hw/pci-host/pnv_phb3.c

   1 /*
   2  * QEMU PowerPC PowerNV (POWER8) PHB3 model
   3  *
   4  * Copyright (c) 2014-2020, IBM Corporation.
   5  *
   6  * This code is licensed under the GPL version 2 or later. See the
   7  * COPYING file in the top-level directory.
   8  */
   9 #include "qemu/osdep.h"
  10 #include "qemu/log.h"
  11 #include "qapi/visitor.h"
  12 #include "qapi/error.h"
  13 #include "hw/pci-host/pnv_phb3_regs.h"
  14 #include "hw/pci-host/pnv_phb.h"
  15 #include "hw/pci-host/pnv_phb3.h"
  16 #include "hw/pci/pcie_host.h"
  17 #include "hw/pci/pcie_port.h"
  18 #include "hw/ppc/pnv.h"
  19 #include "hw/ppc/pnv_chip.h"
  20 #include "hw/irq.h"
  21 #include "hw/qdev-properties.h"
  22 #include "qom/object.h"
  23 #include "sysemu/sysemu.h"
  24
  25 #define phb3_error(phb, fmt, ...)                                       \
  26     qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n",            \
  27                   (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
  28
  29 static PCIDevice *pnv_phb3_find_cfg_dev(PnvPHB3 *phb)
  30 {
  31     PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
  32     uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
  33     uint8_t bus, devfn;
  34
  35     if (!(addr >> 63)) {
  36         return NULL;
  37     }
  38     bus = (addr >> 52) & 0xff;
  39     devfn = (addr >> 44) & 0xff;
  40
  41     return pci_find_device(pci->bus, bus, devfn);
  42 }
  43
  44 /*
  45  * The CONFIG_DATA register expects little endian accesses, but as the
  46  * region is big endian, we have to swap the value.
  47  */
  48 static void pnv_phb3_config_write(PnvPHB3 *phb, unsigned off,
  49                                   unsigned size, uint64_t val)
  50 {
  51     uint32_t cfg_addr, limit;
  52     PCIDevice *pdev;
  53
  54     pdev = pnv_phb3_find_cfg_dev(phb);
  55     if (!pdev) {
  56         return;
  57     }
  58     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
  59     cfg_addr |= off;
  60     limit = pci_config_size(pdev);
  61     if (limit <= cfg_addr) {
  62         /*
  63          * conventional pci device can be behind pcie-to-pci bridge.
  64          * 256 <= addr < 4K has no effects.
  65          */
  66         return;
  67     }
  68     switch (size) {
  69     case 1:
  70         break;
  71     case 2:
  72         val = bswap16(val);
  73         break;
  74     case 4:
  75         val = bswap32(val);
  76         break;
  77     default:
  78         g_assert_not_reached();
  79     }
  80     pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
  81 }
  82
  83 static uint64_t pnv_phb3_config_read(PnvPHB3 *phb, unsigned off,
  84                                      unsigned size)
  85 {
  86     uint32_t cfg_addr, limit;
  87     PCIDevice *pdev;
  88     uint64_t val;
  89
  90     pdev = pnv_phb3_find_cfg_dev(phb);
  91     if (!pdev) {
  92         return ~0ull;
  93     }
  94     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
  95     cfg_addr |= off;
  96     limit = pci_config_size(pdev);
  97     if (limit <= cfg_addr) {
  98         /*
  99          * conventional pci device can be behind pcie-to-pci bridge.
 100          * 256 <= addr < 4K has no effects.
 101          */
 102         return ~0ull;
 103     }
 104     val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
 105     switch (size) {
 106     case 1:
 107         return val;
 108     case 2:
 109         return bswap16(val);
 110     case 4:
 111         return bswap32(val);
 112     default:
 113         g_assert_not_reached();
 114     }
 115 }
 116
 117 static void pnv_phb3_check_m32(PnvPHB3 *phb)
 118 {
 119     uint64_t base, start, size;
 120     MemoryRegion *parent;
 121     PnvPBCQState *pbcq = &phb->pbcq;
 122
 123     if (memory_region_is_mapped(&phb->mr_m32)) {
 124         memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32);
 125     }
 126
 127     if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) {
 128         return;
 129     }
 130
 131     /* Grab geometry from registers */
 132     base = phb->regs[PHB_M32_BASE_ADDR >> 3];
 133     start = phb->regs[PHB_M32_START_ADDR >> 3];
 134     size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1;
 135
 136     /* Check if it matches an enabled MMIO region in the PBCQ */
 137     if (memory_region_is_mapped(&pbcq->mmbar0) &&
 138         base >= pbcq->mmio0_base &&
 139         (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
 140         parent = &pbcq->mmbar0;
 141         base -= pbcq->mmio0_base;
 142     } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
 143                base >= pbcq->mmio1_base &&
 144                (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
 145         parent = &pbcq->mmbar1;
 146         base -= pbcq->mmio1_base;
 147     } else {
 148         return;
 149     }
 150
 151     /* Create alias */
 152     memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32",
 153                              &phb->pci_mmio, start, size);
 154     memory_region_add_subregion(parent, base, &phb->mr_m32);
 155 }
 156
 157 static void pnv_phb3_check_m64(PnvPHB3 *phb, uint32_t index)
 158 {
 159     uint64_t base, start, size, m64;
 160     MemoryRegion *parent;
 161     PnvPBCQState *pbcq = &phb->pbcq;
 162
 163     if (memory_region_is_mapped(&phb->mr_m64[index])) {
 164         /* Should we destroy it in RCU friendly way... ? */
 165         memory_region_del_subregion(phb->mr_m64[index].container,
 166                                     &phb->mr_m64[index]);
 167     }
 168
 169     /* Get table entry */
 170     m64 = phb->ioda_M64BT[index];
 171
 172     if (!(m64 & IODA2_M64BT_ENABLE)) {
 173         return;
 174     }
 175
 176     /* Grab geometry from registers */
 177     base = GETFIELD(IODA2_M64BT_BASE, m64) << 20;
 178     if (m64 & IODA2_M64BT_SINGLE_PE) {
 179         base &= ~0x1ffffffull;
 180     }
 181     size = GETFIELD(IODA2_M64BT_MASK, m64) << 20;
 182     size |= 0xfffc000000000000ull;
 183     size = ~size + 1;
 184     start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
 185
 186     /* Check if it matches an enabled MMIO region in the PBCQ */
 187     if (memory_region_is_mapped(&pbcq->mmbar0) &&
 188         base >= pbcq->mmio0_base &&
 189         (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
 190         parent = &pbcq->mmbar0;
 191         base -= pbcq->mmio0_base;
 192     } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
 193                base >= pbcq->mmio1_base &&
 194                (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
 195         parent = &pbcq->mmbar1;
 196         base -= pbcq->mmio1_base;
 197     } else {
 198         return;
 199     }
 200
 201     /* Create alias */
 202     memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64",
 203                              &phb->pci_mmio, start, size);
 204     memory_region_add_subregion(parent, base, &phb->mr_m64[index]);
 205 }
 206
 207 static void pnv_phb3_check_all_m64s(PnvPHB3 *phb)
 208 {
 209     uint64_t i;
 210
 211     for (i = 0; i < PNV_PHB3_NUM_M64; i++) {
 212         pnv_phb3_check_m64(phb, i);
 213     }
 214 }
 215
 216 static void pnv_phb3_lxivt_write(PnvPHB3 *phb, unsigned idx, uint64_t val)
 217 {
 218     uint8_t server, prio;
 219
 220     phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER |
 221                                   IODA2_LXIVT_PRIORITY |
 222                                   IODA2_LXIVT_NODE_ID);
 223     server = GETFIELD(IODA2_LXIVT_SERVER, val);
 224     prio = GETFIELD(IODA2_LXIVT_PRIORITY, val);
 225
 226     /*
 227      * The low order 2 bits are the link pointer (Type II interrupts).
 228      * Shift back to get a valid IRQ server.
 229      */
 230     server >>= 2;
 231
 232     ics_write_xive(&phb->lsis, idx, server, prio, prio);
 233 }
 234
 235 static uint64_t *pnv_phb3_ioda_access(PnvPHB3 *phb,
 236                                       unsigned *out_table, unsigned *out_idx)
 237 {
 238     uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
 239     unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
 240     unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
 241     unsigned int mask;
 242     uint64_t *tptr = NULL;
 243
 244     switch (table) {
 245     case IODA2_TBL_LIST:
 246         tptr = phb->ioda_LIST;
 247         mask = 7;
 248         break;
 249     case IODA2_TBL_LXIVT:
 250         tptr = phb->ioda_LXIVT;
 251         mask = 7;
 252         break;
 253     case IODA2_TBL_IVC_CAM:
 254     case IODA2_TBL_RBA:
 255         mask = 31;
 256         break;
 257     case IODA2_TBL_RCAM:
 258         mask = 63;
 259         break;
 260     case IODA2_TBL_MRT:
 261         mask = 7;
 262         break;
 263     case IODA2_TBL_PESTA:
 264     case IODA2_TBL_PESTB:
 265         mask = 255;
 266         break;
 267     case IODA2_TBL_TVT:
 268         tptr = phb->ioda_TVT;
 269         mask = 511;
 270         break;
 271     case IODA2_TBL_TCAM:
 272     case IODA2_TBL_TDR:
 273         mask = 63;
 274         break;
 275     case IODA2_TBL_M64BT:
 276         tptr = phb->ioda_M64BT;
 277         mask = 15;
 278         break;
 279     case IODA2_TBL_M32DT:
 280         tptr = phb->ioda_MDT;
 281         mask = 255;
 282         break;
 283     case IODA2_TBL_PEEV:
 284         tptr = phb->ioda_PEEV;
 285         mask = 3;
 286         break;
 287     default:
 288         phb3_error(phb, "invalid IODA table %d", table);
 289         return NULL;
 290     }
 291     index &= mask;
 292     if (out_idx) {
 293         *out_idx = index;
 294     }
 295     if (out_table) {
 296         *out_table = table;
 297     }
 298     if (tptr) {
 299         tptr += index;
 300     }
 301     if (adreg & PHB_IODA_AD_AUTOINC) {
 302         index = (index + 1) & mask;
 303         adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
 304     }
 305     phb->regs[PHB_IODA_ADDR >> 3] = adreg;
 306     return tptr;
 307 }
 308
 309 static uint64_t pnv_phb3_ioda_read(PnvPHB3 *phb)
 310 {
 311         unsigned table;
 312         uint64_t *tptr;
 313
 314         tptr = pnv_phb3_ioda_access(phb, &table, NULL);
 315         if (!tptr) {
 316             /* Return 0 on unsupported tables, not ff's */
 317             return 0;
 318         }
 319         return *tptr;
 320 }
 321
 322 static void pnv_phb3_ioda_write(PnvPHB3 *phb, uint64_t val)
 323 {
 324         unsigned table, idx;
 325         uint64_t *tptr;
 326
 327         tptr = pnv_phb3_ioda_access(phb, &table, &idx);
 328         if (!tptr) {
 329             return;
 330         }
 331
 332         /* Handle side effects */
 333         switch (table) {
 334         case IODA2_TBL_LXIVT:
 335             pnv_phb3_lxivt_write(phb, idx, val);
 336             break;
 337         case IODA2_TBL_M64BT:
 338             *tptr = val;
 339             pnv_phb3_check_m64(phb, idx);
 340             break;
 341         default:
 342             *tptr = val;
 343         }
 344 }
 345
 346 /*
 347  * This is called whenever the PHB LSI, MSI source ID register or
 348  * the PBCQ irq filters are written.
 349  */
 350 void pnv_phb3_remap_irqs(PnvPHB3 *phb)
 351 {
 352     ICSState *ics = &phb->lsis;
 353     uint32_t local, global, count, mask, comp;
 354     uint64_t baren;
 355     PnvPBCQState *pbcq = &phb->pbcq;
 356
 357     /*
 358      * First check if we are enabled. Unlike real HW we don't separate
 359      * TX and RX so we enable if both are set
 360      */
 361     baren = pbcq->nest_regs[PBCQ_NEST_BAR_EN];
 362     if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) ||
 363         !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) {
 364         ics->offset = 0;
 365         return;
 366     }
 367
 368     /* Grab local LSI source ID */
 369     local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3;
 370
 371     /* Grab global one and compare */
 372     global = GETFIELD(PBCQ_NEST_LSI_SRC,
 373                       pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3;
 374     if (global != local) {
 375         /*
 376          * This happens during initialization, let's come back when we
 377          * are properly configured
 378          */
 379         ics->offset = 0;
 380         return;
 381     }
 382
 383     /* Get the base on the powerbus */
 384     comp = GETFIELD(PBCQ_NEST_IRSN_COMP,
 385                     pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]);
 386     mask = GETFIELD(PBCQ_NEST_IRSN_COMP,
 387                     pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]);
 388     count = ((~mask) + 1) & 0x7ffff;
 389     phb->total_irq = count;
 390
 391     /* Sanity checks */
 392     if ((global + PNV_PHB3_NUM_LSI) > count) {
 393         phb3_error(phb, "LSIs out of reach: LSI base=%d total irq=%d", global,
 394                    count);
 395     }
 396
 397     if (count > 2048) {
 398         phb3_error(phb, "More interrupts than supported: %d", count);
 399     }
 400
 401     if ((comp & mask) != comp) {
 402         phb3_error(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x",
 403                    comp, mask);
 404         comp &= mask;
 405     }
 406     /* Setup LSI offset */
 407     ics->offset = comp + global;
 408
 409     /* Setup MSI offset */
 410     pnv_phb3_msi_update_config(&phb->msis, comp, count - PNV_PHB3_NUM_LSI);
 411 }
 412
 413 static void pnv_phb3_lsi_src_id_write(PnvPHB3 *phb, uint64_t val)
 414 {
 415     /* Sanitize content */
 416     val &= PHB_LSI_SRC_ID;
 417     phb->regs[PHB_LSI_SOURCE_ID >> 3] = val;
 418     pnv_phb3_remap_irqs(phb);
 419 }
 420
 421 static void pnv_phb3_rtc_invalidate(PnvPHB3 *phb, uint64_t val)
 422 {
 423     PnvPhb3DMASpace *ds;
 424
 425     /* Always invalidate all for now ... */
 426     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
 427         ds->pe_num = PHB_INVALID_PE;
 428     }
 429 }
 430
 431
 432 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds)
 433 {
 434     uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
 435
 436     if (cfg & PHB_PHB3C_32BIT_MSI_EN) {
 437         if (!memory_region_is_mapped(&ds->msi32_mr)) {
 438             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
 439                                         0xffff0000, &ds->msi32_mr);
 440         }
 441     } else {
 442         if (memory_region_is_mapped(&ds->msi32_mr)) {
 443             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
 444                                         &ds->msi32_mr);
 445         }
 446     }
 447
 448     if (cfg & PHB_PHB3C_64BIT_MSI_EN) {
 449         if (!memory_region_is_mapped(&ds->msi64_mr)) {
 450             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
 451                                         (1ull << 60), &ds->msi64_mr);
 452         }
 453     } else {
 454         if (memory_region_is_mapped(&ds->msi64_mr)) {
 455             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
 456                                         &ds->msi64_mr);
 457         }
 458     }
 459 }
 460
 461 static void pnv_phb3_update_all_msi_regions(PnvPHB3 *phb)
 462 {
 463     PnvPhb3DMASpace *ds;
 464
 465     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
 466         pnv_phb3_update_msi_regions(ds);
 467     }
 468 }
 469
 470 void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size)
 471 {
 472     PnvPHB3 *phb = opaque;
 473     bool changed;
 474
 475     /* Special case configuration data */
 476     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
 477         pnv_phb3_config_write(phb, off & 0x3, size, val);
 478         return;
 479     }
 480
 481     /* Other registers are 64-bit only */
 482     if (size != 8 || off & 0x7) {
 483         phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
 484                    off, size);
 485         return;
 486     }
 487
 488     /* Handle masking & filtering */
 489     switch (off) {
 490     case PHB_M64_UPPER_BITS:
 491         val &= 0xfffc000000000000ull;
 492         break;
 493     case PHB_Q_DMA_R:
 494         /*
 495          * This is enough logic to make SW happy but we aren't actually
 496          * quiescing the DMAs
 497          */
 498         if (val & PHB_Q_DMA_R_AUTORESET) {
 499             val = 0;
 500         } else {
 501             val &= PHB_Q_DMA_R_QUIESCE_DMA;
 502         }
 503         break;
 504     /* LEM stuff */
 505     case PHB_LEM_FIR_AND_MASK:
 506         phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
 507         return;
 508     case PHB_LEM_FIR_OR_MASK:
 509         phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
 510         return;
 511     case PHB_LEM_ERROR_AND_MASK:
 512         phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
 513         return;
 514     case PHB_LEM_ERROR_OR_MASK:
 515         phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
 516         return;
 517     case PHB_LEM_WOF:
 518         val = 0;
 519         break;
 520     }
 521
 522     /* Record whether it changed */
 523     changed = phb->regs[off >> 3] != val;
 524
 525     /* Store in register cache first */
 526     phb->regs[off >> 3] = val;
 527
 528     /* Handle side effects */
 529     switch (off) {
 530     case PHB_PHB3_CONFIG:
 531         if (changed) {
 532             pnv_phb3_update_all_msi_regions(phb);
 533         }
 534         /* fall through */
 535     case PHB_M32_BASE_ADDR:
 536     case PHB_M32_BASE_MASK:
 537     case PHB_M32_START_ADDR:
 538         if (changed) {
 539             pnv_phb3_check_m32(phb);
 540         }
 541         break;
 542     case PHB_M64_UPPER_BITS:
 543         if (changed) {
 544             pnv_phb3_check_all_m64s(phb);
 545         }
 546         break;
 547     case PHB_LSI_SOURCE_ID:
 548         if (changed) {
 549             pnv_phb3_lsi_src_id_write(phb, val);
 550         }
 551         break;
 552
 553     /* IODA table accesses */
 554     case PHB_IODA_DATA0:
 555         pnv_phb3_ioda_write(phb, val);
 556         break;
 557
 558     /* RTC invalidation */
 559     case PHB_RTC_INVALIDATE:
 560         pnv_phb3_rtc_invalidate(phb, val);
 561         break;
 562
 563     /* FFI request */
 564     case PHB_FFI_REQUEST:
 565         pnv_phb3_msi_ffi(&phb->msis, val);
 566         break;
 567
 568     /* Silent simple writes */
 569     case PHB_CONFIG_ADDRESS:
 570     case PHB_IODA_ADDR:
 571     case PHB_TCE_KILL:
 572     case PHB_TCE_SPEC_CTL:
 573     case PHB_PEST_BAR:
 574     case PHB_PELTV_BAR:
 575     case PHB_RTT_BAR:
 576     case PHB_RBA_BAR:
 577     case PHB_IVT_BAR:
 578     case PHB_FFI_LOCK:
 579     case PHB_LEM_FIR_ACCUM:
 580     case PHB_LEM_ERROR_MASK:
 581     case PHB_LEM_ACTION0:
 582     case PHB_LEM_ACTION1:
 583         break;
 584
 585     /* Noise on anything else */
 586     default:
 587         qemu_log_mask(LOG_UNIMP, "phb3: reg_write 0x%"PRIx64"=%"PRIx64"\n",
 588                       off, val);
 589     }
 590 }
 591
 592 uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size)
 593 {
 594     PnvPHB3 *phb = opaque;
 595     PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
 596     uint64_t val;
 597
 598     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
 599         return pnv_phb3_config_read(phb, off & 0x3, size);
 600     }
 601
 602     /* Other registers are 64-bit only */
 603     if (size != 8 || off & 0x7) {
 604         phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
 605                    off, size);
 606         return ~0ull;
 607     }
 608
 609     /* Default read from cache */
 610     val = phb->regs[off >> 3];
 611
 612     switch (off) {
 613     /* Simulate venice DD2.0 */
 614     case PHB_VERSION:
 615         return 0x000000a300000005ull;
 616     case PHB_PCIE_SYSTEM_CONFIG:
 617         return 0x441100fc30000000;
 618
 619     /* IODA table accesses */
 620     case PHB_IODA_DATA0:
 621         return pnv_phb3_ioda_read(phb);
 622
 623     /* Link training always appears trained */
 624     case PHB_PCIE_DLP_TRAIN_CTL:
 625         if (!pci_find_device(pci->bus, 1, 0)) {
 626             return 0;
 627         }
 628         return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT;
 629
 630     /* FFI Lock */
 631     case PHB_FFI_LOCK:
 632         /* Set lock and return previous value */
 633         phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE;
 634         return val;
 635
 636     /* DMA read sync: make it look like it's complete */
 637     case PHB_DMARD_SYNC:
 638         return PHB_DMARD_SYNC_COMPLETE;
 639
 640     /* Silent simple reads */
 641     case PHB_PHB3_CONFIG:
 642     case PHB_M32_BASE_ADDR:
 643     case PHB_M32_BASE_MASK:
 644     case PHB_M32_START_ADDR:
 645     case PHB_CONFIG_ADDRESS:
 646     case PHB_IODA_ADDR:
 647     case PHB_RTC_INVALIDATE:
 648     case PHB_TCE_KILL:
 649     case PHB_TCE_SPEC_CTL:
 650     case PHB_PEST_BAR:
 651     case PHB_PELTV_BAR:
 652     case PHB_RTT_BAR:
 653     case PHB_RBA_BAR:
 654     case PHB_IVT_BAR:
 655     case PHB_M64_UPPER_BITS:
 656     case PHB_LEM_FIR_ACCUM:
 657     case PHB_LEM_ERROR_MASK:
 658     case PHB_LEM_ACTION0:
 659     case PHB_LEM_ACTION1:
 660         break;
 661
 662     /* Noise on anything else */
 663     default:
 664         qemu_log_mask(LOG_UNIMP, "phb3: reg_read 0x%"PRIx64"=%"PRIx64"\n",
 665                       off, val);
 666     }
 667     return val;
 668 }
 669
 670 static const MemoryRegionOps pnv_phb3_reg_ops = {
 671     .read = pnv_phb3_reg_read,
 672     .write = pnv_phb3_reg_write,
 673     .valid.min_access_size = 1,
 674     .valid.max_access_size = 8,
 675     .impl.min_access_size = 1,
 676     .impl.max_access_size = 8,
 677     .endianness = DEVICE_BIG_ENDIAN,
 678 };
 679
 680 static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num)
 681 {
 682     /* Check that out properly ... */
 683     return irq_num & 3;
 684 }
 685
 686 static void pnv_phb3_set_irq(void *opaque, int irq_num, int level)
 687 {
 688     PnvPHB3 *phb = opaque;
 689
 690     /* LSI only ... */
 691     if (irq_num > 3) {
 692         phb3_error(phb, "Unknown IRQ to set %d", irq_num);
 693     }
 694     qemu_set_irq(phb->qirqs[irq_num], level);
 695 }
 696
 697 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds)
 698 {
 699     uint64_t rtt, addr;
 700     uint16_t rte;
 701     int bus_num;
 702
 703     /* Already resolved ? */
 704     if (ds->pe_num != PHB_INVALID_PE) {
 705         return true;
 706     }
 707
 708     /* We need to lookup the RTT */
 709     rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
 710     if (!(rtt & PHB_RTT_BAR_ENABLE)) {
 711         phb3_error(ds->phb, "DMA with RTT BAR disabled !");
 712         /* Set error bits ? fence ? ... */
 713         return false;
 714     }
 715
 716     /* Read RTE */
 717     bus_num = pci_bus_num(ds->bus);
 718     addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
 719     addr += 2 * ((bus_num << 8) | ds->devfn);
 720     if (dma_memory_read(&address_space_memory, addr, &rte,
 721                         sizeof(rte), MEMTXATTRS_UNSPECIFIED)) {
 722         phb3_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
 723         /* Set error bits ? fence ? ... */
 724         return false;
 725     }
 726     rte = be16_to_cpu(rte);
 727
 728     /* Fail upon reading of invalid PE# */
 729     if (rte >= PNV_PHB3_NUM_PE) {
 730         phb3_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
 731         /* Set error bits ? fence ? ... */
 732         return false;
 733     }
 734     ds->pe_num = rte;
 735     return true;
 736 }
 737
 738 static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr,
 739                                    bool is_write, uint64_t tve,
 740                                    IOMMUTLBEntry *tlb)
 741 {
 742     uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve);
 743     int32_t  lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve);
 744     uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve);
 745     uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve);
 746     PnvPHB3 *phb = ds->phb;
 747
 748     /* Invalid levels */
 749     if (lev > 4) {
 750         phb3_error(phb, "Invalid #levels in TVE %d", lev);
 751         return;
 752     }
 753
 754     /* IO Page Size of 0 means untranslated, else use TCEs */
 755     if (tps == 0) {
 756         /*
 757          * We only support non-translate in top window.
 758          *
 759          * TODO: Venice/Murano support it on bottom window above 4G and
 760          * Naples supports it on everything
 761          */
 762         if (!(tve & PPC_BIT(51))) {
 763             phb3_error(phb, "xlate for invalid non-translate TVE");
 764             return;
 765         }
 766         /* TODO: Handle boundaries */
 767
 768         /* Use 4k pages like q35 ... for now */
 769         tlb->iova = addr & 0xfffffffffffff000ull;
 770         tlb->translated_addr = addr & 0x0003fffffffff000ull;
 771         tlb->addr_mask = 0xfffull;
 772         tlb->perm = IOMMU_RW;
 773     } else {
 774         uint32_t tce_shift, tbl_shift, sh;
 775         uint64_t base, taddr, tce, tce_mask;
 776
 777         /* TVE disabled ? */
 778         if (tts == 0) {
 779             phb3_error(phb, "xlate for invalid translated TVE");
 780             return;
 781         }
 782
 783         /* Address bits per bottom level TCE entry */
 784         tce_shift = tps + 11;
 785
 786         /* Address bits per table level */
 787         tbl_shift = tts + 8;
 788
 789         /* Top level table base address */
 790         base = tta << 12;
 791
 792         /* Total shift to first level */
 793         sh = tbl_shift * lev + tce_shift;
 794
 795         /* TODO: Multi-level untested */
 796         do {
 797             lev--;
 798
 799             /* Grab the TCE address */
 800             taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
 801             if (dma_memory_read(&address_space_memory, taddr, &tce,
 802                                 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) {
 803                 phb3_error(phb, "Failed to read TCE at 0x%"PRIx64, taddr);
 804                 return;
 805             }
 806             tce = be64_to_cpu(tce);
 807
 808             /* Check permission for indirect TCE */
 809             if ((lev >= 0) && !(tce & 3)) {
 810                 phb3_error(phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
 811                 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
 812                            is_write ? 'W' : 'R', tve);
 813                 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
 814                            tta, lev, tts, tps);
 815                 return;
 816             }
 817             sh -= tbl_shift;
 818             base = tce & ~0xfffull;
 819         } while (lev >= 0);
 820
 821         /* We exit the loop with TCE being the final TCE */
 822         if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
 823             phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr);
 824             phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
 825                        is_write ? 'W' : 'R', tve);
 826             phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
 827                        tta, lev, tts, tps);
 828             return;
 829         }
 830         tce_mask = ~((1ull << tce_shift) - 1);
 831         tlb->iova = addr & tce_mask;
 832         tlb->translated_addr = tce & tce_mask;
 833         tlb->addr_mask = ~tce_mask;
 834         tlb->perm = tce & 3;
 835     }
 836 }
 837
 838 static IOMMUTLBEntry pnv_phb3_translate_iommu(IOMMUMemoryRegion *iommu,
 839                                               hwaddr addr,
 840                                               IOMMUAccessFlags flag,
 841                                               int iommu_idx)
 842 {
 843     PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr);
 844     int tve_sel;
 845     uint64_t tve, cfg;
 846     IOMMUTLBEntry ret = {
 847         .target_as = &address_space_memory,
 848         .iova = addr,
 849         .translated_addr = 0,
 850         .addr_mask = ~(hwaddr)0,
 851         .perm = IOMMU_NONE,
 852     };
 853     PnvPHB3 *phb = ds->phb;
 854
 855     /* Resolve PE# */
 856     if (!pnv_phb3_resolve_pe(ds)) {
 857         phb3_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
 858                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
 859         return ret;
 860     }
 861
 862     /* Check top bits */
 863     switch (addr >> 60) {
 864     case 00:
 865         /* DMA or 32-bit MSI ? */
 866         cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
 867         if ((cfg & PHB_PHB3C_32BIT_MSI_EN) &&
 868             ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
 869             phb3_error(phb, "xlate on 32-bit MSI region");
 870             return ret;
 871         }
 872         /* Choose TVE XXX Use PHB3 Control Register */
 873         tve_sel = (addr >> 59) & 1;
 874         tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
 875         pnv_phb3_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
 876         break;
 877     case 01:
 878         phb3_error(phb, "xlate on 64-bit MSI region");
 879         break;
 880     default:
 881         phb3_error(phb, "xlate on unsupported address 0x%"PRIx64, addr);
 882     }
 883     return ret;
 884 }
 885
 886 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region"
 887 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB3_IOMMU_MEMORY_REGION,
 888                          TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)
 889
 890 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass,
 891                                                     void *data)
 892 {
 893     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 894
 895     imrc->translate = pnv_phb3_translate_iommu;
 896 }
 897
 898 static const TypeInfo pnv_phb3_iommu_memory_region_info = {
 899     .parent = TYPE_IOMMU_MEMORY_REGION,
 900     .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
 901     .class_init = pnv_phb3_iommu_memory_region_class_init,
 902 };
 903
 904 /*
 905  * MSI/MSIX memory region implementation.
 906  * The handler handles both MSI and MSIX.
 907  */
 908 static void pnv_phb3_msi_write(void *opaque, hwaddr addr,
 909                                uint64_t data, unsigned size)
 910 {
 911     PnvPhb3DMASpace *ds = opaque;
 912
 913     /* Resolve PE# */
 914     if (!pnv_phb3_resolve_pe(ds)) {
 915         phb3_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
 916                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
 917         return;
 918     }
 919
 920     pnv_phb3_msi_send(&ds->phb->msis, addr, data, ds->pe_num);
 921 }
 922
 923 /* There is no .read as the read result is undefined by PCI spec */
 924 static uint64_t pnv_phb3_msi_read(void *opaque, hwaddr addr, unsigned size)
 925 {
 926     PnvPhb3DMASpace *ds = opaque;
 927
 928     phb3_error(ds->phb, "invalid read @ 0x%" HWADDR_PRIx, addr);
 929     return -1;
 930 }
 931
 932 static const MemoryRegionOps pnv_phb3_msi_ops = {
 933     .read = pnv_phb3_msi_read,
 934     .write = pnv_phb3_msi_write,
 935     .endianness = DEVICE_LITTLE_ENDIAN
 936 };
 937
 938 static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn)
 939 {
 940     PnvPHB3 *phb = opaque;
 941     PnvPhb3DMASpace *ds;
 942
 943     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
 944         if (ds->bus == bus && ds->devfn == devfn) {
 945             break;
 946         }
 947     }
 948
 949     if (ds == NULL) {
 950         ds = g_new0(PnvPhb3DMASpace, 1);
 951         ds->bus = bus;
 952         ds->devfn = devfn;
 953         ds->pe_num = PHB_INVALID_PE;
 954         ds->phb = phb;
 955         memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
 956                                  TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
 957                                  OBJECT(phb), "phb3_iommu", UINT64_MAX);
 958         address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
 959                            "phb3_iommu");
 960         memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops,
 961                               ds, "msi32", 0x10000);
 962         memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops,
 963                               ds, "msi64", 0x100000);
 964         pnv_phb3_update_msi_regions(ds);
 965
 966         QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
 967     }
 968     return &ds->dma_as;
 969 }
 970
 971 static PCIIOMMUOps pnv_phb3_iommu_ops = {
 972     .get_address_space = pnv_phb3_dma_iommu,
 973 };
 974
 975 static void pnv_phb3_instance_init(Object *obj)
 976 {
 977     PnvPHB3 *phb = PNV_PHB3(obj);
 978
 979     QLIST_INIT(&phb->dma_spaces);
 980
 981     /* LSI sources */
 982     object_initialize_child(obj, "lsi", &phb->lsis, TYPE_ICS);
 983
 984     /* Default init ... will be fixed by HW inits */
 985     phb->lsis.offset = 0;
 986
 987     /* MSI sources */
 988     object_initialize_child(obj, "msi", &phb->msis, TYPE_PHB3_MSI);
 989
 990     /* Power Bus Common Queue */
 991     object_initialize_child(obj, "pbcq", &phb->pbcq, TYPE_PNV_PBCQ);
 992
 993 }
 994
 995 void pnv_phb3_bus_init(DeviceState *dev, PnvPHB3 *phb)
 996 {
 997     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
 998
 999     /*
1000      * PHB3 doesn't support IO space. However, qemu gets very upset if
1001      * we don't have an IO region to anchor IO BARs onto so we just
1002      * initialize one which we never hook up to anything
1003      */
1004     memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000);
1005     memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio",
1006                        PCI_MMIO_TOTAL_SIZE);
1007
1008     pci->bus = pci_register_root_bus(dev,
1009                                      dev->id ? dev->id : NULL,
1010                                      pnv_phb3_set_irq, pnv_phb3_map_irq, phb,
1011                                      &phb->pci_mmio, &phb->pci_io,
1012                                      0, 4, TYPE_PNV_PHB3_ROOT_BUS);
1013
1014     object_property_set_int(OBJECT(pci->bus), "phb-id", phb->phb_id,
1015                             &error_abort);
1016     object_property_set_int(OBJECT(pci->bus), "chip-id", phb->chip_id,
1017                             &error_abort);
1018
1019     pci_setup_iommu(pci->bus, &pnv_phb3_iommu_ops, phb);
1020 }
1021
1022 static void pnv_phb3_realize(DeviceState *dev, Error **errp)
1023 {
1024     PnvPHB3 *phb = PNV_PHB3(dev);
1025     PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
1026     int i;
1027
1028     if (phb->phb_id >= PNV_CHIP_GET_CLASS(phb->chip)->num_phbs) {
1029         error_setg(errp, "invalid PHB index: %d", phb->phb_id);
1030         return;
1031     }
1032
1033     /* LSI sources */
1034     object_property_set_link(OBJECT(&phb->lsis), "xics", OBJECT(pnv),
1035                              &error_abort);
1036     object_property_set_int(OBJECT(&phb->lsis), "nr-irqs", PNV_PHB3_NUM_LSI,
1037                             &error_abort);
1038     if (!qdev_realize(DEVICE(&phb->lsis), NULL, errp)) {
1039         return;
1040     }
1041
1042     for (i = 0; i < phb->lsis.nr_irqs; i++) {
1043         ics_set_irq_type(&phb->lsis, i, true);
1044     }
1045
1046     phb->qirqs = qemu_allocate_irqs(ics_set_irq, &phb->lsis, phb->lsis.nr_irqs);
1047
1048     /* MSI sources */
1049     object_property_set_link(OBJECT(&phb->msis), "phb", OBJECT(phb),
1050                              &error_abort);
1051     object_property_set_link(OBJECT(&phb->msis), "xics", OBJECT(pnv),
1052                              &error_abort);
1053     object_property_set_int(OBJECT(&phb->msis), "nr-irqs", PHB3_MAX_MSI,
1054                             &error_abort);
1055     if (!qdev_realize(DEVICE(&phb->msis), NULL, errp)) {
1056         return;
1057     }
1058
1059     /* Power Bus Common Queue */
1060     object_property_set_link(OBJECT(&phb->pbcq), "phb", OBJECT(phb),
1061                              &error_abort);
1062     if (!qdev_realize(DEVICE(&phb->pbcq), NULL, errp)) {
1063         return;
1064     }
1065
1066     /* Controller Registers */
1067     memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb,
1068                           "phb3-regs", 0x1000);
1069 }
1070
1071 void pnv_phb3_update_regions(PnvPHB3 *phb)
1072 {
1073     PnvPBCQState *pbcq = &phb->pbcq;
1074
1075     /* Unmap first always */
1076     if (memory_region_is_mapped(&phb->mr_regs)) {
1077         memory_region_del_subregion(&pbcq->phbbar, &phb->mr_regs);
1078     }
1079
1080     /* Map registers if enabled */
1081     if (memory_region_is_mapped(&pbcq->phbbar)) {
1082         /* TODO: We should use the PHB BAR 2 register but we don't ... */
1083         memory_region_add_subregion(&pbcq->phbbar, 0, &phb->mr_regs);
1084     }
1085
1086     /* Check/update m32 */
1087     if (memory_region_is_mapped(&phb->mr_m32)) {
1088         pnv_phb3_check_m32(phb);
1089     }
1090     pnv_phb3_check_all_m64s(phb);
1091 }
1092
1093 static Property pnv_phb3_properties[] = {
1094     DEFINE_PROP_UINT32("index", PnvPHB3, phb_id, 0),
1095     DEFINE_PROP_UINT32("chip-id", PnvPHB3, chip_id, 0),
1096     DEFINE_PROP_LINK("chip", PnvPHB3, chip, TYPE_PNV_CHIP, PnvChip *),
1097     DEFINE_PROP_LINK("phb-base", PnvPHB3, phb_base, TYPE_PNV_PHB, PnvPHB *),
1098     DEFINE_PROP_END_OF_LIST(),
1099 };
1100
1101 static void pnv_phb3_class_init(ObjectClass *klass, void *data)
1102 {
1103     DeviceClass *dc = DEVICE_CLASS(klass);
1104
1105     dc->realize = pnv_phb3_realize;
1106     device_class_set_props(dc, pnv_phb3_properties);
1107     dc->user_creatable = false;
1108 }
1109
1110 static const TypeInfo pnv_phb3_type_info = {
1111     .name          = TYPE_PNV_PHB3,
1112     .parent        = TYPE_DEVICE,
1113     .instance_size = sizeof(PnvPHB3),
1114     .class_init    = pnv_phb3_class_init,
1115     .instance_init = pnv_phb3_instance_init,
1116 };
1117
1118 static void pnv_phb3_root_bus_get_prop(Object *obj, Visitor *v,
1119                                        const char *name,
1120                                        void *opaque, Error **errp)
1121 {
1122     PnvPHB3RootBus *bus = PNV_PHB3_ROOT_BUS(obj);
1123     uint64_t value = 0;
1124
1125     if (strcmp(name, "phb-id") == 0) {
1126         value = bus->phb_id;
1127     } else {
1128         value = bus->chip_id;
1129     }
1130
1131     visit_type_size(v, name, &value, errp);
1132 }
1133
1134 static void pnv_phb3_root_bus_set_prop(Object *obj, Visitor *v,
1135                                        const char *name,
1136                                        void *opaque, Error **errp)
1137
1138 {
1139     PnvPHB3RootBus *bus = PNV_PHB3_ROOT_BUS(obj);
1140     uint64_t value;
1141
1142     if (!visit_type_size(v, name, &value, errp)) {
1143         return;
1144     }
1145
1146     if (strcmp(name, "phb-id") == 0) {
1147         bus->phb_id = value;
1148     } else {
1149         bus->chip_id = value;
1150     }
1151 }
1152
1153 static void pnv_phb3_root_bus_class_init(ObjectClass *klass, void *data)
1154 {
1155     BusClass *k = BUS_CLASS(klass);
1156
1157     object_class_property_add(klass, "phb-id", "int",
1158                               pnv_phb3_root_bus_get_prop,
1159                               pnv_phb3_root_bus_set_prop,
1160                               NULL, NULL);
1161
1162     object_class_property_add(klass, "chip-id", "int",
1163                               pnv_phb3_root_bus_get_prop,
1164                               pnv_phb3_root_bus_set_prop,
1165                               NULL, NULL);
1166
1167     /*
1168      * PHB3 has only a single root complex. Enforce the limit on the
1169      * parent bus
1170      */
1171     k->max_dev = 1;
1172 }
1173
1174 static const TypeInfo pnv_phb3_root_bus_info = {
1175     .name = TYPE_PNV_PHB3_ROOT_BUS,
1176     .parent = TYPE_PCIE_BUS,
1177     .instance_size = sizeof(PnvPHB3RootBus),
1178     .class_init = pnv_phb3_root_bus_class_init,
1179 };
1180
1181 static void pnv_phb3_register_types(void)
1182 {
1183     type_register_static(&pnv_phb3_root_bus_info);
1184     type_register_static(&pnv_phb3_type_info);
1185     type_register_static(&pnv_phb3_iommu_memory_region_info);
1186 }
1187
1188 type_init(pnv_phb3_register_types)