qemu/hw/pci-host/versatile.c
<<
>>
Prefs
   1/*
   2 * ARM Versatile/PB PCI host controller
   3 *
   4 * Copyright (c) 2006-2009 CodeSourcery.
   5 * Written by Paul Brook
   6 *
   7 * This code is licensed under the LGPL.
   8 */
   9
  10#include "qemu/osdep.h"
  11#include "hw/sysbus.h"
  12#include "hw/pci/pci.h"
  13#include "hw/pci/pci_bus.h"
  14#include "hw/pci/pci_host.h"
  15#include "exec/address-spaces.h"
  16#include "qemu/log.h"
  17
  18/* Old and buggy versions of QEMU used the wrong mapping from
  19 * PCI IRQs to system interrupt lines. Unfortunately the Linux
  20 * kernel also had the corresponding bug in setting up interrupts
  21 * (so older kernels work on QEMU and not on real hardware).
  22 * We automatically detect these broken kernels and flip back
  23 * to the broken irq mapping by spotting guest writes to the
  24 * PCI_INTERRUPT_LINE register to see where the guest thinks
  25 * interrupts are going to be routed. So we start in state
  26 * ASSUME_OK on reset, and transition to either BROKEN or
  27 * FORCE_OK at the first write to an INTERRUPT_LINE register for
  28 * a slot where broken and correct interrupt mapping would differ.
  29 * Once in either BROKEN or FORCE_OK we never transition again;
  30 * this allows a newer kernel to use the INTERRUPT_LINE
  31 * registers arbitrarily once it has indicated that it isn't
  32 * broken in its init code somewhere.
  33 *
  34 * Unfortunately we have to cope with multiple different
  35 * variants on the broken kernel behaviour:
  36 *  phase I (before kernel commit 1bc39ac5d) kernels assume old
  37 *   QEMU behaviour, so they use IRQ 27 for all slots
  38 *  phase II (1bc39ac5d and later, but before e3e92a7be6) kernels
  39 *   swizzle IRQs between slots, but do it wrongly, so they
  40 *   work only for every fourth PCI card, and only if (like old
  41 *   QEMU) the PCI host device is at slot 0 rather than where
  42 *   the h/w actually puts it
  43 *  phase III (e3e92a7be6 and later) kernels still swizzle IRQs between
  44 *   slots wrongly, but add a fixed offset of 64 to everything
  45 *   they write to PCI_INTERRUPT_LINE.
  46 *
  47 * We live in hope of a mythical phase IV kernel which might
  48 * actually behave in ways that work on the hardware. Such a
  49 * kernel should probably start off by writing some value neither
  50 * 27 nor 91 to slot zero's PCI_INTERRUPT_LINE register to
  51 * disable the autodetection. After that it can do what it likes.
  52 *
  53 * Slot % 4 | hw | I  | II | III
  54 * -------------------------------
  55 *   0      | 29 | 27 | 27 | 91
  56 *   1      | 30 | 27 | 28 | 92
  57 *   2      | 27 | 27 | 29 | 93
  58 *   3      | 28 | 27 | 30 | 94
  59 *
  60 * Since our autodetection is not perfect we also provide a
  61 * property so the user can make us start in BROKEN or FORCE_OK
  62 * on reset if they know they have a bad or good kernel.
  63 */
  64enum {
  65    PCI_VPB_IRQMAP_ASSUME_OK,
  66    PCI_VPB_IRQMAP_BROKEN,
  67    PCI_VPB_IRQMAP_FORCE_OK,
  68};
  69
  70typedef struct {
  71    PCIHostState parent_obj;
  72
  73    qemu_irq irq[4];
  74    MemoryRegion controlregs;
  75    MemoryRegion mem_config;
  76    MemoryRegion mem_config2;
  77    /* Containers representing the PCI address spaces */
  78    MemoryRegion pci_io_space;
  79    MemoryRegion pci_mem_space;
  80    /* Alias regions into PCI address spaces which we expose as sysbus regions.
  81     * The offsets into pci_mem_space are controlled by the imap registers.
  82     */
  83    MemoryRegion pci_io_window;
  84    MemoryRegion pci_mem_window[3];
  85    PCIBus pci_bus;
  86    PCIDevice pci_dev;
  87
  88    /* Constant for life of device: */
  89    int realview;
  90    uint32_t mem_win_size[3];
  91    uint8_t irq_mapping_prop;
  92
  93    /* Variable state: */
  94    uint32_t imap[3];
  95    uint32_t smap[3];
  96    uint32_t selfid;
  97    uint32_t flags;
  98    uint8_t irq_mapping;
  99} PCIVPBState;
 100
 101static void pci_vpb_update_window(PCIVPBState *s, int i)
 102{
 103    /* Adjust the offset of the alias region we use for
 104     * the memory window i to account for a change in the
 105     * value of the corresponding IMAP register.
 106     * Note that the semantics of the IMAP register differ
 107     * for realview and versatile variants of the controller.
 108     */
 109    hwaddr offset;
 110    if (s->realview) {
 111        /* Top bits of register (masked according to window size) provide
 112         * top bits of PCI address.
 113         */
 114        offset = s->imap[i] & ~(s->mem_win_size[i] - 1);
 115    } else {
 116        /* Bottom 4 bits of register provide top 4 bits of PCI address */
 117        offset = s->imap[i] << 28;
 118    }
 119    memory_region_set_alias_offset(&s->pci_mem_window[i], offset);
 120}
 121
 122static void pci_vpb_update_all_windows(PCIVPBState *s)
 123{
 124    /* Update all alias windows based on the current register state */
 125    int i;
 126
 127    for (i = 0; i < 3; i++) {
 128        pci_vpb_update_window(s, i);
 129    }
 130}
 131
 132static int pci_vpb_post_load(void *opaque, int version_id)
 133{
 134    PCIVPBState *s = opaque;
 135    pci_vpb_update_all_windows(s);
 136    return 0;
 137}
 138
 139static const VMStateDescription pci_vpb_vmstate = {
 140    .name = "versatile-pci",
 141    .version_id = 1,
 142    .minimum_version_id = 1,
 143    .post_load = pci_vpb_post_load,
 144    .fields = (VMStateField[]) {
 145        VMSTATE_UINT32_ARRAY(imap, PCIVPBState, 3),
 146        VMSTATE_UINT32_ARRAY(smap, PCIVPBState, 3),
 147        VMSTATE_UINT32(selfid, PCIVPBState),
 148        VMSTATE_UINT32(flags, PCIVPBState),
 149        VMSTATE_UINT8(irq_mapping, PCIVPBState),
 150        VMSTATE_END_OF_LIST()
 151    }
 152};
 153
 154#define TYPE_VERSATILE_PCI "versatile_pci"
 155#define PCI_VPB(obj) \
 156    OBJECT_CHECK(PCIVPBState, (obj), TYPE_VERSATILE_PCI)
 157
 158#define TYPE_VERSATILE_PCI_HOST "versatile_pci_host"
 159#define PCI_VPB_HOST(obj) \
 160    OBJECT_CHECK(PCIDevice, (obj), TYPE_VERSATILE_PCIHOST)
 161
 162typedef enum {
 163    PCI_IMAP0 = 0x0,
 164    PCI_IMAP1 = 0x4,
 165    PCI_IMAP2 = 0x8,
 166    PCI_SELFID = 0xc,
 167    PCI_FLAGS = 0x10,
 168    PCI_SMAP0 = 0x14,
 169    PCI_SMAP1 = 0x18,
 170    PCI_SMAP2 = 0x1c,
 171} PCIVPBControlRegs;
 172
 173static void pci_vpb_reg_write(void *opaque, hwaddr addr,
 174                              uint64_t val, unsigned size)
 175{
 176    PCIVPBState *s = opaque;
 177
 178    switch (addr) {
 179    case PCI_IMAP0:
 180    case PCI_IMAP1:
 181    case PCI_IMAP2:
 182    {
 183        int win = (addr - PCI_IMAP0) >> 2;
 184        s->imap[win] = val;
 185        pci_vpb_update_window(s, win);
 186        break;
 187    }
 188    case PCI_SELFID:
 189        s->selfid = val;
 190        break;
 191    case PCI_FLAGS:
 192        s->flags = val;
 193        break;
 194    case PCI_SMAP0:
 195    case PCI_SMAP1:
 196    case PCI_SMAP2:
 197    {
 198        int win = (addr - PCI_SMAP0) >> 2;
 199        s->smap[win] = val;
 200        break;
 201    }
 202    default:
 203        qemu_log_mask(LOG_GUEST_ERROR,
 204                      "pci_vpb_reg_write: Bad offset %x\n", (int)addr);
 205        break;
 206    }
 207}
 208
 209static uint64_t pci_vpb_reg_read(void *opaque, hwaddr addr,
 210                                 unsigned size)
 211{
 212    PCIVPBState *s = opaque;
 213
 214    switch (addr) {
 215    case PCI_IMAP0:
 216    case PCI_IMAP1:
 217    case PCI_IMAP2:
 218    {
 219        int win = (addr - PCI_IMAP0) >> 2;
 220        return s->imap[win];
 221    }
 222    case PCI_SELFID:
 223        return s->selfid;
 224    case PCI_FLAGS:
 225        return s->flags;
 226    case PCI_SMAP0:
 227    case PCI_SMAP1:
 228    case PCI_SMAP2:
 229    {
 230        int win = (addr - PCI_SMAP0) >> 2;
 231        return s->smap[win];
 232    }
 233    default:
 234        qemu_log_mask(LOG_GUEST_ERROR,
 235                      "pci_vpb_reg_read: Bad offset %x\n", (int)addr);
 236        return 0;
 237    }
 238}
 239
 240static const MemoryRegionOps pci_vpb_reg_ops = {
 241    .read = pci_vpb_reg_read,
 242    .write = pci_vpb_reg_write,
 243    .endianness = DEVICE_NATIVE_ENDIAN,
 244    .valid = {
 245        .min_access_size = 4,
 246        .max_access_size = 4,
 247    },
 248};
 249
 250static int pci_vpb_broken_irq(int slot, int irq)
 251{
 252    /* Determine whether this IRQ value for this slot represents a
 253     * known broken Linux kernel behaviour for this slot.
 254     * Return one of the PCI_VPB_IRQMAP_ constants:
 255     *   BROKEN : if this definitely looks like a broken kernel
 256     *   FORCE_OK : if this definitely looks good
 257     *   ASSUME_OK : if we can't tell
 258     */
 259    slot %= PCI_NUM_PINS;
 260
 261    if (irq == 27) {
 262        if (slot == 2) {
 263            /* Might be a Phase I kernel, or might be a fixed kernel,
 264             * since slot 2 is where we expect this IRQ.
 265             */
 266            return PCI_VPB_IRQMAP_ASSUME_OK;
 267        }
 268        /* Phase I kernel */
 269        return PCI_VPB_IRQMAP_BROKEN;
 270    }
 271    if (irq == slot + 27) {
 272        /* Phase II kernel */
 273        return PCI_VPB_IRQMAP_BROKEN;
 274    }
 275    if (irq == slot + 27 + 64) {
 276        /* Phase III kernel */
 277        return PCI_VPB_IRQMAP_BROKEN;
 278    }
 279    /* Anything else must be a fixed kernel, possibly using an
 280     * arbitrary irq map.
 281     */
 282    return PCI_VPB_IRQMAP_FORCE_OK;
 283}
 284
 285static void pci_vpb_config_write(void *opaque, hwaddr addr,
 286                                 uint64_t val, unsigned size)
 287{
 288    PCIVPBState *s = opaque;
 289    if (!s->realview && (addr & 0xff) == PCI_INTERRUPT_LINE
 290        && s->irq_mapping == PCI_VPB_IRQMAP_ASSUME_OK) {
 291        uint8_t devfn = addr >> 8;
 292        s->irq_mapping = pci_vpb_broken_irq(PCI_SLOT(devfn), val);
 293    }
 294    pci_data_write(&s->pci_bus, addr, val, size);
 295}
 296
 297static uint64_t pci_vpb_config_read(void *opaque, hwaddr addr,
 298                                    unsigned size)
 299{
 300    PCIVPBState *s = opaque;
 301    uint32_t val;
 302    val = pci_data_read(&s->pci_bus, addr, size);
 303    return val;
 304}
 305
 306static const MemoryRegionOps pci_vpb_config_ops = {
 307    .read = pci_vpb_config_read,
 308    .write = pci_vpb_config_write,
 309    .endianness = DEVICE_NATIVE_ENDIAN,
 310};
 311
 312static int pci_vpb_map_irq(PCIDevice *d, int irq_num)
 313{
 314    PCIVPBState *s = container_of(d->bus, PCIVPBState, pci_bus);
 315
 316    if (s->irq_mapping == PCI_VPB_IRQMAP_BROKEN) {
 317        /* Legacy broken IRQ mapping for compatibility with old and
 318         * buggy Linux guests
 319         */
 320        return irq_num;
 321    }
 322
 323    /* Slot to IRQ mapping for RealView Platform Baseboard 926 backplane
 324     *      name    slot    IntA    IntB    IntC    IntD
 325     *      A       31      IRQ28   IRQ29   IRQ30   IRQ27
 326     *      B       30      IRQ27   IRQ28   IRQ29   IRQ30
 327     *      C       29      IRQ30   IRQ27   IRQ28   IRQ29
 328     * Slot C is for the host bridge; A and B the peripherals.
 329     * Our output irqs 0..3 correspond to the baseboard's 27..30.
 330     *
 331     * This mapping function takes account of an oddity in the PB926
 332     * board wiring, where the FPGA's P_nINTA input is connected to
 333     * the INTB connection on the board PCI edge connector, P_nINTB
 334     * is connected to INTC, and so on, so everything is one number
 335     * further round from where you might expect.
 336     */
 337    return pci_swizzle_map_irq_fn(d, irq_num + 2);
 338}
 339
 340static int pci_vpb_rv_map_irq(PCIDevice *d, int irq_num)
 341{
 342    /* Slot to IRQ mapping for RealView EB and PB1176 backplane
 343     *      name    slot    IntA    IntB    IntC    IntD
 344     *      A       31      IRQ50   IRQ51   IRQ48   IRQ49
 345     *      B       30      IRQ49   IRQ50   IRQ51   IRQ48
 346     *      C       29      IRQ48   IRQ49   IRQ50   IRQ51
 347     * Slot C is for the host bridge; A and B the peripherals.
 348     * Our output irqs 0..3 correspond to the baseboard's 48..51.
 349     *
 350     * The PB1176 and EB boards don't have the PB926 wiring oddity
 351     * described above; P_nINTA connects to INTA, P_nINTB to INTB
 352     * and so on, which is why this mapping function is different.
 353     */
 354    return pci_swizzle_map_irq_fn(d, irq_num + 3);
 355}
 356
 357static void pci_vpb_set_irq(void *opaque, int irq_num, int level)
 358{
 359    qemu_irq *pic = opaque;
 360
 361    qemu_set_irq(pic[irq_num], level);
 362}
 363
 364static void pci_vpb_reset(DeviceState *d)
 365{
 366    PCIVPBState *s = PCI_VPB(d);
 367
 368    s->imap[0] = 0;
 369    s->imap[1] = 0;
 370    s->imap[2] = 0;
 371    s->smap[0] = 0;
 372    s->smap[1] = 0;
 373    s->smap[2] = 0;
 374    s->selfid = 0;
 375    s->flags = 0;
 376    s->irq_mapping = s->irq_mapping_prop;
 377
 378    pci_vpb_update_all_windows(s);
 379}
 380
 381static void pci_vpb_init(Object *obj)
 382{
 383    PCIHostState *h = PCI_HOST_BRIDGE(obj);
 384    PCIVPBState *s = PCI_VPB(obj);
 385
 386    memory_region_init(&s->pci_io_space, OBJECT(s), "pci_io", 1ULL << 32);
 387    memory_region_init(&s->pci_mem_space, OBJECT(s), "pci_mem", 1ULL << 32);
 388
 389    pci_bus_new_inplace(&s->pci_bus, sizeof(s->pci_bus), DEVICE(obj), "pci",
 390                        &s->pci_mem_space, &s->pci_io_space,
 391                        PCI_DEVFN(11, 0), TYPE_PCI_BUS);
 392    h->bus = &s->pci_bus;
 393
 394    object_initialize(&s->pci_dev, sizeof(s->pci_dev), TYPE_VERSATILE_PCI_HOST);
 395    qdev_set_parent_bus(DEVICE(&s->pci_dev), BUS(&s->pci_bus));
 396
 397    /* Window sizes for VersatilePB; realview_pci's init will override */
 398    s->mem_win_size[0] = 0x0c000000;
 399    s->mem_win_size[1] = 0x10000000;
 400    s->mem_win_size[2] = 0x10000000;
 401}
 402
 403static void pci_vpb_realize(DeviceState *dev, Error **errp)
 404{
 405    PCIVPBState *s = PCI_VPB(dev);
 406    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 407    pci_map_irq_fn mapfn;
 408    int i;
 409
 410    for (i = 0; i < 4; i++) {
 411        sysbus_init_irq(sbd, &s->irq[i]);
 412    }
 413
 414    if (s->realview) {
 415        mapfn = pci_vpb_rv_map_irq;
 416    } else {
 417        mapfn = pci_vpb_map_irq;
 418    }
 419
 420    pci_bus_irqs(&s->pci_bus, pci_vpb_set_irq, mapfn, s->irq, 4);
 421
 422    /* Our memory regions are:
 423     * 0 : our control registers
 424     * 1 : PCI self config window
 425     * 2 : PCI config window
 426     * 3 : PCI IO window
 427     * 4..6 : PCI memory windows
 428     */
 429    memory_region_init_io(&s->controlregs, OBJECT(s), &pci_vpb_reg_ops, s,
 430                          "pci-vpb-regs", 0x1000);
 431    sysbus_init_mmio(sbd, &s->controlregs);
 432    memory_region_init_io(&s->mem_config, OBJECT(s), &pci_vpb_config_ops, s,
 433                          "pci-vpb-selfconfig", 0x1000000);
 434    sysbus_init_mmio(sbd, &s->mem_config);
 435    memory_region_init_io(&s->mem_config2, OBJECT(s), &pci_vpb_config_ops, s,
 436                          "pci-vpb-config", 0x1000000);
 437    sysbus_init_mmio(sbd, &s->mem_config2);
 438
 439    /* The window into I/O space is always into a fixed base address;
 440     * its size is the same for both realview and versatile.
 441     */
 442    memory_region_init_alias(&s->pci_io_window, OBJECT(s), "pci-vbp-io-window",
 443                             &s->pci_io_space, 0, 0x100000);
 444
 445    sysbus_init_mmio(sbd, &s->pci_io_space);
 446
 447    /* Create the alias regions corresponding to our three windows onto
 448     * PCI memory space. The sizes vary from board to board; the base
 449     * offsets are guest controllable via the IMAP registers.
 450     */
 451    for (i = 0; i < 3; i++) {
 452        memory_region_init_alias(&s->pci_mem_window[i], OBJECT(s), "pci-vbp-window",
 453                                 &s->pci_mem_space, 0, s->mem_win_size[i]);
 454        sysbus_init_mmio(sbd, &s->pci_mem_window[i]);
 455    }
 456
 457    /* TODO Remove once realize propagates to child devices. */
 458    object_property_set_bool(OBJECT(&s->pci_dev), true, "realized", errp);
 459}
 460
 461static void versatile_pci_host_realize(PCIDevice *d, Error **errp)
 462{
 463    pci_set_word(d->config + PCI_STATUS,
 464                 PCI_STATUS_66MHZ | PCI_STATUS_DEVSEL_MEDIUM);
 465    pci_set_byte(d->config + PCI_LATENCY_TIMER, 0x10);
 466}
 467
 468static void versatile_pci_host_class_init(ObjectClass *klass, void *data)
 469{
 470    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
 471    DeviceClass *dc = DEVICE_CLASS(klass);
 472
 473    k->realize = versatile_pci_host_realize;
 474    k->vendor_id = PCI_VENDOR_ID_XILINX;
 475    k->device_id = PCI_DEVICE_ID_XILINX_XC2VP30;
 476    k->class_id = PCI_CLASS_PROCESSOR_CO;
 477    /*
 478     * PCI-facing part of the host bridge, not usable without the
 479     * host-facing part, which can't be device_add'ed, yet.
 480     */
 481    dc->cannot_instantiate_with_device_add_yet = true;
 482}
 483
 484static const TypeInfo versatile_pci_host_info = {
 485    .name          = TYPE_VERSATILE_PCI_HOST,
 486    .parent        = TYPE_PCI_DEVICE,
 487    .instance_size = sizeof(PCIDevice),
 488    .class_init    = versatile_pci_host_class_init,
 489};
 490
 491static Property pci_vpb_properties[] = {
 492    DEFINE_PROP_UINT8("broken-irq-mapping", PCIVPBState, irq_mapping_prop,
 493                      PCI_VPB_IRQMAP_ASSUME_OK),
 494    DEFINE_PROP_END_OF_LIST()
 495};
 496
 497static void pci_vpb_class_init(ObjectClass *klass, void *data)
 498{
 499    DeviceClass *dc = DEVICE_CLASS(klass);
 500
 501    dc->realize = pci_vpb_realize;
 502    dc->reset = pci_vpb_reset;
 503    dc->vmsd = &pci_vpb_vmstate;
 504    dc->props = pci_vpb_properties;
 505    /* Reason: object_unref() hangs */
 506    dc->cannot_destroy_with_object_finalize_yet = true;
 507}
 508
 509static const TypeInfo pci_vpb_info = {
 510    .name          = TYPE_VERSATILE_PCI,
 511    .parent        = TYPE_PCI_HOST_BRIDGE,
 512    .instance_size = sizeof(PCIVPBState),
 513    .instance_init = pci_vpb_init,
 514    .class_init    = pci_vpb_class_init,
 515};
 516
 517static void pci_realview_init(Object *obj)
 518{
 519    PCIVPBState *s = PCI_VPB(obj);
 520
 521    s->realview = 1;
 522    /* The PCI window sizes are different on Realview boards */
 523    s->mem_win_size[0] = 0x01000000;
 524    s->mem_win_size[1] = 0x04000000;
 525    s->mem_win_size[2] = 0x08000000;
 526}
 527
 528static void pci_realview_class_init(ObjectClass *class, void *data)
 529{
 530    DeviceClass *dc = DEVICE_CLASS(class);
 531
 532    /* Reason: object_unref() hangs */
 533    dc->cannot_destroy_with_object_finalize_yet = true;
 534}
 535
 536static const TypeInfo pci_realview_info = {
 537    .name          = "realview_pci",
 538    .parent        = TYPE_VERSATILE_PCI,
 539    .instance_init = pci_realview_init,
 540    .class_init    = pci_realview_class_init,
 541};
 542
 543static void versatile_pci_register_types(void)
 544{
 545    type_register_static(&pci_vpb_info);
 546    type_register_static(&pci_realview_info);
 547    type_register_static(&versatile_pci_host_info);
 548}
 549
 550type_init(versatile_pci_register_types)
 551