aboutsummaryrefslogtreecommitdiffstats
path: root/hw/pci-host
diff options
context:
space:
mode:
Diffstat (limited to 'hw/pci-host')
-rw-r--r--hw/pci-host/Kconfig79
-rw-r--r--hw/pci-host/bonito.c819
-rw-r--r--hw/pci-host/designware.c773
-rw-r--r--hw/pci-host/gpex-acpi.c269
-rw-r--r--hw/pci-host/gpex.c240
-rw-r--r--hw/pci-host/grackle.c176
-rw-r--r--hw/pci-host/i440fx.c412
-rw-r--r--hw/pci-host/meson.build36
-rw-r--r--hw/pci-host/mv64361.c951
-rw-r--r--hw/pci-host/mv643xx.h918
-rw-r--r--hw/pci-host/pam.c70
-rw-r--r--hw/pci-host/pnv_phb3.c1186
-rw-r--r--hw/pci-host/pnv_phb3_msi.c348
-rw-r--r--hw/pci-host/pnv_phb3_pbcq.c358
-rw-r--r--hw/pci-host/pnv_phb4.c1437
-rw-r--r--hw/pci-host/pnv_phb4_pec.c593
-rw-r--r--hw/pci-host/ppce500.c547
-rw-r--r--hw/pci-host/q35.c721
-rw-r--r--hw/pci-host/raven.c445
-rw-r--r--hw/pci-host/remote.c75
-rw-r--r--hw/pci-host/sabre.c526
-rw-r--r--hw/pci-host/sh_pci.c201
-rw-r--r--hw/pci-host/trace-events34
-rw-r--r--hw/pci-host/trace.h1
-rw-r--r--hw/pci-host/uninorth.c582
-rw-r--r--hw/pci-host/versatile.c548
-rw-r--r--hw/pci-host/xen_igd_pt.c119
-rw-r--r--hw/pci-host/xilinx-pcie.c331
28 files changed, 12795 insertions, 0 deletions
diff --git a/hw/pci-host/Kconfig b/hw/pci-host/Kconfig
new file mode 100644
index 000000000..2b5f7d58c
--- /dev/null
+++ b/hw/pci-host/Kconfig
@@ -0,0 +1,79 @@
+config PAM
+ bool
+
+config XEN_IGD_PASSTHROUGH
+ bool
+ default y
+ depends on XEN && PCI_I440FX
+
+config RAVEN_PCI
+ bool
+ select PCI
+ select OR_IRQ
+
+config GRACKLE_PCI
+ select PCI
+ bool
+
+config UNIN_PCI
+ bool
+ select PCI
+ select DEC_PCI
+ select OPENPIC
+
+config PPCE500_PCI
+ select PCI
+ bool
+
+config VERSATILE_PCI
+ select PCI
+ bool
+
+config PCI_SABRE
+ select PCI
+ bool
+
+config PCI_I440FX
+ bool
+ select PCI
+ select PAM
+
+config PCI_EXPRESS_Q35
+ bool
+ select PCI_EXPRESS
+ select PAM
+
+config PCI_EXPRESS_GENERIC_BRIDGE
+ bool
+ select PCI_EXPRESS
+
+config PCI_EXPRESS_XILINX
+ bool
+ select PCI_EXPRESS
+
+config PCI_EXPRESS_DESIGNWARE
+ bool
+ select PCI_EXPRESS
+ select MSI_NONBROKEN
+
+config PCI_BONITO
+ select PCI
+ select UNIMP
+ bool
+
+config PCI_POWERNV
+ select PCI_EXPRESS
+ select MSI_NONBROKEN
+ select PCIE_PORT
+
+config REMOTE_PCIHOST
+ bool
+
+config SH_PCI
+ bool
+ select PCI
+
+config MV64361
+ bool
+ select PCI
+ select I8259
diff --git a/hw/pci-host/bonito.c b/hw/pci-host/bonito.c
new file mode 100644
index 000000000..a57e81e3a
--- /dev/null
+++ b/hw/pci-host/bonito.c
@@ -0,0 +1,819 @@
+/*
+ * bonito north bridge support
+ *
+ * Copyright (c) 2008 yajin (yajin@vm-kernel.org)
+ * Copyright (c) 2010 Huacai Chen (zltjiangshi@gmail.com)
+ *
+ * This code is licensed under the GNU GPL v2.
+ *
+ * Contributions after 2012-01-13 are licensed under the terms of the
+ * GNU GPL, version 2 or (at your option) any later version.
+ */
+
+/*
+ * fuloong 2e mini pc has a bonito north bridge.
+ */
+
+/*
+ * what is the meaning of devfn in qemu and IDSEL in bonito northbridge?
+ *
+ * devfn pci_slot<<3 + funno
+ * one pci bus can have 32 devices and each device can have 8 functions.
+ *
+ * In bonito north bridge, pci slot = IDSEL bit - 12.
+ * For example, PCI_IDSEL_VIA686B = 17,
+ * pci slot = 17-12=5
+ *
+ * so
+ * VT686B_FUN0's devfn = (5<<3)+0
+ * VT686B_FUN1's devfn = (5<<3)+1
+ *
+ * qemu also uses pci address for north bridge to access pci config register.
+ * bus_no [23:16]
+ * dev_no [15:11]
+ * fun_no [10:8]
+ * reg_no [7:2]
+ *
+ * so function bonito_sbridge_pciaddr for the translation from
+ * north bridge address to pci address.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+#include "hw/pci/pci.h"
+#include "hw/irq.h"
+#include "hw/mips/mips.h"
+#include "hw/pci/pci_host.h"
+#include "migration/vmstate.h"
+#include "sysemu/reset.h"
+#include "sysemu/runstate.h"
+#include "hw/misc/unimp.h"
+#include "hw/registerfields.h"
+#include "qom/object.h"
+#include "trace.h"
+
+/* #define DEBUG_BONITO */
+
+#ifdef DEBUG_BONITO
+#define DPRINTF(fmt, ...) fprintf(stderr, "%s: " fmt, __func__, ##__VA_ARGS__)
+#else
+#define DPRINTF(fmt, ...)
+#endif
+
+/* from linux soure code. include/asm-mips/mips-boards/bonito64.h*/
+#define BONITO_BOOT_BASE 0x1fc00000
+#define BONITO_BOOT_SIZE 0x00100000
+#define BONITO_BOOT_TOP (BONITO_BOOT_BASE + BONITO_BOOT_SIZE - 1)
+#define BONITO_FLASH_BASE 0x1c000000
+#define BONITO_FLASH_SIZE 0x03000000
+#define BONITO_FLASH_TOP (BONITO_FLASH_BASE + BONITO_FLASH_SIZE - 1)
+#define BONITO_SOCKET_BASE 0x1f800000
+#define BONITO_SOCKET_SIZE 0x00400000
+#define BONITO_SOCKET_TOP (BONITO_SOCKET_BASE + BONITO_SOCKET_SIZE - 1)
+#define BONITO_REG_BASE 0x1fe00000
+#define BONITO_REG_SIZE 0x00040000
+#define BONITO_REG_TOP (BONITO_REG_BASE + BONITO_REG_SIZE - 1)
+#define BONITO_DEV_BASE 0x1ff00000
+#define BONITO_DEV_SIZE 0x00100000
+#define BONITO_DEV_TOP (BONITO_DEV_BASE + BONITO_DEV_SIZE - 1)
+#define BONITO_PCILO_BASE 0x10000000
+#define BONITO_PCILO_BASE_VA 0xb0000000
+#define BONITO_PCILO_SIZE 0x0c000000
+#define BONITO_PCILO_TOP (BONITO_PCILO_BASE + BONITO_PCILO_SIZE - 1)
+#define BONITO_PCILO0_BASE 0x10000000
+#define BONITO_PCILO1_BASE 0x14000000
+#define BONITO_PCILO2_BASE 0x18000000
+#define BONITO_PCIHI_BASE 0x20000000
+#define BONITO_PCIHI_SIZE 0x60000000
+#define BONITO_PCIHI_TOP (BONITO_PCIHI_BASE + BONITO_PCIHI_SIZE - 1)
+#define BONITO_PCIIO_BASE 0x1fd00000
+#define BONITO_PCIIO_BASE_VA 0xbfd00000
+#define BONITO_PCIIO_SIZE 0x00010000
+#define BONITO_PCIIO_TOP (BONITO_PCIIO_BASE + BONITO_PCIIO_SIZE - 1)
+#define BONITO_PCICFG_BASE 0x1fe80000
+#define BONITO_PCICFG_SIZE 0x00080000
+#define BONITO_PCICFG_TOP (BONITO_PCICFG_BASE + BONITO_PCICFG_SIZE - 1)
+
+
+#define BONITO_PCICONFIGBASE 0x00
+#define BONITO_REGBASE 0x100
+
+#define BONITO_PCICONFIG_BASE (BONITO_PCICONFIGBASE + BONITO_REG_BASE)
+#define BONITO_PCICONFIG_SIZE (0x100)
+
+#define BONITO_INTERNAL_REG_BASE (BONITO_REGBASE + BONITO_REG_BASE)
+#define BONITO_INTERNAL_REG_SIZE (0x70)
+
+#define BONITO_SPCICONFIG_BASE (BONITO_PCICFG_BASE)
+#define BONITO_SPCICONFIG_SIZE (BONITO_PCICFG_SIZE)
+
+
+
+/* 1. Bonito h/w Configuration */
+/* Power on register */
+
+#define BONITO_BONPONCFG (0x00 >> 2) /* 0x100 */
+
+/* PCI configuration register */
+#define BONITO_BONGENCFG_OFFSET 0x4
+#define BONITO_BONGENCFG (BONITO_BONGENCFG_OFFSET >> 2) /*0x104 */
+REG32(BONGENCFG, 0x104)
+FIELD(BONGENCFG, DEBUGMODE, 0, 1)
+FIELD(BONGENCFG, SNOOP, 1, 1)
+FIELD(BONGENCFG, CPUSELFRESET, 2, 1)
+FIELD(BONGENCFG, BYTESWAP, 6, 1)
+FIELD(BONGENCFG, UNCACHED, 7, 1)
+FIELD(BONGENCFG, PREFETCH, 8, 1)
+FIELD(BONGENCFG, WRITEBEHIND, 9, 1)
+FIELD(BONGENCFG, PCIQUEUE, 12, 1)
+
+/* 2. IO & IDE configuration */
+#define BONITO_IODEVCFG (0x08 >> 2) /* 0x108 */
+
+/* 3. IO & IDE configuration */
+#define BONITO_SDCFG (0x0c >> 2) /* 0x10c */
+
+/* 4. PCI address map control */
+#define BONITO_PCIMAP (0x10 >> 2) /* 0x110 */
+#define BONITO_PCIMEMBASECFG (0x14 >> 2) /* 0x114 */
+#define BONITO_PCIMAP_CFG (0x18 >> 2) /* 0x118 */
+
+/* 5. ICU & GPIO regs */
+/* GPIO Regs - r/w */
+#define BONITO_GPIODATA_OFFSET 0x1c
+#define BONITO_GPIODATA (BONITO_GPIODATA_OFFSET >> 2) /* 0x11c */
+#define BONITO_GPIOIE (0x20 >> 2) /* 0x120 */
+
+/* ICU Configuration Regs - r/w */
+#define BONITO_INTEDGE (0x24 >> 2) /* 0x124 */
+#define BONITO_INTSTEER (0x28 >> 2) /* 0x128 */
+#define BONITO_INTPOL (0x2c >> 2) /* 0x12c */
+
+/* ICU Enable Regs - IntEn & IntISR are r/o. */
+#define BONITO_INTENSET (0x30 >> 2) /* 0x130 */
+#define BONITO_INTENCLR (0x34 >> 2) /* 0x134 */
+#define BONITO_INTEN (0x38 >> 2) /* 0x138 */
+#define BONITO_INTISR (0x3c >> 2) /* 0x13c */
+
+/* PCI mail boxes */
+#define BONITO_PCIMAIL0_OFFSET 0x40
+#define BONITO_PCIMAIL1_OFFSET 0x44
+#define BONITO_PCIMAIL2_OFFSET 0x48
+#define BONITO_PCIMAIL3_OFFSET 0x4c
+#define BONITO_PCIMAIL0 (0x40 >> 2) /* 0x140 */
+#define BONITO_PCIMAIL1 (0x44 >> 2) /* 0x144 */
+#define BONITO_PCIMAIL2 (0x48 >> 2) /* 0x148 */
+#define BONITO_PCIMAIL3 (0x4c >> 2) /* 0x14c */
+
+/* 6. PCI cache */
+#define BONITO_PCICACHECTRL (0x50 >> 2) /* 0x150 */
+#define BONITO_PCICACHETAG (0x54 >> 2) /* 0x154 */
+#define BONITO_PCIBADADDR (0x58 >> 2) /* 0x158 */
+#define BONITO_PCIMSTAT (0x5c >> 2) /* 0x15c */
+
+/* 7. other*/
+#define BONITO_TIMECFG (0x60 >> 2) /* 0x160 */
+#define BONITO_CPUCFG (0x64 >> 2) /* 0x164 */
+#define BONITO_DQCFG (0x68 >> 2) /* 0x168 */
+#define BONITO_MEMSIZE (0x6C >> 2) /* 0x16c */
+
+#define BONITO_REGS (0x70 >> 2)
+
+/* PCI config for south bridge. type 0 */
+#define BONITO_PCICONF_IDSEL_MASK 0xfffff800 /* [31:11] */
+#define BONITO_PCICONF_IDSEL_OFFSET 11
+#define BONITO_PCICONF_FUN_MASK 0x700 /* [10:8] */
+#define BONITO_PCICONF_FUN_OFFSET 8
+#define BONITO_PCICONF_REG_MASK_DS (~3) /* Per datasheet */
+#define BONITO_PCICONF_REG_MASK_HW 0xff /* As seen running PMON */
+#define BONITO_PCICONF_REG_OFFSET 0
+
+
+/* idsel BIT = pci slot number +12 */
+#define PCI_SLOT_BASE 12
+#define PCI_IDSEL_VIA686B_BIT (17)
+#define PCI_IDSEL_VIA686B (1 << PCI_IDSEL_VIA686B_BIT)
+
+#define PCI_ADDR(busno , devno , funno , regno) \
+ ((PCI_BUILD_BDF(busno, PCI_DEVFN(devno , funno)) << 8) + (regno))
+
+typedef struct BonitoState BonitoState;
+
+struct PCIBonitoState {
+ PCIDevice dev;
+
+ BonitoState *pcihost;
+ uint32_t regs[BONITO_REGS];
+
+ struct bonldma {
+ uint32_t ldmactrl;
+ uint32_t ldmastat;
+ uint32_t ldmaaddr;
+ uint32_t ldmago;
+ } bonldma;
+
+ /* Based at 1fe00300, bonito Copier */
+ struct boncop {
+ uint32_t copctrl;
+ uint32_t copstat;
+ uint32_t coppaddr;
+ uint32_t copgo;
+ } boncop;
+
+ /* Bonito registers */
+ MemoryRegion iomem;
+ MemoryRegion iomem_ldma;
+ MemoryRegion iomem_cop;
+ MemoryRegion bonito_pciio;
+ MemoryRegion bonito_localio;
+
+};
+typedef struct PCIBonitoState PCIBonitoState;
+
+struct BonitoState {
+ PCIHostState parent_obj;
+ qemu_irq *pic;
+ PCIBonitoState *pci_dev;
+ MemoryRegion pci_mem;
+};
+
+#define TYPE_BONITO_PCI_HOST_BRIDGE "Bonito-pcihost"
+OBJECT_DECLARE_SIMPLE_TYPE(BonitoState, BONITO_PCI_HOST_BRIDGE)
+
+#define TYPE_PCI_BONITO "Bonito"
+OBJECT_DECLARE_SIMPLE_TYPE(PCIBonitoState, PCI_BONITO)
+
+static void bonito_writel(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PCIBonitoState *s = opaque;
+ uint32_t saddr;
+ int reset = 0;
+
+ saddr = addr >> 2;
+
+ DPRINTF("bonito_writel "TARGET_FMT_plx" val %lx saddr %x\n",
+ addr, val, saddr);
+ switch (saddr) {
+ case BONITO_BONPONCFG:
+ case BONITO_IODEVCFG:
+ case BONITO_SDCFG:
+ case BONITO_PCIMAP:
+ case BONITO_PCIMEMBASECFG:
+ case BONITO_PCIMAP_CFG:
+ case BONITO_GPIODATA:
+ case BONITO_GPIOIE:
+ case BONITO_INTEDGE:
+ case BONITO_INTSTEER:
+ case BONITO_INTPOL:
+ case BONITO_PCIMAIL0:
+ case BONITO_PCIMAIL1:
+ case BONITO_PCIMAIL2:
+ case BONITO_PCIMAIL3:
+ case BONITO_PCICACHECTRL:
+ case BONITO_PCICACHETAG:
+ case BONITO_PCIBADADDR:
+ case BONITO_PCIMSTAT:
+ case BONITO_TIMECFG:
+ case BONITO_CPUCFG:
+ case BONITO_DQCFG:
+ case BONITO_MEMSIZE:
+ s->regs[saddr] = val;
+ break;
+ case BONITO_BONGENCFG:
+ if (!(s->regs[saddr] & 0x04) && (val & 0x04)) {
+ reset = 1; /* bit 2 jump from 0 to 1 cause reset */
+ }
+ s->regs[saddr] = val;
+ if (reset) {
+ qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+ }
+ break;
+ case BONITO_INTENSET:
+ s->regs[BONITO_INTENSET] = val;
+ s->regs[BONITO_INTEN] |= val;
+ break;
+ case BONITO_INTENCLR:
+ s->regs[BONITO_INTENCLR] = val;
+ s->regs[BONITO_INTEN] &= ~val;
+ break;
+ case BONITO_INTEN:
+ case BONITO_INTISR:
+ DPRINTF("write to readonly bonito register %x\n", saddr);
+ break;
+ default:
+ DPRINTF("write to unknown bonito register %x\n", saddr);
+ break;
+ }
+}
+
+static uint64_t bonito_readl(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PCIBonitoState *s = opaque;
+ uint32_t saddr;
+
+ saddr = addr >> 2;
+
+ DPRINTF("bonito_readl "TARGET_FMT_plx"\n", addr);
+ switch (saddr) {
+ case BONITO_INTISR:
+ return s->regs[saddr];
+ default:
+ return s->regs[saddr];
+ }
+}
+
+static const MemoryRegionOps bonito_ops = {
+ .read = bonito_readl,
+ .write = bonito_writel,
+ .endianness = DEVICE_NATIVE_ENDIAN,
+ .valid = {
+ .min_access_size = 4,
+ .max_access_size = 4,
+ },
+};
+
+static void bonito_pciconf_writel(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PCIBonitoState *s = opaque;
+ PCIDevice *d = PCI_DEVICE(s);
+
+ DPRINTF("bonito_pciconf_writel "TARGET_FMT_plx" val %lx\n", addr, val);
+ d->config_write(d, addr, val, 4);
+}
+
+static uint64_t bonito_pciconf_readl(void *opaque, hwaddr addr,
+ unsigned size)
+{
+
+ PCIBonitoState *s = opaque;
+ PCIDevice *d = PCI_DEVICE(s);
+
+ DPRINTF("bonito_pciconf_readl "TARGET_FMT_plx"\n", addr);
+ return d->config_read(d, addr, 4);
+}
+
+/* north bridge PCI configure space. 0x1fe0 0000 - 0x1fe0 00ff */
+
+static const MemoryRegionOps bonito_pciconf_ops = {
+ .read = bonito_pciconf_readl,
+ .write = bonito_pciconf_writel,
+ .endianness = DEVICE_NATIVE_ENDIAN,
+ .valid = {
+ .min_access_size = 4,
+ .max_access_size = 4,
+ },
+};
+
+static uint64_t bonito_ldma_readl(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ uint32_t val;
+ PCIBonitoState *s = opaque;
+
+ if (addr >= sizeof(s->bonldma)) {
+ return 0;
+ }
+
+ val = ((uint32_t *)(&s->bonldma))[addr / sizeof(uint32_t)];
+
+ return val;
+}
+
+static void bonito_ldma_writel(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PCIBonitoState *s = opaque;
+
+ if (addr >= sizeof(s->bonldma)) {
+ return;
+ }
+
+ ((uint32_t *)(&s->bonldma))[addr / sizeof(uint32_t)] = val & 0xffffffff;
+}
+
+static const MemoryRegionOps bonito_ldma_ops = {
+ .read = bonito_ldma_readl,
+ .write = bonito_ldma_writel,
+ .endianness = DEVICE_NATIVE_ENDIAN,
+ .valid = {
+ .min_access_size = 4,
+ .max_access_size = 4,
+ },
+};
+
+static uint64_t bonito_cop_readl(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ uint32_t val;
+ PCIBonitoState *s = opaque;
+
+ if (addr >= sizeof(s->boncop)) {
+ return 0;
+ }
+
+ val = ((uint32_t *)(&s->boncop))[addr / sizeof(uint32_t)];
+
+ return val;
+}
+
+static void bonito_cop_writel(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PCIBonitoState *s = opaque;
+
+ if (addr >= sizeof(s->boncop)) {
+ return;
+ }
+
+ ((uint32_t *)(&s->boncop))[addr / sizeof(uint32_t)] = val & 0xffffffff;
+}
+
+static const MemoryRegionOps bonito_cop_ops = {
+ .read = bonito_cop_readl,
+ .write = bonito_cop_writel,
+ .endianness = DEVICE_NATIVE_ENDIAN,
+ .valid = {
+ .min_access_size = 4,
+ .max_access_size = 4,
+ },
+};
+
+static uint32_t bonito_sbridge_pciaddr(void *opaque, hwaddr addr)
+{
+ PCIBonitoState *s = opaque;
+ PCIHostState *phb = PCI_HOST_BRIDGE(s->pcihost);
+ uint32_t cfgaddr;
+ uint32_t idsel;
+ uint32_t devno;
+ uint32_t funno;
+ uint32_t regno;
+ uint32_t pciaddr;
+
+ /* support type0 pci config */
+ if ((s->regs[BONITO_PCIMAP_CFG] & 0x10000) != 0x0) {
+ return 0xffffffff;
+ }
+
+ cfgaddr = addr & 0xffff;
+ cfgaddr |= (s->regs[BONITO_PCIMAP_CFG] & 0xffff) << 16;
+
+ idsel = (cfgaddr & BONITO_PCICONF_IDSEL_MASK) >>
+ BONITO_PCICONF_IDSEL_OFFSET;
+ devno = ctz32(idsel);
+ funno = (cfgaddr & BONITO_PCICONF_FUN_MASK) >> BONITO_PCICONF_FUN_OFFSET;
+ regno = (cfgaddr & BONITO_PCICONF_REG_MASK_HW) >> BONITO_PCICONF_REG_OFFSET;
+
+ if (idsel == 0) {
+ error_report("error in bonito pci config address 0x" TARGET_FMT_plx
+ ",pcimap_cfg=0x%x", addr, s->regs[BONITO_PCIMAP_CFG]);
+ exit(1);
+ }
+ pciaddr = PCI_ADDR(pci_bus_num(phb->bus), devno, funno, regno);
+ DPRINTF("cfgaddr %x pciaddr %x busno %x devno %d funno %d regno %d\n",
+ cfgaddr, pciaddr, pci_bus_num(phb->bus), devno, funno, regno);
+
+ return pciaddr;
+}
+
+static void bonito_spciconf_write(void *opaque, hwaddr addr, uint64_t val,
+ unsigned size)
+{
+ PCIBonitoState *s = opaque;
+ PCIDevice *d = PCI_DEVICE(s);
+ PCIHostState *phb = PCI_HOST_BRIDGE(s->pcihost);
+ uint32_t pciaddr;
+ uint16_t status;
+
+ DPRINTF("bonito_spciconf_write "TARGET_FMT_plx" size %d val %lx\n",
+ addr, size, val);
+
+ pciaddr = bonito_sbridge_pciaddr(s, addr);
+
+ if (pciaddr == 0xffffffff) {
+ return;
+ }
+ if (addr & ~BONITO_PCICONF_REG_MASK_DS) {
+ trace_bonito_spciconf_small_access(addr, size);
+ }
+
+ /* set the pci address in s->config_reg */
+ phb->config_reg = (pciaddr) | (1u << 31);
+ pci_data_write(phb->bus, phb->config_reg, val, size);
+
+ /* clear PCI_STATUS_REC_MASTER_ABORT and PCI_STATUS_REC_TARGET_ABORT */
+ status = pci_get_word(d->config + PCI_STATUS);
+ status &= ~(PCI_STATUS_REC_MASTER_ABORT | PCI_STATUS_REC_TARGET_ABORT);
+ pci_set_word(d->config + PCI_STATUS, status);
+}
+
+static uint64_t bonito_spciconf_read(void *opaque, hwaddr addr, unsigned size)
+{
+ PCIBonitoState *s = opaque;
+ PCIDevice *d = PCI_DEVICE(s);
+ PCIHostState *phb = PCI_HOST_BRIDGE(s->pcihost);
+ uint32_t pciaddr;
+ uint16_t status;
+
+ DPRINTF("bonito_spciconf_read "TARGET_FMT_plx" size %d\n", addr, size);
+
+ pciaddr = bonito_sbridge_pciaddr(s, addr);
+
+ if (pciaddr == 0xffffffff) {
+ return MAKE_64BIT_MASK(0, size * 8);
+ }
+ if (addr & ~BONITO_PCICONF_REG_MASK_DS) {
+ trace_bonito_spciconf_small_access(addr, size);
+ }
+
+ /* set the pci address in s->config_reg */
+ phb->config_reg = (pciaddr) | (1u << 31);
+
+ /* clear PCI_STATUS_REC_MASTER_ABORT and PCI_STATUS_REC_TARGET_ABORT */
+ status = pci_get_word(d->config + PCI_STATUS);
+ status &= ~(PCI_STATUS_REC_MASTER_ABORT | PCI_STATUS_REC_TARGET_ABORT);
+ pci_set_word(d->config + PCI_STATUS, status);
+
+ return pci_data_read(phb->bus, phb->config_reg, size);
+}
+
+/* south bridge PCI configure space. 0x1fe8 0000 - 0x1fef ffff */
+static const MemoryRegionOps bonito_spciconf_ops = {
+ .read = bonito_spciconf_read,
+ .write = bonito_spciconf_write,
+ .valid.min_access_size = 1,
+ .valid.max_access_size = 4,
+ .impl.min_access_size = 1,
+ .impl.max_access_size = 4,
+ .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+#define BONITO_IRQ_BASE 32
+
+static void pci_bonito_set_irq(void *opaque, int irq_num, int level)
+{
+ BonitoState *s = opaque;
+ qemu_irq *pic = s->pic;
+ PCIBonitoState *bonito_state = s->pci_dev;
+ int internal_irq = irq_num - BONITO_IRQ_BASE;
+
+ if (bonito_state->regs[BONITO_INTEDGE] & (1 << internal_irq)) {
+ qemu_irq_pulse(*pic);
+ } else { /* level triggered */
+ if (bonito_state->regs[BONITO_INTPOL] & (1 << internal_irq)) {
+ qemu_irq_raise(*pic);
+ } else {
+ qemu_irq_lower(*pic);
+ }
+ }
+}
+
+/* map the original irq (0~3) to bonito irq (16~47, but 16~31 are unused) */
+static int pci_bonito_map_irq(PCIDevice *pci_dev, int irq_num)
+{
+ int slot;
+
+ slot = PCI_SLOT(pci_dev->devfn);
+
+ switch (slot) {
+ case 5: /* FULOONG2E_VIA_SLOT, SouthBridge, IDE, USB, ACPI, AC97, MC97 */
+ return irq_num % 4 + BONITO_IRQ_BASE;
+ case 6: /* FULOONG2E_ATI_SLOT, VGA */
+ return 4 + BONITO_IRQ_BASE;
+ case 7: /* FULOONG2E_RTL_SLOT, RTL8139 */
+ return 5 + BONITO_IRQ_BASE;
+ case 8 ... 12: /* PCI slot 1 to 4 */
+ return (slot - 8 + irq_num) + 6 + BONITO_IRQ_BASE;
+ default: /* Unknown device, don't do any translation */
+ return irq_num;
+ }
+}
+
+static void bonito_reset(void *opaque)
+{
+ PCIBonitoState *s = opaque;
+ uint32_t val = 0;
+
+ /* set the default value of north bridge registers */
+
+ s->regs[BONITO_BONPONCFG] = 0xc40;
+ val = FIELD_DP32(val, BONGENCFG, PCIQUEUE, 1);
+ val = FIELD_DP32(val, BONGENCFG, WRITEBEHIND, 1);
+ val = FIELD_DP32(val, BONGENCFG, PREFETCH, 1);
+ val = FIELD_DP32(val, BONGENCFG, UNCACHED, 1);
+ val = FIELD_DP32(val, BONGENCFG, CPUSELFRESET, 1);
+ s->regs[BONITO_BONGENCFG] = val;
+
+ s->regs[BONITO_IODEVCFG] = 0x2bff8010;
+ s->regs[BONITO_SDCFG] = 0x255e0091;
+
+ s->regs[BONITO_GPIODATA] = 0x1ff;
+ s->regs[BONITO_GPIOIE] = 0x1ff;
+ s->regs[BONITO_DQCFG] = 0x8;
+ s->regs[BONITO_MEMSIZE] = 0x10000000;
+ s->regs[BONITO_PCIMAP] = 0x6140;
+}
+
+static const VMStateDescription vmstate_bonito = {
+ .name = "Bonito",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .fields = (VMStateField[]) {
+ VMSTATE_PCI_DEVICE(dev, PCIBonitoState),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static void bonito_pcihost_realize(DeviceState *dev, Error **errp)
+{
+ PCIHostState *phb = PCI_HOST_BRIDGE(dev);
+ BonitoState *bs = BONITO_PCI_HOST_BRIDGE(dev);
+ MemoryRegion *pcimem_lo_alias = g_new(MemoryRegion, 3);
+
+ memory_region_init(&bs->pci_mem, OBJECT(dev), "pci.mem", BONITO_PCIHI_SIZE);
+ phb->bus = pci_register_root_bus(dev, "pci",
+ pci_bonito_set_irq, pci_bonito_map_irq,
+ dev, &bs->pci_mem, get_system_io(),
+ PCI_DEVFN(5, 0), 32, TYPE_PCI_BUS);
+
+ for (size_t i = 0; i < 3; i++) {
+ char *name = g_strdup_printf("pci.lomem%zu", i);
+
+ memory_region_init_alias(&pcimem_lo_alias[i], NULL, name,
+ &bs->pci_mem, i * 64 * MiB, 64 * MiB);
+ memory_region_add_subregion(get_system_memory(),
+ BONITO_PCILO_BASE + i * 64 * MiB,
+ &pcimem_lo_alias[i]);
+ g_free(name);
+ }
+
+ create_unimplemented_device("pci.io", BONITO_PCIIO_BASE, 1 * MiB);
+}
+
+static void bonito_realize(PCIDevice *dev, Error **errp)
+{
+ PCIBonitoState *s = PCI_BONITO(dev);
+ SysBusDevice *sysbus = SYS_BUS_DEVICE(s->pcihost);
+ PCIHostState *phb = PCI_HOST_BRIDGE(s->pcihost);
+ BonitoState *bs = BONITO_PCI_HOST_BRIDGE(s->pcihost);
+ MemoryRegion *pcimem_alias = g_new(MemoryRegion, 1);
+
+ /*
+ * Bonito North Bridge, built on FPGA,
+ * VENDOR_ID/DEVICE_ID are "undefined"
+ */
+ pci_config_set_prog_interface(dev->config, 0x00);
+
+ /* set the north bridge register mapping */
+ memory_region_init_io(&s->iomem, OBJECT(s), &bonito_ops, s,
+ "north-bridge-register", BONITO_INTERNAL_REG_SIZE);
+ sysbus_init_mmio(sysbus, &s->iomem);
+ sysbus_mmio_map(sysbus, 0, BONITO_INTERNAL_REG_BASE);
+
+ /* set the north bridge pci configure mapping */
+ memory_region_init_io(&phb->conf_mem, OBJECT(s), &bonito_pciconf_ops, s,
+ "north-bridge-pci-config", BONITO_PCICONFIG_SIZE);
+ sysbus_init_mmio(sysbus, &phb->conf_mem);
+ sysbus_mmio_map(sysbus, 1, BONITO_PCICONFIG_BASE);
+
+ /* set the south bridge pci configure mapping */
+ memory_region_init_io(&phb->data_mem, OBJECT(s), &bonito_spciconf_ops, s,
+ "south-bridge-pci-config", BONITO_SPCICONFIG_SIZE);
+ sysbus_init_mmio(sysbus, &phb->data_mem);
+ sysbus_mmio_map(sysbus, 2, BONITO_SPCICONFIG_BASE);
+
+ create_unimplemented_device("bonito", BONITO_REG_BASE, BONITO_REG_SIZE);
+
+ memory_region_init_io(&s->iomem_ldma, OBJECT(s), &bonito_ldma_ops, s,
+ "ldma", 0x100);
+ sysbus_init_mmio(sysbus, &s->iomem_ldma);
+ sysbus_mmio_map(sysbus, 3, 0x1fe00200);
+
+ /* PCI copier */
+ memory_region_init_io(&s->iomem_cop, OBJECT(s), &bonito_cop_ops, s,
+ "cop", 0x100);
+ sysbus_init_mmio(sysbus, &s->iomem_cop);
+ sysbus_mmio_map(sysbus, 4, 0x1fe00300);
+
+ create_unimplemented_device("ROMCS", BONITO_FLASH_BASE, 60 * MiB);
+
+ /* Map PCI IO Space 0x1fd0 0000 - 0x1fd1 0000 */
+ memory_region_init_alias(&s->bonito_pciio, OBJECT(s), "isa_mmio",
+ get_system_io(), 0, BONITO_PCIIO_SIZE);
+ sysbus_init_mmio(sysbus, &s->bonito_pciio);
+ sysbus_mmio_map(sysbus, 5, BONITO_PCIIO_BASE);
+
+ /* add pci local io mapping */
+
+ memory_region_init_alias(&s->bonito_localio, OBJECT(s), "IOCS[0]",
+ get_system_io(), 0, 256 * KiB);
+ sysbus_init_mmio(sysbus, &s->bonito_localio);
+ sysbus_mmio_map(sysbus, 6, BONITO_DEV_BASE);
+ create_unimplemented_device("IOCS[1]", BONITO_DEV_BASE + 1 * 256 * KiB,
+ 256 * KiB);
+ create_unimplemented_device("IOCS[2]", BONITO_DEV_BASE + 2 * 256 * KiB,
+ 256 * KiB);
+ create_unimplemented_device("IOCS[3]", BONITO_DEV_BASE + 3 * 256 * KiB,
+ 256 * KiB);
+
+ memory_region_init_alias(pcimem_alias, NULL, "pci.mem.alias",
+ &bs->pci_mem, 0, BONITO_PCIHI_SIZE);
+ memory_region_add_subregion(get_system_memory(),
+ BONITO_PCIHI_BASE, pcimem_alias);
+ create_unimplemented_device("PCI_2",
+ (hwaddr)BONITO_PCIHI_BASE + BONITO_PCIHI_SIZE,
+ 2 * GiB);
+
+ /* set the default value of north bridge pci config */
+ pci_set_word(dev->config + PCI_COMMAND, 0x0000);
+ pci_set_word(dev->config + PCI_STATUS, 0x0000);
+ pci_set_word(dev->config + PCI_SUBSYSTEM_VENDOR_ID, 0x0000);
+ pci_set_word(dev->config + PCI_SUBSYSTEM_ID, 0x0000);
+
+ pci_set_byte(dev->config + PCI_INTERRUPT_LINE, 0x00);
+ pci_config_set_interrupt_pin(dev->config, 0x01); /* interrupt pin A */
+
+ pci_set_byte(dev->config + PCI_MIN_GNT, 0x3c);
+ pci_set_byte(dev->config + PCI_MAX_LAT, 0x00);
+
+ qemu_register_reset(bonito_reset, s);
+}
+
+PCIBus *bonito_init(qemu_irq *pic)
+{
+ DeviceState *dev;
+ BonitoState *pcihost;
+ PCIHostState *phb;
+ PCIBonitoState *s;
+ PCIDevice *d;
+
+ dev = qdev_new(TYPE_BONITO_PCI_HOST_BRIDGE);
+ phb = PCI_HOST_BRIDGE(dev);
+ pcihost = BONITO_PCI_HOST_BRIDGE(dev);
+ pcihost->pic = pic;
+ sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+
+ d = pci_new(PCI_DEVFN(0, 0), TYPE_PCI_BONITO);
+ s = PCI_BONITO(d);
+ s->pcihost = pcihost;
+ pcihost->pci_dev = s;
+ pci_realize_and_unref(d, phb->bus, &error_fatal);
+
+ return phb->bus;
+}
+
+static void bonito_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+ k->realize = bonito_realize;
+ k->vendor_id = 0xdf53;
+ k->device_id = 0x00d5;
+ k->revision = 0x01;
+ k->class_id = PCI_CLASS_BRIDGE_HOST;
+ dc->desc = "Host bridge";
+ dc->vmsd = &vmstate_bonito;
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo bonito_info = {
+ .name = TYPE_PCI_BONITO,
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(PCIBonitoState),
+ .class_init = bonito_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+static void bonito_pcihost_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ dc->realize = bonito_pcihost_realize;
+}
+
+static const TypeInfo bonito_pcihost_info = {
+ .name = TYPE_BONITO_PCI_HOST_BRIDGE,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(BonitoState),
+ .class_init = bonito_pcihost_class_init,
+};
+
+static void bonito_register_types(void)
+{
+ type_register_static(&bonito_pcihost_info);
+ type_register_static(&bonito_info);
+}
+
+type_init(bonito_register_types)
diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
new file mode 100644
index 000000000..bde3a343a
--- /dev/null
+++ b/hw/pci-host/designware.c
@@ -0,0 +1,773 @@
+/*
+ * Copyright (c) 2018, Impinj, Inc.
+ *
+ * Designware PCIe IP block emulation
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see
+ * <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/module.h"
+#include "qemu/log.h"
+#include "hw/pci/msi.h"
+#include "hw/pci/pci_bridge.h"
+#include "hw/pci/pci_host.h"
+#include "hw/pci/pcie_port.h"
+#include "hw/qdev-properties.h"
+#include "migration/vmstate.h"
+#include "hw/irq.h"
+#include "hw/pci-host/designware.h"
+
+#define DESIGNWARE_PCIE_PORT_LINK_CONTROL 0x710
+#define DESIGNWARE_PCIE_PHY_DEBUG_R1 0x72C
+#define DESIGNWARE_PCIE_PHY_DEBUG_R1_XMLH_LINK_UP BIT(4)
+#define DESIGNWARE_PCIE_LINK_WIDTH_SPEED_CONTROL 0x80C
+#define DESIGNWARE_PCIE_PORT_LOGIC_SPEED_CHANGE BIT(17)
+#define DESIGNWARE_PCIE_MSI_ADDR_LO 0x820
+#define DESIGNWARE_PCIE_MSI_ADDR_HI 0x824
+#define DESIGNWARE_PCIE_MSI_INTR0_ENABLE 0x828
+#define DESIGNWARE_PCIE_MSI_INTR0_MASK 0x82C
+#define DESIGNWARE_PCIE_MSI_INTR0_STATUS 0x830
+#define DESIGNWARE_PCIE_ATU_VIEWPORT 0x900
+#define DESIGNWARE_PCIE_ATU_REGION_INBOUND BIT(31)
+#define DESIGNWARE_PCIE_ATU_CR1 0x904
+#define DESIGNWARE_PCIE_ATU_TYPE_MEM (0x0 << 0)
+#define DESIGNWARE_PCIE_ATU_CR2 0x908
+#define DESIGNWARE_PCIE_ATU_ENABLE BIT(31)
+#define DESIGNWARE_PCIE_ATU_LOWER_BASE 0x90C
+#define DESIGNWARE_PCIE_ATU_UPPER_BASE 0x910
+#define DESIGNWARE_PCIE_ATU_LIMIT 0x914
+#define DESIGNWARE_PCIE_ATU_LOWER_TARGET 0x918
+#define DESIGNWARE_PCIE_ATU_BUS(x) (((x) >> 24) & 0xff)
+#define DESIGNWARE_PCIE_ATU_DEVFN(x) (((x) >> 16) & 0xff)
+#define DESIGNWARE_PCIE_ATU_UPPER_TARGET 0x91C
+
+#define DESIGNWARE_PCIE_IRQ_MSI 3
+
+static DesignwarePCIEHost *
+designware_pcie_root_to_host(DesignwarePCIERoot *root)
+{
+ BusState *bus = qdev_get_parent_bus(DEVICE(root));
+ return DESIGNWARE_PCIE_HOST(bus->parent);
+}
+
+static uint64_t designware_pcie_root_msi_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ /*
+ * Attempts to read from the MSI address are undefined in
+ * the PCI specifications. For this hardware, the datasheet
+ * specifies that a read from the magic address is simply not
+ * intercepted by the MSI controller, and will go out to the
+ * AHB/AXI bus like any other PCI-device-initiated DMA read.
+ * This is not trivial to implement in QEMU, so since
+ * well-behaved guests won't ever ask a PCI device to DMA from
+ * this address we just log the missing functionality.
+ */
+ qemu_log_mask(LOG_UNIMP, "%s not implemented\n", __func__);
+ return 0;
+}
+
+static void designware_pcie_root_msi_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned len)
+{
+ DesignwarePCIERoot *root = DESIGNWARE_PCIE_ROOT(opaque);
+ DesignwarePCIEHost *host = designware_pcie_root_to_host(root);
+
+ root->msi.intr[0].status |= BIT(val) & root->msi.intr[0].enable;
+
+ if (root->msi.intr[0].status & ~root->msi.intr[0].mask) {
+ qemu_set_irq(host->pci.irqs[DESIGNWARE_PCIE_IRQ_MSI], 1);
+ }
+}
+
+static const MemoryRegionOps designware_pci_host_msi_ops = {
+ .read = designware_pcie_root_msi_read,
+ .write = designware_pcie_root_msi_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ .valid = {
+ .min_access_size = 4,
+ .max_access_size = 4,
+ },
+};
+
+static void designware_pcie_root_update_msi_mapping(DesignwarePCIERoot *root)
+
+{
+ MemoryRegion *mem = &root->msi.iomem;
+ const uint64_t base = root->msi.base;
+ const bool enable = root->msi.intr[0].enable;
+
+ memory_region_set_address(mem, base);
+ memory_region_set_enabled(mem, enable);
+}
+
+static DesignwarePCIEViewport *
+designware_pcie_root_get_current_viewport(DesignwarePCIERoot *root)
+{
+ const unsigned int idx = root->atu_viewport & 0xF;
+ const unsigned int dir =
+ !!(root->atu_viewport & DESIGNWARE_PCIE_ATU_REGION_INBOUND);
+ return &root->viewports[dir][idx];
+}
+
+static uint32_t
+designware_pcie_root_config_read(PCIDevice *d, uint32_t address, int len)
+{
+ DesignwarePCIERoot *root = DESIGNWARE_PCIE_ROOT(d);
+ DesignwarePCIEViewport *viewport =
+ designware_pcie_root_get_current_viewport(root);
+
+ uint32_t val;
+
+ switch (address) {
+ case DESIGNWARE_PCIE_PORT_LINK_CONTROL:
+ /*
+ * Linux guest uses this register only to configure number of
+ * PCIE lane (which in our case is irrelevant) and doesn't
+ * really care about the value it reads from this register
+ */
+ val = 0xDEADBEEF;
+ break;
+
+ case DESIGNWARE_PCIE_LINK_WIDTH_SPEED_CONTROL:
+ /*
+ * To make sure that any code in guest waiting for speed
+ * change does not time out we always report
+ * PORT_LOGIC_SPEED_CHANGE as set
+ */
+ val = DESIGNWARE_PCIE_PORT_LOGIC_SPEED_CHANGE;
+ break;
+
+ case DESIGNWARE_PCIE_MSI_ADDR_LO:
+ val = root->msi.base;
+ break;
+
+ case DESIGNWARE_PCIE_MSI_ADDR_HI:
+ val = root->msi.base >> 32;
+ break;
+
+ case DESIGNWARE_PCIE_MSI_INTR0_ENABLE:
+ val = root->msi.intr[0].enable;
+ break;
+
+ case DESIGNWARE_PCIE_MSI_INTR0_MASK:
+ val = root->msi.intr[0].mask;
+ break;
+
+ case DESIGNWARE_PCIE_MSI_INTR0_STATUS:
+ val = root->msi.intr[0].status;
+ break;
+
+ case DESIGNWARE_PCIE_PHY_DEBUG_R1:
+ val = DESIGNWARE_PCIE_PHY_DEBUG_R1_XMLH_LINK_UP;
+ break;
+
+ case DESIGNWARE_PCIE_ATU_VIEWPORT:
+ val = root->atu_viewport;
+ break;
+
+ case DESIGNWARE_PCIE_ATU_LOWER_BASE:
+ val = viewport->base;
+ break;
+
+ case DESIGNWARE_PCIE_ATU_UPPER_BASE:
+ val = viewport->base >> 32;
+ break;
+
+ case DESIGNWARE_PCIE_ATU_LOWER_TARGET:
+ val = viewport->target;
+ break;
+
+ case DESIGNWARE_PCIE_ATU_UPPER_TARGET:
+ val = viewport->target >> 32;
+ break;
+
+ case DESIGNWARE_PCIE_ATU_LIMIT:
+ val = viewport->limit;
+ break;
+
+ case DESIGNWARE_PCIE_ATU_CR1:
+ case DESIGNWARE_PCIE_ATU_CR2:
+ val = viewport->cr[(address - DESIGNWARE_PCIE_ATU_CR1) /
+ sizeof(uint32_t)];
+ break;
+
+ default:
+ val = pci_default_read_config(d, address, len);
+ break;
+ }
+
+ return val;
+}
+
+static uint64_t designware_pcie_root_data_access(void *opaque, hwaddr addr,
+ uint64_t *val, unsigned len)
+{
+ DesignwarePCIEViewport *viewport = opaque;
+ DesignwarePCIERoot *root = viewport->root;
+
+ const uint8_t busnum = DESIGNWARE_PCIE_ATU_BUS(viewport->target);
+ const uint8_t devfn = DESIGNWARE_PCIE_ATU_DEVFN(viewport->target);
+ PCIBus *pcibus = pci_get_bus(PCI_DEVICE(root));
+ PCIDevice *pcidev = pci_find_device(pcibus, busnum, devfn);
+
+ if (pcidev) {
+ addr &= pci_config_size(pcidev) - 1;
+
+ if (val) {
+ pci_host_config_write_common(pcidev, addr,
+ pci_config_size(pcidev),
+ *val, len);
+ } else {
+ return pci_host_config_read_common(pcidev, addr,
+ pci_config_size(pcidev),
+ len);
+ }
+ }
+
+ return UINT64_MAX;
+}
+
+static uint64_t designware_pcie_root_data_read(void *opaque, hwaddr addr,
+ unsigned len)
+{
+ return designware_pcie_root_data_access(opaque, addr, NULL, len);
+}
+
+static void designware_pcie_root_data_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned len)
+{
+ designware_pcie_root_data_access(opaque, addr, &val, len);
+}
+
+static const MemoryRegionOps designware_pci_host_conf_ops = {
+ .read = designware_pcie_root_data_read,
+ .write = designware_pcie_root_data_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ .valid = {
+ .min_access_size = 1,
+ .max_access_size = 4,
+ },
+};
+
+static void designware_pcie_update_viewport(DesignwarePCIERoot *root,
+ DesignwarePCIEViewport *viewport)
+{
+ const uint64_t target = viewport->target;
+ const uint64_t base = viewport->base;
+ const uint64_t size = (uint64_t)viewport->limit - base + 1;
+ const bool enabled = viewport->cr[1] & DESIGNWARE_PCIE_ATU_ENABLE;
+
+ MemoryRegion *current, *other;
+
+ if (viewport->cr[0] == DESIGNWARE_PCIE_ATU_TYPE_MEM) {
+ current = &viewport->mem;
+ other = &viewport->cfg;
+ memory_region_set_alias_offset(current, target);
+ } else {
+ current = &viewport->cfg;
+ other = &viewport->mem;
+ }
+
+ /*
+ * An outbound viewport can be reconfigure from being MEM to CFG,
+ * to account for that we disable the "other" memory region that
+ * becomes unused due to that fact.
+ */
+ memory_region_set_enabled(other, false);
+ if (enabled) {
+ memory_region_set_size(current, size);
+ memory_region_set_address(current, base);
+ }
+ memory_region_set_enabled(current, enabled);
+}
+
+static void designware_pcie_root_config_write(PCIDevice *d, uint32_t address,
+ uint32_t val, int len)
+{
+ DesignwarePCIERoot *root = DESIGNWARE_PCIE_ROOT(d);
+ DesignwarePCIEHost *host = designware_pcie_root_to_host(root);
+ DesignwarePCIEViewport *viewport =
+ designware_pcie_root_get_current_viewport(root);
+
+ switch (address) {
+ case DESIGNWARE_PCIE_PORT_LINK_CONTROL:
+ case DESIGNWARE_PCIE_LINK_WIDTH_SPEED_CONTROL:
+ case DESIGNWARE_PCIE_PHY_DEBUG_R1:
+ /* No-op */
+ break;
+
+ case DESIGNWARE_PCIE_MSI_ADDR_LO:
+ root->msi.base &= 0xFFFFFFFF00000000ULL;
+ root->msi.base |= val;
+ designware_pcie_root_update_msi_mapping(root);
+ break;
+
+ case DESIGNWARE_PCIE_MSI_ADDR_HI:
+ root->msi.base &= 0x00000000FFFFFFFFULL;
+ root->msi.base |= (uint64_t)val << 32;
+ designware_pcie_root_update_msi_mapping(root);
+ break;
+
+ case DESIGNWARE_PCIE_MSI_INTR0_ENABLE:
+ root->msi.intr[0].enable = val;
+ designware_pcie_root_update_msi_mapping(root);
+ break;
+
+ case DESIGNWARE_PCIE_MSI_INTR0_MASK:
+ root->msi.intr[0].mask = val;
+ break;
+
+ case DESIGNWARE_PCIE_MSI_INTR0_STATUS:
+ root->msi.intr[0].status ^= val;
+ if (!root->msi.intr[0].status) {
+ qemu_set_irq(host->pci.irqs[DESIGNWARE_PCIE_IRQ_MSI], 0);
+ }
+ break;
+
+ case DESIGNWARE_PCIE_ATU_VIEWPORT:
+ root->atu_viewport = val;
+ break;
+
+ case DESIGNWARE_PCIE_ATU_LOWER_BASE:
+ viewport->base &= 0xFFFFFFFF00000000ULL;
+ viewport->base |= val;
+ break;
+
+ case DESIGNWARE_PCIE_ATU_UPPER_BASE:
+ viewport->base &= 0x00000000FFFFFFFFULL;
+ viewport->base |= (uint64_t)val << 32;
+ break;
+
+ case DESIGNWARE_PCIE_ATU_LOWER_TARGET:
+ viewport->target &= 0xFFFFFFFF00000000ULL;
+ viewport->target |= val;
+ break;
+
+ case DESIGNWARE_PCIE_ATU_UPPER_TARGET:
+ viewport->target &= 0x00000000FFFFFFFFULL;
+ viewport->target |= val;
+ break;
+
+ case DESIGNWARE_PCIE_ATU_LIMIT:
+ viewport->limit = val;
+ break;
+
+ case DESIGNWARE_PCIE_ATU_CR1:
+ viewport->cr[0] = val;
+ break;
+ case DESIGNWARE_PCIE_ATU_CR2:
+ viewport->cr[1] = val;
+ designware_pcie_update_viewport(root, viewport);
+ break;
+
+ default:
+ pci_bridge_write_config(d, address, val, len);
+ break;
+ }
+}
+
+static char *designware_pcie_viewport_name(const char *direction,
+ unsigned int i,
+ const char *type)
+{
+ return g_strdup_printf("PCI %s Viewport %u [%s]",
+ direction, i, type);
+}
+
+static void designware_pcie_root_realize(PCIDevice *dev, Error **errp)
+{
+ DesignwarePCIERoot *root = DESIGNWARE_PCIE_ROOT(dev);
+ DesignwarePCIEHost *host = designware_pcie_root_to_host(root);
+ MemoryRegion *address_space = &host->pci.memory;
+ PCIBridge *br = PCI_BRIDGE(dev);
+ DesignwarePCIEViewport *viewport;
+ /*
+ * Dummy values used for initial configuration of MemoryRegions
+ * that belong to a given viewport
+ */
+ const hwaddr dummy_offset = 0;
+ const uint64_t dummy_size = 4;
+ size_t i;
+
+ br->bus_name = "dw-pcie";
+
+ pci_set_word(dev->config + PCI_COMMAND,
+ PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
+
+ pci_config_set_interrupt_pin(dev->config, 1);
+ pci_bridge_initfn(dev, TYPE_PCIE_BUS);
+
+ pcie_port_init_reg(dev);
+
+ pcie_cap_init(dev, 0x70, PCI_EXP_TYPE_ROOT_PORT,
+ 0, &error_fatal);
+
+ msi_nonbroken = true;
+ msi_init(dev, 0x50, 32, true, true, &error_fatal);
+
+ for (i = 0; i < DESIGNWARE_PCIE_NUM_VIEWPORTS; i++) {
+ MemoryRegion *source, *destination, *mem;
+ const char *direction;
+ char *name;
+
+ viewport = &root->viewports[DESIGNWARE_PCIE_VIEWPORT_INBOUND][i];
+ viewport->inbound = true;
+ viewport->base = 0x0000000000000000ULL;
+ viewport->target = 0x0000000000000000ULL;
+ viewport->limit = UINT32_MAX;
+ viewport->cr[0] = DESIGNWARE_PCIE_ATU_TYPE_MEM;
+
+ source = &host->pci.address_space_root;
+ destination = get_system_memory();
+ direction = "Inbound";
+
+ /*
+ * Configure MemoryRegion implementing PCI -> CPU memory
+ * access
+ */
+ mem = &viewport->mem;
+ name = designware_pcie_viewport_name(direction, i, "MEM");
+ memory_region_init_alias(mem, OBJECT(root), name, destination,
+ dummy_offset, dummy_size);
+ memory_region_add_subregion_overlap(source, dummy_offset, mem, -1);
+ memory_region_set_enabled(mem, false);
+ g_free(name);
+
+ viewport = &root->viewports[DESIGNWARE_PCIE_VIEWPORT_OUTBOUND][i];
+ viewport->root = root;
+ viewport->inbound = false;
+ viewport->base = 0x0000000000000000ULL;
+ viewport->target = 0x0000000000000000ULL;
+ viewport->limit = UINT32_MAX;
+ viewport->cr[0] = DESIGNWARE_PCIE_ATU_TYPE_MEM;
+
+ destination = &host->pci.memory;
+ direction = "Outbound";
+ source = get_system_memory();
+
+ /*
+ * Configure MemoryRegion implementing CPU -> PCI memory
+ * access
+ */
+ mem = &viewport->mem;
+ name = designware_pcie_viewport_name(direction, i, "MEM");
+ memory_region_init_alias(mem, OBJECT(root), name, destination,
+ dummy_offset, dummy_size);
+ memory_region_add_subregion(source, dummy_offset, mem);
+ memory_region_set_enabled(mem, false);
+ g_free(name);
+
+ /*
+ * Configure MemoryRegion implementing access to configuration
+ * space
+ */
+ mem = &viewport->cfg;
+ name = designware_pcie_viewport_name(direction, i, "CFG");
+ memory_region_init_io(&viewport->cfg, OBJECT(root),
+ &designware_pci_host_conf_ops,
+ viewport, name, dummy_size);
+ memory_region_add_subregion(source, dummy_offset, mem);
+ memory_region_set_enabled(mem, false);
+ g_free(name);
+ }
+
+ /*
+ * If no inbound iATU windows are configured, HW defaults to
+ * letting inbound TLPs to pass in. We emulate that by exlicitly
+ * configuring first inbound window to cover all of target's
+ * address space.
+ *
+ * NOTE: This will not work correctly for the case when first
+ * configured inbound window is window 0
+ */
+ viewport = &root->viewports[DESIGNWARE_PCIE_VIEWPORT_INBOUND][0];
+ viewport->cr[1] = DESIGNWARE_PCIE_ATU_ENABLE;
+ designware_pcie_update_viewport(root, viewport);
+
+ memory_region_init_io(&root->msi.iomem, OBJECT(root),
+ &designware_pci_host_msi_ops,
+ root, "pcie-msi", 0x4);
+ /*
+ * We initially place MSI interrupt I/O region a adress 0 and
+ * disable it. It'll be later moved to correct offset and enabled
+ * in designware_pcie_root_update_msi_mapping() as a part of
+ * initialization done by guest OS
+ */
+ memory_region_add_subregion(address_space, dummy_offset, &root->msi.iomem);
+ memory_region_set_enabled(&root->msi.iomem, false);
+}
+
+static void designware_pcie_set_irq(void *opaque, int irq_num, int level)
+{
+ DesignwarePCIEHost *host = DESIGNWARE_PCIE_HOST(opaque);
+
+ qemu_set_irq(host->pci.irqs[irq_num], level);
+}
+
+static const char *
+designware_pcie_host_root_bus_path(PCIHostState *host_bridge, PCIBus *rootbus)
+{
+ return "0000:00";
+}
+
+static const VMStateDescription vmstate_designware_pcie_msi_bank = {
+ .name = "designware-pcie-msi-bank",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT32(enable, DesignwarePCIEMSIBank),
+ VMSTATE_UINT32(mask, DesignwarePCIEMSIBank),
+ VMSTATE_UINT32(status, DesignwarePCIEMSIBank),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static const VMStateDescription vmstate_designware_pcie_msi = {
+ .name = "designware-pcie-msi",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(base, DesignwarePCIEMSI),
+ VMSTATE_STRUCT_ARRAY(intr,
+ DesignwarePCIEMSI,
+ DESIGNWARE_PCIE_NUM_MSI_BANKS,
+ 1,
+ vmstate_designware_pcie_msi_bank,
+ DesignwarePCIEMSIBank),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static const VMStateDescription vmstate_designware_pcie_viewport = {
+ .name = "designware-pcie-viewport",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(base, DesignwarePCIEViewport),
+ VMSTATE_UINT64(target, DesignwarePCIEViewport),
+ VMSTATE_UINT32(limit, DesignwarePCIEViewport),
+ VMSTATE_UINT32_ARRAY(cr, DesignwarePCIEViewport, 2),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static const VMStateDescription vmstate_designware_pcie_root = {
+ .name = "designware-pcie-root",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .fields = (VMStateField[]) {
+ VMSTATE_PCI_DEVICE(parent_obj, PCIBridge),
+ VMSTATE_UINT32(atu_viewport, DesignwarePCIERoot),
+ VMSTATE_STRUCT_2DARRAY(viewports,
+ DesignwarePCIERoot,
+ 2,
+ DESIGNWARE_PCIE_NUM_VIEWPORTS,
+ 1,
+ vmstate_designware_pcie_viewport,
+ DesignwarePCIEViewport),
+ VMSTATE_STRUCT(msi,
+ DesignwarePCIERoot,
+ 1,
+ vmstate_designware_pcie_msi,
+ DesignwarePCIEMSI),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static void designware_pcie_root_class_init(ObjectClass *klass, void *data)
+{
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+
+ k->vendor_id = PCI_VENDOR_ID_SYNOPSYS;
+ k->device_id = 0xABCD;
+ k->revision = 0;
+ k->class_id = PCI_CLASS_BRIDGE_PCI;
+ k->is_bridge = true;
+ k->exit = pci_bridge_exitfn;
+ k->realize = designware_pcie_root_realize;
+ k->config_read = designware_pcie_root_config_read;
+ k->config_write = designware_pcie_root_config_write;
+
+ dc->reset = pci_bridge_reset;
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+ dc->vmsd = &vmstate_designware_pcie_root;
+}
+
+static uint64_t designware_pcie_host_mmio_read(void *opaque, hwaddr addr,
+ unsigned int size)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(opaque);
+ PCIDevice *device = pci_find_device(pci->bus, 0, 0);
+
+ return pci_host_config_read_common(device,
+ addr,
+ pci_config_size(device),
+ size);
+}
+
+static void designware_pcie_host_mmio_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned int size)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(opaque);
+ PCIDevice *device = pci_find_device(pci->bus, 0, 0);
+
+ return pci_host_config_write_common(device,
+ addr,
+ pci_config_size(device),
+ val, size);
+}
+
+static const MemoryRegionOps designware_pci_mmio_ops = {
+ .read = designware_pcie_host_mmio_read,
+ .write = designware_pcie_host_mmio_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ .impl = {
+ /*
+ * Our device would not work correctly if the guest was doing
+ * unaligned access. This might not be a limitation on the real
+ * device but in practice there is no reason for a guest to access
+ * this device unaligned.
+ */
+ .min_access_size = 4,
+ .max_access_size = 4,
+ .unaligned = false,
+ },
+};
+
+static AddressSpace *designware_pcie_host_set_iommu(PCIBus *bus, void *opaque,
+ int devfn)
+{
+ DesignwarePCIEHost *s = DESIGNWARE_PCIE_HOST(opaque);
+
+ return &s->pci.address_space;
+}
+
+static void designware_pcie_host_realize(DeviceState *dev, Error **errp)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+ DesignwarePCIEHost *s = DESIGNWARE_PCIE_HOST(dev);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+ size_t i;
+
+ for (i = 0; i < ARRAY_SIZE(s->pci.irqs); i++) {
+ sysbus_init_irq(sbd, &s->pci.irqs[i]);
+ }
+
+ memory_region_init_io(&s->mmio,
+ OBJECT(s),
+ &designware_pci_mmio_ops,
+ s,
+ "pcie.reg", 4 * 1024);
+ sysbus_init_mmio(sbd, &s->mmio);
+
+ memory_region_init(&s->pci.io, OBJECT(s), "pcie-pio", 16);
+ memory_region_init(&s->pci.memory, OBJECT(s),
+ "pcie-bus-memory",
+ UINT64_MAX);
+
+ pci->bus = pci_register_root_bus(dev, "pcie",
+ designware_pcie_set_irq,
+ pci_swizzle_map_irq_fn,
+ s,
+ &s->pci.memory,
+ &s->pci.io,
+ 0, 4,
+ TYPE_PCIE_BUS);
+
+ memory_region_init(&s->pci.address_space_root,
+ OBJECT(s),
+ "pcie-bus-address-space-root",
+ UINT64_MAX);
+ memory_region_add_subregion(&s->pci.address_space_root,
+ 0x0, &s->pci.memory);
+ address_space_init(&s->pci.address_space,
+ &s->pci.address_space_root,
+ "pcie-bus-address-space");
+ pci_setup_iommu(pci->bus, designware_pcie_host_set_iommu, s);
+
+ qdev_realize(DEVICE(&s->root), BUS(pci->bus), &error_fatal);
+}
+
+static const VMStateDescription vmstate_designware_pcie_host = {
+ .name = "designware-pcie-host",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .fields = (VMStateField[]) {
+ VMSTATE_STRUCT(root,
+ DesignwarePCIEHost,
+ 1,
+ vmstate_designware_pcie_root,
+ DesignwarePCIERoot),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static void designware_pcie_host_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
+
+ hc->root_bus_path = designware_pcie_host_root_bus_path;
+ dc->realize = designware_pcie_host_realize;
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->fw_name = "pci";
+ dc->vmsd = &vmstate_designware_pcie_host;
+}
+
+static void designware_pcie_host_init(Object *obj)
+{
+ DesignwarePCIEHost *s = DESIGNWARE_PCIE_HOST(obj);
+ DesignwarePCIERoot *root = &s->root;
+
+ object_initialize_child(obj, "root", root, TYPE_DESIGNWARE_PCIE_ROOT);
+ qdev_prop_set_int32(DEVICE(root), "addr", PCI_DEVFN(0, 0));
+ qdev_prop_set_bit(DEVICE(root), "multifunction", false);
+}
+
+static const TypeInfo designware_pcie_root_info = {
+ .name = TYPE_DESIGNWARE_PCIE_ROOT,
+ .parent = TYPE_PCI_BRIDGE,
+ .instance_size = sizeof(DesignwarePCIERoot),
+ .class_init = designware_pcie_root_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_PCIE_DEVICE },
+ { }
+ },
+};
+
+static const TypeInfo designware_pcie_host_info = {
+ .name = TYPE_DESIGNWARE_PCIE_HOST,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(DesignwarePCIEHost),
+ .instance_init = designware_pcie_host_init,
+ .class_init = designware_pcie_host_class_init,
+};
+
+static void designware_pcie_register(void)
+{
+ type_register_static(&designware_pcie_root_info);
+ type_register_static(&designware_pcie_host_info);
+}
+type_init(designware_pcie_register)
diff --git a/hw/pci-host/gpex-acpi.c b/hw/pci-host/gpex-acpi.c
new file mode 100644
index 000000000..e7e162a00
--- /dev/null
+++ b/hw/pci-host/gpex-acpi.c
@@ -0,0 +1,269 @@
+#include "qemu/osdep.h"
+#include "hw/acpi/aml-build.h"
+#include "hw/pci-host/gpex.h"
+#include "hw/arm/virt.h"
+#include "hw/pci/pci_bus.h"
+#include "hw/pci/pci_bridge.h"
+#include "hw/pci/pcie_host.h"
+
+static void acpi_dsdt_add_pci_route_table(Aml *dev, uint32_t irq)
+{
+ Aml *method, *crs;
+ int i, slot_no;
+
+ /* Declare the PCI Routing Table. */
+ Aml *rt_pkg = aml_varpackage(PCI_SLOT_MAX * PCI_NUM_PINS);
+ for (slot_no = 0; slot_no < PCI_SLOT_MAX; slot_no++) {
+ for (i = 0; i < PCI_NUM_PINS; i++) {
+ int gsi = (i + slot_no) % PCI_NUM_PINS;
+ Aml *pkg = aml_package(4);
+ aml_append(pkg, aml_int((slot_no << 16) | 0xFFFF));
+ aml_append(pkg, aml_int(i));
+ aml_append(pkg, aml_name("GSI%d", gsi));
+ aml_append(pkg, aml_int(0));
+ aml_append(rt_pkg, pkg);
+ }
+ }
+ aml_append(dev, aml_name_decl("_PRT", rt_pkg));
+
+ /* Create GSI link device */
+ for (i = 0; i < PCI_NUM_PINS; i++) {
+ uint32_t irqs = irq + i;
+ Aml *dev_gsi = aml_device("GSI%d", i);
+ aml_append(dev_gsi, aml_name_decl("_HID", aml_string("PNP0C0F")));
+ aml_append(dev_gsi, aml_name_decl("_UID", aml_int(i)));
+ crs = aml_resource_template();
+ aml_append(crs,
+ aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
+ AML_EXCLUSIVE, &irqs, 1));
+ aml_append(dev_gsi, aml_name_decl("_PRS", crs));
+ crs = aml_resource_template();
+ aml_append(crs,
+ aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
+ AML_EXCLUSIVE, &irqs, 1));
+ aml_append(dev_gsi, aml_name_decl("_CRS", crs));
+ method = aml_method("_SRS", 1, AML_NOTSERIALIZED);
+ aml_append(dev_gsi, method);
+ aml_append(dev, dev_gsi);
+ }
+}
+
+static void acpi_dsdt_add_pci_osc(Aml *dev)
+{
+ Aml *method, *UUID, *ifctx, *ifctx1, *elsectx, *buf;
+
+ /* Declare an _OSC (OS Control Handoff) method */
+ aml_append(dev, aml_name_decl("SUPP", aml_int(0)));
+ aml_append(dev, aml_name_decl("CTRL", aml_int(0)));
+ method = aml_method("_OSC", 4, AML_NOTSERIALIZED);
+ aml_append(method,
+ aml_create_dword_field(aml_arg(3), aml_int(0), "CDW1"));
+
+ /* PCI Firmware Specification 3.0
+ * 4.5.1. _OSC Interface for PCI Host Bridge Devices
+ * The _OSC interface for a PCI/PCI-X/PCI Express hierarchy is
+ * identified by the Universal Unique IDentifier (UUID)
+ * 33DB4D5B-1FF7-401C-9657-7441C03DD766
+ */
+ UUID = aml_touuid("33DB4D5B-1FF7-401C-9657-7441C03DD766");
+ ifctx = aml_if(aml_equal(aml_arg(0), UUID));
+ aml_append(ifctx,
+ aml_create_dword_field(aml_arg(3), aml_int(4), "CDW2"));
+ aml_append(ifctx,
+ aml_create_dword_field(aml_arg(3), aml_int(8), "CDW3"));
+ aml_append(ifctx, aml_store(aml_name("CDW2"), aml_name("SUPP")));
+ aml_append(ifctx, aml_store(aml_name("CDW3"), aml_name("CTRL")));
+
+ /*
+ * Allow OS control for all 5 features:
+ * PCIeHotplug SHPCHotplug PME AER PCIeCapability.
+ */
+ aml_append(ifctx, aml_and(aml_name("CTRL"), aml_int(0x1F),
+ aml_name("CTRL")));
+
+ ifctx1 = aml_if(aml_lnot(aml_equal(aml_arg(1), aml_int(0x1))));
+ aml_append(ifctx1, aml_or(aml_name("CDW1"), aml_int(0x08),
+ aml_name("CDW1")));
+ aml_append(ifctx, ifctx1);
+
+ ifctx1 = aml_if(aml_lnot(aml_equal(aml_name("CDW3"), aml_name("CTRL"))));
+ aml_append(ifctx1, aml_or(aml_name("CDW1"), aml_int(0x10),
+ aml_name("CDW1")));
+ aml_append(ifctx, ifctx1);
+
+ aml_append(ifctx, aml_store(aml_name("CTRL"), aml_name("CDW3")));
+ aml_append(ifctx, aml_return(aml_arg(3)));
+ aml_append(method, ifctx);
+
+ elsectx = aml_else();
+ aml_append(elsectx, aml_or(aml_name("CDW1"), aml_int(4),
+ aml_name("CDW1")));
+ aml_append(elsectx, aml_return(aml_arg(3)));
+ aml_append(method, elsectx);
+ aml_append(dev, method);
+
+ method = aml_method("_DSM", 4, AML_NOTSERIALIZED);
+
+ /* PCI Firmware Specification 3.0
+ * 4.6.1. _DSM for PCI Express Slot Information
+ * The UUID in _DSM in this context is
+ * {E5C937D0-3553-4D7A-9117-EA4D19C3434D}
+ */
+ UUID = aml_touuid("E5C937D0-3553-4D7A-9117-EA4D19C3434D");
+ ifctx = aml_if(aml_equal(aml_arg(0), UUID));
+ ifctx1 = aml_if(aml_equal(aml_arg(2), aml_int(0)));
+ uint8_t byte_list[1] = {1};
+ buf = aml_buffer(1, byte_list);
+ aml_append(ifctx1, aml_return(buf));
+ aml_append(ifctx, ifctx1);
+ aml_append(method, ifctx);
+
+ byte_list[0] = 0;
+ buf = aml_buffer(1, byte_list);
+ aml_append(method, aml_return(buf));
+ aml_append(dev, method);
+}
+
+void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
+{
+ int nr_pcie_buses = cfg->ecam.size / PCIE_MMCFG_SIZE_MIN;
+ Aml *method, *crs, *dev, *rbuf;
+ PCIBus *bus = cfg->bus;
+ CrsRangeSet crs_range_set;
+ CrsRangeEntry *entry;
+ int i;
+
+ /* start to construct the tables for pxb */
+ crs_range_set_init(&crs_range_set);
+ if (bus) {
+ QLIST_FOREACH(bus, &bus->child, sibling) {
+ uint8_t bus_num = pci_bus_num(bus);
+ uint8_t numa_node = pci_bus_numa_node(bus);
+
+ if (!pci_bus_is_root(bus)) {
+ continue;
+ }
+
+ /*
+ * 0 - (nr_pcie_buses - 1) is the bus range for the main
+ * host-bridge and it equals the MIN of the
+ * busNr defined for pxb-pcie.
+ */
+ if (bus_num < nr_pcie_buses) {
+ nr_pcie_buses = bus_num;
+ }
+
+ dev = aml_device("PC%.02X", bus_num);
+ aml_append(dev, aml_name_decl("_HID", aml_string("PNP0A08")));
+ aml_append(dev, aml_name_decl("_CID", aml_string("PNP0A03")));
+ aml_append(dev, aml_name_decl("_BBN", aml_int(bus_num)));
+ aml_append(dev, aml_name_decl("_UID", aml_int(bus_num)));
+ aml_append(dev, aml_name_decl("_STR", aml_unicode("pxb Device")));
+ aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
+ if (numa_node != NUMA_NODE_UNASSIGNED) {
+ aml_append(dev, aml_name_decl("_PXM", aml_int(numa_node)));
+ }
+
+ acpi_dsdt_add_pci_route_table(dev, cfg->irq);
+
+ /*
+ * Resources defined for PXBs are composed by the folling parts:
+ * 1. The resources the pci-brige/pcie-root-port need.
+ * 2. The resources the devices behind pxb need.
+ */
+ crs = build_crs(PCI_HOST_BRIDGE(BUS(bus)->parent), &crs_range_set,
+ cfg->pio.base, 0, 0, 0);
+ aml_append(dev, aml_name_decl("_CRS", crs));
+
+ acpi_dsdt_add_pci_osc(dev);
+
+ aml_append(scope, dev);
+ }
+ }
+
+ /* tables for the main */
+ dev = aml_device("%s", "PCI0");
+ aml_append(dev, aml_name_decl("_HID", aml_string("PNP0A08")));
+ aml_append(dev, aml_name_decl("_CID", aml_string("PNP0A03")));
+ aml_append(dev, aml_name_decl("_SEG", aml_int(0)));
+ aml_append(dev, aml_name_decl("_BBN", aml_int(0)));
+ aml_append(dev, aml_name_decl("_UID", aml_int(0)));
+ aml_append(dev, aml_name_decl("_STR", aml_unicode("PCIe 0 Device")));
+ aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
+
+ acpi_dsdt_add_pci_route_table(dev, cfg->irq);
+
+ method = aml_method("_CBA", 0, AML_NOTSERIALIZED);
+ aml_append(method, aml_return(aml_int(cfg->ecam.base)));
+ aml_append(dev, method);
+
+ /*
+ * At this point crs_range_set has all the ranges used by pci
+ * busses *other* than PCI0. These ranges will be excluded from
+ * the PCI0._CRS.
+ */
+ rbuf = aml_resource_template();
+ aml_append(rbuf,
+ aml_word_bus_number(AML_MIN_FIXED, AML_MAX_FIXED, AML_POS_DECODE,
+ 0x0000, 0x0000, nr_pcie_buses - 1, 0x0000,
+ nr_pcie_buses));
+ if (cfg->mmio32.size) {
+ crs_replace_with_free_ranges(crs_range_set.mem_ranges,
+ cfg->mmio32.base,
+ cfg->mmio32.base + cfg->mmio32.size - 1);
+ for (i = 0; i < crs_range_set.mem_ranges->len; i++) {
+ entry = g_ptr_array_index(crs_range_set.mem_ranges, i);
+ aml_append(rbuf,
+ aml_dword_memory(AML_POS_DECODE, AML_MIN_FIXED, AML_MAX_FIXED,
+ AML_NON_CACHEABLE, AML_READ_WRITE, 0x0000,
+ entry->base, entry->limit,
+ 0x0000, entry->limit - entry->base + 1));
+ }
+ }
+ if (cfg->pio.size) {
+ crs_replace_with_free_ranges(crs_range_set.io_ranges,
+ 0x0000,
+ cfg->pio.size - 1);
+ for (i = 0; i < crs_range_set.io_ranges->len; i++) {
+ entry = g_ptr_array_index(crs_range_set.io_ranges, i);
+ aml_append(rbuf,
+ aml_dword_io(AML_MIN_FIXED, AML_MAX_FIXED, AML_POS_DECODE,
+ AML_ENTIRE_RANGE, 0x0000, entry->base,
+ entry->limit, cfg->pio.base,
+ entry->limit - entry->base + 1));
+ }
+ }
+ if (cfg->mmio64.size) {
+ crs_replace_with_free_ranges(crs_range_set.mem_64bit_ranges,
+ cfg->mmio64.base,
+ cfg->mmio64.base + cfg->mmio64.size - 1);
+ for (i = 0; i < crs_range_set.mem_64bit_ranges->len; i++) {
+ entry = g_ptr_array_index(crs_range_set.mem_64bit_ranges, i);
+ aml_append(rbuf,
+ aml_qword_memory(AML_POS_DECODE, AML_MIN_FIXED, AML_MAX_FIXED,
+ AML_NON_CACHEABLE, AML_READ_WRITE, 0x0000,
+ entry->base,
+ entry->limit, 0x0000,
+ entry->limit - entry->base + 1));
+ }
+ }
+ aml_append(dev, aml_name_decl("_CRS", rbuf));
+
+ acpi_dsdt_add_pci_osc(dev);
+
+ Aml *dev_res0 = aml_device("%s", "RES0");
+ aml_append(dev_res0, aml_name_decl("_HID", aml_string("PNP0C02")));
+ crs = aml_resource_template();
+ aml_append(crs,
+ aml_qword_memory(AML_POS_DECODE, AML_MIN_FIXED, AML_MAX_FIXED,
+ AML_NON_CACHEABLE, AML_READ_WRITE, 0x0000,
+ cfg->ecam.base,
+ cfg->ecam.base + cfg->ecam.size - 1,
+ 0x0000,
+ cfg->ecam.size));
+ aml_append(dev_res0, aml_name_decl("_CRS", crs));
+ aml_append(dev, dev_res0);
+ aml_append(scope, dev);
+
+ crs_range_set_free(&crs_range_set);
+}
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
new file mode 100644
index 000000000..a6752fac5
--- /dev/null
+++ b/hw/pci-host/gpex.c
@@ -0,0 +1,240 @@
+/*
+ * QEMU Generic PCI Express Bridge Emulation
+ *
+ * Copyright (C) 2015 Alexander Graf <agraf@suse.de>
+ *
+ * Code loosely based on q35.c.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ * Check out these documents for more information on the device:
+ *
+ * http://www.kernel.org/doc/Documentation/devicetree/bindings/pci/host-generic-pci.txt
+ * http://www.firmware.org/1275/practice/imap/imap0_9d.pdf
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/irq.h"
+#include "hw/pci-host/gpex.h"
+#include "hw/qdev-properties.h"
+#include "migration/vmstate.h"
+#include "qemu/module.h"
+
+/****************************************************************************
+ * GPEX host
+ */
+
+static void gpex_set_irq(void *opaque, int irq_num, int level)
+{
+ GPEXHost *s = opaque;
+
+ qemu_set_irq(s->irq[irq_num], level);
+}
+
+int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
+{
+ if (index >= GPEX_NUM_IRQS) {
+ return -EINVAL;
+ }
+
+ s->irq_num[index] = gsi;
+ return 0;
+}
+
+static PCIINTxRoute gpex_route_intx_pin_to_irq(void *opaque, int pin)
+{
+ PCIINTxRoute route;
+ GPEXHost *s = opaque;
+ int gsi = s->irq_num[pin];
+
+ route.irq = gsi;
+ if (gsi < 0) {
+ route.mode = PCI_INTX_DISABLED;
+ } else {
+ route.mode = PCI_INTX_ENABLED;
+ }
+
+ return route;
+}
+
+static void gpex_host_realize(DeviceState *dev, Error **errp)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+ GPEXHost *s = GPEX_HOST(dev);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+ PCIExpressHost *pex = PCIE_HOST_BRIDGE(dev);
+ int i;
+
+ pcie_host_mmcfg_init(pex, PCIE_MMCFG_SIZE_MAX);
+ sysbus_init_mmio(sbd, &pex->mmio);
+
+ /*
+ * Note that the MemoryRegions io_mmio and io_ioport that we pass
+ * to pci_register_root_bus() are not the same as the
+ * MemoryRegions io_mmio_window and io_ioport_window that we
+ * expose as SysBus MRs. The difference is in the behaviour of
+ * accesses to addresses where no PCI device has been mapped.
+ *
+ * io_mmio and io_ioport are the underlying PCI view of the PCI
+ * address space, and when a PCI device does a bus master access
+ * to a bad address this is reported back to it as a transaction
+ * failure.
+ *
+ * io_mmio_window and io_ioport_window implement "unmapped
+ * addresses read as -1 and ignore writes"; this is traditional
+ * x86 PC behaviour, which is not mandated by the PCI spec proper
+ * but expected by much PCI-using guest software, including Linux.
+ *
+ * In the interests of not being unnecessarily surprising, we
+ * implement it in the gpex PCI host controller, by providing the
+ * _window MRs, which are containers with io ops that implement
+ * the 'background' behaviour and which hold the real PCI MRs as
+ * subregions.
+ */
+ memory_region_init(&s->io_mmio, OBJECT(s), "gpex_mmio", UINT64_MAX);
+ memory_region_init(&s->io_ioport, OBJECT(s), "gpex_ioport", 64 * 1024);
+
+ if (s->allow_unmapped_accesses) {
+ memory_region_init_io(&s->io_mmio_window, OBJECT(s),
+ &unassigned_io_ops, OBJECT(s),
+ "gpex_mmio_window", UINT64_MAX);
+ memory_region_init_io(&s->io_ioport_window, OBJECT(s),
+ &unassigned_io_ops, OBJECT(s),
+ "gpex_ioport_window", 64 * 1024);
+
+ memory_region_add_subregion(&s->io_mmio_window, 0, &s->io_mmio);
+ memory_region_add_subregion(&s->io_ioport_window, 0, &s->io_ioport);
+ sysbus_init_mmio(sbd, &s->io_mmio_window);
+ sysbus_init_mmio(sbd, &s->io_ioport_window);
+ } else {
+ sysbus_init_mmio(sbd, &s->io_mmio);
+ sysbus_init_mmio(sbd, &s->io_ioport);
+ }
+
+ for (i = 0; i < GPEX_NUM_IRQS; i++) {
+ sysbus_init_irq(sbd, &s->irq[i]);
+ s->irq_num[i] = -1;
+ }
+
+ pci->bus = pci_register_root_bus(dev, "pcie.0", gpex_set_irq,
+ pci_swizzle_map_irq_fn, s, &s->io_mmio,
+ &s->io_ioport, 0, 4, TYPE_PCIE_BUS);
+
+ pci_bus_set_route_irq_fn(pci->bus, gpex_route_intx_pin_to_irq);
+ qdev_realize(DEVICE(&s->gpex_root), BUS(pci->bus), &error_fatal);
+}
+
+static const char *gpex_host_root_bus_path(PCIHostState *host_bridge,
+ PCIBus *rootbus)
+{
+ return "0000:00";
+}
+
+static Property gpex_host_properties[] = {
+ /*
+ * Permit CPU accesses to unmapped areas of the PIO and MMIO windows
+ * (discarding writes and returning -1 for reads) rather than aborting.
+ */
+ DEFINE_PROP_BOOL("allow-unmapped-accesses", GPEXHost,
+ allow_unmapped_accesses, true),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void gpex_host_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
+
+ hc->root_bus_path = gpex_host_root_bus_path;
+ dc->realize = gpex_host_realize;
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->fw_name = "pci";
+ device_class_set_props(dc, gpex_host_properties);
+}
+
+static void gpex_host_initfn(Object *obj)
+{
+ GPEXHost *s = GPEX_HOST(obj);
+ GPEXRootState *root = &s->gpex_root;
+
+ object_initialize_child(obj, "gpex_root", root, TYPE_GPEX_ROOT_DEVICE);
+ qdev_prop_set_int32(DEVICE(root), "addr", PCI_DEVFN(0, 0));
+ qdev_prop_set_bit(DEVICE(root), "multifunction", false);
+}
+
+static const TypeInfo gpex_host_info = {
+ .name = TYPE_GPEX_HOST,
+ .parent = TYPE_PCIE_HOST_BRIDGE,
+ .instance_size = sizeof(GPEXHost),
+ .instance_init = gpex_host_initfn,
+ .class_init = gpex_host_class_init,
+};
+
+/****************************************************************************
+ * GPEX Root D0:F0
+ */
+
+static const VMStateDescription vmstate_gpex_root = {
+ .name = "gpex_root",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .fields = (VMStateField[]) {
+ VMSTATE_PCI_DEVICE(parent_obj, GPEXRootState),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static void gpex_root_class_init(ObjectClass *klass, void *data)
+{
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->desc = "QEMU generic PCIe host bridge";
+ dc->vmsd = &vmstate_gpex_root;
+ k->vendor_id = PCI_VENDOR_ID_REDHAT;
+ k->device_id = PCI_DEVICE_ID_REDHAT_PCIE_HOST;
+ k->revision = 0;
+ k->class_id = PCI_CLASS_BRIDGE_HOST;
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo gpex_root_info = {
+ .name = TYPE_GPEX_ROOT_DEVICE,
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(GPEXRootState),
+ .class_init = gpex_root_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+static void gpex_register(void)
+{
+ type_register_static(&gpex_root_info);
+ type_register_static(&gpex_host_info);
+}
+
+type_init(gpex_register)
diff --git a/hw/pci-host/grackle.c b/hw/pci-host/grackle.c
new file mode 100644
index 000000000..b05facf46
--- /dev/null
+++ b/hw/pci-host/grackle.c
@@ -0,0 +1,176 @@
+/*
+ * QEMU Grackle PCI host (heathrow OldWorld PowerMac)
+ *
+ * Copyright (c) 2006-2007 Fabrice Bellard
+ * Copyright (c) 2007 Jocelyn Mayer
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/pci/pci_host.h"
+#include "hw/ppc/mac.h"
+#include "hw/qdev-properties.h"
+#include "hw/pci/pci.h"
+#include "hw/irq.h"
+#include "qapi/error.h"
+#include "qemu/module.h"
+#include "trace.h"
+#include "qom/object.h"
+
+OBJECT_DECLARE_SIMPLE_TYPE(GrackleState, GRACKLE_PCI_HOST_BRIDGE)
+
+struct GrackleState {
+ PCIHostState parent_obj;
+
+ uint32_t ofw_addr;
+ qemu_irq irqs[4];
+ MemoryRegion pci_mmio;
+ MemoryRegion pci_hole;
+ MemoryRegion pci_io;
+};
+
+/* Don't know if this matches real hardware, but it agrees with OHW. */
+static int pci_grackle_map_irq(PCIDevice *pci_dev, int irq_num)
+{
+ return (irq_num + (pci_dev->devfn >> 3)) & 3;
+}
+
+static void pci_grackle_set_irq(void *opaque, int irq_num, int level)
+{
+ GrackleState *s = opaque;
+
+ trace_grackle_set_irq(irq_num, level);
+ qemu_set_irq(s->irqs[irq_num], level);
+}
+
+static void grackle_realize(DeviceState *dev, Error **errp)
+{
+ GrackleState *s = GRACKLE_PCI_HOST_BRIDGE(dev);
+ PCIHostState *phb = PCI_HOST_BRIDGE(dev);
+
+ phb->bus = pci_register_root_bus(dev, NULL,
+ pci_grackle_set_irq,
+ pci_grackle_map_irq,
+ s,
+ &s->pci_mmio,
+ &s->pci_io,
+ 0, 4, TYPE_PCI_BUS);
+
+ pci_create_simple(phb->bus, 0, "grackle");
+}
+
+static void grackle_init(Object *obj)
+{
+ GrackleState *s = GRACKLE_PCI_HOST_BRIDGE(obj);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+ PCIHostState *phb = PCI_HOST_BRIDGE(obj);
+
+ memory_region_init(&s->pci_mmio, OBJECT(s), "pci-mmio", 0x100000000ULL);
+ memory_region_init_io(&s->pci_io, OBJECT(s), &unassigned_io_ops, obj,
+ "pci-isa-mmio", 0x00200000);
+
+ memory_region_init_alias(&s->pci_hole, OBJECT(s), "pci-hole", &s->pci_mmio,
+ 0x80000000ULL, 0x7e000000ULL);
+
+ memory_region_init_io(&phb->conf_mem, obj, &pci_host_conf_le_ops,
+ DEVICE(obj), "pci-conf-idx", 0x1000);
+ memory_region_init_io(&phb->data_mem, obj, &pci_host_data_le_ops,
+ DEVICE(obj), "pci-data-idx", 0x1000);
+
+ sysbus_init_mmio(sbd, &phb->conf_mem);
+ sysbus_init_mmio(sbd, &phb->data_mem);
+ sysbus_init_mmio(sbd, &s->pci_hole);
+ sysbus_init_mmio(sbd, &s->pci_io);
+
+ qdev_init_gpio_out(DEVICE(obj), s->irqs, ARRAY_SIZE(s->irqs));
+}
+
+static void grackle_pci_realize(PCIDevice *d, Error **errp)
+{
+ d->config[0x09] = 0x01;
+}
+
+static void grackle_pci_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+ k->realize = grackle_pci_realize;
+ k->vendor_id = PCI_VENDOR_ID_MOTOROLA;
+ k->device_id = PCI_DEVICE_ID_MOTOROLA_MPC106;
+ k->revision = 0x00;
+ k->class_id = PCI_CLASS_BRIDGE_HOST;
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo grackle_pci_info = {
+ .name = "grackle",
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(PCIDevice),
+ .class_init = grackle_pci_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+static char *grackle_ofw_unit_address(const SysBusDevice *dev)
+{
+ GrackleState *s = GRACKLE_PCI_HOST_BRIDGE(dev);
+
+ return g_strdup_printf("%x", s->ofw_addr);
+}
+
+static Property grackle_properties[] = {
+ DEFINE_PROP_UINT32("ofw-addr", GrackleState, ofw_addr, -1),
+ DEFINE_PROP_END_OF_LIST()
+};
+
+static void grackle_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ SysBusDeviceClass *sbc = SYS_BUS_DEVICE_CLASS(klass);
+
+ dc->realize = grackle_realize;
+ device_class_set_props(dc, grackle_properties);
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->fw_name = "pci";
+ sbc->explicit_ofw_unit_address = grackle_ofw_unit_address;
+}
+
+static const TypeInfo grackle_host_info = {
+ .name = TYPE_GRACKLE_PCI_HOST_BRIDGE,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(GrackleState),
+ .instance_init = grackle_init,
+ .class_init = grackle_class_init,
+};
+
+static void grackle_register_types(void)
+{
+ type_register_static(&grackle_pci_info);
+ type_register_static(&grackle_host_info);
+}
+
+type_init(grackle_register_types)
diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
new file mode 100644
index 000000000..e08716142
--- /dev/null
+++ b/hw/pci-host/i440fx.c
@@ -0,0 +1,412 @@
+/*
+ * QEMU i440FX PCI Bridge Emulation
+ *
+ * Copyright (c) 2006 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "qemu/range.h"
+#include "hw/i386/pc.h"
+#include "hw/pci/pci.h"
+#include "hw/pci/pci_host.h"
+#include "hw/pci-host/i440fx.h"
+#include "hw/qdev-properties.h"
+#include "hw/sysbus.h"
+#include "qapi/error.h"
+#include "migration/vmstate.h"
+#include "qapi/visitor.h"
+#include "qemu/error-report.h"
+#include "qom/object.h"
+
+/*
+ * I440FX chipset data sheet.
+ * https://wiki.qemu.org/File:29054901.pdf
+ */
+
+OBJECT_DECLARE_SIMPLE_TYPE(I440FXState, I440FX_PCI_HOST_BRIDGE)
+
+struct I440FXState {
+ PCIHostState parent_obj;
+ Range pci_hole;
+ uint64_t pci_hole64_size;
+ bool pci_hole64_fix;
+ uint32_t short_root_bus;
+};
+
+#define I440FX_PAM 0x59
+#define I440FX_PAM_SIZE 7
+#define I440FX_SMRAM 0x72
+
+/* Keep it 2G to comply with older win32 guests */
+#define I440FX_PCI_HOST_HOLE64_SIZE_DEFAULT (1ULL << 31)
+
+/* Older coreboot versions (4.0 and older) read a config register that doesn't
+ * exist in real hardware, to get the RAM size from QEMU.
+ */
+#define I440FX_COREBOOT_RAM_SIZE 0x57
+
+static void i440fx_update_memory_mappings(PCII440FXState *d)
+{
+ int i;
+ PCIDevice *pd = PCI_DEVICE(d);
+
+ memory_region_transaction_begin();
+ for (i = 0; i < ARRAY_SIZE(d->pam_regions); i++) {
+ pam_update(&d->pam_regions[i], i,
+ pd->config[I440FX_PAM + DIV_ROUND_UP(i, 2)]);
+ }
+ memory_region_set_enabled(&d->smram_region,
+ !(pd->config[I440FX_SMRAM] & SMRAM_D_OPEN));
+ memory_region_set_enabled(&d->smram,
+ pd->config[I440FX_SMRAM] & SMRAM_G_SMRAME);
+ memory_region_transaction_commit();
+}
+
+
+static void i440fx_write_config(PCIDevice *dev,
+ uint32_t address, uint32_t val, int len)
+{
+ PCII440FXState *d = I440FX_PCI_DEVICE(dev);
+
+ /* XXX: implement SMRAM.D_LOCK */
+ pci_default_write_config(dev, address, val, len);
+ if (ranges_overlap(address, len, I440FX_PAM, I440FX_PAM_SIZE) ||
+ range_covers_byte(address, len, I440FX_SMRAM)) {
+ i440fx_update_memory_mappings(d);
+ }
+}
+
+static int i440fx_post_load(void *opaque, int version_id)
+{
+ PCII440FXState *d = opaque;
+
+ i440fx_update_memory_mappings(d);
+ return 0;
+}
+
+static const VMStateDescription vmstate_i440fx = {
+ .name = "I440FX",
+ .version_id = 3,
+ .minimum_version_id = 3,
+ .post_load = i440fx_post_load,
+ .fields = (VMStateField[]) {
+ VMSTATE_PCI_DEVICE(parent_obj, PCII440FXState),
+ /* Used to be smm_enabled, which was basically always zero because
+ * SeaBIOS hardly uses SMM. SMRAM is now handled by CPU code.
+ */
+ VMSTATE_UNUSED(1),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static void i440fx_pcihost_get_pci_hole_start(Object *obj, Visitor *v,
+ const char *name, void *opaque,
+ Error **errp)
+{
+ I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+ uint64_t val64;
+ uint32_t value;
+
+ val64 = range_is_empty(&s->pci_hole) ? 0 : range_lob(&s->pci_hole);
+ value = val64;
+ assert(value == val64);
+ visit_type_uint32(v, name, &value, errp);
+}
+
+static void i440fx_pcihost_get_pci_hole_end(Object *obj, Visitor *v,
+ const char *name, void *opaque,
+ Error **errp)
+{
+ I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+ uint64_t val64;
+ uint32_t value;
+
+ val64 = range_is_empty(&s->pci_hole) ? 0 : range_upb(&s->pci_hole) + 1;
+ value = val64;
+ assert(value == val64);
+ visit_type_uint32(v, name, &value, errp);
+}
+
+/*
+ * The 64bit PCI hole start is set by the Guest firmware
+ * as the address of the first 64bit PCI MEM resource.
+ * If no PCI device has resources on the 64bit area,
+ * the 64bit PCI hole will start after "over 4G RAM" and the
+ * reserved space for memory hotplug if any.
+ */
+static uint64_t i440fx_pcihost_get_pci_hole64_start_value(Object *obj)
+{
+ PCIHostState *h = PCI_HOST_BRIDGE(obj);
+ I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+ Range w64;
+ uint64_t value;
+
+ pci_bus_get_w64_range(h->bus, &w64);
+ value = range_is_empty(&w64) ? 0 : range_lob(&w64);
+ if (!value && s->pci_hole64_fix) {
+ value = pc_pci_hole64_start();
+ }
+ return value;
+}
+
+static void i440fx_pcihost_get_pci_hole64_start(Object *obj, Visitor *v,
+ const char *name,
+ void *opaque, Error **errp)
+{
+ uint64_t hole64_start = i440fx_pcihost_get_pci_hole64_start_value(obj);
+
+ visit_type_uint64(v, name, &hole64_start, errp);
+}
+
+/*
+ * The 64bit PCI hole end is set by the Guest firmware
+ * as the address of the last 64bit PCI MEM resource.
+ * Then it is expanded to the PCI_HOST_PROP_PCI_HOLE64_SIZE
+ * that can be configured by the user.
+ */
+static void i440fx_pcihost_get_pci_hole64_end(Object *obj, Visitor *v,
+ const char *name, void *opaque,
+ Error **errp)
+{
+ PCIHostState *h = PCI_HOST_BRIDGE(obj);
+ I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+ uint64_t hole64_start = i440fx_pcihost_get_pci_hole64_start_value(obj);
+ Range w64;
+ uint64_t value, hole64_end;
+
+ pci_bus_get_w64_range(h->bus, &w64);
+ value = range_is_empty(&w64) ? 0 : range_upb(&w64) + 1;
+ hole64_end = ROUND_UP(hole64_start + s->pci_hole64_size, 1ULL << 30);
+ if (s->pci_hole64_fix && value < hole64_end) {
+ value = hole64_end;
+ }
+ visit_type_uint64(v, name, &value, errp);
+}
+
+static void i440fx_pcihost_initfn(Object *obj)
+{
+ PCIHostState *s = PCI_HOST_BRIDGE(obj);
+
+ memory_region_init_io(&s->conf_mem, obj, &pci_host_conf_le_ops, s,
+ "pci-conf-idx", 4);
+ memory_region_init_io(&s->data_mem, obj, &pci_host_data_le_ops, s,
+ "pci-conf-data", 4);
+}
+
+static void i440fx_pcihost_realize(DeviceState *dev, Error **errp)
+{
+ PCIHostState *s = PCI_HOST_BRIDGE(dev);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+
+ sysbus_add_io(sbd, 0xcf8, &s->conf_mem);
+ sysbus_init_ioports(sbd, 0xcf8, 4);
+
+ sysbus_add_io(sbd, 0xcfc, &s->data_mem);
+ sysbus_init_ioports(sbd, 0xcfc, 4);
+
+ /* register i440fx 0xcf8 port as coalesced pio */
+ memory_region_set_flush_coalesced(&s->data_mem);
+ memory_region_add_coalescing(&s->conf_mem, 0, 4);
+}
+
+static void i440fx_realize(PCIDevice *dev, Error **errp)
+{
+ dev->config[I440FX_SMRAM] = 0x02;
+
+ if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
+ warn_report("i440fx doesn't support emulated iommu");
+ }
+}
+
+PCIBus *i440fx_init(const char *host_type, const char *pci_type,
+ PCII440FXState **pi440fx_state,
+ MemoryRegion *address_space_mem,
+ MemoryRegion *address_space_io,
+ ram_addr_t ram_size,
+ ram_addr_t below_4g_mem_size,
+ ram_addr_t above_4g_mem_size,
+ MemoryRegion *pci_address_space,
+ MemoryRegion *ram_memory)
+{
+ DeviceState *dev;
+ PCIBus *b;
+ PCIDevice *d;
+ PCIHostState *s;
+ PCII440FXState *f;
+ unsigned i;
+ I440FXState *i440fx;
+
+ dev = qdev_new(host_type);
+ s = PCI_HOST_BRIDGE(dev);
+ b = pci_root_bus_new(dev, NULL, pci_address_space,
+ address_space_io, 0, TYPE_PCI_BUS);
+ s->bus = b;
+ object_property_add_child(qdev_get_machine(), "i440fx", OBJECT(dev));
+ sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+
+ d = pci_create_simple(b, 0, pci_type);
+ *pi440fx_state = I440FX_PCI_DEVICE(d);
+ f = *pi440fx_state;
+ f->system_memory = address_space_mem;
+ f->pci_address_space = pci_address_space;
+ f->ram_memory = ram_memory;
+
+ i440fx = I440FX_PCI_HOST_BRIDGE(dev);
+ range_set_bounds(&i440fx->pci_hole, below_4g_mem_size,
+ IO_APIC_DEFAULT_ADDRESS - 1);
+
+ /* setup pci memory mapping */
+ pc_pci_as_mapping_init(OBJECT(f), f->system_memory,
+ f->pci_address_space);
+
+ /* if *disabled* show SMRAM to all CPUs */
+ memory_region_init_alias(&f->smram_region, OBJECT(d), "smram-region",
+ f->pci_address_space, 0xa0000, 0x20000);
+ memory_region_add_subregion_overlap(f->system_memory, 0xa0000,
+ &f->smram_region, 1);
+ memory_region_set_enabled(&f->smram_region, true);
+
+ /* smram, as seen by SMM CPUs */
+ memory_region_init(&f->smram, OBJECT(d), "smram", 4 * GiB);
+ memory_region_set_enabled(&f->smram, true);
+ memory_region_init_alias(&f->low_smram, OBJECT(d), "smram-low",
+ f->ram_memory, 0xa0000, 0x20000);
+ memory_region_set_enabled(&f->low_smram, true);
+ memory_region_add_subregion(&f->smram, 0xa0000, &f->low_smram);
+ object_property_add_const_link(qdev_get_machine(), "smram",
+ OBJECT(&f->smram));
+
+ init_pam(dev, f->ram_memory, f->system_memory, f->pci_address_space,
+ &f->pam_regions[0], PAM_BIOS_BASE, PAM_BIOS_SIZE);
+ for (i = 0; i < ARRAY_SIZE(f->pam_regions) - 1; ++i) {
+ init_pam(dev, f->ram_memory, f->system_memory, f->pci_address_space,
+ &f->pam_regions[i+1], PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE,
+ PAM_EXPAN_SIZE);
+ }
+
+ ram_size = ram_size / 8 / 1024 / 1024;
+ if (ram_size > 255) {
+ ram_size = 255;
+ }
+ d->config[I440FX_COREBOOT_RAM_SIZE] = ram_size;
+
+ i440fx_update_memory_mappings(f);
+
+ return b;
+}
+
+static void i440fx_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+ k->realize = i440fx_realize;
+ k->config_write = i440fx_write_config;
+ k->vendor_id = PCI_VENDOR_ID_INTEL;
+ k->device_id = PCI_DEVICE_ID_INTEL_82441;
+ k->revision = 0x02;
+ k->class_id = PCI_CLASS_BRIDGE_HOST;
+ dc->desc = "Host bridge";
+ dc->vmsd = &vmstate_i440fx;
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+ dc->hotpluggable = false;
+}
+
+static const TypeInfo i440fx_info = {
+ .name = TYPE_I440FX_PCI_DEVICE,
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(PCII440FXState),
+ .class_init = i440fx_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+static const char *i440fx_pcihost_root_bus_path(PCIHostState *host_bridge,
+ PCIBus *rootbus)
+{
+ I440FXState *s = I440FX_PCI_HOST_BRIDGE(host_bridge);
+
+ /* For backwards compat with old device paths */
+ if (s->short_root_bus) {
+ return "0000";
+ }
+ return "0000:00";
+}
+
+static Property i440fx_props[] = {
+ DEFINE_PROP_SIZE(PCI_HOST_PROP_PCI_HOLE64_SIZE, I440FXState,
+ pci_hole64_size, I440FX_PCI_HOST_HOLE64_SIZE_DEFAULT),
+ DEFINE_PROP_UINT32("short_root_bus", I440FXState, short_root_bus, 0),
+ DEFINE_PROP_BOOL("x-pci-hole64-fix", I440FXState, pci_hole64_fix, true),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void i440fx_pcihost_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
+
+ hc->root_bus_path = i440fx_pcihost_root_bus_path;
+ dc->realize = i440fx_pcihost_realize;
+ dc->fw_name = "pci";
+ device_class_set_props(dc, i440fx_props);
+ /* Reason: needs to be wired up by pc_init1 */
+ dc->user_creatable = false;
+
+ object_class_property_add(klass, PCI_HOST_PROP_PCI_HOLE_START, "uint32",
+ i440fx_pcihost_get_pci_hole_start,
+ NULL, NULL, NULL);
+
+ object_class_property_add(klass, PCI_HOST_PROP_PCI_HOLE_END, "uint32",
+ i440fx_pcihost_get_pci_hole_end,
+ NULL, NULL, NULL);
+
+ object_class_property_add(klass, PCI_HOST_PROP_PCI_HOLE64_START, "uint64",
+ i440fx_pcihost_get_pci_hole64_start,
+ NULL, NULL, NULL);
+
+ object_class_property_add(klass, PCI_HOST_PROP_PCI_HOLE64_END, "uint64",
+ i440fx_pcihost_get_pci_hole64_end,
+ NULL, NULL, NULL);
+}
+
+static const TypeInfo i440fx_pcihost_info = {
+ .name = TYPE_I440FX_PCI_HOST_BRIDGE,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(I440FXState),
+ .instance_init = i440fx_pcihost_initfn,
+ .class_init = i440fx_pcihost_class_init,
+};
+
+static void i440fx_register_types(void)
+{
+ type_register_static(&i440fx_info);
+ type_register_static(&i440fx_pcihost_info);
+}
+
+type_init(i440fx_register_types)
diff --git a/hw/pci-host/meson.build b/hw/pci-host/meson.build
new file mode 100644
index 000000000..4c4f39c15
--- /dev/null
+++ b/hw/pci-host/meson.build
@@ -0,0 +1,36 @@
+pci_ss = ss.source_set()
+pci_ss.add(when: 'CONFIG_PAM', if_true: files('pam.c'))
+pci_ss.add(when: 'CONFIG_PCI_BONITO', if_true: files('bonito.c'))
+pci_ss.add(when: 'CONFIG_PCI_EXPRESS_DESIGNWARE', if_true: files('designware.c'))
+pci_ss.add(when: 'CONFIG_PCI_EXPRESS_GENERIC_BRIDGE', if_true: files('gpex.c'))
+pci_ss.add(when: ['CONFIG_PCI_EXPRESS_GENERIC_BRIDGE', 'CONFIG_ACPI'], if_true: files('gpex-acpi.c'))
+pci_ss.add(when: 'CONFIG_PCI_EXPRESS_Q35', if_true: files('q35.c'))
+pci_ss.add(when: 'CONFIG_PCI_EXPRESS_XILINX', if_true: files('xilinx-pcie.c'))
+pci_ss.add(when: 'CONFIG_PCI_I440FX', if_true: files('i440fx.c'))
+pci_ss.add(when: 'CONFIG_PCI_SABRE', if_true: files('sabre.c'))
+pci_ss.add(when: 'CONFIG_XEN_IGD_PASSTHROUGH', if_true: files('xen_igd_pt.c'))
+pci_ss.add(when: 'CONFIG_REMOTE_PCIHOST', if_true: files('remote.c'))
+pci_ss.add(when: 'CONFIG_SH_PCI', if_true: files('sh_pci.c'))
+
+# PPC devices
+pci_ss.add(when: 'CONFIG_RAVEN_PCI', if_true: files('raven.c'))
+pci_ss.add(when: 'CONFIG_GRACKLE_PCI', if_true: files('grackle.c'))
+# NewWorld PowerMac
+pci_ss.add(when: 'CONFIG_UNIN_PCI', if_true: files('uninorth.c'))
+# PowerPC E500 boards
+pci_ss.add(when: 'CONFIG_PPCE500_PCI', if_true: files('ppce500.c'))
+# Pegasos2
+pci_ss.add(when: 'CONFIG_MV64361', if_true: files('mv64361.c'))
+
+# ARM devices
+pci_ss.add(when: 'CONFIG_VERSATILE_PCI', if_true: files('versatile.c'))
+
+softmmu_ss.add_all(when: 'CONFIG_PCI', if_true: pci_ss)
+
+specific_ss.add(when: 'CONFIG_PCI_POWERNV', if_true: files(
+ 'pnv_phb3.c',
+ 'pnv_phb3_msi.c',
+ 'pnv_phb3_pbcq.c',
+ 'pnv_phb4.c',
+ 'pnv_phb4_pec.c'
+))
diff --git a/hw/pci-host/mv64361.c b/hw/pci-host/mv64361.c
new file mode 100644
index 000000000..00b3ff7d9
--- /dev/null
+++ b/hw/pci-host/mv64361.c
@@ -0,0 +1,951 @@
+/*
+ * Marvell Discovery II MV64361 System Controller for
+ * QEMU PowerPC CHRP (Genesi/bPlan Pegasos II) hardware System Emulator
+ *
+ * Copyright (c) 2018-2020 BALATON Zoltan
+ *
+ * This work is licensed under the GNU GPL license version 2 or later.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "qemu/units.h"
+#include "qapi/error.h"
+#include "hw/hw.h"
+#include "hw/sysbus.h"
+#include "hw/pci/pci.h"
+#include "hw/pci/pci_host.h"
+#include "hw/irq.h"
+#include "hw/intc/i8259.h"
+#include "hw/qdev-properties.h"
+#include "exec/address-spaces.h"
+#include "qemu/log.h"
+#include "qemu/error-report.h"
+#include "trace.h"
+#include "hw/pci-host/mv64361.h"
+#include "mv643xx.h"
+
+#define TYPE_MV64361_PCI_BRIDGE "mv64361-pcibridge"
+
+static void mv64361_pcibridge_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+ k->vendor_id = PCI_VENDOR_ID_MARVELL;
+ k->device_id = PCI_DEVICE_ID_MARVELL_MV6436X;
+ k->class_id = PCI_CLASS_BRIDGE_HOST;
+ /*
+ * PCI-facing part of the host bridge,
+ * not usable without the host-facing part
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo mv64361_pcibridge_info = {
+ .name = TYPE_MV64361_PCI_BRIDGE,
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(PCIDevice),
+ .class_init = mv64361_pcibridge_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+
+#define TYPE_MV64361_PCI "mv64361-pcihost"
+OBJECT_DECLARE_SIMPLE_TYPE(MV64361PCIState, MV64361_PCI)
+
+struct MV64361PCIState {
+ PCIHostState parent_obj;
+
+ uint8_t index;
+ MemoryRegion io;
+ MemoryRegion mem;
+ qemu_irq irq[PCI_NUM_PINS];
+
+ uint32_t io_base;
+ uint32_t io_size;
+ uint32_t mem_base[4];
+ uint32_t mem_size[4];
+ uint64_t remap[5];
+};
+
+static int mv64361_pcihost_map_irq(PCIDevice *pci_dev, int n)
+{
+ return (n + PCI_SLOT(pci_dev->devfn)) % PCI_NUM_PINS;
+}
+
+static void mv64361_pcihost_set_irq(void *opaque, int n, int level)
+{
+ MV64361PCIState *s = opaque;
+ qemu_set_irq(s->irq[n], level);
+}
+
+static void mv64361_pcihost_realize(DeviceState *dev, Error **errp)
+{
+ MV64361PCIState *s = MV64361_PCI(dev);
+ PCIHostState *h = PCI_HOST_BRIDGE(dev);
+ char *name;
+
+ name = g_strdup_printf("pci%d-io", s->index);
+ memory_region_init(&s->io, OBJECT(dev), name, 0x10000);
+ g_free(name);
+ name = g_strdup_printf("pci%d-mem", s->index);
+ memory_region_init(&s->mem, OBJECT(dev), name, 1ULL << 32);
+ g_free(name);
+ name = g_strdup_printf("pci.%d", s->index);
+ h->bus = pci_register_root_bus(dev, name, mv64361_pcihost_set_irq,
+ mv64361_pcihost_map_irq, dev,
+ &s->mem, &s->io, 0, 4, TYPE_PCI_BUS);
+ g_free(name);
+ pci_create_simple(h->bus, 0, TYPE_MV64361_PCI_BRIDGE);
+}
+
+static Property mv64361_pcihost_props[] = {
+ DEFINE_PROP_UINT8("index", MV64361PCIState, index, 0),
+ DEFINE_PROP_END_OF_LIST()
+};
+
+static void mv64361_pcihost_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ dc->realize = mv64361_pcihost_realize;
+ device_class_set_props(dc, mv64361_pcihost_props);
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+}
+
+static const TypeInfo mv64361_pcihost_info = {
+ .name = TYPE_MV64361_PCI,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(MV64361PCIState),
+ .class_init = mv64361_pcihost_class_init,
+};
+
+static void mv64361_pci_register_types(void)
+{
+ type_register_static(&mv64361_pcihost_info);
+ type_register_static(&mv64361_pcibridge_info);
+}
+
+type_init(mv64361_pci_register_types)
+
+
+OBJECT_DECLARE_SIMPLE_TYPE(MV64361State, MV64361)
+
+struct MV64361State {
+ SysBusDevice parent_obj;
+
+ MemoryRegion regs;
+ MV64361PCIState pci[2];
+ MemoryRegion cpu_win[19];
+ qemu_irq cpu_irq;
+
+ /* registers state */
+ uint32_t cpu_conf;
+ uint32_t regs_base;
+ uint32_t base_addr_enable;
+ uint64_t main_int_cr;
+ uint64_t cpu0_int_mask;
+ uint32_t gpp_io;
+ uint32_t gpp_level;
+ uint32_t gpp_value;
+ uint32_t gpp_int_cr;
+ uint32_t gpp_int_mask;
+ bool gpp_int_level;
+};
+
+enum mv64361_irq_cause {
+ MV64361_IRQ_DEVERR = 1,
+ MV64361_IRQ_DMAERR = 2,
+ MV64361_IRQ_CPUERR = 3,
+ MV64361_IRQ_IDMA0 = 4,
+ MV64361_IRQ_IDMA1 = 5,
+ MV64361_IRQ_IDMA2 = 6,
+ MV64361_IRQ_IDMA3 = 7,
+ MV64361_IRQ_TIMER0 = 8,
+ MV64361_IRQ_TIMER1 = 9,
+ MV64361_IRQ_TIMER2 = 10,
+ MV64361_IRQ_TIMER3 = 11,
+ MV64361_IRQ_PCI0 = 12,
+ MV64361_IRQ_SRAMERR = 13,
+ MV64361_IRQ_GBEERR = 14,
+ MV64361_IRQ_CERR = 15,
+ MV64361_IRQ_PCI1 = 16,
+ MV64361_IRQ_DRAMERR = 17,
+ MV64361_IRQ_WDNMI = 18,
+ MV64361_IRQ_WDE = 19,
+ MV64361_IRQ_PCI0IN = 20,
+ MV64361_IRQ_PCI0OUT = 21,
+ MV64361_IRQ_PCI1IN = 22,
+ MV64361_IRQ_PCI1OUT = 23,
+ MV64361_IRQ_P1_GPP0_7 = 24,
+ MV64361_IRQ_P1_GPP8_15 = 25,
+ MV64361_IRQ_P1_GPP16_23 = 26,
+ MV64361_IRQ_P1_GPP24_31 = 27,
+ MV64361_IRQ_P1_CPU_DB = 28,
+ /* 29-31: reserved */
+ MV64361_IRQ_GBE0 = 32,
+ MV64361_IRQ_GBE1 = 33,
+ MV64361_IRQ_GBE2 = 34,
+ /* 35: reserved */
+ MV64361_IRQ_SDMA0 = 36,
+ MV64361_IRQ_TWSI = 37,
+ MV64361_IRQ_SDMA1 = 38,
+ MV64361_IRQ_BRG = 39,
+ MV64361_IRQ_MPSC0 = 40,
+ MV64361_IRQ_MPSC1 = 41,
+ MV64361_IRQ_G0RX = 42,
+ MV64361_IRQ_G0TX = 43,
+ MV64361_IRQ_G0MISC = 44,
+ MV64361_IRQ_G1RX = 45,
+ MV64361_IRQ_G1TX = 46,
+ MV64361_IRQ_G1MISC = 47,
+ MV64361_IRQ_G2RX = 48,
+ MV64361_IRQ_G2TX = 49,
+ MV64361_IRQ_G2MISC = 50,
+ /* 51-55: reserved */
+ MV64361_IRQ_P0_GPP0_7 = 56,
+ MV64361_IRQ_P0_GPP8_15 = 57,
+ MV64361_IRQ_P0_GPP16_23 = 58,
+ MV64361_IRQ_P0_GPP24_31 = 59,
+ MV64361_IRQ_P0_CPU_DB = 60,
+ /* 61-63: reserved */
+};
+
+PCIBus *mv64361_get_pci_bus(DeviceState *dev, int n)
+{
+ MV64361State *mv = MV64361(dev);
+ return PCI_HOST_BRIDGE(&mv->pci[n])->bus;
+}
+
+static void unmap_region(MemoryRegion *mr)
+{
+ if (memory_region_is_mapped(mr)) {
+ memory_region_del_subregion(get_system_memory(), mr);
+ object_unparent(OBJECT(mr));
+ }
+}
+
+static void map_pci_region(MemoryRegion *mr, MemoryRegion *parent,
+ struct Object *owner, const char *name,
+ hwaddr poffs, uint64_t size, hwaddr moffs)
+{
+ memory_region_init_alias(mr, owner, name, parent, poffs, size);
+ memory_region_add_subregion(get_system_memory(), moffs, mr);
+ trace_mv64361_region_map(name, poffs, size, moffs);
+}
+
+static void set_mem_windows(MV64361State *s, uint32_t val)
+{
+ MV64361PCIState *p;
+ MemoryRegion *mr;
+ uint32_t mask;
+ int i;
+
+ val &= 0x1fffff;
+ for (mask = 1, i = 0; i < 21; i++, mask <<= 1) {
+ if ((val & mask) != (s->base_addr_enable & mask)) {
+ trace_mv64361_region_enable(!(val & mask) ? "enable" : "disable", i);
+ /*
+ * 0-3 are SDRAM chip selects but we map all RAM directly
+ * 4-7 are device chip selects (not sure what those are)
+ * 8 is Boot device (ROM) chip select but we map that directly too
+ */
+ if (i == 9) {
+ p = &s->pci[0];
+ mr = &s->cpu_win[i];
+ unmap_region(mr);
+ if (!(val & mask)) {
+ map_pci_region(mr, &p->io, OBJECT(s), "pci0-io-win",
+ p->remap[4], (p->io_size + 1) << 16,
+ (p->io_base & 0xfffff) << 16);
+ }
+ } else if (i == 10) {
+ p = &s->pci[0];
+ mr = &s->cpu_win[i];
+ unmap_region(mr);
+ if (!(val & mask)) {
+ map_pci_region(mr, &p->mem, OBJECT(s), "pci0-mem0-win",
+ p->remap[0], (p->mem_size[0] + 1) << 16,
+ (p->mem_base[0] & 0xfffff) << 16);
+ }
+ } else if (i == 11) {
+ p = &s->pci[0];
+ mr = &s->cpu_win[i];
+ unmap_region(mr);
+ if (!(val & mask)) {
+ map_pci_region(mr, &p->mem, OBJECT(s), "pci0-mem1-win",
+ p->remap[1], (p->mem_size[1] + 1) << 16,
+ (p->mem_base[1] & 0xfffff) << 16);
+ }
+ } else if (i == 12) {
+ p = &s->pci[0];
+ mr = &s->cpu_win[i];
+ unmap_region(mr);
+ if (!(val & mask)) {
+ map_pci_region(mr, &p->mem, OBJECT(s), "pci0-mem2-win",
+ p->remap[2], (p->mem_size[2] + 1) << 16,
+ (p->mem_base[2] & 0xfffff) << 16);
+ }
+ } else if (i == 13) {
+ p = &s->pci[0];
+ mr = &s->cpu_win[i];
+ unmap_region(mr);
+ if (!(val & mask)) {
+ map_pci_region(mr, &p->mem, OBJECT(s), "pci0-mem3-win",
+ p->remap[3], (p->mem_size[3] + 1) << 16,
+ (p->mem_base[3] & 0xfffff) << 16);
+ }
+ } else if (i == 14) {
+ p = &s->pci[1];
+ mr = &s->cpu_win[i];
+ unmap_region(mr);
+ if (!(val & mask)) {
+ map_pci_region(mr, &p->io, OBJECT(s), "pci1-io-win",
+ p->remap[4], (p->io_size + 1) << 16,
+ (p->io_base & 0xfffff) << 16);
+ }
+ } else if (i == 15) {
+ p = &s->pci[1];
+ mr = &s->cpu_win[i];
+ unmap_region(mr);
+ if (!(val & mask)) {
+ map_pci_region(mr, &p->mem, OBJECT(s), "pci1-mem0-win",
+ p->remap[0], (p->mem_size[0] + 1) << 16,
+ (p->mem_base[0] & 0xfffff) << 16);
+ }
+ } else if (i == 16) {
+ p = &s->pci[1];
+ mr = &s->cpu_win[i];
+ unmap_region(mr);
+ if (!(val & mask)) {
+ map_pci_region(mr, &p->mem, OBJECT(s), "pci1-mem1-win",
+ p->remap[1], (p->mem_size[1] + 1) << 16,
+ (p->mem_base[1] & 0xfffff) << 16);
+ }
+ } else if (i == 17) {
+ p = &s->pci[1];
+ mr = &s->cpu_win[i];
+ unmap_region(mr);
+ if (!(val & mask)) {
+ map_pci_region(mr, &p->mem, OBJECT(s), "pci1-mem2-win",
+ p->remap[2], (p->mem_size[2] + 1) << 16,
+ (p->mem_base[2] & 0xfffff) << 16);
+ }
+ } else if (i == 18) {
+ p = &s->pci[1];
+ mr = &s->cpu_win[i];
+ unmap_region(mr);
+ if (!(val & mask)) {
+ map_pci_region(mr, &p->mem, OBJECT(s), "pci1-mem3-win",
+ p->remap[3], (p->mem_size[3] + 1) << 16,
+ (p->mem_base[3] & 0xfffff) << 16);
+ }
+ /* 19 is integrated SRAM */
+ } else if (i == 20) {
+ mr = &s->regs;
+ unmap_region(mr);
+ if (!(val & mask)) {
+ memory_region_add_subregion(get_system_memory(),
+ (s->regs_base & 0xfffff) << 16, mr);
+ }
+ }
+ }
+ }
+ s->base_addr_enable = val;
+}
+
+static void mv64361_update_irq(void *opaque, int n, int level)
+{
+ MV64361State *s = opaque;
+ uint64_t val = s->main_int_cr;
+
+ if (level) {
+ val |= BIT_ULL(n);
+ } else {
+ val &= ~BIT_ULL(n);
+ }
+ if ((s->main_int_cr & s->cpu0_int_mask) != (val & s->cpu0_int_mask)) {
+ qemu_set_irq(s->cpu_irq, level);
+ }
+ s->main_int_cr = val;
+}
+
+static uint64_t mv64361_read(void *opaque, hwaddr addr, unsigned int size)
+{
+ MV64361State *s = MV64361(opaque);
+ uint32_t ret = 0;
+
+ switch (addr) {
+ case MV64340_CPU_CONFIG:
+ ret = s->cpu_conf;
+ break;
+ case MV64340_PCI_0_IO_BASE_ADDR:
+ ret = s->pci[0].io_base;
+ break;
+ case MV64340_PCI_0_IO_SIZE:
+ ret = s->pci[0].io_size;
+ break;
+ case MV64340_PCI_0_IO_ADDR_REMAP:
+ ret = s->pci[0].remap[4] >> 16;
+ break;
+ case MV64340_PCI_0_MEMORY0_BASE_ADDR:
+ ret = s->pci[0].mem_base[0];
+ break;
+ case MV64340_PCI_0_MEMORY0_SIZE:
+ ret = s->pci[0].mem_size[0];
+ break;
+ case MV64340_PCI_0_MEMORY0_LOW_ADDR_REMAP:
+ ret = (s->pci[0].remap[0] & 0xffff0000) >> 16;
+ break;
+ case MV64340_PCI_0_MEMORY0_HIGH_ADDR_REMAP:
+ ret = s->pci[0].remap[0] >> 32;
+ break;
+ case MV64340_PCI_0_MEMORY1_BASE_ADDR:
+ ret = s->pci[0].mem_base[1];
+ break;
+ case MV64340_PCI_0_MEMORY1_SIZE:
+ ret = s->pci[0].mem_size[1];
+ break;
+ case MV64340_PCI_0_MEMORY1_LOW_ADDR_REMAP:
+ ret = (s->pci[0].remap[1] & 0xffff0000) >> 16;
+ break;
+ case MV64340_PCI_0_MEMORY1_HIGH_ADDR_REMAP:
+ ret = s->pci[0].remap[1] >> 32;
+ break;
+ case MV64340_PCI_0_MEMORY2_BASE_ADDR:
+ ret = s->pci[0].mem_base[2];
+ break;
+ case MV64340_PCI_0_MEMORY2_SIZE:
+ ret = s->pci[0].mem_size[2];
+ break;
+ case MV64340_PCI_0_MEMORY2_LOW_ADDR_REMAP:
+ ret = (s->pci[0].remap[2] & 0xffff0000) >> 16;
+ break;
+ case MV64340_PCI_0_MEMORY2_HIGH_ADDR_REMAP:
+ ret = s->pci[0].remap[2] >> 32;
+ break;
+ case MV64340_PCI_0_MEMORY3_BASE_ADDR:
+ ret = s->pci[0].mem_base[3];
+ break;
+ case MV64340_PCI_0_MEMORY3_SIZE:
+ ret = s->pci[0].mem_size[3];
+ break;
+ case MV64340_PCI_0_MEMORY3_LOW_ADDR_REMAP:
+ ret = (s->pci[0].remap[3] & 0xffff0000) >> 16;
+ break;
+ case MV64340_PCI_0_MEMORY3_HIGH_ADDR_REMAP:
+ ret = s->pci[0].remap[3] >> 32;
+ break;
+ case MV64340_PCI_1_IO_BASE_ADDR:
+ ret = s->pci[1].io_base;
+ break;
+ case MV64340_PCI_1_IO_SIZE:
+ ret = s->pci[1].io_size;
+ break;
+ case MV64340_PCI_1_IO_ADDR_REMAP:
+ ret = s->pci[1].remap[4] >> 16;
+ break;
+ case MV64340_PCI_1_MEMORY0_BASE_ADDR:
+ ret = s->pci[1].mem_base[0];
+ break;
+ case MV64340_PCI_1_MEMORY0_SIZE:
+ ret = s->pci[1].mem_size[0];
+ break;
+ case MV64340_PCI_1_MEMORY0_LOW_ADDR_REMAP:
+ ret = (s->pci[1].remap[0] & 0xffff0000) >> 16;
+ break;
+ case MV64340_PCI_1_MEMORY0_HIGH_ADDR_REMAP:
+ ret = s->pci[1].remap[0] >> 32;
+ break;
+ case MV64340_PCI_1_MEMORY1_BASE_ADDR:
+ ret = s->pci[1].mem_base[1];
+ break;
+ case MV64340_PCI_1_MEMORY1_SIZE:
+ ret = s->pci[1].mem_size[1];
+ break;
+ case MV64340_PCI_1_MEMORY1_LOW_ADDR_REMAP:
+ ret = (s->pci[1].remap[1] & 0xffff0000) >> 16;
+ break;
+ case MV64340_PCI_1_MEMORY1_HIGH_ADDR_REMAP:
+ ret = s->pci[1].remap[1] >> 32;
+ break;
+ case MV64340_PCI_1_MEMORY2_BASE_ADDR:
+ ret = s->pci[1].mem_base[2];
+ break;
+ case MV64340_PCI_1_MEMORY2_SIZE:
+ ret = s->pci[1].mem_size[2];
+ break;
+ case MV64340_PCI_1_MEMORY2_LOW_ADDR_REMAP:
+ ret = (s->pci[1].remap[2] & 0xffff0000) >> 16;
+ break;
+ case MV64340_PCI_1_MEMORY2_HIGH_ADDR_REMAP:
+ ret = s->pci[1].remap[2] >> 32;
+ break;
+ case MV64340_PCI_1_MEMORY3_BASE_ADDR:
+ ret = s->pci[1].mem_base[3];
+ break;
+ case MV64340_PCI_1_MEMORY3_SIZE:
+ ret = s->pci[1].mem_size[3];
+ break;
+ case MV64340_PCI_1_MEMORY3_LOW_ADDR_REMAP:
+ ret = (s->pci[1].remap[3] & 0xffff0000) >> 16;
+ break;
+ case MV64340_PCI_1_MEMORY3_HIGH_ADDR_REMAP:
+ ret = s->pci[1].remap[3] >> 32;
+ break;
+ case MV64340_INTERNAL_SPACE_BASE_ADDR:
+ ret = s->regs_base;
+ break;
+ case MV64340_BASE_ADDR_ENABLE:
+ ret = s->base_addr_enable;
+ break;
+ case MV64340_PCI_0_CONFIG_ADDR:
+ ret = pci_host_conf_le_ops.read(PCI_HOST_BRIDGE(&s->pci[0]), 0, size);
+ break;
+ case MV64340_PCI_0_CONFIG_DATA_VIRTUAL_REG ...
+ MV64340_PCI_0_CONFIG_DATA_VIRTUAL_REG + 3:
+ ret = pci_host_data_le_ops.read(PCI_HOST_BRIDGE(&s->pci[0]),
+ addr - MV64340_PCI_0_CONFIG_DATA_VIRTUAL_REG, size);
+ break;
+ case MV64340_PCI_1_CONFIG_ADDR:
+ ret = pci_host_conf_le_ops.read(PCI_HOST_BRIDGE(&s->pci[1]), 0, size);
+ break;
+ case MV64340_PCI_1_CONFIG_DATA_VIRTUAL_REG ...
+ MV64340_PCI_1_CONFIG_DATA_VIRTUAL_REG + 3:
+ ret = pci_host_data_le_ops.read(PCI_HOST_BRIDGE(&s->pci[1]),
+ addr - MV64340_PCI_1_CONFIG_DATA_VIRTUAL_REG, size);
+ break;
+ case MV64340_PCI_1_INTERRUPT_ACKNOWLEDGE_VIRTUAL_REG:
+ /* FIXME: Should this be sent via the PCI bus somehow? */
+ if (s->gpp_int_level && (s->gpp_value & BIT(31))) {
+ ret = pic_read_irq(isa_pic);
+ }
+ break;
+ case MV64340_MAIN_INTERRUPT_CAUSE_LOW:
+ ret = s->main_int_cr;
+ break;
+ case MV64340_MAIN_INTERRUPT_CAUSE_HIGH:
+ ret = s->main_int_cr >> 32;
+ break;
+ case MV64340_CPU_INTERRUPT0_MASK_LOW:
+ ret = s->cpu0_int_mask;
+ break;
+ case MV64340_CPU_INTERRUPT0_MASK_HIGH:
+ ret = s->cpu0_int_mask >> 32;
+ break;
+ case MV64340_CPU_INTERRUPT0_SELECT_CAUSE:
+ ret = s->main_int_cr;
+ if (s->main_int_cr & s->cpu0_int_mask) {
+ if (!(s->main_int_cr & s->cpu0_int_mask & 0xffffffff)) {
+ ret = s->main_int_cr >> 32 | BIT(30);
+ } else if ((s->main_int_cr & s->cpu0_int_mask) >> 32) {
+ ret |= BIT(31);
+ }
+ }
+ break;
+ case MV64340_CUNIT_ARBITER_CONTROL_REG:
+ ret = 0x11ff0000 | (s->gpp_int_level << 10);
+ break;
+ case MV64340_GPP_IO_CONTROL:
+ ret = s->gpp_io;
+ break;
+ case MV64340_GPP_LEVEL_CONTROL:
+ ret = s->gpp_level;
+ break;
+ case MV64340_GPP_VALUE:
+ ret = s->gpp_value;
+ break;
+ case MV64340_GPP_VALUE_SET:
+ case MV64340_GPP_VALUE_CLEAR:
+ ret = 0;
+ break;
+ case MV64340_GPP_INTERRUPT_CAUSE:
+ ret = s->gpp_int_cr;
+ break;
+ case MV64340_GPP_INTERRUPT_MASK0:
+ case MV64340_GPP_INTERRUPT_MASK1:
+ ret = s->gpp_int_mask;
+ break;
+ default:
+ qemu_log_mask(LOG_UNIMP, "%s: Unimplemented register read 0x%"
+ HWADDR_PRIx "\n", __func__, addr);
+ break;
+ }
+ if (addr != MV64340_PCI_1_INTERRUPT_ACKNOWLEDGE_VIRTUAL_REG) {
+ trace_mv64361_reg_read(addr, ret);
+ }
+ return ret;
+}
+
+static void warn_swap_bit(uint64_t val)
+{
+ if ((val & 0x3000000ULL) >> 24 != 1) {
+ qemu_log_mask(LOG_UNIMP, "%s: Data swap not implemented", __func__);
+ }
+}
+
+static void mv64361_set_pci_mem_remap(MV64361State *s, int bus, int idx,
+ uint64_t val, bool high)
+{
+ if (high) {
+ s->pci[bus].remap[idx] = val;
+ } else {
+ s->pci[bus].remap[idx] &= 0xffffffff00000000ULL;
+ s->pci[bus].remap[idx] |= (val & 0xffffULL) << 16;
+ }
+}
+
+static void mv64361_write(void *opaque, hwaddr addr, uint64_t val,
+ unsigned int size)
+{
+ MV64361State *s = MV64361(opaque);
+
+ trace_mv64361_reg_write(addr, val);
+ switch (addr) {
+ case MV64340_CPU_CONFIG:
+ s->cpu_conf = val & 0xe4e3bffULL;
+ s->cpu_conf |= BIT(23);
+ break;
+ case MV64340_PCI_0_IO_BASE_ADDR:
+ s->pci[0].io_base = val & 0x30fffffULL;
+ warn_swap_bit(val);
+ if (!(s->cpu_conf & BIT(27))) {
+ s->pci[0].remap[4] = (val & 0xffffULL) << 16;
+ }
+ break;
+ case MV64340_PCI_0_IO_SIZE:
+ s->pci[0].io_size = val & 0xffffULL;
+ break;
+ case MV64340_PCI_0_IO_ADDR_REMAP:
+ s->pci[0].remap[4] = (val & 0xffffULL) << 16;
+ break;
+ case MV64340_PCI_0_MEMORY0_BASE_ADDR:
+ s->pci[0].mem_base[0] = val & 0x70fffffULL;
+ warn_swap_bit(val);
+ if (!(s->cpu_conf & BIT(27))) {
+ mv64361_set_pci_mem_remap(s, 0, 0, val, false);
+ }
+ break;
+ case MV64340_PCI_0_MEMORY0_SIZE:
+ s->pci[0].mem_size[0] = val & 0xffffULL;
+ break;
+ case MV64340_PCI_0_MEMORY0_LOW_ADDR_REMAP:
+ case MV64340_PCI_0_MEMORY0_HIGH_ADDR_REMAP:
+ mv64361_set_pci_mem_remap(s, 0, 0, val,
+ (addr == MV64340_PCI_0_MEMORY0_HIGH_ADDR_REMAP));
+ break;
+ case MV64340_PCI_0_MEMORY1_BASE_ADDR:
+ s->pci[0].mem_base[1] = val & 0x70fffffULL;
+ warn_swap_bit(val);
+ if (!(s->cpu_conf & BIT(27))) {
+ mv64361_set_pci_mem_remap(s, 0, 1, val, false);
+ }
+ break;
+ case MV64340_PCI_0_MEMORY1_SIZE:
+ s->pci[0].mem_size[1] = val & 0xffffULL;
+ break;
+ case MV64340_PCI_0_MEMORY1_LOW_ADDR_REMAP:
+ case MV64340_PCI_0_MEMORY1_HIGH_ADDR_REMAP:
+ mv64361_set_pci_mem_remap(s, 0, 1, val,
+ (addr == MV64340_PCI_0_MEMORY1_HIGH_ADDR_REMAP));
+ break;
+ case MV64340_PCI_0_MEMORY2_BASE_ADDR:
+ s->pci[0].mem_base[2] = val & 0x70fffffULL;
+ warn_swap_bit(val);
+ if (!(s->cpu_conf & BIT(27))) {
+ mv64361_set_pci_mem_remap(s, 0, 2, val, false);
+ }
+ break;
+ case MV64340_PCI_0_MEMORY2_SIZE:
+ s->pci[0].mem_size[2] = val & 0xffffULL;
+ break;
+ case MV64340_PCI_0_MEMORY2_LOW_ADDR_REMAP:
+ case MV64340_PCI_0_MEMORY2_HIGH_ADDR_REMAP:
+ mv64361_set_pci_mem_remap(s, 0, 2, val,
+ (addr == MV64340_PCI_0_MEMORY2_HIGH_ADDR_REMAP));
+ break;
+ case MV64340_PCI_0_MEMORY3_BASE_ADDR:
+ s->pci[0].mem_base[3] = val & 0x70fffffULL;
+ warn_swap_bit(val);
+ if (!(s->cpu_conf & BIT(27))) {
+ mv64361_set_pci_mem_remap(s, 0, 3, val, false);
+ }
+ break;
+ case MV64340_PCI_0_MEMORY3_SIZE:
+ s->pci[0].mem_size[3] = val & 0xffffULL;
+ break;
+ case MV64340_PCI_0_MEMORY3_LOW_ADDR_REMAP:
+ case MV64340_PCI_0_MEMORY3_HIGH_ADDR_REMAP:
+ mv64361_set_pci_mem_remap(s, 0, 3, val,
+ (addr == MV64340_PCI_0_MEMORY3_HIGH_ADDR_REMAP));
+ break;
+ case MV64340_PCI_1_IO_BASE_ADDR:
+ s->pci[1].io_base = val & 0x30fffffULL;
+ warn_swap_bit(val);
+ if (!(s->cpu_conf & BIT(27))) {
+ s->pci[1].remap[4] = (val & 0xffffULL) << 16;
+ }
+ break;
+ case MV64340_PCI_1_IO_SIZE:
+ s->pci[1].io_size = val & 0xffffULL;
+ break;
+ case MV64340_PCI_1_MEMORY0_BASE_ADDR:
+ s->pci[1].mem_base[0] = val & 0x70fffffULL;
+ warn_swap_bit(val);
+ if (!(s->cpu_conf & BIT(27))) {
+ mv64361_set_pci_mem_remap(s, 1, 0, val, false);
+ }
+ break;
+ case MV64340_PCI_1_MEMORY0_SIZE:
+ s->pci[1].mem_size[0] = val & 0xffffULL;
+ break;
+ case MV64340_PCI_1_MEMORY0_LOW_ADDR_REMAP:
+ case MV64340_PCI_1_MEMORY0_HIGH_ADDR_REMAP:
+ mv64361_set_pci_mem_remap(s, 1, 0, val,
+ (addr == MV64340_PCI_1_MEMORY0_HIGH_ADDR_REMAP));
+ break;
+ case MV64340_PCI_1_MEMORY1_BASE_ADDR:
+ s->pci[1].mem_base[1] = val & 0x70fffffULL;
+ warn_swap_bit(val);
+ if (!(s->cpu_conf & BIT(27))) {
+ mv64361_set_pci_mem_remap(s, 1, 1, val, false);
+ }
+ break;
+ case MV64340_PCI_1_MEMORY1_SIZE:
+ s->pci[1].mem_size[1] = val & 0xffffULL;
+ break;
+ case MV64340_PCI_1_MEMORY1_LOW_ADDR_REMAP:
+ case MV64340_PCI_1_MEMORY1_HIGH_ADDR_REMAP:
+ mv64361_set_pci_mem_remap(s, 1, 1, val,
+ (addr == MV64340_PCI_1_MEMORY1_HIGH_ADDR_REMAP));
+ break;
+ case MV64340_PCI_1_MEMORY2_BASE_ADDR:
+ s->pci[1].mem_base[2] = val & 0x70fffffULL;
+ warn_swap_bit(val);
+ if (!(s->cpu_conf & BIT(27))) {
+ mv64361_set_pci_mem_remap(s, 1, 2, val, false);
+ }
+ break;
+ case MV64340_PCI_1_MEMORY2_SIZE:
+ s->pci[1].mem_size[2] = val & 0xffffULL;
+ break;
+ case MV64340_PCI_1_MEMORY2_LOW_ADDR_REMAP:
+ case MV64340_PCI_1_MEMORY2_HIGH_ADDR_REMAP:
+ mv64361_set_pci_mem_remap(s, 1, 2, val,
+ (addr == MV64340_PCI_1_MEMORY2_HIGH_ADDR_REMAP));
+ break;
+ case MV64340_PCI_1_MEMORY3_BASE_ADDR:
+ s->pci[1].mem_base[3] = val & 0x70fffffULL;
+ warn_swap_bit(val);
+ if (!(s->cpu_conf & BIT(27))) {
+ mv64361_set_pci_mem_remap(s, 1, 3, val, false);
+ }
+ break;
+ case MV64340_PCI_1_MEMORY3_SIZE:
+ s->pci[1].mem_size[3] = val & 0xffffULL;
+ break;
+ case MV64340_PCI_1_MEMORY3_LOW_ADDR_REMAP:
+ case MV64340_PCI_1_MEMORY3_HIGH_ADDR_REMAP:
+ mv64361_set_pci_mem_remap(s, 1, 3, val,
+ (addr == MV64340_PCI_1_MEMORY3_HIGH_ADDR_REMAP));
+ break;
+ case MV64340_INTERNAL_SPACE_BASE_ADDR:
+ s->regs_base = val & 0xfffffULL;
+ break;
+ case MV64340_BASE_ADDR_ENABLE:
+ set_mem_windows(s, val);
+ break;
+ case MV64340_PCI_0_CONFIG_ADDR:
+ pci_host_conf_le_ops.write(PCI_HOST_BRIDGE(&s->pci[0]), 0, val, size);
+ break;
+ case MV64340_PCI_0_CONFIG_DATA_VIRTUAL_REG ...
+ MV64340_PCI_0_CONFIG_DATA_VIRTUAL_REG + 3:
+ pci_host_data_le_ops.write(PCI_HOST_BRIDGE(&s->pci[0]),
+ addr - MV64340_PCI_0_CONFIG_DATA_VIRTUAL_REG, val, size);
+ break;
+ case MV64340_PCI_1_CONFIG_ADDR:
+ pci_host_conf_le_ops.write(PCI_HOST_BRIDGE(&s->pci[1]), 0, val, size);
+ break;
+ case MV64340_PCI_1_CONFIG_DATA_VIRTUAL_REG ...
+ MV64340_PCI_1_CONFIG_DATA_VIRTUAL_REG + 3:
+ pci_host_data_le_ops.write(PCI_HOST_BRIDGE(&s->pci[1]),
+ addr - MV64340_PCI_1_CONFIG_DATA_VIRTUAL_REG, val, size);
+ break;
+ case MV64340_CPU_INTERRUPT0_MASK_LOW:
+ s->cpu0_int_mask &= 0xffffffff00000000ULL;
+ s->cpu0_int_mask |= val & 0xffffffffULL;
+ break;
+ case MV64340_CPU_INTERRUPT0_MASK_HIGH:
+ s->cpu0_int_mask &= 0xffffffffULL;
+ s->cpu0_int_mask |= val << 32;
+ break;
+ case MV64340_CUNIT_ARBITER_CONTROL_REG:
+ s->gpp_int_level = !!(val & BIT(10));
+ break;
+ case MV64340_GPP_IO_CONTROL:
+ s->gpp_io = val;
+ break;
+ case MV64340_GPP_LEVEL_CONTROL:
+ s->gpp_level = val;
+ break;
+ case MV64340_GPP_VALUE:
+ s->gpp_value &= ~s->gpp_io;
+ s->gpp_value |= val & s->gpp_io;
+ break;
+ case MV64340_GPP_VALUE_SET:
+ s->gpp_value |= val & s->gpp_io;
+ break;
+ case MV64340_GPP_VALUE_CLEAR:
+ s->gpp_value &= ~(val & s->gpp_io);
+ break;
+ case MV64340_GPP_INTERRUPT_CAUSE:
+ if (!s->gpp_int_level && val != s->gpp_int_cr) {
+ int i;
+ uint32_t ch = s->gpp_int_cr ^ val;
+ s->gpp_int_cr = val;
+ for (i = 0; i < 4; i++) {
+ if ((ch & 0xff << i) && !(val & 0xff << i)) {
+ mv64361_update_irq(opaque, MV64361_IRQ_P0_GPP0_7 + i, 0);
+ }
+ }
+ } else {
+ s->gpp_int_cr = val;
+ }
+ break;
+ case MV64340_GPP_INTERRUPT_MASK0:
+ case MV64340_GPP_INTERRUPT_MASK1:
+ s->gpp_int_mask = val;
+ break;
+ default:
+ qemu_log_mask(LOG_UNIMP, "%s: Unimplemented register write 0x%"
+ HWADDR_PRIx " = %"PRIx64"\n", __func__, addr, val);
+ break;
+ }
+}
+
+static const MemoryRegionOps mv64361_ops = {
+ .read = mv64361_read,
+ .write = mv64361_write,
+ .valid.min_access_size = 1,
+ .valid.max_access_size = 4,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void mv64361_gpp_irq(void *opaque, int n, int level)
+{
+ MV64361State *s = opaque;
+ uint32_t mask = BIT(n);
+ uint32_t val = s->gpp_value & ~mask;
+
+ if (s->gpp_level & mask) {
+ level = !level;
+ }
+ val |= level << n;
+ if (val > s->gpp_value) {
+ s->gpp_value = val;
+ s->gpp_int_cr |= mask;
+ if (s->gpp_int_mask & mask) {
+ mv64361_update_irq(opaque, MV64361_IRQ_P0_GPP0_7 + n / 8, 1);
+ }
+ } else if (val < s->gpp_value) {
+ int b = n / 8;
+ s->gpp_value = val;
+ if (s->gpp_int_level && !(val & 0xff << b)) {
+ mv64361_update_irq(opaque, MV64361_IRQ_P0_GPP0_7 + b, 0);
+ }
+ }
+}
+
+static void mv64361_realize(DeviceState *dev, Error **errp)
+{
+ MV64361State *s = MV64361(dev);
+ int i;
+
+ s->base_addr_enable = 0x1fffff;
+ memory_region_init_io(&s->regs, OBJECT(s), &mv64361_ops, s,
+ TYPE_MV64361, 0x10000);
+ sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->regs);
+ for (i = 0; i < 2; i++) {
+ g_autofree char *name = g_strdup_printf("pcihost%d", i);
+ object_initialize_child(OBJECT(dev), name, &s->pci[i],
+ TYPE_MV64361_PCI);
+ DeviceState *pci = DEVICE(&s->pci[i]);
+ qdev_prop_set_uint8(pci, "index", i);
+ sysbus_realize_and_unref(SYS_BUS_DEVICE(pci), &error_fatal);
+ }
+ sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->cpu_irq);
+ qdev_init_gpio_in_named(dev, mv64361_gpp_irq, "gpp", 32);
+ /* FIXME: PCI IRQ connections may be board specific */
+ for (i = 0; i < PCI_NUM_PINS; i++) {
+ s->pci[1].irq[i] = qdev_get_gpio_in_named(dev, "gpp", 12 + i);
+ }
+}
+
+static void mv64361_reset(DeviceState *dev)
+{
+ MV64361State *s = MV64361(dev);
+ int i, j;
+
+ /*
+ * These values may be board specific
+ * Real chip supports init from an eprom but that's not modelled
+ */
+ set_mem_windows(s, 0x1fffff);
+ s->cpu_conf = 0x28000ff;
+ s->regs_base = 0x100f100;
+ s->pci[0].io_base = 0x100f800;
+ s->pci[0].io_size = 0xff;
+ s->pci[0].mem_base[0] = 0x100c000;
+ s->pci[0].mem_size[0] = 0x1fff;
+ s->pci[0].mem_base[1] = 0x100f900;
+ s->pci[0].mem_size[1] = 0xff;
+ s->pci[0].mem_base[2] = 0x100f400;
+ s->pci[0].mem_size[2] = 0x1ff;
+ s->pci[0].mem_base[3] = 0x100f600;
+ s->pci[0].mem_size[3] = 0x1ff;
+ s->pci[1].io_base = 0x100fe00;
+ s->pci[1].io_size = 0xff;
+ s->pci[1].mem_base[0] = 0x1008000;
+ s->pci[1].mem_size[0] = 0x3fff;
+ s->pci[1].mem_base[1] = 0x100fd00;
+ s->pci[1].mem_size[1] = 0xff;
+ s->pci[1].mem_base[2] = 0x1002600;
+ s->pci[1].mem_size[2] = 0x1ff;
+ s->pci[1].mem_base[3] = 0x100ff80;
+ s->pci[1].mem_size[3] = 0x7f;
+ for (i = 0; i < 2; i++) {
+ for (j = 0; j < 4; j++) {
+ s->pci[i].remap[j] = s->pci[i].mem_base[j] << 16;
+ }
+ }
+ s->pci[0].remap[1] = 0;
+ s->pci[1].remap[1] = 0;
+ set_mem_windows(s, 0xfbfff);
+}
+
+static void mv64361_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ dc->realize = mv64361_realize;
+ dc->reset = mv64361_reset;
+}
+
+static const TypeInfo mv64361_type_info = {
+ .name = TYPE_MV64361,
+ .parent = TYPE_SYS_BUS_DEVICE,
+ .instance_size = sizeof(MV64361State),
+ .class_init = mv64361_class_init,
+};
+
+static void mv64361_register_types(void)
+{
+ type_register_static(&mv64361_type_info);
+}
+
+type_init(mv64361_register_types)
diff --git a/hw/pci-host/mv643xx.h b/hw/pci-host/mv643xx.h
new file mode 100644
index 000000000..cd26a43f1
--- /dev/null
+++ b/hw/pci-host/mv643xx.h
@@ -0,0 +1,918 @@
+/*
+ * mv643xx.h - MV-643XX Internal registers definition file.
+ *
+ * Copyright 2002 Momentum Computer, Inc.
+ * Author: Matthew Dharm <mdharm@momenco.com>
+ * Copyright 2002 GALILEO TECHNOLOGY, LTD.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ */
+#ifndef ASM_MV643XX_H
+#define ASM_MV643XX_H
+
+/****************************************/
+/* Processor Address Space */
+/****************************************/
+
+/* DDR SDRAM BAR and size registers */
+
+#define MV64340_CS_0_BASE_ADDR 0x008
+#define MV64340_CS_0_SIZE 0x010
+#define MV64340_CS_1_BASE_ADDR 0x208
+#define MV64340_CS_1_SIZE 0x210
+#define MV64340_CS_2_BASE_ADDR 0x018
+#define MV64340_CS_2_SIZE 0x020
+#define MV64340_CS_3_BASE_ADDR 0x218
+#define MV64340_CS_3_SIZE 0x220
+
+/* Devices BAR and size registers */
+
+#define MV64340_DEV_CS0_BASE_ADDR 0x028
+#define MV64340_DEV_CS0_SIZE 0x030
+#define MV64340_DEV_CS1_BASE_ADDR 0x228
+#define MV64340_DEV_CS1_SIZE 0x230
+#define MV64340_DEV_CS2_BASE_ADDR 0x248
+#define MV64340_DEV_CS2_SIZE 0x250
+#define MV64340_DEV_CS3_BASE_ADDR 0x038
+#define MV64340_DEV_CS3_SIZE 0x040
+#define MV64340_BOOTCS_BASE_ADDR 0x238
+#define MV64340_BOOTCS_SIZE 0x240
+
+/* PCI 0 BAR and size registers */
+
+#define MV64340_PCI_0_IO_BASE_ADDR 0x048
+#define MV64340_PCI_0_IO_SIZE 0x050
+#define MV64340_PCI_0_MEMORY0_BASE_ADDR 0x058
+#define MV64340_PCI_0_MEMORY0_SIZE 0x060
+#define MV64340_PCI_0_MEMORY1_BASE_ADDR 0x080
+#define MV64340_PCI_0_MEMORY1_SIZE 0x088
+#define MV64340_PCI_0_MEMORY2_BASE_ADDR 0x258
+#define MV64340_PCI_0_MEMORY2_SIZE 0x260
+#define MV64340_PCI_0_MEMORY3_BASE_ADDR 0x280
+#define MV64340_PCI_0_MEMORY3_SIZE 0x288
+
+/* PCI 1 BAR and size registers */
+#define MV64340_PCI_1_IO_BASE_ADDR 0x090
+#define MV64340_PCI_1_IO_SIZE 0x098
+#define MV64340_PCI_1_MEMORY0_BASE_ADDR 0x0a0
+#define MV64340_PCI_1_MEMORY0_SIZE 0x0a8
+#define MV64340_PCI_1_MEMORY1_BASE_ADDR 0x0b0
+#define MV64340_PCI_1_MEMORY1_SIZE 0x0b8
+#define MV64340_PCI_1_MEMORY2_BASE_ADDR 0x2a0
+#define MV64340_PCI_1_MEMORY2_SIZE 0x2a8
+#define MV64340_PCI_1_MEMORY3_BASE_ADDR 0x2b0
+#define MV64340_PCI_1_MEMORY3_SIZE 0x2b8
+
+/* SRAM base address */
+#define MV64340_INTEGRATED_SRAM_BASE_ADDR 0x268
+
+/* internal registers space base address */
+#define MV64340_INTERNAL_SPACE_BASE_ADDR 0x068
+
+/* Enables the CS , DEV_CS , PCI 0 and PCI 1 windows above */
+#define MV64340_BASE_ADDR_ENABLE 0x278
+
+/****************************************/
+/* PCI remap registers */
+/****************************************/
+
+ /* PCI 0 */
+#define MV64340_PCI_0_IO_ADDR_REMAP 0x0f0
+#define MV64340_PCI_0_MEMORY0_LOW_ADDR_REMAP 0x0f8
+#define MV64340_PCI_0_MEMORY0_HIGH_ADDR_REMAP 0x320
+#define MV64340_PCI_0_MEMORY1_LOW_ADDR_REMAP 0x100
+#define MV64340_PCI_0_MEMORY1_HIGH_ADDR_REMAP 0x328
+#define MV64340_PCI_0_MEMORY2_LOW_ADDR_REMAP 0x2f8
+#define MV64340_PCI_0_MEMORY2_HIGH_ADDR_REMAP 0x330
+#define MV64340_PCI_0_MEMORY3_LOW_ADDR_REMAP 0x300
+#define MV64340_PCI_0_MEMORY3_HIGH_ADDR_REMAP 0x338
+ /* PCI 1 */
+#define MV64340_PCI_1_IO_ADDR_REMAP 0x108
+#define MV64340_PCI_1_MEMORY0_LOW_ADDR_REMAP 0x110
+#define MV64340_PCI_1_MEMORY0_HIGH_ADDR_REMAP 0x340
+#define MV64340_PCI_1_MEMORY1_LOW_ADDR_REMAP 0x118
+#define MV64340_PCI_1_MEMORY1_HIGH_ADDR_REMAP 0x348
+#define MV64340_PCI_1_MEMORY2_LOW_ADDR_REMAP 0x310
+#define MV64340_PCI_1_MEMORY2_HIGH_ADDR_REMAP 0x350
+#define MV64340_PCI_1_MEMORY3_LOW_ADDR_REMAP 0x318
+#define MV64340_PCI_1_MEMORY3_HIGH_ADDR_REMAP 0x358
+
+#define MV64340_CPU_PCI_0_HEADERS_RETARGET_CONTROL 0x3b0
+#define MV64340_CPU_PCI_0_HEADERS_RETARGET_BASE 0x3b8
+#define MV64340_CPU_PCI_1_HEADERS_RETARGET_CONTROL 0x3c0
+#define MV64340_CPU_PCI_1_HEADERS_RETARGET_BASE 0x3c8
+#define MV64340_CPU_GE_HEADERS_RETARGET_CONTROL 0x3d0
+#define MV64340_CPU_GE_HEADERS_RETARGET_BASE 0x3d8
+#define MV64340_CPU_IDMA_HEADERS_RETARGET_CONTROL 0x3e0
+#define MV64340_CPU_IDMA_HEADERS_RETARGET_BASE 0x3e8
+
+/****************************************/
+/* CPU Control Registers */
+/****************************************/
+
+#define MV64340_CPU_CONFIG 0x000
+#define MV64340_CPU_MODE 0x120
+#define MV64340_CPU_MASTER_CONTROL 0x160
+#define MV64340_CPU_CROSS_BAR_CONTROL_LOW 0x150
+#define MV64340_CPU_CROSS_BAR_CONTROL_HIGH 0x158
+#define MV64340_CPU_CROSS_BAR_TIMEOUT 0x168
+
+/****************************************/
+/* SMP RegisterS */
+/****************************************/
+
+#define MV64340_SMP_WHO_AM_I 0x200
+#define MV64340_SMP_CPU0_DOORBELL 0x214
+#define MV64340_SMP_CPU0_DOORBELL_CLEAR 0x21C
+#define MV64340_SMP_CPU1_DOORBELL 0x224
+#define MV64340_SMP_CPU1_DOORBELL_CLEAR 0x22C
+#define MV64340_SMP_CPU0_DOORBELL_MASK 0x234
+#define MV64340_SMP_CPU1_DOORBELL_MASK 0x23C
+#define MV64340_SMP_SEMAPHOR0 0x244
+#define MV64340_SMP_SEMAPHOR1 0x24c
+#define MV64340_SMP_SEMAPHOR2 0x254
+#define MV64340_SMP_SEMAPHOR3 0x25c
+#define MV64340_SMP_SEMAPHOR4 0x264
+#define MV64340_SMP_SEMAPHOR5 0x26c
+#define MV64340_SMP_SEMAPHOR6 0x274
+#define MV64340_SMP_SEMAPHOR7 0x27c
+
+/****************************************/
+/* CPU Sync Barrier Register */
+/****************************************/
+
+#define MV64340_CPU_0_SYNC_BARRIER_TRIGGER 0x0c0
+#define MV64340_CPU_0_SYNC_BARRIER_VIRTUAL 0x0c8
+#define MV64340_CPU_1_SYNC_BARRIER_TRIGGER 0x0d0
+#define MV64340_CPU_1_SYNC_BARRIER_VIRTUAL 0x0d8
+
+/****************************************/
+/* CPU Access Protect */
+/****************************************/
+
+#define MV64340_CPU_PROTECT_WINDOW_0_BASE_ADDR 0x180
+#define MV64340_CPU_PROTECT_WINDOW_0_SIZE 0x188
+#define MV64340_CPU_PROTECT_WINDOW_1_BASE_ADDR 0x190
+#define MV64340_CPU_PROTECT_WINDOW_1_SIZE 0x198
+#define MV64340_CPU_PROTECT_WINDOW_2_BASE_ADDR 0x1a0
+#define MV64340_CPU_PROTECT_WINDOW_2_SIZE 0x1a8
+#define MV64340_CPU_PROTECT_WINDOW_3_BASE_ADDR 0x1b0
+#define MV64340_CPU_PROTECT_WINDOW_3_SIZE 0x1b8
+
+
+/****************************************/
+/* CPU Error Report */
+/****************************************/
+
+#define MV64340_CPU_ERROR_ADDR_LOW 0x070
+#define MV64340_CPU_ERROR_ADDR_HIGH 0x078
+#define MV64340_CPU_ERROR_DATA_LOW 0x128
+#define MV64340_CPU_ERROR_DATA_HIGH 0x130
+#define MV64340_CPU_ERROR_PARITY 0x138
+#define MV64340_CPU_ERROR_CAUSE 0x140
+#define MV64340_CPU_ERROR_MASK 0x148
+
+/****************************************/
+/* CPU Interface Debug Registers */
+/****************************************/
+
+#define MV64340_PUNIT_SLAVE_DEBUG_LOW 0x360
+#define MV64340_PUNIT_SLAVE_DEBUG_HIGH 0x368
+#define MV64340_PUNIT_MASTER_DEBUG_LOW 0x370
+#define MV64340_PUNIT_MASTER_DEBUG_HIGH 0x378
+#define MV64340_PUNIT_MMASK 0x3e4
+
+/****************************************/
+/* Integrated SRAM Registers */
+/****************************************/
+
+#define MV64340_SRAM_CONFIG 0x380
+#define MV64340_SRAM_TEST_MODE 0X3F4
+#define MV64340_SRAM_ERROR_CAUSE 0x388
+#define MV64340_SRAM_ERROR_ADDR 0x390
+#define MV64340_SRAM_ERROR_ADDR_HIGH 0X3F8
+#define MV64340_SRAM_ERROR_DATA_LOW 0x398
+#define MV64340_SRAM_ERROR_DATA_HIGH 0x3a0
+#define MV64340_SRAM_ERROR_DATA_PARITY 0x3a8
+
+/****************************************/
+/* SDRAM Configuration */
+/****************************************/
+
+#define MV64340_SDRAM_CONFIG 0x1400
+#define MV64340_D_UNIT_CONTROL_LOW 0x1404
+#define MV64340_D_UNIT_CONTROL_HIGH 0x1424
+#define MV64340_SDRAM_TIMING_CONTROL_LOW 0x1408
+#define MV64340_SDRAM_TIMING_CONTROL_HIGH 0x140c
+#define MV64340_SDRAM_ADDR_CONTROL 0x1410
+#define MV64340_SDRAM_OPEN_PAGES_CONTROL 0x1414
+#define MV64340_SDRAM_OPERATION 0x1418
+#define MV64340_SDRAM_MODE 0x141c
+#define MV64340_EXTENDED_DRAM_MODE 0x1420
+#define MV64340_SDRAM_CROSS_BAR_CONTROL_LOW 0x1430
+#define MV64340_SDRAM_CROSS_BAR_CONTROL_HIGH 0x1434
+#define MV64340_SDRAM_CROSS_BAR_TIMEOUT 0x1438
+#define MV64340_SDRAM_ADDR_CTRL_PADS_CALIBRATION 0x14c0
+#define MV64340_SDRAM_DATA_PADS_CALIBRATION 0x14c4
+
+/****************************************/
+/* SDRAM Error Report */
+/****************************************/
+
+#define MV64340_SDRAM_ERROR_DATA_LOW 0x1444
+#define MV64340_SDRAM_ERROR_DATA_HIGH 0x1440
+#define MV64340_SDRAM_ERROR_ADDR 0x1450
+#define MV64340_SDRAM_RECEIVED_ECC 0x1448
+#define MV64340_SDRAM_CALCULATED_ECC 0x144c
+#define MV64340_SDRAM_ECC_CONTROL 0x1454
+#define MV64340_SDRAM_ECC_ERROR_COUNTER 0x1458
+
+/******************************************/
+/* Controlled Delay Line (CDL) Registers */
+/******************************************/
+
+#define MV64340_DFCDL_CONFIG0 0x1480
+#define MV64340_DFCDL_CONFIG1 0x1484
+#define MV64340_DLL_WRITE 0x1488
+#define MV64340_DLL_READ 0x148c
+#define MV64340_SRAM_ADDR 0x1490
+#define MV64340_SRAM_DATA0 0x1494
+#define MV64340_SRAM_DATA1 0x1498
+#define MV64340_SRAM_DATA2 0x149c
+#define MV64340_DFCL_PROBE 0x14a0
+
+/******************************************/
+/* Debug Registers */
+/******************************************/
+
+#define MV64340_DUNIT_DEBUG_LOW 0x1460
+#define MV64340_DUNIT_DEBUG_HIGH 0x1464
+#define MV64340_DUNIT_MMASK 0X1b40
+
+/****************************************/
+/* Device Parameters */
+/****************************************/
+
+#define MV64340_DEVICE_BANK0_PARAMETERS 0x45c
+#define MV64340_DEVICE_BANK1_PARAMETERS 0x460
+#define MV64340_DEVICE_BANK2_PARAMETERS 0x464
+#define MV64340_DEVICE_BANK3_PARAMETERS 0x468
+#define MV64340_DEVICE_BOOT_BANK_PARAMETERS 0x46c
+#define MV64340_DEVICE_INTERFACE_CONTROL 0x4c0
+#define MV64340_DEVICE_INTERFACE_CROSS_BAR_CONTROL_LOW 0x4c8
+#define MV64340_DEVICE_INTERFACE_CROSS_BAR_CONTROL_HIGH 0x4cc
+#define MV64340_DEVICE_INTERFACE_CROSS_BAR_TIMEOUT 0x4c4
+
+/****************************************/
+/* Device interrupt registers */
+/****************************************/
+
+#define MV64340_DEVICE_INTERRUPT_CAUSE 0x4d0
+#define MV64340_DEVICE_INTERRUPT_MASK 0x4d4
+#define MV64340_DEVICE_ERROR_ADDR 0x4d8
+#define MV64340_DEVICE_ERROR_DATA 0x4dc
+#define MV64340_DEVICE_ERROR_PARITY 0x4e0
+
+/****************************************/
+/* Device debug registers */
+/****************************************/
+
+#define MV64340_DEVICE_DEBUG_LOW 0x4e4
+#define MV64340_DEVICE_DEBUG_HIGH 0x4e8
+#define MV64340_RUNIT_MMASK 0x4f0
+
+/****************************************/
+/* PCI Slave Address Decoding registers */
+/****************************************/
+
+#define MV64340_PCI_0_CS_0_BANK_SIZE 0xc08
+#define MV64340_PCI_1_CS_0_BANK_SIZE 0xc88
+#define MV64340_PCI_0_CS_1_BANK_SIZE 0xd08
+#define MV64340_PCI_1_CS_1_BANK_SIZE 0xd88
+#define MV64340_PCI_0_CS_2_BANK_SIZE 0xc0c
+#define MV64340_PCI_1_CS_2_BANK_SIZE 0xc8c
+#define MV64340_PCI_0_CS_3_BANK_SIZE 0xd0c
+#define MV64340_PCI_1_CS_3_BANK_SIZE 0xd8c
+#define MV64340_PCI_0_DEVCS_0_BANK_SIZE 0xc10
+#define MV64340_PCI_1_DEVCS_0_BANK_SIZE 0xc90
+#define MV64340_PCI_0_DEVCS_1_BANK_SIZE 0xd10
+#define MV64340_PCI_1_DEVCS_1_BANK_SIZE 0xd90
+#define MV64340_PCI_0_DEVCS_2_BANK_SIZE 0xd18
+#define MV64340_PCI_1_DEVCS_2_BANK_SIZE 0xd98
+#define MV64340_PCI_0_DEVCS_3_BANK_SIZE 0xc14
+#define MV64340_PCI_1_DEVCS_3_BANK_SIZE 0xc94
+#define MV64340_PCI_0_DEVCS_BOOT_BANK_SIZE 0xd14
+#define MV64340_PCI_1_DEVCS_BOOT_BANK_SIZE 0xd94
+#define MV64340_PCI_0_P2P_MEM0_BAR_SIZE 0xd1c
+#define MV64340_PCI_1_P2P_MEM0_BAR_SIZE 0xd9c
+#define MV64340_PCI_0_P2P_MEM1_BAR_SIZE 0xd20
+#define MV64340_PCI_1_P2P_MEM1_BAR_SIZE 0xda0
+#define MV64340_PCI_0_P2P_I_O_BAR_SIZE 0xd24
+#define MV64340_PCI_1_P2P_I_O_BAR_SIZE 0xda4
+#define MV64340_PCI_0_CPU_BAR_SIZE 0xd28
+#define MV64340_PCI_1_CPU_BAR_SIZE 0xda8
+#define MV64340_PCI_0_INTERNAL_SRAM_BAR_SIZE 0xe00
+#define MV64340_PCI_1_INTERNAL_SRAM_BAR_SIZE 0xe80
+#define MV64340_PCI_0_EXPANSION_ROM_BAR_SIZE 0xd2c
+#define MV64340_PCI_1_EXPANSION_ROM_BAR_SIZE 0xd9c
+#define MV64340_PCI_0_BASE_ADDR_REG_ENABLE 0xc3c
+#define MV64340_PCI_1_BASE_ADDR_REG_ENABLE 0xcbc
+#define MV64340_PCI_0_CS_0_BASE_ADDR_REMAP 0xc48
+#define MV64340_PCI_1_CS_0_BASE_ADDR_REMAP 0xcc8
+#define MV64340_PCI_0_CS_1_BASE_ADDR_REMAP 0xd48
+#define MV64340_PCI_1_CS_1_BASE_ADDR_REMAP 0xdc8
+#define MV64340_PCI_0_CS_2_BASE_ADDR_REMAP 0xc4c
+#define MV64340_PCI_1_CS_2_BASE_ADDR_REMAP 0xccc
+#define MV64340_PCI_0_CS_3_BASE_ADDR_REMAP 0xd4c
+#define MV64340_PCI_1_CS_3_BASE_ADDR_REMAP 0xdcc
+#define MV64340_PCI_0_CS_0_BASE_HIGH_ADDR_REMAP 0xF04
+#define MV64340_PCI_1_CS_0_BASE_HIGH_ADDR_REMAP 0xF84
+#define MV64340_PCI_0_CS_1_BASE_HIGH_ADDR_REMAP 0xF08
+#define MV64340_PCI_1_CS_1_BASE_HIGH_ADDR_REMAP 0xF88
+#define MV64340_PCI_0_CS_2_BASE_HIGH_ADDR_REMAP 0xF0C
+#define MV64340_PCI_1_CS_2_BASE_HIGH_ADDR_REMAP 0xF8C
+#define MV64340_PCI_0_CS_3_BASE_HIGH_ADDR_REMAP 0xF10
+#define MV64340_PCI_1_CS_3_BASE_HIGH_ADDR_REMAP 0xF90
+#define MV64340_PCI_0_DEVCS_0_BASE_ADDR_REMAP 0xc50
+#define MV64340_PCI_1_DEVCS_0_BASE_ADDR_REMAP 0xcd0
+#define MV64340_PCI_0_DEVCS_1_BASE_ADDR_REMAP 0xd50
+#define MV64340_PCI_1_DEVCS_1_BASE_ADDR_REMAP 0xdd0
+#define MV64340_PCI_0_DEVCS_2_BASE_ADDR_REMAP 0xd58
+#define MV64340_PCI_1_DEVCS_2_BASE_ADDR_REMAP 0xdd8
+#define MV64340_PCI_0_DEVCS_3_BASE_ADDR_REMAP 0xc54
+#define MV64340_PCI_1_DEVCS_3_BASE_ADDR_REMAP 0xcd4
+#define MV64340_PCI_0_DEVCS_BOOTCS_BASE_ADDR_REMAP 0xd54
+#define MV64340_PCI_1_DEVCS_BOOTCS_BASE_ADDR_REMAP 0xdd4
+#define MV64340_PCI_0_P2P_MEM0_BASE_ADDR_REMAP_LOW 0xd5c
+#define MV64340_PCI_1_P2P_MEM0_BASE_ADDR_REMAP_LOW 0xddc
+#define MV64340_PCI_0_P2P_MEM0_BASE_ADDR_REMAP_HIGH 0xd60
+#define MV64340_PCI_1_P2P_MEM0_BASE_ADDR_REMAP_HIGH 0xde0
+#define MV64340_PCI_0_P2P_MEM1_BASE_ADDR_REMAP_LOW 0xd64
+#define MV64340_PCI_1_P2P_MEM1_BASE_ADDR_REMAP_LOW 0xde4
+#define MV64340_PCI_0_P2P_MEM1_BASE_ADDR_REMAP_HIGH 0xd68
+#define MV64340_PCI_1_P2P_MEM1_BASE_ADDR_REMAP_HIGH 0xde8
+#define MV64340_PCI_0_P2P_I_O_BASE_ADDR_REMAP 0xd6c
+#define MV64340_PCI_1_P2P_I_O_BASE_ADDR_REMAP 0xdec
+#define MV64340_PCI_0_CPU_BASE_ADDR_REMAP_LOW 0xd70
+#define MV64340_PCI_1_CPU_BASE_ADDR_REMAP_LOW 0xdf0
+#define MV64340_PCI_0_CPU_BASE_ADDR_REMAP_HIGH 0xd74
+#define MV64340_PCI_1_CPU_BASE_ADDR_REMAP_HIGH 0xdf4
+#define MV64340_PCI_0_INTEGRATED_SRAM_BASE_ADDR_REMAP 0xf00
+#define MV64340_PCI_1_INTEGRATED_SRAM_BASE_ADDR_REMAP 0xf80
+#define MV64340_PCI_0_EXPANSION_ROM_BASE_ADDR_REMAP 0xf38
+#define MV64340_PCI_1_EXPANSION_ROM_BASE_ADDR_REMAP 0xfb8
+#define MV64340_PCI_0_ADDR_DECODE_CONTROL 0xd3c
+#define MV64340_PCI_1_ADDR_DECODE_CONTROL 0xdbc
+#define MV64340_PCI_0_HEADERS_RETARGET_CONTROL 0xF40
+#define MV64340_PCI_1_HEADERS_RETARGET_CONTROL 0xFc0
+#define MV64340_PCI_0_HEADERS_RETARGET_BASE 0xF44
+#define MV64340_PCI_1_HEADERS_RETARGET_BASE 0xFc4
+#define MV64340_PCI_0_HEADERS_RETARGET_HIGH 0xF48
+#define MV64340_PCI_1_HEADERS_RETARGET_HIGH 0xFc8
+
+/***********************************/
+/* PCI Control Register Map */
+/***********************************/
+
+#define MV64340_PCI_0_DLL_STATUS_AND_COMMAND 0x1d20
+#define MV64340_PCI_1_DLL_STATUS_AND_COMMAND 0x1da0
+#define MV64340_PCI_0_MPP_PADS_DRIVE_CONTROL 0x1d1C
+#define MV64340_PCI_1_MPP_PADS_DRIVE_CONTROL 0x1d9C
+#define MV64340_PCI_0_COMMAND 0xc00
+#define MV64340_PCI_1_COMMAND 0xc80
+#define MV64340_PCI_0_MODE 0xd00
+#define MV64340_PCI_1_MODE 0xd80
+#define MV64340_PCI_0_RETRY 0xc04
+#define MV64340_PCI_1_RETRY 0xc84
+#define MV64340_PCI_0_READ_BUFFER_DISCARD_TIMER 0xd04
+#define MV64340_PCI_1_READ_BUFFER_DISCARD_TIMER 0xd84
+#define MV64340_PCI_0_MSI_TRIGGER_TIMER 0xc38
+#define MV64340_PCI_1_MSI_TRIGGER_TIMER 0xcb8
+#define MV64340_PCI_0_ARBITER_CONTROL 0x1d00
+#define MV64340_PCI_1_ARBITER_CONTROL 0x1d80
+#define MV64340_PCI_0_CROSS_BAR_CONTROL_LOW 0x1d08
+#define MV64340_PCI_1_CROSS_BAR_CONTROL_LOW 0x1d88
+#define MV64340_PCI_0_CROSS_BAR_CONTROL_HIGH 0x1d0c
+#define MV64340_PCI_1_CROSS_BAR_CONTROL_HIGH 0x1d8c
+#define MV64340_PCI_0_CROSS_BAR_TIMEOUT 0x1d04
+#define MV64340_PCI_1_CROSS_BAR_TIMEOUT 0x1d84
+#define MV64340_PCI_0_SYNC_BARRIER_TRIGGER_REG 0x1D18
+#define MV64340_PCI_1_SYNC_BARRIER_TRIGGER_REG 0x1D98
+#define MV64340_PCI_0_SYNC_BARRIER_VIRTUAL_REG 0x1d10
+#define MV64340_PCI_1_SYNC_BARRIER_VIRTUAL_REG 0x1d90
+#define MV64340_PCI_0_P2P_CONFIG 0x1d14
+#define MV64340_PCI_1_P2P_CONFIG 0x1d94
+
+#define MV64340_PCI_0_ACCESS_CONTROL_BASE_0_LOW 0x1e00
+#define MV64340_PCI_0_ACCESS_CONTROL_BASE_0_HIGH 0x1e04
+#define MV64340_PCI_0_ACCESS_CONTROL_SIZE_0 0x1e08
+#define MV64340_PCI_0_ACCESS_CONTROL_BASE_1_LOW 0x1e10
+#define MV64340_PCI_0_ACCESS_CONTROL_BASE_1_HIGH 0x1e14
+#define MV64340_PCI_0_ACCESS_CONTROL_SIZE_1 0x1e18
+#define MV64340_PCI_0_ACCESS_CONTROL_BASE_2_LOW 0x1e20
+#define MV64340_PCI_0_ACCESS_CONTROL_BASE_2_HIGH 0x1e24
+#define MV64340_PCI_0_ACCESS_CONTROL_SIZE_2 0x1e28
+#define MV64340_PCI_0_ACCESS_CONTROL_BASE_3_LOW 0x1e30
+#define MV64340_PCI_0_ACCESS_CONTROL_BASE_3_HIGH 0x1e34
+#define MV64340_PCI_0_ACCESS_CONTROL_SIZE_3 0x1e38
+#define MV64340_PCI_0_ACCESS_CONTROL_BASE_4_LOW 0x1e40
+#define MV64340_PCI_0_ACCESS_CONTROL_BASE_4_HIGH 0x1e44
+#define MV64340_PCI_0_ACCESS_CONTROL_SIZE_4 0x1e48
+#define MV64340_PCI_0_ACCESS_CONTROL_BASE_5_LOW 0x1e50
+#define MV64340_PCI_0_ACCESS_CONTROL_BASE_5_HIGH 0x1e54
+#define MV64340_PCI_0_ACCESS_CONTROL_SIZE_5 0x1e58
+
+#define MV64340_PCI_1_ACCESS_CONTROL_BASE_0_LOW 0x1e80
+#define MV64340_PCI_1_ACCESS_CONTROL_BASE_0_HIGH 0x1e84
+#define MV64340_PCI_1_ACCESS_CONTROL_SIZE_0 0x1e88
+#define MV64340_PCI_1_ACCESS_CONTROL_BASE_1_LOW 0x1e90
+#define MV64340_PCI_1_ACCESS_CONTROL_BASE_1_HIGH 0x1e94
+#define MV64340_PCI_1_ACCESS_CONTROL_SIZE_1 0x1e98
+#define MV64340_PCI_1_ACCESS_CONTROL_BASE_2_LOW 0x1ea0
+#define MV64340_PCI_1_ACCESS_CONTROL_BASE_2_HIGH 0x1ea4
+#define MV64340_PCI_1_ACCESS_CONTROL_SIZE_2 0x1ea8
+#define MV64340_PCI_1_ACCESS_CONTROL_BASE_3_LOW 0x1eb0
+#define MV64340_PCI_1_ACCESS_CONTROL_BASE_3_HIGH 0x1eb4
+#define MV64340_PCI_1_ACCESS_CONTROL_SIZE_3 0x1eb8
+#define MV64340_PCI_1_ACCESS_CONTROL_BASE_4_LOW 0x1ec0
+#define MV64340_PCI_1_ACCESS_CONTROL_BASE_4_HIGH 0x1ec4
+#define MV64340_PCI_1_ACCESS_CONTROL_SIZE_4 0x1ec8
+#define MV64340_PCI_1_ACCESS_CONTROL_BASE_5_LOW 0x1ed0
+#define MV64340_PCI_1_ACCESS_CONTROL_BASE_5_HIGH 0x1ed4
+#define MV64340_PCI_1_ACCESS_CONTROL_SIZE_5 0x1ed8
+
+/****************************************/
+/* PCI Configuration Access Registers */
+/****************************************/
+
+#define MV64340_PCI_0_CONFIG_ADDR 0xcf8
+#define MV64340_PCI_0_CONFIG_DATA_VIRTUAL_REG 0xcfc
+#define MV64340_PCI_1_CONFIG_ADDR 0xc78
+#define MV64340_PCI_1_CONFIG_DATA_VIRTUAL_REG 0xc7c
+#define MV64340_PCI_0_INTERRUPT_ACKNOWLEDGE_VIRTUAL_REG 0xc34
+#define MV64340_PCI_1_INTERRUPT_ACKNOWLEDGE_VIRTUAL_REG 0xcb4
+
+/****************************************/
+/* PCI Error Report Registers */
+/****************************************/
+
+#define MV64340_PCI_0_SERR_MASK 0xc28
+#define MV64340_PCI_1_SERR_MASK 0xca8
+#define MV64340_PCI_0_ERROR_ADDR_LOW 0x1d40
+#define MV64340_PCI_1_ERROR_ADDR_LOW 0x1dc0
+#define MV64340_PCI_0_ERROR_ADDR_HIGH 0x1d44
+#define MV64340_PCI_1_ERROR_ADDR_HIGH 0x1dc4
+#define MV64340_PCI_0_ERROR_ATTRIBUTE 0x1d48
+#define MV64340_PCI_1_ERROR_ATTRIBUTE 0x1dc8
+#define MV64340_PCI_0_ERROR_COMMAND 0x1d50
+#define MV64340_PCI_1_ERROR_COMMAND 0x1dd0
+#define MV64340_PCI_0_ERROR_CAUSE 0x1d58
+#define MV64340_PCI_1_ERROR_CAUSE 0x1dd8
+#define MV64340_PCI_0_ERROR_MASK 0x1d5c
+#define MV64340_PCI_1_ERROR_MASK 0x1ddc
+
+/****************************************/
+/* PCI Debug Registers */
+/****************************************/
+
+#define MV64340_PCI_0_MMASK 0X1D24
+#define MV64340_PCI_1_MMASK 0X1DA4
+
+/*********************************************/
+/* PCI Configuration, Function 0, Registers */
+/*********************************************/
+
+#define MV64340_PCI_DEVICE_AND_VENDOR_ID 0x000
+#define MV64340_PCI_STATUS_AND_COMMAND 0x004
+#define MV64340_PCI_CLASS_CODE_AND_REVISION_ID 0x008
+#define MV64340_PCI_BIST_HEADER_TYPE_LATENCY_TIMER_CACHE_LINE 0x00C
+
+#define MV64340_PCI_SCS_0_BASE_ADDR_LOW 0x010
+#define MV64340_PCI_SCS_0_BASE_ADDR_HIGH 0x014
+#define MV64340_PCI_SCS_1_BASE_ADDR_LOW 0x018
+#define MV64340_PCI_SCS_1_BASE_ADDR_HIGH 0x01C
+#define MV64340_PCI_INTERNAL_REG_MEM_MAPPED_BASE_ADDR_LOW 0x020
+#define MV64340_PCI_INTERNAL_REG_MEM_MAPPED_BASE_ADDR_HIGH 0x024
+#define MV64340_PCI_SUBSYSTEM_ID_AND_SUBSYSTEM_VENDOR_ID 0x02c
+#define MV64340_PCI_EXPANSION_ROM_BASE_ADDR_REG 0x030
+#define MV64340_PCI_CAPABILTY_LIST_POINTER 0x034
+#define MV64340_PCI_INTERRUPT_PIN_AND_LINE 0x03C
+ /* capability list */
+#define MV64340_PCI_POWER_MANAGEMENT_CAPABILITY 0x040
+#define MV64340_PCI_POWER_MANAGEMENT_STATUS_AND_CONTROL 0x044
+#define MV64340_PCI_VPD_ADDR 0x048
+#define MV64340_PCI_VPD_DATA 0x04c
+#define MV64340_PCI_MSI_MESSAGE_CONTROL 0x050
+#define MV64340_PCI_MSI_MESSAGE_ADDR 0x054
+#define MV64340_PCI_MSI_MESSAGE_UPPER_ADDR 0x058
+#define MV64340_PCI_MSI_MESSAGE_DATA 0x05c
+#define MV64340_PCI_X_COMMAND 0x060
+#define MV64340_PCI_X_STATUS 0x064
+#define MV64340_PCI_COMPACT_PCI_HOT_SWAP 0x068
+
+/***********************************************/
+/* PCI Configuration, Function 1, Registers */
+/***********************************************/
+
+#define MV64340_PCI_SCS_2_BASE_ADDR_LOW 0x110
+#define MV64340_PCI_SCS_2_BASE_ADDR_HIGH 0x114
+#define MV64340_PCI_SCS_3_BASE_ADDR_LOW 0x118
+#define MV64340_PCI_SCS_3_BASE_ADDR_HIGH 0x11c
+#define MV64340_PCI_INTERNAL_SRAM_BASE_ADDR_LOW 0x120
+#define MV64340_PCI_INTERNAL_SRAM_BASE_ADDR_HIGH 0x124
+
+/***********************************************/
+/* PCI Configuration, Function 2, Registers */
+/***********************************************/
+
+#define MV64340_PCI_DEVCS_0_BASE_ADDR_LOW 0x210
+#define MV64340_PCI_DEVCS_0_BASE_ADDR_HIGH 0x214
+#define MV64340_PCI_DEVCS_1_BASE_ADDR_LOW 0x218
+#define MV64340_PCI_DEVCS_1_BASE_ADDR_HIGH 0x21c
+#define MV64340_PCI_DEVCS_2_BASE_ADDR_LOW 0x220
+#define MV64340_PCI_DEVCS_2_BASE_ADDR_HIGH 0x224
+
+/***********************************************/
+/* PCI Configuration, Function 3, Registers */
+/***********************************************/
+
+#define MV64340_PCI_DEVCS_3_BASE_ADDR_LOW 0x310
+#define MV64340_PCI_DEVCS_3_BASE_ADDR_HIGH 0x314
+#define MV64340_PCI_BOOT_CS_BASE_ADDR_LOW 0x318
+#define MV64340_PCI_BOOT_CS_BASE_ADDR_HIGH 0x31c
+#define MV64340_PCI_CPU_BASE_ADDR_LOW 0x220
+#define MV64340_PCI_CPU_BASE_ADDR_HIGH 0x224
+
+/***********************************************/
+/* PCI Configuration, Function 4, Registers */
+/***********************************************/
+
+#define MV64340_PCI_P2P_MEM0_BASE_ADDR_LOW 0x410
+#define MV64340_PCI_P2P_MEM0_BASE_ADDR_HIGH 0x414
+#define MV64340_PCI_P2P_MEM1_BASE_ADDR_LOW 0x418
+#define MV64340_PCI_P2P_MEM1_BASE_ADDR_HIGH 0x41c
+#define MV64340_PCI_P2P_I_O_BASE_ADDR 0x420
+#define MV64340_PCI_INTERNAL_REGS_I_O_MAPPED_BASE_ADDR 0x424
+
+/****************************************/
+/* Messaging Unit Registers (I20) */
+/****************************************/
+
+#define MV64340_I2O_INBOUND_MESSAGE_REG0_PCI_0_SIDE 0x010
+#define MV64340_I2O_INBOUND_MESSAGE_REG1_PCI_0_SIDE 0x014
+#define MV64340_I2O_OUTBOUND_MESSAGE_REG0_PCI_0_SIDE 0x018
+#define MV64340_I2O_OUTBOUND_MESSAGE_REG1_PCI_0_SIDE 0x01C
+#define MV64340_I2O_INBOUND_DOORBELL_REG_PCI_0_SIDE 0x020
+#define MV64340_I2O_INBOUND_INTERRUPT_CAUSE_REG_PCI_0_SIDE 0x024
+#define MV64340_I2O_INBOUND_INTERRUPT_MASK_REG_PCI_0_SIDE 0x028
+#define MV64340_I2O_OUTBOUND_DOORBELL_REG_PCI_0_SIDE 0x02C
+#define MV64340_I2O_OUTBOUND_INTERRUPT_CAUSE_REG_PCI_0_SIDE 0x030
+#define MV64340_I2O_OUTBOUND_INTERRUPT_MASK_REG_PCI_0_SIDE 0x034
+#define MV64340_I2O_INBOUND_QUEUE_PORT_VIRTUAL_REG_PCI_0_SIDE 0x040
+#define MV64340_I2O_OUTBOUND_QUEUE_PORT_VIRTUAL_REG_PCI_0_SIDE 0x044
+#define MV64340_I2O_QUEUE_CONTROL_REG_PCI_0_SIDE 0x050
+#define MV64340_I2O_QUEUE_BASE_ADDR_REG_PCI_0_SIDE 0x054
+#define MV64340_I2O_INBOUND_FREE_HEAD_POINTER_REG_PCI_0_SIDE 0x060
+#define MV64340_I2O_INBOUND_FREE_TAIL_POINTER_REG_PCI_0_SIDE 0x064
+#define MV64340_I2O_INBOUND_POST_HEAD_POINTER_REG_PCI_0_SIDE 0x068
+#define MV64340_I2O_INBOUND_POST_TAIL_POINTER_REG_PCI_0_SIDE 0x06C
+#define MV64340_I2O_OUTBOUND_FREE_HEAD_POINTER_REG_PCI_0_SIDE 0x070
+#define MV64340_I2O_OUTBOUND_FREE_TAIL_POINTER_REG_PCI_0_SIDE 0x074
+#define MV64340_I2O_OUTBOUND_POST_HEAD_POINTER_REG_PCI_0_SIDE 0x0F8
+#define MV64340_I2O_OUTBOUND_POST_TAIL_POINTER_REG_PCI_0_SIDE 0x0FC
+
+#define MV64340_I2O_INBOUND_MESSAGE_REG0_PCI_1_SIDE 0x090
+#define MV64340_I2O_INBOUND_MESSAGE_REG1_PCI_1_SIDE 0x094
+#define MV64340_I2O_OUTBOUND_MESSAGE_REG0_PCI_1_SIDE 0x098
+#define MV64340_I2O_OUTBOUND_MESSAGE_REG1_PCI_1_SIDE 0x09C
+#define MV64340_I2O_INBOUND_DOORBELL_REG_PCI_1_SIDE 0x0A0
+#define MV64340_I2O_INBOUND_INTERRUPT_CAUSE_REG_PCI_1_SIDE 0x0A4
+#define MV64340_I2O_INBOUND_INTERRUPT_MASK_REG_PCI_1_SIDE 0x0A8
+#define MV64340_I2O_OUTBOUND_DOORBELL_REG_PCI_1_SIDE 0x0AC
+#define MV64340_I2O_OUTBOUND_INTERRUPT_CAUSE_REG_PCI_1_SIDE 0x0B0
+#define MV64340_I2O_OUTBOUND_INTERRUPT_MASK_REG_PCI_1_SIDE 0x0B4
+#define MV64340_I2O_INBOUND_QUEUE_PORT_VIRTUAL_REG_PCI_1_SIDE 0x0C0
+#define MV64340_I2O_OUTBOUND_QUEUE_PORT_VIRTUAL_REG_PCI_1_SIDE 0x0C4
+#define MV64340_I2O_QUEUE_CONTROL_REG_PCI_1_SIDE 0x0D0
+#define MV64340_I2O_QUEUE_BASE_ADDR_REG_PCI_1_SIDE 0x0D4
+#define MV64340_I2O_INBOUND_FREE_HEAD_POINTER_REG_PCI_1_SIDE 0x0E0
+#define MV64340_I2O_INBOUND_FREE_TAIL_POINTER_REG_PCI_1_SIDE 0x0E4
+#define MV64340_I2O_INBOUND_POST_HEAD_POINTER_REG_PCI_1_SIDE 0x0E8
+#define MV64340_I2O_INBOUND_POST_TAIL_POINTER_REG_PCI_1_SIDE 0x0EC
+#define MV64340_I2O_OUTBOUND_FREE_HEAD_POINTER_REG_PCI_1_SIDE 0x0F0
+#define MV64340_I2O_OUTBOUND_FREE_TAIL_POINTER_REG_PCI_1_SIDE 0x0F4
+#define MV64340_I2O_OUTBOUND_POST_HEAD_POINTER_REG_PCI_1_SIDE 0x078
+#define MV64340_I2O_OUTBOUND_POST_TAIL_POINTER_REG_PCI_1_SIDE 0x07C
+
+#define MV64340_I2O_INBOUND_MESSAGE_REG0_CPU0_SIDE 0x1C10
+#define MV64340_I2O_INBOUND_MESSAGE_REG1_CPU0_SIDE 0x1C14
+#define MV64340_I2O_OUTBOUND_MESSAGE_REG0_CPU0_SIDE 0x1C18
+#define MV64340_I2O_OUTBOUND_MESSAGE_REG1_CPU0_SIDE 0x1C1C
+#define MV64340_I2O_INBOUND_DOORBELL_REG_CPU0_SIDE 0x1C20
+#define MV64340_I2O_INBOUND_INTERRUPT_CAUSE_REG_CPU0_SIDE 0x1C24
+#define MV64340_I2O_INBOUND_INTERRUPT_MASK_REG_CPU0_SIDE 0x1C28
+#define MV64340_I2O_OUTBOUND_DOORBELL_REG_CPU0_SIDE 0x1C2C
+#define MV64340_I2O_OUTBOUND_INTERRUPT_CAUSE_REG_CPU0_SIDE 0x1C30
+#define MV64340_I2O_OUTBOUND_INTERRUPT_MASK_REG_CPU0_SIDE 0x1C34
+#define MV64340_I2O_INBOUND_QUEUE_PORT_VIRTUAL_REG_CPU0_SIDE 0x1C40
+#define MV64340_I2O_OUTBOUND_QUEUE_PORT_VIRTUAL_REG_CPU0_SIDE 0x1C44
+#define MV64340_I2O_QUEUE_CONTROL_REG_CPU0_SIDE 0x1C50
+#define MV64340_I2O_QUEUE_BASE_ADDR_REG_CPU0_SIDE 0x1C54
+#define MV64340_I2O_INBOUND_FREE_HEAD_POINTER_REG_CPU0_SIDE 0x1C60
+#define MV64340_I2O_INBOUND_FREE_TAIL_POINTER_REG_CPU0_SIDE 0x1C64
+#define MV64340_I2O_INBOUND_POST_HEAD_POINTER_REG_CPU0_SIDE 0x1C68
+#define MV64340_I2O_INBOUND_POST_TAIL_POINTER_REG_CPU0_SIDE 0x1C6C
+#define MV64340_I2O_OUTBOUND_FREE_HEAD_POINTER_REG_CPU0_SIDE 0x1C70
+#define MV64340_I2O_OUTBOUND_FREE_TAIL_POINTER_REG_CPU0_SIDE 0x1C74
+#define MV64340_I2O_OUTBOUND_POST_HEAD_POINTER_REG_CPU0_SIDE 0x1CF8
+#define MV64340_I2O_OUTBOUND_POST_TAIL_POINTER_REG_CPU0_SIDE 0x1CFC
+#define MV64340_I2O_INBOUND_MESSAGE_REG0_CPU1_SIDE 0x1C90
+#define MV64340_I2O_INBOUND_MESSAGE_REG1_CPU1_SIDE 0x1C94
+#define MV64340_I2O_OUTBOUND_MESSAGE_REG0_CPU1_SIDE 0x1C98
+#define MV64340_I2O_OUTBOUND_MESSAGE_REG1_CPU1_SIDE 0x1C9C
+#define MV64340_I2O_INBOUND_DOORBELL_REG_CPU1_SIDE 0x1CA0
+#define MV64340_I2O_INBOUND_INTERRUPT_CAUSE_REG_CPU1_SIDE 0x1CA4
+#define MV64340_I2O_INBOUND_INTERRUPT_MASK_REG_CPU1_SIDE 0x1CA8
+#define MV64340_I2O_OUTBOUND_DOORBELL_REG_CPU1_SIDE 0x1CAC
+#define MV64340_I2O_OUTBOUND_INTERRUPT_CAUSE_REG_CPU1_SIDE 0x1CB0
+#define MV64340_I2O_OUTBOUND_INTERRUPT_MASK_REG_CPU1_SIDE 0x1CB4
+#define MV64340_I2O_INBOUND_QUEUE_PORT_VIRTUAL_REG_CPU1_SIDE 0x1CC0
+#define MV64340_I2O_OUTBOUND_QUEUE_PORT_VIRTUAL_REG_CPU1_SIDE 0x1CC4
+#define MV64340_I2O_QUEUE_CONTROL_REG_CPU1_SIDE 0x1CD0
+#define MV64340_I2O_QUEUE_BASE_ADDR_REG_CPU1_SIDE 0x1CD4
+#define MV64340_I2O_INBOUND_FREE_HEAD_POINTER_REG_CPU1_SIDE 0x1CE0
+#define MV64340_I2O_INBOUND_FREE_TAIL_POINTER_REG_CPU1_SIDE 0x1CE4
+#define MV64340_I2O_INBOUND_POST_HEAD_POINTER_REG_CPU1_SIDE 0x1CE8
+#define MV64340_I2O_INBOUND_POST_TAIL_POINTER_REG_CPU1_SIDE 0x1CEC
+#define MV64340_I2O_OUTBOUND_FREE_HEAD_POINTER_REG_CPU1_SIDE 0x1CF0
+#define MV64340_I2O_OUTBOUND_FREE_TAIL_POINTER_REG_CPU1_SIDE 0x1CF4
+#define MV64340_I2O_OUTBOUND_POST_HEAD_POINTER_REG_CPU1_SIDE 0x1C78
+#define MV64340_I2O_OUTBOUND_POST_TAIL_POINTER_REG_CPU1_SIDE 0x1C7C
+
+/****************************************/
+/* Ethernet Unit Registers */
+/****************************************/
+
+/*******************************************/
+/* CUNIT Registers */
+/*******************************************/
+
+ /* Address Decoding Register Map */
+
+#define MV64340_CUNIT_BASE_ADDR_REG0 0xf200
+#define MV64340_CUNIT_BASE_ADDR_REG1 0xf208
+#define MV64340_CUNIT_BASE_ADDR_REG2 0xf210
+#define MV64340_CUNIT_BASE_ADDR_REG3 0xf218
+#define MV64340_CUNIT_SIZE0 0xf204
+#define MV64340_CUNIT_SIZE1 0xf20c
+#define MV64340_CUNIT_SIZE2 0xf214
+#define MV64340_CUNIT_SIZE3 0xf21c
+#define MV64340_CUNIT_HIGH_ADDR_REMAP_REG0 0xf240
+#define MV64340_CUNIT_HIGH_ADDR_REMAP_REG1 0xf244
+#define MV64340_CUNIT_BASE_ADDR_ENABLE_REG 0xf250
+#define MV64340_MPSC0_ACCESS_PROTECTION_REG 0xf254
+#define MV64340_MPSC1_ACCESS_PROTECTION_REG 0xf258
+#define MV64340_CUNIT_INTERNAL_SPACE_BASE_ADDR_REG 0xf25C
+
+ /* Error Report Registers */
+
+#define MV64340_CUNIT_INTERRUPT_CAUSE_REG 0xf310
+#define MV64340_CUNIT_INTERRUPT_MASK_REG 0xf314
+#define MV64340_CUNIT_ERROR_ADDR 0xf318
+
+ /* Cunit Control Registers */
+
+#define MV64340_CUNIT_ARBITER_CONTROL_REG 0xf300
+#define MV64340_CUNIT_CONFIG_REG 0xb40c
+#define MV64340_CUNIT_CRROSBAR_TIMEOUT_REG 0xf304
+
+ /* Cunit Debug Registers */
+
+#define MV64340_CUNIT_DEBUG_LOW 0xf340
+#define MV64340_CUNIT_DEBUG_HIGH 0xf344
+#define MV64340_CUNIT_MMASK 0xf380
+
+ /* MPSCs Clocks Routing Registers */
+
+#define MV64340_MPSC_ROUTING_REG 0xb400
+#define MV64340_MPSC_RX_CLOCK_ROUTING_REG 0xb404
+#define MV64340_MPSC_TX_CLOCK_ROUTING_REG 0xb408
+
+ /* MPSCs Interrupts Registers */
+
+#define MV64340_MPSC_CAUSE_REG(port) (0xb804 + (port << 3))
+#define MV64340_MPSC_MASK_REG(port) (0xb884 + (port << 3))
+
+#define MV64340_MPSC_MAIN_CONFIG_LOW(port) (0x8000 + (port << 12))
+#define MV64340_MPSC_MAIN_CONFIG_HIGH(port) (0x8004 + (port << 12))
+#define MV64340_MPSC_PROTOCOL_CONFIG(port) (0x8008 + (port << 12))
+#define MV64340_MPSC_CHANNEL_REG1(port) (0x800c + (port << 12))
+#define MV64340_MPSC_CHANNEL_REG2(port) (0x8010 + (port << 12))
+#define MV64340_MPSC_CHANNEL_REG3(port) (0x8014 + (port << 12))
+#define MV64340_MPSC_CHANNEL_REG4(port) (0x8018 + (port << 12))
+#define MV64340_MPSC_CHANNEL_REG5(port) (0x801c + (port << 12))
+#define MV64340_MPSC_CHANNEL_REG6(port) (0x8020 + (port << 12))
+#define MV64340_MPSC_CHANNEL_REG7(port) (0x8024 + (port << 12))
+#define MV64340_MPSC_CHANNEL_REG8(port) (0x8028 + (port << 12))
+#define MV64340_MPSC_CHANNEL_REG9(port) (0x802c + (port << 12))
+#define MV64340_MPSC_CHANNEL_REG10(port) (0x8030 + (port << 12))
+
+ /* MPSC0 Registers */
+
+
+/***************************************/
+/* SDMA Registers */
+/***************************************/
+
+#define MV64340_SDMA_CONFIG_REG(channel) (0x4000 + (channel << 13))
+#define MV64340_SDMA_COMMAND_REG(channel) (0x4008 + (channel << 13))
+#define MV64340_SDMA_CURRENT_RX_DESCRIPTOR_POINTER(channel) (0x4810 + (channel << 13))
+#define MV64340_SDMA_CURRENT_TX_DESCRIPTOR_POINTER(channel) (0x4c10 + (channel << 13))
+#define MV64340_SDMA_FIRST_TX_DESCRIPTOR_POINTER(channel) (0x4c14 + (channel << 13))
+
+#define MV64340_SDMA_CAUSE_REG 0xb800
+#define MV64340_SDMA_MASK_REG 0xb880
+
+/* BRG Interrupts */
+
+#define MV64340_BRG_CONFIG_REG(brg) (0xb200 + (brg << 3))
+#define MV64340_BRG_BAUDE_TUNING_REG(brg) (0xb208 + (brg << 3))
+#define MV64340_BRG_CAUSE_REG 0xb834
+#define MV64340_BRG_MASK_REG 0xb8b4
+
+/****************************************/
+/* DMA Channel Control */
+/****************************************/
+
+#define MV64340_DMA_CHANNEL0_CONTROL 0x840
+#define MV64340_DMA_CHANNEL0_CONTROL_HIGH 0x880
+#define MV64340_DMA_CHANNEL1_CONTROL 0x844
+#define MV64340_DMA_CHANNEL1_CONTROL_HIGH 0x884
+#define MV64340_DMA_CHANNEL2_CONTROL 0x848
+#define MV64340_DMA_CHANNEL2_CONTROL_HIGH 0x888
+#define MV64340_DMA_CHANNEL3_CONTROL 0x84C
+#define MV64340_DMA_CHANNEL3_CONTROL_HIGH 0x88C
+
+
+/****************************************/
+/* IDMA Registers */
+/****************************************/
+
+#define MV64340_DMA_CHANNEL0_BYTE_COUNT 0x800
+#define MV64340_DMA_CHANNEL1_BYTE_COUNT 0x804
+#define MV64340_DMA_CHANNEL2_BYTE_COUNT 0x808
+#define MV64340_DMA_CHANNEL3_BYTE_COUNT 0x80C
+#define MV64340_DMA_CHANNEL0_SOURCE_ADDR 0x810
+#define MV64340_DMA_CHANNEL1_SOURCE_ADDR 0x814
+#define MV64340_DMA_CHANNEL2_SOURCE_ADDR 0x818
+#define MV64340_DMA_CHANNEL3_SOURCE_ADDR 0x81c
+#define MV64340_DMA_CHANNEL0_DESTINATION_ADDR 0x820
+#define MV64340_DMA_CHANNEL1_DESTINATION_ADDR 0x824
+#define MV64340_DMA_CHANNEL2_DESTINATION_ADDR 0x828
+#define MV64340_DMA_CHANNEL3_DESTINATION_ADDR 0x82C
+#define MV64340_DMA_CHANNEL0_NEXT_DESCRIPTOR_POINTER 0x830
+#define MV64340_DMA_CHANNEL1_NEXT_DESCRIPTOR_POINTER 0x834
+#define MV64340_DMA_CHANNEL2_NEXT_DESCRIPTOR_POINTER 0x838
+#define MV64340_DMA_CHANNEL3_NEXT_DESCRIPTOR_POINTER 0x83C
+#define MV64340_DMA_CHANNEL0_CURRENT_DESCRIPTOR_POINTER 0x870
+#define MV64340_DMA_CHANNEL1_CURRENT_DESCRIPTOR_POINTER 0x874
+#define MV64340_DMA_CHANNEL2_CURRENT_DESCRIPTOR_POINTER 0x878
+#define MV64340_DMA_CHANNEL3_CURRENT_DESCRIPTOR_POINTER 0x87C
+
+ /* IDMA Address Decoding Base Address Registers */
+
+#define MV64340_DMA_BASE_ADDR_REG0 0xa00
+#define MV64340_DMA_BASE_ADDR_REG1 0xa08
+#define MV64340_DMA_BASE_ADDR_REG2 0xa10
+#define MV64340_DMA_BASE_ADDR_REG3 0xa18
+#define MV64340_DMA_BASE_ADDR_REG4 0xa20
+#define MV64340_DMA_BASE_ADDR_REG5 0xa28
+#define MV64340_DMA_BASE_ADDR_REG6 0xa30
+#define MV64340_DMA_BASE_ADDR_REG7 0xa38
+
+ /* IDMA Address Decoding Size Address Register */
+
+#define MV64340_DMA_SIZE_REG0 0xa04
+#define MV64340_DMA_SIZE_REG1 0xa0c
+#define MV64340_DMA_SIZE_REG2 0xa14
+#define MV64340_DMA_SIZE_REG3 0xa1c
+#define MV64340_DMA_SIZE_REG4 0xa24
+#define MV64340_DMA_SIZE_REG5 0xa2c
+#define MV64340_DMA_SIZE_REG6 0xa34
+#define MV64340_DMA_SIZE_REG7 0xa3C
+
+ /* IDMA Address Decoding High Address Remap and Access Protection Registers */
+
+#define MV64340_DMA_HIGH_ADDR_REMAP_REG0 0xa60
+#define MV64340_DMA_HIGH_ADDR_REMAP_REG1 0xa64
+#define MV64340_DMA_HIGH_ADDR_REMAP_REG2 0xa68
+#define MV64340_DMA_HIGH_ADDR_REMAP_REG3 0xa6C
+#define MV64340_DMA_BASE_ADDR_ENABLE_REG 0xa80
+#define MV64340_DMA_CHANNEL0_ACCESS_PROTECTION_REG 0xa70
+#define MV64340_DMA_CHANNEL1_ACCESS_PROTECTION_REG 0xa74
+#define MV64340_DMA_CHANNEL2_ACCESS_PROTECTION_REG 0xa78
+#define MV64340_DMA_CHANNEL3_ACCESS_PROTECTION_REG 0xa7c
+#define MV64340_DMA_ARBITER_CONTROL 0x860
+#define MV64340_DMA_CROSS_BAR_TIMEOUT 0x8d0
+
+ /* IDMA Headers Retarget Registers */
+
+#define MV64340_DMA_HEADERS_RETARGET_CONTROL 0xa84
+#define MV64340_DMA_HEADERS_RETARGET_BASE 0xa88
+
+ /* IDMA Interrupt Register */
+
+#define MV64340_DMA_INTERRUPT_CAUSE_REG 0x8c0
+#define MV64340_DMA_INTERRUPT_CAUSE_MASK 0x8c4
+#define MV64340_DMA_ERROR_ADDR 0x8c8
+#define MV64340_DMA_ERROR_SELECT 0x8cc
+
+ /* IDMA Debug Register ( for internal use ) */
+
+#define MV64340_DMA_DEBUG_LOW 0x8e0
+#define MV64340_DMA_DEBUG_HIGH 0x8e4
+#define MV64340_DMA_SPARE 0xA8C
+
+/****************************************/
+/* Timer_Counter */
+/****************************************/
+
+#define MV64340_TIMER_COUNTER0 0x850
+#define MV64340_TIMER_COUNTER1 0x854
+#define MV64340_TIMER_COUNTER2 0x858
+#define MV64340_TIMER_COUNTER3 0x85C
+#define MV64340_TIMER_COUNTER_0_3_CONTROL 0x864
+#define MV64340_TIMER_COUNTER_0_3_INTERRUPT_CAUSE 0x868
+#define MV64340_TIMER_COUNTER_0_3_INTERRUPT_MASK 0x86c
+
+/****************************************/
+/* Watchdog registers */
+/****************************************/
+
+#define MV64340_WATCHDOG_CONFIG_REG 0xb410
+#define MV64340_WATCHDOG_VALUE_REG 0xb414
+
+/****************************************/
+/* I2C Registers */
+/****************************************/
+
+#define MV64XXX_I2C_OFFSET 0xc000
+#define MV64XXX_I2C_REG_BLOCK_SIZE 0x0020
+
+/****************************************/
+/* GPP Interface Registers */
+/****************************************/
+
+#define MV64340_GPP_IO_CONTROL 0xf100
+#define MV64340_GPP_LEVEL_CONTROL 0xf110
+#define MV64340_GPP_VALUE 0xf104
+#define MV64340_GPP_INTERRUPT_CAUSE 0xf108
+#define MV64340_GPP_INTERRUPT_MASK0 0xf10c
+#define MV64340_GPP_INTERRUPT_MASK1 0xf114
+#define MV64340_GPP_VALUE_SET 0xf118
+#define MV64340_GPP_VALUE_CLEAR 0xf11c
+
+/****************************************/
+/* Interrupt Controller Registers */
+/****************************************/
+
+/****************************************/
+/* Interrupts */
+/****************************************/
+
+#define MV64340_MAIN_INTERRUPT_CAUSE_LOW 0x004
+#define MV64340_MAIN_INTERRUPT_CAUSE_HIGH 0x00c
+#define MV64340_CPU_INTERRUPT0_MASK_LOW 0x014
+#define MV64340_CPU_INTERRUPT0_MASK_HIGH 0x01c
+#define MV64340_CPU_INTERRUPT0_SELECT_CAUSE 0x024
+#define MV64340_CPU_INTERRUPT1_MASK_LOW 0x034
+#define MV64340_CPU_INTERRUPT1_MASK_HIGH 0x03c
+#define MV64340_CPU_INTERRUPT1_SELECT_CAUSE 0x044
+#define MV64340_INTERRUPT0_MASK_0_LOW 0x054
+#define MV64340_INTERRUPT0_MASK_0_HIGH 0x05c
+#define MV64340_INTERRUPT0_SELECT_CAUSE 0x064
+#define MV64340_INTERRUPT1_MASK_0_LOW 0x074
+#define MV64340_INTERRUPT1_MASK_0_HIGH 0x07c
+#define MV64340_INTERRUPT1_SELECT_CAUSE 0x084
+
+/****************************************/
+/* MPP Interface Registers */
+/****************************************/
+
+#define MV64340_MPP_CONTROL0 0xf000
+#define MV64340_MPP_CONTROL1 0xf004
+#define MV64340_MPP_CONTROL2 0xf008
+#define MV64340_MPP_CONTROL3 0xf00c
+
+/****************************************/
+/* Serial Initialization registers */
+/****************************************/
+
+#define MV64340_SERIAL_INIT_LAST_DATA 0xf324
+#define MV64340_SERIAL_INIT_CONTROL 0xf328
+#define MV64340_SERIAL_INIT_STATUS 0xf32c
+
+#endif /* ASM_MV643XX_H */
diff --git a/hw/pci-host/pam.c b/hw/pci-host/pam.c
new file mode 100644
index 000000000..454dd120d
--- /dev/null
+++ b/hw/pci-host/pam.c
@@ -0,0 +1,70 @@
+/*
+ * QEMU Smram/pam logic implementation
+ *
+ * Copyright (c) 2006 Fabrice Bellard
+ * Copyright (c) 2011 Isaku Yamahata <yamahata at valinux co jp>
+ * VA Linux Systems Japan K.K.
+ * Copyright (c) 2012 Jason Baron <jbaron@redhat.com>
+ *
+ * Split out from piix.c
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/pci-host/pam.h"
+
+void init_pam(DeviceState *dev, MemoryRegion *ram_memory,
+ MemoryRegion *system_memory, MemoryRegion *pci_address_space,
+ PAMMemoryRegion *mem, uint32_t start, uint32_t size)
+{
+ int i;
+
+ /* RAM */
+ memory_region_init_alias(&mem->alias[3], OBJECT(dev), "pam-ram", ram_memory,
+ start, size);
+ /* ROM (XXX: not quite correct) */
+ memory_region_init_alias(&mem->alias[1], OBJECT(dev), "pam-rom", ram_memory,
+ start, size);
+ memory_region_set_readonly(&mem->alias[1], true);
+
+ /* XXX: should distinguish read/write cases */
+ memory_region_init_alias(&mem->alias[0], OBJECT(dev), "pam-pci", pci_address_space,
+ start, size);
+ memory_region_init_alias(&mem->alias[2], OBJECT(dev), "pam-pci", ram_memory,
+ start, size);
+
+ memory_region_transaction_begin();
+ for (i = 0; i < 4; ++i) {
+ memory_region_set_enabled(&mem->alias[i], false);
+ memory_region_add_subregion_overlap(system_memory, start,
+ &mem->alias[i], 1);
+ }
+ memory_region_transaction_commit();
+ mem->current = 0;
+}
+
+void pam_update(PAMMemoryRegion *pam, int idx, uint8_t val)
+{
+ assert(0 <= idx && idx < PAM_REGIONS_COUNT);
+
+ memory_region_set_enabled(&pam->alias[pam->current], false);
+ pam->current = (val >> ((!(idx & 1)) * 4)) & PAM_ATTR_MASK;
+ memory_region_set_enabled(&pam->alias[pam->current], true);
+}
diff --git a/hw/pci-host/pnv_phb3.c b/hw/pci-host/pnv_phb3.c
new file mode 100644
index 000000000..a7f968500
--- /dev/null
+++ b/hw/pci-host/pnv_phb3.c
@@ -0,0 +1,1186 @@
+/*
+ * QEMU PowerPC PowerNV (POWER8) PHB3 model
+ *
+ * Copyright (c) 2014-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/visitor.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "hw/pci-host/pnv_phb3_regs.h"
+#include "hw/pci-host/pnv_phb3.h"
+#include "hw/pci/pcie_host.h"
+#include "hw/pci/pcie_port.h"
+#include "hw/ppc/pnv.h"
+#include "hw/irq.h"
+#include "hw/qdev-properties.h"
+#include "qom/object.h"
+
+#define phb3_error(phb, fmt, ...) \
+ qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n", \
+ (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
+
+static PCIDevice *pnv_phb3_find_cfg_dev(PnvPHB3 *phb)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(phb);
+ uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
+ uint8_t bus, devfn;
+
+ if (!(addr >> 63)) {
+ return NULL;
+ }
+ bus = (addr >> 52) & 0xff;
+ devfn = (addr >> 44) & 0xff;
+
+ return pci_find_device(pci->bus, bus, devfn);
+}
+
+/*
+ * The CONFIG_DATA register expects little endian accesses, but as the
+ * region is big endian, we have to swap the value.
+ */
+static void pnv_phb3_config_write(PnvPHB3 *phb, unsigned off,
+ unsigned size, uint64_t val)
+{
+ uint32_t cfg_addr, limit;
+ PCIDevice *pdev;
+
+ pdev = pnv_phb3_find_cfg_dev(phb);
+ if (!pdev) {
+ return;
+ }
+ cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
+ cfg_addr |= off;
+ limit = pci_config_size(pdev);
+ if (limit <= cfg_addr) {
+ /*
+ * conventional pci device can be behind pcie-to-pci bridge.
+ * 256 <= addr < 4K has no effects.
+ */
+ return;
+ }
+ switch (size) {
+ case 1:
+ break;
+ case 2:
+ val = bswap16(val);
+ break;
+ case 4:
+ val = bswap32(val);
+ break;
+ default:
+ g_assert_not_reached();
+ }
+ pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
+}
+
+static uint64_t pnv_phb3_config_read(PnvPHB3 *phb, unsigned off,
+ unsigned size)
+{
+ uint32_t cfg_addr, limit;
+ PCIDevice *pdev;
+ uint64_t val;
+
+ pdev = pnv_phb3_find_cfg_dev(phb);
+ if (!pdev) {
+ return ~0ull;
+ }
+ cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
+ cfg_addr |= off;
+ limit = pci_config_size(pdev);
+ if (limit <= cfg_addr) {
+ /*
+ * conventional pci device can be behind pcie-to-pci bridge.
+ * 256 <= addr < 4K has no effects.
+ */
+ return ~0ull;
+ }
+ val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
+ switch (size) {
+ case 1:
+ return val;
+ case 2:
+ return bswap16(val);
+ case 4:
+ return bswap32(val);
+ default:
+ g_assert_not_reached();
+ }
+}
+
+static void pnv_phb3_check_m32(PnvPHB3 *phb)
+{
+ uint64_t base, start, size;
+ MemoryRegion *parent;
+ PnvPBCQState *pbcq = &phb->pbcq;
+
+ if (memory_region_is_mapped(&phb->mr_m32)) {
+ memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32);
+ }
+
+ if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) {
+ return;
+ }
+
+ /* Grab geometry from registers */
+ base = phb->regs[PHB_M32_BASE_ADDR >> 3];
+ start = phb->regs[PHB_M32_START_ADDR >> 3];
+ size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1;
+
+ /* Check if it matches an enabled MMIO region in the PBCQ */
+ if (memory_region_is_mapped(&pbcq->mmbar0) &&
+ base >= pbcq->mmio0_base &&
+ (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
+ parent = &pbcq->mmbar0;
+ base -= pbcq->mmio0_base;
+ } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
+ base >= pbcq->mmio1_base &&
+ (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
+ parent = &pbcq->mmbar1;
+ base -= pbcq->mmio1_base;
+ } else {
+ return;
+ }
+
+ /* Create alias */
+ memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32",
+ &phb->pci_mmio, start, size);
+ memory_region_add_subregion(parent, base, &phb->mr_m32);
+}
+
+static void pnv_phb3_check_m64(PnvPHB3 *phb, uint32_t index)
+{
+ uint64_t base, start, size, m64;
+ MemoryRegion *parent;
+ PnvPBCQState *pbcq = &phb->pbcq;
+
+ if (memory_region_is_mapped(&phb->mr_m64[index])) {
+ /* Should we destroy it in RCU friendly way... ? */
+ memory_region_del_subregion(phb->mr_m64[index].container,
+ &phb->mr_m64[index]);
+ }
+
+ /* Get table entry */
+ m64 = phb->ioda_M64BT[index];
+
+ if (!(m64 & IODA2_M64BT_ENABLE)) {
+ return;
+ }
+
+ /* Grab geometry from registers */
+ base = GETFIELD(IODA2_M64BT_BASE, m64) << 20;
+ if (m64 & IODA2_M64BT_SINGLE_PE) {
+ base &= ~0x1ffffffull;
+ }
+ size = GETFIELD(IODA2_M64BT_MASK, m64) << 20;
+ size |= 0xfffc000000000000ull;
+ size = ~size + 1;
+ start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
+
+ /* Check if it matches an enabled MMIO region in the PBCQ */
+ if (memory_region_is_mapped(&pbcq->mmbar0) &&
+ base >= pbcq->mmio0_base &&
+ (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
+ parent = &pbcq->mmbar0;
+ base -= pbcq->mmio0_base;
+ } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
+ base >= pbcq->mmio1_base &&
+ (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
+ parent = &pbcq->mmbar1;
+ base -= pbcq->mmio1_base;
+ } else {
+ return;
+ }
+
+ /* Create alias */
+ memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64",
+ &phb->pci_mmio, start, size);
+ memory_region_add_subregion(parent, base, &phb->mr_m64[index]);
+}
+
+static void pnv_phb3_check_all_m64s(PnvPHB3 *phb)
+{
+ uint64_t i;
+
+ for (i = 0; i < PNV_PHB3_NUM_M64; i++) {
+ pnv_phb3_check_m64(phb, i);
+ }
+}
+
+static void pnv_phb3_lxivt_write(PnvPHB3 *phb, unsigned idx, uint64_t val)
+{
+ uint8_t server, prio;
+
+ phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER |
+ IODA2_LXIVT_PRIORITY |
+ IODA2_LXIVT_NODE_ID);
+ server = GETFIELD(IODA2_LXIVT_SERVER, val);
+ prio = GETFIELD(IODA2_LXIVT_PRIORITY, val);
+
+ /*
+ * The low order 2 bits are the link pointer (Type II interrupts).
+ * Shift back to get a valid IRQ server.
+ */
+ server >>= 2;
+
+ ics_write_xive(&phb->lsis, idx, server, prio, prio);
+}
+
+static uint64_t *pnv_phb3_ioda_access(PnvPHB3 *phb,
+ unsigned *out_table, unsigned *out_idx)
+{
+ uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
+ unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
+ unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
+ unsigned int mask;
+ uint64_t *tptr = NULL;
+
+ switch (table) {
+ case IODA2_TBL_LIST:
+ tptr = phb->ioda_LIST;
+ mask = 7;
+ break;
+ case IODA2_TBL_LXIVT:
+ tptr = phb->ioda_LXIVT;
+ mask = 7;
+ break;
+ case IODA2_TBL_IVC_CAM:
+ case IODA2_TBL_RBA:
+ mask = 31;
+ break;
+ case IODA2_TBL_RCAM:
+ mask = 63;
+ break;
+ case IODA2_TBL_MRT:
+ mask = 7;
+ break;
+ case IODA2_TBL_PESTA:
+ case IODA2_TBL_PESTB:
+ mask = 255;
+ break;
+ case IODA2_TBL_TVT:
+ tptr = phb->ioda_TVT;
+ mask = 511;
+ break;
+ case IODA2_TBL_TCAM:
+ case IODA2_TBL_TDR:
+ mask = 63;
+ break;
+ case IODA2_TBL_M64BT:
+ tptr = phb->ioda_M64BT;
+ mask = 15;
+ break;
+ case IODA2_TBL_M32DT:
+ tptr = phb->ioda_MDT;
+ mask = 255;
+ break;
+ case IODA2_TBL_PEEV:
+ tptr = phb->ioda_PEEV;
+ mask = 3;
+ break;
+ default:
+ phb3_error(phb, "invalid IODA table %d", table);
+ return NULL;
+ }
+ index &= mask;
+ if (out_idx) {
+ *out_idx = index;
+ }
+ if (out_table) {
+ *out_table = table;
+ }
+ if (tptr) {
+ tptr += index;
+ }
+ if (adreg & PHB_IODA_AD_AUTOINC) {
+ index = (index + 1) & mask;
+ adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
+ }
+ phb->regs[PHB_IODA_ADDR >> 3] = adreg;
+ return tptr;
+}
+
+static uint64_t pnv_phb3_ioda_read(PnvPHB3 *phb)
+{
+ unsigned table;
+ uint64_t *tptr;
+
+ tptr = pnv_phb3_ioda_access(phb, &table, NULL);
+ if (!tptr) {
+ /* Return 0 on unsupported tables, not ff's */
+ return 0;
+ }
+ return *tptr;
+}
+
+static void pnv_phb3_ioda_write(PnvPHB3 *phb, uint64_t val)
+{
+ unsigned table, idx;
+ uint64_t *tptr;
+
+ tptr = pnv_phb3_ioda_access(phb, &table, &idx);
+ if (!tptr) {
+ return;
+ }
+
+ /* Handle side effects */
+ switch (table) {
+ case IODA2_TBL_LXIVT:
+ pnv_phb3_lxivt_write(phb, idx, val);
+ break;
+ case IODA2_TBL_M64BT:
+ *tptr = val;
+ pnv_phb3_check_m64(phb, idx);
+ break;
+ default:
+ *tptr = val;
+ }
+}
+
+/*
+ * This is called whenever the PHB LSI, MSI source ID register or
+ * the PBCQ irq filters are written.
+ */
+void pnv_phb3_remap_irqs(PnvPHB3 *phb)
+{
+ ICSState *ics = &phb->lsis;
+ uint32_t local, global, count, mask, comp;
+ uint64_t baren;
+ PnvPBCQState *pbcq = &phb->pbcq;
+
+ /*
+ * First check if we are enabled. Unlike real HW we don't separate
+ * TX and RX so we enable if both are set
+ */
+ baren = pbcq->nest_regs[PBCQ_NEST_BAR_EN];
+ if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) ||
+ !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) {
+ ics->offset = 0;
+ return;
+ }
+
+ /* Grab local LSI source ID */
+ local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3;
+
+ /* Grab global one and compare */
+ global = GETFIELD(PBCQ_NEST_LSI_SRC,
+ pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3;
+ if (global != local) {
+ /*
+ * This happens during initialization, let's come back when we
+ * are properly configured
+ */
+ ics->offset = 0;
+ return;
+ }
+
+ /* Get the base on the powerbus */
+ comp = GETFIELD(PBCQ_NEST_IRSN_COMP,
+ pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]);
+ mask = GETFIELD(PBCQ_NEST_IRSN_COMP,
+ pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]);
+ count = ((~mask) + 1) & 0x7ffff;
+ phb->total_irq = count;
+
+ /* Sanity checks */
+ if ((global + PNV_PHB3_NUM_LSI) > count) {
+ phb3_error(phb, "LSIs out of reach: LSI base=%d total irq=%d", global,
+ count);
+ }
+
+ if (count > 2048) {
+ phb3_error(phb, "More interrupts than supported: %d", count);
+ }
+
+ if ((comp & mask) != comp) {
+ phb3_error(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x",
+ comp, mask);
+ comp &= mask;
+ }
+ /* Setup LSI offset */
+ ics->offset = comp + global;
+
+ /* Setup MSI offset */
+ pnv_phb3_msi_update_config(&phb->msis, comp, count - PNV_PHB3_NUM_LSI);
+}
+
+static void pnv_phb3_lsi_src_id_write(PnvPHB3 *phb, uint64_t val)
+{
+ /* Sanitize content */
+ val &= PHB_LSI_SRC_ID;
+ phb->regs[PHB_LSI_SOURCE_ID >> 3] = val;
+ pnv_phb3_remap_irqs(phb);
+}
+
+static void pnv_phb3_rtc_invalidate(PnvPHB3 *phb, uint64_t val)
+{
+ PnvPhb3DMASpace *ds;
+
+ /* Always invalidate all for now ... */
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ ds->pe_num = PHB_INVALID_PE;
+ }
+}
+
+
+static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds)
+{
+ uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
+
+ if (cfg & PHB_PHB3C_32BIT_MSI_EN) {
+ if (!memory_region_is_mapped(&ds->msi32_mr)) {
+ memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
+ 0xffff0000, &ds->msi32_mr);
+ }
+ } else {
+ if (memory_region_is_mapped(&ds->msi32_mr)) {
+ memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
+ &ds->msi32_mr);
+ }
+ }
+
+ if (cfg & PHB_PHB3C_64BIT_MSI_EN) {
+ if (!memory_region_is_mapped(&ds->msi64_mr)) {
+ memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
+ (1ull << 60), &ds->msi64_mr);
+ }
+ } else {
+ if (memory_region_is_mapped(&ds->msi64_mr)) {
+ memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
+ &ds->msi64_mr);
+ }
+ }
+}
+
+static void pnv_phb3_update_all_msi_regions(PnvPHB3 *phb)
+{
+ PnvPhb3DMASpace *ds;
+
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ pnv_phb3_update_msi_regions(ds);
+ }
+}
+
+void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size)
+{
+ PnvPHB3 *phb = opaque;
+ bool changed;
+
+ /* Special case configuration data */
+ if ((off & 0xfffc) == PHB_CONFIG_DATA) {
+ pnv_phb3_config_write(phb, off & 0x3, size, val);
+ return;
+ }
+
+ /* Other registers are 64-bit only */
+ if (size != 8 || off & 0x7) {
+ phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
+ off, size);
+ return;
+ }
+
+ /* Handle masking & filtering */
+ switch (off) {
+ case PHB_M64_UPPER_BITS:
+ val &= 0xfffc000000000000ull;
+ break;
+ case PHB_Q_DMA_R:
+ /*
+ * This is enough logic to make SW happy but we aren't actually
+ * quiescing the DMAs
+ */
+ if (val & PHB_Q_DMA_R_AUTORESET) {
+ val = 0;
+ } else {
+ val &= PHB_Q_DMA_R_QUIESCE_DMA;
+ }
+ break;
+ /* LEM stuff */
+ case PHB_LEM_FIR_AND_MASK:
+ phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
+ return;
+ case PHB_LEM_FIR_OR_MASK:
+ phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
+ return;
+ case PHB_LEM_ERROR_AND_MASK:
+ phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
+ return;
+ case PHB_LEM_ERROR_OR_MASK:
+ phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
+ return;
+ case PHB_LEM_WOF:
+ val = 0;
+ break;
+ }
+
+ /* Record whether it changed */
+ changed = phb->regs[off >> 3] != val;
+
+ /* Store in register cache first */
+ phb->regs[off >> 3] = val;
+
+ /* Handle side effects */
+ switch (off) {
+ case PHB_PHB3_CONFIG:
+ if (changed) {
+ pnv_phb3_update_all_msi_regions(phb);
+ }
+ /* fall through */
+ case PHB_M32_BASE_ADDR:
+ case PHB_M32_BASE_MASK:
+ case PHB_M32_START_ADDR:
+ if (changed) {
+ pnv_phb3_check_m32(phb);
+ }
+ break;
+ case PHB_M64_UPPER_BITS:
+ if (changed) {
+ pnv_phb3_check_all_m64s(phb);
+ }
+ break;
+ case PHB_LSI_SOURCE_ID:
+ if (changed) {
+ pnv_phb3_lsi_src_id_write(phb, val);
+ }
+ break;
+
+ /* IODA table accesses */
+ case PHB_IODA_DATA0:
+ pnv_phb3_ioda_write(phb, val);
+ break;
+
+ /* RTC invalidation */
+ case PHB_RTC_INVALIDATE:
+ pnv_phb3_rtc_invalidate(phb, val);
+ break;
+
+ /* FFI request */
+ case PHB_FFI_REQUEST:
+ pnv_phb3_msi_ffi(&phb->msis, val);
+ break;
+
+ /* Silent simple writes */
+ case PHB_CONFIG_ADDRESS:
+ case PHB_IODA_ADDR:
+ case PHB_TCE_KILL:
+ case PHB_TCE_SPEC_CTL:
+ case PHB_PEST_BAR:
+ case PHB_PELTV_BAR:
+ case PHB_RTT_BAR:
+ case PHB_RBA_BAR:
+ case PHB_IVT_BAR:
+ case PHB_FFI_LOCK:
+ case PHB_LEM_FIR_ACCUM:
+ case PHB_LEM_ERROR_MASK:
+ case PHB_LEM_ACTION0:
+ case PHB_LEM_ACTION1:
+ break;
+
+ /* Noise on anything else */
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb3: reg_write 0x%"PRIx64"=%"PRIx64"\n",
+ off, val);
+ }
+}
+
+uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size)
+{
+ PnvPHB3 *phb = opaque;
+ PCIHostState *pci = PCI_HOST_BRIDGE(phb);
+ uint64_t val;
+
+ if ((off & 0xfffc) == PHB_CONFIG_DATA) {
+ return pnv_phb3_config_read(phb, off & 0x3, size);
+ }
+
+ /* Other registers are 64-bit only */
+ if (size != 8 || off & 0x7) {
+ phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
+ off, size);
+ return ~0ull;
+ }
+
+ /* Default read from cache */
+ val = phb->regs[off >> 3];
+
+ switch (off) {
+ /* Simulate venice DD2.0 */
+ case PHB_VERSION:
+ return 0x000000a300000005ull;
+ case PHB_PCIE_SYSTEM_CONFIG:
+ return 0x441100fc30000000;
+
+ /* IODA table accesses */
+ case PHB_IODA_DATA0:
+ return pnv_phb3_ioda_read(phb);
+
+ /* Link training always appears trained */
+ case PHB_PCIE_DLP_TRAIN_CTL:
+ if (!pci_find_device(pci->bus, 1, 0)) {
+ return 0;
+ }
+ return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT;
+
+ /* FFI Lock */
+ case PHB_FFI_LOCK:
+ /* Set lock and return previous value */
+ phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE;
+ return val;
+
+ /* DMA read sync: make it look like it's complete */
+ case PHB_DMARD_SYNC:
+ return PHB_DMARD_SYNC_COMPLETE;
+
+ /* Silent simple reads */
+ case PHB_PHB3_CONFIG:
+ case PHB_M32_BASE_ADDR:
+ case PHB_M32_BASE_MASK:
+ case PHB_M32_START_ADDR:
+ case PHB_CONFIG_ADDRESS:
+ case PHB_IODA_ADDR:
+ case PHB_RTC_INVALIDATE:
+ case PHB_TCE_KILL:
+ case PHB_TCE_SPEC_CTL:
+ case PHB_PEST_BAR:
+ case PHB_PELTV_BAR:
+ case PHB_RTT_BAR:
+ case PHB_RBA_BAR:
+ case PHB_IVT_BAR:
+ case PHB_M64_UPPER_BITS:
+ case PHB_LEM_FIR_ACCUM:
+ case PHB_LEM_ERROR_MASK:
+ case PHB_LEM_ACTION0:
+ case PHB_LEM_ACTION1:
+ break;
+
+ /* Noise on anything else */
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb3: reg_read 0x%"PRIx64"=%"PRIx64"\n",
+ off, val);
+ }
+ return val;
+}
+
+static const MemoryRegionOps pnv_phb3_reg_ops = {
+ .read = pnv_phb3_reg_read,
+ .write = pnv_phb3_reg_write,
+ .valid.min_access_size = 1,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 1,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num)
+{
+ /* Check that out properly ... */
+ return irq_num & 3;
+}
+
+static void pnv_phb3_set_irq(void *opaque, int irq_num, int level)
+{
+ PnvPHB3 *phb = opaque;
+
+ /* LSI only ... */
+ if (irq_num > 3) {
+ phb3_error(phb, "Unknown IRQ to set %d", irq_num);
+ }
+ qemu_set_irq(phb->qirqs[irq_num], level);
+}
+
+static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds)
+{
+ uint64_t rtt, addr;
+ uint16_t rte;
+ int bus_num;
+
+ /* Already resolved ? */
+ if (ds->pe_num != PHB_INVALID_PE) {
+ return true;
+ }
+
+ /* We need to lookup the RTT */
+ rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
+ if (!(rtt & PHB_RTT_BAR_ENABLE)) {
+ phb3_error(ds->phb, "DMA with RTT BAR disabled !");
+ /* Set error bits ? fence ? ... */
+ return false;
+ }
+
+ /* Read RTE */
+ bus_num = pci_bus_num(ds->bus);
+ addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
+ addr += 2 * ((bus_num << 8) | ds->devfn);
+ if (dma_memory_read(&address_space_memory, addr, &rte, sizeof(rte))) {
+ phb3_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
+ /* Set error bits ? fence ? ... */
+ return false;
+ }
+ rte = be16_to_cpu(rte);
+
+ /* Fail upon reading of invalid PE# */
+ if (rte >= PNV_PHB3_NUM_PE) {
+ phb3_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
+ /* Set error bits ? fence ? ... */
+ return false;
+ }
+ ds->pe_num = rte;
+ return true;
+}
+
+static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr,
+ bool is_write, uint64_t tve,
+ IOMMUTLBEntry *tlb)
+{
+ uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve);
+ int32_t lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve);
+ uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve);
+ uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve);
+ PnvPHB3 *phb = ds->phb;
+
+ /* Invalid levels */
+ if (lev > 4) {
+ phb3_error(phb, "Invalid #levels in TVE %d", lev);
+ return;
+ }
+
+ /* IO Page Size of 0 means untranslated, else use TCEs */
+ if (tps == 0) {
+ /*
+ * We only support non-translate in top window.
+ *
+ * TODO: Venice/Murano support it on bottom window above 4G and
+ * Naples suports it on everything
+ */
+ if (!(tve & PPC_BIT(51))) {
+ phb3_error(phb, "xlate for invalid non-translate TVE");
+ return;
+ }
+ /* TODO: Handle boundaries */
+
+ /* Use 4k pages like q35 ... for now */
+ tlb->iova = addr & 0xfffffffffffff000ull;
+ tlb->translated_addr = addr & 0x0003fffffffff000ull;
+ tlb->addr_mask = 0xfffull;
+ tlb->perm = IOMMU_RW;
+ } else {
+ uint32_t tce_shift, tbl_shift, sh;
+ uint64_t base, taddr, tce, tce_mask;
+
+ /* TVE disabled ? */
+ if (tts == 0) {
+ phb3_error(phb, "xlate for invalid translated TVE");
+ return;
+ }
+
+ /* Address bits per bottom level TCE entry */
+ tce_shift = tps + 11;
+
+ /* Address bits per table level */
+ tbl_shift = tts + 8;
+
+ /* Top level table base address */
+ base = tta << 12;
+
+ /* Total shift to first level */
+ sh = tbl_shift * lev + tce_shift;
+
+ /* TODO: Multi-level untested */
+ while ((lev--) >= 0) {
+ /* Grab the TCE address */
+ taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
+ if (dma_memory_read(&address_space_memory, taddr, &tce,
+ sizeof(tce))) {
+ phb3_error(phb, "Failed to read TCE at 0x%"PRIx64, taddr);
+ return;
+ }
+ tce = be64_to_cpu(tce);
+
+ /* Check permission for indirect TCE */
+ if ((lev >= 0) && !(tce & 3)) {
+ phb3_error(phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
+ phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
+ is_write ? 'W' : 'R', tve);
+ phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
+ tta, lev, tts, tps);
+ return;
+ }
+ sh -= tbl_shift;
+ base = tce & ~0xfffull;
+ }
+
+ /* We exit the loop with TCE being the final TCE */
+ tce_mask = ~((1ull << tce_shift) - 1);
+ tlb->iova = addr & tce_mask;
+ tlb->translated_addr = tce & tce_mask;
+ tlb->addr_mask = ~tce_mask;
+ tlb->perm = tce & 3;
+ if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
+ phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr);
+ phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
+ is_write ? 'W' : 'R', tve);
+ phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
+ tta, lev, tts, tps);
+ }
+ }
+}
+
+static IOMMUTLBEntry pnv_phb3_translate_iommu(IOMMUMemoryRegion *iommu,
+ hwaddr addr,
+ IOMMUAccessFlags flag,
+ int iommu_idx)
+{
+ PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr);
+ int tve_sel;
+ uint64_t tve, cfg;
+ IOMMUTLBEntry ret = {
+ .target_as = &address_space_memory,
+ .iova = addr,
+ .translated_addr = 0,
+ .addr_mask = ~(hwaddr)0,
+ .perm = IOMMU_NONE,
+ };
+ PnvPHB3 *phb = ds->phb;
+
+ /* Resolve PE# */
+ if (!pnv_phb3_resolve_pe(ds)) {
+ phb3_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
+ ds->bus, pci_bus_num(ds->bus), ds->devfn);
+ return ret;
+ }
+
+ /* Check top bits */
+ switch (addr >> 60) {
+ case 00:
+ /* DMA or 32-bit MSI ? */
+ cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
+ if ((cfg & PHB_PHB3C_32BIT_MSI_EN) &&
+ ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
+ phb3_error(phb, "xlate on 32-bit MSI region");
+ return ret;
+ }
+ /* Choose TVE XXX Use PHB3 Control Register */
+ tve_sel = (addr >> 59) & 1;
+ tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
+ pnv_phb3_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
+ break;
+ case 01:
+ phb3_error(phb, "xlate on 64-bit MSI region");
+ break;
+ default:
+ phb3_error(phb, "xlate on unsupported address 0x%"PRIx64, addr);
+ }
+ return ret;
+}
+
+#define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region"
+DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB3_IOMMU_MEMORY_REGION,
+ TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)
+
+static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass,
+ void *data)
+{
+ IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
+
+ imrc->translate = pnv_phb3_translate_iommu;
+}
+
+static const TypeInfo pnv_phb3_iommu_memory_region_info = {
+ .parent = TYPE_IOMMU_MEMORY_REGION,
+ .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
+ .class_init = pnv_phb3_iommu_memory_region_class_init,
+};
+
+/*
+ * MSI/MSIX memory region implementation.
+ * The handler handles both MSI and MSIX.
+ */
+static void pnv_phb3_msi_write(void *opaque, hwaddr addr,
+ uint64_t data, unsigned size)
+{
+ PnvPhb3DMASpace *ds = opaque;
+
+ /* Resolve PE# */
+ if (!pnv_phb3_resolve_pe(ds)) {
+ phb3_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
+ ds->bus, pci_bus_num(ds->bus), ds->devfn);
+ return;
+ }
+
+ pnv_phb3_msi_send(&ds->phb->msis, addr, data, ds->pe_num);
+}
+
+/* There is no .read as the read result is undefined by PCI spec */
+static uint64_t pnv_phb3_msi_read(void *opaque, hwaddr addr, unsigned size)
+{
+ PnvPhb3DMASpace *ds = opaque;
+
+ phb3_error(ds->phb, "invalid read @ 0x%" HWADDR_PRIx, addr);
+ return -1;
+}
+
+static const MemoryRegionOps pnv_phb3_msi_ops = {
+ .read = pnv_phb3_msi_read,
+ .write = pnv_phb3_msi_write,
+ .endianness = DEVICE_LITTLE_ENDIAN
+};
+
+static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn)
+{
+ PnvPHB3 *phb = opaque;
+ PnvPhb3DMASpace *ds;
+
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ if (ds->bus == bus && ds->devfn == devfn) {
+ break;
+ }
+ }
+
+ if (ds == NULL) {
+ ds = g_malloc0(sizeof(PnvPhb3DMASpace));
+ ds->bus = bus;
+ ds->devfn = devfn;
+ ds->pe_num = PHB_INVALID_PE;
+ ds->phb = phb;
+ memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
+ TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
+ OBJECT(phb), "phb3_iommu", UINT64_MAX);
+ address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
+ "phb3_iommu");
+ memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops,
+ ds, "msi32", 0x10000);
+ memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops,
+ ds, "msi64", 0x100000);
+ pnv_phb3_update_msi_regions(ds);
+
+ QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
+ }
+ return &ds->dma_as;
+}
+
+static void pnv_phb3_instance_init(Object *obj)
+{
+ PnvPHB3 *phb = PNV_PHB3(obj);
+
+ QLIST_INIT(&phb->dma_spaces);
+
+ /* LSI sources */
+ object_initialize_child(obj, "lsi", &phb->lsis, TYPE_ICS);
+
+ /* Default init ... will be fixed by HW inits */
+ phb->lsis.offset = 0;
+
+ /* MSI sources */
+ object_initialize_child(obj, "msi", &phb->msis, TYPE_PHB3_MSI);
+
+ /* Power Bus Common Queue */
+ object_initialize_child(obj, "pbcq", &phb->pbcq, TYPE_PNV_PBCQ);
+
+ /* Root Port */
+ object_initialize_child(obj, "root", &phb->root, TYPE_PNV_PHB3_ROOT_PORT);
+ qdev_prop_set_int32(DEVICE(&phb->root), "addr", PCI_DEVFN(0, 0));
+ qdev_prop_set_bit(DEVICE(&phb->root), "multifunction", false);
+}
+
+static void pnv_phb3_realize(DeviceState *dev, Error **errp)
+{
+ PnvPHB3 *phb = PNV_PHB3(dev);
+ PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+ PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
+ int i;
+
+ if (phb->phb_id >= PNV8_CHIP_PHB3_MAX) {
+ error_setg(errp, "invalid PHB index: %d", phb->phb_id);
+ return;
+ }
+
+ /* LSI sources */
+ object_property_set_link(OBJECT(&phb->lsis), "xics", OBJECT(pnv),
+ &error_abort);
+ object_property_set_int(OBJECT(&phb->lsis), "nr-irqs", PNV_PHB3_NUM_LSI,
+ &error_abort);
+ if (!qdev_realize(DEVICE(&phb->lsis), NULL, errp)) {
+ return;
+ }
+
+ for (i = 0; i < phb->lsis.nr_irqs; i++) {
+ ics_set_irq_type(&phb->lsis, i, true);
+ }
+
+ phb->qirqs = qemu_allocate_irqs(ics_set_irq, &phb->lsis, phb->lsis.nr_irqs);
+
+ /* MSI sources */
+ object_property_set_link(OBJECT(&phb->msis), "phb", OBJECT(phb),
+ &error_abort);
+ object_property_set_link(OBJECT(&phb->msis), "xics", OBJECT(pnv),
+ &error_abort);
+ object_property_set_int(OBJECT(&phb->msis), "nr-irqs", PHB3_MAX_MSI,
+ &error_abort);
+ if (!qdev_realize(DEVICE(&phb->msis), NULL, errp)) {
+ return;
+ }
+
+ /* Power Bus Common Queue */
+ object_property_set_link(OBJECT(&phb->pbcq), "phb", OBJECT(phb),
+ &error_abort);
+ if (!qdev_realize(DEVICE(&phb->pbcq), NULL, errp)) {
+ return;
+ }
+
+ /* Controller Registers */
+ memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb,
+ "phb3-regs", 0x1000);
+
+ /*
+ * PHB3 doesn't support IO space. However, qemu gets very upset if
+ * we don't have an IO region to anchor IO BARs onto so we just
+ * initialize one which we never hook up to anything
+ */
+ memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000);
+ memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio",
+ PCI_MMIO_TOTAL_SIZE);
+
+ pci->bus = pci_register_root_bus(dev, "root-bus",
+ pnv_phb3_set_irq, pnv_phb3_map_irq, phb,
+ &phb->pci_mmio, &phb->pci_io,
+ 0, 4, TYPE_PNV_PHB3_ROOT_BUS);
+
+ pci_setup_iommu(pci->bus, pnv_phb3_dma_iommu, phb);
+
+ /* Add a single Root port */
+ qdev_prop_set_uint8(DEVICE(&phb->root), "chassis", phb->chip_id);
+ qdev_prop_set_uint16(DEVICE(&phb->root), "slot", phb->phb_id);
+ qdev_realize(DEVICE(&phb->root), BUS(pci->bus), &error_fatal);
+}
+
+void pnv_phb3_update_regions(PnvPHB3 *phb)
+{
+ PnvPBCQState *pbcq = &phb->pbcq;
+
+ /* Unmap first always */
+ if (memory_region_is_mapped(&phb->mr_regs)) {
+ memory_region_del_subregion(&pbcq->phbbar, &phb->mr_regs);
+ }
+
+ /* Map registers if enabled */
+ if (memory_region_is_mapped(&pbcq->phbbar)) {
+ /* TODO: We should use the PHB BAR 2 register but we don't ... */
+ memory_region_add_subregion(&pbcq->phbbar, 0, &phb->mr_regs);
+ }
+
+ /* Check/update m32 */
+ if (memory_region_is_mapped(&phb->mr_m32)) {
+ pnv_phb3_check_m32(phb);
+ }
+ pnv_phb3_check_all_m64s(phb);
+}
+
+static const char *pnv_phb3_root_bus_path(PCIHostState *host_bridge,
+ PCIBus *rootbus)
+{
+ PnvPHB3 *phb = PNV_PHB3(host_bridge);
+
+ snprintf(phb->bus_path, sizeof(phb->bus_path), "00%02x:%02x",
+ phb->chip_id, phb->phb_id);
+ return phb->bus_path;
+}
+
+static Property pnv_phb3_properties[] = {
+ DEFINE_PROP_UINT32("index", PnvPHB3, phb_id, 0),
+ DEFINE_PROP_UINT32("chip-id", PnvPHB3, chip_id, 0),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void pnv_phb3_class_init(ObjectClass *klass, void *data)
+{
+ PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ hc->root_bus_path = pnv_phb3_root_bus_path;
+ dc->realize = pnv_phb3_realize;
+ device_class_set_props(dc, pnv_phb3_properties);
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->user_creatable = false;
+}
+
+static const TypeInfo pnv_phb3_type_info = {
+ .name = TYPE_PNV_PHB3,
+ .parent = TYPE_PCIE_HOST_BRIDGE,
+ .instance_size = sizeof(PnvPHB3),
+ .class_init = pnv_phb3_class_init,
+ .instance_init = pnv_phb3_instance_init,
+};
+
+static void pnv_phb3_root_bus_class_init(ObjectClass *klass, void *data)
+{
+ BusClass *k = BUS_CLASS(klass);
+
+ /*
+ * PHB3 has only a single root complex. Enforce the limit on the
+ * parent bus
+ */
+ k->max_dev = 1;
+}
+
+static const TypeInfo pnv_phb3_root_bus_info = {
+ .name = TYPE_PNV_PHB3_ROOT_BUS,
+ .parent = TYPE_PCIE_BUS,
+ .class_init = pnv_phb3_root_bus_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_PCIE_DEVICE },
+ { }
+ },
+};
+
+static void pnv_phb3_root_port_realize(DeviceState *dev, Error **errp)
+{
+ PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev);
+ Error *local_err = NULL;
+
+ rpc->parent_realize(dev, &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+}
+
+static void pnv_phb3_root_port_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ PCIERootPortClass *rpc = PCIE_ROOT_PORT_CLASS(klass);
+
+ dc->desc = "IBM PHB3 PCIE Root Port";
+
+ device_class_set_parent_realize(dc, pnv_phb3_root_port_realize,
+ &rpc->parent_realize);
+ dc->user_creatable = false;
+
+ k->vendor_id = PCI_VENDOR_ID_IBM;
+ k->device_id = 0x03dc;
+ k->revision = 0;
+
+ rpc->exp_offset = 0x48;
+ rpc->aer_offset = 0x100;
+}
+
+static const TypeInfo pnv_phb3_root_port_info = {
+ .name = TYPE_PNV_PHB3_ROOT_PORT,
+ .parent = TYPE_PCIE_ROOT_PORT,
+ .instance_size = sizeof(PnvPHB3RootPort),
+ .class_init = pnv_phb3_root_port_class_init,
+};
+
+static void pnv_phb3_register_types(void)
+{
+ type_register_static(&pnv_phb3_root_bus_info);
+ type_register_static(&pnv_phb3_root_port_info);
+ type_register_static(&pnv_phb3_type_info);
+ type_register_static(&pnv_phb3_iommu_memory_region_info);
+}
+
+type_init(pnv_phb3_register_types)
diff --git a/hw/pci-host/pnv_phb3_msi.c b/hw/pci-host/pnv_phb3_msi.c
new file mode 100644
index 000000000..099d2092a
--- /dev/null
+++ b/hw/pci-host/pnv_phb3_msi.c
@@ -0,0 +1,348 @@
+/*
+ * QEMU PowerPC PowerNV (POWER8) PHB3 model
+ *
+ * Copyright (c) 2014-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "hw/pci-host/pnv_phb3_regs.h"
+#include "hw/pci-host/pnv_phb3.h"
+#include "hw/ppc/pnv.h"
+#include "hw/pci/msi.h"
+#include "monitor/monitor.h"
+#include "hw/irq.h"
+#include "hw/qdev-properties.h"
+#include "sysemu/reset.h"
+
+static uint64_t phb3_msi_ive_addr(PnvPHB3 *phb, int srcno)
+{
+ uint64_t ivtbar = phb->regs[PHB_IVT_BAR >> 3];
+ uint64_t phbctl = phb->regs[PHB_CONTROL >> 3];
+
+ if (!(ivtbar & PHB_IVT_BAR_ENABLE)) {
+ qemu_log_mask(LOG_GUEST_ERROR, "Failed access to disable IVT BAR !");
+ return 0;
+ }
+
+ if (srcno >= (ivtbar & PHB_IVT_LENGTH_MASK)) {
+ qemu_log_mask(LOG_GUEST_ERROR, "MSI out of bounds (%d vs 0x%"PRIx64")",
+ srcno, (uint64_t) (ivtbar & PHB_IVT_LENGTH_MASK));
+ return 0;
+ }
+
+ ivtbar &= PHB_IVT_BASE_ADDRESS_MASK;
+
+ if (phbctl & PHB_CTRL_IVE_128_BYTES) {
+ return ivtbar + 128 * srcno;
+ } else {
+ return ivtbar + 16 * srcno;
+ }
+}
+
+static bool phb3_msi_read_ive(PnvPHB3 *phb, int srcno, uint64_t *out_ive)
+{
+ uint64_t ive_addr, ive;
+
+ ive_addr = phb3_msi_ive_addr(phb, srcno);
+ if (!ive_addr) {
+ return false;
+ }
+
+ if (dma_memory_read(&address_space_memory, ive_addr, &ive, sizeof(ive))) {
+ qemu_log_mask(LOG_GUEST_ERROR, "Failed to read IVE at 0x%" PRIx64,
+ ive_addr);
+ return false;
+ }
+ *out_ive = be64_to_cpu(ive);
+
+ return true;
+}
+
+static void phb3_msi_set_p(Phb3MsiState *msi, int srcno, uint8_t gen)
+{
+ uint64_t ive_addr;
+ uint8_t p = 0x01 | (gen << 1);
+
+ ive_addr = phb3_msi_ive_addr(msi->phb, srcno);
+ if (!ive_addr) {
+ return;
+ }
+
+ if (dma_memory_write(&address_space_memory, ive_addr + 4, &p, 1)) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "Failed to write IVE (set P) at 0x%" PRIx64, ive_addr);
+ }
+}
+
+static void phb3_msi_set_q(Phb3MsiState *msi, int srcno)
+{
+ uint64_t ive_addr;
+ uint8_t q = 0x01;
+
+ ive_addr = phb3_msi_ive_addr(msi->phb, srcno);
+ if (!ive_addr) {
+ return;
+ }
+
+ if (dma_memory_write(&address_space_memory, ive_addr + 5, &q, 1)) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "Failed to write IVE (set Q) at 0x%" PRIx64, ive_addr);
+ }
+}
+
+static void phb3_msi_try_send(Phb3MsiState *msi, int srcno, bool force)
+{
+ ICSState *ics = ICS(msi);
+ uint64_t ive;
+ uint64_t server, prio, pq, gen;
+
+ if (!phb3_msi_read_ive(msi->phb, srcno, &ive)) {
+ return;
+ }
+
+ server = GETFIELD(IODA2_IVT_SERVER, ive);
+ prio = GETFIELD(IODA2_IVT_PRIORITY, ive);
+ if (!force) {
+ pq = GETFIELD(IODA2_IVT_Q, ive) | (GETFIELD(IODA2_IVT_P, ive) << 1);
+ } else {
+ pq = 0;
+ }
+ gen = GETFIELD(IODA2_IVT_GEN, ive);
+
+ /*
+ * The low order 2 bits are the link pointer (Type II interrupts).
+ * Shift back to get a valid IRQ server.
+ */
+ server >>= 2;
+
+ switch (pq) {
+ case 0: /* 00 */
+ if (prio == 0xff) {
+ /* Masked, set Q */
+ phb3_msi_set_q(msi, srcno);
+ } else {
+ /* Enabled, set P and send */
+ phb3_msi_set_p(msi, srcno, gen);
+ icp_irq(ics, server, srcno + ics->offset, prio);
+ }
+ break;
+ case 2: /* 10 */
+ /* Already pending, set Q */
+ phb3_msi_set_q(msi, srcno);
+ break;
+ case 1: /* 01 */
+ case 3: /* 11 */
+ default:
+ /* Just drop stuff if Q already set */
+ break;
+ }
+}
+
+static void phb3_msi_set_irq(void *opaque, int srcno, int val)
+{
+ Phb3MsiState *msi = PHB3_MSI(opaque);
+
+ if (val) {
+ phb3_msi_try_send(msi, srcno, false);
+ }
+}
+
+
+void pnv_phb3_msi_send(Phb3MsiState *msi, uint64_t addr, uint16_t data,
+ int32_t dev_pe)
+{
+ ICSState *ics = ICS(msi);
+ uint64_t ive;
+ uint16_t pe;
+ uint32_t src = ((addr >> 4) & 0xffff) | (data & 0x1f);
+
+ if (src >= ics->nr_irqs) {
+ qemu_log_mask(LOG_GUEST_ERROR, "MSI %d out of bounds", src);
+ return;
+ }
+ if (dev_pe >= 0) {
+ if (!phb3_msi_read_ive(msi->phb, src, &ive)) {
+ return;
+ }
+ pe = GETFIELD(IODA2_IVT_PE, ive);
+ if (pe != dev_pe) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "MSI %d send by PE#%d but assigned to PE#%d",
+ src, dev_pe, pe);
+ return;
+ }
+ }
+ qemu_irq_pulse(msi->qirqs[src]);
+}
+
+void pnv_phb3_msi_ffi(Phb3MsiState *msi, uint64_t val)
+{
+ /* Emit interrupt */
+ pnv_phb3_msi_send(msi, val, 0, -1);
+
+ /* Clear FFI lock */
+ msi->phb->regs[PHB_FFI_LOCK >> 3] = 0;
+}
+
+static void phb3_msi_reject(ICSState *ics, uint32_t nr)
+{
+ Phb3MsiState *msi = PHB3_MSI(ics);
+ unsigned int srcno = nr - ics->offset;
+ unsigned int idx = srcno >> 6;
+ unsigned int bit = 1ull << (srcno & 0x3f);
+
+ assert(srcno < PHB3_MAX_MSI);
+
+ msi->rba[idx] |= bit;
+ msi->rba_sum |= (1u << idx);
+}
+
+static void phb3_msi_resend(ICSState *ics)
+{
+ Phb3MsiState *msi = PHB3_MSI(ics);
+ unsigned int i, j;
+
+ if (msi->rba_sum == 0) {
+ return;
+ }
+
+ for (i = 0; i < 32; i++) {
+ if ((msi->rba_sum & (1u << i)) == 0) {
+ continue;
+ }
+ msi->rba_sum &= ~(1u << i);
+ for (j = 0; j < 64; j++) {
+ if ((msi->rba[i] & (1ull << j)) == 0) {
+ continue;
+ }
+ msi->rba[i] &= ~(1ull << j);
+ phb3_msi_try_send(msi, i * 64 + j, true);
+ }
+ }
+}
+
+static void phb3_msi_reset(DeviceState *dev)
+{
+ Phb3MsiState *msi = PHB3_MSI(dev);
+ ICSStateClass *icsc = ICS_GET_CLASS(dev);
+
+ icsc->parent_reset(dev);
+
+ memset(msi->rba, 0, sizeof(msi->rba));
+ msi->rba_sum = 0;
+}
+
+static void phb3_msi_reset_handler(void *dev)
+{
+ phb3_msi_reset(dev);
+}
+
+void pnv_phb3_msi_update_config(Phb3MsiState *msi, uint32_t base,
+ uint32_t count)
+{
+ ICSState *ics = ICS(msi);
+
+ if (count > PHB3_MAX_MSI) {
+ count = PHB3_MAX_MSI;
+ }
+ ics->nr_irqs = count;
+ ics->offset = base;
+}
+
+static void phb3_msi_realize(DeviceState *dev, Error **errp)
+{
+ Phb3MsiState *msi = PHB3_MSI(dev);
+ ICSState *ics = ICS(msi);
+ ICSStateClass *icsc = ICS_GET_CLASS(ics);
+ Error *local_err = NULL;
+
+ assert(msi->phb);
+
+ icsc->parent_realize(dev, &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+
+ msi->qirqs = qemu_allocate_irqs(phb3_msi_set_irq, msi, ics->nr_irqs);
+
+ qemu_register_reset(phb3_msi_reset_handler, dev);
+}
+
+static void phb3_msi_instance_init(Object *obj)
+{
+ Phb3MsiState *msi = PHB3_MSI(obj);
+ ICSState *ics = ICS(obj);
+
+ object_property_add_link(obj, "phb", TYPE_PNV_PHB3,
+ (Object **)&msi->phb,
+ object_property_allow_set_link,
+ OBJ_PROP_LINK_STRONG);
+
+ /* Will be overriden later */
+ ics->offset = 0;
+}
+
+static void phb3_msi_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ ICSStateClass *isc = ICS_CLASS(klass);
+
+ device_class_set_parent_realize(dc, phb3_msi_realize,
+ &isc->parent_realize);
+ device_class_set_parent_reset(dc, phb3_msi_reset,
+ &isc->parent_reset);
+
+ isc->reject = phb3_msi_reject;
+ isc->resend = phb3_msi_resend;
+}
+
+static const TypeInfo phb3_msi_info = {
+ .name = TYPE_PHB3_MSI,
+ .parent = TYPE_ICS,
+ .instance_size = sizeof(Phb3MsiState),
+ .class_init = phb3_msi_class_init,
+ .class_size = sizeof(ICSStateClass),
+ .instance_init = phb3_msi_instance_init,
+};
+
+static void pnv_phb3_msi_register_types(void)
+{
+ type_register_static(&phb3_msi_info);
+}
+
+type_init(pnv_phb3_msi_register_types);
+
+void pnv_phb3_msi_pic_print_info(Phb3MsiState *msi, Monitor *mon)
+{
+ ICSState *ics = ICS(msi);
+ int i;
+
+ monitor_printf(mon, "ICS %4x..%4x %p\n",
+ ics->offset, ics->offset + ics->nr_irqs - 1, ics);
+
+ for (i = 0; i < ics->nr_irqs; i++) {
+ uint64_t ive;
+
+ if (!phb3_msi_read_ive(msi->phb, i, &ive)) {
+ return;
+ }
+
+ if (GETFIELD(IODA2_IVT_PRIORITY, ive) == 0xff) {
+ continue;
+ }
+
+ monitor_printf(mon, " %4x %c%c server=%04x prio=%02x gen=%d\n",
+ ics->offset + i,
+ GETFIELD(IODA2_IVT_P, ive) ? 'P' : '-',
+ GETFIELD(IODA2_IVT_Q, ive) ? 'Q' : '-',
+ (uint32_t) GETFIELD(IODA2_IVT_SERVER, ive) >> 2,
+ (uint32_t) GETFIELD(IODA2_IVT_PRIORITY, ive),
+ (uint32_t) GETFIELD(IODA2_IVT_GEN, ive));
+ }
+}
diff --git a/hw/pci-host/pnv_phb3_pbcq.c b/hw/pci-host/pnv_phb3_pbcq.c
new file mode 100644
index 000000000..a0526aa1e
--- /dev/null
+++ b/hw/pci-host/pnv_phb3_pbcq.c
@@ -0,0 +1,358 @@
+/*
+ * QEMU PowerPC PowerNV (POWER8) PHB3 model
+ *
+ * Copyright (c) 2014-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "qemu/log.h"
+#include "target/ppc/cpu.h"
+#include "hw/ppc/fdt.h"
+#include "hw/pci-host/pnv_phb3_regs.h"
+#include "hw/pci-host/pnv_phb3.h"
+#include "hw/ppc/pnv.h"
+#include "hw/ppc/pnv_xscom.h"
+#include "hw/pci/pci_bridge.h"
+#include "hw/pci/pci_bus.h"
+
+#include <libfdt.h>
+
+#define phb3_pbcq_error(pbcq, fmt, ...) \
+ qemu_log_mask(LOG_GUEST_ERROR, "phb3_pbcq[%d:%d]: " fmt "\n", \
+ (pbcq)->phb->chip_id, (pbcq)->phb->phb_id, ## __VA_ARGS__)
+
+static uint64_t pnv_pbcq_nest_xscom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(opaque);
+ uint32_t offset = addr >> 3;
+
+ return pbcq->nest_regs[offset];
+}
+
+static uint64_t pnv_pbcq_pci_xscom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(opaque);
+ uint32_t offset = addr >> 3;
+
+ return pbcq->pci_regs[offset];
+}
+
+static uint64_t pnv_pbcq_spci_xscom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(opaque);
+ uint32_t offset = addr >> 3;
+
+ if (offset == PBCQ_SPCI_ASB_DATA) {
+ return pnv_phb3_reg_read(pbcq->phb,
+ pbcq->spci_regs[PBCQ_SPCI_ASB_ADDR], 8);
+ }
+ return pbcq->spci_regs[offset];
+}
+
+static void pnv_pbcq_update_map(PnvPBCQState *pbcq)
+{
+ uint64_t bar_en = pbcq->nest_regs[PBCQ_NEST_BAR_EN];
+ uint64_t bar, mask, size;
+
+ /*
+ * NOTE: This will really not work well if those are remapped
+ * after the PHB has created its sub regions. We could do better
+ * if we had a way to resize regions but we don't really care
+ * that much in practice as the stuff below really only happens
+ * once early during boot
+ */
+
+ /* Handle unmaps */
+ if (memory_region_is_mapped(&pbcq->mmbar0) &&
+ !(bar_en & PBCQ_NEST_BAR_EN_MMIO0)) {
+ memory_region_del_subregion(get_system_memory(), &pbcq->mmbar0);
+ }
+ if (memory_region_is_mapped(&pbcq->mmbar1) &&
+ !(bar_en & PBCQ_NEST_BAR_EN_MMIO1)) {
+ memory_region_del_subregion(get_system_memory(), &pbcq->mmbar1);
+ }
+ if (memory_region_is_mapped(&pbcq->phbbar) &&
+ !(bar_en & PBCQ_NEST_BAR_EN_PHB)) {
+ memory_region_del_subregion(get_system_memory(), &pbcq->phbbar);
+ }
+
+ /* Update PHB */
+ pnv_phb3_update_regions(pbcq->phb);
+
+ /* Handle maps */
+ if (!memory_region_is_mapped(&pbcq->mmbar0) &&
+ (bar_en & PBCQ_NEST_BAR_EN_MMIO0)) {
+ bar = pbcq->nest_regs[PBCQ_NEST_MMIO_BAR0] >> 14;
+ mask = pbcq->nest_regs[PBCQ_NEST_MMIO_MASK0];
+ size = ((~mask) >> 14) + 1;
+ memory_region_init(&pbcq->mmbar0, OBJECT(pbcq), "pbcq-mmio0", size);
+ memory_region_add_subregion(get_system_memory(), bar, &pbcq->mmbar0);
+ pbcq->mmio0_base = bar;
+ pbcq->mmio0_size = size;
+ }
+ if (!memory_region_is_mapped(&pbcq->mmbar1) &&
+ (bar_en & PBCQ_NEST_BAR_EN_MMIO1)) {
+ bar = pbcq->nest_regs[PBCQ_NEST_MMIO_BAR1] >> 14;
+ mask = pbcq->nest_regs[PBCQ_NEST_MMIO_MASK1];
+ size = ((~mask) >> 14) + 1;
+ memory_region_init(&pbcq->mmbar1, OBJECT(pbcq), "pbcq-mmio1", size);
+ memory_region_add_subregion(get_system_memory(), bar, &pbcq->mmbar1);
+ pbcq->mmio1_base = bar;
+ pbcq->mmio1_size = size;
+ }
+ if (!memory_region_is_mapped(&pbcq->phbbar)
+ && (bar_en & PBCQ_NEST_BAR_EN_PHB)) {
+ bar = pbcq->nest_regs[PBCQ_NEST_PHB_BAR] >> 14;
+ size = 0x1000;
+ memory_region_init(&pbcq->phbbar, OBJECT(pbcq), "pbcq-phb", size);
+ memory_region_add_subregion(get_system_memory(), bar, &pbcq->phbbar);
+ }
+
+ /* Update PHB */
+ pnv_phb3_update_regions(pbcq->phb);
+}
+
+static void pnv_pbcq_nest_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(opaque);
+ uint32_t reg = addr >> 3;
+
+ switch (reg) {
+ case PBCQ_NEST_MMIO_BAR0:
+ case PBCQ_NEST_MMIO_BAR1:
+ case PBCQ_NEST_MMIO_MASK0:
+ case PBCQ_NEST_MMIO_MASK1:
+ if (pbcq->nest_regs[PBCQ_NEST_BAR_EN] &
+ (PBCQ_NEST_BAR_EN_MMIO0 |
+ PBCQ_NEST_BAR_EN_MMIO1)) {
+ phb3_pbcq_error(pbcq, "Changing enabled BAR unsupported");
+ }
+ pbcq->nest_regs[reg] = val & 0xffffffffc0000000ull;
+ break;
+ case PBCQ_NEST_PHB_BAR:
+ if (pbcq->nest_regs[PBCQ_NEST_BAR_EN] & PBCQ_NEST_BAR_EN_PHB) {
+ phb3_pbcq_error(pbcq, "Changing enabled BAR unsupported");
+ }
+ pbcq->nest_regs[reg] = val & 0xfffffffffc000000ull;
+ break;
+ case PBCQ_NEST_BAR_EN:
+ pbcq->nest_regs[reg] = val & 0xf800000000000000ull;
+ pnv_pbcq_update_map(pbcq);
+ pnv_phb3_remap_irqs(pbcq->phb);
+ break;
+ case PBCQ_NEST_IRSN_COMPARE:
+ case PBCQ_NEST_IRSN_MASK:
+ pbcq->nest_regs[reg] = val & PBCQ_NEST_IRSN_COMP;
+ pnv_phb3_remap_irqs(pbcq->phb);
+ break;
+ case PBCQ_NEST_LSI_SRC_ID:
+ pbcq->nest_regs[reg] = val & PBCQ_NEST_LSI_SRC;
+ pnv_phb3_remap_irqs(pbcq->phb);
+ break;
+ default:
+ phb3_pbcq_error(pbcq, "%s @0x%"HWADDR_PRIx"=%"PRIx64, __func__,
+ addr, val);
+ }
+}
+
+static void pnv_pbcq_pci_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(opaque);
+ uint32_t reg = addr >> 3;
+
+ switch (reg) {
+ case PBCQ_PCI_BAR2:
+ pbcq->pci_regs[reg] = val & 0xfffffffffc000000ull;
+ pnv_pbcq_update_map(pbcq);
+ break;
+ default:
+ phb3_pbcq_error(pbcq, "%s @0x%"HWADDR_PRIx"=%"PRIx64, __func__,
+ addr, val);
+ }
+}
+
+static void pnv_pbcq_spci_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(opaque);
+ uint32_t reg = addr >> 3;
+
+ switch (reg) {
+ case PBCQ_SPCI_ASB_ADDR:
+ pbcq->spci_regs[reg] = val & 0xfff;
+ break;
+ case PBCQ_SPCI_ASB_STATUS:
+ pbcq->spci_regs[reg] &= ~val;
+ break;
+ case PBCQ_SPCI_ASB_DATA:
+ pnv_phb3_reg_write(pbcq->phb, pbcq->spci_regs[PBCQ_SPCI_ASB_ADDR],
+ val, 8);
+ break;
+ case PBCQ_SPCI_AIB_CAPP_EN:
+ case PBCQ_SPCI_CAPP_SEC_TMR:
+ break;
+ default:
+ phb3_pbcq_error(pbcq, "%s @0x%"HWADDR_PRIx"=%"PRIx64, __func__,
+ addr, val);
+ }
+}
+
+static const MemoryRegionOps pnv_pbcq_nest_xscom_ops = {
+ .read = pnv_pbcq_nest_xscom_read,
+ .write = pnv_pbcq_nest_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static const MemoryRegionOps pnv_pbcq_pci_xscom_ops = {
+ .read = pnv_pbcq_pci_xscom_read,
+ .write = pnv_pbcq_pci_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static const MemoryRegionOps pnv_pbcq_spci_xscom_ops = {
+ .read = pnv_pbcq_spci_xscom_read,
+ .write = pnv_pbcq_spci_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static void pnv_pbcq_default_bars(PnvPBCQState *pbcq)
+{
+ uint64_t mm0, mm1, reg;
+ PnvPHB3 *phb = pbcq->phb;
+
+ mm0 = 0x3d00000000000ull + 0x4000000000ull * phb->chip_id +
+ 0x1000000000ull * phb->phb_id;
+ mm1 = 0x3ff8000000000ull + 0x0200000000ull * phb->chip_id +
+ 0x0080000000ull * phb->phb_id;
+ reg = 0x3fffe40000000ull + 0x0000400000ull * phb->chip_id +
+ 0x0000100000ull * phb->phb_id;
+
+ pbcq->nest_regs[PBCQ_NEST_MMIO_BAR0] = mm0 << 14;
+ pbcq->nest_regs[PBCQ_NEST_MMIO_BAR1] = mm1 << 14;
+ pbcq->nest_regs[PBCQ_NEST_PHB_BAR] = reg << 14;
+ pbcq->nest_regs[PBCQ_NEST_MMIO_MASK0] = 0x3fff000000000ull << 14;
+ pbcq->nest_regs[PBCQ_NEST_MMIO_MASK1] = 0x3ffff80000000ull << 14;
+ pbcq->pci_regs[PBCQ_PCI_BAR2] = reg << 14;
+}
+
+static void pnv_pbcq_realize(DeviceState *dev, Error **errp)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(dev);
+ PnvPHB3 *phb;
+ char name[32];
+
+ assert(pbcq->phb);
+ phb = pbcq->phb;
+
+ /* TODO: Fix OPAL to do that: establish default BAR values */
+ pnv_pbcq_default_bars(pbcq);
+
+ /* Initialize the XSCOM region for the PBCQ registers */
+ snprintf(name, sizeof(name), "xscom-pbcq-nest-%d.%d",
+ phb->chip_id, phb->phb_id);
+ pnv_xscom_region_init(&pbcq->xscom_nest_regs, OBJECT(dev),
+ &pnv_pbcq_nest_xscom_ops, pbcq, name,
+ PNV_XSCOM_PBCQ_NEST_SIZE);
+ snprintf(name, sizeof(name), "xscom-pbcq-pci-%d.%d",
+ phb->chip_id, phb->phb_id);
+ pnv_xscom_region_init(&pbcq->xscom_pci_regs, OBJECT(dev),
+ &pnv_pbcq_pci_xscom_ops, pbcq, name,
+ PNV_XSCOM_PBCQ_PCI_SIZE);
+ snprintf(name, sizeof(name), "xscom-pbcq-spci-%d.%d",
+ phb->chip_id, phb->phb_id);
+ pnv_xscom_region_init(&pbcq->xscom_spci_regs, OBJECT(dev),
+ &pnv_pbcq_spci_xscom_ops, pbcq, name,
+ PNV_XSCOM_PBCQ_SPCI_SIZE);
+}
+
+static int pnv_pbcq_dt_xscom(PnvXScomInterface *dev, void *fdt,
+ int xscom_offset)
+{
+ const char compat[] = "ibm,power8-pbcq";
+ PnvPHB3 *phb = PNV_PBCQ(dev)->phb;
+ char *name;
+ int offset;
+ uint32_t lpc_pcba = PNV_XSCOM_PBCQ_NEST_BASE + 0x400 * phb->phb_id;
+ uint32_t reg[] = {
+ cpu_to_be32(lpc_pcba),
+ cpu_to_be32(PNV_XSCOM_PBCQ_NEST_SIZE),
+ cpu_to_be32(PNV_XSCOM_PBCQ_PCI_BASE + 0x400 * phb->phb_id),
+ cpu_to_be32(PNV_XSCOM_PBCQ_PCI_SIZE),
+ cpu_to_be32(PNV_XSCOM_PBCQ_SPCI_BASE + 0x040 * phb->phb_id),
+ cpu_to_be32(PNV_XSCOM_PBCQ_SPCI_SIZE)
+ };
+
+ name = g_strdup_printf("pbcq@%x", lpc_pcba);
+ offset = fdt_add_subnode(fdt, xscom_offset, name);
+ _FDT(offset);
+ g_free(name);
+
+ _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
+
+ _FDT((fdt_setprop_cell(fdt, offset, "ibm,phb-index", phb->phb_id)));
+ _FDT((fdt_setprop_cell(fdt, offset, "ibm,chip-id", phb->chip_id)));
+ _FDT((fdt_setprop(fdt, offset, "compatible", compat,
+ sizeof(compat))));
+ return 0;
+}
+
+static void phb3_pbcq_instance_init(Object *obj)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(obj);
+
+ object_property_add_link(obj, "phb", TYPE_PNV_PHB3,
+ (Object **)&pbcq->phb,
+ object_property_allow_set_link,
+ OBJ_PROP_LINK_STRONG);
+}
+
+static void pnv_pbcq_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
+
+ xdc->dt_xscom = pnv_pbcq_dt_xscom;
+
+ dc->realize = pnv_pbcq_realize;
+ dc->user_creatable = false;
+}
+
+static const TypeInfo pnv_pbcq_type_info = {
+ .name = TYPE_PNV_PBCQ,
+ .parent = TYPE_DEVICE,
+ .instance_size = sizeof(PnvPBCQState),
+ .instance_init = phb3_pbcq_instance_init,
+ .class_init = pnv_pbcq_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { TYPE_PNV_XSCOM_INTERFACE },
+ { }
+ }
+};
+
+static void pnv_pbcq_register_types(void)
+{
+ type_register_static(&pnv_pbcq_type_info);
+}
+
+type_init(pnv_pbcq_register_types)
diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c
new file mode 100644
index 000000000..5c375a9f2
--- /dev/null
+++ b/hw/pci-host/pnv_phb4.c
@@ -0,0 +1,1437 @@
+/*
+ * QEMU PowerPC PowerNV (POWER9) PHB4 model
+ *
+ * Copyright (c) 2018-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/visitor.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "monitor/monitor.h"
+#include "target/ppc/cpu.h"
+#include "hw/pci-host/pnv_phb4_regs.h"
+#include "hw/pci-host/pnv_phb4.h"
+#include "hw/pci/pcie_host.h"
+#include "hw/pci/pcie_port.h"
+#include "hw/ppc/pnv.h"
+#include "hw/ppc/pnv_xscom.h"
+#include "hw/irq.h"
+#include "hw/qdev-properties.h"
+#include "qom/object.h"
+#include "trace.h"
+
+#define phb_error(phb, fmt, ...) \
+ qemu_log_mask(LOG_GUEST_ERROR, "phb4[%d:%d]: " fmt "\n", \
+ (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
+
+/*
+ * QEMU version of the GETFIELD/SETFIELD macros
+ *
+ * These are common with the PnvXive model.
+ */
+static inline uint64_t GETFIELD(uint64_t mask, uint64_t word)
+{
+ return (word & mask) >> ctz64(mask);
+}
+
+static inline uint64_t SETFIELD(uint64_t mask, uint64_t word,
+ uint64_t value)
+{
+ return (word & ~mask) | ((value << ctz64(mask)) & mask);
+}
+
+static PCIDevice *pnv_phb4_find_cfg_dev(PnvPHB4 *phb)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(phb);
+ uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
+ uint8_t bus, devfn;
+
+ if (!(addr >> 63)) {
+ return NULL;
+ }
+ bus = (addr >> 52) & 0xff;
+ devfn = (addr >> 44) & 0xff;
+
+ /* We don't access the root complex this way */
+ if (bus == 0 && devfn == 0) {
+ return NULL;
+ }
+ return pci_find_device(pci->bus, bus, devfn);
+}
+
+/*
+ * The CONFIG_DATA register expects little endian accesses, but as the
+ * region is big endian, we have to swap the value.
+ */
+static void pnv_phb4_config_write(PnvPHB4 *phb, unsigned off,
+ unsigned size, uint64_t val)
+{
+ uint32_t cfg_addr, limit;
+ PCIDevice *pdev;
+
+ pdev = pnv_phb4_find_cfg_dev(phb);
+ if (!pdev) {
+ return;
+ }
+ cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
+ cfg_addr |= off;
+ limit = pci_config_size(pdev);
+ if (limit <= cfg_addr) {
+ /*
+ * conventional pci device can be behind pcie-to-pci bridge.
+ * 256 <= addr < 4K has no effects.
+ */
+ return;
+ }
+ switch (size) {
+ case 1:
+ break;
+ case 2:
+ val = bswap16(val);
+ break;
+ case 4:
+ val = bswap32(val);
+ break;
+ default:
+ g_assert_not_reached();
+ }
+ pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
+}
+
+static uint64_t pnv_phb4_config_read(PnvPHB4 *phb, unsigned off,
+ unsigned size)
+{
+ uint32_t cfg_addr, limit;
+ PCIDevice *pdev;
+ uint64_t val;
+
+ pdev = pnv_phb4_find_cfg_dev(phb);
+ if (!pdev) {
+ return ~0ull;
+ }
+ cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
+ cfg_addr |= off;
+ limit = pci_config_size(pdev);
+ if (limit <= cfg_addr) {
+ /*
+ * conventional pci device can be behind pcie-to-pci bridge.
+ * 256 <= addr < 4K has no effects.
+ */
+ return ~0ull;
+ }
+ val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
+ switch (size) {
+ case 1:
+ return val;
+ case 2:
+ return bswap16(val);
+ case 4:
+ return bswap32(val);
+ default:
+ g_assert_not_reached();
+ }
+}
+
+/*
+ * Root complex register accesses are memory mapped.
+ */
+static void pnv_phb4_rc_config_write(PnvPHB4 *phb, unsigned off,
+ unsigned size, uint64_t val)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(phb);
+ PCIDevice *pdev;
+
+ if (size != 4) {
+ phb_error(phb, "rc_config_write invalid size %d\n", size);
+ return;
+ }
+
+ pdev = pci_find_device(pci->bus, 0, 0);
+ assert(pdev);
+
+ pci_host_config_write_common(pdev, off, PHB_RC_CONFIG_SIZE,
+ bswap32(val), 4);
+}
+
+static uint64_t pnv_phb4_rc_config_read(PnvPHB4 *phb, unsigned off,
+ unsigned size)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(phb);
+ PCIDevice *pdev;
+ uint64_t val;
+
+ if (size != 4) {
+ phb_error(phb, "rc_config_read invalid size %d\n", size);
+ return ~0ull;
+ }
+
+ pdev = pci_find_device(pci->bus, 0, 0);
+ assert(pdev);
+
+ val = pci_host_config_read_common(pdev, off, PHB_RC_CONFIG_SIZE, 4);
+ return bswap32(val);
+}
+
+static void pnv_phb4_check_mbt(PnvPHB4 *phb, uint32_t index)
+{
+ uint64_t base, start, size, mbe0, mbe1;
+ MemoryRegion *parent;
+ char name[64];
+
+ /* Unmap first */
+ if (memory_region_is_mapped(&phb->mr_mmio[index])) {
+ /* Should we destroy it in RCU friendly way... ? */
+ memory_region_del_subregion(phb->mr_mmio[index].container,
+ &phb->mr_mmio[index]);
+ }
+
+ /* Get table entry */
+ mbe0 = phb->ioda_MBT[(index << 1)];
+ mbe1 = phb->ioda_MBT[(index << 1) + 1];
+
+ if (!(mbe0 & IODA3_MBT0_ENABLE)) {
+ return;
+ }
+
+ /* Grab geometry from registers */
+ base = GETFIELD(IODA3_MBT0_BASE_ADDR, mbe0) << 12;
+ size = GETFIELD(IODA3_MBT1_MASK, mbe1) << 12;
+ size |= 0xff00000000000000ull;
+ size = ~size + 1;
+
+ /* Calculate PCI side start address based on M32/M64 window type */
+ if (mbe0 & IODA3_MBT0_TYPE_M32) {
+ start = phb->regs[PHB_M32_START_ADDR >> 3];
+ if ((start + size) > 0x100000000ull) {
+ phb_error(phb, "M32 set beyond 4GB boundary !");
+ size = 0x100000000 - start;
+ }
+ } else {
+ start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
+ }
+
+ /* TODO: Figure out how to implemet/decode AOMASK */
+
+ /* Check if it matches an enabled MMIO region in the PEC stack */
+ if (memory_region_is_mapped(&phb->stack->mmbar0) &&
+ base >= phb->stack->mmio0_base &&
+ (base + size) <= (phb->stack->mmio0_base + phb->stack->mmio0_size)) {
+ parent = &phb->stack->mmbar0;
+ base -= phb->stack->mmio0_base;
+ } else if (memory_region_is_mapped(&phb->stack->mmbar1) &&
+ base >= phb->stack->mmio1_base &&
+ (base + size) <= (phb->stack->mmio1_base + phb->stack->mmio1_size)) {
+ parent = &phb->stack->mmbar1;
+ base -= phb->stack->mmio1_base;
+ } else {
+ phb_error(phb, "PHB MBAR %d out of parent bounds", index);
+ return;
+ }
+
+ /* Create alias (better name ?) */
+ snprintf(name, sizeof(name), "phb4-mbar%d", index);
+ memory_region_init_alias(&phb->mr_mmio[index], OBJECT(phb), name,
+ &phb->pci_mmio, start, size);
+ memory_region_add_subregion(parent, base, &phb->mr_mmio[index]);
+}
+
+static void pnv_phb4_check_all_mbt(PnvPHB4 *phb)
+{
+ uint64_t i;
+ uint32_t num_windows = phb->big_phb ? PNV_PHB4_MAX_MMIO_WINDOWS :
+ PNV_PHB4_MIN_MMIO_WINDOWS;
+
+ for (i = 0; i < num_windows; i++) {
+ pnv_phb4_check_mbt(phb, i);
+ }
+}
+
+static uint64_t *pnv_phb4_ioda_access(PnvPHB4 *phb,
+ unsigned *out_table, unsigned *out_idx)
+{
+ uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
+ unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
+ unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
+ unsigned int mask;
+ uint64_t *tptr = NULL;
+
+ switch (table) {
+ case IODA3_TBL_LIST:
+ tptr = phb->ioda_LIST;
+ mask = 7;
+ break;
+ case IODA3_TBL_MIST:
+ tptr = phb->ioda_MIST;
+ mask = phb->big_phb ? PNV_PHB4_MAX_MIST : (PNV_PHB4_MAX_MIST >> 1);
+ mask -= 1;
+ break;
+ case IODA3_TBL_RCAM:
+ mask = phb->big_phb ? 127 : 63;
+ break;
+ case IODA3_TBL_MRT:
+ mask = phb->big_phb ? 15 : 7;
+ break;
+ case IODA3_TBL_PESTA:
+ case IODA3_TBL_PESTB:
+ mask = phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
+ mask -= 1;
+ break;
+ case IODA3_TBL_TVT:
+ tptr = phb->ioda_TVT;
+ mask = phb->big_phb ? PNV_PHB4_MAX_TVEs : (PNV_PHB4_MAX_TVEs >> 1);
+ mask -= 1;
+ break;
+ case IODA3_TBL_TCR:
+ case IODA3_TBL_TDR:
+ mask = phb->big_phb ? 1023 : 511;
+ break;
+ case IODA3_TBL_MBT:
+ tptr = phb->ioda_MBT;
+ mask = phb->big_phb ? PNV_PHB4_MAX_MBEs : (PNV_PHB4_MAX_MBEs >> 1);
+ mask -= 1;
+ break;
+ case IODA3_TBL_MDT:
+ tptr = phb->ioda_MDT;
+ mask = phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
+ mask -= 1;
+ break;
+ case IODA3_TBL_PEEV:
+ tptr = phb->ioda_PEEV;
+ mask = phb->big_phb ? PNV_PHB4_MAX_PEEVs : (PNV_PHB4_MAX_PEEVs >> 1);
+ mask -= 1;
+ break;
+ default:
+ phb_error(phb, "invalid IODA table %d", table);
+ return NULL;
+ }
+ index &= mask;
+ if (out_idx) {
+ *out_idx = index;
+ }
+ if (out_table) {
+ *out_table = table;
+ }
+ if (tptr) {
+ tptr += index;
+ }
+ if (adreg & PHB_IODA_AD_AUTOINC) {
+ index = (index + 1) & mask;
+ adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
+ }
+
+ phb->regs[PHB_IODA_ADDR >> 3] = adreg;
+ return tptr;
+}
+
+static uint64_t pnv_phb4_ioda_read(PnvPHB4 *phb)
+{
+ unsigned table, idx;
+ uint64_t *tptr;
+
+ tptr = pnv_phb4_ioda_access(phb, &table, &idx);
+ if (!tptr) {
+ /* Special PESTA case */
+ if (table == IODA3_TBL_PESTA) {
+ return ((uint64_t)(phb->ioda_PEST_AB[idx] & 1)) << 63;
+ } else if (table == IODA3_TBL_PESTB) {
+ return ((uint64_t)(phb->ioda_PEST_AB[idx] & 2)) << 62;
+ }
+ /* Return 0 on unsupported tables, not ff's */
+ return 0;
+ }
+ return *tptr;
+}
+
+static void pnv_phb4_ioda_write(PnvPHB4 *phb, uint64_t val)
+{
+ unsigned table, idx;
+ uint64_t *tptr;
+
+ tptr = pnv_phb4_ioda_access(phb, &table, &idx);
+ if (!tptr) {
+ /* Special PESTA case */
+ if (table == IODA3_TBL_PESTA) {
+ phb->ioda_PEST_AB[idx] &= ~1;
+ phb->ioda_PEST_AB[idx] |= (val >> 63) & 1;
+ } else if (table == IODA3_TBL_PESTB) {
+ phb->ioda_PEST_AB[idx] &= ~2;
+ phb->ioda_PEST_AB[idx] |= (val >> 62) & 2;
+ }
+ return;
+ }
+
+ /* Handle side effects */
+ switch (table) {
+ case IODA3_TBL_LIST:
+ break;
+ case IODA3_TBL_MIST: {
+ /* Special mask for MIST partial write */
+ uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
+ uint32_t mmask = GETFIELD(PHB_IODA_AD_MIST_PWV, adreg);
+ uint64_t v = *tptr;
+ if (mmask == 0) {
+ mmask = 0xf;
+ }
+ if (mmask & 8) {
+ v &= 0x0000ffffffffffffull;
+ v |= 0xcfff000000000000ull & val;
+ }
+ if (mmask & 4) {
+ v &= 0xffff0000ffffffffull;
+ v |= 0x0000cfff00000000ull & val;
+ }
+ if (mmask & 2) {
+ v &= 0xffffffff0000ffffull;
+ v |= 0x00000000cfff0000ull & val;
+ }
+ if (mmask & 1) {
+ v &= 0xffffffffffff0000ull;
+ v |= 0x000000000000cfffull & val;
+ }
+ *tptr = v;
+ break;
+ }
+ case IODA3_TBL_MBT:
+ *tptr = val;
+
+ /* Copy accross the valid bit to the other half */
+ phb->ioda_MBT[idx ^ 1] &= 0x7fffffffffffffffull;
+ phb->ioda_MBT[idx ^ 1] |= 0x8000000000000000ull & val;
+
+ /* Update mappings */
+ pnv_phb4_check_mbt(phb, idx >> 1);
+ break;
+ default:
+ *tptr = val;
+ }
+}
+
+static void pnv_phb4_rtc_invalidate(PnvPHB4 *phb, uint64_t val)
+{
+ PnvPhb4DMASpace *ds;
+
+ /* Always invalidate all for now ... */
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ ds->pe_num = PHB_INVALID_PE;
+ }
+}
+
+static void pnv_phb4_update_msi_regions(PnvPhb4DMASpace *ds)
+{
+ uint64_t cfg = ds->phb->regs[PHB_PHB4_CONFIG >> 3];
+
+ if (cfg & PHB_PHB4C_32BIT_MSI_EN) {
+ if (!memory_region_is_mapped(MEMORY_REGION(&ds->msi32_mr))) {
+ memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
+ 0xffff0000, &ds->msi32_mr);
+ }
+ } else {
+ if (memory_region_is_mapped(MEMORY_REGION(&ds->msi32_mr))) {
+ memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
+ &ds->msi32_mr);
+ }
+ }
+
+ if (cfg & PHB_PHB4C_64BIT_MSI_EN) {
+ if (!memory_region_is_mapped(MEMORY_REGION(&ds->msi64_mr))) {
+ memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
+ (1ull << 60), &ds->msi64_mr);
+ }
+ } else {
+ if (memory_region_is_mapped(MEMORY_REGION(&ds->msi64_mr))) {
+ memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
+ &ds->msi64_mr);
+ }
+ }
+}
+
+static void pnv_phb4_update_all_msi_regions(PnvPHB4 *phb)
+{
+ PnvPhb4DMASpace *ds;
+
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ pnv_phb4_update_msi_regions(ds);
+ }
+}
+
+static void pnv_phb4_update_xsrc(PnvPHB4 *phb)
+{
+ int shift, flags, i, lsi_base;
+ XiveSource *xsrc = &phb->xsrc;
+
+ /* The XIVE source characteristics can be set at run time */
+ if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_PGSZ_64K) {
+ shift = XIVE_ESB_64K;
+ } else {
+ shift = XIVE_ESB_4K;
+ }
+ if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_STORE_EOI) {
+ flags = XIVE_SRC_STORE_EOI;
+ } else {
+ flags = 0;
+ }
+
+ phb->xsrc.esb_shift = shift;
+ phb->xsrc.esb_flags = flags;
+
+ lsi_base = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]);
+ lsi_base <<= 3;
+
+ /* TODO: handle reset values of PHB_LSI_SRC_ID */
+ if (!lsi_base) {
+ return;
+ }
+
+ /* TODO: need a xive_source_irq_reset_lsi() */
+ bitmap_zero(xsrc->lsi_map, xsrc->nr_irqs);
+
+ for (i = 0; i < xsrc->nr_irqs; i++) {
+ bool msi = (i < lsi_base || i >= (lsi_base + 8));
+ if (!msi) {
+ xive_source_irq_set_lsi(xsrc, i);
+ }
+ }
+}
+
+static void pnv_phb4_reg_write(void *opaque, hwaddr off, uint64_t val,
+ unsigned size)
+{
+ PnvPHB4 *phb = PNV_PHB4(opaque);
+ bool changed;
+
+ /* Special case outbound configuration data */
+ if ((off & 0xfffc) == PHB_CONFIG_DATA) {
+ pnv_phb4_config_write(phb, off & 0x3, size, val);
+ return;
+ }
+
+ /* Special case RC configuration space */
+ if ((off & 0xf800) == PHB_RC_CONFIG_BASE) {
+ pnv_phb4_rc_config_write(phb, off & 0x7ff, size, val);
+ return;
+ }
+
+ /* Other registers are 64-bit only */
+ if (size != 8 || off & 0x7) {
+ phb_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
+ off, size);
+ return;
+ }
+
+ /* Handle masking */
+ switch (off) {
+ case PHB_LSI_SOURCE_ID:
+ val &= PHB_LSI_SRC_ID;
+ break;
+ case PHB_M64_UPPER_BITS:
+ val &= 0xff00000000000000ull;
+ break;
+ /* TCE Kill */
+ case PHB_TCE_KILL:
+ /* Clear top 3 bits which HW does to indicate successful queuing */
+ val &= ~(PHB_TCE_KILL_ALL | PHB_TCE_KILL_PE | PHB_TCE_KILL_ONE);
+ break;
+ case PHB_Q_DMA_R:
+ /*
+ * This is enough logic to make SW happy but we aren't
+ * actually quiescing the DMAs
+ */
+ if (val & PHB_Q_DMA_R_AUTORESET) {
+ val = 0;
+ } else {
+ val &= PHB_Q_DMA_R_QUIESCE_DMA;
+ }
+ break;
+ /* LEM stuff */
+ case PHB_LEM_FIR_AND_MASK:
+ phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
+ return;
+ case PHB_LEM_FIR_OR_MASK:
+ phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
+ return;
+ case PHB_LEM_ERROR_AND_MASK:
+ phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
+ return;
+ case PHB_LEM_ERROR_OR_MASK:
+ phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
+ return;
+ case PHB_LEM_WOF:
+ val = 0;
+ break;
+ /* TODO: More regs ..., maybe create a table with masks... */
+
+ /* Read only registers */
+ case PHB_CPU_LOADSTORE_STATUS:
+ case PHB_ETU_ERR_SUMMARY:
+ case PHB_PHB4_GEN_CAP:
+ case PHB_PHB4_TCE_CAP:
+ case PHB_PHB4_IRQ_CAP:
+ case PHB_PHB4_EEH_CAP:
+ return;
+ }
+
+ /* Record whether it changed */
+ changed = phb->regs[off >> 3] != val;
+
+ /* Store in register cache first */
+ phb->regs[off >> 3] = val;
+
+ /* Handle side effects */
+ switch (off) {
+ case PHB_PHB4_CONFIG:
+ if (changed) {
+ pnv_phb4_update_all_msi_regions(phb);
+ }
+ break;
+ case PHB_M32_START_ADDR:
+ case PHB_M64_UPPER_BITS:
+ if (changed) {
+ pnv_phb4_check_all_mbt(phb);
+ }
+ break;
+
+ /* IODA table accesses */
+ case PHB_IODA_DATA0:
+ pnv_phb4_ioda_write(phb, val);
+ break;
+
+ /* RTC invalidation */
+ case PHB_RTC_INVALIDATE:
+ pnv_phb4_rtc_invalidate(phb, val);
+ break;
+
+ /* PHB Control (Affects XIVE source) */
+ case PHB_CTRLR:
+ case PHB_LSI_SOURCE_ID:
+ pnv_phb4_update_xsrc(phb);
+ break;
+
+ /* Silent simple writes */
+ case PHB_ASN_CMPM:
+ case PHB_CONFIG_ADDRESS:
+ case PHB_IODA_ADDR:
+ case PHB_TCE_KILL:
+ case PHB_TCE_SPEC_CTL:
+ case PHB_PEST_BAR:
+ case PHB_PELTV_BAR:
+ case PHB_RTT_BAR:
+ case PHB_LEM_FIR_ACCUM:
+ case PHB_LEM_ERROR_MASK:
+ case PHB_LEM_ACTION0:
+ case PHB_LEM_ACTION1:
+ case PHB_TCE_TAG_ENABLE:
+ case PHB_INT_NOTIFY_ADDR:
+ case PHB_INT_NOTIFY_INDEX:
+ case PHB_DMARD_SYNC:
+ break;
+
+ /* Noise on anything else */
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb4: reg_write 0x%"PRIx64"=%"PRIx64"\n",
+ off, val);
+ }
+}
+
+static uint64_t pnv_phb4_reg_read(void *opaque, hwaddr off, unsigned size)
+{
+ PnvPHB4 *phb = PNV_PHB4(opaque);
+ uint64_t val;
+
+ if ((off & 0xfffc) == PHB_CONFIG_DATA) {
+ return pnv_phb4_config_read(phb, off & 0x3, size);
+ }
+
+ /* Special case RC configuration space */
+ if ((off & 0xf800) == PHB_RC_CONFIG_BASE) {
+ return pnv_phb4_rc_config_read(phb, off & 0x7ff, size);
+ }
+
+ /* Other registers are 64-bit only */
+ if (size != 8 || off & 0x7) {
+ phb_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
+ off, size);
+ return ~0ull;
+ }
+
+ /* Default read from cache */
+ val = phb->regs[off >> 3];
+
+ switch (off) {
+ case PHB_VERSION:
+ return phb->version;
+
+ /* Read-only */
+ case PHB_PHB4_GEN_CAP:
+ return 0xe4b8000000000000ull;
+ case PHB_PHB4_TCE_CAP:
+ return phb->big_phb ? 0x4008440000000400ull : 0x2008440000000200ull;
+ case PHB_PHB4_IRQ_CAP:
+ return phb->big_phb ? 0x0800000000001000ull : 0x0800000000000800ull;
+ case PHB_PHB4_EEH_CAP:
+ return phb->big_phb ? 0x2000000000000000ull : 0x1000000000000000ull;
+
+ /* IODA table accesses */
+ case PHB_IODA_DATA0:
+ return pnv_phb4_ioda_read(phb);
+
+ /* Link training always appears trained */
+ case PHB_PCIE_DLP_TRAIN_CTL:
+ /* TODO: Do something sensible with speed ? */
+ return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TL_LINKACT;
+
+ /* DMA read sync: make it look like it's complete */
+ case PHB_DMARD_SYNC:
+ return PHB_DMARD_SYNC_COMPLETE;
+
+ /* Silent simple reads */
+ case PHB_LSI_SOURCE_ID:
+ case PHB_CPU_LOADSTORE_STATUS:
+ case PHB_ASN_CMPM:
+ case PHB_PHB4_CONFIG:
+ case PHB_M32_START_ADDR:
+ case PHB_CONFIG_ADDRESS:
+ case PHB_IODA_ADDR:
+ case PHB_RTC_INVALIDATE:
+ case PHB_TCE_KILL:
+ case PHB_TCE_SPEC_CTL:
+ case PHB_PEST_BAR:
+ case PHB_PELTV_BAR:
+ case PHB_RTT_BAR:
+ case PHB_M64_UPPER_BITS:
+ case PHB_CTRLR:
+ case PHB_LEM_FIR_ACCUM:
+ case PHB_LEM_ERROR_MASK:
+ case PHB_LEM_ACTION0:
+ case PHB_LEM_ACTION1:
+ case PHB_TCE_TAG_ENABLE:
+ case PHB_INT_NOTIFY_ADDR:
+ case PHB_INT_NOTIFY_INDEX:
+ case PHB_Q_DMA_R:
+ case PHB_ETU_ERR_SUMMARY:
+ break;
+
+ /* Noise on anything else */
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb4: reg_read 0x%"PRIx64"=%"PRIx64"\n",
+ off, val);
+ }
+ return val;
+}
+
+static const MemoryRegionOps pnv_phb4_reg_ops = {
+ .read = pnv_phb4_reg_read,
+ .write = pnv_phb4_reg_write,
+ .valid.min_access_size = 1,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 1,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static uint64_t pnv_phb4_xscom_read(void *opaque, hwaddr addr, unsigned size)
+{
+ PnvPHB4 *phb = PNV_PHB4(opaque);
+ uint32_t reg = addr >> 3;
+ uint64_t val;
+ hwaddr offset;
+
+ switch (reg) {
+ case PHB_SCOM_HV_IND_ADDR:
+ return phb->scom_hv_ind_addr_reg;
+
+ case PHB_SCOM_HV_IND_DATA:
+ if (!(phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_VALID)) {
+ phb_error(phb, "Invalid indirect address");
+ return ~0ull;
+ }
+ size = (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_4B) ? 4 : 8;
+ offset = GETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR, phb->scom_hv_ind_addr_reg);
+ val = pnv_phb4_reg_read(phb, offset, size);
+ if (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_AUTOINC) {
+ offset += size;
+ offset &= 0x3fff;
+ phb->scom_hv_ind_addr_reg = SETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR,
+ phb->scom_hv_ind_addr_reg,
+ offset);
+ }
+ return val;
+ case PHB_SCOM_ETU_LEM_FIR:
+ case PHB_SCOM_ETU_LEM_FIR_AND:
+ case PHB_SCOM_ETU_LEM_FIR_OR:
+ case PHB_SCOM_ETU_LEM_FIR_MSK:
+ case PHB_SCOM_ETU_LEM_ERR_MSK_AND:
+ case PHB_SCOM_ETU_LEM_ERR_MSK_OR:
+ case PHB_SCOM_ETU_LEM_ACT0:
+ case PHB_SCOM_ETU_LEM_ACT1:
+ case PHB_SCOM_ETU_LEM_WOF:
+ offset = ((reg - PHB_SCOM_ETU_LEM_FIR) << 3) + PHB_LEM_FIR_ACCUM;
+ return pnv_phb4_reg_read(phb, offset, size);
+ case PHB_SCOM_ETU_PMON_CONFIG:
+ case PHB_SCOM_ETU_PMON_CTR0:
+ case PHB_SCOM_ETU_PMON_CTR1:
+ case PHB_SCOM_ETU_PMON_CTR2:
+ case PHB_SCOM_ETU_PMON_CTR3:
+ offset = ((reg - PHB_SCOM_ETU_PMON_CONFIG) << 3) + PHB_PERFMON_CONFIG;
+ return pnv_phb4_reg_read(phb, offset, size);
+
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb4: xscom_read 0x%"HWADDR_PRIx"\n", addr);
+ return ~0ull;
+ }
+}
+
+static void pnv_phb4_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPHB4 *phb = PNV_PHB4(opaque);
+ uint32_t reg = addr >> 3;
+ hwaddr offset;
+
+ switch (reg) {
+ case PHB_SCOM_HV_IND_ADDR:
+ phb->scom_hv_ind_addr_reg = val & 0xe000000000001fff;
+ break;
+ case PHB_SCOM_HV_IND_DATA:
+ if (!(phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_VALID)) {
+ phb_error(phb, "Invalid indirect address");
+ break;
+ }
+ size = (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_4B) ? 4 : 8;
+ offset = GETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR, phb->scom_hv_ind_addr_reg);
+ pnv_phb4_reg_write(phb, offset, val, size);
+ if (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_AUTOINC) {
+ offset += size;
+ offset &= 0x3fff;
+ phb->scom_hv_ind_addr_reg = SETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR,
+ phb->scom_hv_ind_addr_reg,
+ offset);
+ }
+ break;
+ case PHB_SCOM_ETU_LEM_FIR:
+ case PHB_SCOM_ETU_LEM_FIR_AND:
+ case PHB_SCOM_ETU_LEM_FIR_OR:
+ case PHB_SCOM_ETU_LEM_FIR_MSK:
+ case PHB_SCOM_ETU_LEM_ERR_MSK_AND:
+ case PHB_SCOM_ETU_LEM_ERR_MSK_OR:
+ case PHB_SCOM_ETU_LEM_ACT0:
+ case PHB_SCOM_ETU_LEM_ACT1:
+ case PHB_SCOM_ETU_LEM_WOF:
+ offset = ((reg - PHB_SCOM_ETU_LEM_FIR) << 3) + PHB_LEM_FIR_ACCUM;
+ pnv_phb4_reg_write(phb, offset, val, size);
+ break;
+ case PHB_SCOM_ETU_PMON_CONFIG:
+ case PHB_SCOM_ETU_PMON_CTR0:
+ case PHB_SCOM_ETU_PMON_CTR1:
+ case PHB_SCOM_ETU_PMON_CTR2:
+ case PHB_SCOM_ETU_PMON_CTR3:
+ offset = ((reg - PHB_SCOM_ETU_PMON_CONFIG) << 3) + PHB_PERFMON_CONFIG;
+ pnv_phb4_reg_write(phb, offset, val, size);
+ break;
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb4: xscom_write 0x%"HWADDR_PRIx
+ "=%"PRIx64"\n", addr, val);
+ }
+}
+
+const MemoryRegionOps pnv_phb4_xscom_ops = {
+ .read = pnv_phb4_xscom_read,
+ .write = pnv_phb4_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static int pnv_phb4_map_irq(PCIDevice *pci_dev, int irq_num)
+{
+ /* Check that out properly ... */
+ return irq_num & 3;
+}
+
+static void pnv_phb4_set_irq(void *opaque, int irq_num, int level)
+{
+ PnvPHB4 *phb = PNV_PHB4(opaque);
+ uint32_t lsi_base;
+
+ /* LSI only ... */
+ if (irq_num > 3) {
+ phb_error(phb, "IRQ %x is not an LSI", irq_num);
+ }
+ lsi_base = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]);
+ lsi_base <<= 3;
+ qemu_set_irq(phb->qirqs[lsi_base + irq_num], level);
+}
+
+static bool pnv_phb4_resolve_pe(PnvPhb4DMASpace *ds)
+{
+ uint64_t rtt, addr;
+ uint16_t rte;
+ int bus_num;
+ int num_PEs;
+
+ /* Already resolved ? */
+ if (ds->pe_num != PHB_INVALID_PE) {
+ return true;
+ }
+
+ /* We need to lookup the RTT */
+ rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
+ if (!(rtt & PHB_RTT_BAR_ENABLE)) {
+ phb_error(ds->phb, "DMA with RTT BAR disabled !");
+ /* Set error bits ? fence ? ... */
+ return false;
+ }
+
+ /* Read RTE */
+ bus_num = pci_bus_num(ds->bus);
+ addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
+ addr += 2 * PCI_BUILD_BDF(bus_num, ds->devfn);
+ if (dma_memory_read(&address_space_memory, addr, &rte, sizeof(rte))) {
+ phb_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
+ /* Set error bits ? fence ? ... */
+ return false;
+ }
+ rte = be16_to_cpu(rte);
+
+ /* Fail upon reading of invalid PE# */
+ num_PEs = ds->phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
+ if (rte >= num_PEs) {
+ phb_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
+ rte &= num_PEs - 1;
+ }
+ ds->pe_num = rte;
+ return true;
+}
+
+static void pnv_phb4_translate_tve(PnvPhb4DMASpace *ds, hwaddr addr,
+ bool is_write, uint64_t tve,
+ IOMMUTLBEntry *tlb)
+{
+ uint64_t tta = GETFIELD(IODA3_TVT_TABLE_ADDR, tve);
+ int32_t lev = GETFIELD(IODA3_TVT_NUM_LEVELS, tve);
+ uint32_t tts = GETFIELD(IODA3_TVT_TCE_TABLE_SIZE, tve);
+ uint32_t tps = GETFIELD(IODA3_TVT_IO_PSIZE, tve);
+
+ /* Invalid levels */
+ if (lev > 4) {
+ phb_error(ds->phb, "Invalid #levels in TVE %d", lev);
+ return;
+ }
+
+ /* Invalid entry */
+ if (tts == 0) {
+ phb_error(ds->phb, "Access to invalid TVE");
+ return;
+ }
+
+ /* IO Page Size of 0 means untranslated, else use TCEs */
+ if (tps == 0) {
+ /* TODO: Handle boundaries */
+
+ /* Use 4k pages like q35 ... for now */
+ tlb->iova = addr & 0xfffffffffffff000ull;
+ tlb->translated_addr = addr & 0x0003fffffffff000ull;
+ tlb->addr_mask = 0xfffull;
+ tlb->perm = IOMMU_RW;
+ } else {
+ uint32_t tce_shift, tbl_shift, sh;
+ uint64_t base, taddr, tce, tce_mask;
+
+ /* Address bits per bottom level TCE entry */
+ tce_shift = tps + 11;
+
+ /* Address bits per table level */
+ tbl_shift = tts + 8;
+
+ /* Top level table base address */
+ base = tta << 12;
+
+ /* Total shift to first level */
+ sh = tbl_shift * lev + tce_shift;
+
+ /* TODO: Limit to support IO page sizes */
+
+ /* TODO: Multi-level untested */
+ while ((lev--) >= 0) {
+ /* Grab the TCE address */
+ taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
+ if (dma_memory_read(&address_space_memory, taddr, &tce,
+ sizeof(tce))) {
+ phb_error(ds->phb, "Failed to read TCE at 0x%"PRIx64, taddr);
+ return;
+ }
+ tce = be64_to_cpu(tce);
+
+ /* Check permission for indirect TCE */
+ if ((lev >= 0) && !(tce & 3)) {
+ phb_error(ds->phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
+ phb_error(ds->phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
+ is_write ? 'W' : 'R', tve);
+ phb_error(ds->phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
+ tta, lev, tts, tps);
+ return;
+ }
+ sh -= tbl_shift;
+ base = tce & ~0xfffull;
+ }
+
+ /* We exit the loop with TCE being the final TCE */
+ tce_mask = ~((1ull << tce_shift) - 1);
+ tlb->iova = addr & tce_mask;
+ tlb->translated_addr = tce & tce_mask;
+ tlb->addr_mask = ~tce_mask;
+ tlb->perm = tce & 3;
+ if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
+ phb_error(ds->phb, "TCE access fault at 0x%"PRIx64, taddr);
+ phb_error(ds->phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
+ is_write ? 'W' : 'R', tve);
+ phb_error(ds->phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
+ tta, lev, tts, tps);
+ }
+ }
+}
+
+static IOMMUTLBEntry pnv_phb4_translate_iommu(IOMMUMemoryRegion *iommu,
+ hwaddr addr,
+ IOMMUAccessFlags flag,
+ int iommu_idx)
+{
+ PnvPhb4DMASpace *ds = container_of(iommu, PnvPhb4DMASpace, dma_mr);
+ int tve_sel;
+ uint64_t tve, cfg;
+ IOMMUTLBEntry ret = {
+ .target_as = &address_space_memory,
+ .iova = addr,
+ .translated_addr = 0,
+ .addr_mask = ~(hwaddr)0,
+ .perm = IOMMU_NONE,
+ };
+
+ /* Resolve PE# */
+ if (!pnv_phb4_resolve_pe(ds)) {
+ phb_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
+ ds->bus, pci_bus_num(ds->bus), ds->devfn);
+ return ret;
+ }
+
+ /* Check top bits */
+ switch (addr >> 60) {
+ case 00:
+ /* DMA or 32-bit MSI ? */
+ cfg = ds->phb->regs[PHB_PHB4_CONFIG >> 3];
+ if ((cfg & PHB_PHB4C_32BIT_MSI_EN) &&
+ ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
+ phb_error(ds->phb, "xlate on 32-bit MSI region");
+ return ret;
+ }
+ /* Choose TVE XXX Use PHB4 Control Register */
+ tve_sel = (addr >> 59) & 1;
+ tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
+ pnv_phb4_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
+ break;
+ case 01:
+ phb_error(ds->phb, "xlate on 64-bit MSI region");
+ break;
+ default:
+ phb_error(ds->phb, "xlate on unsupported address 0x%"PRIx64, addr);
+ }
+ return ret;
+}
+
+#define TYPE_PNV_PHB4_IOMMU_MEMORY_REGION "pnv-phb4-iommu-memory-region"
+DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB4_IOMMU_MEMORY_REGION,
+ TYPE_PNV_PHB4_IOMMU_MEMORY_REGION)
+
+static void pnv_phb4_iommu_memory_region_class_init(ObjectClass *klass,
+ void *data)
+{
+ IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
+
+ imrc->translate = pnv_phb4_translate_iommu;
+}
+
+static const TypeInfo pnv_phb4_iommu_memory_region_info = {
+ .parent = TYPE_IOMMU_MEMORY_REGION,
+ .name = TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
+ .class_init = pnv_phb4_iommu_memory_region_class_init,
+};
+
+/*
+ * MSI/MSIX memory region implementation.
+ * The handler handles both MSI and MSIX.
+ */
+static void pnv_phb4_msi_write(void *opaque, hwaddr addr,
+ uint64_t data, unsigned size)
+{
+ PnvPhb4DMASpace *ds = opaque;
+ PnvPHB4 *phb = ds->phb;
+
+ uint32_t src = ((addr >> 4) & 0xffff) | (data & 0x1f);
+
+ /* Resolve PE# */
+ if (!pnv_phb4_resolve_pe(ds)) {
+ phb_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
+ ds->bus, pci_bus_num(ds->bus), ds->devfn);
+ return;
+ }
+
+ /* TODO: Check it doesn't collide with LSIs */
+ if (src >= phb->xsrc.nr_irqs) {
+ phb_error(phb, "MSI %d out of bounds", src);
+ return;
+ }
+
+ /* TODO: check PE/MSI assignement */
+
+ qemu_irq_pulse(phb->qirqs[src]);
+}
+
+/* There is no .read as the read result is undefined by PCI spec */
+static uint64_t pnv_phb4_msi_read(void *opaque, hwaddr addr, unsigned size)
+{
+ PnvPhb4DMASpace *ds = opaque;
+
+ phb_error(ds->phb, "Invalid MSI read @ 0x%" HWADDR_PRIx, addr);
+ return -1;
+}
+
+static const MemoryRegionOps pnv_phb4_msi_ops = {
+ .read = pnv_phb4_msi_read,
+ .write = pnv_phb4_msi_write,
+ .endianness = DEVICE_LITTLE_ENDIAN
+};
+
+static PnvPhb4DMASpace *pnv_phb4_dma_find(PnvPHB4 *phb, PCIBus *bus, int devfn)
+{
+ PnvPhb4DMASpace *ds;
+
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ if (ds->bus == bus && ds->devfn == devfn) {
+ break;
+ }
+ }
+ return ds;
+}
+
+static AddressSpace *pnv_phb4_dma_iommu(PCIBus *bus, void *opaque, int devfn)
+{
+ PnvPHB4 *phb = opaque;
+ PnvPhb4DMASpace *ds;
+ char name[32];
+
+ ds = pnv_phb4_dma_find(phb, bus, devfn);
+
+ if (ds == NULL) {
+ ds = g_malloc0(sizeof(PnvPhb4DMASpace));
+ ds->bus = bus;
+ ds->devfn = devfn;
+ ds->pe_num = PHB_INVALID_PE;
+ ds->phb = phb;
+ snprintf(name, sizeof(name), "phb4-%d.%d-iommu", phb->chip_id,
+ phb->phb_id);
+ memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
+ TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
+ OBJECT(phb), name, UINT64_MAX);
+ address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
+ name);
+ memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb4_msi_ops,
+ ds, "msi32", 0x10000);
+ memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb4_msi_ops,
+ ds, "msi64", 0x100000);
+ pnv_phb4_update_msi_regions(ds);
+
+ QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
+ }
+ return &ds->dma_as;
+}
+
+static void pnv_phb4_instance_init(Object *obj)
+{
+ PnvPHB4 *phb = PNV_PHB4(obj);
+
+ QLIST_INIT(&phb->dma_spaces);
+
+ /* XIVE interrupt source object */
+ object_initialize_child(obj, "source", &phb->xsrc, TYPE_XIVE_SOURCE);
+
+ /* Root Port */
+ object_initialize_child(obj, "root", &phb->root, TYPE_PNV_PHB4_ROOT_PORT);
+
+ qdev_prop_set_int32(DEVICE(&phb->root), "addr", PCI_DEVFN(0, 0));
+ qdev_prop_set_bit(DEVICE(&phb->root), "multifunction", false);
+}
+
+static void pnv_phb4_realize(DeviceState *dev, Error **errp)
+{
+ PnvPHB4 *phb = PNV_PHB4(dev);
+ PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+ XiveSource *xsrc = &phb->xsrc;
+ int nr_irqs;
+ char name[32];
+
+ assert(phb->stack);
+
+ /* Set the "big_phb" flag */
+ phb->big_phb = phb->phb_id == 0 || phb->phb_id == 3;
+
+ /* Controller Registers */
+ snprintf(name, sizeof(name), "phb4-%d.%d-regs", phb->chip_id,
+ phb->phb_id);
+ memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb4_reg_ops, phb,
+ name, 0x2000);
+
+ /*
+ * PHB4 doesn't support IO space. However, qemu gets very upset if
+ * we don't have an IO region to anchor IO BARs onto so we just
+ * initialize one which we never hook up to anything
+ */
+
+ snprintf(name, sizeof(name), "phb4-%d.%d-pci-io", phb->chip_id,
+ phb->phb_id);
+ memory_region_init(&phb->pci_io, OBJECT(phb), name, 0x10000);
+
+ snprintf(name, sizeof(name), "phb4-%d.%d-pci-mmio", phb->chip_id,
+ phb->phb_id);
+ memory_region_init(&phb->pci_mmio, OBJECT(phb), name,
+ PCI_MMIO_TOTAL_SIZE);
+
+ pci->bus = pci_register_root_bus(dev, "root-bus",
+ pnv_phb4_set_irq, pnv_phb4_map_irq, phb,
+ &phb->pci_mmio, &phb->pci_io,
+ 0, 4, TYPE_PNV_PHB4_ROOT_BUS);
+ pci_setup_iommu(pci->bus, pnv_phb4_dma_iommu, phb);
+
+ /* Add a single Root port */
+ qdev_prop_set_uint8(DEVICE(&phb->root), "chassis", phb->chip_id);
+ qdev_prop_set_uint16(DEVICE(&phb->root), "slot", phb->phb_id);
+ qdev_realize(DEVICE(&phb->root), BUS(pci->bus), &error_fatal);
+
+ /* Setup XIVE Source */
+ if (phb->big_phb) {
+ nr_irqs = PNV_PHB4_MAX_INTs;
+ } else {
+ nr_irqs = PNV_PHB4_MAX_INTs >> 1;
+ }
+ object_property_set_int(OBJECT(xsrc), "nr-irqs", nr_irqs, &error_fatal);
+ object_property_set_link(OBJECT(xsrc), "xive", OBJECT(phb), &error_fatal);
+ if (!qdev_realize(DEVICE(xsrc), NULL, errp)) {
+ return;
+ }
+
+ pnv_phb4_update_xsrc(phb);
+
+ phb->qirqs = qemu_allocate_irqs(xive_source_set_irq, xsrc, xsrc->nr_irqs);
+}
+
+static void pnv_phb4_reset(DeviceState *dev)
+{
+ PnvPHB4 *phb = PNV_PHB4(dev);
+ PCIDevice *root_dev = PCI_DEVICE(&phb->root);
+
+ /*
+ * Configure PCI device id at reset using a property.
+ */
+ pci_config_set_vendor_id(root_dev->config, PCI_VENDOR_ID_IBM);
+ pci_config_set_device_id(root_dev->config, phb->device_id);
+}
+
+static const char *pnv_phb4_root_bus_path(PCIHostState *host_bridge,
+ PCIBus *rootbus)
+{
+ PnvPHB4 *phb = PNV_PHB4(host_bridge);
+
+ snprintf(phb->bus_path, sizeof(phb->bus_path), "00%02x:%02x",
+ phb->chip_id, phb->phb_id);
+ return phb->bus_path;
+}
+
+static void pnv_phb4_xive_notify(XiveNotifier *xf, uint32_t srcno)
+{
+ PnvPHB4 *phb = PNV_PHB4(xf);
+ uint64_t notif_port = phb->regs[PHB_INT_NOTIFY_ADDR >> 3];
+ uint32_t offset = phb->regs[PHB_INT_NOTIFY_INDEX >> 3];
+ uint64_t data = XIVE_TRIGGER_PQ | offset | srcno;
+ MemTxResult result;
+
+ trace_pnv_phb4_xive_notify(notif_port, data);
+
+ address_space_stq_be(&address_space_memory, notif_port, data,
+ MEMTXATTRS_UNSPECIFIED, &result);
+ if (result != MEMTX_OK) {
+ phb_error(phb, "trigger failed @%"HWADDR_PRIx "\n", notif_port);
+ return;
+ }
+}
+
+static Property pnv_phb4_properties[] = {
+ DEFINE_PROP_UINT32("index", PnvPHB4, phb_id, 0),
+ DEFINE_PROP_UINT32("chip-id", PnvPHB4, chip_id, 0),
+ DEFINE_PROP_UINT64("version", PnvPHB4, version, 0),
+ DEFINE_PROP_UINT16("device-id", PnvPHB4, device_id, 0),
+ DEFINE_PROP_LINK("stack", PnvPHB4, stack, TYPE_PNV_PHB4_PEC_STACK,
+ PnvPhb4PecStack *),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void pnv_phb4_class_init(ObjectClass *klass, void *data)
+{
+ PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ XiveNotifierClass *xfc = XIVE_NOTIFIER_CLASS(klass);
+
+ hc->root_bus_path = pnv_phb4_root_bus_path;
+ dc->realize = pnv_phb4_realize;
+ device_class_set_props(dc, pnv_phb4_properties);
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->user_creatable = false;
+ dc->reset = pnv_phb4_reset;
+
+ xfc->notify = pnv_phb4_xive_notify;
+}
+
+static const TypeInfo pnv_phb4_type_info = {
+ .name = TYPE_PNV_PHB4,
+ .parent = TYPE_PCIE_HOST_BRIDGE,
+ .instance_init = pnv_phb4_instance_init,
+ .instance_size = sizeof(PnvPHB4),
+ .class_init = pnv_phb4_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { TYPE_XIVE_NOTIFIER },
+ { },
+ }
+};
+
+static void pnv_phb4_root_bus_class_init(ObjectClass *klass, void *data)
+{
+ BusClass *k = BUS_CLASS(klass);
+
+ /*
+ * PHB4 has only a single root complex. Enforce the limit on the
+ * parent bus
+ */
+ k->max_dev = 1;
+}
+
+static const TypeInfo pnv_phb4_root_bus_info = {
+ .name = TYPE_PNV_PHB4_ROOT_BUS,
+ .parent = TYPE_PCIE_BUS,
+ .class_init = pnv_phb4_root_bus_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_PCIE_DEVICE },
+ { }
+ },
+};
+
+static void pnv_phb4_root_port_reset(DeviceState *dev)
+{
+ PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev);
+ PCIDevice *d = PCI_DEVICE(dev);
+ uint8_t *conf = d->config;
+
+ rpc->parent_reset(dev);
+
+ pci_byte_test_and_set_mask(conf + PCI_IO_BASE,
+ PCI_IO_RANGE_MASK & 0xff);
+ pci_byte_test_and_clear_mask(conf + PCI_IO_LIMIT,
+ PCI_IO_RANGE_MASK & 0xff);
+ pci_set_word(conf + PCI_MEMORY_BASE, 0);
+ pci_set_word(conf + PCI_MEMORY_LIMIT, 0xfff0);
+ pci_set_word(conf + PCI_PREF_MEMORY_BASE, 0x1);
+ pci_set_word(conf + PCI_PREF_MEMORY_LIMIT, 0xfff1);
+ pci_set_long(conf + PCI_PREF_BASE_UPPER32, 0x1); /* Hack */
+ pci_set_long(conf + PCI_PREF_LIMIT_UPPER32, 0xffffffff);
+}
+
+static void pnv_phb4_root_port_realize(DeviceState *dev, Error **errp)
+{
+ PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev);
+ Error *local_err = NULL;
+
+ rpc->parent_realize(dev, &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+}
+
+static void pnv_phb4_root_port_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ PCIERootPortClass *rpc = PCIE_ROOT_PORT_CLASS(klass);
+
+ dc->desc = "IBM PHB4 PCIE Root Port";
+ dc->user_creatable = false;
+
+ device_class_set_parent_realize(dc, pnv_phb4_root_port_realize,
+ &rpc->parent_realize);
+ device_class_set_parent_reset(dc, pnv_phb4_root_port_reset,
+ &rpc->parent_reset);
+
+ k->vendor_id = PCI_VENDOR_ID_IBM;
+ k->device_id = PNV_PHB4_DEVICE_ID;
+ k->revision = 0;
+
+ rpc->exp_offset = 0x48;
+ rpc->aer_offset = 0x100;
+
+ dc->reset = &pnv_phb4_root_port_reset;
+}
+
+static const TypeInfo pnv_phb4_root_port_info = {
+ .name = TYPE_PNV_PHB4_ROOT_PORT,
+ .parent = TYPE_PCIE_ROOT_PORT,
+ .instance_size = sizeof(PnvPHB4RootPort),
+ .class_init = pnv_phb4_root_port_class_init,
+};
+
+static void pnv_phb4_register_types(void)
+{
+ type_register_static(&pnv_phb4_root_bus_info);
+ type_register_static(&pnv_phb4_root_port_info);
+ type_register_static(&pnv_phb4_type_info);
+ type_register_static(&pnv_phb4_iommu_memory_region_info);
+}
+
+type_init(pnv_phb4_register_types);
+
+void pnv_phb4_update_regions(PnvPhb4PecStack *stack)
+{
+ PnvPHB4 *phb = &stack->phb;
+
+ /* Unmap first always */
+ if (memory_region_is_mapped(&phb->mr_regs)) {
+ memory_region_del_subregion(&stack->phbbar, &phb->mr_regs);
+ }
+ if (memory_region_is_mapped(&phb->xsrc.esb_mmio)) {
+ memory_region_del_subregion(&stack->intbar, &phb->xsrc.esb_mmio);
+ }
+
+ /* Map registers if enabled */
+ if (memory_region_is_mapped(&stack->phbbar)) {
+ memory_region_add_subregion(&stack->phbbar, 0, &phb->mr_regs);
+ }
+
+ /* Map ESB if enabled */
+ if (memory_region_is_mapped(&stack->intbar)) {
+ memory_region_add_subregion(&stack->intbar, 0, &phb->xsrc.esb_mmio);
+ }
+
+ /* Check/update m32 */
+ pnv_phb4_check_all_mbt(phb);
+}
+
+void pnv_phb4_pic_print_info(PnvPHB4 *phb, Monitor *mon)
+{
+ uint32_t offset = phb->regs[PHB_INT_NOTIFY_INDEX >> 3];
+
+ monitor_printf(mon, "PHB4[%x:%x] Source %08x .. %08x\n",
+ phb->chip_id, phb->phb_id,
+ offset, offset + phb->xsrc.nr_irqs - 1);
+ xive_source_pic_print_info(&phb->xsrc, 0, mon);
+}
diff --git a/hw/pci-host/pnv_phb4_pec.c b/hw/pci-host/pnv_phb4_pec.c
new file mode 100644
index 000000000..741ddc90e
--- /dev/null
+++ b/hw/pci-host/pnv_phb4_pec.c
@@ -0,0 +1,593 @@
+/*
+ * QEMU PowerPC PowerNV (POWER9) PHB4 model
+ *
+ * Copyright (c) 2018-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "qemu/log.h"
+#include "target/ppc/cpu.h"
+#include "hw/ppc/fdt.h"
+#include "hw/pci-host/pnv_phb4_regs.h"
+#include "hw/pci-host/pnv_phb4.h"
+#include "hw/ppc/pnv_xscom.h"
+#include "hw/pci/pci_bridge.h"
+#include "hw/pci/pci_bus.h"
+#include "hw/ppc/pnv.h"
+#include "hw/qdev-properties.h"
+
+#include <libfdt.h>
+
+#define phb_pec_error(pec, fmt, ...) \
+ qemu_log_mask(LOG_GUEST_ERROR, "phb4_pec[%d:%d]: " fmt "\n", \
+ (pec)->chip_id, (pec)->index, ## __VA_ARGS__)
+
+
+static uint64_t pnv_pec_nest_xscom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PnvPhb4PecState *pec = PNV_PHB4_PEC(opaque);
+ uint32_t reg = addr >> 3;
+
+ /* TODO: add list of allowed registers and error out if not */
+ return pec->nest_regs[reg];
+}
+
+static void pnv_pec_nest_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPhb4PecState *pec = PNV_PHB4_PEC(opaque);
+ uint32_t reg = addr >> 3;
+
+ switch (reg) {
+ case PEC_NEST_PBCQ_HW_CONFIG:
+ case PEC_NEST_DROP_PRIO_CTRL:
+ case PEC_NEST_PBCQ_ERR_INJECT:
+ case PEC_NEST_PCI_NEST_CLK_TRACE_CTL:
+ case PEC_NEST_PBCQ_PMON_CTRL:
+ case PEC_NEST_PBCQ_PBUS_ADDR_EXT:
+ case PEC_NEST_PBCQ_PRED_VEC_TIMEOUT:
+ case PEC_NEST_CAPP_CTRL:
+ case PEC_NEST_PBCQ_READ_STK_OVR:
+ case PEC_NEST_PBCQ_WRITE_STK_OVR:
+ case PEC_NEST_PBCQ_STORE_STK_OVR:
+ case PEC_NEST_PBCQ_RETRY_BKOFF_CTRL:
+ pec->nest_regs[reg] = val;
+ break;
+ default:
+ phb_pec_error(pec, "%s @0x%"HWADDR_PRIx"=%"PRIx64"\n", __func__,
+ addr, val);
+ }
+}
+
+static const MemoryRegionOps pnv_pec_nest_xscom_ops = {
+ .read = pnv_pec_nest_xscom_read,
+ .write = pnv_pec_nest_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static uint64_t pnv_pec_pci_xscom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PnvPhb4PecState *pec = PNV_PHB4_PEC(opaque);
+ uint32_t reg = addr >> 3;
+
+ /* TODO: add list of allowed registers and error out if not */
+ return pec->pci_regs[reg];
+}
+
+static void pnv_pec_pci_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPhb4PecState *pec = PNV_PHB4_PEC(opaque);
+ uint32_t reg = addr >> 3;
+
+ switch (reg) {
+ case PEC_PCI_PBAIB_HW_CONFIG:
+ case PEC_PCI_PBAIB_READ_STK_OVR:
+ pec->pci_regs[reg] = val;
+ break;
+ default:
+ phb_pec_error(pec, "%s @0x%"HWADDR_PRIx"=%"PRIx64"\n", __func__,
+ addr, val);
+ }
+}
+
+static const MemoryRegionOps pnv_pec_pci_xscom_ops = {
+ .read = pnv_pec_pci_xscom_read,
+ .write = pnv_pec_pci_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static uint64_t pnv_pec_stk_nest_xscom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PnvPhb4PecStack *stack = PNV_PHB4_PEC_STACK(opaque);
+ uint32_t reg = addr >> 3;
+
+ /* TODO: add list of allowed registers and error out if not */
+ return stack->nest_regs[reg];
+}
+
+static void pnv_pec_stk_update_map(PnvPhb4PecStack *stack)
+{
+ PnvPhb4PecState *pec = stack->pec;
+ MemoryRegion *sysmem = pec->system_memory;
+ uint64_t bar_en = stack->nest_regs[PEC_NEST_STK_BAR_EN];
+ uint64_t bar, mask, size;
+ char name[64];
+
+ /*
+ * NOTE: This will really not work well if those are remapped
+ * after the PHB has created its sub regions. We could do better
+ * if we had a way to resize regions but we don't really care
+ * that much in practice as the stuff below really only happens
+ * once early during boot
+ */
+
+ /* Handle unmaps */
+ if (memory_region_is_mapped(&stack->mmbar0) &&
+ !(bar_en & PEC_NEST_STK_BAR_EN_MMIO0)) {
+ memory_region_del_subregion(sysmem, &stack->mmbar0);
+ }
+ if (memory_region_is_mapped(&stack->mmbar1) &&
+ !(bar_en & PEC_NEST_STK_BAR_EN_MMIO1)) {
+ memory_region_del_subregion(sysmem, &stack->mmbar1);
+ }
+ if (memory_region_is_mapped(&stack->phbbar) &&
+ !(bar_en & PEC_NEST_STK_BAR_EN_PHB)) {
+ memory_region_del_subregion(sysmem, &stack->phbbar);
+ }
+ if (memory_region_is_mapped(&stack->intbar) &&
+ !(bar_en & PEC_NEST_STK_BAR_EN_INT)) {
+ memory_region_del_subregion(sysmem, &stack->intbar);
+ }
+
+ /* Update PHB */
+ pnv_phb4_update_regions(stack);
+
+ /* Handle maps */
+ if (!memory_region_is_mapped(&stack->mmbar0) &&
+ (bar_en & PEC_NEST_STK_BAR_EN_MMIO0)) {
+ bar = stack->nest_regs[PEC_NEST_STK_MMIO_BAR0] >> 8;
+ mask = stack->nest_regs[PEC_NEST_STK_MMIO_BAR0_MASK];
+ size = ((~mask) >> 8) + 1;
+ snprintf(name, sizeof(name), "pec-%d.%d-stack-%d-mmio0",
+ pec->chip_id, pec->index, stack->stack_no);
+ memory_region_init(&stack->mmbar0, OBJECT(stack), name, size);
+ memory_region_add_subregion(sysmem, bar, &stack->mmbar0);
+ stack->mmio0_base = bar;
+ stack->mmio0_size = size;
+ }
+ if (!memory_region_is_mapped(&stack->mmbar1) &&
+ (bar_en & PEC_NEST_STK_BAR_EN_MMIO1)) {
+ bar = stack->nest_regs[PEC_NEST_STK_MMIO_BAR1] >> 8;
+ mask = stack->nest_regs[PEC_NEST_STK_MMIO_BAR1_MASK];
+ size = ((~mask) >> 8) + 1;
+ snprintf(name, sizeof(name), "pec-%d.%d-stack-%d-mmio1",
+ pec->chip_id, pec->index, stack->stack_no);
+ memory_region_init(&stack->mmbar1, OBJECT(stack), name, size);
+ memory_region_add_subregion(sysmem, bar, &stack->mmbar1);
+ stack->mmio1_base = bar;
+ stack->mmio1_size = size;
+ }
+ if (!memory_region_is_mapped(&stack->phbbar) &&
+ (bar_en & PEC_NEST_STK_BAR_EN_PHB)) {
+ bar = stack->nest_regs[PEC_NEST_STK_PHB_REGS_BAR] >> 8;
+ size = PNV_PHB4_NUM_REGS << 3;
+ snprintf(name, sizeof(name), "pec-%d.%d-stack-%d-phb",
+ pec->chip_id, pec->index, stack->stack_no);
+ memory_region_init(&stack->phbbar, OBJECT(stack), name, size);
+ memory_region_add_subregion(sysmem, bar, &stack->phbbar);
+ }
+ if (!memory_region_is_mapped(&stack->intbar) &&
+ (bar_en & PEC_NEST_STK_BAR_EN_INT)) {
+ bar = stack->nest_regs[PEC_NEST_STK_INT_BAR] >> 8;
+ size = PNV_PHB4_MAX_INTs << 16;
+ snprintf(name, sizeof(name), "pec-%d.%d-stack-%d-int",
+ stack->pec->chip_id, stack->pec->index, stack->stack_no);
+ memory_region_init(&stack->intbar, OBJECT(stack), name, size);
+ memory_region_add_subregion(sysmem, bar, &stack->intbar);
+ }
+
+ /* Update PHB */
+ pnv_phb4_update_regions(stack);
+}
+
+static void pnv_pec_stk_nest_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPhb4PecStack *stack = PNV_PHB4_PEC_STACK(opaque);
+ PnvPhb4PecState *pec = stack->pec;
+ uint32_t reg = addr >> 3;
+
+ switch (reg) {
+ case PEC_NEST_STK_PCI_NEST_FIR:
+ stack->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] = val;
+ break;
+ case PEC_NEST_STK_PCI_NEST_FIR_CLR:
+ stack->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] &= val;
+ break;
+ case PEC_NEST_STK_PCI_NEST_FIR_SET:
+ stack->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] |= val;
+ break;
+ case PEC_NEST_STK_PCI_NEST_FIR_MSK:
+ stack->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] = val;
+ break;
+ case PEC_NEST_STK_PCI_NEST_FIR_MSKC:
+ stack->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] &= val;
+ break;
+ case PEC_NEST_STK_PCI_NEST_FIR_MSKS:
+ stack->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] |= val;
+ break;
+ case PEC_NEST_STK_PCI_NEST_FIR_ACT0:
+ case PEC_NEST_STK_PCI_NEST_FIR_ACT1:
+ stack->nest_regs[reg] = val;
+ break;
+ case PEC_NEST_STK_PCI_NEST_FIR_WOF:
+ stack->nest_regs[reg] = 0;
+ break;
+ case PEC_NEST_STK_ERR_REPORT_0:
+ case PEC_NEST_STK_ERR_REPORT_1:
+ case PEC_NEST_STK_PBCQ_GNRL_STATUS:
+ /* Flag error ? */
+ break;
+ case PEC_NEST_STK_PBCQ_MODE:
+ stack->nest_regs[reg] = val & 0xff00000000000000ull;
+ break;
+ case PEC_NEST_STK_MMIO_BAR0:
+ case PEC_NEST_STK_MMIO_BAR0_MASK:
+ case PEC_NEST_STK_MMIO_BAR1:
+ case PEC_NEST_STK_MMIO_BAR1_MASK:
+ if (stack->nest_regs[PEC_NEST_STK_BAR_EN] &
+ (PEC_NEST_STK_BAR_EN_MMIO0 |
+ PEC_NEST_STK_BAR_EN_MMIO1)) {
+ phb_pec_error(pec, "Changing enabled BAR unsupported\n");
+ }
+ stack->nest_regs[reg] = val & 0xffffffffff000000ull;
+ break;
+ case PEC_NEST_STK_PHB_REGS_BAR:
+ if (stack->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_PHB) {
+ phb_pec_error(pec, "Changing enabled BAR unsupported\n");
+ }
+ stack->nest_regs[reg] = val & 0xffffffffffc00000ull;
+ break;
+ case PEC_NEST_STK_INT_BAR:
+ if (stack->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_INT) {
+ phb_pec_error(pec, "Changing enabled BAR unsupported\n");
+ }
+ stack->nest_regs[reg] = val & 0xfffffff000000000ull;
+ break;
+ case PEC_NEST_STK_BAR_EN:
+ stack->nest_regs[reg] = val & 0xf000000000000000ull;
+ pnv_pec_stk_update_map(stack);
+ break;
+ case PEC_NEST_STK_DATA_FRZ_TYPE:
+ case PEC_NEST_STK_PBCQ_TUN_BAR:
+ /* Not used for now */
+ stack->nest_regs[reg] = val;
+ break;
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb4_pec: nest_xscom_write 0x%"HWADDR_PRIx
+ "=%"PRIx64"\n", addr, val);
+ }
+}
+
+static const MemoryRegionOps pnv_pec_stk_nest_xscom_ops = {
+ .read = pnv_pec_stk_nest_xscom_read,
+ .write = pnv_pec_stk_nest_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static uint64_t pnv_pec_stk_pci_xscom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PnvPhb4PecStack *stack = PNV_PHB4_PEC_STACK(opaque);
+ uint32_t reg = addr >> 3;
+
+ /* TODO: add list of allowed registers and error out if not */
+ return stack->pci_regs[reg];
+}
+
+static void pnv_pec_stk_pci_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPhb4PecStack *stack = PNV_PHB4_PEC_STACK(opaque);
+ uint32_t reg = addr >> 3;
+
+ switch (reg) {
+ case PEC_PCI_STK_PCI_FIR:
+ stack->nest_regs[reg] = val;
+ break;
+ case PEC_PCI_STK_PCI_FIR_CLR:
+ stack->nest_regs[PEC_PCI_STK_PCI_FIR] &= val;
+ break;
+ case PEC_PCI_STK_PCI_FIR_SET:
+ stack->nest_regs[PEC_PCI_STK_PCI_FIR] |= val;
+ break;
+ case PEC_PCI_STK_PCI_FIR_MSK:
+ stack->nest_regs[reg] = val;
+ break;
+ case PEC_PCI_STK_PCI_FIR_MSKC:
+ stack->nest_regs[PEC_PCI_STK_PCI_FIR_MSK] &= val;
+ break;
+ case PEC_PCI_STK_PCI_FIR_MSKS:
+ stack->nest_regs[PEC_PCI_STK_PCI_FIR_MSK] |= val;
+ break;
+ case PEC_PCI_STK_PCI_FIR_ACT0:
+ case PEC_PCI_STK_PCI_FIR_ACT1:
+ stack->nest_regs[reg] = val;
+ break;
+ case PEC_PCI_STK_PCI_FIR_WOF:
+ stack->nest_regs[reg] = 0;
+ break;
+ case PEC_PCI_STK_ETU_RESET:
+ stack->nest_regs[reg] = val & 0x8000000000000000ull;
+ /* TODO: Implement reset */
+ break;
+ case PEC_PCI_STK_PBAIB_ERR_REPORT:
+ break;
+ case PEC_PCI_STK_PBAIB_TX_CMD_CRED:
+ case PEC_PCI_STK_PBAIB_TX_DAT_CRED:
+ stack->nest_regs[reg] = val;
+ break;
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb4_pec_stk: pci_xscom_write 0x%"HWADDR_PRIx
+ "=%"PRIx64"\n", addr, val);
+ }
+}
+
+static const MemoryRegionOps pnv_pec_stk_pci_xscom_ops = {
+ .read = pnv_pec_stk_pci_xscom_read,
+ .write = pnv_pec_stk_pci_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static void pnv_pec_instance_init(Object *obj)
+{
+ PnvPhb4PecState *pec = PNV_PHB4_PEC(obj);
+ int i;
+
+ for (i = 0; i < PHB4_PEC_MAX_STACKS; i++) {
+ object_initialize_child(obj, "stack[*]", &pec->stacks[i],
+ TYPE_PNV_PHB4_PEC_STACK);
+ }
+}
+
+static void pnv_pec_realize(DeviceState *dev, Error **errp)
+{
+ PnvPhb4PecState *pec = PNV_PHB4_PEC(dev);
+ char name[64];
+ int i;
+
+ assert(pec->system_memory);
+
+ /* Create stacks */
+ for (i = 0; i < pec->num_stacks; i++) {
+ PnvPhb4PecStack *stack = &pec->stacks[i];
+ Object *stk_obj = OBJECT(stack);
+
+ object_property_set_int(stk_obj, "stack-no", i, &error_abort);
+ object_property_set_link(stk_obj, "pec", OBJECT(pec), &error_abort);
+ if (!qdev_realize(DEVICE(stk_obj), NULL, errp)) {
+ return;
+ }
+ }
+ for (; i < PHB4_PEC_MAX_STACKS; i++) {
+ object_unparent(OBJECT(&pec->stacks[i]));
+ }
+
+ /* Initialize the XSCOM regions for the PEC registers */
+ snprintf(name, sizeof(name), "xscom-pec-%d.%d-nest", pec->chip_id,
+ pec->index);
+ pnv_xscom_region_init(&pec->nest_regs_mr, OBJECT(dev),
+ &pnv_pec_nest_xscom_ops, pec, name,
+ PHB4_PEC_NEST_REGS_COUNT);
+
+ snprintf(name, sizeof(name), "xscom-pec-%d.%d-pci", pec->chip_id,
+ pec->index);
+ pnv_xscom_region_init(&pec->pci_regs_mr, OBJECT(dev),
+ &pnv_pec_pci_xscom_ops, pec, name,
+ PHB4_PEC_PCI_REGS_COUNT);
+}
+
+static int pnv_pec_dt_xscom(PnvXScomInterface *dev, void *fdt,
+ int xscom_offset)
+{
+ PnvPhb4PecState *pec = PNV_PHB4_PEC(dev);
+ PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(dev);
+ uint32_t nbase = pecc->xscom_nest_base(pec);
+ uint32_t pbase = pecc->xscom_pci_base(pec);
+ int offset, i;
+ char *name;
+ uint32_t reg[] = {
+ cpu_to_be32(nbase),
+ cpu_to_be32(pecc->xscom_nest_size),
+ cpu_to_be32(pbase),
+ cpu_to_be32(pecc->xscom_pci_size),
+ };
+
+ name = g_strdup_printf("pbcq@%x", nbase);
+ offset = fdt_add_subnode(fdt, xscom_offset, name);
+ _FDT(offset);
+ g_free(name);
+
+ _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
+
+ _FDT((fdt_setprop_cell(fdt, offset, "ibm,pec-index", pec->index)));
+ _FDT((fdt_setprop_cell(fdt, offset, "#address-cells", 1)));
+ _FDT((fdt_setprop_cell(fdt, offset, "#size-cells", 0)));
+ _FDT((fdt_setprop(fdt, offset, "compatible", pecc->compat,
+ pecc->compat_size)));
+
+ for (i = 0; i < pec->num_stacks; i++) {
+ PnvPhb4PecStack *stack = &pec->stacks[i];
+ PnvPHB4 *phb = &stack->phb;
+ int stk_offset;
+
+ name = g_strdup_printf("stack@%x", i);
+ stk_offset = fdt_add_subnode(fdt, offset, name);
+ _FDT(stk_offset);
+ g_free(name);
+ _FDT((fdt_setprop(fdt, stk_offset, "compatible", pecc->stk_compat,
+ pecc->stk_compat_size)));
+ _FDT((fdt_setprop_cell(fdt, stk_offset, "reg", i)));
+ _FDT((fdt_setprop_cell(fdt, stk_offset, "ibm,phb-index", phb->phb_id)));
+ }
+
+ return 0;
+}
+
+static Property pnv_pec_properties[] = {
+ DEFINE_PROP_UINT32("index", PnvPhb4PecState, index, 0),
+ DEFINE_PROP_UINT32("num-stacks", PnvPhb4PecState, num_stacks, 0),
+ DEFINE_PROP_UINT32("chip-id", PnvPhb4PecState, chip_id, 0),
+ DEFINE_PROP_LINK("system-memory", PnvPhb4PecState, system_memory,
+ TYPE_MEMORY_REGION, MemoryRegion *),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static uint32_t pnv_pec_xscom_pci_base(PnvPhb4PecState *pec)
+{
+ return PNV9_XSCOM_PEC_PCI_BASE + 0x1000000 * pec->index;
+}
+
+static uint32_t pnv_pec_xscom_nest_base(PnvPhb4PecState *pec)
+{
+ return PNV9_XSCOM_PEC_NEST_BASE + 0x400 * pec->index;
+}
+
+static void pnv_pec_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
+ PnvPhb4PecClass *pecc = PNV_PHB4_PEC_CLASS(klass);
+ static const char compat[] = "ibm,power9-pbcq";
+ static const char stk_compat[] = "ibm,power9-phb-stack";
+
+ xdc->dt_xscom = pnv_pec_dt_xscom;
+
+ dc->realize = pnv_pec_realize;
+ device_class_set_props(dc, pnv_pec_properties);
+ dc->user_creatable = false;
+
+ pecc->xscom_nest_base = pnv_pec_xscom_nest_base;
+ pecc->xscom_pci_base = pnv_pec_xscom_pci_base;
+ pecc->xscom_nest_size = PNV9_XSCOM_PEC_NEST_SIZE;
+ pecc->xscom_pci_size = PNV9_XSCOM_PEC_PCI_SIZE;
+ pecc->compat = compat;
+ pecc->compat_size = sizeof(compat);
+ pecc->stk_compat = stk_compat;
+ pecc->stk_compat_size = sizeof(stk_compat);
+}
+
+static const TypeInfo pnv_pec_type_info = {
+ .name = TYPE_PNV_PHB4_PEC,
+ .parent = TYPE_DEVICE,
+ .instance_size = sizeof(PnvPhb4PecState),
+ .instance_init = pnv_pec_instance_init,
+ .class_init = pnv_pec_class_init,
+ .class_size = sizeof(PnvPhb4PecClass),
+ .interfaces = (InterfaceInfo[]) {
+ { TYPE_PNV_XSCOM_INTERFACE },
+ { }
+ }
+};
+
+static void pnv_pec_stk_instance_init(Object *obj)
+{
+ PnvPhb4PecStack *stack = PNV_PHB4_PEC_STACK(obj);
+
+ object_initialize_child(obj, "phb", &stack->phb, TYPE_PNV_PHB4);
+}
+
+static void pnv_pec_stk_realize(DeviceState *dev, Error **errp)
+{
+ PnvPhb4PecStack *stack = PNV_PHB4_PEC_STACK(dev);
+ PnvPhb4PecState *pec = stack->pec;
+ char name[64];
+
+ assert(pec);
+
+ /* Initialize the XSCOM regions for the stack registers */
+ snprintf(name, sizeof(name), "xscom-pec-%d.%d-nest-stack-%d",
+ pec->chip_id, pec->index, stack->stack_no);
+ pnv_xscom_region_init(&stack->nest_regs_mr, OBJECT(stack),
+ &pnv_pec_stk_nest_xscom_ops, stack, name,
+ PHB4_PEC_NEST_STK_REGS_COUNT);
+
+ snprintf(name, sizeof(name), "xscom-pec-%d.%d-pci-stack-%d",
+ pec->chip_id, pec->index, stack->stack_no);
+ pnv_xscom_region_init(&stack->pci_regs_mr, OBJECT(stack),
+ &pnv_pec_stk_pci_xscom_ops, stack, name,
+ PHB4_PEC_PCI_STK_REGS_COUNT);
+
+ /* PHB pass-through */
+ snprintf(name, sizeof(name), "xscom-pec-%d.%d-pci-stack-%d-phb",
+ pec->chip_id, pec->index, stack->stack_no);
+ pnv_xscom_region_init(&stack->phb_regs_mr, OBJECT(&stack->phb),
+ &pnv_phb4_xscom_ops, &stack->phb, name, 0x40);
+
+ /*
+ * Let the machine/chip realize the PHB object to customize more
+ * easily some fields
+ */
+}
+
+static Property pnv_pec_stk_properties[] = {
+ DEFINE_PROP_UINT32("stack-no", PnvPhb4PecStack, stack_no, 0),
+ DEFINE_PROP_LINK("pec", PnvPhb4PecStack, pec, TYPE_PNV_PHB4_PEC,
+ PnvPhb4PecState *),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void pnv_pec_stk_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ device_class_set_props(dc, pnv_pec_stk_properties);
+ dc->realize = pnv_pec_stk_realize;
+ dc->user_creatable = false;
+
+ /* TODO: reset regs ? */
+}
+
+static const TypeInfo pnv_pec_stk_type_info = {
+ .name = TYPE_PNV_PHB4_PEC_STACK,
+ .parent = TYPE_DEVICE,
+ .instance_size = sizeof(PnvPhb4PecStack),
+ .instance_init = pnv_pec_stk_instance_init,
+ .class_init = pnv_pec_stk_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { TYPE_PNV_XSCOM_INTERFACE },
+ { }
+ }
+};
+
+static void pnv_pec_register_types(void)
+{
+ type_register_static(&pnv_pec_type_info);
+ type_register_static(&pnv_pec_stk_type_info);
+}
+
+type_init(pnv_pec_register_types);
diff --git a/hw/pci-host/ppce500.c b/hw/pci-host/ppce500.c
new file mode 100644
index 000000000..89c1b53dd
--- /dev/null
+++ b/hw/pci-host/ppce500.c
@@ -0,0 +1,547 @@
+/*
+ * QEMU PowerPC E500 embedded processors pci controller emulation
+ *
+ * Copyright (C) 2009 Freescale Semiconductor, Inc. All rights reserved.
+ *
+ * Author: Yu Liu, <yu.liu@freescale.com>
+ *
+ * This file is derived from hw/ppc4xx_pci.c,
+ * the copyright for that material belongs to the original owners.
+ *
+ * This is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/irq.h"
+#include "hw/ppc/e500-ccsr.h"
+#include "hw/qdev-properties.h"
+#include "migration/vmstate.h"
+#include "hw/pci/pci.h"
+#include "hw/pci/pci_host.h"
+#include "qemu/bswap.h"
+#include "qemu/module.h"
+#include "hw/pci-host/ppce500.h"
+#include "qom/object.h"
+
+#ifdef DEBUG_PCI
+#define pci_debug(fmt, ...) fprintf(stderr, fmt, ## __VA_ARGS__)
+#else
+#define pci_debug(fmt, ...)
+#endif
+
+#define PCIE500_CFGADDR 0x0
+#define PCIE500_CFGDATA 0x4
+#define PCIE500_REG_BASE 0xC00
+#define PCIE500_ALL_SIZE 0x1000
+#define PCIE500_REG_SIZE (PCIE500_ALL_SIZE - PCIE500_REG_BASE)
+
+#define PCIE500_PCI_IOLEN 0x10000ULL
+
+#define PPCE500_PCI_CONFIG_ADDR 0x0
+#define PPCE500_PCI_CONFIG_DATA 0x4
+#define PPCE500_PCI_INTACK 0x8
+
+#define PPCE500_PCI_OW1 (0xC20 - PCIE500_REG_BASE)
+#define PPCE500_PCI_OW2 (0xC40 - PCIE500_REG_BASE)
+#define PPCE500_PCI_OW3 (0xC60 - PCIE500_REG_BASE)
+#define PPCE500_PCI_OW4 (0xC80 - PCIE500_REG_BASE)
+#define PPCE500_PCI_IW3 (0xDA0 - PCIE500_REG_BASE)
+#define PPCE500_PCI_IW2 (0xDC0 - PCIE500_REG_BASE)
+#define PPCE500_PCI_IW1 (0xDE0 - PCIE500_REG_BASE)
+
+#define PPCE500_PCI_GASKET_TIMR (0xE20 - PCIE500_REG_BASE)
+
+#define PCI_POTAR 0x0
+#define PCI_POTEAR 0x4
+#define PCI_POWBAR 0x8
+#define PCI_POWAR 0x10
+
+#define PCI_PITAR 0x0
+#define PCI_PIWBAR 0x8
+#define PCI_PIWBEAR 0xC
+#define PCI_PIWAR 0x10
+
+#define PPCE500_PCI_NR_POBS 5
+#define PPCE500_PCI_NR_PIBS 3
+
+#define PIWAR_EN 0x80000000 /* Enable */
+#define PIWAR_PF 0x20000000 /* prefetch */
+#define PIWAR_TGI_LOCAL 0x00f00000 /* target - local memory */
+#define PIWAR_READ_SNOOP 0x00050000
+#define PIWAR_WRITE_SNOOP 0x00005000
+#define PIWAR_SZ_MASK 0x0000003f
+
+struct pci_outbound {
+ uint32_t potar;
+ uint32_t potear;
+ uint32_t powbar;
+ uint32_t powar;
+ MemoryRegion mem;
+};
+
+struct pci_inbound {
+ uint32_t pitar;
+ uint32_t piwbar;
+ uint32_t piwbear;
+ uint32_t piwar;
+ MemoryRegion mem;
+};
+
+#define TYPE_PPC_E500_PCI_HOST_BRIDGE "e500-pcihost"
+
+OBJECT_DECLARE_SIMPLE_TYPE(PPCE500PCIState, PPC_E500_PCI_HOST_BRIDGE)
+
+struct PPCE500PCIState {
+ PCIHostState parent_obj;
+
+ struct pci_outbound pob[PPCE500_PCI_NR_POBS];
+ struct pci_inbound pib[PPCE500_PCI_NR_PIBS];
+ uint32_t gasket_time;
+ qemu_irq irq[PCI_NUM_PINS];
+ uint32_t irq_num[PCI_NUM_PINS];
+ uint32_t first_slot;
+ uint32_t first_pin_irq;
+ AddressSpace bm_as;
+ MemoryRegion bm;
+ /* mmio maps */
+ MemoryRegion container;
+ MemoryRegion iomem;
+ MemoryRegion pio;
+ MemoryRegion busmem;
+};
+
+#define TYPE_PPC_E500_PCI_BRIDGE "e500-host-bridge"
+OBJECT_DECLARE_SIMPLE_TYPE(PPCE500PCIBridgeState, PPC_E500_PCI_BRIDGE)
+
+struct PPCE500PCIBridgeState {
+ /*< private >*/
+ PCIDevice parent;
+ /*< public >*/
+
+ MemoryRegion bar0;
+};
+
+
+static uint64_t pci_reg_read4(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PPCE500PCIState *pci = opaque;
+ unsigned long win;
+ uint32_t value = 0;
+ int idx;
+
+ win = addr & 0xfe0;
+
+ switch (win) {
+ case PPCE500_PCI_OW1:
+ case PPCE500_PCI_OW2:
+ case PPCE500_PCI_OW3:
+ case PPCE500_PCI_OW4:
+ idx = (addr >> 5) & 0x7;
+ switch (addr & 0x1F) {
+ case PCI_POTAR:
+ value = pci->pob[idx].potar;
+ break;
+ case PCI_POTEAR:
+ value = pci->pob[idx].potear;
+ break;
+ case PCI_POWBAR:
+ value = pci->pob[idx].powbar;
+ break;
+ case PCI_POWAR:
+ value = pci->pob[idx].powar;
+ break;
+ default:
+ break;
+ }
+ break;
+
+ case PPCE500_PCI_IW3:
+ case PPCE500_PCI_IW2:
+ case PPCE500_PCI_IW1:
+ idx = ((addr >> 5) & 0x3) - 1;
+ switch (addr & 0x1F) {
+ case PCI_PITAR:
+ value = pci->pib[idx].pitar;
+ break;
+ case PCI_PIWBAR:
+ value = pci->pib[idx].piwbar;
+ break;
+ case PCI_PIWBEAR:
+ value = pci->pib[idx].piwbear;
+ break;
+ case PCI_PIWAR:
+ value = pci->pib[idx].piwar;
+ break;
+ default:
+ break;
+ };
+ break;
+
+ case PPCE500_PCI_GASKET_TIMR:
+ value = pci->gasket_time;
+ break;
+
+ default:
+ break;
+ }
+
+ pci_debug("%s: win:%lx(addr:" TARGET_FMT_plx ") -> value:%x\n", __func__,
+ win, addr, value);
+ return value;
+}
+
+/* DMA mapping */
+static void e500_update_piw(PPCE500PCIState *pci, int idx)
+{
+ uint64_t tar = ((uint64_t)pci->pib[idx].pitar) << 12;
+ uint64_t wbar = ((uint64_t)pci->pib[idx].piwbar) << 12;
+ uint64_t war = pci->pib[idx].piwar;
+ uint64_t size = 2ULL << (war & PIWAR_SZ_MASK);
+ MemoryRegion *address_space_mem = get_system_memory();
+ MemoryRegion *mem = &pci->pib[idx].mem;
+ MemoryRegion *bm = &pci->bm;
+ char *name;
+
+ if (memory_region_is_mapped(mem)) {
+ /* Before we modify anything, unmap and destroy the region */
+ memory_region_del_subregion(bm, mem);
+ object_unparent(OBJECT(mem));
+ }
+
+ if (!(war & PIWAR_EN)) {
+ /* Not enabled, nothing to do */
+ return;
+ }
+
+ name = g_strdup_printf("PCI Inbound Window %d", idx);
+ memory_region_init_alias(mem, OBJECT(pci), name, address_space_mem, tar,
+ size);
+ memory_region_add_subregion_overlap(bm, wbar, mem, -1);
+ g_free(name);
+
+ pci_debug("%s: Added window of size=%#lx from PCI=%#lx to CPU=%#lx\n",
+ __func__, size, wbar, tar);
+}
+
+/* BAR mapping */
+static void e500_update_pow(PPCE500PCIState *pci, int idx)
+{
+ uint64_t tar = ((uint64_t)pci->pob[idx].potar) << 12;
+ uint64_t wbar = ((uint64_t)pci->pob[idx].powbar) << 12;
+ uint64_t war = pci->pob[idx].powar;
+ uint64_t size = 2ULL << (war & PIWAR_SZ_MASK);
+ MemoryRegion *mem = &pci->pob[idx].mem;
+ MemoryRegion *address_space_mem = get_system_memory();
+ char *name;
+
+ if (memory_region_is_mapped(mem)) {
+ /* Before we modify anything, unmap and destroy the region */
+ memory_region_del_subregion(address_space_mem, mem);
+ object_unparent(OBJECT(mem));
+ }
+
+ if (!(war & PIWAR_EN)) {
+ /* Not enabled, nothing to do */
+ return;
+ }
+
+ name = g_strdup_printf("PCI Outbound Window %d", idx);
+ memory_region_init_alias(mem, OBJECT(pci), name, &pci->busmem, tar,
+ size);
+ memory_region_add_subregion(address_space_mem, wbar, mem);
+ g_free(name);
+
+ pci_debug("%s: Added window of size=%#lx from CPU=%#lx to PCI=%#lx\n",
+ __func__, size, wbar, tar);
+}
+
+static void pci_reg_write4(void *opaque, hwaddr addr,
+ uint64_t value, unsigned size)
+{
+ PPCE500PCIState *pci = opaque;
+ unsigned long win;
+ int idx;
+
+ win = addr & 0xfe0;
+
+ pci_debug("%s: value:%x -> win:%lx(addr:" TARGET_FMT_plx ")\n",
+ __func__, (unsigned)value, win, addr);
+
+ switch (win) {
+ case PPCE500_PCI_OW1:
+ case PPCE500_PCI_OW2:
+ case PPCE500_PCI_OW3:
+ case PPCE500_PCI_OW4:
+ idx = (addr >> 5) & 0x7;
+ switch (addr & 0x1F) {
+ case PCI_POTAR:
+ pci->pob[idx].potar = value;
+ e500_update_pow(pci, idx);
+ break;
+ case PCI_POTEAR:
+ pci->pob[idx].potear = value;
+ e500_update_pow(pci, idx);
+ break;
+ case PCI_POWBAR:
+ pci->pob[idx].powbar = value;
+ e500_update_pow(pci, idx);
+ break;
+ case PCI_POWAR:
+ pci->pob[idx].powar = value;
+ e500_update_pow(pci, idx);
+ break;
+ default:
+ break;
+ };
+ break;
+
+ case PPCE500_PCI_IW3:
+ case PPCE500_PCI_IW2:
+ case PPCE500_PCI_IW1:
+ idx = ((addr >> 5) & 0x3) - 1;
+ switch (addr & 0x1F) {
+ case PCI_PITAR:
+ pci->pib[idx].pitar = value;
+ e500_update_piw(pci, idx);
+ break;
+ case PCI_PIWBAR:
+ pci->pib[idx].piwbar = value;
+ e500_update_piw(pci, idx);
+ break;
+ case PCI_PIWBEAR:
+ pci->pib[idx].piwbear = value;
+ e500_update_piw(pci, idx);
+ break;
+ case PCI_PIWAR:
+ pci->pib[idx].piwar = value;
+ e500_update_piw(pci, idx);
+ break;
+ default:
+ break;
+ };
+ break;
+
+ case PPCE500_PCI_GASKET_TIMR:
+ pci->gasket_time = value;
+ break;
+
+ default:
+ break;
+ };
+}
+
+static const MemoryRegionOps e500_pci_reg_ops = {
+ .read = pci_reg_read4,
+ .write = pci_reg_write4,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static int mpc85xx_pci_map_irq(PCIDevice *pci_dev, int pin)
+{
+ int devno = PCI_SLOT(pci_dev->devfn);
+ int ret;
+
+ ret = ppce500_pci_map_irq_slot(devno, pin);
+
+ pci_debug("%s: devfn %x irq %d -> %d devno:%x\n", __func__,
+ pci_dev->devfn, pin, ret, devno);
+
+ return ret;
+}
+
+static void mpc85xx_pci_set_irq(void *opaque, int pin, int level)
+{
+ PPCE500PCIState *s = opaque;
+ qemu_irq *pic = s->irq;
+
+ pci_debug("%s: PCI irq %d, level:%d\n", __func__, pin , level);
+
+ qemu_set_irq(pic[pin], level);
+}
+
+static PCIINTxRoute e500_route_intx_pin_to_irq(void *opaque, int pin)
+{
+ PCIINTxRoute route;
+ PPCE500PCIState *s = opaque;
+
+ route.mode = PCI_INTX_ENABLED;
+ route.irq = s->irq_num[pin];
+
+ pci_debug("%s: PCI irq-pin = %d, irq_num= %d\n", __func__, pin, route.irq);
+ return route;
+}
+
+static const VMStateDescription vmstate_pci_outbound = {
+ .name = "pci_outbound",
+ .version_id = 0,
+ .minimum_version_id = 0,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT32(potar, struct pci_outbound),
+ VMSTATE_UINT32(potear, struct pci_outbound),
+ VMSTATE_UINT32(powbar, struct pci_outbound),
+ VMSTATE_UINT32(powar, struct pci_outbound),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static const VMStateDescription vmstate_pci_inbound = {
+ .name = "pci_inbound",
+ .version_id = 0,
+ .minimum_version_id = 0,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT32(pitar, struct pci_inbound),
+ VMSTATE_UINT32(piwbar, struct pci_inbound),
+ VMSTATE_UINT32(piwbear, struct pci_inbound),
+ VMSTATE_UINT32(piwar, struct pci_inbound),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static const VMStateDescription vmstate_ppce500_pci = {
+ .name = "ppce500_pci",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .fields = (VMStateField[]) {
+ VMSTATE_STRUCT_ARRAY(pob, PPCE500PCIState, PPCE500_PCI_NR_POBS, 1,
+ vmstate_pci_outbound, struct pci_outbound),
+ VMSTATE_STRUCT_ARRAY(pib, PPCE500PCIState, PPCE500_PCI_NR_PIBS, 1,
+ vmstate_pci_inbound, struct pci_inbound),
+ VMSTATE_UINT32(gasket_time, PPCE500PCIState),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+
+static void e500_pcihost_bridge_realize(PCIDevice *d, Error **errp)
+{
+ PPCE500PCIBridgeState *b = PPC_E500_PCI_BRIDGE(d);
+ PPCE500CCSRState *ccsr = CCSR(container_get(qdev_get_machine(),
+ "/e500-ccsr"));
+
+ memory_region_init_alias(&b->bar0, OBJECT(ccsr), "e500-pci-bar0", &ccsr->ccsr_space,
+ 0, int128_get64(ccsr->ccsr_space.size));
+ pci_register_bar(d, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &b->bar0);
+}
+
+static AddressSpace *e500_pcihost_set_iommu(PCIBus *bus, void *opaque,
+ int devfn)
+{
+ PPCE500PCIState *s = opaque;
+
+ return &s->bm_as;
+}
+
+static void e500_pcihost_realize(DeviceState *dev, Error **errp)
+{
+ SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+ PCIHostState *h;
+ PPCE500PCIState *s;
+ PCIBus *b;
+ int i;
+
+ h = PCI_HOST_BRIDGE(dev);
+ s = PPC_E500_PCI_HOST_BRIDGE(dev);
+
+ for (i = 0; i < ARRAY_SIZE(s->irq); i++) {
+ sysbus_init_irq(sbd, &s->irq[i]);
+ }
+
+ for (i = 0; i < PCI_NUM_PINS; i++) {
+ s->irq_num[i] = s->first_pin_irq + i;
+ }
+
+ memory_region_init(&s->pio, OBJECT(s), "pci-pio", PCIE500_PCI_IOLEN);
+ memory_region_init(&s->busmem, OBJECT(s), "pci bus memory", UINT64_MAX);
+
+ /* PIO lives at the bottom of our bus space */
+ memory_region_add_subregion_overlap(&s->busmem, 0, &s->pio, -2);
+
+ b = pci_register_root_bus(dev, NULL, mpc85xx_pci_set_irq,
+ mpc85xx_pci_map_irq, s, &s->busmem, &s->pio,
+ PCI_DEVFN(s->first_slot, 0), 4, TYPE_PCI_BUS);
+ h->bus = b;
+
+ /* Set up PCI view of memory */
+ memory_region_init(&s->bm, OBJECT(s), "bm-e500", UINT64_MAX);
+ memory_region_add_subregion(&s->bm, 0x0, &s->busmem);
+ address_space_init(&s->bm_as, &s->bm, "pci-bm");
+ pci_setup_iommu(b, e500_pcihost_set_iommu, s);
+
+ pci_create_simple(b, 0, "e500-host-bridge");
+
+ memory_region_init(&s->container, OBJECT(h), "pci-container", PCIE500_ALL_SIZE);
+ memory_region_init_io(&h->conf_mem, OBJECT(h), &pci_host_conf_be_ops, h,
+ "pci-conf-idx", 4);
+ memory_region_init_io(&h->data_mem, OBJECT(h), &pci_host_data_le_ops, h,
+ "pci-conf-data", 4);
+ memory_region_init_io(&s->iomem, OBJECT(s), &e500_pci_reg_ops, s,
+ "pci.reg", PCIE500_REG_SIZE);
+ memory_region_add_subregion(&s->container, PCIE500_CFGADDR, &h->conf_mem);
+ memory_region_add_subregion(&s->container, PCIE500_CFGDATA, &h->data_mem);
+ memory_region_add_subregion(&s->container, PCIE500_REG_BASE, &s->iomem);
+ sysbus_init_mmio(sbd, &s->container);
+ pci_bus_set_route_irq_fn(b, e500_route_intx_pin_to_irq);
+}
+
+static void e500_host_bridge_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+ k->realize = e500_pcihost_bridge_realize;
+ k->vendor_id = PCI_VENDOR_ID_FREESCALE;
+ k->device_id = PCI_DEVICE_ID_MPC8533E;
+ k->class_id = PCI_CLASS_PROCESSOR_POWERPC;
+ dc->desc = "Host bridge";
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo e500_host_bridge_info = {
+ .name = TYPE_PPC_E500_PCI_BRIDGE,
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(PPCE500PCIBridgeState),
+ .class_init = e500_host_bridge_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+static Property pcihost_properties[] = {
+ DEFINE_PROP_UINT32("first_slot", PPCE500PCIState, first_slot, 0x11),
+ DEFINE_PROP_UINT32("first_pin_irq", PPCE500PCIState, first_pin_irq, 0x1),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void e500_pcihost_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ dc->realize = e500_pcihost_realize;
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ device_class_set_props(dc, pcihost_properties);
+ dc->vmsd = &vmstate_ppce500_pci;
+}
+
+static const TypeInfo e500_pcihost_info = {
+ .name = TYPE_PPC_E500_PCI_HOST_BRIDGE,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(PPCE500PCIState),
+ .class_init = e500_pcihost_class_init,
+};
+
+static void e500_pci_register_types(void)
+{
+ type_register_static(&e500_pcihost_info);
+ type_register_static(&e500_host_bridge_info);
+}
+
+type_init(e500_pci_register_types)
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
new file mode 100644
index 000000000..ab5a47aff
--- /dev/null
+++ b/hw/pci-host/q35.c
@@ -0,0 +1,721 @@
+/*
+ * QEMU MCH/ICH9 PCI Bridge Emulation
+ *
+ * Copyright (c) 2006 Fabrice Bellard
+ * Copyright (c) 2009, 2010, 2011
+ * Isaku Yamahata <yamahata at valinux co jp>
+ * VA Linux Systems Japan K.K.
+ * Copyright (C) 2012 Jason Baron <jbaron@redhat.com>
+ *
+ * This is based on piix.c, but heavily modified.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/i386/pc.h"
+#include "hw/pci-host/q35.h"
+#include "hw/qdev-properties.h"
+#include "migration/vmstate.h"
+#include "qapi/error.h"
+#include "qapi/visitor.h"
+#include "qemu/module.h"
+
+/****************************************************************************
+ * Q35 host
+ */
+
+#define Q35_PCI_HOST_HOLE64_SIZE_DEFAULT (1ULL << 35)
+
+static void q35_host_realize(DeviceState *dev, Error **errp)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+ Q35PCIHost *s = Q35_HOST_DEVICE(dev);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+
+ sysbus_add_io(sbd, MCH_HOST_BRIDGE_CONFIG_ADDR, &pci->conf_mem);
+ sysbus_init_ioports(sbd, MCH_HOST_BRIDGE_CONFIG_ADDR, 4);
+
+ sysbus_add_io(sbd, MCH_HOST_BRIDGE_CONFIG_DATA, &pci->data_mem);
+ sysbus_init_ioports(sbd, MCH_HOST_BRIDGE_CONFIG_DATA, 4);
+
+ /* register q35 0xcf8 port as coalesced pio */
+ memory_region_set_flush_coalesced(&pci->data_mem);
+ memory_region_add_coalescing(&pci->conf_mem, 0, 4);
+
+ pci->bus = pci_root_bus_new(DEVICE(s), "pcie.0",
+ s->mch.pci_address_space,
+ s->mch.address_space_io,
+ 0, TYPE_PCIE_BUS);
+ PC_MACHINE(qdev_get_machine())->bus = pci->bus;
+ pci->bypass_iommu =
+ PC_MACHINE(qdev_get_machine())->default_bus_bypass_iommu;
+ qdev_realize(DEVICE(&s->mch), BUS(pci->bus), &error_fatal);
+}
+
+static const char *q35_host_root_bus_path(PCIHostState *host_bridge,
+ PCIBus *rootbus)
+{
+ Q35PCIHost *s = Q35_HOST_DEVICE(host_bridge);
+
+ /* For backwards compat with old device paths */
+ if (s->mch.short_root_bus) {
+ return "0000";
+ }
+ return "0000:00";
+}
+
+static void q35_host_get_pci_hole_start(Object *obj, Visitor *v,
+ const char *name, void *opaque,
+ Error **errp)
+{
+ Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+ uint64_t val64;
+ uint32_t value;
+
+ val64 = range_is_empty(&s->mch.pci_hole)
+ ? 0 : range_lob(&s->mch.pci_hole);
+ value = val64;
+ assert(value == val64);
+ visit_type_uint32(v, name, &value, errp);
+}
+
+static void q35_host_get_pci_hole_end(Object *obj, Visitor *v,
+ const char *name, void *opaque,
+ Error **errp)
+{
+ Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+ uint64_t val64;
+ uint32_t value;
+
+ val64 = range_is_empty(&s->mch.pci_hole)
+ ? 0 : range_upb(&s->mch.pci_hole) + 1;
+ value = val64;
+ assert(value == val64);
+ visit_type_uint32(v, name, &value, errp);
+}
+
+/*
+ * The 64bit PCI hole start is set by the Guest firmware
+ * as the address of the first 64bit PCI MEM resource.
+ * If no PCI device has resources on the 64bit area,
+ * the 64bit PCI hole will start after "over 4G RAM" and the
+ * reserved space for memory hotplug if any.
+ */
+static uint64_t q35_host_get_pci_hole64_start_value(Object *obj)
+{
+ PCIHostState *h = PCI_HOST_BRIDGE(obj);
+ Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+ Range w64;
+ uint64_t value;
+
+ pci_bus_get_w64_range(h->bus, &w64);
+ value = range_is_empty(&w64) ? 0 : range_lob(&w64);
+ if (!value && s->pci_hole64_fix) {
+ value = pc_pci_hole64_start();
+ }
+ return value;
+}
+
+static void q35_host_get_pci_hole64_start(Object *obj, Visitor *v,
+ const char *name, void *opaque,
+ Error **errp)
+{
+ uint64_t hole64_start = q35_host_get_pci_hole64_start_value(obj);
+
+ visit_type_uint64(v, name, &hole64_start, errp);
+}
+
+/*
+ * The 64bit PCI hole end is set by the Guest firmware
+ * as the address of the last 64bit PCI MEM resource.
+ * Then it is expanded to the PCI_HOST_PROP_PCI_HOLE64_SIZE
+ * that can be configured by the user.
+ */
+static void q35_host_get_pci_hole64_end(Object *obj, Visitor *v,
+ const char *name, void *opaque,
+ Error **errp)
+{
+ PCIHostState *h = PCI_HOST_BRIDGE(obj);
+ Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+ uint64_t hole64_start = q35_host_get_pci_hole64_start_value(obj);
+ Range w64;
+ uint64_t value, hole64_end;
+
+ pci_bus_get_w64_range(h->bus, &w64);
+ value = range_is_empty(&w64) ? 0 : range_upb(&w64) + 1;
+ hole64_end = ROUND_UP(hole64_start + s->mch.pci_hole64_size, 1ULL << 30);
+ if (s->pci_hole64_fix && value < hole64_end) {
+ value = hole64_end;
+ }
+ visit_type_uint64(v, name, &value, errp);
+}
+
+/*
+ * NOTE: setting defaults for the mch.* fields in this table
+ * doesn't work, because mch is a separate QOM object that is
+ * zeroed by the object_initialize(&s->mch, ...) call inside
+ * q35_host_initfn(). The default values for those
+ * properties need to be initialized manually by
+ * q35_host_initfn() after the object_initialize() call.
+ */
+static Property q35_host_props[] = {
+ DEFINE_PROP_UINT64(PCIE_HOST_MCFG_BASE, Q35PCIHost, parent_obj.base_addr,
+ MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT),
+ DEFINE_PROP_SIZE(PCI_HOST_PROP_PCI_HOLE64_SIZE, Q35PCIHost,
+ mch.pci_hole64_size, Q35_PCI_HOST_HOLE64_SIZE_DEFAULT),
+ DEFINE_PROP_UINT32("short_root_bus", Q35PCIHost, mch.short_root_bus, 0),
+ DEFINE_PROP_SIZE(PCI_HOST_BELOW_4G_MEM_SIZE, Q35PCIHost,
+ mch.below_4g_mem_size, 0),
+ DEFINE_PROP_SIZE(PCI_HOST_ABOVE_4G_MEM_SIZE, Q35PCIHost,
+ mch.above_4g_mem_size, 0),
+ DEFINE_PROP_BOOL("x-pci-hole64-fix", Q35PCIHost, pci_hole64_fix, true),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void q35_host_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
+
+ hc->root_bus_path = q35_host_root_bus_path;
+ dc->realize = q35_host_realize;
+ device_class_set_props(dc, q35_host_props);
+ /* Reason: needs to be wired up by pc_q35_init */
+ dc->user_creatable = false;
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->fw_name = "pci";
+}
+
+static void q35_host_initfn(Object *obj)
+{
+ Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+ PCIHostState *phb = PCI_HOST_BRIDGE(obj);
+ PCIExpressHost *pehb = PCIE_HOST_BRIDGE(obj);
+
+ memory_region_init_io(&phb->conf_mem, obj, &pci_host_conf_le_ops, phb,
+ "pci-conf-idx", 4);
+ memory_region_init_io(&phb->data_mem, obj, &pci_host_data_le_ops, phb,
+ "pci-conf-data", 4);
+
+ object_initialize_child(OBJECT(s), "mch", &s->mch, TYPE_MCH_PCI_DEVICE);
+ qdev_prop_set_int32(DEVICE(&s->mch), "addr", PCI_DEVFN(0, 0));
+ qdev_prop_set_bit(DEVICE(&s->mch), "multifunction", false);
+ /* mch's object_initialize resets the default value, set it again */
+ qdev_prop_set_uint64(DEVICE(s), PCI_HOST_PROP_PCI_HOLE64_SIZE,
+ Q35_PCI_HOST_HOLE64_SIZE_DEFAULT);
+ object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_START, "uint32",
+ q35_host_get_pci_hole_start,
+ NULL, NULL, NULL);
+
+ object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_END, "uint32",
+ q35_host_get_pci_hole_end,
+ NULL, NULL, NULL);
+
+ object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_START, "uint64",
+ q35_host_get_pci_hole64_start,
+ NULL, NULL, NULL);
+
+ object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_END, "uint64",
+ q35_host_get_pci_hole64_end,
+ NULL, NULL, NULL);
+
+ object_property_add_uint64_ptr(obj, PCIE_HOST_MCFG_SIZE,
+ &pehb->size, OBJ_PROP_FLAG_READ);
+
+ object_property_add_link(obj, MCH_HOST_PROP_RAM_MEM, TYPE_MEMORY_REGION,
+ (Object **) &s->mch.ram_memory,
+ qdev_prop_allow_set_link_before_realize, 0);
+
+ object_property_add_link(obj, MCH_HOST_PROP_PCI_MEM, TYPE_MEMORY_REGION,
+ (Object **) &s->mch.pci_address_space,
+ qdev_prop_allow_set_link_before_realize, 0);
+
+ object_property_add_link(obj, MCH_HOST_PROP_SYSTEM_MEM, TYPE_MEMORY_REGION,
+ (Object **) &s->mch.system_memory,
+ qdev_prop_allow_set_link_before_realize, 0);
+
+ object_property_add_link(obj, MCH_HOST_PROP_IO_MEM, TYPE_MEMORY_REGION,
+ (Object **) &s->mch.address_space_io,
+ qdev_prop_allow_set_link_before_realize, 0);
+}
+
+static const TypeInfo q35_host_info = {
+ .name = TYPE_Q35_HOST_DEVICE,
+ .parent = TYPE_PCIE_HOST_BRIDGE,
+ .instance_size = sizeof(Q35PCIHost),
+ .instance_init = q35_host_initfn,
+ .class_init = q35_host_class_init,
+};
+
+/****************************************************************************
+ * MCH D0:F0
+ */
+
+static uint64_t blackhole_read(void *ptr, hwaddr reg, unsigned size)
+{
+ return 0xffffffff;
+}
+
+static void blackhole_write(void *opaque, hwaddr addr, uint64_t val,
+ unsigned width)
+{
+ /* nothing */
+}
+
+static const MemoryRegionOps blackhole_ops = {
+ .read = blackhole_read,
+ .write = blackhole_write,
+ .endianness = DEVICE_NATIVE_ENDIAN,
+ .valid.min_access_size = 1,
+ .valid.max_access_size = 4,
+ .impl.min_access_size = 4,
+ .impl.max_access_size = 4,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+/* PCIe MMCFG */
+static void mch_update_pciexbar(MCHPCIState *mch)
+{
+ PCIDevice *pci_dev = PCI_DEVICE(mch);
+ BusState *bus = qdev_get_parent_bus(DEVICE(mch));
+ PCIExpressHost *pehb = PCIE_HOST_BRIDGE(bus->parent);
+
+ uint64_t pciexbar;
+ int enable;
+ uint64_t addr;
+ uint64_t addr_mask;
+ uint32_t length;
+
+ pciexbar = pci_get_quad(pci_dev->config + MCH_HOST_BRIDGE_PCIEXBAR);
+ enable = pciexbar & MCH_HOST_BRIDGE_PCIEXBAREN;
+ addr_mask = MCH_HOST_BRIDGE_PCIEXBAR_ADMSK;
+ switch (pciexbar & MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_MASK) {
+ case MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_256M:
+ length = 256 * 1024 * 1024;
+ break;
+ case MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_128M:
+ length = 128 * 1024 * 1024;
+ addr_mask |= MCH_HOST_BRIDGE_PCIEXBAR_128ADMSK |
+ MCH_HOST_BRIDGE_PCIEXBAR_64ADMSK;
+ break;
+ case MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_64M:
+ length = 64 * 1024 * 1024;
+ addr_mask |= MCH_HOST_BRIDGE_PCIEXBAR_64ADMSK;
+ break;
+ case MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD:
+ qemu_log_mask(LOG_GUEST_ERROR, "Q35: Reserved PCIEXBAR LENGTH\n");
+ return;
+ default:
+ abort();
+ }
+ addr = pciexbar & addr_mask;
+ pcie_host_mmcfg_update(pehb, enable, addr, length);
+}
+
+/* PAM */
+static void mch_update_pam(MCHPCIState *mch)
+{
+ PCIDevice *pd = PCI_DEVICE(mch);
+ int i;
+
+ memory_region_transaction_begin();
+ for (i = 0; i < 13; i++) {
+ pam_update(&mch->pam_regions[i], i,
+ pd->config[MCH_HOST_BRIDGE_PAM0 + DIV_ROUND_UP(i, 2)]);
+ }
+ memory_region_transaction_commit();
+}
+
+/* SMRAM */
+static void mch_update_smram(MCHPCIState *mch)
+{
+ PCIDevice *pd = PCI_DEVICE(mch);
+ bool h_smrame = (pd->config[MCH_HOST_BRIDGE_ESMRAMC] & MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME);
+ uint32_t tseg_size;
+
+ /* implement SMRAM.D_LCK */
+ if (pd->config[MCH_HOST_BRIDGE_SMRAM] & MCH_HOST_BRIDGE_SMRAM_D_LCK) {
+ pd->config[MCH_HOST_BRIDGE_SMRAM] &= ~MCH_HOST_BRIDGE_SMRAM_D_OPEN;
+ pd->wmask[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_WMASK_LCK;
+ pd->wmask[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_WMASK_LCK;
+ }
+
+ memory_region_transaction_begin();
+
+ if (pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_D_OPEN) {
+ /* Hide (!) low SMRAM if H_SMRAME = 1 */
+ memory_region_set_enabled(&mch->smram_region, h_smrame);
+ /* Show high SMRAM if H_SMRAME = 1 */
+ memory_region_set_enabled(&mch->open_high_smram, h_smrame);
+ } else {
+ /* Hide high SMRAM and low SMRAM */
+ memory_region_set_enabled(&mch->smram_region, true);
+ memory_region_set_enabled(&mch->open_high_smram, false);
+ }
+
+ if (pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_G_SMRAME) {
+ memory_region_set_enabled(&mch->low_smram, !h_smrame);
+ memory_region_set_enabled(&mch->high_smram, h_smrame);
+ } else {
+ memory_region_set_enabled(&mch->low_smram, false);
+ memory_region_set_enabled(&mch->high_smram, false);
+ }
+
+ if (pd->config[MCH_HOST_BRIDGE_ESMRAMC] & MCH_HOST_BRIDGE_ESMRAMC_T_EN) {
+ switch (pd->config[MCH_HOST_BRIDGE_ESMRAMC] &
+ MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_MASK) {
+ case MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_1MB:
+ tseg_size = 1024 * 1024;
+ break;
+ case MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_2MB:
+ tseg_size = 1024 * 1024 * 2;
+ break;
+ case MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_8MB:
+ tseg_size = 1024 * 1024 * 8;
+ break;
+ default:
+ tseg_size = 1024 * 1024 * (uint32_t)mch->ext_tseg_mbytes;
+ break;
+ }
+ } else {
+ tseg_size = 0;
+ }
+ memory_region_del_subregion(mch->system_memory, &mch->tseg_blackhole);
+ memory_region_set_enabled(&mch->tseg_blackhole, tseg_size);
+ memory_region_set_size(&mch->tseg_blackhole, tseg_size);
+ memory_region_add_subregion_overlap(mch->system_memory,
+ mch->below_4g_mem_size - tseg_size,
+ &mch->tseg_blackhole, 1);
+
+ memory_region_set_enabled(&mch->tseg_window, tseg_size);
+ memory_region_set_size(&mch->tseg_window, tseg_size);
+ memory_region_set_address(&mch->tseg_window,
+ mch->below_4g_mem_size - tseg_size);
+ memory_region_set_alias_offset(&mch->tseg_window,
+ mch->below_4g_mem_size - tseg_size);
+
+ memory_region_transaction_commit();
+}
+
+static void mch_update_ext_tseg_mbytes(MCHPCIState *mch)
+{
+ PCIDevice *pd = PCI_DEVICE(mch);
+ uint8_t *reg = pd->config + MCH_HOST_BRIDGE_EXT_TSEG_MBYTES;
+
+ if (mch->ext_tseg_mbytes > 0 &&
+ pci_get_word(reg) == MCH_HOST_BRIDGE_EXT_TSEG_MBYTES_QUERY) {
+ pci_set_word(reg, mch->ext_tseg_mbytes);
+ }
+}
+
+static void mch_update_smbase_smram(MCHPCIState *mch)
+{
+ PCIDevice *pd = PCI_DEVICE(mch);
+ uint8_t *reg = pd->config + MCH_HOST_BRIDGE_F_SMBASE;
+ bool lck;
+
+ if (!mch->has_smram_at_smbase) {
+ return;
+ }
+
+ if (*reg == MCH_HOST_BRIDGE_F_SMBASE_QUERY) {
+ pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] =
+ MCH_HOST_BRIDGE_F_SMBASE_LCK;
+ *reg = MCH_HOST_BRIDGE_F_SMBASE_IN_RAM;
+ return;
+ }
+
+ /*
+ * default/reset state, discard written value
+ * which will disable SMRAM balackhole at SMBASE
+ */
+ if (pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] == 0xff) {
+ *reg = 0x00;
+ }
+
+ memory_region_transaction_begin();
+ if (*reg & MCH_HOST_BRIDGE_F_SMBASE_LCK) {
+ /* disable all writes */
+ pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] &=
+ ~MCH_HOST_BRIDGE_F_SMBASE_LCK;
+ *reg = MCH_HOST_BRIDGE_F_SMBASE_LCK;
+ lck = true;
+ } else {
+ lck = false;
+ }
+ memory_region_set_enabled(&mch->smbase_blackhole, lck);
+ memory_region_set_enabled(&mch->smbase_window, lck);
+ memory_region_transaction_commit();
+}
+
+static void mch_write_config(PCIDevice *d,
+ uint32_t address, uint32_t val, int len)
+{
+ MCHPCIState *mch = MCH_PCI_DEVICE(d);
+
+ pci_default_write_config(d, address, val, len);
+
+ if (ranges_overlap(address, len, MCH_HOST_BRIDGE_PAM0,
+ MCH_HOST_BRIDGE_PAM_SIZE)) {
+ mch_update_pam(mch);
+ }
+
+ if (ranges_overlap(address, len, MCH_HOST_BRIDGE_PCIEXBAR,
+ MCH_HOST_BRIDGE_PCIEXBAR_SIZE)) {
+ mch_update_pciexbar(mch);
+ }
+
+ if (ranges_overlap(address, len, MCH_HOST_BRIDGE_SMRAM,
+ MCH_HOST_BRIDGE_SMRAM_SIZE)) {
+ mch_update_smram(mch);
+ }
+
+ if (ranges_overlap(address, len, MCH_HOST_BRIDGE_EXT_TSEG_MBYTES,
+ MCH_HOST_BRIDGE_EXT_TSEG_MBYTES_SIZE)) {
+ mch_update_ext_tseg_mbytes(mch);
+ }
+
+ if (ranges_overlap(address, len, MCH_HOST_BRIDGE_F_SMBASE, 1)) {
+ mch_update_smbase_smram(mch);
+ }
+}
+
+static void mch_update(MCHPCIState *mch)
+{
+ mch_update_pciexbar(mch);
+ mch_update_pam(mch);
+ mch_update_smram(mch);
+ mch_update_ext_tseg_mbytes(mch);
+ mch_update_smbase_smram(mch);
+
+ /*
+ * pci hole goes from end-of-low-ram to io-apic.
+ * mmconfig will be excluded by the dsdt builder.
+ */
+ range_set_bounds(&mch->pci_hole,
+ mch->below_4g_mem_size,
+ IO_APIC_DEFAULT_ADDRESS - 1);
+}
+
+static int mch_post_load(void *opaque, int version_id)
+{
+ MCHPCIState *mch = opaque;
+ mch_update(mch);
+ return 0;
+}
+
+static const VMStateDescription vmstate_mch = {
+ .name = "mch",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .post_load = mch_post_load,
+ .fields = (VMStateField[]) {
+ VMSTATE_PCI_DEVICE(parent_obj, MCHPCIState),
+ /* Used to be smm_enabled, which was basically always zero because
+ * SeaBIOS hardly uses SMM. SMRAM is now handled by CPU code.
+ */
+ VMSTATE_UNUSED(1),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static void mch_reset(DeviceState *qdev)
+{
+ PCIDevice *d = PCI_DEVICE(qdev);
+ MCHPCIState *mch = MCH_PCI_DEVICE(d);
+
+ pci_set_quad(d->config + MCH_HOST_BRIDGE_PCIEXBAR,
+ MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT);
+
+ d->config[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_DEFAULT;
+ d->config[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_DEFAULT;
+ d->wmask[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_WMASK;
+ d->wmask[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_WMASK;
+
+ if (mch->ext_tseg_mbytes > 0) {
+ pci_set_word(d->config + MCH_HOST_BRIDGE_EXT_TSEG_MBYTES,
+ MCH_HOST_BRIDGE_EXT_TSEG_MBYTES_QUERY);
+ }
+
+ d->config[MCH_HOST_BRIDGE_F_SMBASE] = 0;
+ d->wmask[MCH_HOST_BRIDGE_F_SMBASE] = 0xff;
+
+ mch_update(mch);
+}
+
+static void mch_realize(PCIDevice *d, Error **errp)
+{
+ int i;
+ MCHPCIState *mch = MCH_PCI_DEVICE(d);
+
+ if (mch->ext_tseg_mbytes > MCH_HOST_BRIDGE_EXT_TSEG_MBYTES_MAX) {
+ error_setg(errp, "invalid extended-tseg-mbytes value: %" PRIu16,
+ mch->ext_tseg_mbytes);
+ return;
+ }
+
+ /* setup pci memory mapping */
+ pc_pci_as_mapping_init(OBJECT(mch), mch->system_memory,
+ mch->pci_address_space);
+
+ /* if *disabled* show SMRAM to all CPUs */
+ memory_region_init_alias(&mch->smram_region, OBJECT(mch), "smram-region",
+ mch->pci_address_space, MCH_HOST_BRIDGE_SMRAM_C_BASE,
+ MCH_HOST_BRIDGE_SMRAM_C_SIZE);
+ memory_region_add_subregion_overlap(mch->system_memory, MCH_HOST_BRIDGE_SMRAM_C_BASE,
+ &mch->smram_region, 1);
+ memory_region_set_enabled(&mch->smram_region, true);
+
+ memory_region_init_alias(&mch->open_high_smram, OBJECT(mch), "smram-open-high",
+ mch->ram_memory, MCH_HOST_BRIDGE_SMRAM_C_BASE,
+ MCH_HOST_BRIDGE_SMRAM_C_SIZE);
+ memory_region_add_subregion_overlap(mch->system_memory, 0xfeda0000,
+ &mch->open_high_smram, 1);
+ memory_region_set_enabled(&mch->open_high_smram, false);
+
+ /* smram, as seen by SMM CPUs */
+ memory_region_init(&mch->smram, OBJECT(mch), "smram", 4 * GiB);
+ memory_region_set_enabled(&mch->smram, true);
+ memory_region_init_alias(&mch->low_smram, OBJECT(mch), "smram-low",
+ mch->ram_memory, MCH_HOST_BRIDGE_SMRAM_C_BASE,
+ MCH_HOST_BRIDGE_SMRAM_C_SIZE);
+ memory_region_set_enabled(&mch->low_smram, true);
+ memory_region_add_subregion(&mch->smram, MCH_HOST_BRIDGE_SMRAM_C_BASE,
+ &mch->low_smram);
+ memory_region_init_alias(&mch->high_smram, OBJECT(mch), "smram-high",
+ mch->ram_memory, MCH_HOST_BRIDGE_SMRAM_C_BASE,
+ MCH_HOST_BRIDGE_SMRAM_C_SIZE);
+ memory_region_set_enabled(&mch->high_smram, true);
+ memory_region_add_subregion(&mch->smram, 0xfeda0000, &mch->high_smram);
+
+ memory_region_init_io(&mch->tseg_blackhole, OBJECT(mch),
+ &blackhole_ops, NULL,
+ "tseg-blackhole", 0);
+ memory_region_set_enabled(&mch->tseg_blackhole, false);
+ memory_region_add_subregion_overlap(mch->system_memory,
+ mch->below_4g_mem_size,
+ &mch->tseg_blackhole, 1);
+
+ memory_region_init_alias(&mch->tseg_window, OBJECT(mch), "tseg-window",
+ mch->ram_memory, mch->below_4g_mem_size, 0);
+ memory_region_set_enabled(&mch->tseg_window, false);
+ memory_region_add_subregion(&mch->smram, mch->below_4g_mem_size,
+ &mch->tseg_window);
+
+ /*
+ * This is not what hardware does, so it's QEMU specific hack.
+ * See commit message for details.
+ */
+ memory_region_init_io(&mch->smbase_blackhole, OBJECT(mch), &blackhole_ops,
+ NULL, "smbase-blackhole",
+ MCH_HOST_BRIDGE_SMBASE_SIZE);
+ memory_region_set_enabled(&mch->smbase_blackhole, false);
+ memory_region_add_subregion_overlap(mch->system_memory,
+ MCH_HOST_BRIDGE_SMBASE_ADDR,
+ &mch->smbase_blackhole, 1);
+
+ memory_region_init_alias(&mch->smbase_window, OBJECT(mch),
+ "smbase-window", mch->ram_memory,
+ MCH_HOST_BRIDGE_SMBASE_ADDR,
+ MCH_HOST_BRIDGE_SMBASE_SIZE);
+ memory_region_set_enabled(&mch->smbase_window, false);
+ memory_region_add_subregion(&mch->smram, MCH_HOST_BRIDGE_SMBASE_ADDR,
+ &mch->smbase_window);
+
+ object_property_add_const_link(qdev_get_machine(), "smram",
+ OBJECT(&mch->smram));
+
+ init_pam(DEVICE(mch), mch->ram_memory, mch->system_memory,
+ mch->pci_address_space, &mch->pam_regions[0],
+ PAM_BIOS_BASE, PAM_BIOS_SIZE);
+ for (i = 0; i < ARRAY_SIZE(mch->pam_regions) - 1; ++i) {
+ init_pam(DEVICE(mch), mch->ram_memory, mch->system_memory,
+ mch->pci_address_space, &mch->pam_regions[i+1],
+ PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
+ }
+}
+
+uint64_t mch_mcfg_base(void)
+{
+ bool ambiguous;
+ Object *o = object_resolve_path_type("", TYPE_MCH_PCI_DEVICE, &ambiguous);
+ if (!o) {
+ return 0;
+ }
+ return MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT;
+}
+
+static Property mch_props[] = {
+ DEFINE_PROP_UINT16("extended-tseg-mbytes", MCHPCIState, ext_tseg_mbytes,
+ 16),
+ DEFINE_PROP_BOOL("smbase-smram", MCHPCIState, has_smram_at_smbase, true),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void mch_class_init(ObjectClass *klass, void *data)
+{
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ k->realize = mch_realize;
+ k->config_write = mch_write_config;
+ dc->reset = mch_reset;
+ device_class_set_props(dc, mch_props);
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->desc = "Host bridge";
+ dc->vmsd = &vmstate_mch;
+ k->vendor_id = PCI_VENDOR_ID_INTEL;
+ /*
+ * The 'q35' machine type implements an Intel Series 3 chipset,
+ * of which there are several variants. The key difference between
+ * the 82P35 MCH ('p35') and 82Q35 GMCH ('q35') variants is that
+ * the latter has an integrated graphics adapter. QEMU does not
+ * implement integrated graphics, so uses the PCI ID for the 82P35
+ * chipset.
+ */
+ k->device_id = PCI_DEVICE_ID_INTEL_P35_MCH;
+ k->revision = MCH_HOST_BRIDGE_REVISION_DEFAULT;
+ k->class_id = PCI_CLASS_BRIDGE_HOST;
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo mch_info = {
+ .name = TYPE_MCH_PCI_DEVICE,
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(MCHPCIState),
+ .class_init = mch_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+static void q35_register(void)
+{
+ type_register_static(&mch_info);
+ type_register_static(&q35_host_info);
+}
+
+type_init(q35_register);
diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
new file mode 100644
index 000000000..6e514f75e
--- /dev/null
+++ b/hw/pci-host/raven.c
@@ -0,0 +1,445 @@
+/*
+ * QEMU PREP PCI host
+ *
+ * Copyright (c) 2006 Fabrice Bellard
+ * Copyright (c) 2011-2013 Andreas Färber
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "qemu/datadir.h"
+#include "qemu/units.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "hw/pci/pci.h"
+#include "hw/pci/pci_bus.h"
+#include "hw/pci/pci_host.h"
+#include "hw/qdev-properties.h"
+#include "migration/vmstate.h"
+#include "hw/intc/i8259.h"
+#include "hw/irq.h"
+#include "hw/loader.h"
+#include "hw/or-irq.h"
+#include "elf.h"
+#include "qom/object.h"
+
+#define TYPE_RAVEN_PCI_DEVICE "raven"
+#define TYPE_RAVEN_PCI_HOST_BRIDGE "raven-pcihost"
+
+OBJECT_DECLARE_SIMPLE_TYPE(RavenPCIState, RAVEN_PCI_DEVICE)
+
+struct RavenPCIState {
+ PCIDevice dev;
+
+ uint32_t elf_machine;
+ char *bios_name;
+ MemoryRegion bios;
+};
+
+typedef struct PRePPCIState PREPPCIState;
+DECLARE_INSTANCE_CHECKER(PREPPCIState, RAVEN_PCI_HOST_BRIDGE,
+ TYPE_RAVEN_PCI_HOST_BRIDGE)
+
+struct PRePPCIState {
+ PCIHostState parent_obj;
+
+ qemu_or_irq *or_irq;
+ qemu_irq pci_irqs[PCI_NUM_PINS];
+ PCIBus pci_bus;
+ AddressSpace pci_io_as;
+ MemoryRegion pci_io;
+ MemoryRegion pci_io_non_contiguous;
+ MemoryRegion pci_memory;
+ MemoryRegion pci_intack;
+ MemoryRegion bm;
+ MemoryRegion bm_ram_alias;
+ MemoryRegion bm_pci_memory_alias;
+ AddressSpace bm_as;
+ RavenPCIState pci_dev;
+
+ int contiguous_map;
+ bool is_legacy_prep;
+};
+
+#define BIOS_SIZE (1 * MiB)
+
+#define PCI_IO_BASE_ADDR 0x80000000 /* Physical address on main bus */
+
+static inline uint32_t raven_pci_io_config(hwaddr addr)
+{
+ int i;
+
+ for (i = 0; i < 11; i++) {
+ if ((addr & (1 << (11 + i))) != 0) {
+ break;
+ }
+ }
+ return (addr & 0x7ff) | (i << 11);
+}
+
+static void raven_pci_io_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned int size)
+{
+ PREPPCIState *s = opaque;
+ PCIHostState *phb = PCI_HOST_BRIDGE(s);
+ pci_data_write(phb->bus, raven_pci_io_config(addr), val, size);
+}
+
+static uint64_t raven_pci_io_read(void *opaque, hwaddr addr,
+ unsigned int size)
+{
+ PREPPCIState *s = opaque;
+ PCIHostState *phb = PCI_HOST_BRIDGE(s);
+ return pci_data_read(phb->bus, raven_pci_io_config(addr), size);
+}
+
+static const MemoryRegionOps raven_pci_io_ops = {
+ .read = raven_pci_io_read,
+ .write = raven_pci_io_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static uint64_t raven_intack_read(void *opaque, hwaddr addr,
+ unsigned int size)
+{
+ return pic_read_irq(isa_pic);
+}
+
+static void raven_intack_write(void *opaque, hwaddr addr,
+ uint64_t data, unsigned size)
+{
+ qemu_log_mask(LOG_UNIMP, "%s not implemented\n", __func__);
+}
+
+static const MemoryRegionOps raven_intack_ops = {
+ .read = raven_intack_read,
+ .write = raven_intack_write,
+ .valid = {
+ .max_access_size = 1,
+ },
+};
+
+static inline hwaddr raven_io_address(PREPPCIState *s,
+ hwaddr addr)
+{
+ if (s->contiguous_map == 0) {
+ /* 64 KB contiguous space for IOs */
+ addr &= 0xFFFF;
+ } else {
+ /* 8 MB non-contiguous space for IOs */
+ addr = (addr & 0x1F) | ((addr & 0x007FFF000) >> 7);
+ }
+
+ /* FIXME: handle endianness switch */
+
+ return addr;
+}
+
+static uint64_t raven_io_read(void *opaque, hwaddr addr,
+ unsigned int size)
+{
+ PREPPCIState *s = opaque;
+ uint8_t buf[4];
+
+ addr = raven_io_address(s, addr);
+ address_space_read(&s->pci_io_as, addr + PCI_IO_BASE_ADDR,
+ MEMTXATTRS_UNSPECIFIED, buf, size);
+
+ if (size == 1) {
+ return buf[0];
+ } else if (size == 2) {
+ return lduw_le_p(buf);
+ } else if (size == 4) {
+ return ldl_le_p(buf);
+ } else {
+ g_assert_not_reached();
+ }
+}
+
+static void raven_io_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned int size)
+{
+ PREPPCIState *s = opaque;
+ uint8_t buf[4];
+
+ addr = raven_io_address(s, addr);
+
+ if (size == 1) {
+ buf[0] = val;
+ } else if (size == 2) {
+ stw_le_p(buf, val);
+ } else if (size == 4) {
+ stl_le_p(buf, val);
+ } else {
+ g_assert_not_reached();
+ }
+
+ address_space_write(&s->pci_io_as, addr + PCI_IO_BASE_ADDR,
+ MEMTXATTRS_UNSPECIFIED, buf, size);
+}
+
+static const MemoryRegionOps raven_io_ops = {
+ .read = raven_io_read,
+ .write = raven_io_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ .impl.max_access_size = 4,
+ .valid.unaligned = true,
+};
+
+static int raven_map_irq(PCIDevice *pci_dev, int irq_num)
+{
+ return (irq_num + (pci_dev->devfn >> 3)) & 1;
+}
+
+static void raven_set_irq(void *opaque, int irq_num, int level)
+{
+ PREPPCIState *s = opaque;
+
+ qemu_set_irq(s->pci_irqs[irq_num], level);
+}
+
+static AddressSpace *raven_pcihost_set_iommu(PCIBus *bus, void *opaque,
+ int devfn)
+{
+ PREPPCIState *s = opaque;
+
+ return &s->bm_as;
+}
+
+static void raven_change_gpio(void *opaque, int n, int level)
+{
+ PREPPCIState *s = opaque;
+
+ s->contiguous_map = level;
+}
+
+static void raven_pcihost_realizefn(DeviceState *d, Error **errp)
+{
+ SysBusDevice *dev = SYS_BUS_DEVICE(d);
+ PCIHostState *h = PCI_HOST_BRIDGE(dev);
+ PREPPCIState *s = RAVEN_PCI_HOST_BRIDGE(dev);
+ MemoryRegion *address_space_mem = get_system_memory();
+ int i;
+
+ if (s->is_legacy_prep) {
+ for (i = 0; i < PCI_NUM_PINS; i++) {
+ sysbus_init_irq(dev, &s->pci_irqs[i]);
+ }
+ } else {
+ /* According to PReP specification section 6.1.6 "System Interrupt
+ * Assignments", all PCI interrupts are routed via IRQ 15 */
+ s->or_irq = OR_IRQ(object_new(TYPE_OR_IRQ));
+ object_property_set_int(OBJECT(s->or_irq), "num-lines", PCI_NUM_PINS,
+ &error_fatal);
+ qdev_realize(DEVICE(s->or_irq), NULL, &error_fatal);
+ sysbus_init_irq(dev, &s->or_irq->out_irq);
+
+ for (i = 0; i < PCI_NUM_PINS; i++) {
+ s->pci_irqs[i] = qdev_get_gpio_in(DEVICE(s->or_irq), i);
+ }
+ }
+
+ qdev_init_gpio_in(d, raven_change_gpio, 1);
+
+ pci_bus_irqs(&s->pci_bus, raven_set_irq, raven_map_irq, s, PCI_NUM_PINS);
+
+ memory_region_init_io(&h->conf_mem, OBJECT(h), &pci_host_conf_le_ops, s,
+ "pci-conf-idx", 4);
+ memory_region_add_subregion(&s->pci_io, 0xcf8, &h->conf_mem);
+
+ memory_region_init_io(&h->data_mem, OBJECT(h), &pci_host_data_le_ops, s,
+ "pci-conf-data", 4);
+ memory_region_add_subregion(&s->pci_io, 0xcfc, &h->data_mem);
+
+ memory_region_init_io(&h->mmcfg, OBJECT(s), &raven_pci_io_ops, s,
+ "pciio", 0x00400000);
+ memory_region_add_subregion(address_space_mem, 0x80800000, &h->mmcfg);
+
+ memory_region_init_io(&s->pci_intack, OBJECT(s), &raven_intack_ops, s,
+ "pci-intack", 1);
+ memory_region_add_subregion(address_space_mem, 0xbffffff0, &s->pci_intack);
+
+ /* TODO Remove once realize propagates to child devices. */
+ qdev_realize(DEVICE(&s->pci_dev), BUS(&s->pci_bus), errp);
+}
+
+static void raven_pcihost_initfn(Object *obj)
+{
+ PCIHostState *h = PCI_HOST_BRIDGE(obj);
+ PREPPCIState *s = RAVEN_PCI_HOST_BRIDGE(obj);
+ MemoryRegion *address_space_mem = get_system_memory();
+ DeviceState *pci_dev;
+
+ memory_region_init(&s->pci_io, obj, "pci-io", 0x3f800000);
+ memory_region_init_io(&s->pci_io_non_contiguous, obj, &raven_io_ops, s,
+ "pci-io-non-contiguous", 0x00800000);
+ memory_region_init(&s->pci_memory, obj, "pci-memory", 0x3f000000);
+ address_space_init(&s->pci_io_as, &s->pci_io, "raven-io");
+
+ /* CPU address space */
+ memory_region_add_subregion(address_space_mem, PCI_IO_BASE_ADDR,
+ &s->pci_io);
+ memory_region_add_subregion_overlap(address_space_mem, PCI_IO_BASE_ADDR,
+ &s->pci_io_non_contiguous, 1);
+ memory_region_add_subregion(address_space_mem, 0xc0000000, &s->pci_memory);
+ pci_root_bus_init(&s->pci_bus, sizeof(s->pci_bus), DEVICE(obj), NULL,
+ &s->pci_memory, &s->pci_io, 0, TYPE_PCI_BUS);
+
+ /* Bus master address space */
+ memory_region_init(&s->bm, obj, "bm-raven", 4 * GiB);
+ memory_region_init_alias(&s->bm_pci_memory_alias, obj, "bm-pci-memory",
+ &s->pci_memory, 0,
+ memory_region_size(&s->pci_memory));
+ memory_region_init_alias(&s->bm_ram_alias, obj, "bm-system",
+ get_system_memory(), 0, 0x80000000);
+ memory_region_add_subregion(&s->bm, 0 , &s->bm_pci_memory_alias);
+ memory_region_add_subregion(&s->bm, 0x80000000, &s->bm_ram_alias);
+ address_space_init(&s->bm_as, &s->bm, "raven-bm");
+ pci_setup_iommu(&s->pci_bus, raven_pcihost_set_iommu, s);
+
+ h->bus = &s->pci_bus;
+
+ object_initialize(&s->pci_dev, sizeof(s->pci_dev), TYPE_RAVEN_PCI_DEVICE);
+ pci_dev = DEVICE(&s->pci_dev);
+ object_property_set_int(OBJECT(&s->pci_dev), "addr", PCI_DEVFN(0, 0),
+ NULL);
+ qdev_prop_set_bit(pci_dev, "multifunction", false);
+}
+
+static void raven_realize(PCIDevice *d, Error **errp)
+{
+ RavenPCIState *s = RAVEN_PCI_DEVICE(d);
+ char *filename;
+ int bios_size = -1;
+
+ d->config[0x0C] = 0x08; // cache_line_size
+ d->config[0x0D] = 0x10; // latency_timer
+ d->config[0x34] = 0x00; // capabilities_pointer
+
+ memory_region_init_rom_nomigrate(&s->bios, OBJECT(s), "bios", BIOS_SIZE,
+ &error_fatal);
+ memory_region_add_subregion(get_system_memory(), (uint32_t)(-BIOS_SIZE),
+ &s->bios);
+ if (s->bios_name) {
+ filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, s->bios_name);
+ if (filename) {
+ if (s->elf_machine != EM_NONE) {
+ bios_size = load_elf(filename, NULL, NULL, NULL, NULL,
+ NULL, NULL, NULL, 1, s->elf_machine,
+ 0, 0);
+ }
+ if (bios_size < 0) {
+ bios_size = get_image_size(filename);
+ if (bios_size > 0 && bios_size <= BIOS_SIZE) {
+ hwaddr bios_addr;
+ bios_size = (bios_size + 0xfff) & ~0xfff;
+ bios_addr = (uint32_t)(-BIOS_SIZE);
+ bios_size = load_image_targphys(filename, bios_addr,
+ bios_size);
+ }
+ }
+ }
+ g_free(filename);
+ if (bios_size < 0 || bios_size > BIOS_SIZE) {
+ memory_region_del_subregion(get_system_memory(), &s->bios);
+ error_setg(errp, "Could not load bios image '%s'", s->bios_name);
+ return;
+ }
+ }
+
+ vmstate_register_ram_global(&s->bios);
+}
+
+static const VMStateDescription vmstate_raven = {
+ .name = "raven",
+ .version_id = 0,
+ .minimum_version_id = 0,
+ .fields = (VMStateField[]) {
+ VMSTATE_PCI_DEVICE(dev, RavenPCIState),
+ VMSTATE_END_OF_LIST()
+ },
+};
+
+static void raven_class_init(ObjectClass *klass, void *data)
+{
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ k->realize = raven_realize;
+ k->vendor_id = PCI_VENDOR_ID_MOTOROLA;
+ k->device_id = PCI_DEVICE_ID_MOTOROLA_RAVEN;
+ k->revision = 0x00;
+ k->class_id = PCI_CLASS_BRIDGE_HOST;
+ dc->desc = "PReP Host Bridge - Motorola Raven";
+ dc->vmsd = &vmstate_raven;
+ /*
+ * Reason: PCI-facing part of the host bridge, not usable without
+ * the host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo raven_info = {
+ .name = TYPE_RAVEN_PCI_DEVICE,
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(RavenPCIState),
+ .class_init = raven_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+static Property raven_pcihost_properties[] = {
+ DEFINE_PROP_UINT32("elf-machine", PREPPCIState, pci_dev.elf_machine,
+ EM_NONE),
+ DEFINE_PROP_STRING("bios-name", PREPPCIState, pci_dev.bios_name),
+ /* Temporary workaround until legacy prep machine is removed */
+ DEFINE_PROP_BOOL("is-legacy-prep", PREPPCIState, is_legacy_prep,
+ false),
+ DEFINE_PROP_END_OF_LIST()
+};
+
+static void raven_pcihost_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->realize = raven_pcihost_realizefn;
+ device_class_set_props(dc, raven_pcihost_properties);
+ dc->fw_name = "pci";
+}
+
+static const TypeInfo raven_pcihost_info = {
+ .name = TYPE_RAVEN_PCI_HOST_BRIDGE,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(PREPPCIState),
+ .instance_init = raven_pcihost_initfn,
+ .class_init = raven_pcihost_class_init,
+};
+
+static void raven_register_types(void)
+{
+ type_register_static(&raven_pcihost_info);
+ type_register_static(&raven_info);
+}
+
+type_init(raven_register_types)
diff --git a/hw/pci-host/remote.c b/hw/pci-host/remote.c
new file mode 100644
index 000000000..eee45444e
--- /dev/null
+++ b/hw/pci-host/remote.c
@@ -0,0 +1,75 @@
+/*
+ * Remote PCI host device
+ *
+ * Unlike PCI host devices that model physical hardware, the purpose
+ * of this PCI host is to host multi-process QEMU devices.
+ *
+ * Multi-process QEMU extends the PCI host of a QEMU machine into a
+ * remote process. Any PCI device attached to the remote process is
+ * visible in the QEMU guest. This allows existing QEMU device models
+ * to be reused in the remote process.
+ *
+ * This PCI host is purely a container for PCI devices. It's fake in the
+ * sense that the guest never sees this PCI host and has no way of
+ * accessing it. Its job is just to provide the environment that QEMU
+ * PCI device models need when running in a remote process.
+ *
+ * Copyright © 2018, 2021 Oracle and/or its affiliates.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+
+#include "hw/pci/pci.h"
+#include "hw/pci/pci_host.h"
+#include "hw/pci/pcie_host.h"
+#include "hw/qdev-properties.h"
+#include "hw/pci-host/remote.h"
+#include "exec/memory.h"
+
+static const char *remote_pcihost_root_bus_path(PCIHostState *host_bridge,
+ PCIBus *rootbus)
+{
+ return "0000:00";
+}
+
+static void remote_pcihost_realize(DeviceState *dev, Error **errp)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+ RemotePCIHost *s = REMOTE_PCIHOST(dev);
+
+ pci->bus = pci_root_bus_new(DEVICE(s), "remote-pci",
+ s->mr_pci_mem, s->mr_sys_io,
+ 0, TYPE_PCIE_BUS);
+}
+
+static void remote_pcihost_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
+
+ hc->root_bus_path = remote_pcihost_root_bus_path;
+ dc->realize = remote_pcihost_realize;
+
+ dc->user_creatable = false;
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->fw_name = "pci";
+}
+
+static const TypeInfo remote_pcihost_info = {
+ .name = TYPE_REMOTE_PCIHOST,
+ .parent = TYPE_PCIE_HOST_BRIDGE,
+ .instance_size = sizeof(RemotePCIHost),
+ .class_init = remote_pcihost_class_init,
+};
+
+static void remote_pcihost_register(void)
+{
+ type_register_static(&remote_pcihost_info);
+}
+
+type_init(remote_pcihost_register)
diff --git a/hw/pci-host/sabre.c b/hw/pci-host/sabre.c
new file mode 100644
index 000000000..949ecc21f
--- /dev/null
+++ b/hw/pci-host/sabre.c
@@ -0,0 +1,526 @@
+/*
+ * QEMU Ultrasparc Sabre PCI host (PBM)
+ *
+ * Copyright (c) 2006 Fabrice Bellard
+ * Copyright (c) 2012,2013 Artyom Tarasenko
+ * Copyright (c) 2018 Mark Cave-Ayland
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "hw/pci/pci.h"
+#include "hw/pci/pci_host.h"
+#include "hw/qdev-properties.h"
+#include "hw/pci/pci_bridge.h"
+#include "hw/pci/pci_bus.h"
+#include "hw/irq.h"
+#include "hw/pci-bridge/simba.h"
+#include "hw/pci-host/sabre.h"
+#include "qapi/error.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "sysemu/runstate.h"
+#include "trace.h"
+
+/*
+ * Chipset docs:
+ * PBM: "UltraSPARC IIi User's Manual",
+ * https://web.archive.org/web/20030403110020/http://www.sun.com/processors/manuals/805-0087.pdf
+ */
+
+#define PBM_PCI_IMR_MASK 0x7fffffff
+#define PBM_PCI_IMR_ENABLED 0x80000000
+
+#define POR (1U << 31)
+#define SOFT_POR (1U << 30)
+#define SOFT_XIR (1U << 29)
+#define BTN_POR (1U << 28)
+#define BTN_XIR (1U << 27)
+#define RESET_MASK 0xf8000000
+#define RESET_WCMASK 0x98000000
+#define RESET_WMASK 0x60000000
+
+#define NO_IRQ_REQUEST (MAX_IVEC + 1)
+
+static inline void sabre_set_request(SabreState *s, unsigned int irq_num)
+{
+ trace_sabre_set_request(irq_num);
+ s->irq_request = irq_num;
+ qemu_set_irq(s->ivec_irqs[irq_num], 1);
+}
+
+static inline void sabre_check_irqs(SabreState *s)
+{
+ unsigned int i;
+
+ /* Previous request is not acknowledged, resubmit */
+ if (s->irq_request != NO_IRQ_REQUEST) {
+ sabre_set_request(s, s->irq_request);
+ return;
+ }
+ /* no request pending */
+ if (s->pci_irq_in == 0ULL) {
+ return;
+ }
+ for (i = 0; i < 32; i++) {
+ if (s->pci_irq_in & (1ULL << i)) {
+ if (s->pci_irq_map[i >> 2] & PBM_PCI_IMR_ENABLED) {
+ sabre_set_request(s, i);
+ return;
+ }
+ }
+ }
+ for (i = 32; i < 64; i++) {
+ if (s->pci_irq_in & (1ULL << i)) {
+ if (s->obio_irq_map[i - 32] & PBM_PCI_IMR_ENABLED) {
+ sabre_set_request(s, i);
+ break;
+ }
+ }
+ }
+}
+
+static inline void sabre_clear_request(SabreState *s, unsigned int irq_num)
+{
+ trace_sabre_clear_request(irq_num);
+ qemu_set_irq(s->ivec_irqs[irq_num], 0);
+ s->irq_request = NO_IRQ_REQUEST;
+}
+
+static AddressSpace *sabre_pci_dma_iommu(PCIBus *bus, void *opaque, int devfn)
+{
+ IOMMUState *is = opaque;
+
+ return &is->iommu_as;
+}
+
+static void sabre_config_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ SabreState *s = opaque;
+
+ trace_sabre_config_write(addr, val);
+
+ switch (addr) {
+ case 0x30 ... 0x4f: /* DMA error registers */
+ /* XXX: not implemented yet */
+ break;
+ case 0xc00 ... 0xc3f: /* PCI interrupt control */
+ if (addr & 4) {
+ unsigned int ino = (addr & 0x3f) >> 3;
+ s->pci_irq_map[ino] &= PBM_PCI_IMR_MASK;
+ s->pci_irq_map[ino] |= val & ~PBM_PCI_IMR_MASK;
+ if ((s->irq_request == ino) && !(val & ~PBM_PCI_IMR_MASK)) {
+ sabre_clear_request(s, ino);
+ }
+ sabre_check_irqs(s);
+ }
+ break;
+ case 0x1000 ... 0x107f: /* OBIO interrupt control */
+ if (addr & 4) {
+ unsigned int ino = ((addr & 0xff) >> 3);
+ s->obio_irq_map[ino] &= PBM_PCI_IMR_MASK;
+ s->obio_irq_map[ino] |= val & ~PBM_PCI_IMR_MASK;
+ if ((s->irq_request == (ino | 0x20))
+ && !(val & ~PBM_PCI_IMR_MASK)) {
+ sabre_clear_request(s, ino | 0x20);
+ }
+ sabre_check_irqs(s);
+ }
+ break;
+ case 0x1400 ... 0x14ff: /* PCI interrupt clear */
+ if (addr & 4) {
+ unsigned int ino = (addr & 0xff) >> 5;
+ if ((s->irq_request / 4) == ino) {
+ sabre_clear_request(s, s->irq_request);
+ sabre_check_irqs(s);
+ }
+ }
+ break;
+ case 0x1800 ... 0x1860: /* OBIO interrupt clear */
+ if (addr & 4) {
+ unsigned int ino = ((addr & 0xff) >> 3) | 0x20;
+ if (s->irq_request == ino) {
+ sabre_clear_request(s, ino);
+ sabre_check_irqs(s);
+ }
+ }
+ break;
+ case 0x2000 ... 0x202f: /* PCI control */
+ s->pci_control[(addr & 0x3f) >> 2] = val;
+ break;
+ case 0xf020 ... 0xf027: /* Reset control */
+ if (addr & 4) {
+ val &= RESET_MASK;
+ s->reset_control &= ~(val & RESET_WCMASK);
+ s->reset_control |= val & RESET_WMASK;
+ if (val & SOFT_POR) {
+ s->nr_resets = 0;
+ qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+ } else if (val & SOFT_XIR) {
+ qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+ }
+ }
+ break;
+ case 0x5000 ... 0x51cf: /* PIO/DMA diagnostics */
+ case 0xa400 ... 0xa67f: /* IOMMU diagnostics */
+ case 0xa800 ... 0xa80f: /* Interrupt diagnostics */
+ case 0xf000 ... 0xf01f: /* FFB config, memory control */
+ /* we don't care */
+ default:
+ break;
+ }
+}
+
+static uint64_t sabre_config_read(void *opaque,
+ hwaddr addr, unsigned size)
+{
+ SabreState *s = opaque;
+ uint32_t val = 0;
+
+ switch (addr) {
+ case 0x30 ... 0x4f: /* DMA error registers */
+ /* XXX: not implemented yet */
+ break;
+ case 0xc00 ... 0xc3f: /* PCI interrupt control */
+ if (addr & 4) {
+ val = s->pci_irq_map[(addr & 0x3f) >> 3];
+ }
+ break;
+ case 0x1000 ... 0x107f: /* OBIO interrupt control */
+ if (addr & 4) {
+ val = s->obio_irq_map[(addr & 0xff) >> 3];
+ }
+ break;
+ case 0x1080 ... 0x108f: /* PCI bus error */
+ if (addr & 4) {
+ val = s->pci_err_irq_map[(addr & 0xf) >> 3];
+ }
+ break;
+ case 0x2000 ... 0x202f: /* PCI control */
+ val = s->pci_control[(addr & 0x3f) >> 2];
+ break;
+ case 0xf020 ... 0xf027: /* Reset control */
+ if (addr & 4) {
+ val = s->reset_control;
+ }
+ break;
+ case 0x5000 ... 0x51cf: /* PIO/DMA diagnostics */
+ case 0xa400 ... 0xa67f: /* IOMMU diagnostics */
+ case 0xa800 ... 0xa80f: /* Interrupt diagnostics */
+ case 0xf000 ... 0xf01f: /* FFB config, memory control */
+ /* we don't care */
+ default:
+ break;
+ }
+ trace_sabre_config_read(addr, val);
+
+ return val;
+}
+
+static const MemoryRegionOps sabre_config_ops = {
+ .read = sabre_config_read,
+ .write = sabre_config_write,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static void sabre_pci_config_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ SabreState *s = opaque;
+ PCIHostState *phb = PCI_HOST_BRIDGE(s);
+
+ trace_sabre_pci_config_write(addr, val);
+ pci_data_write(phb->bus, addr, val, size);
+}
+
+static uint64_t sabre_pci_config_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ uint32_t ret;
+ SabreState *s = opaque;
+ PCIHostState *phb = PCI_HOST_BRIDGE(s);
+
+ ret = pci_data_read(phb->bus, addr, size);
+ trace_sabre_pci_config_read(addr, ret);
+ return ret;
+}
+
+/* The sabre host has an IRQ line for each IRQ line of each slot. */
+static int pci_sabre_map_irq(PCIDevice *pci_dev, int irq_num)
+{
+ /* Return the irq as swizzled by the PBM */
+ return irq_num;
+}
+
+static int pci_simbaA_map_irq(PCIDevice *pci_dev, int irq_num)
+{
+ /* The on-board devices have fixed (legacy) OBIO intnos */
+ switch (PCI_SLOT(pci_dev->devfn)) {
+ case 1:
+ /* Onboard NIC */
+ return OBIO_NIC_IRQ;
+ case 3:
+ /* Onboard IDE */
+ return OBIO_HDD_IRQ;
+ default:
+ /* Normal intno, fall through */
+ break;
+ }
+
+ return ((PCI_SLOT(pci_dev->devfn) << 2) + irq_num) & 0x1f;
+}
+
+static int pci_simbaB_map_irq(PCIDevice *pci_dev, int irq_num)
+{
+ return (0x10 + (PCI_SLOT(pci_dev->devfn) << 2) + irq_num) & 0x1f;
+}
+
+static void pci_sabre_set_irq(void *opaque, int irq_num, int level)
+{
+ SabreState *s = opaque;
+
+ trace_sabre_pci_set_irq(irq_num, level);
+
+ /* PCI IRQ map onto the first 32 INO. */
+ if (irq_num < 32) {
+ if (level) {
+ s->pci_irq_in |= 1ULL << irq_num;
+ if (s->pci_irq_map[irq_num >> 2] & PBM_PCI_IMR_ENABLED) {
+ sabre_set_request(s, irq_num);
+ }
+ } else {
+ s->pci_irq_in &= ~(1ULL << irq_num);
+ }
+ } else {
+ /* OBIO IRQ map onto the next 32 INO. */
+ if (level) {
+ trace_sabre_pci_set_obio_irq(irq_num, level);
+ s->pci_irq_in |= 1ULL << irq_num;
+ if ((s->irq_request == NO_IRQ_REQUEST)
+ && (s->obio_irq_map[irq_num - 32] & PBM_PCI_IMR_ENABLED)) {
+ sabre_set_request(s, irq_num);
+ }
+ } else {
+ s->pci_irq_in &= ~(1ULL << irq_num);
+ }
+ }
+}
+
+static void sabre_reset(DeviceState *d)
+{
+ SabreState *s = SABRE(d);
+ PCIDevice *pci_dev;
+ unsigned int i;
+ uint16_t cmd;
+
+ for (i = 0; i < 8; i++) {
+ s->pci_irq_map[i] &= PBM_PCI_IMR_MASK;
+ }
+ for (i = 0; i < 32; i++) {
+ s->obio_irq_map[i] &= PBM_PCI_IMR_MASK;
+ }
+
+ s->irq_request = NO_IRQ_REQUEST;
+ s->pci_irq_in = 0ULL;
+
+ if (s->nr_resets++ == 0) {
+ /* Power on reset */
+ s->reset_control = POR;
+ }
+
+ /* As this is the busA PCI bridge which contains the on-board devices
+ * attached to the ebus, ensure that we initially allow IO transactions
+ * so that we get the early serial console until OpenBIOS can properly
+ * configure the PCI bridge itself */
+ pci_dev = PCI_DEVICE(s->bridgeA);
+ cmd = pci_get_word(pci_dev->config + PCI_COMMAND);
+ pci_set_word(pci_dev->config + PCI_COMMAND, cmd | PCI_COMMAND_IO);
+ pci_bridge_update_mappings(PCI_BRIDGE(pci_dev));
+}
+
+static const MemoryRegionOps pci_config_ops = {
+ .read = sabre_pci_config_read,
+ .write = sabre_pci_config_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void sabre_realize(DeviceState *dev, Error **errp)
+{
+ SabreState *s = SABRE(dev);
+ PCIHostState *phb = PCI_HOST_BRIDGE(dev);
+ PCIDevice *pci_dev;
+
+ memory_region_init(&s->pci_mmio, OBJECT(s), "pci-mmio", 0x100000000ULL);
+ memory_region_add_subregion(get_system_memory(), s->mem_base,
+ &s->pci_mmio);
+
+ phb->bus = pci_register_root_bus(dev, "pci",
+ pci_sabre_set_irq, pci_sabre_map_irq, s,
+ &s->pci_mmio,
+ &s->pci_ioport,
+ 0, 0x40, TYPE_PCI_BUS);
+
+ pci_create_simple(phb->bus, 0, TYPE_SABRE_PCI_DEVICE);
+
+ /* IOMMU */
+ memory_region_add_subregion_overlap(&s->sabre_config, 0x200,
+ sysbus_mmio_get_region(SYS_BUS_DEVICE(s->iommu), 0), 1);
+ pci_setup_iommu(phb->bus, sabre_pci_dma_iommu, s->iommu);
+
+ /* APB secondary busses */
+ pci_dev = pci_new_multifunction(PCI_DEVFN(1, 0), true,
+ TYPE_SIMBA_PCI_BRIDGE);
+ s->bridgeB = PCI_BRIDGE(pci_dev);
+ pci_bridge_map_irq(s->bridgeB, "pciB", pci_simbaB_map_irq);
+ pci_realize_and_unref(pci_dev, phb->bus, &error_fatal);
+
+ pci_dev = pci_new_multifunction(PCI_DEVFN(1, 1), true,
+ TYPE_SIMBA_PCI_BRIDGE);
+ s->bridgeA = PCI_BRIDGE(pci_dev);
+ pci_bridge_map_irq(s->bridgeA, "pciA", pci_simbaA_map_irq);
+ pci_realize_and_unref(pci_dev, phb->bus, &error_fatal);
+}
+
+static void sabre_init(Object *obj)
+{
+ SabreState *s = SABRE(obj);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+ unsigned int i;
+
+ for (i = 0; i < 8; i++) {
+ s->pci_irq_map[i] = (0x1f << 6) | (i << 2);
+ }
+ for (i = 0; i < 2; i++) {
+ s->pci_err_irq_map[i] = (0x1f << 6) | 0x30;
+ }
+ for (i = 0; i < 32; i++) {
+ s->obio_irq_map[i] = ((0x1f << 6) | 0x20) + i;
+ }
+ qdev_init_gpio_in_named(DEVICE(s), pci_sabre_set_irq, "pbm-irq", MAX_IVEC);
+ qdev_init_gpio_out_named(DEVICE(s), s->ivec_irqs, "ivec-irq", MAX_IVEC);
+ s->irq_request = NO_IRQ_REQUEST;
+ s->pci_irq_in = 0ULL;
+
+ /* IOMMU */
+ object_property_add_link(obj, "iommu", TYPE_SUN4U_IOMMU,
+ (Object **) &s->iommu,
+ qdev_prop_allow_set_link_before_realize,
+ 0);
+
+ /* sabre_config */
+ memory_region_init_io(&s->sabre_config, OBJECT(s), &sabre_config_ops, s,
+ "sabre-config", 0x10000);
+ /* at region 0 */
+ sysbus_init_mmio(sbd, &s->sabre_config);
+
+ memory_region_init_io(&s->pci_config, OBJECT(s), &pci_config_ops, s,
+ "sabre-pci-config", 0x1000000);
+ /* at region 1 */
+ sysbus_init_mmio(sbd, &s->pci_config);
+
+ /* pci_ioport */
+ memory_region_init(&s->pci_ioport, OBJECT(s), "sabre-pci-ioport",
+ 0x1000000);
+
+ /* at region 2 */
+ sysbus_init_mmio(sbd, &s->pci_ioport);
+}
+
+static void sabre_pci_realize(PCIDevice *d, Error **errp)
+{
+ pci_set_word(d->config + PCI_COMMAND,
+ PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
+ pci_set_word(d->config + PCI_STATUS,
+ PCI_STATUS_FAST_BACK | PCI_STATUS_66MHZ |
+ PCI_STATUS_DEVSEL_MEDIUM);
+}
+
+static void sabre_pci_class_init(ObjectClass *klass, void *data)
+{
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ k->realize = sabre_pci_realize;
+ k->vendor_id = PCI_VENDOR_ID_SUN;
+ k->device_id = PCI_DEVICE_ID_SUN_SABRE;
+ k->class_id = PCI_CLASS_BRIDGE_HOST;
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo sabre_pci_info = {
+ .name = TYPE_SABRE_PCI_DEVICE,
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(SabrePCIState),
+ .class_init = sabre_pci_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+static char *sabre_ofw_unit_address(const SysBusDevice *dev)
+{
+ SabreState *s = SABRE(dev);
+
+ return g_strdup_printf("%x,%x",
+ (uint32_t)((s->special_base >> 32) & 0xffffffff),
+ (uint32_t)(s->special_base & 0xffffffff));
+}
+
+static Property sabre_properties[] = {
+ DEFINE_PROP_UINT64("special-base", SabreState, special_base, 0),
+ DEFINE_PROP_UINT64("mem-base", SabreState, mem_base, 0),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void sabre_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ SysBusDeviceClass *sbc = SYS_BUS_DEVICE_CLASS(klass);
+
+ dc->realize = sabre_realize;
+ dc->reset = sabre_reset;
+ device_class_set_props(dc, sabre_properties);
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->fw_name = "pci";
+ sbc->explicit_ofw_unit_address = sabre_ofw_unit_address;
+}
+
+static const TypeInfo sabre_info = {
+ .name = TYPE_SABRE,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(SabreState),
+ .instance_init = sabre_init,
+ .class_init = sabre_class_init,
+};
+
+static void sabre_register_types(void)
+{
+ type_register_static(&sabre_info);
+ type_register_static(&sabre_pci_info);
+}
+
+type_init(sabre_register_types)
diff --git a/hw/pci-host/sh_pci.c b/hw/pci-host/sh_pci.c
new file mode 100644
index 000000000..719d6ca2a
--- /dev/null
+++ b/hw/pci-host/sh_pci.c
@@ -0,0 +1,201 @@
+/*
+ * SuperH on-chip PCIC emulation.
+ *
+ * Copyright (c) 2008 Takashi YOSHII
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "hw/sh4/sh.h"
+#include "hw/irq.h"
+#include "hw/pci/pci.h"
+#include "hw/pci/pci_host.h"
+#include "qemu/bswap.h"
+#include "qemu/module.h"
+#include "qom/object.h"
+
+#define TYPE_SH_PCI_HOST_BRIDGE "sh_pci"
+
+OBJECT_DECLARE_SIMPLE_TYPE(SHPCIState, SH_PCI_HOST_BRIDGE)
+
+struct SHPCIState {
+ PCIHostState parent_obj;
+
+ PCIDevice *dev;
+ qemu_irq irq[4];
+ MemoryRegion memconfig_p4;
+ MemoryRegion memconfig_a7;
+ MemoryRegion isa;
+ uint32_t par;
+ uint32_t mbr;
+ uint32_t iobr;
+};
+
+static void sh_pci_reg_write(void *p, hwaddr addr, uint64_t val, unsigned size)
+{
+ SHPCIState *pcic = p;
+ PCIHostState *phb = PCI_HOST_BRIDGE(pcic);
+
+ switch (addr) {
+ case 0 ... 0xfc:
+ stl_le_p(pcic->dev->config + addr, val);
+ break;
+ case 0x1c0:
+ pcic->par = val;
+ break;
+ case 0x1c4:
+ pcic->mbr = val & 0xff000001;
+ break;
+ case 0x1c8:
+ pcic->iobr = val & 0xfffc0001;
+ memory_region_set_alias_offset(&pcic->isa, val & 0xfffc0000);
+ break;
+ case 0x220:
+ pci_data_write(phb->bus, pcic->par, val, 4);
+ break;
+ }
+}
+
+static uint64_t sh_pci_reg_read(void *p, hwaddr addr, unsigned size)
+{
+ SHPCIState *pcic = p;
+ PCIHostState *phb = PCI_HOST_BRIDGE(pcic);
+
+ switch (addr) {
+ case 0 ... 0xfc:
+ return ldl_le_p(pcic->dev->config + addr);
+ case 0x1c0:
+ return pcic->par;
+ case 0x1c4:
+ return pcic->mbr;
+ case 0x1c8:
+ return pcic->iobr;
+ case 0x220:
+ return pci_data_read(phb->bus, pcic->par, 4);
+ }
+ return 0;
+}
+
+static const MemoryRegionOps sh_pci_reg_ops = {
+ .read = sh_pci_reg_read,
+ .write = sh_pci_reg_write,
+ .endianness = DEVICE_NATIVE_ENDIAN,
+ .valid = {
+ .min_access_size = 4,
+ .max_access_size = 4,
+ },
+};
+
+static int sh_pci_map_irq(PCIDevice *d, int irq_num)
+{
+ return PCI_SLOT(d->devfn);
+}
+
+static void sh_pci_set_irq(void *opaque, int irq_num, int level)
+{
+ qemu_irq *pic = opaque;
+
+ qemu_set_irq(pic[irq_num], level);
+}
+
+static void sh_pci_device_realize(DeviceState *dev, Error **errp)
+{
+ SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+ SHPCIState *s = SH_PCI_HOST_BRIDGE(dev);
+ PCIHostState *phb = PCI_HOST_BRIDGE(s);
+ int i;
+
+ for (i = 0; i < 4; i++) {
+ sysbus_init_irq(sbd, &s->irq[i]);
+ }
+ phb->bus = pci_register_root_bus(dev, "pci",
+ sh_pci_set_irq, sh_pci_map_irq,
+ s->irq,
+ get_system_memory(),
+ get_system_io(),
+ PCI_DEVFN(0, 0), 4, TYPE_PCI_BUS);
+ memory_region_init_io(&s->memconfig_p4, OBJECT(s), &sh_pci_reg_ops, s,
+ "sh_pci", 0x224);
+ memory_region_init_alias(&s->memconfig_a7, OBJECT(s), "sh_pci.2",
+ &s->memconfig_p4, 0, 0x224);
+ memory_region_init_alias(&s->isa, OBJECT(s), "sh_pci.isa",
+ get_system_io(), 0, 0x40000);
+ sysbus_init_mmio(sbd, &s->memconfig_p4);
+ sysbus_init_mmio(sbd, &s->memconfig_a7);
+ memory_region_add_subregion(get_system_memory(), 0xfe240000, &s->isa);
+
+ s->dev = pci_create_simple(phb->bus, PCI_DEVFN(0, 0), "sh_pci_host");
+}
+
+static void sh_pci_host_realize(PCIDevice *d, Error **errp)
+{
+ pci_set_word(d->config + PCI_COMMAND, PCI_COMMAND_WAIT);
+ pci_set_word(d->config + PCI_STATUS, PCI_STATUS_CAP_LIST |
+ PCI_STATUS_FAST_BACK | PCI_STATUS_DEVSEL_MEDIUM);
+}
+
+static void sh_pci_host_class_init(ObjectClass *klass, void *data)
+{
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ k->realize = sh_pci_host_realize;
+ k->vendor_id = PCI_VENDOR_ID_HITACHI;
+ k->device_id = PCI_DEVICE_ID_HITACHI_SH7751R;
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo sh_pci_host_info = {
+ .name = "sh_pci_host",
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(PCIDevice),
+ .class_init = sh_pci_host_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+static void sh_pci_device_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ dc->realize = sh_pci_device_realize;
+}
+
+static const TypeInfo sh_pci_device_info = {
+ .name = TYPE_SH_PCI_HOST_BRIDGE,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(SHPCIState),
+ .class_init = sh_pci_device_class_init,
+};
+
+static void sh_pci_register_types(void)
+{
+ type_register_static(&sh_pci_device_info);
+ type_register_static(&sh_pci_host_info);
+}
+
+type_init(sh_pci_register_types)
diff --git a/hw/pci-host/trace-events b/hw/pci-host/trace-events
new file mode 100644
index 000000000..630e9fcc5
--- /dev/null
+++ b/hw/pci-host/trace-events
@@ -0,0 +1,34 @@
+# See docs/devel/tracing.rst for syntax documentation.
+
+# bonito.c
+bonito_spciconf_small_access(uint64_t addr, unsigned size) "PCI config address is smaller then 32-bit, addr: 0x%"PRIx64", size: %u"
+
+# grackle.c
+grackle_set_irq(int irq_num, int level) "set_irq num %d level %d"
+
+# mv64361.c
+mv64361_region_map(const char *name, uint64_t poffs, uint64_t size, uint64_t moffs) "Mapping %s 0x%"PRIx64"+0x%"PRIx64" @ 0x%"PRIx64
+mv64361_region_enable(const char *op, int num) "Should %s region %d"
+mv64361_reg_read(uint64_t addr, uint32_t val) "0x%"PRIx64" -> 0x%x"
+mv64361_reg_write(uint64_t addr, uint64_t val) "0x%"PRIx64" <- 0x%"PRIx64
+
+# sabre.c
+sabre_set_request(int irq_num) "request irq %d"
+sabre_clear_request(int irq_num) "clear request irq %d"
+sabre_config_write(uint64_t addr, uint64_t val) "addr 0x%"PRIx64" val 0x%"PRIx64
+sabre_config_read(uint64_t addr, uint64_t val) "addr 0x%"PRIx64" val 0x%"PRIx64
+sabre_pci_config_write(uint64_t addr, uint64_t val) "addr 0x%"PRIx64" val 0x%"PRIx64
+sabre_pci_config_read(uint64_t addr, uint64_t val) "addr 0x%"PRIx64" val 0x%"PRIx64
+sabre_pci_set_irq(int irq_num, int level) "set irq_in %d level %d"
+sabre_pci_set_obio_irq(int irq_num, int level) "set irq %d level %d"
+
+# uninorth.c
+unin_set_irq(int irq_num, int level) "setting INT %d = %d"
+unin_get_config_reg(uint32_t reg, uint32_t addr, uint32_t retval) "converted config space accessor 0x%"PRIx32 "/0x%"PRIx32 " -> 0x%"PRIx32
+unin_data_write(uint64_t addr, unsigned len, uint64_t val) "write addr 0x%"PRIx64 " len %d val 0x%"PRIx64
+unin_data_read(uint64_t addr, unsigned len, uint64_t val) "read addr 0x%"PRIx64 " len %d val 0x%"PRIx64
+unin_write(uint64_t addr, uint64_t value) "addr=0x%" PRIx64 " val=0x%"PRIx64
+unin_read(uint64_t addr, uint64_t value) "addr=0x%" PRIx64 " val=0x%"PRIx64
+
+# pnv_phb4.c
+pnv_phb4_xive_notify(uint64_t notif_port, uint64_t data) "notif=@0x%"PRIx64" data=0x%"PRIx64
diff --git a/hw/pci-host/trace.h b/hw/pci-host/trace.h
new file mode 100644
index 000000000..93ec814a7
--- /dev/null
+++ b/hw/pci-host/trace.h
@@ -0,0 +1 @@
+#include "trace/trace-hw_pci_host.h"
diff --git a/hw/pci-host/uninorth.c b/hw/pci-host/uninorth.c
new file mode 100644
index 000000000..d25b62d6a
--- /dev/null
+++ b/hw/pci-host/uninorth.c
@@ -0,0 +1,582 @@
+/*
+ * QEMU Uninorth PCI host (for all Mac99 and newer machines)
+ *
+ * Copyright (c) 2006 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/irq.h"
+#include "hw/ppc/mac.h"
+#include "hw/qdev-properties.h"
+#include "qemu/module.h"
+#include "hw/pci/pci.h"
+#include "hw/pci/pci_host.h"
+#include "hw/pci-host/uninorth.h"
+#include "trace.h"
+
+static int pci_unin_map_irq(PCIDevice *pci_dev, int irq_num)
+{
+ return (irq_num + (pci_dev->devfn >> 3)) & 3;
+}
+
+static void pci_unin_set_irq(void *opaque, int irq_num, int level)
+{
+ UNINHostState *s = opaque;
+
+ trace_unin_set_irq(irq_num, level);
+ qemu_set_irq(s->irqs[irq_num], level);
+}
+
+static uint32_t unin_get_config_reg(uint32_t reg, uint32_t addr)
+{
+ uint32_t retval;
+
+ if (reg & (1u << 31)) {
+ /* XXX OpenBIOS compatibility hack */
+ retval = reg | (addr & 3);
+ } else if (reg & 1) {
+ /* CFA1 style */
+ retval = (reg & ~7u) | (addr & 7);
+ } else {
+ uint32_t slot, func;
+
+ /* Grab CFA0 style values */
+ slot = ctz32(reg & 0xfffff800);
+ if (slot == 32) {
+ slot = -1; /* XXX: should this be 0? */
+ }
+ func = PCI_FUNC(reg >> 8);
+
+ /* ... and then convert them to x86 format */
+ /* config pointer */
+ retval = (reg & (0xff - 7)) | (addr & 7);
+ /* slot, fn */
+ retval |= PCI_DEVFN(slot, func) << 8;
+ }
+
+ trace_unin_get_config_reg(reg, addr, retval);
+
+ return retval;
+}
+
+static void unin_data_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned len)
+{
+ UNINHostState *s = opaque;
+ PCIHostState *phb = PCI_HOST_BRIDGE(s);
+ trace_unin_data_write(addr, len, val);
+ pci_data_write(phb->bus,
+ unin_get_config_reg(phb->config_reg, addr),
+ val, len);
+}
+
+static uint64_t unin_data_read(void *opaque, hwaddr addr,
+ unsigned len)
+{
+ UNINHostState *s = opaque;
+ PCIHostState *phb = PCI_HOST_BRIDGE(s);
+ uint32_t val;
+
+ val = pci_data_read(phb->bus,
+ unin_get_config_reg(phb->config_reg, addr),
+ len);
+ trace_unin_data_read(addr, len, val);
+ return val;
+}
+
+static const MemoryRegionOps unin_data_ops = {
+ .read = unin_data_read,
+ .write = unin_data_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static char *pci_unin_main_ofw_unit_address(const SysBusDevice *dev)
+{
+ UNINHostState *s = UNI_NORTH_PCI_HOST_BRIDGE(dev);
+
+ return g_strdup_printf("%x", s->ofw_addr);
+}
+
+static void pci_unin_main_realize(DeviceState *dev, Error **errp)
+{
+ UNINHostState *s = UNI_NORTH_PCI_HOST_BRIDGE(dev);
+ PCIHostState *h = PCI_HOST_BRIDGE(dev);
+
+ h->bus = pci_register_root_bus(dev, NULL,
+ pci_unin_set_irq, pci_unin_map_irq,
+ s,
+ &s->pci_mmio,
+ &s->pci_io,
+ PCI_DEVFN(11, 0), 4, TYPE_PCI_BUS);
+
+ pci_create_simple(h->bus, PCI_DEVFN(11, 0), "uni-north-pci");
+
+ /* DEC 21154 bridge */
+#if 0
+ /* XXX: not activated as PPC BIOS doesn't handle multiple buses properly */
+ pci_create_simple(h->bus, PCI_DEVFN(12, 0), "dec-21154");
+#endif
+}
+
+static void pci_unin_main_init(Object *obj)
+{
+ UNINHostState *s = UNI_NORTH_PCI_HOST_BRIDGE(obj);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+ PCIHostState *h = PCI_HOST_BRIDGE(obj);
+
+ /* Use values found on a real PowerMac */
+ /* Uninorth main bus */
+ memory_region_init_io(&h->conf_mem, OBJECT(h), &pci_host_conf_le_ops,
+ obj, "unin-pci-conf-idx", 0x1000);
+ memory_region_init_io(&h->data_mem, OBJECT(h), &unin_data_ops, obj,
+ "unin-pci-conf-data", 0x1000);
+
+ memory_region_init(&s->pci_mmio, OBJECT(s), "unin-pci-mmio",
+ 0x100000000ULL);
+ memory_region_init_io(&s->pci_io, OBJECT(s), &unassigned_io_ops, obj,
+ "unin-pci-isa-mmio", 0x00800000);
+
+ memory_region_init_alias(&s->pci_hole, OBJECT(s),
+ "unin-pci-hole", &s->pci_mmio,
+ 0x80000000ULL, 0x10000000ULL);
+
+ sysbus_init_mmio(sbd, &h->conf_mem);
+ sysbus_init_mmio(sbd, &h->data_mem);
+ sysbus_init_mmio(sbd, &s->pci_hole);
+ sysbus_init_mmio(sbd, &s->pci_io);
+
+ qdev_init_gpio_out(DEVICE(obj), s->irqs, ARRAY_SIZE(s->irqs));
+}
+
+static void pci_u3_agp_realize(DeviceState *dev, Error **errp)
+{
+ UNINHostState *s = U3_AGP_HOST_BRIDGE(dev);
+ PCIHostState *h = PCI_HOST_BRIDGE(dev);
+
+ h->bus = pci_register_root_bus(dev, NULL,
+ pci_unin_set_irq, pci_unin_map_irq,
+ s,
+ &s->pci_mmio,
+ &s->pci_io,
+ PCI_DEVFN(11, 0), 4, TYPE_PCI_BUS);
+
+ pci_create_simple(h->bus, PCI_DEVFN(11, 0), "u3-agp");
+}
+
+static void pci_u3_agp_init(Object *obj)
+{
+ UNINHostState *s = U3_AGP_HOST_BRIDGE(obj);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+ PCIHostState *h = PCI_HOST_BRIDGE(obj);
+
+ /* Uninorth U3 AGP bus */
+ memory_region_init_io(&h->conf_mem, OBJECT(h), &pci_host_conf_le_ops,
+ obj, "unin-pci-conf-idx", 0x1000);
+ memory_region_init_io(&h->data_mem, OBJECT(h), &unin_data_ops, obj,
+ "unin-pci-conf-data", 0x1000);
+
+ memory_region_init(&s->pci_mmio, OBJECT(s), "unin-pci-mmio",
+ 0x100000000ULL);
+ memory_region_init_io(&s->pci_io, OBJECT(s), &unassigned_io_ops, obj,
+ "unin-pci-isa-mmio", 0x00800000);
+
+ memory_region_init_alias(&s->pci_hole, OBJECT(s),
+ "unin-pci-hole", &s->pci_mmio,
+ 0x80000000ULL, 0x70000000ULL);
+
+ sysbus_init_mmio(sbd, &h->conf_mem);
+ sysbus_init_mmio(sbd, &h->data_mem);
+ sysbus_init_mmio(sbd, &s->pci_hole);
+ sysbus_init_mmio(sbd, &s->pci_io);
+
+ qdev_init_gpio_out(DEVICE(obj), s->irqs, ARRAY_SIZE(s->irqs));
+}
+
+static void pci_unin_agp_realize(DeviceState *dev, Error **errp)
+{
+ UNINHostState *s = UNI_NORTH_AGP_HOST_BRIDGE(dev);
+ PCIHostState *h = PCI_HOST_BRIDGE(dev);
+
+ h->bus = pci_register_root_bus(dev, NULL,
+ pci_unin_set_irq, pci_unin_map_irq,
+ s,
+ &s->pci_mmio,
+ &s->pci_io,
+ PCI_DEVFN(11, 0), 4, TYPE_PCI_BUS);
+
+ pci_create_simple(h->bus, PCI_DEVFN(11, 0), "uni-north-agp");
+}
+
+static void pci_unin_agp_init(Object *obj)
+{
+ UNINHostState *s = UNI_NORTH_AGP_HOST_BRIDGE(obj);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+ PCIHostState *h = PCI_HOST_BRIDGE(obj);
+
+ /* Uninorth AGP bus */
+ memory_region_init_io(&h->conf_mem, OBJECT(h), &pci_host_conf_le_ops,
+ obj, "unin-agp-conf-idx", 0x1000);
+ memory_region_init_io(&h->data_mem, OBJECT(h), &pci_host_data_le_ops,
+ obj, "unin-agp-conf-data", 0x1000);
+
+ sysbus_init_mmio(sbd, &h->conf_mem);
+ sysbus_init_mmio(sbd, &h->data_mem);
+
+ qdev_init_gpio_out(DEVICE(obj), s->irqs, ARRAY_SIZE(s->irqs));
+}
+
+static void pci_unin_internal_realize(DeviceState *dev, Error **errp)
+{
+ UNINHostState *s = UNI_NORTH_INTERNAL_PCI_HOST_BRIDGE(dev);
+ PCIHostState *h = PCI_HOST_BRIDGE(dev);
+
+ h->bus = pci_register_root_bus(dev, NULL,
+ pci_unin_set_irq, pci_unin_map_irq,
+ s,
+ &s->pci_mmio,
+ &s->pci_io,
+ PCI_DEVFN(14, 0), 4, TYPE_PCI_BUS);
+
+ pci_create_simple(h->bus, PCI_DEVFN(14, 0), "uni-north-internal-pci");
+}
+
+static void pci_unin_internal_init(Object *obj)
+{
+ UNINHostState *s = UNI_NORTH_INTERNAL_PCI_HOST_BRIDGE(obj);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+ PCIHostState *h = PCI_HOST_BRIDGE(obj);
+
+ /* Uninorth internal bus */
+ memory_region_init_io(&h->conf_mem, OBJECT(h), &pci_host_conf_le_ops,
+ obj, "unin-pci-conf-idx", 0x1000);
+ memory_region_init_io(&h->data_mem, OBJECT(h), &pci_host_data_le_ops,
+ obj, "unin-pci-conf-data", 0x1000);
+
+ sysbus_init_mmio(sbd, &h->conf_mem);
+ sysbus_init_mmio(sbd, &h->data_mem);
+
+ qdev_init_gpio_out(DEVICE(obj), s->irqs, ARRAY_SIZE(s->irqs));
+}
+
+static void unin_main_pci_host_realize(PCIDevice *d, Error **errp)
+{
+ /* cache_line_size */
+ d->config[0x0C] = 0x08;
+ /* latency_timer */
+ d->config[0x0D] = 0x10;
+ /* capabilities_pointer */
+ d->config[0x34] = 0x00;
+
+ /*
+ * Set kMacRISCPCIAddressSelect (0x48) register to indicate PCI
+ * memory space with base 0x80000000, size 0x10000000 for Apple's
+ * AppleMacRiscPCI driver
+ */
+ d->config[0x48] = 0x0;
+ d->config[0x49] = 0x0;
+ d->config[0x4a] = 0x0;
+ d->config[0x4b] = 0x1;
+}
+
+static void unin_agp_pci_host_realize(PCIDevice *d, Error **errp)
+{
+ /* cache_line_size */
+ d->config[0x0C] = 0x08;
+ /* latency_timer */
+ d->config[0x0D] = 0x10;
+ /* capabilities_pointer
+ d->config[0x34] = 0x80; */
+}
+
+static void u3_agp_pci_host_realize(PCIDevice *d, Error **errp)
+{
+ /* cache line size */
+ d->config[0x0C] = 0x08;
+ /* latency timer */
+ d->config[0x0D] = 0x10;
+}
+
+static void unin_internal_pci_host_realize(PCIDevice *d, Error **errp)
+{
+ /* cache_line_size */
+ d->config[0x0C] = 0x08;
+ /* latency_timer */
+ d->config[0x0D] = 0x10;
+ /* capabilities_pointer */
+ d->config[0x34] = 0x00;
+}
+
+static void unin_main_pci_host_class_init(ObjectClass *klass, void *data)
+{
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ k->realize = unin_main_pci_host_realize;
+ k->vendor_id = PCI_VENDOR_ID_APPLE;
+ k->device_id = PCI_DEVICE_ID_APPLE_UNI_N_PCI;
+ k->revision = 0x00;
+ k->class_id = PCI_CLASS_BRIDGE_HOST;
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo unin_main_pci_host_info = {
+ .name = "uni-north-pci",
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(PCIDevice),
+ .class_init = unin_main_pci_host_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+static void u3_agp_pci_host_class_init(ObjectClass *klass, void *data)
+{
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ k->realize = u3_agp_pci_host_realize;
+ k->vendor_id = PCI_VENDOR_ID_APPLE;
+ k->device_id = PCI_DEVICE_ID_APPLE_U3_AGP;
+ k->revision = 0x00;
+ k->class_id = PCI_CLASS_BRIDGE_HOST;
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo u3_agp_pci_host_info = {
+ .name = "u3-agp",
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(PCIDevice),
+ .class_init = u3_agp_pci_host_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+static void unin_agp_pci_host_class_init(ObjectClass *klass, void *data)
+{
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ k->realize = unin_agp_pci_host_realize;
+ k->vendor_id = PCI_VENDOR_ID_APPLE;
+ k->device_id = PCI_DEVICE_ID_APPLE_UNI_N_AGP;
+ k->revision = 0x00;
+ k->class_id = PCI_CLASS_BRIDGE_HOST;
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo unin_agp_pci_host_info = {
+ .name = "uni-north-agp",
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(PCIDevice),
+ .class_init = unin_agp_pci_host_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+static void unin_internal_pci_host_class_init(ObjectClass *klass, void *data)
+{
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ k->realize = unin_internal_pci_host_realize;
+ k->vendor_id = PCI_VENDOR_ID_APPLE;
+ k->device_id = PCI_DEVICE_ID_APPLE_UNI_N_I_PCI;
+ k->revision = 0x00;
+ k->class_id = PCI_CLASS_BRIDGE_HOST;
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo unin_internal_pci_host_info = {
+ .name = "uni-north-internal-pci",
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(PCIDevice),
+ .class_init = unin_internal_pci_host_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+static Property pci_unin_main_pci_host_props[] = {
+ DEFINE_PROP_UINT32("ofw-addr", UNINHostState, ofw_addr, -1),
+ DEFINE_PROP_END_OF_LIST()
+};
+
+static void pci_unin_main_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ SysBusDeviceClass *sbc = SYS_BUS_DEVICE_CLASS(klass);
+
+ dc->realize = pci_unin_main_realize;
+ device_class_set_props(dc, pci_unin_main_pci_host_props);
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->fw_name = "pci";
+ sbc->explicit_ofw_unit_address = pci_unin_main_ofw_unit_address;
+}
+
+static const TypeInfo pci_unin_main_info = {
+ .name = TYPE_UNI_NORTH_PCI_HOST_BRIDGE,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(UNINHostState),
+ .instance_init = pci_unin_main_init,
+ .class_init = pci_unin_main_class_init,
+};
+
+static void pci_u3_agp_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ dc->realize = pci_u3_agp_realize;
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+}
+
+static const TypeInfo pci_u3_agp_info = {
+ .name = TYPE_U3_AGP_HOST_BRIDGE,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(UNINHostState),
+ .instance_init = pci_u3_agp_init,
+ .class_init = pci_u3_agp_class_init,
+};
+
+static void pci_unin_agp_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ dc->realize = pci_unin_agp_realize;
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+}
+
+static const TypeInfo pci_unin_agp_info = {
+ .name = TYPE_UNI_NORTH_AGP_HOST_BRIDGE,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(UNINHostState),
+ .instance_init = pci_unin_agp_init,
+ .class_init = pci_unin_agp_class_init,
+};
+
+static void pci_unin_internal_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ dc->realize = pci_unin_internal_realize;
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+}
+
+static const TypeInfo pci_unin_internal_info = {
+ .name = TYPE_UNI_NORTH_INTERNAL_PCI_HOST_BRIDGE,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(UNINHostState),
+ .instance_init = pci_unin_internal_init,
+ .class_init = pci_unin_internal_class_init,
+};
+
+/* UniN device */
+static void unin_write(void *opaque, hwaddr addr, uint64_t value,
+ unsigned size)
+{
+ trace_unin_write(addr, value);
+}
+
+static uint64_t unin_read(void *opaque, hwaddr addr, unsigned size)
+{
+ uint32_t value;
+
+ switch (addr) {
+ case 0:
+ value = UNINORTH_VERSION_10A;
+ break;
+ default:
+ value = 0;
+ }
+
+ trace_unin_read(addr, value);
+
+ return value;
+}
+
+static const MemoryRegionOps unin_ops = {
+ .read = unin_read,
+ .write = unin_write,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static void unin_init(Object *obj)
+{
+ UNINState *s = UNI_NORTH(obj);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+ memory_region_init_io(&s->mem, obj, &unin_ops, s, "unin", 0x1000);
+
+ sysbus_init_mmio(sbd, &s->mem);
+}
+
+static void unin_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+}
+
+static const TypeInfo unin_info = {
+ .name = TYPE_UNI_NORTH,
+ .parent = TYPE_SYS_BUS_DEVICE,
+ .instance_size = sizeof(UNINState),
+ .instance_init = unin_init,
+ .class_init = unin_class_init,
+};
+
+static void unin_register_types(void)
+{
+ type_register_static(&unin_main_pci_host_info);
+ type_register_static(&u3_agp_pci_host_info);
+ type_register_static(&unin_agp_pci_host_info);
+ type_register_static(&unin_internal_pci_host_info);
+
+ type_register_static(&pci_unin_main_info);
+ type_register_static(&pci_u3_agp_info);
+ type_register_static(&pci_unin_agp_info);
+ type_register_static(&pci_unin_internal_info);
+
+ type_register_static(&unin_info);
+}
+
+type_init(unin_register_types)
diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
new file mode 100644
index 000000000..f66384fa0
--- /dev/null
+++ b/hw/pci-host/versatile.c
@@ -0,0 +1,548 @@
+/*
+ * ARM Versatile/PB PCI host controller
+ *
+ * Copyright (c) 2006-2009 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licensed under the LGPL.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "hw/sysbus.h"
+#include "migration/vmstate.h"
+#include "hw/irq.h"
+#include "hw/pci/pci.h"
+#include "hw/pci/pci_bus.h"
+#include "hw/pci/pci_host.h"
+#include "hw/qdev-properties.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qom/object.h"
+
+/* Old and buggy versions of QEMU used the wrong mapping from
+ * PCI IRQs to system interrupt lines. Unfortunately the Linux
+ * kernel also had the corresponding bug in setting up interrupts
+ * (so older kernels work on QEMU and not on real hardware).
+ * We automatically detect these broken kernels and flip back
+ * to the broken irq mapping by spotting guest writes to the
+ * PCI_INTERRUPT_LINE register to see where the guest thinks
+ * interrupts are going to be routed. So we start in state
+ * ASSUME_OK on reset, and transition to either BROKEN or
+ * FORCE_OK at the first write to an INTERRUPT_LINE register for
+ * a slot where broken and correct interrupt mapping would differ.
+ * Once in either BROKEN or FORCE_OK we never transition again;
+ * this allows a newer kernel to use the INTERRUPT_LINE
+ * registers arbitrarily once it has indicated that it isn't
+ * broken in its init code somewhere.
+ *
+ * Unfortunately we have to cope with multiple different
+ * variants on the broken kernel behaviour:
+ * phase I (before kernel commit 1bc39ac5d) kernels assume old
+ * QEMU behaviour, so they use IRQ 27 for all slots
+ * phase II (1bc39ac5d and later, but before e3e92a7be6) kernels
+ * swizzle IRQs between slots, but do it wrongly, so they
+ * work only for every fourth PCI card, and only if (like old
+ * QEMU) the PCI host device is at slot 0 rather than where
+ * the h/w actually puts it
+ * phase III (e3e92a7be6 and later) kernels still swizzle IRQs between
+ * slots wrongly, but add a fixed offset of 64 to everything
+ * they write to PCI_INTERRUPT_LINE.
+ *
+ * We live in hope of a mythical phase IV kernel which might
+ * actually behave in ways that work on the hardware. Such a
+ * kernel should probably start off by writing some value neither
+ * 27 nor 91 to slot zero's PCI_INTERRUPT_LINE register to
+ * disable the autodetection. After that it can do what it likes.
+ *
+ * Slot % 4 | hw | I | II | III
+ * -------------------------------
+ * 0 | 29 | 27 | 27 | 91
+ * 1 | 30 | 27 | 28 | 92
+ * 2 | 27 | 27 | 29 | 93
+ * 3 | 28 | 27 | 30 | 94
+ *
+ * Since our autodetection is not perfect we also provide a
+ * property so the user can make us start in BROKEN or FORCE_OK
+ * on reset if they know they have a bad or good kernel.
+ */
+enum {
+ PCI_VPB_IRQMAP_ASSUME_OK,
+ PCI_VPB_IRQMAP_BROKEN,
+ PCI_VPB_IRQMAP_FORCE_OK,
+};
+
+struct PCIVPBState {
+ PCIHostState parent_obj;
+
+ qemu_irq irq[4];
+ MemoryRegion controlregs;
+ MemoryRegion mem_config;
+ MemoryRegion mem_config2;
+ /* Containers representing the PCI address spaces */
+ MemoryRegion pci_io_space;
+ MemoryRegion pci_mem_space;
+ /* Alias regions into PCI address spaces which we expose as sysbus regions.
+ * The offsets into pci_mem_space are controlled by the imap registers.
+ */
+ MemoryRegion pci_io_window;
+ MemoryRegion pci_mem_window[3];
+ PCIBus pci_bus;
+ PCIDevice pci_dev;
+
+ /* Constant for life of device: */
+ int realview;
+ uint32_t mem_win_size[3];
+ uint8_t irq_mapping_prop;
+
+ /* Variable state: */
+ uint32_t imap[3];
+ uint32_t smap[3];
+ uint32_t selfid;
+ uint32_t flags;
+ uint8_t irq_mapping;
+};
+typedef struct PCIVPBState PCIVPBState;
+
+static void pci_vpb_update_window(PCIVPBState *s, int i)
+{
+ /* Adjust the offset of the alias region we use for
+ * the memory window i to account for a change in the
+ * value of the corresponding IMAP register.
+ * Note that the semantics of the IMAP register differ
+ * for realview and versatile variants of the controller.
+ */
+ hwaddr offset;
+ if (s->realview) {
+ /* Top bits of register (masked according to window size) provide
+ * top bits of PCI address.
+ */
+ offset = s->imap[i] & ~(s->mem_win_size[i] - 1);
+ } else {
+ /* Bottom 4 bits of register provide top 4 bits of PCI address */
+ offset = s->imap[i] << 28;
+ }
+ memory_region_set_alias_offset(&s->pci_mem_window[i], offset);
+}
+
+static void pci_vpb_update_all_windows(PCIVPBState *s)
+{
+ /* Update all alias windows based on the current register state */
+ int i;
+
+ for (i = 0; i < 3; i++) {
+ pci_vpb_update_window(s, i);
+ }
+}
+
+static int pci_vpb_post_load(void *opaque, int version_id)
+{
+ PCIVPBState *s = opaque;
+ pci_vpb_update_all_windows(s);
+ return 0;
+}
+
+static const VMStateDescription pci_vpb_vmstate = {
+ .name = "versatile-pci",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .post_load = pci_vpb_post_load,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT32_ARRAY(imap, PCIVPBState, 3),
+ VMSTATE_UINT32_ARRAY(smap, PCIVPBState, 3),
+ VMSTATE_UINT32(selfid, PCIVPBState),
+ VMSTATE_UINT32(flags, PCIVPBState),
+ VMSTATE_UINT8(irq_mapping, PCIVPBState),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+#define TYPE_VERSATILE_PCI "versatile_pci"
+DECLARE_INSTANCE_CHECKER(PCIVPBState, PCI_VPB,
+ TYPE_VERSATILE_PCI)
+
+#define TYPE_VERSATILE_PCI_HOST "versatile_pci_host"
+DECLARE_INSTANCE_CHECKER(PCIDevice, PCI_VPB_HOST,
+ TYPE_VERSATILE_PCI_HOST)
+
+typedef enum {
+ PCI_IMAP0 = 0x0,
+ PCI_IMAP1 = 0x4,
+ PCI_IMAP2 = 0x8,
+ PCI_SELFID = 0xc,
+ PCI_FLAGS = 0x10,
+ PCI_SMAP0 = 0x14,
+ PCI_SMAP1 = 0x18,
+ PCI_SMAP2 = 0x1c,
+} PCIVPBControlRegs;
+
+static void pci_vpb_reg_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PCIVPBState *s = opaque;
+
+ switch (addr) {
+ case PCI_IMAP0:
+ case PCI_IMAP1:
+ case PCI_IMAP2:
+ {
+ int win = (addr - PCI_IMAP0) >> 2;
+ s->imap[win] = val;
+ pci_vpb_update_window(s, win);
+ break;
+ }
+ case PCI_SELFID:
+ s->selfid = val;
+ break;
+ case PCI_FLAGS:
+ s->flags = val;
+ break;
+ case PCI_SMAP0:
+ case PCI_SMAP1:
+ case PCI_SMAP2:
+ {
+ int win = (addr - PCI_SMAP0) >> 2;
+ s->smap[win] = val;
+ break;
+ }
+ default:
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "pci_vpb_reg_write: Bad offset %x\n", (int)addr);
+ break;
+ }
+}
+
+static uint64_t pci_vpb_reg_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PCIVPBState *s = opaque;
+
+ switch (addr) {
+ case PCI_IMAP0:
+ case PCI_IMAP1:
+ case PCI_IMAP2:
+ {
+ int win = (addr - PCI_IMAP0) >> 2;
+ return s->imap[win];
+ }
+ case PCI_SELFID:
+ return s->selfid;
+ case PCI_FLAGS:
+ return s->flags;
+ case PCI_SMAP0:
+ case PCI_SMAP1:
+ case PCI_SMAP2:
+ {
+ int win = (addr - PCI_SMAP0) >> 2;
+ return s->smap[win];
+ }
+ default:
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "pci_vpb_reg_read: Bad offset %x\n", (int)addr);
+ return 0;
+ }
+}
+
+static const MemoryRegionOps pci_vpb_reg_ops = {
+ .read = pci_vpb_reg_read,
+ .write = pci_vpb_reg_write,
+ .endianness = DEVICE_NATIVE_ENDIAN,
+ .valid = {
+ .min_access_size = 4,
+ .max_access_size = 4,
+ },
+};
+
+static int pci_vpb_broken_irq(int slot, int irq)
+{
+ /* Determine whether this IRQ value for this slot represents a
+ * known broken Linux kernel behaviour for this slot.
+ * Return one of the PCI_VPB_IRQMAP_ constants:
+ * BROKEN : if this definitely looks like a broken kernel
+ * FORCE_OK : if this definitely looks good
+ * ASSUME_OK : if we can't tell
+ */
+ slot %= PCI_NUM_PINS;
+
+ if (irq == 27) {
+ if (slot == 2) {
+ /* Might be a Phase I kernel, or might be a fixed kernel,
+ * since slot 2 is where we expect this IRQ.
+ */
+ return PCI_VPB_IRQMAP_ASSUME_OK;
+ }
+ /* Phase I kernel */
+ return PCI_VPB_IRQMAP_BROKEN;
+ }
+ if (irq == slot + 27) {
+ /* Phase II kernel */
+ return PCI_VPB_IRQMAP_BROKEN;
+ }
+ if (irq == slot + 27 + 64) {
+ /* Phase III kernel */
+ return PCI_VPB_IRQMAP_BROKEN;
+ }
+ /* Anything else must be a fixed kernel, possibly using an
+ * arbitrary irq map.
+ */
+ return PCI_VPB_IRQMAP_FORCE_OK;
+}
+
+static void pci_vpb_config_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PCIVPBState *s = opaque;
+ if (!s->realview && (addr & 0xff) == PCI_INTERRUPT_LINE
+ && s->irq_mapping == PCI_VPB_IRQMAP_ASSUME_OK) {
+ uint8_t devfn = addr >> 8;
+ s->irq_mapping = pci_vpb_broken_irq(PCI_SLOT(devfn), val);
+ }
+ pci_data_write(&s->pci_bus, addr, val, size);
+}
+
+static uint64_t pci_vpb_config_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PCIVPBState *s = opaque;
+ uint32_t val;
+ val = pci_data_read(&s->pci_bus, addr, size);
+ return val;
+}
+
+static const MemoryRegionOps pci_vpb_config_ops = {
+ .read = pci_vpb_config_read,
+ .write = pci_vpb_config_write,
+ .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static int pci_vpb_map_irq(PCIDevice *d, int irq_num)
+{
+ PCIVPBState *s = container_of(pci_get_bus(d), PCIVPBState, pci_bus);
+
+ if (s->irq_mapping == PCI_VPB_IRQMAP_BROKEN) {
+ /* Legacy broken IRQ mapping for compatibility with old and
+ * buggy Linux guests
+ */
+ return irq_num;
+ }
+
+ /* Slot to IRQ mapping for RealView Platform Baseboard 926 backplane
+ * name slot IntA IntB IntC IntD
+ * A 31 IRQ28 IRQ29 IRQ30 IRQ27
+ * B 30 IRQ27 IRQ28 IRQ29 IRQ30
+ * C 29 IRQ30 IRQ27 IRQ28 IRQ29
+ * Slot C is for the host bridge; A and B the peripherals.
+ * Our output irqs 0..3 correspond to the baseboard's 27..30.
+ *
+ * This mapping function takes account of an oddity in the PB926
+ * board wiring, where the FPGA's P_nINTA input is connected to
+ * the INTB connection on the board PCI edge connector, P_nINTB
+ * is connected to INTC, and so on, so everything is one number
+ * further round from where you might expect.
+ */
+ return pci_swizzle_map_irq_fn(d, irq_num + 2);
+}
+
+static int pci_vpb_rv_map_irq(PCIDevice *d, int irq_num)
+{
+ /* Slot to IRQ mapping for RealView EB and PB1176 backplane
+ * name slot IntA IntB IntC IntD
+ * A 31 IRQ50 IRQ51 IRQ48 IRQ49
+ * B 30 IRQ49 IRQ50 IRQ51 IRQ48
+ * C 29 IRQ48 IRQ49 IRQ50 IRQ51
+ * Slot C is for the host bridge; A and B the peripherals.
+ * Our output irqs 0..3 correspond to the baseboard's 48..51.
+ *
+ * The PB1176 and EB boards don't have the PB926 wiring oddity
+ * described above; P_nINTA connects to INTA, P_nINTB to INTB
+ * and so on, which is why this mapping function is different.
+ */
+ return pci_swizzle_map_irq_fn(d, irq_num + 3);
+}
+
+static void pci_vpb_set_irq(void *opaque, int irq_num, int level)
+{
+ qemu_irq *pic = opaque;
+
+ qemu_set_irq(pic[irq_num], level);
+}
+
+static void pci_vpb_reset(DeviceState *d)
+{
+ PCIVPBState *s = PCI_VPB(d);
+
+ s->imap[0] = 0;
+ s->imap[1] = 0;
+ s->imap[2] = 0;
+ s->smap[0] = 0;
+ s->smap[1] = 0;
+ s->smap[2] = 0;
+ s->selfid = 0;
+ s->flags = 0;
+ s->irq_mapping = s->irq_mapping_prop;
+
+ pci_vpb_update_all_windows(s);
+}
+
+static void pci_vpb_init(Object *obj)
+{
+ PCIVPBState *s = PCI_VPB(obj);
+
+ /* Window sizes for VersatilePB; realview_pci's init will override */
+ s->mem_win_size[0] = 0x0c000000;
+ s->mem_win_size[1] = 0x10000000;
+ s->mem_win_size[2] = 0x10000000;
+}
+
+static void pci_vpb_realize(DeviceState *dev, Error **errp)
+{
+ PCIVPBState *s = PCI_VPB(dev);
+ PCIHostState *h = PCI_HOST_BRIDGE(dev);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+ pci_map_irq_fn mapfn;
+ int i;
+
+ memory_region_init(&s->pci_io_space, OBJECT(s), "pci_io", 4 * GiB);
+ memory_region_init(&s->pci_mem_space, OBJECT(s), "pci_mem", 4 * GiB);
+
+ pci_root_bus_init(&s->pci_bus, sizeof(s->pci_bus), dev, "pci",
+ &s->pci_mem_space, &s->pci_io_space,
+ PCI_DEVFN(11, 0), TYPE_PCI_BUS);
+ h->bus = &s->pci_bus;
+
+ object_initialize(&s->pci_dev, sizeof(s->pci_dev), TYPE_VERSATILE_PCI_HOST);
+
+ for (i = 0; i < 4; i++) {
+ sysbus_init_irq(sbd, &s->irq[i]);
+ }
+
+ if (s->realview) {
+ mapfn = pci_vpb_rv_map_irq;
+ } else {
+ mapfn = pci_vpb_map_irq;
+ }
+
+ pci_bus_irqs(&s->pci_bus, pci_vpb_set_irq, mapfn, s->irq, 4);
+
+ /* Our memory regions are:
+ * 0 : our control registers
+ * 1 : PCI self config window
+ * 2 : PCI config window
+ * 3 : PCI IO window
+ * 4..6 : PCI memory windows
+ */
+ memory_region_init_io(&s->controlregs, OBJECT(s), &pci_vpb_reg_ops, s,
+ "pci-vpb-regs", 0x1000);
+ sysbus_init_mmio(sbd, &s->controlregs);
+ memory_region_init_io(&s->mem_config, OBJECT(s), &pci_vpb_config_ops, s,
+ "pci-vpb-selfconfig", 0x1000000);
+ sysbus_init_mmio(sbd, &s->mem_config);
+ memory_region_init_io(&s->mem_config2, OBJECT(s), &pci_vpb_config_ops, s,
+ "pci-vpb-config", 0x1000000);
+ sysbus_init_mmio(sbd, &s->mem_config2);
+
+ /* The window into I/O space is always into a fixed base address;
+ * its size is the same for both realview and versatile.
+ */
+ memory_region_init_alias(&s->pci_io_window, OBJECT(s), "pci-vbp-io-window",
+ &s->pci_io_space, 0, 0x100000);
+
+ sysbus_init_mmio(sbd, &s->pci_io_space);
+
+ /* Create the alias regions corresponding to our three windows onto
+ * PCI memory space. The sizes vary from board to board; the base
+ * offsets are guest controllable via the IMAP registers.
+ */
+ for (i = 0; i < 3; i++) {
+ memory_region_init_alias(&s->pci_mem_window[i], OBJECT(s), "pci-vbp-window",
+ &s->pci_mem_space, 0, s->mem_win_size[i]);
+ sysbus_init_mmio(sbd, &s->pci_mem_window[i]);
+ }
+
+ /* TODO Remove once realize propagates to child devices. */
+ qdev_realize(DEVICE(&s->pci_dev), BUS(&s->pci_bus), errp);
+}
+
+static void versatile_pci_host_realize(PCIDevice *d, Error **errp)
+{
+ pci_set_word(d->config + PCI_STATUS,
+ PCI_STATUS_66MHZ | PCI_STATUS_DEVSEL_MEDIUM);
+ pci_set_byte(d->config + PCI_LATENCY_TIMER, 0x10);
+}
+
+static void versatile_pci_host_class_init(ObjectClass *klass, void *data)
+{
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ k->realize = versatile_pci_host_realize;
+ k->vendor_id = PCI_VENDOR_ID_XILINX;
+ k->device_id = PCI_DEVICE_ID_XILINX_XC2VP30;
+ k->class_id = PCI_CLASS_PROCESSOR_CO;
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo versatile_pci_host_info = {
+ .name = TYPE_VERSATILE_PCI_HOST,
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(PCIDevice),
+ .class_init = versatile_pci_host_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+ { },
+ },
+};
+
+static Property pci_vpb_properties[] = {
+ DEFINE_PROP_UINT8("broken-irq-mapping", PCIVPBState, irq_mapping_prop,
+ PCI_VPB_IRQMAP_ASSUME_OK),
+ DEFINE_PROP_END_OF_LIST()
+};
+
+static void pci_vpb_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ dc->realize = pci_vpb_realize;
+ dc->reset = pci_vpb_reset;
+ dc->vmsd = &pci_vpb_vmstate;
+ device_class_set_props(dc, pci_vpb_properties);
+}
+
+static const TypeInfo pci_vpb_info = {
+ .name = TYPE_VERSATILE_PCI,
+ .parent = TYPE_PCI_HOST_BRIDGE,
+ .instance_size = sizeof(PCIVPBState),
+ .instance_init = pci_vpb_init,
+ .class_init = pci_vpb_class_init,
+};
+
+static void pci_realview_init(Object *obj)
+{
+ PCIVPBState *s = PCI_VPB(obj);
+
+ s->realview = 1;
+ /* The PCI window sizes are different on Realview boards */
+ s->mem_win_size[0] = 0x01000000;
+ s->mem_win_size[1] = 0x04000000;
+ s->mem_win_size[2] = 0x08000000;
+}
+
+static const TypeInfo pci_realview_info = {
+ .name = "realview_pci",
+ .parent = TYPE_VERSATILE_PCI,
+ .instance_init = pci_realview_init,
+};
+
+static void versatile_pci_register_types(void)
+{
+ type_register_static(&pci_vpb_info);
+ type_register_static(&pci_realview_info);
+ type_register_static(&versatile_pci_host_info);
+}
+
+type_init(versatile_pci_register_types)
diff --git a/hw/pci-host/xen_igd_pt.c b/hw/pci-host/xen_igd_pt.c
new file mode 100644
index 000000000..d094b675d
--- /dev/null
+++ b/hw/pci-host/xen_igd_pt.c
@@ -0,0 +1,119 @@
+/*
+ * QEMU Intel IGD Passthrough Host Bridge Emulation
+ *
+ * Copyright (c) 2006 Fabrice Bellard
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/pci/pci.h"
+#include "hw/pci/pci_host.h"
+#include "hw/pci-host/i440fx.h"
+#include "qapi/error.h"
+
+typedef struct {
+ uint8_t offset;
+ uint8_t len;
+} IGDHostInfo;
+
+/* Here we just expose minimal host bridge offset subset. */
+static const IGDHostInfo igd_host_bridge_infos[] = {
+ {PCI_REVISION_ID, 2},
+ {PCI_SUBSYSTEM_VENDOR_ID, 2},
+ {PCI_SUBSYSTEM_ID, 2},
+ {0x50, 2}, /* SNB: processor graphics control register */
+ {0x52, 2}, /* processor graphics control register */
+ {0xa4, 4}, /* SNB: graphics base of stolen memory */
+ {0xa8, 4}, /* SNB: base of GTT stolen memory */
+};
+
+static void host_pci_config_read(int pos, int len, uint32_t *val, Error **errp)
+{
+ int rc, config_fd;
+ /* Access real host bridge. */
+ char *path = g_strdup_printf("/sys/bus/pci/devices/%04x:%02x:%02x.%d/%s",
+ 0, 0, 0, 0, "config");
+
+ config_fd = open(path, O_RDWR);
+ if (config_fd < 0) {
+ error_setg_errno(errp, errno, "Failed to open: %s", path);
+ goto out;
+ }
+
+ if (lseek(config_fd, pos, SEEK_SET) != pos) {
+ error_setg_errno(errp, errno, "Failed to seek: %s", path);
+ goto out_close_fd;
+ }
+
+ do {
+ rc = read(config_fd, (uint8_t *)val, len);
+ } while (rc < 0 && (errno == EINTR || errno == EAGAIN));
+ if (rc != len) {
+ error_setg_errno(errp, errno, "Failed to read: %s", path);
+ }
+
+ out_close_fd:
+ close(config_fd);
+ out:
+ g_free(path);
+}
+
+static void igd_pt_i440fx_realize(PCIDevice *pci_dev, Error **errp)
+{
+ ERRP_GUARD();
+ uint32_t val = 0;
+ size_t i;
+ int pos, len;
+
+ for (i = 0; i < ARRAY_SIZE(igd_host_bridge_infos); i++) {
+ pos = igd_host_bridge_infos[i].offset;
+ len = igd_host_bridge_infos[i].len;
+ host_pci_config_read(pos, len, &val, errp);
+ if (*errp) {
+ return;
+ }
+ pci_default_write_config(pci_dev, pos, val, len);
+ }
+}
+
+static void igd_passthrough_i440fx_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+ k->realize = igd_pt_i440fx_realize;
+ dc->desc = "IGD Passthrough Host bridge";
+}
+
+static const TypeInfo igd_passthrough_i440fx_info = {
+ .name = TYPE_IGD_PASSTHROUGH_I440FX_PCI_DEVICE,
+ .parent = TYPE_I440FX_PCI_DEVICE,
+ .instance_size = sizeof(PCII440FXState),
+ .class_init = igd_passthrough_i440fx_class_init,
+};
+
+static void igd_pt_i440fx_register_types(void)
+{
+ type_register_static(&igd_passthrough_i440fx_info);
+}
+
+type_init(igd_pt_i440fx_register_types)
diff --git a/hw/pci-host/xilinx-pcie.c b/hw/pci-host/xilinx-pcie.c
new file mode 100644
index 000000000..38d5901a4
--- /dev/null
+++ b/hw/pci-host/xilinx-pcie.c
@@ -0,0 +1,331 @@
+/*
+ * Xilinx PCIe host controller emulation.
+ *
+ * Copyright (c) 2016 Imagination Technologies
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/module.h"
+#include "qemu/units.h"
+#include "qapi/error.h"
+#include "hw/pci/pci_bridge.h"
+#include "hw/qdev-properties.h"
+#include "hw/irq.h"
+#include "hw/pci-host/xilinx-pcie.h"
+
+enum root_cfg_reg {
+ /* Interrupt Decode Register */
+ ROOTCFG_INTDEC = 0x138,
+
+ /* Interrupt Mask Register */
+ ROOTCFG_INTMASK = 0x13c,
+ /* INTx Interrupt Received */
+#define ROOTCFG_INTMASK_INTX (1 << 16)
+ /* MSI Interrupt Received */
+#define ROOTCFG_INTMASK_MSI (1 << 17)
+
+ /* PHY Status/Control Register */
+ ROOTCFG_PSCR = 0x144,
+ /* Link Up */
+#define ROOTCFG_PSCR_LINK_UP (1 << 11)
+
+ /* Root Port Status/Control Register */
+ ROOTCFG_RPSCR = 0x148,
+ /* Bridge Enable */
+#define ROOTCFG_RPSCR_BRIDGEEN (1 << 0)
+ /* Interrupt FIFO Not Empty */
+#define ROOTCFG_RPSCR_INTNEMPTY (1 << 18)
+ /* Interrupt FIFO Overflow */
+#define ROOTCFG_RPSCR_INTOVF (1 << 19)
+
+ /* Root Port Interrupt FIFO Read Register 1 */
+ ROOTCFG_RPIFR1 = 0x158,
+#define ROOTCFG_RPIFR1_INT_LANE_SHIFT 27
+#define ROOTCFG_RPIFR1_INT_ASSERT_SHIFT 29
+#define ROOTCFG_RPIFR1_INT_VALID_SHIFT 31
+ /* Root Port Interrupt FIFO Read Register 2 */
+ ROOTCFG_RPIFR2 = 0x15c,
+};
+
+static void xilinx_pcie_update_intr(XilinxPCIEHost *s,
+ uint32_t set, uint32_t clear)
+{
+ int level;
+
+ s->intr |= set;
+ s->intr &= ~clear;
+
+ if (s->intr_fifo_r != s->intr_fifo_w) {
+ s->intr |= ROOTCFG_INTMASK_INTX;
+ }
+
+ level = !!(s->intr & s->intr_mask);
+ qemu_set_irq(s->irq, level);
+}
+
+static void xilinx_pcie_queue_intr(XilinxPCIEHost *s,
+ uint32_t fifo_reg1, uint32_t fifo_reg2)
+{
+ XilinxPCIEInt *intr;
+ unsigned int new_w;
+
+ new_w = (s->intr_fifo_w + 1) % ARRAY_SIZE(s->intr_fifo);
+ if (new_w == s->intr_fifo_r) {
+ s->rpscr |= ROOTCFG_RPSCR_INTOVF;
+ return;
+ }
+
+ intr = &s->intr_fifo[s->intr_fifo_w];
+ s->intr_fifo_w = new_w;
+
+ intr->fifo_reg1 = fifo_reg1;
+ intr->fifo_reg2 = fifo_reg2;
+
+ xilinx_pcie_update_intr(s, ROOTCFG_INTMASK_INTX, 0);
+}
+
+static void xilinx_pcie_set_irq(void *opaque, int irq_num, int level)
+{
+ XilinxPCIEHost *s = XILINX_PCIE_HOST(opaque);
+
+ xilinx_pcie_queue_intr(s,
+ (irq_num << ROOTCFG_RPIFR1_INT_LANE_SHIFT) |
+ (level << ROOTCFG_RPIFR1_INT_ASSERT_SHIFT) |
+ (1 << ROOTCFG_RPIFR1_INT_VALID_SHIFT),
+ 0);
+}
+
+static void xilinx_pcie_host_realize(DeviceState *dev, Error **errp)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+ XilinxPCIEHost *s = XILINX_PCIE_HOST(dev);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+ PCIExpressHost *pex = PCIE_HOST_BRIDGE(dev);
+
+ snprintf(s->name, sizeof(s->name), "pcie%u", s->bus_nr);
+
+ /* PCI configuration space */
+ pcie_host_mmcfg_init(pex, s->cfg_size);
+
+ /* MMIO region */
+ memory_region_init(&s->mmio, OBJECT(s), "mmio", UINT64_MAX);
+ memory_region_set_enabled(&s->mmio, false);
+
+ /* dummy PCI I/O region (not visible to the CPU) */
+ memory_region_init(&s->io, OBJECT(s), "io", 16);
+
+ /* interrupt out */
+ qdev_init_gpio_out_named(dev, &s->irq, "interrupt_out", 1);
+
+ sysbus_init_mmio(sbd, &pex->mmio);
+ sysbus_init_mmio(sbd, &s->mmio);
+
+ pci->bus = pci_register_root_bus(dev, s->name, xilinx_pcie_set_irq,
+ pci_swizzle_map_irq_fn, s, &s->mmio,
+ &s->io, 0, 4, TYPE_PCIE_BUS);
+
+ qdev_realize(DEVICE(&s->root), BUS(pci->bus), &error_fatal);
+}
+
+static const char *xilinx_pcie_host_root_bus_path(PCIHostState *host_bridge,
+ PCIBus *rootbus)
+{
+ return "0000:00";
+}
+
+static void xilinx_pcie_host_init(Object *obj)
+{
+ XilinxPCIEHost *s = XILINX_PCIE_HOST(obj);
+ XilinxPCIERoot *root = &s->root;
+
+ object_initialize_child(obj, "root", root, TYPE_XILINX_PCIE_ROOT);
+ qdev_prop_set_int32(DEVICE(root), "addr", PCI_DEVFN(0, 0));
+ qdev_prop_set_bit(DEVICE(root), "multifunction", false);
+}
+
+static Property xilinx_pcie_host_props[] = {
+ DEFINE_PROP_UINT32("bus_nr", XilinxPCIEHost, bus_nr, 0),
+ DEFINE_PROP_SIZE("cfg_base", XilinxPCIEHost, cfg_base, 0),
+ DEFINE_PROP_SIZE("cfg_size", XilinxPCIEHost, cfg_size, 32 * MiB),
+ DEFINE_PROP_SIZE("mmio_base", XilinxPCIEHost, mmio_base, 0),
+ DEFINE_PROP_SIZE("mmio_size", XilinxPCIEHost, mmio_size, 1 * MiB),
+ DEFINE_PROP_BOOL("link_up", XilinxPCIEHost, link_up, true),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void xilinx_pcie_host_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
+
+ hc->root_bus_path = xilinx_pcie_host_root_bus_path;
+ dc->realize = xilinx_pcie_host_realize;
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->fw_name = "pci";
+ device_class_set_props(dc, xilinx_pcie_host_props);
+}
+
+static const TypeInfo xilinx_pcie_host_info = {
+ .name = TYPE_XILINX_PCIE_HOST,
+ .parent = TYPE_PCIE_HOST_BRIDGE,
+ .instance_size = sizeof(XilinxPCIEHost),
+ .instance_init = xilinx_pcie_host_init,
+ .class_init = xilinx_pcie_host_class_init,
+};
+
+static uint32_t xilinx_pcie_root_config_read(PCIDevice *d,
+ uint32_t address, int len)
+{
+ XilinxPCIEHost *s = XILINX_PCIE_HOST(OBJECT(d)->parent);
+ uint32_t val;
+
+ switch (address) {
+ case ROOTCFG_INTDEC:
+ val = s->intr;
+ break;
+ case ROOTCFG_INTMASK:
+ val = s->intr_mask;
+ break;
+ case ROOTCFG_PSCR:
+ val = s->link_up ? ROOTCFG_PSCR_LINK_UP : 0;
+ break;
+ case ROOTCFG_RPSCR:
+ if (s->intr_fifo_r != s->intr_fifo_w) {
+ s->rpscr &= ~ROOTCFG_RPSCR_INTNEMPTY;
+ } else {
+ s->rpscr |= ROOTCFG_RPSCR_INTNEMPTY;
+ }
+ val = s->rpscr;
+ break;
+ case ROOTCFG_RPIFR1:
+ if (s->intr_fifo_w == s->intr_fifo_r) {
+ /* FIFO empty */
+ val = 0;
+ } else {
+ val = s->intr_fifo[s->intr_fifo_r].fifo_reg1;
+ }
+ break;
+ case ROOTCFG_RPIFR2:
+ if (s->intr_fifo_w == s->intr_fifo_r) {
+ /* FIFO empty */
+ val = 0;
+ } else {
+ val = s->intr_fifo[s->intr_fifo_r].fifo_reg2;
+ }
+ break;
+ default:
+ val = pci_default_read_config(d, address, len);
+ break;
+ }
+ return val;
+}
+
+static void xilinx_pcie_root_config_write(PCIDevice *d, uint32_t address,
+ uint32_t val, int len)
+{
+ XilinxPCIEHost *s = XILINX_PCIE_HOST(OBJECT(d)->parent);
+ switch (address) {
+ case ROOTCFG_INTDEC:
+ xilinx_pcie_update_intr(s, 0, val);
+ break;
+ case ROOTCFG_INTMASK:
+ s->intr_mask = val;
+ xilinx_pcie_update_intr(s, 0, 0);
+ break;
+ case ROOTCFG_RPSCR:
+ s->rpscr &= ~ROOTCFG_RPSCR_BRIDGEEN;
+ s->rpscr |= val & ROOTCFG_RPSCR_BRIDGEEN;
+ memory_region_set_enabled(&s->mmio, val & ROOTCFG_RPSCR_BRIDGEEN);
+
+ if (val & ROOTCFG_INTMASK_INTX) {
+ s->rpscr &= ~ROOTCFG_INTMASK_INTX;
+ }
+ break;
+ case ROOTCFG_RPIFR1:
+ case ROOTCFG_RPIFR2:
+ if (s->intr_fifo_w == s->intr_fifo_r) {
+ /* FIFO empty */
+ return;
+ } else {
+ s->intr_fifo_r = (s->intr_fifo_r + 1) % ARRAY_SIZE(s->intr_fifo);
+ }
+ break;
+ default:
+ pci_default_write_config(d, address, val, len);
+ break;
+ }
+}
+
+static void xilinx_pcie_root_realize(PCIDevice *pci_dev, Error **errp)
+{
+ BusState *bus = qdev_get_parent_bus(DEVICE(pci_dev));
+ XilinxPCIEHost *s = XILINX_PCIE_HOST(bus->parent);
+
+ pci_set_word(pci_dev->config + PCI_COMMAND,
+ PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
+ pci_set_word(pci_dev->config + PCI_MEMORY_BASE, s->mmio_base >> 16);
+ pci_set_word(pci_dev->config + PCI_MEMORY_LIMIT,
+ ((s->mmio_base + s->mmio_size - 1) >> 16) & 0xfff0);
+
+ pci_bridge_initfn(pci_dev, TYPE_PCI_BUS);
+
+ if (pcie_endpoint_cap_v1_init(pci_dev, 0x80) < 0) {
+ error_setg(errp, "Failed to initialize PCIe capability");
+ }
+}
+
+static void xilinx_pcie_root_class_init(ObjectClass *klass, void *data)
+{
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->desc = "Xilinx AXI-PCIe Host Bridge";
+ k->vendor_id = PCI_VENDOR_ID_XILINX;
+ k->device_id = 0x7021;
+ k->revision = 0;
+ k->class_id = PCI_CLASS_BRIDGE_HOST;
+ k->is_bridge = true;
+ k->realize = xilinx_pcie_root_realize;
+ k->exit = pci_bridge_exitfn;
+ dc->reset = pci_bridge_reset;
+ k->config_read = xilinx_pcie_root_config_read;
+ k->config_write = xilinx_pcie_root_config_write;
+ /*
+ * PCI-facing part of the host bridge, not usable without the
+ * host-facing part, which can't be device_add'ed, yet.
+ */
+ dc->user_creatable = false;
+}
+
+static const TypeInfo xilinx_pcie_root_info = {
+ .name = TYPE_XILINX_PCIE_ROOT,
+ .parent = TYPE_PCI_BRIDGE,
+ .instance_size = sizeof(XilinxPCIERoot),
+ .class_init = xilinx_pcie_root_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_PCIE_DEVICE },
+ { }
+ },
+};
+
+static void xilinx_pcie_register(void)
+{
+ type_register_static(&xilinx_pcie_root_info);
+ type_register_static(&xilinx_pcie_host_info);
+}
+
+type_init(xilinx_pcie_register)