1 | /* |
2 | * ARM Versatile/PB PCI host controller |
3 | * |
4 | * Copyright (c) 2006-2009 CodeSourcery. |
5 | * Written by Paul Brook |
6 | * |
7 | * This code is licensed under the LGPL. |
8 | */ |
9 | |
10 | #include "qemu/osdep.h" |
11 | #include "hw/sysbus.h" |
12 | #include "migration/vmstate.h" |
13 | #include "hw/irq.h" |
14 | #include "hw/pci/pci.h" |
15 | #include "hw/pci/pci_bus.h" |
16 | #include "hw/pci/pci_host.h" |
17 | #include "hw/qdev-properties.h" |
18 | #include "qemu/log.h" |
19 | #include "qemu/module.h" |
20 | |
21 | /* Old and buggy versions of QEMU used the wrong mapping from |
22 | * PCI IRQs to system interrupt lines. Unfortunately the Linux |
23 | * kernel also had the corresponding bug in setting up interrupts |
24 | * (so older kernels work on QEMU and not on real hardware). |
25 | * We automatically detect these broken kernels and flip back |
26 | * to the broken irq mapping by spotting guest writes to the |
27 | * PCI_INTERRUPT_LINE register to see where the guest thinks |
28 | * interrupts are going to be routed. So we start in state |
29 | * ASSUME_OK on reset, and transition to either BROKEN or |
30 | * FORCE_OK at the first write to an INTERRUPT_LINE register for |
31 | * a slot where broken and correct interrupt mapping would differ. |
32 | * Once in either BROKEN or FORCE_OK we never transition again; |
33 | * this allows a newer kernel to use the INTERRUPT_LINE |
34 | * registers arbitrarily once it has indicated that it isn't |
35 | * broken in its init code somewhere. |
36 | * |
37 | * Unfortunately we have to cope with multiple different |
38 | * variants on the broken kernel behaviour: |
39 | * phase I (before kernel commit 1bc39ac5d) kernels assume old |
40 | * QEMU behaviour, so they use IRQ 27 for all slots |
41 | * phase II (1bc39ac5d and later, but before e3e92a7be6) kernels |
42 | * swizzle IRQs between slots, but do it wrongly, so they |
43 | * work only for every fourth PCI card, and only if (like old |
44 | * QEMU) the PCI host device is at slot 0 rather than where |
45 | * the h/w actually puts it |
46 | * phase III (e3e92a7be6 and later) kernels still swizzle IRQs between |
47 | * slots wrongly, but add a fixed offset of 64 to everything |
48 | * they write to PCI_INTERRUPT_LINE. |
49 | * |
50 | * We live in hope of a mythical phase IV kernel which might |
51 | * actually behave in ways that work on the hardware. Such a |
52 | * kernel should probably start off by writing some value neither |
53 | * 27 nor 91 to slot zero's PCI_INTERRUPT_LINE register to |
54 | * disable the autodetection. After that it can do what it likes. |
55 | * |
56 | * Slot % 4 | hw | I | II | III |
57 | * ------------------------------- |
58 | * 0 | 29 | 27 | 27 | 91 |
59 | * 1 | 30 | 27 | 28 | 92 |
60 | * 2 | 27 | 27 | 29 | 93 |
61 | * 3 | 28 | 27 | 30 | 94 |
62 | * |
63 | * Since our autodetection is not perfect we also provide a |
64 | * property so the user can make us start in BROKEN or FORCE_OK |
65 | * on reset if they know they have a bad or good kernel. |
66 | */ |
67 | enum { |
68 | PCI_VPB_IRQMAP_ASSUME_OK, |
69 | PCI_VPB_IRQMAP_BROKEN, |
70 | PCI_VPB_IRQMAP_FORCE_OK, |
71 | }; |
72 | |
73 | typedef struct { |
74 | PCIHostState parent_obj; |
75 | |
76 | qemu_irq irq[4]; |
77 | MemoryRegion controlregs; |
78 | MemoryRegion mem_config; |
79 | MemoryRegion mem_config2; |
80 | /* Containers representing the PCI address spaces */ |
81 | MemoryRegion pci_io_space; |
82 | MemoryRegion pci_mem_space; |
83 | /* Alias regions into PCI address spaces which we expose as sysbus regions. |
84 | * The offsets into pci_mem_space are controlled by the imap registers. |
85 | */ |
86 | MemoryRegion pci_io_window; |
87 | MemoryRegion pci_mem_window[3]; |
88 | PCIBus pci_bus; |
89 | PCIDevice pci_dev; |
90 | |
91 | /* Constant for life of device: */ |
92 | int realview; |
93 | uint32_t mem_win_size[3]; |
94 | uint8_t irq_mapping_prop; |
95 | |
96 | /* Variable state: */ |
97 | uint32_t imap[3]; |
98 | uint32_t smap[3]; |
99 | uint32_t selfid; |
100 | uint32_t flags; |
101 | uint8_t irq_mapping; |
102 | } PCIVPBState; |
103 | |
104 | static void pci_vpb_update_window(PCIVPBState *s, int i) |
105 | { |
106 | /* Adjust the offset of the alias region we use for |
107 | * the memory window i to account for a change in the |
108 | * value of the corresponding IMAP register. |
109 | * Note that the semantics of the IMAP register differ |
110 | * for realview and versatile variants of the controller. |
111 | */ |
112 | hwaddr offset; |
113 | if (s->realview) { |
114 | /* Top bits of register (masked according to window size) provide |
115 | * top bits of PCI address. |
116 | */ |
117 | offset = s->imap[i] & ~(s->mem_win_size[i] - 1); |
118 | } else { |
119 | /* Bottom 4 bits of register provide top 4 bits of PCI address */ |
120 | offset = s->imap[i] << 28; |
121 | } |
122 | memory_region_set_alias_offset(&s->pci_mem_window[i], offset); |
123 | } |
124 | |
125 | static void pci_vpb_update_all_windows(PCIVPBState *s) |
126 | { |
127 | /* Update all alias windows based on the current register state */ |
128 | int i; |
129 | |
130 | for (i = 0; i < 3; i++) { |
131 | pci_vpb_update_window(s, i); |
132 | } |
133 | } |
134 | |
135 | static int pci_vpb_post_load(void *opaque, int version_id) |
136 | { |
137 | PCIVPBState *s = opaque; |
138 | pci_vpb_update_all_windows(s); |
139 | return 0; |
140 | } |
141 | |
142 | static const VMStateDescription pci_vpb_vmstate = { |
143 | .name = "versatile-pci" , |
144 | .version_id = 1, |
145 | .minimum_version_id = 1, |
146 | .post_load = pci_vpb_post_load, |
147 | .fields = (VMStateField[]) { |
148 | VMSTATE_UINT32_ARRAY(imap, PCIVPBState, 3), |
149 | VMSTATE_UINT32_ARRAY(smap, PCIVPBState, 3), |
150 | VMSTATE_UINT32(selfid, PCIVPBState), |
151 | VMSTATE_UINT32(flags, PCIVPBState), |
152 | VMSTATE_UINT8(irq_mapping, PCIVPBState), |
153 | VMSTATE_END_OF_LIST() |
154 | } |
155 | }; |
156 | |
157 | #define TYPE_VERSATILE_PCI "versatile_pci" |
158 | #define PCI_VPB(obj) \ |
159 | OBJECT_CHECK(PCIVPBState, (obj), TYPE_VERSATILE_PCI) |
160 | |
161 | #define TYPE_VERSATILE_PCI_HOST "versatile_pci_host" |
162 | #define PCI_VPB_HOST(obj) \ |
163 | OBJECT_CHECK(PCIDevice, (obj), TYPE_VERSATILE_PCIHOST) |
164 | |
165 | typedef enum { |
166 | PCI_IMAP0 = 0x0, |
167 | PCI_IMAP1 = 0x4, |
168 | PCI_IMAP2 = 0x8, |
169 | PCI_SELFID = 0xc, |
170 | PCI_FLAGS = 0x10, |
171 | PCI_SMAP0 = 0x14, |
172 | PCI_SMAP1 = 0x18, |
173 | PCI_SMAP2 = 0x1c, |
174 | } PCIVPBControlRegs; |
175 | |
176 | static void pci_vpb_reg_write(void *opaque, hwaddr addr, |
177 | uint64_t val, unsigned size) |
178 | { |
179 | PCIVPBState *s = opaque; |
180 | |
181 | switch (addr) { |
182 | case PCI_IMAP0: |
183 | case PCI_IMAP1: |
184 | case PCI_IMAP2: |
185 | { |
186 | int win = (addr - PCI_IMAP0) >> 2; |
187 | s->imap[win] = val; |
188 | pci_vpb_update_window(s, win); |
189 | break; |
190 | } |
191 | case PCI_SELFID: |
192 | s->selfid = val; |
193 | break; |
194 | case PCI_FLAGS: |
195 | s->flags = val; |
196 | break; |
197 | case PCI_SMAP0: |
198 | case PCI_SMAP1: |
199 | case PCI_SMAP2: |
200 | { |
201 | int win = (addr - PCI_SMAP0) >> 2; |
202 | s->smap[win] = val; |
203 | break; |
204 | } |
205 | default: |
206 | qemu_log_mask(LOG_GUEST_ERROR, |
207 | "pci_vpb_reg_write: Bad offset %x\n" , (int)addr); |
208 | break; |
209 | } |
210 | } |
211 | |
212 | static uint64_t pci_vpb_reg_read(void *opaque, hwaddr addr, |
213 | unsigned size) |
214 | { |
215 | PCIVPBState *s = opaque; |
216 | |
217 | switch (addr) { |
218 | case PCI_IMAP0: |
219 | case PCI_IMAP1: |
220 | case PCI_IMAP2: |
221 | { |
222 | int win = (addr - PCI_IMAP0) >> 2; |
223 | return s->imap[win]; |
224 | } |
225 | case PCI_SELFID: |
226 | return s->selfid; |
227 | case PCI_FLAGS: |
228 | return s->flags; |
229 | case PCI_SMAP0: |
230 | case PCI_SMAP1: |
231 | case PCI_SMAP2: |
232 | { |
233 | int win = (addr - PCI_SMAP0) >> 2; |
234 | return s->smap[win]; |
235 | } |
236 | default: |
237 | qemu_log_mask(LOG_GUEST_ERROR, |
238 | "pci_vpb_reg_read: Bad offset %x\n" , (int)addr); |
239 | return 0; |
240 | } |
241 | } |
242 | |
243 | static const MemoryRegionOps pci_vpb_reg_ops = { |
244 | .read = pci_vpb_reg_read, |
245 | .write = pci_vpb_reg_write, |
246 | .endianness = DEVICE_NATIVE_ENDIAN, |
247 | .valid = { |
248 | .min_access_size = 4, |
249 | .max_access_size = 4, |
250 | }, |
251 | }; |
252 | |
253 | static int pci_vpb_broken_irq(int slot, int irq) |
254 | { |
255 | /* Determine whether this IRQ value for this slot represents a |
256 | * known broken Linux kernel behaviour for this slot. |
257 | * Return one of the PCI_VPB_IRQMAP_ constants: |
258 | * BROKEN : if this definitely looks like a broken kernel |
259 | * FORCE_OK : if this definitely looks good |
260 | * ASSUME_OK : if we can't tell |
261 | */ |
262 | slot %= PCI_NUM_PINS; |
263 | |
264 | if (irq == 27) { |
265 | if (slot == 2) { |
266 | /* Might be a Phase I kernel, or might be a fixed kernel, |
267 | * since slot 2 is where we expect this IRQ. |
268 | */ |
269 | return PCI_VPB_IRQMAP_ASSUME_OK; |
270 | } |
271 | /* Phase I kernel */ |
272 | return PCI_VPB_IRQMAP_BROKEN; |
273 | } |
274 | if (irq == slot + 27) { |
275 | /* Phase II kernel */ |
276 | return PCI_VPB_IRQMAP_BROKEN; |
277 | } |
278 | if (irq == slot + 27 + 64) { |
279 | /* Phase III kernel */ |
280 | return PCI_VPB_IRQMAP_BROKEN; |
281 | } |
282 | /* Anything else must be a fixed kernel, possibly using an |
283 | * arbitrary irq map. |
284 | */ |
285 | return PCI_VPB_IRQMAP_FORCE_OK; |
286 | } |
287 | |
288 | static void pci_vpb_config_write(void *opaque, hwaddr addr, |
289 | uint64_t val, unsigned size) |
290 | { |
291 | PCIVPBState *s = opaque; |
292 | if (!s->realview && (addr & 0xff) == PCI_INTERRUPT_LINE |
293 | && s->irq_mapping == PCI_VPB_IRQMAP_ASSUME_OK) { |
294 | uint8_t devfn = addr >> 8; |
295 | s->irq_mapping = pci_vpb_broken_irq(PCI_SLOT(devfn), val); |
296 | } |
297 | pci_data_write(&s->pci_bus, addr, val, size); |
298 | } |
299 | |
300 | static uint64_t pci_vpb_config_read(void *opaque, hwaddr addr, |
301 | unsigned size) |
302 | { |
303 | PCIVPBState *s = opaque; |
304 | uint32_t val; |
305 | val = pci_data_read(&s->pci_bus, addr, size); |
306 | return val; |
307 | } |
308 | |
309 | static const MemoryRegionOps pci_vpb_config_ops = { |
310 | .read = pci_vpb_config_read, |
311 | .write = pci_vpb_config_write, |
312 | .endianness = DEVICE_NATIVE_ENDIAN, |
313 | }; |
314 | |
315 | static int pci_vpb_map_irq(PCIDevice *d, int irq_num) |
316 | { |
317 | PCIVPBState *s = container_of(pci_get_bus(d), PCIVPBState, pci_bus); |
318 | |
319 | if (s->irq_mapping == PCI_VPB_IRQMAP_BROKEN) { |
320 | /* Legacy broken IRQ mapping for compatibility with old and |
321 | * buggy Linux guests |
322 | */ |
323 | return irq_num; |
324 | } |
325 | |
326 | /* Slot to IRQ mapping for RealView Platform Baseboard 926 backplane |
327 | * name slot IntA IntB IntC IntD |
328 | * A 31 IRQ28 IRQ29 IRQ30 IRQ27 |
329 | * B 30 IRQ27 IRQ28 IRQ29 IRQ30 |
330 | * C 29 IRQ30 IRQ27 IRQ28 IRQ29 |
331 | * Slot C is for the host bridge; A and B the peripherals. |
332 | * Our output irqs 0..3 correspond to the baseboard's 27..30. |
333 | * |
334 | * This mapping function takes account of an oddity in the PB926 |
335 | * board wiring, where the FPGA's P_nINTA input is connected to |
336 | * the INTB connection on the board PCI edge connector, P_nINTB |
337 | * is connected to INTC, and so on, so everything is one number |
338 | * further round from where you might expect. |
339 | */ |
340 | return pci_swizzle_map_irq_fn(d, irq_num + 2); |
341 | } |
342 | |
343 | static int pci_vpb_rv_map_irq(PCIDevice *d, int irq_num) |
344 | { |
345 | /* Slot to IRQ mapping for RealView EB and PB1176 backplane |
346 | * name slot IntA IntB IntC IntD |
347 | * A 31 IRQ50 IRQ51 IRQ48 IRQ49 |
348 | * B 30 IRQ49 IRQ50 IRQ51 IRQ48 |
349 | * C 29 IRQ48 IRQ49 IRQ50 IRQ51 |
350 | * Slot C is for the host bridge; A and B the peripherals. |
351 | * Our output irqs 0..3 correspond to the baseboard's 48..51. |
352 | * |
353 | * The PB1176 and EB boards don't have the PB926 wiring oddity |
354 | * described above; P_nINTA connects to INTA, P_nINTB to INTB |
355 | * and so on, which is why this mapping function is different. |
356 | */ |
357 | return pci_swizzle_map_irq_fn(d, irq_num + 3); |
358 | } |
359 | |
360 | static void pci_vpb_set_irq(void *opaque, int irq_num, int level) |
361 | { |
362 | qemu_irq *pic = opaque; |
363 | |
364 | qemu_set_irq(pic[irq_num], level); |
365 | } |
366 | |
367 | static void pci_vpb_reset(DeviceState *d) |
368 | { |
369 | PCIVPBState *s = PCI_VPB(d); |
370 | |
371 | s->imap[0] = 0; |
372 | s->imap[1] = 0; |
373 | s->imap[2] = 0; |
374 | s->smap[0] = 0; |
375 | s->smap[1] = 0; |
376 | s->smap[2] = 0; |
377 | s->selfid = 0; |
378 | s->flags = 0; |
379 | s->irq_mapping = s->irq_mapping_prop; |
380 | |
381 | pci_vpb_update_all_windows(s); |
382 | } |
383 | |
384 | static void pci_vpb_init(Object *obj) |
385 | { |
386 | PCIVPBState *s = PCI_VPB(obj); |
387 | |
388 | /* Window sizes for VersatilePB; realview_pci's init will override */ |
389 | s->mem_win_size[0] = 0x0c000000; |
390 | s->mem_win_size[1] = 0x10000000; |
391 | s->mem_win_size[2] = 0x10000000; |
392 | } |
393 | |
394 | static void pci_vpb_realize(DeviceState *dev, Error **errp) |
395 | { |
396 | PCIVPBState *s = PCI_VPB(dev); |
397 | PCIHostState *h = PCI_HOST_BRIDGE(dev); |
398 | SysBusDevice *sbd = SYS_BUS_DEVICE(dev); |
399 | pci_map_irq_fn mapfn; |
400 | int i; |
401 | |
402 | memory_region_init(&s->pci_io_space, OBJECT(s), "pci_io" , 1ULL << 32); |
403 | memory_region_init(&s->pci_mem_space, OBJECT(s), "pci_mem" , 1ULL << 32); |
404 | |
405 | pci_root_bus_new_inplace(&s->pci_bus, sizeof(s->pci_bus), dev, "pci" , |
406 | &s->pci_mem_space, &s->pci_io_space, |
407 | PCI_DEVFN(11, 0), TYPE_PCI_BUS); |
408 | h->bus = &s->pci_bus; |
409 | |
410 | object_initialize(&s->pci_dev, sizeof(s->pci_dev), TYPE_VERSATILE_PCI_HOST); |
411 | qdev_set_parent_bus(DEVICE(&s->pci_dev), BUS(&s->pci_bus)); |
412 | |
413 | for (i = 0; i < 4; i++) { |
414 | sysbus_init_irq(sbd, &s->irq[i]); |
415 | } |
416 | |
417 | if (s->realview) { |
418 | mapfn = pci_vpb_rv_map_irq; |
419 | } else { |
420 | mapfn = pci_vpb_map_irq; |
421 | } |
422 | |
423 | pci_bus_irqs(&s->pci_bus, pci_vpb_set_irq, mapfn, s->irq, 4); |
424 | |
425 | /* Our memory regions are: |
426 | * 0 : our control registers |
427 | * 1 : PCI self config window |
428 | * 2 : PCI config window |
429 | * 3 : PCI IO window |
430 | * 4..6 : PCI memory windows |
431 | */ |
432 | memory_region_init_io(&s->controlregs, OBJECT(s), &pci_vpb_reg_ops, s, |
433 | "pci-vpb-regs" , 0x1000); |
434 | sysbus_init_mmio(sbd, &s->controlregs); |
435 | memory_region_init_io(&s->mem_config, OBJECT(s), &pci_vpb_config_ops, s, |
436 | "pci-vpb-selfconfig" , 0x1000000); |
437 | sysbus_init_mmio(sbd, &s->mem_config); |
438 | memory_region_init_io(&s->mem_config2, OBJECT(s), &pci_vpb_config_ops, s, |
439 | "pci-vpb-config" , 0x1000000); |
440 | sysbus_init_mmio(sbd, &s->mem_config2); |
441 | |
442 | /* The window into I/O space is always into a fixed base address; |
443 | * its size is the same for both realview and versatile. |
444 | */ |
445 | memory_region_init_alias(&s->pci_io_window, OBJECT(s), "pci-vbp-io-window" , |
446 | &s->pci_io_space, 0, 0x100000); |
447 | |
448 | sysbus_init_mmio(sbd, &s->pci_io_space); |
449 | |
450 | /* Create the alias regions corresponding to our three windows onto |
451 | * PCI memory space. The sizes vary from board to board; the base |
452 | * offsets are guest controllable via the IMAP registers. |
453 | */ |
454 | for (i = 0; i < 3; i++) { |
455 | memory_region_init_alias(&s->pci_mem_window[i], OBJECT(s), "pci-vbp-window" , |
456 | &s->pci_mem_space, 0, s->mem_win_size[i]); |
457 | sysbus_init_mmio(sbd, &s->pci_mem_window[i]); |
458 | } |
459 | |
460 | /* TODO Remove once realize propagates to child devices. */ |
461 | object_property_set_bool(OBJECT(&s->pci_bus), true, "realized" , errp); |
462 | object_property_set_bool(OBJECT(&s->pci_dev), true, "realized" , errp); |
463 | } |
464 | |
465 | static void versatile_pci_host_realize(PCIDevice *d, Error **errp) |
466 | { |
467 | pci_set_word(d->config + PCI_STATUS, |
468 | PCI_STATUS_66MHZ | PCI_STATUS_DEVSEL_MEDIUM); |
469 | pci_set_byte(d->config + PCI_LATENCY_TIMER, 0x10); |
470 | } |
471 | |
472 | static void versatile_pci_host_class_init(ObjectClass *klass, void *data) |
473 | { |
474 | PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); |
475 | DeviceClass *dc = DEVICE_CLASS(klass); |
476 | |
477 | k->realize = versatile_pci_host_realize; |
478 | k->vendor_id = PCI_VENDOR_ID_XILINX; |
479 | k->device_id = PCI_DEVICE_ID_XILINX_XC2VP30; |
480 | k->class_id = PCI_CLASS_PROCESSOR_CO; |
481 | /* |
482 | * PCI-facing part of the host bridge, not usable without the |
483 | * host-facing part, which can't be device_add'ed, yet. |
484 | */ |
485 | dc->user_creatable = false; |
486 | } |
487 | |
488 | static const TypeInfo versatile_pci_host_info = { |
489 | .name = TYPE_VERSATILE_PCI_HOST, |
490 | .parent = TYPE_PCI_DEVICE, |
491 | .instance_size = sizeof(PCIDevice), |
492 | .class_init = versatile_pci_host_class_init, |
493 | .interfaces = (InterfaceInfo[]) { |
494 | { INTERFACE_CONVENTIONAL_PCI_DEVICE }, |
495 | { }, |
496 | }, |
497 | }; |
498 | |
499 | static Property pci_vpb_properties[] = { |
500 | DEFINE_PROP_UINT8("broken-irq-mapping" , PCIVPBState, irq_mapping_prop, |
501 | PCI_VPB_IRQMAP_ASSUME_OK), |
502 | DEFINE_PROP_END_OF_LIST() |
503 | }; |
504 | |
505 | static void pci_vpb_class_init(ObjectClass *klass, void *data) |
506 | { |
507 | DeviceClass *dc = DEVICE_CLASS(klass); |
508 | |
509 | dc->realize = pci_vpb_realize; |
510 | dc->reset = pci_vpb_reset; |
511 | dc->vmsd = &pci_vpb_vmstate; |
512 | dc->props = pci_vpb_properties; |
513 | } |
514 | |
515 | static const TypeInfo pci_vpb_info = { |
516 | .name = TYPE_VERSATILE_PCI, |
517 | .parent = TYPE_PCI_HOST_BRIDGE, |
518 | .instance_size = sizeof(PCIVPBState), |
519 | .instance_init = pci_vpb_init, |
520 | .class_init = pci_vpb_class_init, |
521 | }; |
522 | |
523 | static void pci_realview_init(Object *obj) |
524 | { |
525 | PCIVPBState *s = PCI_VPB(obj); |
526 | |
527 | s->realview = 1; |
528 | /* The PCI window sizes are different on Realview boards */ |
529 | s->mem_win_size[0] = 0x01000000; |
530 | s->mem_win_size[1] = 0x04000000; |
531 | s->mem_win_size[2] = 0x08000000; |
532 | } |
533 | |
534 | static const TypeInfo pci_realview_info = { |
535 | .name = "realview_pci" , |
536 | .parent = TYPE_VERSATILE_PCI, |
537 | .instance_init = pci_realview_init, |
538 | }; |
539 | |
540 | static void versatile_pci_register_types(void) |
541 | { |
542 | type_register_static(&pci_vpb_info); |
543 | type_register_static(&pci_realview_info); |
544 | type_register_static(&versatile_pci_host_info); |
545 | } |
546 | |
547 | type_init(versatile_pci_register_types) |
548 | |