This is a model of the PCIe host bridge found on Power8 chips,
including IOMMU support, PCIe root complex etc...
This implementation doesn't emulate the EEH error handling (and
may never do).
Signed-off-by: Benjamin Herrenschmidt <b...@kernel.crashing.org>
---
hw/intc/xics.c | 2 +-
hw/pci-host/Makefile.objs | 2 +
hw/pci-host/pnv_phb3.c | 1083 +++++++++++++++++++++++++++++++++++
hw/pci-host/pnv_phb3_msi.c | 338 +++++++++++
hw/pci-host/pnv_phb3_pbcq.c | 314 ++++++++++
hw/pci-host/pnv_phb3_rc.c | 132 +++++
hw/ppc/pnv.c | 22 +-
include/hw/pci-host/pnv_phb3.h | 145 +++++
include/hw/pci-host/pnv_phb3_regs.h | 505 ++++++++++++++++
include/hw/ppc/pnv.h | 3 +
include/hw/ppc/xics.h | 1 +
11 files changed, 2543 insertions(+), 4 deletions(-)
create mode 100644 hw/pci-host/pnv_phb3.c
create mode 100644 hw/pci-host/pnv_phb3_msi.c
create mode 100644 hw/pci-host/pnv_phb3_pbcq.c
create mode 100644 hw/pci-host/pnv_phb3_rc.c
create mode 100644 include/hw/pci-host/pnv_phb3.h
create mode 100644 include/hw/pci-host/pnv_phb3_regs.h
diff --git a/hw/intc/xics.c b/hw/intc/xics.c
index d027a24..eaeb1e1 100644
--- a/hw/intc/xics.c
+++ b/hw/intc/xics.c
@@ -341,7 +341,7 @@ void icp_eoi(XICSState *xics, int server, uint32_t xirr)
}
}
-static void icp_irq(ICSState *ics, int server, int nr, uint8_t priority)
+void icp_irq(ICSState *ics, int server, int nr, uint8_t priority)
{
XICSState *xics = ics->xics;
ICPState *ss = xics->ss + server;
diff --git a/hw/pci-host/Makefile.objs b/hw/pci-host/Makefile.objs
index 45f1f0e..961fe5b 100644
--- a/hw/pci-host/Makefile.objs
+++ b/hw/pci-host/Makefile.objs
@@ -16,3 +16,5 @@ common-obj-$(CONFIG_FULONG) += bonito.o
common-obj-$(CONFIG_PCI_PIIX) += piix.o
common-obj-$(CONFIG_PCI_Q35) += q35.o
common-obj-$(CONFIG_PCI_GENERIC) += gpex.o
+
+obj-$(CONFIG_POWERNV) += pnv_phb3.o pnv_phb3_pbcq.o pnv_phb3_rc.o
pnv_phb3_msi.o
diff --git a/hw/pci-host/pnv_phb3.c b/hw/pci-host/pnv_phb3.c
new file mode 100644
index 0000000..1136003
--- /dev/null
+++ b/hw/pci-host/pnv_phb3.c
@@ -0,0 +1,1083 @@
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ *
+ * Copyright IBM Corp. 2014
+ */
+#include "hw/pci-host/pnv_phb3.h"
+#include "hw/pci/pci_bridge.h"
+#include "hw/pci/pci_bus.h"
+#include "hw/ppc/xics.h"
+
+#define DBG_ERR(p, fmt, ...) do { \
+ if (1) fprintf(stderr, "PHB3(%s): " fmt "\n", __func__, ## __VA_ARGS__); \
+ } while(0)
+
+#define DBG_DMA(p, fmt, ...) do { \
+ if (0) fprintf(stderr, "PHB3(%s): " fmt "\n", __func__, ## __VA_ARGS__); \
+ } while(0)
+
+#define DBG_MAP(p, fmt, ...) do { \
+ if (0) fprintf(stderr, "PHB3(%s): " fmt "\n", __func__, ## __VA_ARGS__); \
+ } while(0)
+
+//#define DISPLAY_UNIMPLENTED_REG
+
+static PCIDevice *pnb_phb3_find_cfg_dev(PnvPhb3State *phb)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(phb);
+ uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
+ uint8_t bus, devfn;
+
+ if (!(addr >> 63)) {
+ return NULL;
+ }
+ bus = (addr >> 52) & 0xff;
+ devfn = (addr >> 44) & 0xff;
+
+ return pci_find_device(pci->bus, bus, devfn);
+}
+
+static void pnv_phb3_config_write(PnvPhb3State *phb, unsigned off,
+ unsigned size, uint64_t val)
+{
+ uint32_t cfg_addr, limit;
+ PCIDevice *pdev;
+
+ pdev = pnb_phb3_find_cfg_dev(phb);
+ if (!pdev) {
+ return;
+ }
+ cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xfff;
+ cfg_addr |= off;
+ limit = pci_config_size(pdev);
+ if (limit <= cfg_addr) {
+ /* conventional pci device can be behind pcie-to-pci bridge.
+ 256 <= addr < 4K has no effects. */
+ return;
+ }
+ switch (size) {
+ case 1:
+ break;
+ case 2:
+ val = bswap16(val);
+ break;
+ case 4:
+ val = bswap32(val);
+ break;
+ default:
+ DBG_ERR(phb, "Unsupported config access size %d !", size);
+ return;
+ }
+ pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
+}
+
+static uint64_t pnv_phb3_config_read(PnvPhb3State *phb, unsigned off,
+ unsigned size)
+{
+ uint32_t cfg_addr, limit;
+ PCIDevice *pdev;
+ uint64_t val;
+
+ pdev = pnb_phb3_find_cfg_dev(phb);
+ if (!pdev) {
+ return ~0ull;
+ }
+ cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
+ cfg_addr |= off;
+ limit = pci_config_size(pdev);
+ if (limit <= cfg_addr) {
+ /* conventional pci device can be behind pcie-to-pci bridge.
+ 256 <= addr < 4K has no effects. */
+ return ~0ull;
+ }
+ val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
+ switch (size) {
+ case 1:
+ return val;
+ case 2:
+ return bswap16(val);
+ case 4:
+ return bswap32(val);
+ default:
+ DBG_ERR(phb, "Unsupported config access size %d !", size);
+ return ~0ull;
+ }
+}
+
+static void pnv_phb3_check_m32(PnvPhb3State *phb)
+{
+ uint64_t base, start, size;
+ MemoryRegion *parent;
+
+ if (phb->m32_mapped) {
+ // Should we destroy it in RCU friendly way... ?
+ memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32);
+ phb->m32_mapped = false;
+ }
+
+ /* Disabled ? move on with life ... */
+ if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) {
+ return;
+ }
+
+ /* Grab geometry from registers */
+ base = phb->regs[PHB_M32_BASE_ADDR >> 3];
+ start = phb->regs[PHB_M32_START_ADDR >> 3];
+ size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1;
+
+ DBG_MAP(phb, "PHB3: M32 enabled, base=%016llx/%016llx",
+ (unsigned long long)base, (unsigned long long)size);
+ DBG_MAP(phb, "PHB3: MMIO0 =%016llx/%016llx [%d]",
+ (unsigned long long)phb->pbcq->mmio0_base,
+ (unsigned long long)phb->pbcq->mmio0_size, phb->pbcq->mmio0_mapped);
+ DBG_MAP(phb, "PHB3: MMIO1 =%016llx/%016llx [%d]",
+ (unsigned long long)phb->pbcq->mmio1_base,
+ (unsigned long long)phb->pbcq->mmio1_size, phb->pbcq->mmio1_mapped);
+ /* Check if it matches an enabled MMIO region in the PBCQ */
+ if (phb->pbcq->mmio0_mapped && base >= phb->pbcq->mmio0_base &&
+ (base + size) <= (phb->pbcq->mmio0_base + phb->pbcq->mmio0_size)) {
+ parent = &phb->pbcq->mmbar0;
+ base -= phb->pbcq->mmio0_base;
+ DBG_MAP(phb, "M32: Mapping under MMIO0");
+ } else if (phb->pbcq->mmio1_mapped && base >= phb->pbcq->mmio1_base &&
+ (base + size) <= (phb->pbcq->mmio1_base + phb->pbcq->mmio1_size)) {
+ parent = &phb->pbcq->mmbar1;
+ base -= phb->pbcq->mmio1_base;
+ DBG_MAP(phb, "M32: Mapping under MMIO1");
+ } else {
+ DBG_MAP(phb, "M32 not matching either PBCQ MMIO region !");
+ return;
+ }
+
+ /* Create alias */
+ memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32",
+ &phb->pci_mmio, start, size);
+ memory_region_add_subregion(parent, base, &phb->mr_m32);
+ phb->m32_mapped = true;
+}
+
+static void pnv_phb3_check_m64(PnvPhb3State *phb, uint32_t index)
+{
+ uint64_t base, start, size, m64;
+ MemoryRegion *parent;
+
+ if (phb->m64_mapped[index]) {
+ // Should we destroy it in RCU friendly way... ?
+ memory_region_del_subregion(phb->mr_m64[index].container,
+ &phb->mr_m64[index]);
+ phb->m64_mapped[index] = false;
+ }
+
+ /* Get table entry */
+ m64 = phb->ioda_M64BT[index];
+
+ /* Disabled ? move on with life ... */
+ if (!(m64 & IODA2_M64BT_ENABLE)) {
+ return;
+ }
+
+ /* Grab geometry from registers */
+ base = GETFIELD(IODA2_M64BT_BASE, m64) << 20;
+ if (m64 & IODA2_M64BT_SINGLE_PE) {
+ base &= ~0x1ffffffull;
+ }
+ size = GETFIELD(IODA2_M64BT_MASK, m64) << 20;
+ size |= 0xfffc000000000000ull;
+ size = ~size + 1;
+ start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
+
+ DBG_MAP(phb, "PHB3: M64[%d] enabled, base=%016llx/%016llx", index,
+ (unsigned long long)base, (unsigned long long)size);
+ DBG_MAP(phb, "PHB3: MMIO0 =%016llx/%016llx [%d]",
+ (unsigned long long)phb->pbcq->mmio0_base,
+ (unsigned long long)phb->pbcq->mmio0_size, phb->pbcq->mmio0_mapped);
+ DBG_MAP(phb, "PHB3: MMIO1 =%016llx/%016llx [%d]",
+ (unsigned long long)phb->pbcq->mmio1_base,
+ (unsigned long long)phb->pbcq->mmio1_size, phb->pbcq->mmio1_mapped);
+ /* Check if it matches an enabled MMIO region in the PBCQ */
+ if (phb->pbcq->mmio0_mapped && base >= phb->pbcq->mmio0_base &&
+ (base + size) <= (phb->pbcq->mmio0_base + phb->pbcq->mmio0_size)) {
+ parent = &phb->pbcq->mmbar0;
+ base -= phb->pbcq->mmio0_base;
+ DBG_MAP(phb, "M64: Mapping under MMIO0");
+ } else if (phb->pbcq->mmio1_mapped && base >= phb->pbcq->mmio1_base &&
+ (base + size) <= (phb->pbcq->mmio1_base + phb->pbcq->mmio1_size)) {
+ parent = &phb->pbcq->mmbar1;
+ base -= phb->pbcq->mmio1_base;
+ DBG_MAP(phb, "M64: Mapping under MMIO1");
+ } else {
+ DBG_MAP(phb, "M64 not matching either PBCQ MMIO region !");
+ return;
+ }
+
+ /* Create alias */
+ memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64",
+ &phb->pci_mmio, start, size);
+ memory_region_add_subregion(parent, base, &phb->mr_m64[index]);
+ phb->m64_mapped[index] = true;
+}
+
+static void pnv_phb3_check_all_m64s(PnvPhb3State *phb)
+{
+ uint64_t i;
+
+ for (i=0; i<PHB_NUM_M64; i++) {
+ pnv_phb3_check_m64(phb, i);
+ }
+}
+
+static void pnv_phb3_lxivt_write(PnvPhb3State *phb, unsigned idx, uint64_t val)
+{
+ uint8_t server, prio;
+
+ phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER_MASK |
+ IODA2_LXIVT_PRIORITY_MASK |
+ IODA2_LXIVT_NODE_ID_MASK);
+ server = GETFIELD(IODA2_LXIVT_SERVER, val);
+ prio = GETFIELD(IODA2_LXIVT_PRIORITY, val);
+
+ ics_simple_write_xive(phb->lsi_ics, idx, server, prio, prio);
+}
+
+static uint64_t *pnv_phb3_ioda_access(PnvPhb3State *phb,
+ unsigned *out_table, unsigned *out_idx)
+{
+ uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
+ unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
+ unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
+ unsigned int mask;
+ uint64_t *tptr = NULL;
+
+ switch(table) {
+ case IODA2_TBL_LIST:
+ tptr = phb->ioda_LIST;
+ mask = 7;
+ break;
+ case IODA2_TBL_LXIVT:
+ tptr = phb->ioda_LXIVT;
+ mask = 7;
+ break;
+ case IODA2_TBL_IVC_CAM:
+ case IODA2_TBL_RBA:
+ mask = 31;
+ break;
+ case IODA2_TBL_RCAM:
+ mask = 63;
+ break;
+ case IODA2_TBL_MRT:
+ mask = 7;
+ break;
+ case IODA2_TBL_PESTA:
+ case IODA2_TBL_PESTB:
+ mask = 255;
+ break;
+ case IODA2_TBL_TVT:
+ tptr = phb->ioda_TVT;
+ mask = 255;
+ break;
+ case IODA2_TBL_TCAM:
+ case IODA2_TBL_TDR:
+ mask = 63;
+ break;
+ case IODA2_TBL_M64BT:
+ tptr = phb->ioda_M64BT;
+ mask = 15;
+ break;
+ case IODA2_TBL_M32DT:
+ tptr = phb->ioda_MDT;
+ mask = 255;
+ break;
+ case IODA2_TBL_PEEV:
+ tptr = phb->ioda_PEEV;
+ mask = 3;
+ break;
+ default:
+ DBG_ERR(phb, "Unknown IODA table idx %d", table);
+ return NULL;
+ }
+ index &= mask;
+ if (out_idx) {
+ *out_idx = index;
+ }
+ if (out_table) {
+ *out_table = table;
+ }
+ if (adreg & PHB_IODA_AD_AUTOINC) {
+ index = (index + 1) & mask;
+ adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
+ }
+ if (tptr) {
+ tptr += index;
+ }
+ phb->regs[PHB_IODA_ADDR >> 3] = adreg;
+ return tptr;
+}
+
+static uint64_t pnv_phb3_ioda_read(PnvPhb3State *phb)
+{
+ unsigned table;
+ uint64_t *tptr;
+
+ tptr = pnv_phb3_ioda_access(phb, &table, NULL);
+ if (!tptr) {
+ /* Return 0 on unsupported tables, not ff's */
+ return 0;
+ }
+ return *tptr;
+}
+
+static void pnv_phb3_ioda_write(PnvPhb3State *phb, uint64_t val)
+{
+ unsigned table, idx;
+ uint64_t *tptr;
+
+ tptr = pnv_phb3_ioda_access(phb, &table, &idx);
+ if (!tptr) {
+ return;
+ }
+
+ /* Handle side effects */
+ switch(table) {
+ case IODA2_TBL_LXIVT:
+ pnv_phb3_lxivt_write(phb, idx, val);
+ break;
+ case IODA2_TBL_M64BT:
+ *tptr = val;
+ pnv_phb3_check_m64(phb, idx);
+ break;
+ default:
+ *tptr = val;
+ }
+}
+
+/* This is called whenever the PHB LSI, MSI source ID register or
+ * the PBCQ irq filters are written.
+ */
+void pnv_phb3_remap_irqs(PnvPhb3State *phb)
+{
+ uint32_t local, global, count, mask, comp;
+ uint64_t baren;
+
+ /* First check if we are enabled. Unlike real HW we don't separate TX and
RX
+ * so we enable if both are set
+ */
+ baren = phb->pbcq->nest_regs[PBCQ_NEST_BAR_EN];
+ if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) ||
+ !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) {
+ phb->lsi_ics->offset = 0;
+ return;
+ }
+
+ /* Grab local LSI source ID */
+ local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3;
+
+ /* Grab global one and compare */
+ global = GETFIELD(PBCQ_NEST_LSI_SRC,
+ phb->pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3;
+ if (global != local) {
+ /* This happens during initialization, let's come back when we
+ * are properly configured
+ */
+ phb->lsi_ics->offset = 0;
+ return;
+ }
+
+ /* Get the base on the powerbus */
+ comp = GETFIELD(PBCQ_NEST_IRSN_COMP,
+ phb->pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]);
+ mask = GETFIELD(PBCQ_NEST_IRSN_COMP,
+ phb->pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]);
+ count = ((~mask) + 1) & 0x7ffff;
+ phb->total_irq = count;
+
+ /* Sanity checks */
+ if ((global + 8) > count) {
+ DBG_MAP(phb, "LSIs out of reach: LSI base=%d total irq=%d",
+ global, count);
+ }
+ if (count > 2048) {
+ DBG_MAP(phb, "More interrupts than supported: %d", count);
+ }
+ if ((comp & mask) != comp) {
+ DBG_MAP(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x",
+ comp, mask);
+ comp &= mask;
+ }
+ /* Setup LSI offset */
+ phb->lsi_ics->offset = comp + global;
+
+ /* Setup MSI offset */
+ pnv_phb3_msi_update_config(phb->msis, comp, count);
+
+ DBG_MAP(phb, "Initialized for %d interrupts @0x%x, LSI off=%d",
+ count, comp, global);
+}
+
+static void pnv_phb3_lsi_src_id_write(PnvPhb3State *phb, uint64_t val)
+{
+ /* Sanitize content */
+ val &= PHB_LSI_SRC_ID_MASK;
+ phb->regs[PHB_LSI_SOURCE_ID >> 3] = val;
+ pnv_phb3_remap_irqs(phb);
+}
+
+static void pnv_phb3_rtc_invalidate(PnvPhb3State *phb, uint64_t val)
+{
+ PnvPhb3DMASpace *ds;
+
+ /* Always invalidate all for now ... */
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ ds->pe_num = PHB_INVALID_PE;
+ }
+}
+
+
+static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds)
+{
+ uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
+
+ if (cfg & PHB_PHB3C_32BIT_MSI_EN) {
+ if (!ds->msi32_mapped) {
+ memory_region_add_subregion(&ds->dma_mr, 0xffff0000,
&ds->msi32_mr);
+ ds->msi32_mapped = true;
+ }
+ } else {
+ if (ds->msi32_mapped) {
+ memory_region_del_subregion(&ds->dma_mr, &ds->msi32_mr);
+ ds->msi32_mapped = false;
+ }
+ }
+
+ if (cfg & PHB_PHB3C_64BIT_MSI_EN) {
+ if (!ds->msi64_mapped) {
+ memory_region_add_subregion(&ds->dma_mr,
+ (1ull << 60), &ds->msi64_mr);
+ ds->msi64_mapped = true;
+ }
+ } else {
+ if (ds->msi64_mapped) {
+ memory_region_del_subregion(&ds->dma_mr, &ds->msi64_mr);
+ ds->msi64_mapped = false;
+ }
+ }
+}
+
+static void pnv_phb3_update_all_msi_regions(PnvPhb3State *phb)
+{
+ PnvPhb3DMASpace *ds;
+
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ pnv_phb3_update_msi_regions(ds);
+ }
+}
+
+void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size)
+{
+ PnvPhb3State *phb = opaque;
+ bool changed;
+
+ /* Special case configuration data */
+ if ((off & 0xfffc) == PHB_CONFIG_DATA) {
+ pnv_phb3_config_write(phb, off & 0x3, size, val);
+ return;
+ }
+
+ /* Other registers are 64-bit only */
+ if (size != 8 || off & 0x7) {
+ DBG_ERR(phb, "Invalid register access, offset: 0x%x size: %d",
+ (unsigned int)off, size);
+ return;
+ }
+
+ /* Handle masking */
+ switch(off) {
+ case PHB_M64_UPPER_BITS:
+ val &= 0xfffc000000000000ull;
+ break;
+ }
+
+ /* Record whether it changed */
+ changed = phb->regs[off >> 3] != val;
+
+ /* Store in register cache first */
+ phb->regs[off >> 3] = val;
+
+ /* Handle side effects */
+ switch(off) {
+ case PHB_PHB3_CONFIG:
+ if (changed) {
+ pnv_phb3_update_all_msi_regions(phb);
+ }
+ /* fall through */
+ case PHB_M32_BASE_ADDR:
+ case PHB_M32_BASE_MASK:
+ case PHB_M32_START_ADDR:
+ if (changed) {
+ pnv_phb3_check_m32(phb);
+ }
+ break;
+ case PHB_M64_UPPER_BITS:
+ if (changed) {
+ pnv_phb3_check_all_m64s(phb);
+ }
+ break;
+ case PHB_LSI_SOURCE_ID:
+ if (changed) {
+ pnv_phb3_lsi_src_id_write(phb, val);
+ }
+ break;
+
+ /* IODA table accesses */
+ case PHB_IODA_DATA0:
+ pnv_phb3_ioda_write(phb, val);
+ break;
+
+ /* RTC invalidation */
+ case PHB_RTC_INVALIDATE:
+ pnv_phb3_rtc_invalidate(phb, val);
+ break;
+
+ /* FFI request */
+ case PHB_FFI_REQUEST:
+ pnv_phb3_msi_ffi(phb->msis, val);
+ break;
+
+ /* Silent simple writes */
+ case PHB_CONFIG_ADDRESS:
+ case PHB_IODA_ADDR:
+ case PHB_TCE_KILL:
+ case PHB_TCE_SPEC_CTL:
+ case PHB_PEST_BAR:
+ case PHB_PELTV_BAR:
+ case PHB_RTT_BAR:
+ case PHB_RBA_BAR:
+ case PHB_IVT_BAR:
+ case PHB_FFI_LOCK:
+ break;
+
+#ifdef DISPLAY_UNIMPLENTED_REG
+ /* Noise on anything else */
+ default:
+ DBG_ERR(phb, "reg_write 0x%x=%016llx",
+ (unsigned int)off, (unsigned long long)val);
+#endif
+ }
+}
+
+uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size)
+{
+ PnvPhb3State *phb = opaque;
+ uint64_t val;
+
+ if ((off & 0xfffc) == PHB_CONFIG_DATA) {
+ return pnv_phb3_config_read(phb, off & 0x3, size);
+ }
+
+ /* Other registers are 64-bit only */
+ if (size != 8 || off & 0x7) {
+ DBG_ERR(phb, "Invalid register access, offset: 0x%x size: %d",
+ (unsigned int)off, size);
+ return ~0ull;
+ }
+
+ /* Default read from cache */
+ val = phb->regs[off >> 3];
+
+ switch(off) {
+ /* Simulate venice DD2.0 */
+ case PHB_VERSION:
+ return 0x000000a300000005ull;
+
+ /* IODA table accesses */
+ case PHB_IODA_DATA0:
+ return pnv_phb3_ioda_read(phb);
+
+ /* Link training always appears trained */
+ case PHB_PCIE_DLP_TRAIN_CTL:
+ return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT;
+
+ /* FFI Lock */
+ case PHB_FFI_LOCK:
+ /* Set lock and return previous value */
+ phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE;
+ return val;
+
+ /* Silent simple reads */
+ case PHB_PHB3_CONFIG:
+ case PHB_M32_BASE_ADDR:
+ case PHB_M32_BASE_MASK:
+ case PHB_M32_START_ADDR:
+ case PHB_CONFIG_ADDRESS:
+ case PHB_IODA_ADDR:
+ case PHB_RTC_INVALIDATE:
+ case PHB_TCE_KILL:
+ case PHB_TCE_SPEC_CTL:
+ case PHB_PEST_BAR:
+ case PHB_PELTV_BAR:
+ case PHB_RTT_BAR:
+ case PHB_RBA_BAR:
+ case PHB_IVT_BAR:
+ case PHB_M64_UPPER_BITS:
+ break;
+
+#ifdef DISPLAY_UNIMPLENTED_REG
+ /* Noise on anything else */
+ default:
+ DBG_ERR(phb, "reg_read 0x%x=%016llx",
+ (unsigned int)off, (unsigned long long)val);
+#endif
+ }
+ return val;
+}
+
+static const MemoryRegionOps pnv_phb3_reg_ops = {
+ .read = pnv_phb3_reg_read,
+ .write = pnv_phb3_reg_write,
+ .valid.min_access_size = 1,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 1,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num)
+{
+ /* Check that out properly ... */
+ return irq_num & 3;
+}
+
+static void pnv_phb3_set_irq(void *opaque, int irq_num, int level)
+{
+ PnvPhb3State *phb = opaque;
+
+ /* LSI only ... */
+ if (irq_num > 3) {
+ DBG_ERR(phb, "Unknown IRQ to set %d", irq_num);
+ }
+ qemu_set_irq(phb->lsi_ics->qirqs[irq_num], level);
+}
+
+static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds)
+{
+ uint64_t rtt, addr;
+ uint16_t rte;
+ int bus_num;
+
+ /* Already resolved ? */
+ if (ds->pe_num != PHB_INVALID_PE) {
+ return true;
+ }
+
+ /* We need to lookup the RTT */
+ rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
+ if (!(rtt & PHB_RBA_BAR_ENABLE)) {
+ DBG_ERR(ds->phb, "DMA with RTT BAR disabled !");
+ // Set error bits ? fence ? ...
+ return false;
+ }
+
+ /* Read RTE */
+ bus_num = pci_bus_num(ds->bus);
+ addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
+ addr += 2 * ((bus_num << 8) | ds->devfn);
+ if (dma_memory_read(&address_space_memory, addr, &rte, sizeof(rte))) {
+ DBG_ERR(ds->phb, "Failed to read RTT entry at %016llx",
+ (unsigned long long)addr);
+ // Set error bits ? fence ? ...
+ return false;
+ }
+ rte = be16_to_cpu(rte);
+
+ /* Fail upon reading of invalid PE# */
+ if (rte >= PHB_NUM_PE) {
+ DBG_ERR(ds->phb, "RTE for RID 0x%x invalid (%04x)", ds->devfn, rte);
+ // Set error bits ? fence ? ...
+ return false;
+ }
+ ds->pe_num = rte;
+ return true;
+}
+
+static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr,
+ bool is_write, uint64_t tve,
+ IOMMUTLBEntry *tlb)
+{
+ uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve);
+ int32_t lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve);
+ uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve);
+ uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve);
+
+ DBG_DMA(ds->phb, "xlate %016llx:%c TVE=%016llx",
+ (unsigned long long)addr, is_write ? 'W' : 'R',
+ (unsigned long long)tve);
+
+ DBG_DMA(ds->phb, " tta=%016llx lev=%d tts=%d tps=%d",
+ (unsigned long long)tta, lev, tts, tps);
+
+ /* Invalid levels */
+ if (lev > 4) {
+ DBG_ERR(ds->phb, "Invalid #levels in TVE %d", lev);
+ return;
+ }
+
+ /* IO Page Size of 0 means untranslated, else use TCEs */
+ if (tps == 0) {
+ /* We only support non-translate in top window
+ * XXX FIX THAT, Venice/Murano support it on bottom window
+ * above 4G and Naples suports it on everything
+ */
+ if (!(tve & PPC_BIT(51))) {
+ DBG_ERR(ds->phb, "xlate for invalid non-translate TVE");
+ return;
+ }
+ // XXX Handle boundaries */
+
+ /* XXX Use 4k pages like q35 ... for now */
+ DBG_DMA(ds->phb, " non-translate ok");
+ tlb->iova = addr & 0xfffffffffffff000ull;
+ tlb->translated_addr = addr & 0x0003fffffffff000ull;
+ tlb->addr_mask = 0xfffull;
+ tlb->perm = IOMMU_RW;
+ } else {
+ uint32_t tce_shift, tbl_shift, sh;
+ uint64_t base, taddr, tce, tce_mask;
+
+ /* TVE disabled ? */
+ if (tts == 0) {
+ DBG_ERR(ds->phb, "xlate for invalid translated TVE");
+ return;
+ }
+
+ /* Address bits per bottom level TCE entry */
+ tce_shift = tps + 11;
+
+ /* Address bits per table level */
+ tbl_shift = tts + 8;
+
+ /* Top level table base address */
+ base = tta << 12;
+
+ /* Total shift to first level */
+ sh = tbl_shift * lev + tce_shift;
+
+ DBG_DMA(ds->phb, " tce_shift %d tbl_shift %d", tce_shift, tbl_shift);
+
+ // XXX Multi-level untested */
+ while ((lev--) >= 0) {
+ /* Grab the TCE address */
+ taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
+ if (dma_memory_read(&address_space_memory, taddr, &tce,
sizeof(tce))) {
+ DBG_ERR(ds->phb, "Failed to read TCE at 0x%016llx",
+ (unsigned long long)taddr);
+ return;
+ }
+ tce = be64_to_cpu(tce);
+ DBG_DMA(ds->phb, " lev %d taddr 0x%016llx tce 0x%016llx", lev + 1,
+ (unsigned long long)taddr, (unsigned long long)tce);
+
+ /* Check permission for indirect TCE */
+ if ((lev >= 0) && !(tce & 3)) {
+ DBG_ERR(ds->phb, "Invalid indirect TCE at 0x%016llx",
+ (unsigned long long)taddr);
+ DBG_ERR(ds->phb, " xlate %016llx:%c TVE=%016llx",
+ (unsigned long long)addr, is_write ? 'W' : 'R',
+ (unsigned long long)tve);
+ DBG_ERR(ds->phb, " tta=%016llx lev=%d tts=%d tps=%d",
+ (unsigned long long)tta, lev, tts, tps);
+ return;
+ }
+ sh -= tbl_shift;
+ base = tce & ~0xfffull;
+ }
+
+ /* We exit the loop with TCE being the final TCE */
+ tce_mask = ~((1ull << tce_shift) - 1);
+ tlb->iova = addr & tce_mask;
+ tlb->translated_addr = tce & tce_mask;
+ tlb->addr_mask = ~tce_mask;
+ tlb->perm = tce & 3;
+ if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
+ DBG_ERR(ds->phb, "TCE access fault at 0x%016llx",
+ (unsigned long long)taddr);
+ DBG_ERR(ds->phb, " xlate %016llx:%c TVE=%016llx",
+ (unsigned long long)addr, is_write ? 'W' : 'R',
+ (unsigned long long)tve);
+ DBG_ERR(ds->phb, " tta=%016llx lev=%d tts=%d tps=%d",
+ (unsigned long long)tta, lev, tts, tps);
+ }
+ }
+}
+
+static IOMMUTLBEntry pnv_phb3_translate_iommu(MemoryRegion *iommu, hwaddr addr,
+ bool is_write)
+{
+ PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr);
+ int tve_sel;
+ uint64_t tve, cfg;
+ IOMMUTLBEntry ret = {
+ .target_as = &address_space_memory,
+ .iova = addr,
+ .translated_addr = 0,
+ .addr_mask = ~(hwaddr)0,
+ .perm = IOMMU_NONE,
+ };
+
+ /* Resolve PE# */
+ if (!pnv_phb3_resolve_pe(ds)) {
+ DBG_ERR(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
+ ds->bus, pci_bus_num(ds->bus), ds->devfn);
+ return ret;
+ }
+
+ DBG_DMA(ds->phb, "xlate bus @%p (%d) devfn 0x%x PE %d ds @%p",
+ ds->bus, pci_bus_num(ds->bus),ds->devfn, ds->pe_num, ds);
+
+ /* Check top bits */
+ switch (addr >> 60) {
+ case 00:
+ /* DMA or 32-bit MSI ? */
+ cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
+ if ((cfg & PHB_PHB3C_32BIT_MSI_EN) &&
+ ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
+ DBG_ERR(ds->phb, "xlate on 32-bit MSI region");
+ return ret;
+ }
+ /* Choose TVE XXX Use PHB3 Control Register */
+ tve_sel = (addr >> 59) & 1;
+ tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
+ DBG_DMA(ds->phb, " TVE_SEL=%d -> %d",
+ tve_sel, ds->pe_num * 2 + tve_sel);
+ pnv_phb3_translate_tve(ds, addr, is_write, tve, &ret);
+ break;
+ case 01:
+ DBG_ERR(ds->phb, "xlate on 64-bit MSI region");
+ break;
+ default:
+ DBG_ERR(ds->phb, "xlate on unsupported address 0x%016llx",
+ (unsigned long long)addr);
+ }
+ return ret;
+}
+
+static const MemoryRegionIOMMUOps pnv_phb3_iommu_ops = {
+ .translate = pnv_phb3_translate_iommu,
+};
+
+/*
+ * MSI/MSIX memory region implementation.
+ * The handler handles both MSI and MSIX.
+ */
+static void pnv_phb3_msi_write(void *opaque, hwaddr addr,
+ uint64_t data, unsigned size)
+{
+ PnvPhb3DMASpace *ds = opaque;
+
+ /* Resolve PE# */
+ if (!pnv_phb3_resolve_pe(ds)) {
+ DBG_ERR(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
+ ds->bus, pci_bus_num(ds->bus), ds->devfn);
+ return;
+ }
+
+ pnv_phb3_msi_send(ds->phb->msis, addr, data, ds->pe_num);
+}
+
+static const MemoryRegionOps pnv_phb3_msi_ops = {
+ /* There is no .read as the read result is undefined by PCI spec */
+ .read = NULL,
+ .write = pnv_phb3_msi_write,
+ .endianness = DEVICE_LITTLE_ENDIAN
+};
+
+static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn)
+{
+ PnvPhb3State *phb = opaque;
+ PnvPhb3DMASpace *ds;
+
+ DBG_DMA(phb, "get IOMMU for bus @%p devfn 0x%x", bus, devfn);
+
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ if (ds->bus == bus && ds->devfn == devfn) {
+ DBG_DMA(phb, " found @%p", ds);
+ break;
+ }
+ }
+ if (ds == NULL) {
+ ds = g_malloc0(sizeof(PnvPhb3DMASpace));
+ ds->bus = bus;
+ ds->devfn = devfn;
+ ds->pe_num = PHB_INVALID_PE;
+ ds->phb = phb;
+ memory_region_init_iommu(&ds->dma_mr, OBJECT(phb),
+ &pnv_phb3_iommu_ops, "phb3_iommu",
UINT64_MAX);
+ address_space_init(&ds->dma_as, &ds->dma_mr, "phb3_iommu");
+ memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops,
+ ds, "msi32", 0x10000);
+ memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops,
+ ds, "msi64", 0x100000);
+ pnv_phb3_update_msi_regions(ds);
+
+ QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
+ DBG_DMA(phb, " created @%p", ds);
+ }
+ return &ds->dma_as;
+}
+
+static void pnv_phb3_root_bus_class_init(ObjectClass *klass, void *data)
+{
+ BusClass *k = BUS_CLASS(klass);
+
+ k->max_dev = 1;
+}
+
+#define TYPE_PNV_PHB3_ROOT_BUS "pnv-phb3-root-bus"
+
+static const TypeInfo pnv_phb3_root_bus_info = {
+ .name = TYPE_PNV_PHB3_ROOT_BUS,
+ .parent = TYPE_PCIE_BUS,
+ .class_init = pnv_phb3_root_bus_class_init,
+};
+
+static void pnv_phb3_initfn(Object *obj)
+{
+ PnvPhb3State *phb = PNV_PHB3(obj);
+
+ phb->lsi_ics = ICS(object_new(TYPE_ICS_SIMPLE));
+ object_property_add_child(OBJECT(phb), "ics", OBJECT(phb->lsi_ics), NULL);
+ /* Default init ... will be fixed by HW inits */
+ phb->lsi_ics->offset = 0;
+ phb->lsi_ics->nr_irqs = PHB_NUM_LSI;
+ QLIST_INIT(&phb->dma_spaces);
+}
+
+static void pnv_phb3_realize(DeviceState *dev, Error **errp)
+{
+ PnvPhb3State *phb = PNV_PHB3(dev);
+ PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+ Error *error = NULL;
+ int i;
+
+ memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio",
+ PCI_MMIO_TOTAL_SIZE);
+
+ /* PHB3 doesn't support IO space. However, qemu gets very upset if
+ * we don't have an IO region to anchor IO BARs onto so we just
+ * initialize one which we never hook up to anything
+ */
+ memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000);
+
+ memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb,
+ "phb3-regs", 0x1000);
+
+ /* Realize LSI ICS */
+ xics_add_ics(phb->xics, phb->lsi_ics);
+ object_property_set_bool(OBJECT(phb->lsi_ics), true, "realized", &error);
+ if (error) {
+ error_propagate(errp, error);
+ return;
+ }
+ for (i = 0; i < PHB_NUM_LSI; i++)
+ ics_simple_set_irq_type(phb->lsi_ics, i, true);
+
+ pci->bus = pci_register_bus(dev, "phb3-root-bus",
+ pnv_phb3_set_irq, pnv_phb3_map_irq, phb,
+ &phb->pci_mmio, &phb->pci_io,
+ 0, 4, TYPE_PNV_PHB3_ROOT_BUS);
+ pci->bus->devfn_max = 1;
+ pci_setup_iommu(pci->bus, pnv_phb3_dma_iommu, phb);
+}
+
+void pnv_phb3_update_regions(PnvPhb3State *phb)
+{
+ /* Unmap first always */
+ if (phb->regs_mapped) {
+ memory_region_del_subregion(&phb->pbcq->phbbar, &phb->mr_regs);
+ phb->regs_mapped = false;
+ }
+
+ /* Map registers if enabled */
+ if (phb->pbcq->phb_mapped) {
+ /* XXX We should use the PHB BAR 2 register but we don't ... */
+ memory_region_add_subregion(&phb->pbcq->phbbar, 0, &phb->mr_regs);
+ phb->regs_mapped = true;
+ }
+
+ /* Check/update m32 */
+ if (phb->m32_mapped) {
+ pnv_phb3_check_m32(phb);
+ }
+}
+
+static void pnv_phb3_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ dc->realize = pnv_phb3_realize;
+}
+
+static const TypeInfo pnv_phb3_type_info = {
+ .name = TYPE_PNV_PHB3,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(PnvPhb3State),
+ .class_init = pnv_phb3_class_init,
+ .instance_init = pnv_phb3_initfn,
+};
+
+static void pnv_phb3_register_types(void)
+{
+ type_register_static(&pnv_phb3_type_info);
+ type_register_static(&pnv_phb3_root_bus_info);
+}
+
+type_init(pnv_phb3_register_types)
+
+void pnv_phb3_create(PnvChip *chip, XICSState *xics, uint32_t idx)
+{
+ struct DeviceState *dev;
+ PnvPhb3State *phb;
+ PnvPBCQState *pbcq;
+ PCIHostState *pcih;
+ PCIDevice *pdev;
+ PCIBridge *bdev;
+ uint8_t chassis;
+
+ chassis = chip->chip_id * 4 + idx;
+
+ /* Create PBCQ */
+ dev = qdev_create(&chip->xscom->bus, TYPE_PNV_PBCQ);
+ qdev_prop_set_uint32(dev, "phb_id", idx);
+ qdev_init_nofail(dev);
+ pbcq = PNV_PBCQ(dev);
+
+ /* Create PHB3 */
+ dev = qdev_create(NULL, TYPE_PNV_PHB3);
+ phb = PNV_PHB3(dev);
+ phb->pbcq = pbcq;
+ pbcq->phb = phb;
+ phb->xics = xics;
+ qdev_init_nofail(dev);
+ pcih = PCI_HOST_BRIDGE(phb);
+
+ /* Create MSI source */
+ phb->msis = pnv_phb3_msi_create(phb);
+
+ /* Add root complex */
+ pdev = pci_create_multifunction(pcih->bus, 0, false, TYPE_PNV_PHB3_RC);
+ qdev_prop_set_uint8(&pdev->qdev, "chassis", chassis);
+ qdev_prop_set_uint16(&pdev->qdev, "slot", 1);
+ qdev_init_nofail(&pdev->qdev);
+ bdev = PCI_BRIDGE(pdev);
+
+ /* Setup bus for that chip */
+ chip->phb[idx] = pci_bridge_get_sec_bus(bdev);
+}
diff --git a/hw/pci-host/pnv_phb3_msi.c b/hw/pci-host/pnv_phb3_msi.c
new file mode 100644
index 0000000..fa6a2d1
--- /dev/null
+++ b/hw/pci-host/pnv_phb3_msi.c
@@ -0,0 +1,338 @@
+#include "hw/pci-host/pnv_phb3.h"
+#include "hw/pci/pci_bridge.h"
+#include "hw/pci/pci_bus.h"
+#include "hw/pci/msi.h"
+#include "hw/ppc/xics.h"
+
+#define PHB3_MAX_MSI 2048
+
+//#define DEBUG_MSI 1
+#define DEBUG_MSI 0
+
+typedef struct Phb3MsiState {
+ struct ICSState ics;
+ PnvPhb3State *phb;
+ uint64_t rba[PHB3_MAX_MSI/64];
+ uint32_t rba_sum;
+} Phb3MsiState;
+
+#define TYPE_PHB3_MSI "phb3-msi"
+#define PHB3_MSI(obj) OBJECT_CHECK(Phb3MsiState, (obj), TYPE_PHB3_MSI)
+
+#define DBG_ERR(p, fmt, ...) do { \
+ if (1) fprintf(stderr, "PHB3(%s): " fmt "\n", __func__, ## __VA_ARGS__); \
+ } while(0)
+
+#define DBG_MSI(p, fmt, ...) do { \
+ if (DEBUG_MSI) fprintf(stderr, "PHB3(%s): " fmt "\n", __func__, ##
__VA_ARGS__); \
+ } while(0)
+
+
+static void phb3_msi_initfn(Object *obj)
+{
+ Phb3MsiState *msis = PHB3_MSI(obj);
+
+ /* Will be overriden later */
+ msis->ics.offset = 0;
+
+ /* Hard wire 2048, we ignore the fact that 8 of them can be
+ * taken over by LSIs at this point
+ */
+ msis->ics.nr_irqs = PHB3_MAX_MSI;
+}
+
+static uint64_t phb3_msi_ive_addr(Phb3MsiState *msis, int srcno)
+{
+ uint64_t ivtbar = msis->phb->regs[PHB_IVT_BAR >> 3];
+ uint64_t phbctl = msis->phb->regs[PHB_CONTROL >> 3];
+
+ if (!(ivtbar & PHB_IVT_BAR_ENABLE)) {
+ DBG_ERR(msis->phb, "Failed access to disable IVT BAR !");
+ return 0;
+ }
+
+ if (srcno >= (ivtbar & PHB_IVT_LENGTH_MASK)) {
+ DBG_ERR(msis->phb, "MSI out of bounds (%d vs %ld)",
+ srcno, (long)(ivtbar & PHB_IVT_LENGTH_MASK));
+ return 0;
+ }
+
+ ivtbar &= PHB_IVT_BASE_ADDRESS_MASK;
+
+ if (phbctl & PHB_CTRL_IVE_128_BYTES) {
+ return ivtbar + 128 * srcno;
+ } else {
+ return ivtbar + 16 * srcno;
+ }
+}
+
+static bool phb3_msi_read_ive(Phb3MsiState *msis, int srcno, uint64_t *out_ive)
+{
+ uint64_t ive_addr, ive;
+
+ ive_addr = phb3_msi_ive_addr(msis, srcno);
+ if (!ive_addr) {
+ return false;
+ }
+ if (dma_memory_read(&address_space_memory, ive_addr, &ive, sizeof(ive))) {
+ DBG_ERR(msis->phb, "Failed to read IVE at 0x%016llx",
+ (unsigned long long)ive_addr);
+ return false;
+ }
+ *out_ive = be64_to_cpu(ive);
+
+ return true;
+}
+
+static void phb3_msi_set_p(Phb3MsiState *msis, int srcno, uint8_t gen)
+{
+ uint64_t ive_addr;
+ uint8_t p = 0x01 | (gen << 1);
+
+ ive_addr = phb3_msi_ive_addr(msis, srcno);
+ if (!ive_addr) {
+ return;
+ }
+ DBG_MSI(msis->phb, "MSI %d: setting P", srcno);
+ if (dma_memory_write(&address_space_memory, ive_addr + 4, &p, 1)) {
+ DBG_ERR(msis->phb, "Failed to write IVE (set P) at 0x%016llx",
+ (unsigned long long)ive_addr);
+ }
+#ifdef DEBUG_MSI
+ {
+ uint64_t ive;
+
+ if (dma_memory_read(&address_space_memory, ive_addr, &ive, 8)) {
+ DBG_ERR(ds->phb, "Failed to read IVE (set P) at 0x%016llx",
+ (unsigned long long)ive_addr);
+ }
+ DBG_MSI(msis->phb, " IVE readback: %016llx",
+ (unsigned long long)be64_to_cpu(ive));
+ }
+#endif
+}
+
+static void phb3_msi_set_q(Phb3MsiState *msis, int srcno)
+{
+ uint64_t ive_addr;
+ uint8_t q = 0x01;
+
+ ive_addr = phb3_msi_ive_addr(msis, srcno);
+ if (!ive_addr) {
+ return;
+ }
+ DBG_MSI(msis->phb, "MSI %d: setting Q", srcno);
+ if (dma_memory_write(&address_space_memory, ive_addr + 5, &q, 1)) {
+ DBG_ERR(ds->phb, "Failed to write IVE (set Q) at 0x%016llx",
+ (unsigned long long)ive_addr);
+ }
+#ifdef DEBUG_MSI
+ {
+ uint64_t ive;
+
+ if (dma_memory_read(&address_space_memory, ive_addr, &ive, 8)) {
+ DBG_ERR(ds->phb, "Failed to read IVE (set P) at 0x%016llx",
+ (unsigned long long)ive_addr);
+ }
+ DBG_MSI(msis->phb, " IVE readback: %016llx",
+ (unsigned long long)be64_to_cpu(ive));
+ }
+#endif
+}
+
+static void phb3_msi_try_send(Phb3MsiState *msis, int srcno, bool ignore_p)
+{
+ uint64_t ive;
+ uint64_t server, prio, pq, gen;
+
+ if (!phb3_msi_read_ive(msis, srcno, &ive)) {
+ return;
+ }
+
+ server = GETFIELD(IODA2_IVT_SERVER, ive);
+ prio = GETFIELD(IODA2_IVT_PRIORITY, ive);
+ pq = GETFIELD(IODA2_IVT_Q, ive);
+ if (!ignore_p) {
+ pq |= GETFIELD(IODA2_IVT_P, ive) << 1;
+ }
+ gen = GETFIELD(IODA2_IVT_GEN, ive);
+
+ DBG_MSI(msis->phb, "MSI %d: try_send, ive=0x%016llx eff pq=%d", srcno,
+ (unsigned long long)ive, (int)pq);
+
+ switch(pq) {
+ case 0: /* 00 */
+ if (prio == 0xff) {
+ /* Masked, set Q */
+ phb3_msi_set_q(msis, srcno);
+ } else {
+ /* Enabled, set P and send */
+ phb3_msi_set_p(msis, srcno, gen);
+ icp_irq(&msis->ics, server, srcno + msis->ics.offset, prio);
+ }
+ break;
+ case 2: /* 10 */
+ /* Already pending, set Q */
+ phb3_msi_set_q(msis, srcno);
+ break;
+ case 1: /* 01 */
+ case 3: /* 11 */
+ default:
+ /* Just drop stuff if Q already set */
+ break;
+ }
+}
+
+static void phb3_msi_set_irq(void *opaque, int srcno, int val)
+{
+ Phb3MsiState *msis = opaque;
+
+ if (val) {
+ phb3_msi_try_send(msis, srcno, false);
+ }
+}
+
+
+void pnv_phb3_msi_send(Phb3MsiState *msis, uint64_t addr, uint16_t data,
+ int32_t dev_pe)
+{
+ uint64_t ive;
+ uint16_t pe;
+ uint32_t src = ((addr >> 4) & 0xffff) | (data & 0x1f);
+
+ if (src >= msis->ics.nr_irqs) {
+ DBG_ERR(msis->phb, "MSI %d out of bounds", src);
+ return;
+ }
+ if (dev_pe >= 0) {
+ if (!phb3_msi_read_ive(msis, src, &ive)) {
+ return;
+ }
+ pe = GETFIELD(IODA2_IVT_PE, ive);
+ if (pe != dev_pe) {
+ DBG_ERR(msis->phb, "MSI %d send by PE#%d but assigned to PE#%d",
+ src, dev_pe, pe);
+ return;
+ }
+ }
+ qemu_irq_pulse(msis->ics.qirqs[src]);
+
+}
+
+void pnv_phb3_msi_ffi(Phb3MsiState *msis, uint64_t val)
+{
+ /* Emit interrupt */
+ pnv_phb3_msi_send(msis, val, 0, -1);
+
+ /* Clear FFI lock */
+ msis->phb->regs[PHB_FFI_LOCK >> 3] = 0;
+}
+
+static void phb3_msi_reject(ICSState *ics, uint32_t nr)
+{
+ Phb3MsiState *msis = PHB3_MSI(ics);
+ unsigned int srcno = nr - ics->offset;
+ unsigned int idx = srcno >> 6;
+ unsigned int bit = 1ull << (srcno & 0x3f);
+
+ assert(srcno < PHB3_MAX_MSI);
+
+ DBG_MSI(msis->phb, "MSI %d rejected", srcno);
+
+ msis->rba[idx] |= bit;
+ msis->rba_sum |= (1u << idx);
+}
+
+static void phb3_msi_resend(ICSState *ics)
+{
+ Phb3MsiState *msis = PHB3_MSI(ics);
+ unsigned int i,j;
+
+ if (msis->rba_sum == 0) {
+ return;
+ }
+
+ DBG_MSI(msis->phb, "MSI resend...");
+
+ for (i = 0; i < 32; i++) {
+ if ((msis->rba_sum & (1u << i)) == 0) {
+ continue;
+ }
+ msis->rba_sum &= ~(1u << i);
+ for (j = 0; j < 64; j++) {
+ if ((msis->rba[i] & (1ull << j)) == 0) {
+ continue;
+ }
+ msis->rba[i] &= ~(1u << j);
+ phb3_msi_try_send(msis, i * 64 + j, true);
+ }
+ }
+}
+
+static void phb3_msi_reset(DeviceState *dev)
+{
+ Phb3MsiState *msis = PHB3_MSI(dev);
+
+ memset(msis->rba, 0, sizeof(msis->rba));
+ msis->rba_sum = 0;
+}
+
+void pnv_phb3_msi_update_config(Phb3MsiState *msis, uint32_t base,
+ uint32_t count)
+{
+ if (count > PHB3_MAX_MSI) {
+ count = PHB3_MAX_MSI;
+ }
+ msis->ics.nr_irqs = count;
+ msis->ics.offset = base;
+}
+
+static void phb3_msi_realize(DeviceState *dev, Error **errp)
+{
+ Phb3MsiState *msis = PHB3_MSI(dev);
+
+ msis->ics.irqs = NULL;
+ msis->ics.qirqs = qemu_allocate_irqs(phb3_msi_set_irq, msis, PHB3_MAX_MSI);
+}
+
+static void phb3_msi_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ ICSStateClass *isc = ICS_CLASS(klass);
+
+ dc->realize = phb3_msi_realize;
+ dc->reset = phb3_msi_reset;
+ isc->reject = phb3_msi_reject;
+ isc->resend = phb3_msi_resend;
+}
+
+Phb3MsiState *pnv_phb3_msi_create(PnvPhb3State *phb)
+{
+ Phb3MsiState *msis;
+ DeviceState *dev;
+
+ dev = qdev_create(NULL, TYPE_PHB3_MSI);
+ msis = PHB3_MSI(dev);
+ msis->phb = phb;
+ phb->msis = msis;
+ xics_add_ics(phb->xics, &msis->ics);
+ qdev_init_nofail(dev);
+
+ return msis;
+}
+
+static const TypeInfo phb3_msi_info = {
+ .name = TYPE_PHB3_MSI,
+ .parent = TYPE_ICS,
+ .instance_size = sizeof(Phb3MsiState),
+ .class_init = phb3_msi_class_init,
+ .class_size = sizeof(ICSStateClass),
+ .instance_init = phb3_msi_initfn,
+};
+
+static void pnv_phb3_msi_register_types(void)
+{
+ type_register_static(&phb3_msi_info);
+}
+
+type_init(pnv_phb3_msi_register_types)
diff --git a/hw/pci-host/pnv_phb3_pbcq.c b/hw/pci-host/pnv_phb3_pbcq.c
new file mode 100644
index 0000000..e7006ab
--- /dev/null
+++ b/hw/pci-host/pnv_phb3_pbcq.c
@@ -0,0 +1,314 @@
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ *
+ * Copyright IBM Corp. 2014
+ */
+#include "hw/pci-host/pnv_phb3.h"
+#include "hw/pci/pci_bridge.h"
+#include "hw/pci/pci_bus.h"
+
+#include <libfdt.h>
+
+static bool pnv_pbcq_xscom_read(XScomDevice *dev, uint32_t range,
+ uint32_t offset, uint64_t *out_val)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(dev);
+
+ switch(range) {
+ case 0:
+ *out_val = pbcq->nest_regs[offset];
+ break;
+ case 1:
+ *out_val = pbcq->pci_regs[offset];
+ break;
+ case 2:
+ if (offset == PBCQ_SPCI_ASB_DATA) {
+ if (!pbcq->phb) {
+ *out_val = ~0ull;
+ break;
+ }
+ *out_val = pnv_phb3_reg_read(pbcq->phb,
+ pbcq->spci_regs[PBCQ_SPCI_ASB_ADDR], 8);
+ break;
+ }
+ *out_val = pbcq->spci_regs[offset];
+ break;
+ default:
+ return false;
+ }
+ return true;
+}
+
+static void pnv_pbcq_update_map(PnvPBCQState *pbcq)
+{
+ uint64_t bar_en = pbcq->nest_regs[PBCQ_NEST_BAR_EN];
+ uint64_t bar, mask, size;
+
+ /*
+ * NOTE: This will really not work well if those are remapped
+ * after the PHB has created its sub regions. We could do better
+ * if we had a way to resize regions but we don't really care
+ * that much in practice as the stuff below really only happens
+ * once early during boot
+ */
+
+ /* Handle unmaps */
+ if (pbcq->mmio0_mapped && !(bar_en & PBCQ_NEST_BAR_EN_MMIO0)) {
+ memory_region_del_subregion(get_system_memory(), &pbcq->mmbar0);
+ pbcq->mmio0_mapped = false;
+ }
+ if (pbcq->mmio1_mapped && !(bar_en & PBCQ_NEST_BAR_EN_MMIO1)) {
+ memory_region_del_subregion(get_system_memory(), &pbcq->mmbar1);
+ pbcq->mmio1_mapped = false;
+ }
+ if (pbcq->phb_mapped && !(bar_en & PBCQ_NEST_BAR_EN_PHB)) {
+ memory_region_del_subregion(get_system_memory(), &pbcq->phbbar);
+ pbcq->phb_mapped = false;
+ }
+
+ /* Update PHB if it exists */
+ if (pbcq->phb) {
+ pnv_phb3_update_regions(pbcq->phb);
+ }
+
+ /* Handle maps */
+ if (!pbcq->mmio0_mapped && (bar_en & PBCQ_NEST_BAR_EN_MMIO0)) {
+ bar = pbcq->nest_regs[PBCQ_NEST_MMIO_BAR0] >> 14;
+ mask = pbcq->nest_regs[PBCQ_NEST_MMIO_MASK0];
+ size = ((~mask) >> 14) + 1;
+ memory_region_init(&pbcq->mmbar0, OBJECT(pbcq), "pbcq-mmio0", size);
+ memory_region_add_subregion(get_system_memory(), bar, &pbcq->mmbar0);
+ pbcq->mmio0_mapped = true;
+ pbcq->mmio0_base = bar;
+ pbcq->mmio0_size = size;
+ }
+ if (!pbcq->mmio1_mapped && (bar_en & PBCQ_NEST_BAR_EN_MMIO1)) {
+ bar = pbcq->nest_regs[PBCQ_NEST_MMIO_BAR1] >> 14;
+ mask = pbcq->nest_regs[PBCQ_NEST_MMIO_MASK1];
+ size = ((~mask) >> 14) + 1;
+ memory_region_init(&pbcq->mmbar1, OBJECT(pbcq), "pbcq-mmio1", size);
+ memory_region_add_subregion(get_system_memory(), bar, &pbcq->mmbar1);
+ pbcq->mmio1_mapped = true;
+ pbcq->mmio1_base = bar;
+ pbcq->mmio1_size = size;
+ }
+ if (!pbcq->phb_mapped && (bar_en & PBCQ_NEST_BAR_EN_PHB)) {
+ bar = pbcq->nest_regs[PBCQ_NEST_PHB_BAR] >> 14;
+ size = 0x1000;
+ memory_region_init(&pbcq->phbbar, OBJECT(pbcq), "pbcq-phb", size);
+ memory_region_add_subregion(get_system_memory(), bar, &pbcq->phbbar);
+ pbcq->phb_mapped = true;
+ }
+
+ /* Update PHB if it exists */
+ if (pbcq->phb) {
+ pnv_phb3_update_regions(pbcq->phb);
+ }
+}
+
+static bool pnv_pbcq_xnest_write(PnvPBCQState *pbcq, uint32_t reg, uint64_t
val)
+{
+ switch(reg) {
+ case PBCQ_NEST_MMIO_BAR0:
+ case PBCQ_NEST_MMIO_BAR1:
+ case PBCQ_NEST_MMIO_MASK0:
+ case PBCQ_NEST_MMIO_MASK1:
+ if (pbcq->nest_regs[PBCQ_NEST_BAR_EN] &
+ (PBCQ_NEST_BAR_EN_MMIO0 |
+ PBCQ_NEST_BAR_EN_MMIO1)) {
+ printf("WARNING: PH3: Changing enabled BAR unsupported\n");
+ }
+ pbcq->nest_regs[reg] = val & 0xffffffffc0000000ull;
+ return true;
+ case PBCQ_NEST_PHB_BAR:
+ if (pbcq->nest_regs[PBCQ_NEST_BAR_EN] & PBCQ_NEST_BAR_EN_PHB) {
+ printf("WARNING: PH3: Changing enabled BAR unsupported\n");
+ }
+ pbcq->nest_regs[reg] = val & 0xfffffffffc000000ull;
+ return true;
+ case PBCQ_NEST_BAR_EN:
+ pbcq->nest_regs[reg] = val & 0xf800000000000000ull;
+ pnv_pbcq_update_map(pbcq);
+ pnv_phb3_remap_irqs(pbcq->phb);
+ return true;
+ case PBCQ_NEST_IRSN_COMPARE:
+ case PBCQ_NEST_IRSN_MASK:
+ pbcq->nest_regs[reg] = val & PBCQ_NEST_IRSN_COMP_MASK;
+ pnv_phb3_remap_irqs(pbcq->phb);
+ return true;
+ case PBCQ_NEST_LSI_SRC_ID:
+ pbcq->nest_regs[reg] = val & PBCQ_NEST_LSI_SRC_MASK;
+ pnv_phb3_remap_irqs(pbcq->phb);
+ return true;
+ }
+
+ /* XXX Don't error out on other regs for now ... */
+ return true;
+}
+
+static bool pnv_pbcq_xpci_write(PnvPBCQState *pbcq, uint32_t reg, uint64_t val)
+{
+ switch(reg) {
+ case PBCQ_PCI_BAR2:
+ pbcq->pci_regs[reg] = val & 0xfffffffffc000000ull;
+ pnv_pbcq_update_map(pbcq);
+ break;
+ }
+
+ /* XXX Don't error out on other regs for now ... */
+ return true;
+}
+
+static bool pnv_pbcq_xspci_write(PnvPBCQState *pbcq, uint32_t reg, uint64_t
val)
+{
+ switch(reg) {
+ case PBCQ_SPCI_ASB_ADDR:
+ pbcq->spci_regs[reg] = val & 0xfff;
+ return true;
+ case PBCQ_SPCI_ASB_STATUS:
+ pbcq->spci_regs[reg] &= ~val;
+ return true;
+ case PBCQ_SPCI_ASB_DATA:
+ if (!pbcq->phb) {
+ return true;
+ }
+ pnv_phb3_reg_write(pbcq->phb, pbcq->spci_regs[PBCQ_SPCI_ASB_ADDR],
val, 8);
+ return true;
+ // case PBCQ_SPCI_AIB_CAPP_EN:
+ // case PBCQ_SPCI_CAPP_SEC_TMR:
+ }
+
+ /* XXX Don't error out on other regs for now ... */
+ return true;
+}
+
+static bool pnv_pbcq_xscom_write(XScomDevice *dev, uint32_t range,
+ uint32_t offset, uint64_t val)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(dev);
+
+ switch(range) {
+ case 0:
+ return pnv_pbcq_xnest_write(pbcq, offset, val);
+ case 1:
+ return pnv_pbcq_xpci_write(pbcq, offset, val);
+ case 2:
+ return pnv_pbcq_xspci_write(pbcq, offset, val);
+ default:
+ return false;
+ }
+}
+
+static void pnv_pbcq_default_bars(PnvPBCQState *pbcq)
+{
+ uint64_t mm0, mm1, reg;
+
+ mm0 = 0x3d00000000000ull +
+ 0x4000000000ull * pbcq->chip_id +
+ 0x1000000000ull * pbcq->phb_id;
+ mm1 = 0x3ff8000000000ull +
+ 0x0200000000ull * pbcq->chip_id +
+ 0x0080000000ull * pbcq->phb_id;
+ reg = 0x3fffe40000000ull +
+ 0x0000400000ull * pbcq->chip_id +
+ 0x0000100000ull * pbcq->phb_id;
+
+ pbcq->nest_regs[PBCQ_NEST_MMIO_BAR0] = mm0 << 14;
+ pbcq->nest_regs[PBCQ_NEST_MMIO_BAR1] = mm1 << 14;
+ pbcq->nest_regs[PBCQ_NEST_PHB_BAR] = reg << 14;
+ pbcq->nest_regs[PBCQ_NEST_MMIO_MASK0] = 0x3fff000000000ull << 14;
+ pbcq->nest_regs[PBCQ_NEST_MMIO_MASK1] = 0x3ffff80000000ull << 14;
+ pbcq->pci_regs[PBCQ_PCI_BAR2] = reg << 14;
+}
+
+static void pnv_pbcq_realize(DeviceState *dev, Error **errp)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(dev);
+ XScomBus *xb = XSCOM_BUS(dev->parent_bus);
+ XScomDevice *xd = XSCOM_DEVICE(dev);
+
+ assert(pbcq->phb_id < 4);
+
+ /* Copy chip ID over for ease of access */
+ pbcq->chip_id = xb->chip_id;
+
+ /* Calculate XSCOM bases */
+ pbcq->nest_xbase = 0x02012000 + 0x400 * pbcq->phb_id;
+ pbcq->pci_xbase = 0x09012000 + 0x400 * pbcq->phb_id;
+ pbcq->spci_xbase = 0x09013c00 + 0x040 * pbcq->phb_id;
+ xd->ranges[0].addr = pbcq->nest_xbase;
+ xd->ranges[0].size = PBCQ_NEST_REGS_COUNT;
+ xd->ranges[1].addr = pbcq->pci_xbase;
+ xd->ranges[1].size = PBCQ_PCI_REGS_COUNT;
+ xd->ranges[2].addr = pbcq->spci_xbase;
+ xd->ranges[2].size = PBCQ_SPCI_REGS_COUNT;
+
+ /* XXX Fix OPAL to do that: establish default BAR values */
+ pnv_pbcq_default_bars(pbcq);
+}
+
+#define _FDT(exp) \
+ do { \
+ int ret = (exp); \
+ if (ret < 0) { \
+ fprintf(stderr, "qemu: error creating device tree: %s: %s\n", \
+ #exp, fdt_strerror(ret)); \
+ exit(1); \
+ } \
+ } while (0)
+
+
+static int pnv_pbcq_devnode(XScomDevice *dev, void *fdt)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(dev);
+
+ _FDT((fdt_property_cell(fdt, "ibm,phb-index", pbcq->phb_id)));
+
+ return 0;
+}
+
+static Property pnv_pbcq_properties[] = {
+ DEFINE_PROP_UINT32("phb_id", PnvPBCQState, phb_id, 0),
+ DEFINE_PROP_END_OF_LIST(),
+
+};
+
+static void pnv_pbcq_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ XScomDeviceClass *k = XSCOM_DEVICE_CLASS(klass);
+ static const char *compat[] = { "ibm,power8-pbcq", NULL };
+
+ k->devnode = pnv_pbcq_devnode;
+ k->read = pnv_pbcq_xscom_read;
+ k->write = pnv_pbcq_xscom_write;
+ k->dt_name = "pbcq";
+ k->dt_compatible = compat;
+
+ dc->realize = pnv_pbcq_realize;
+ dc->props = pnv_pbcq_properties;
+}
+
+static const TypeInfo pnv_pbcq_type_info = {
+ .name = TYPE_PNV_PBCQ,
+ .parent = TYPE_XSCOM_DEVICE,
+ .instance_size = sizeof(PnvPBCQState),
+ .class_init = pnv_pbcq_class_init,
+};
+
+static void pnv_pbcq_register_types(void)
+{
+ type_register_static(&pnv_pbcq_type_info);
+}
+
+type_init(pnv_pbcq_register_types)
diff --git a/hw/pci-host/pnv_phb3_rc.c b/hw/pci-host/pnv_phb3_rc.c
new file mode 100644
index 0000000..27c33fb
--- /dev/null
+++ b/hw/pci-host/pnv_phb3_rc.c
@@ -0,0 +1,132 @@
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ *
+ * Copyright IBM Corp. 2014
+ */
+#include "hw/pci-host/pnv_phb3.h"
+#include "hw/pci/pcie_port.h"
+
+static void pnv_phb3_rc_write_config(PCIDevice *d,
+ uint32_t address, uint32_t val, int len)
+{
+ uint32_t root_cmd =
+ pci_get_long(d->config + d->exp.aer_cap + PCI_ERR_ROOT_COMMAND);
+
+ pci_bridge_write_config(d, address, val, len);
+ pcie_cap_slot_write_config(d, address, val, len);
+ pcie_aer_write_config(d, address, val, len);
+ pcie_aer_root_write_config(d, address, val, len, root_cmd);
+}
+
+static void pnv_phb3_rc_reset(DeviceState *qdev)
+{
+ PCIDevice *d = PCI_DEVICE(qdev);
+
+ pcie_cap_root_reset(d);
+ pcie_cap_deverr_reset(d);
+ pcie_cap_slot_reset(d);
+ pcie_cap_arifwd_reset(d);
+ pcie_aer_root_reset(d);
+ pci_bridge_reset(qdev);
+ pci_bridge_disable_base_limit(d);
+}
+
+static int pnv_phb3_rc_initfn(PCIDevice *d)
+{
+ PCIEPort *p = PCIE_PORT(d);
+ PCIESlot *s = PCIE_SLOT(d);
+ int rc;
+
+ DEVICE(d)->id = "pcie";
+ rc = pci_bridge_initfn(d, TYPE_PCIE_BUS);
+ if (rc < 0) {
+ printf("phb3-rc: pci_bridge_init() error %d !\n", rc);
+ return rc;
+ }
+ /* XXX Make that a property ? Allow for only one device (8 functions) */
+ pci_bridge_get_sec_bus(PCI_BRIDGE(d))->devfn_max = 8;
+
+ pcie_port_init_reg(d);
+
+ rc = pcie_cap_init(d, 0x48, PCI_EXP_TYPE_ROOT_PORT, p->port);
+ if (rc < 0) {
+ printf("phb3-rc: pcie_cap_init() error %d !\n", rc);
+ goto err_bridge;
+ }
+ pcie_cap_arifwd_init(d);
+ pcie_cap_deverr_init(d);
+ pcie_cap_slot_init(d, s->slot);
+ pcie_chassis_create(s->chassis);
+ rc = pcie_chassis_add_slot(s);
+ if (rc < 0) {
+ printf("phb3-rc: pcie_chassis_add_slot() error %d !\n", rc);
+ goto err_pcie_cap;
+ }
+ pcie_cap_root_init(d);
+ rc = pcie_aer_init(d, 0x100);
+ if (rc < 0) {
+ printf("phb3-rc: pcie_aer_init() error %d !\n", rc);
+ goto err_slot;
+ }
+ pcie_aer_root_init(d);
+ return 0;
+
+err_slot:
+ pcie_chassis_del_slot(s);
+err_pcie_cap:
+ pcie_cap_exit(d);
+err_bridge:
+ pci_bridge_exitfn(d);
+ return rc;
+}
+
+static void pnv_phb3_rc_exitfn(PCIDevice *d)
+{
+ PCIESlot *s = PCIE_SLOT(d);
+
+ pcie_aer_exit(d);
+ pcie_chassis_del_slot(s);
+ pcie_cap_exit(d);
+ pci_bridge_exitfn(d);
+}
+
+static void pnv_phb3_rc_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+ k->is_express = 1;
+ k->is_bridge = 1;
+ k->init = pnv_phb3_rc_initfn;
+ k->exit = pnv_phb3_rc_exitfn;
+ k->config_write = pnv_phb3_rc_write_config;
+ k->vendor_id = PCI_VENDOR_ID_IBM;
+ k->device_id = 0x03dc;
+ k->revision = 0;
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->desc = "IBM PHB3 PCIE Root Port";
+ dc->reset = pnv_phb3_rc_reset;
+}
+
+static const TypeInfo pnv_phb3_rc_info = {
+ .name = TYPE_PNV_PHB3_RC,
+ .parent = TYPE_PCIE_SLOT,
+ .class_init = pnv_phb3_rc_class_init,
+};
+
+static void pnv_phb3_rc_register_types(void)
+{
+ type_register_static(&pnv_phb3_rc_info);
+}
+
+type_init(pnv_phb3_rc_register_types)
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index ae6efbd..d808802 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -44,9 +44,15 @@
#include "hw/ppc/xics.h"
#include "hw/ppc/pnv_xscom.h"
+#include "hw/pci/pci.h"
+#include "hw/pci/pci_bus.h"
+#include "hw/pci/pci_bridge.h"
+#include "hw/pci/msi.h"
#include "hw/isa/isa.h"
#include "hw/char/serial.h"
#include "hw/timer/mc146818rtc.h"
+#include "hw/pci-host/pnv_phb3.h"
+
#include "exec/address-spaces.h"
#include "qemu/config-file.h"
#include "qemu/error-report.h"
@@ -507,9 +513,11 @@ static void pnv_lpc_irq_handler_cpld(void *opaque, int n,
int level)
}
static void pnv_create_chip(PnvSystem *sys, unsigned int chip_no,
- bool has_lpc, bool has_lpc_irq)
+ bool has_lpc, bool has_lpc_irq,
+ unsigned int num_phbs)
{
PnvChip *chip = &sys->chips[chip_no];
+ unsigned int i;
if (chip_no >= PNV_MAX_CHIPS) {
return;
@@ -545,6 +553,11 @@ static void pnv_create_chip(PnvSystem *sys, unsigned int
chip_no,
/* Create the simplified OCC model */
pnv_occ_create(chip);
+
+ /* Create a PCI, for now do one chip with 2 PHBs */
+ for (i = 0; i < num_phbs; i++) {
+ pnv_phb3_create(chip, sys->xics, i);
+ }
}
static void ppc_powernv_init(MachineState *machine)
@@ -568,6 +581,9 @@ static void ppc_powernv_init(MachineState *machine)
void *fdt;
int i;
+ /* MSIs are supported on this platform */
+ msi_supported = true;
+
/* Set up Interrupt Controller before we create the VCPUs */
xics = xics_system_init(smp_cpus * kvmppc_smt_threads() / smp_threads,
XICS_IRQS_POWERNV);
@@ -607,9 +623,9 @@ static void ppc_powernv_init(MachineState *machine)
*/
sys->num_chips = 1;
- /* Create only one chip for now with an LPC bus
+ /* Create only one chip for now with an LPC bus and one PHB
*/
- pnv_create_chip(sys, 0, true, false);
+ pnv_create_chip(sys, 0, true, false, 1);
/* Grab chip 0's ISA bus */
isa_bus = sys->chips[0].lpc_bus;
diff --git a/include/hw/pci-host/pnv_phb3.h b/include/hw/pci-host/pnv_phb3.h
new file mode 100644
index 0000000..d70bf8b
--- /dev/null
+++ b/include/hw/pci-host/pnv_phb3.h
@@ -0,0 +1,145 @@
+#ifndef _HW_PNV_PHB3_H
+#define _HW_PNV_PHB3_H
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ *
+ * Copyright IBM Corp. 2014
+ */
+#include "hw/hw.h"
+#include "hw/ppc/pnv.h"
+#include "hw/pci/pci_host.h"
+#include "exec/address-spaces.h"
+#include "hw/pci-host/pnv_phb3_regs.h"
+#include "sysemu/cpus.h"
+#include "qom/cpu.h"
+#include "hw/ppc/pnv_xscom.h"
+#include "hw/ppc/xics.h"
+
+#define PHB_NUM_M64 16
+#define PHB_NUM_REGS (0x1000 >> 3)
+#define PHB_NUM_LSI 8
+#define PHB_NUM_PE 256
+
+#define PCI_MMIO_TOTAL_SIZE (0x1ull << 60)
+
+#define IODA2_PCI_BUS_MAX 256
+
+typedef struct PnvPBCQState PnvPBCQState;
+typedef struct PnvPhb3State PnvPhb3State;
+typedef struct PnvPhb3DMASpace PnvPhb3DMASpace;
+
+/* We don't want to include xics.h here */
+typedef struct XICSState XICSState;
+typedef struct ICSState ICSState;
+
+/* Similarily with pnv_phb3_msi */
+typedef struct Phb3MsiState Phb3MsiState;
+
+/* We have one such address space wrapper per possible device
+ * under the PHB since they need to be assigned statically at
+ * qemu device creation time. The relationship to a PE is done
+ * later dynamically. This means we can potentially create a lot
+ * of these guys. Q35 stores them as some kind of radix tree but
+ * we never really need to do fast lookups so instead we simply
+ * keep a QLIST of them for now, we can add the radix if needed
+ * later on.
+ *
+ * We do cache the PE number to speed things up a bit though.
+ */
+struct PnvPhb3DMASpace {
+ PCIBus *bus;
+ uint8_t devfn;
+ int pe_num; /* Cached PE number */
+#define PHB_INVALID_PE (-1)
+ PnvPhb3State *phb;
+ AddressSpace dma_as;
+ MemoryRegion dma_mr;
+ MemoryRegion msi32_mr;
+ MemoryRegion msi64_mr;
+ bool msi32_mapped;
+ bool msi64_mapped;
+ QLIST_ENTRY(PnvPhb3DMASpace) list;
+};
+
+struct PnvPhb3State {
+ PCIHostState parent_obj;
+ MemoryRegion mr_m32;
+ MemoryRegion mr_m64[PHB_NUM_M64];
+ MemoryRegion mr_regs;
+ bool regs_mapped;
+ bool m32_mapped;
+ bool m64_mapped[PHB_NUM_M64];
+ MemoryRegion pci_mmio;
+ MemoryRegion pci_io;
+ uint64_t regs[PHB_NUM_REGS];
+ PnvPBCQState *pbcq;
+ uint64_t ioda_LIST[8];
+ uint64_t ioda_LXIVT[8];
+ uint64_t ioda_TVT[512];
+ uint64_t ioda_M64BT[16];
+ uint64_t ioda_MDT[256];
+ uint64_t ioda_PEEV[4];
+ uint32_t total_irq;
+ XICSState *xics;
+ ICSState *lsi_ics;
+ Phb3MsiState *msis;
+ QLIST_HEAD(, PnvPhb3DMASpace) dma_spaces;
+};
+
+struct PnvPBCQState {
+ XScomDevice xd;
+ uint32_t chip_id;
+ uint32_t phb_id;
+ uint32_t nest_xbase;
+ uint32_t spci_xbase;
+ uint32_t pci_xbase;
+ uint64_t nest_regs[PBCQ_NEST_REGS_COUNT];
+ uint64_t spci_regs[PBCQ_SPCI_REGS_COUNT];
+ uint64_t pci_regs[PBCQ_PCI_REGS_COUNT];
+ MemoryRegion mmbar0;
+ MemoryRegion mmbar1;
+ MemoryRegion phbbar;
+ bool mmio0_mapped;
+ bool mmio1_mapped;
+ bool phb_mapped;
+ uint64_t mmio0_base;
+ uint64_t mmio0_size;
+ uint64_t mmio1_base;
+ uint64_t mmio1_size;
+ PnvPhb3State *phb;
+};
+
+#define TYPE_PNV_PBCQ "pnv-pbcq"
+#define PNV_PBCQ(obj) \
+ OBJECT_CHECK(PnvPBCQState, (obj), TYPE_PNV_PBCQ)
+
+
+#define TYPE_PNV_PHB3 "pnv-phb3"
+#define PNV_PHB3(obj) \
+ OBJECT_CHECK(PnvPhb3State, (obj), TYPE_PNV_PHB3)
+
+#define TYPE_PNV_PHB3_RC "pnv-phb3-rc"
+
+uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size);
+void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size);
+void pnv_phb3_update_regions(PnvPhb3State *phb);
+void pnv_phb3_remap_irqs(PnvPhb3State *phb);
+void pnv_phb3_create(PnvChip *chip, XICSState *xics, uint32_t idx);
+Phb3MsiState *pnv_phb3_msi_create(PnvPhb3State *phb);
+void pnv_phb3_msi_update_config(Phb3MsiState *msis, uint32_t base,
+ uint32_t count);
+void pnv_phb3_msi_send(Phb3MsiState *msis, uint64_t addr, uint16_t data,
+ int32_t dev_pe);
+void pnv_phb3_msi_ffi(Phb3MsiState *msis, uint64_t val);
+
+#endif /* _HW_PNV_PHB3_H */
diff --git a/include/hw/pci-host/pnv_phb3_regs.h
b/include/hw/pci-host/pnv_phb3_regs.h
new file mode 100644
index 0000000..daad8fc
--- /dev/null
+++ b/include/hw/pci-host/pnv_phb3_regs.h
@@ -0,0 +1,505 @@
+/* Copyright 2013-2014 IBM Corp.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ * implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __PHB3_REGS_H
+#define __PHB3_REGS_H
+
+#define PPC_BIT(bit) (0x8000000000000000UL >> (bit))
+#define PPC_BIT32(bit) (0x80000000UL >> (bit))
+#define PPC_BIT8(bit) (0x80UL >> (bit))
+#define PPC_BITMASK(bs,be) ((PPC_BIT(bs) - PPC_BIT(be)) | PPC_BIT(bs))
+#define PPC_BITMASK32(bs,be) ((PPC_BIT32(bs) - PPC_BIT32(be))|PPC_BIT32(bs))
+#define PPC_BITLSHIFT(be) (63 - (be))
+#define PPC_BITLSHIFT32(be) (31 - (be))
+
+/* Extract field fname from val */
+#define GETFIELD(fname, val) \
+ (((val) & fname##_MASK) >> fname##_LSH)
+
+/* Set field fname of oval to fval
+ * NOTE: oval isn't modified, the combined result is returned
+ */
+#define SETFIELD(fname, oval, fval) \
+ (((oval) & ~fname##_MASK) | \
+ ((((typeof(oval))(fval)) << fname##_LSH) & fname##_MASK))
+
+/*
+ * PBCQ XSCOM registers
+ */
+
+#define PBCQ_NEST_IRSN_COMPARE 0x1a
+#define PBCQ_NEST_IRSN_COMP_MASK PPC_BITMASK(0,18)
+#define PBCQ_NEST_IRSN_COMP_LSH PPC_BITLSHIFT(18)
+#define PBCQ_NEST_IRSN_MASK 0x1b
+#define PBCQ_NEST_LSI_SRC_ID 0x1f
+#define PBCQ_NEST_LSI_SRC_MASK PPC_BITMASK(0,7)
+#define PBCQ_NEST_LSI_SRC_LSH PPC_BITLSHIFT(7)
+#define PBCQ_NEST_REGS_COUNT 0x46
+#define PBCQ_NEST_MMIO_BAR0 0x40
+#define PBCQ_NEST_MMIO_BAR1 0x41
+#define PBCQ_NEST_PHB_BAR 0x42
+#define PBCQ_NEST_MMIO_MASK0 0x43
+#define PBCQ_NEST_MMIO_MASK1 0x44
+#define PBCQ_NEST_BAR_EN 0x45
+#define PBCQ_NEST_BAR_EN_MMIO0 PPC_BIT(0)
+#define PBCQ_NEST_BAR_EN_MMIO1 PPC_BIT(1)
+#define PBCQ_NEST_BAR_EN_PHB PPC_BIT(2)
+#define PBCQ_NEST_BAR_EN_IRSN_RX PPC_BIT(3)
+#define PBCQ_NEST_BAR_EN_IRSN_TX PPC_BIT(4)
+
+#define PBCQ_PCI_REGS_COUNT 0x15
+#define PBCQ_PCI_BAR2 0x0b
+
+#define PBCQ_SPCI_REGS_COUNT 0x5
+#define PBCQ_SPCI_ASB_ADDR 0x0
+#define PBCQ_SPCI_ASB_STATUS 0x1
+#define PBCQ_SPCI_ASB_DATA 0x2
+#define PBCQ_SPCI_AIB_CAPP_EN 0x3
+#define PBCQ_SPCI_CAPP_SEC_TMR 0x4
+
+/*
+ * PHB MMIO registers
+ */
+
+/* PHB Fundamental register set A */
+#define PHB_LSI_SOURCE_ID 0x100
+#define PHB_LSI_SRC_ID_MASK PPC_BITMASK(5,12)
+#define PHB_LSI_SRC_ID_LSH PPC_BITLSHIFT(12)
+#define PHB_DMA_CHAN_STATUS 0x110
+#define PHB_DMA_CHAN_ANY_ERR PPC_BIT(27)
+#define PHB_DMA_CHAN_ANY_ERR1 PPC_BIT(28)
+#define PHB_DMA_CHAN_ANY_FREEZE PPC_BIT(29)
+#define PHB_CPU_LOADSTORE_STATUS 0x120
+#define PHB_CPU_LS_ANY_ERR PPC_BIT(27)
+#define PHB_CPU_LS_ANY_ERR1 PPC_BIT(28)
+#define PHB_CPU_LS_ANY_FREEZE PPC_BIT(29)
+#define PHB_DMA_MSI_NODE_ID 0x128
+#define PHB_DMAMSI_NID_FIXED PPC_BIT(0)
+#define PHB_DMAMSI_NID_MASK PPC_BITMASK(24,31)
+#define PHB_DMAMSI_NID_LSH PPC_BITLSHIFT(31)
+#define PHB_CONFIG_DATA 0x130
+#define PHB_LOCK0 0x138
+#define PHB_CONFIG_ADDRESS 0x140
+#define PHB_CA_ENABLE PPC_BIT(0)
+#define PHB_CA_BUS_MASK PPC_BITMASK(4,11)
+#define PHB_CA_BUS_LSH PPC_BITLSHIFT(11)
+#define PHB_CA_DEV_MASK PPC_BITMASK(12,16)
+#define PHB_CA_DEV_LSH PPC_BITLSHIFT(16)
+#define PHB_CA_FUNC_MASK PPC_BITMASK(17,19)
+#define PHB_CA_FUNC_LSH PPC_BITLSHIFT(19)
+#define PHB_CA_REG_MASK PPC_BITMASK(20,31)
+#define PHB_CA_REG_LSH PPC_BITLSHIFT(31)
+#define PHB_CA_PE_MASK PPC_BITMASK(40,47)
+#define PHB_CA_PE_LSH PPC_BITLSHIFT(47)
+#define PHB_LOCK1 0x148
+#define PHB_IVT_BAR 0x150
+#define PHB_IVT_BAR_ENABLE PPC_BIT(0)
+#define PHB_IVT_BASE_ADDRESS_MASK PPC_BITMASK(14,48)
+#define PHB_IVT_BASE_ADDRESS_LSH PPC_BITLSHIFT(48)
+#define PHB_IVT_LENGTH_MASK PPC_BITMASK(52,63)
+#define PHB_IVT_LENGTH_ADDRESS_LSH PPC_BITLSHIFT(63)
+#define PHB_RBA_BAR 0x158
+#define PHB_RBA_BAR_ENABLE PPC_BIT(0)
+#define PHB_RBA_BASE_ADDRESS_MASK PPC_BITMASK(14,55)
+#define PHB_RBA_BASE_ADDRESS_LSH PPC_BITLSHIFT(55)
+#define PHB_PHB3_CONFIG 0x160
+#define PHB_PHB3C_64B_TCE_EN PPC_BIT(2)
+#define PHB_PHB3C_32BIT_MSI_EN PPC_BIT(8)
+#define PHB_PHB3C_64BIT_MSI_EN PPC_BIT(14)
+#define PHB_PHB3C_M32_EN PPC_BIT(16)
+#define PHB_RTT_BAR 0x168
+#define PHB_RTT_BAR_ENABLE PPC_BIT(0)
+#define PHB_RTT_BASE_ADDRESS_MASK PPC_BITMASK(14,46)
+#define PHB_RTT_BASE_ADDRESS_LSH PPC_BITLSHIFT(46)
+#define PHB_PELTV_BAR 0x188
+#define PHB_PELTV_BAR_ENABLE PPC_BIT(0)
+#define PHB_PELTV_BASE_ADDRESS_MASK PPC_BITMASK(14,50)
+#define PHB_PELTV_BASE_ADDRESS_LSH PPC_BITLSHIFT(50)
+#define PHB_M32_BASE_ADDR 0x190
+#define PHB_M32_BASE_MASK 0x198
+#define PHB_M32_START_ADDR 0x1a0
+#define PHB_PEST_BAR 0x1a8
+#define PHB_PEST_BAR_ENABLE PPC_BIT(0)
+#define PHB_PEST_BASE_ADDRESS_MASK PPC_BITMASK(14,51)
+#define PHB_PEST_BASE_ADDRESS_LSH PPC_BITLSHIFT(51)
+#define PHB_M64_UPPER_BITS 0x1f0
+#define PHB_INTREP_TIMER 0x1f8
+#define PHB_DMARD_SYNC 0x200
+#define PHB_RTC_INVALIDATE 0x208
+#define PHB_RTC_INVALIDATE_ALL PPC_BIT(0)
+#define PHB_RTC_INVALIDATE_RID_MASK PPC_BITMASK(16,31)
+#define PHB_RTC_INVALIDATE_RID_LSH PPC_BITLSHIFT(31)
+#define PHB_TCE_KILL 0x210
+#define PHB_TCE_KILL_ALL PPC_BIT(0)
+#define PHB_TCE_SPEC_CTL 0x218
+#define PHB_IODA_ADDR 0x220
+#define PHB_IODA_AD_AUTOINC PPC_BIT(0)
+#define PHB_IODA_AD_TSEL_MASK PPC_BITMASK(11,15)
+#define PHB_IODA_AD_TSEL_LSH PPC_BITLSHIFT(15)
+#define PHB_IODA_AD_TADR_MASK PPC_BITMASK(55,63)
+#define PHB_IODA_AD_TADR_LSH PPC_BITLSHIFT(63)
+#define PHB_IODA_DATA0 0x228
+#define PHB_FFI_REQUEST 0x238
+#define PHB_FFI_LOCK_CLEAR PPC_BIT(3)
+#define PHB_FFI_REQUEST_ISN_MASK PPC_BITMASK(49,59)
+#define PHB_FFI_REQUEST_ISN_LSH PPC_BITLSHIFT(59)
+#define PHB_FFI_LOCK 0x240
+#define PHB_FFI_LOCK_STATE PPC_BIT(0)
+#define PHB_XIVE_UPDATE 0x248 /* Broken in DD1 */
+#define PHB_PHB3_GEN_CAP 0x250
+#define PHB_PHB3_TCE_CAP 0x258
+#define PHB_PHB3_IRQ_CAP 0x260
+#define PHB_PHB3_EEH_CAP 0x268
+#define PHB_IVC_INVALIDATE 0x2a0
+#define PHB_IVC_INVALIDATE_ALL PPC_BIT(0)
+#define PHB_IVC_INVALIDATE_SID_MASK PPC_BITMASK(16,31)
+#define PHB_IVC_INVALIDATE_SID_LSH PPC_BITLSHIFT(31)
+#define PHB_IVC_UPDATE 0x2a8
+#define PHB_IVC_UPDATE_ENABLE_P PPC_BIT(0)
+#define PHB_IVC_UPDATE_ENABLE_Q PPC_BIT(1)
+#define PHB_IVC_UPDATE_ENABLE_SERVER PPC_BIT(2)
+#define PHB_IVC_UPDATE_ENABLE_PRI PPC_BIT(3)
+#define PHB_IVC_UPDATE_ENABLE_GEN PPC_BIT(4)
+#define PHB_IVC_UPDATE_ENABLE_CON PPC_BIT(5)
+#define PHB_IVC_UPDATE_GEN_MATCH_MASK PPC_BITMASK(6, 7)
+#define PHB_IVC_UPDATE_GEN_MATCH_LSH PPC_BITLSHIFT(7)
+#define PHB_IVC_UPDATE_SERVER_MASK PPC_BITMASK(8, 23)
+#define PHB_IVC_UPDATE_SERVER_LSH PPC_BITLSHIFT(23)
+#define PHB_IVC_UPDATE_PRI_MASK PPC_BITMASK(24, 31)
+#define PHB_IVC_UPDATE_PRI_LSH PPC_BITLSHIFT(31)
+#define PHB_IVC_UPDATE_GEN_MASK PPC_BITMASK(32,33)
+#define PHB_IVC_UPDATE_GEN_LSH PPC_BITLSHIFT(33)
+#define PHB_IVC_UPDATE_P_MASK PPC_BITMASK(34,34)
+#define PHB_IVC_UPDATE_P_LSH PPC_BITLSHIFT(34)
+#define PHB_IVC_UPDATE_Q_MASK PPC_BITMASK(35,35)
+#define PHB_IVC_UPDATE_Q_LSH PPC_BITLSHIFT(35)
+#define PHB_IVC_UPDATE_SID_MASK PPC_BITMASK(48,63)
+#define PHB_IVC_UPDATE_SID_LSH PPC_BITLSHIFT(63)
+#define PHB_PAPR_ERR_INJ_CTL 0x2b0
+#define PHB_PAPR_ERR_INJ_CTL_INB PPC_BIT(0)
+#define PHB_PAPR_ERR_INJ_CTL_OUTB PPC_BIT(1)
+#define PHB_PAPR_ERR_INJ_CTL_STICKY PPC_BIT(2)
+#define PHB_PAPR_ERR_INJ_CTL_CFG PPC_BIT(3)
+#define PHB_PAPR_ERR_INJ_CTL_RD PPC_BIT(4)
+#define PHB_PAPR_ERR_INJ_CTL_WR PPC_BIT(5)
+#define PHB_PAPR_ERR_INJ_CTL_FREEZE PPC_BIT(6)
+#define PHB_PAPR_ERR_INJ_ADDR 0x2b8
+#define PHB_PAPR_ERR_INJ_ADDR_MMIO_MASK PPC_BITMASK(16,63)
+#define PHB_PAPR_ERR_INJ_ADDR_MMIO_LSH PPC_BITLSHIFT(63)
+#define PHB_PAPR_ERR_INJ_MASK 0x2c0
+#define PHB_PAPR_ERR_INJ_MASK_CFG_MASK PPC_BITMASK(4,11)
+#define PHB_PAPR_ERR_INJ_MASK_CFG_LSH PPC_BITLSHIFT(11)
+#define PHB_PAPR_ERR_INJ_MASK_MMIO_MASK PPC_BITMASK(16,63)
+#define PHB_PAPR_ERR_INJ_MASK_MMIO_LSH PPC_BITLSHIFT(63)
+#define PHB_ETU_ERR_SUMMARY 0x2c8
+
+/* UTL registers */
+#define UTL_SYS_BUS_CONTROL 0x400
+#define UTL_STATUS 0x408
+#define UTL_SYS_BUS_AGENT_STATUS 0x410
+#define UTL_SYS_BUS_AGENT_ERR_SEVERITY 0x418
+#define UTL_SYS_BUS_AGENT_IRQ_EN 0x420
+#define UTL_SYS_BUS_BURST_SZ_CONF 0x440
+#define UTL_REVISION_ID 0x448
+#define UTL_BCLK_DOMAIN_DBG1 0x460
+#define UTL_BCLK_DOMAIN_DBG2 0x468
+#define UTL_BCLK_DOMAIN_DBG3 0x470
+#define UTL_BCLK_DOMAIN_DBG4 0x478
+#define UTL_BCLK_DOMAIN_DBG5 0x480
+#define UTL_BCLK_DOMAIN_DBG6 0x488
+#define UTL_OUT_POST_HDR_BUF_ALLOC 0x4c0
+#define UTL_OUT_POST_DAT_BUF_ALLOC 0x4d0
+#define UTL_IN_POST_HDR_BUF_ALLOC 0x4e0
+#define UTL_IN_POST_DAT_BUF_ALLOC 0x4f0
+#define UTL_OUT_NP_BUF_ALLOC 0x500
+#define UTL_IN_NP_BUF_ALLOC 0x510
+#define UTL_PCIE_TAGS_ALLOC 0x520
+#define UTL_GBIF_READ_TAGS_ALLOC 0x530
+#define UTL_PCIE_PORT_CONTROL 0x540
+#define UTL_PCIE_PORT_STATUS 0x548
+#define UTL_PCIE_PORT_ERROR_SEV 0x550
+#define UTL_PCIE_PORT_IRQ_EN 0x558
+#define UTL_RC_STATUS 0x560
+#define UTL_RC_ERR_SEVERITY 0x568
+#define UTL_RC_IRQ_EN 0x570
+#define UTL_EP_STATUS 0x578
+#define UTL_EP_ERR_SEVERITY 0x580
+#define UTL_EP_ERR_IRQ_EN 0x588
+#define UTL_PCI_PM_CTRL1 0x590
+#define UTL_PCI_PM_CTRL2 0x598
+#define UTL_GP_CTL1 0x5a0
+#define UTL_GP_CTL2 0x5a8
+#define UTL_PCLK_DOMAIN_DBG1 0x5b0
+#define UTL_PCLK_DOMAIN_DBG2 0x5b8
+#define UTL_PCLK_DOMAIN_DBG3 0x5c0
+#define UTL_PCLK_DOMAIN_DBG4 0x5c8
+
+/* PCI-E Stack registers */
+#define PHB_PCIE_SYSTEM_CONFIG 0x600
+#define PHB_PCIE_BUS_NUMBER 0x608
+#define PHB_PCIE_SYSTEM_TEST 0x618
+#define PHB_PCIE_LINK_MANAGEMENT 0x630
+#define PHB_PCIE_LM_LINK_ACTIVE PPC_BIT(8)
+#define PHB_PCIE_DLP_TRAIN_CTL 0x640
+#define PHB_PCIE_DLP_TCTX_DISABLE PPC_BIT(1)
+#define PHB_PCIE_DLP_TCRX_DISABLED PPC_BIT(16)
+#define PHB_PCIE_DLP_INBAND_PRESENCE PPC_BIT(19)
+#define PHB_PCIE_DLP_TC_DL_LINKUP PPC_BIT(21)
+#define PHB_PCIE_DLP_TC_DL_PGRESET PPC_BIT(22)
+#define PHB_PCIE_DLP_TC_DL_LINKACT PPC_BIT(23)
+#define PHB_PCIE_SLOP_LOOPBACK_STATUS 0x648
+#define PHB_PCIE_SYS_LINK_INIT 0x668
+#define PHB_PCIE_UTL_CONFIG 0x670
+#define PHB_PCIE_DLP_CONTROL 0x678
+#define PHB_PCIE_UTL_ERRLOG1 0x680
+#define PHB_PCIE_UTL_ERRLOG2 0x688
+#define PHB_PCIE_UTL_ERRLOG3 0x690
+#define PHB_PCIE_UTL_ERRLOG4 0x698
+#define PHB_PCIE_DLP_ERRLOG1 0x6a0
+#define PHB_PCIE_DLP_ERRLOG2 0x6a8
+#define PHB_PCIE_DLP_ERR_STATUS 0x6b0
+#define PHB_PCIE_DLP_ERR_COUNTERS 0x6b8
+#define PHB_PCIE_UTL_ERR_INJECT 0x6c0
+#define PHB_PCIE_TLDLP_ERR_INJECT 0x6c8
+#define PHB_PCIE_LANE_EQ_CNTL0 0x6d0
+#define PHB_PCIE_LANE_EQ_CNTL1 0x6d8
+#define PHB_PCIE_LANE_EQ_CNTL2 0x6e0
+#define PHB_PCIE_LANE_EQ_CNTL3 0x6e8
+#define PHB_PCIE_STRAPPING 0x700
+
+/* Fundamental register set B */
+#define PHB_VERSION 0x800
+#define PHB_RESET 0x808
+#define PHB_CONTROL 0x810
+#define PHB_CTRL_IVE_128_BYTES PPC_BIT(24)
+#define PHB_AIB_RX_CRED_INIT_TIMER 0x818
+#define PHB_AIB_RX_CMD_CRED 0x820
+#define PHB_AIB_RX_DATA_CRED 0x828
+#define PHB_AIB_TX_CMD_CRED 0x830
+#define PHB_AIB_TX_DATA_CRED 0x838
+#define PHB_AIB_TX_CHAN_MAPPING 0x840
+#define PHB_AIB_TAG_ENABLE 0x858
+#define PHB_AIB_FENCE_CTRL 0x860
+#define PHB_TCE_TAG_ENABLE 0x868
+#define PHB_TCE_WATERMARK 0x870
+#define PHB_TIMEOUT_CTRL1 0x878
+#define PHB_TIMEOUT_CTRL2 0x880
+#define PHB_QUIESCE_DMA_G 0x888
+#define PHB_AIB_TAG_STATUS 0x900
+#define PHB_TCE_TAG_STATUS 0x908
+
+/* FIR & Error registers */
+#define PHB_LEM_FIR_ACCUM 0xc00
+#define PHB_LEM_FIR_AND_MASK 0xc08
+#define PHB_LEM_FIR_OR_MASK 0xc10
+#define PHB_LEM_ERROR_MASK 0xc18
+#define PHB_LEM_ERROR_AND_MASK 0xc20
+#define PHB_LEM_ERROR_OR_MASK 0xc28
+#define PHB_LEM_ACTION0 0xc30
+#define PHB_LEM_ACTION1 0xc38
+#define PHB_LEM_WOF 0xc40
+#define PHB_ERR_STATUS 0xc80
+#define PHB_ERR1_STATUS 0xc88
+#define PHB_ERR_INJECT 0xc90
+#define PHB_ERR_LEM_ENABLE 0xc98
+#define PHB_ERR_IRQ_ENABLE 0xca0
+#define PHB_ERR_FREEZE_ENABLE 0xca8
+#define PHB_ERR_AIB_FENCE_ENABLE 0xcb0
+#define PHB_ERR_LOG_0 0xcc0
+#define PHB_ERR_LOG_1 0xcc8
+#define PHB_ERR_STATUS_MASK 0xcd0
+#define PHB_ERR1_STATUS_MASK 0xcd8
+
+#define PHB_OUT_ERR_STATUS 0xd00
+#define PHB_OUT_ERR1_STATUS 0xd08
+#define PHB_OUT_ERR_INJECT 0xd10
+#define PHB_OUT_ERR_LEM_ENABLE 0xd18
+#define PHB_OUT_ERR_IRQ_ENABLE 0xd20
+#define PHB_OUT_ERR_FREEZE_ENABLE 0xd28
+#define PHB_OUT_ERR_AIB_FENCE_ENABLE 0xd30
+#define PHB_OUT_ERR_LOG_0 0xd40
+#define PHB_OUT_ERR_LOG_1 0xd48
+#define PHB_OUT_ERR_STATUS_MASK 0xd50
+#define PHB_OUT_ERR1_STATUS_MASK 0xd58
+
+#define PHB_INA_ERR_STATUS 0xd80
+#define PHB_INA_ERR1_STATUS 0xd88
+#define PHB_INA_ERR_INJECT 0xd90
+#define PHB_INA_ERR_LEM_ENABLE 0xd98
+#define PHB_INA_ERR_IRQ_ENABLE 0xda0
+#define PHB_INA_ERR_FREEZE_ENABLE 0xda8
+#define PHB_INA_ERR_AIB_FENCE_ENABLE 0xdb0
+#define PHB_INA_ERR_LOG_0 0xdc0
+#define PHB_INA_ERR_LOG_1 0xdc8
+#define PHB_INA_ERR_STATUS_MASK 0xdd0
+#define PHB_INA_ERR1_STATUS_MASK 0xdd8
+
+#define PHB_INB_ERR_STATUS 0xe00
+#define PHB_INB_ERR1_STATUS 0xe08
+#define PHB_INB_ERR_INJECT 0xe10
+#define PHB_INB_ERR_LEM_ENABLE 0xe18
+#define PHB_INB_ERR_IRQ_ENABLE 0xe20
+#define PHB_INB_ERR_FREEZE_ENABLE 0xe28
+#define PHB_INB_ERR_AIB_FENCE_ENABLE 0xe30
+#define PHB_INB_ERR_LOG_0 0xe40
+#define PHB_INB_ERR_LOG_1 0xe48
+#define PHB_INB_ERR_STATUS_MASK 0xe50
+#define PHB_INB_ERR1_STATUS_MASK 0xe58
+
+/* Performance monitor & Debug registers */
+#define PHB_TRACE_CONTROL 0xf80
+#define PHB_PERFMON_CONFIG 0xf88
+#define PHB_PERFMON_CTR0 0xf90
+#define PHB_PERFMON_CTR1 0xf98
+#define PHB_PERFMON_CTR2 0xfa0
+#define PHB_PERFMON_CTR3 0xfa8
+#define PHB_HOTPLUG_OVERRIDE 0xfb0
+#define PHB_HPOVR_FORCE_RESAMPLE PPC_BIT(9)
+#define PHB_HPOVR_PRESENCE_A PPC_BIT(10)
+#define PHB_HPOVR_PRESENCE_B PPC_BIT(11)
+#define PHB_HPOVR_LINK_ACTIVE PPC_BIT(12)
+#define PHB_HPOVR_LINK_BIFURCATED PPC_BIT(13)
+#define PHB_HPOVR_LINK_LANE_SWAPPED PPC_BIT(14)
+
+/*
+ * IODA2 on-chip tables
+ */
+
+#define IODA2_TBL_LIST 1
+#define IODA2_TBL_LXIVT 2
+#define IODA2_TBL_IVC_CAM 3
+#define IODA2_TBL_RBA 4
+#define IODA2_TBL_RCAM 5
+#define IODA2_TBL_MRT 6
+#define IODA2_TBL_PESTA 7
+#define IODA2_TBL_PESTB 8
+#define IODA2_TBL_TVT 9
+#define IODA2_TBL_TCAM 10
+#define IODA2_TBL_TDR 11
+#define IODA2_TBL_M64BT 16
+#define IODA2_TBL_M32DT 17
+#define IODA2_TBL_PEEV 20
+
+/* LXIVT */
+#define IODA2_LXIVT_SERVER_MASK PPC_BITMASK(8,23)
+#define IODA2_LXIVT_SERVER_LSH PPC_BITLSHIFT(23)
+#define IODA2_LXIVT_PRIORITY_MASK PPC_BITMASK(24,31)
+#define IODA2_LXIVT_PRIORITY_LSH PPC_BITLSHIFT(31)
+#define IODA2_LXIVT_NODE_ID_MASK PPC_BITMASK(56,63)
+#define IODA2_LXIVT_NODE_ID_LSH PPC_BITLSHIFT(63)
+
+/* IVT */
+#define IODA2_IVT_SERVER_MASK PPC_BITMASK(0,23)
+#define IODA2_IVT_SERVER_LSH PPC_BITLSHIFT(23)
+#define IODA2_IVT_PRIORITY_MASK PPC_BITMASK(24,31)
+#define IODA2_IVT_PRIORITY_LSH PPC_BITLSHIFT(31)
+#define IODA2_IVT_GEN_MASK PPC_BITMASK(37,38)
+#define IODA2_IVT_GEN_LSH PPC_BITLSHIFT(38)
+#define IODA2_IVT_P_MASK PPC_BITMASK(39,39)
+#define IODA2_IVT_P_LSH PPC_BITLSHIFT(39)
+#define IODA2_IVT_Q_MASK PPC_BITMASK(47,47)
+#define IODA2_IVT_Q_LSH PPC_BITLSHIFT(47)
+#define IODA2_IVT_PE_MASK PPC_BITMASK(48,63)
+#define IODA2_IVT_PE_LSH PPC_BITLSHIFT(63)
+
+/* TVT */
+#define IODA2_TVT_TABLE_ADDR_MASK PPC_BITMASK(0,47)
+#define IODA2_TVT_TABLE_ADDR_LSH PPC_BITLSHIFT(47)
+#define IODA2_TVT_NUM_LEVELS_MASK PPC_BITMASK(48,50)
+#define IODA2_TVT_NUM_LEVELS_LSH PPC_BITLSHIFT(50)
+#define IODA2_TVE_1_LEVEL 0
+#define IODA2_TVE_2_LEVELS 1
+#define IODA2_TVE_3_LEVELS 2
+#define IODA2_TVE_4_LEVELS 3
+#define IODA2_TVE_5_LEVELS 4
+#define IODA2_TVT_TCE_TABLE_SIZE_MASK PPC_BITMASK(51,55)
+#define IODA2_TVT_TCE_TABLE_SIZE_LSH PPC_BITLSHIFT(55)
+#define IODA2_TVT_IO_PSIZE_MASK PPC_BITMASK(59,63)
+#define IODA2_TVT_IO_PSIZE_LSH PPC_BITLSHIFT(63)
+
+/* PESTA */
+#define IODA2_PESTA_MMIO_FROZEN PPC_BIT(0)
+
+/* PESTB */
+#define IODA2_PESTB_DMA_STOPPED PPC_BIT(0)
+
+/* M32DT */
+#define IODA2_M32DT_PE_MASK PPC_BITMASK(8,15)
+#define IODA2_M32DT_PE_LSH PPC_BITLSHIFT(15)
+
+/* M64BT */
+#define IODA2_M64BT_ENABLE PPC_BIT(0)
+#define IODA2_M64BT_SINGLE_PE PPC_BIT(1)
+#define IODA2_M64BT_BASE_MASK PPC_BITMASK(2,31)
+#define IODA2_M64BT_BASE_LSH PPC_BITLSHIFT(31)
+#define IODA2_M64BT_MASK_MASK PPC_BITMASK(34,63)
+#define IODA2_M64BT_MASK_LSH PPC_BITLSHIFT(63)
+#define IODA2_M64BT_SINGLE_BASE_MASK PPC_BITMASK(2,26)
+#define IODA2_M64BT_SINGLE_BASE_LSH PPC_BITLSHIFT(26)
+#define IODA2_M64BT_PE_HI_MASK PPC_BITMASK(27,31)
+#define IODA2_M64BT_PE_HI_LSH PPC_BITLSHIFT(31)
+#define IODA2_M64BT_SINGLE_MASK_MASK PPC_BITMASK(34,58)
+#define IODA2_M64BT_SINGLE_MASK_LSH PPC_BITLSHIFT(58)
+#define IODA2_M64BT_PE_LOW_MASK PPC_BITMASK(59,63)
+#define IODA2_M64BT_PE_LOW_LSH PPC_BITLSHIFT(63)
+
+/*
+ * IODA2 in-memory tables
+ */
+
+/* PEST
+ *
+ * 2x8 bytes entries, PEST0 and PEST1
+ */
+
+#define IODA2_PEST0_MMIO_CAUSE PPC_BIT(2)
+#define IODA2_PEST0_CFG_READ PPC_BIT(3)
+#define IODA2_PEST0_CFG_WRITE PPC_BIT(4)
+#define IODA2_PEST0_TTYPE_MASK PPC_BITMASK(5,7)
+#define IODA2_PEST0_TTYPE_LSH PPC_BITLSHIFT(7)
+#define PEST_TTYPE_DMA_WRITE 0
+#define PEST_TTYPE_MSI 1
+#define PEST_TTYPE_DMA_READ 2
+#define PEST_TTYPE_DMA_READ_RESP 3
+#define PEST_TTYPE_MMIO_LOAD 4
+#define PEST_TTYPE_MMIO_STORE 5
+#define PEST_TTYPE_OTHER 7
+#define IODA2_PEST0_CA_RETURN PPC_BIT(8)
+#define IODA2_PEST0_UTL_RTOS_TIMEOUT PPC_BIT(8) /* Same bit as CA return */
+#define IODA2_PEST0_UR_RETURN PPC_BIT(9)
+#define IODA2_PEST0_UTL_NONFATAL PPC_BIT(10)
+#define IODA2_PEST0_UTL_FATAL PPC_BIT(11)
+#define IODA2_PEST0_PARITY_UE PPC_BIT(13)
+#define IODA2_PEST0_UTL_CORRECTABLE PPC_BIT(14)
+#define IODA2_PEST0_UTL_INTERRUPT PPC_BIT(15)
+#define IODA2_PEST0_MMIO_XLATE PPC_BIT(16)
+#define IODA2_PEST0_IODA2_ERROR PPC_BIT(16) /* Same bit as MMIO
xlate */
+#define IODA2_PEST0_TCE_PAGE_FAULT PPC_BIT(18)
+#define IODA2_PEST0_TCE_ACCESS_FAULT PPC_BIT(19)
+#define IODA2_PEST0_DMA_RESP_TIMEOUT PPC_BIT(20)
+#define IODA2_PEST0_AIB_SIZE_INVALID PPC_BIT(21)
+#define IODA2_PEST0_LEM_BIT_MASK PPC_BITMASK(26,31)
+#define IODA2_PEST0_LEM_BIT_LSH PPC_BITLSHIFT(31)
+#define IODA2_PEST0_RID_MASK PPC_BITMASK(32,47)
+#define IODA2_PEST0_RID_LSH PPC_BITLSHIFT(47)
+#define IODA2_PEST0_MSI_DATA_MASK PPC_BITMASK(48,63)
+#define IODA2_PEST0_MSI_DATA_LSH PPC_BITLSHIFT(63)
+
+#define IODA2_PEST1_FAIL_ADDR_MASK PPC_BITMASK(3,63)
+#define IODA2_PEST1_FAIL_ADDR_LSH PPC_BITLSHIFT(63)
+
+
+#endif /* __PHB3_REGS_H */
diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
index c488f12..98d75b0 100644
--- a/include/hw/ppc/pnv.h
+++ b/include/hw/ppc/pnv.h
@@ -26,6 +26,7 @@ typedef struct PnvLpcController PnvLpcController;
typedef struct PnvPsiController PnvPsiController;
typedef struct XICSState XICSState;
typedef struct PnvOCCState PnvOCCState;
+typedef struct PCIBus PCIBus;
/* Should we turn that into a QOjb of some sort ? */
typedef struct PnvChip {
@@ -35,6 +36,8 @@ typedef struct PnvChip {
ISABus *lpc_bus;
PnvPsiController *psi;
PnvOCCState *occ;
+#define PNV_MAX_CHIP_PHB 4
+ PCIBus *phb[PNV_MAX_CHIP_PHB];
} PnvChip;
typedef struct PnvSystem {
diff --git a/include/hw/ppc/xics.h b/include/hw/ppc/xics.h
index 85d2fb9..31dab8b 100644
--- a/include/hw/ppc/xics.h
+++ b/include/hw/ppc/xics.h
@@ -205,6 +205,7 @@ void icp_set_mfrr(XICSState *icp, int server, uint8_t mfrr);
uint32_t icp_accept(ICPState *ss);
uint32_t icp_ipoll(ICPState *ss, uint32_t *mfrr);
void icp_eoi(XICSState *icp, int server, uint32_t xirr);
+void icp_irq(ICSState *ics, int server, int nr, uint8_t priority);
void ics_simple_write_xive(ICSState *ics, int nr, int server,
uint8_t priority, uint8_t saved_priority);
--
2.5.0
