1 /* 2 * QEMU PowerPC PowerNV LPC controller 3 * 4 * Copyright (c) 2016, IBM Corporation. 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2.1 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 */ 19 20 #include "qemu/osdep.h" 21 #include "target/ppc/cpu.h" 22 #include "qapi/error.h" 23 #include "qemu/log.h" 24 #include "qemu/module.h" 25 #include "hw/irq.h" 26 #include "hw/isa/isa.h" 27 #include "hw/qdev-properties.h" 28 #include "hw/ppc/pnv.h" 29 #include "hw/ppc/pnv_chip.h" 30 #include "hw/ppc/pnv_lpc.h" 31 #include "hw/ppc/pnv_xscom.h" 32 #include "hw/ppc/fdt.h" 33 34 #include <libfdt.h> 35 36 enum { 37 ECCB_CTL = 0, 38 ECCB_RESET = 1, 39 ECCB_STAT = 2, 40 ECCB_DATA = 3, 41 }; 42 43 /* OPB Master LS registers */ 44 #define OPB_MASTER_LS_ROUTE0 0x8 45 #define OPB_MASTER_LS_ROUTE1 0xC 46 #define OPB_MASTER_LS_IRQ_STAT 0x50 47 #define OPB_MASTER_IRQ_LPC 0x00000800 48 #define OPB_MASTER_LS_IRQ_MASK 0x54 49 #define OPB_MASTER_LS_IRQ_POL 0x58 50 #define OPB_MASTER_LS_IRQ_INPUT 0x5c 51 52 /* LPC HC registers */ 53 #define LPC_HC_FW_SEG_IDSEL 0x24 54 #define LPC_HC_FW_RD_ACC_SIZE 0x28 55 #define LPC_HC_FW_RD_1B 0x00000000 56 #define LPC_HC_FW_RD_2B 0x01000000 57 #define LPC_HC_FW_RD_4B 0x02000000 58 #define LPC_HC_FW_RD_16B 0x04000000 59 #define LPC_HC_FW_RD_128B 0x07000000 60 #define LPC_HC_IRQSER_CTRL 0x30 61 #define LPC_HC_IRQSER_EN 0x80000000 62 #define LPC_HC_IRQSER_QMODE 0x40000000 63 #define LPC_HC_IRQSER_START_MASK 0x03000000 64 #define LPC_HC_IRQSER_START_4CLK 0x00000000 65 #define LPC_HC_IRQSER_START_6CLK 0x01000000 66 #define LPC_HC_IRQSER_START_8CLK 0x02000000 67 #define LPC_HC_IRQSER_AUTO_CLEAR 0x00800000 68 #define LPC_HC_IRQMASK 0x34 /* same bit defs as LPC_HC_IRQSTAT */ 69 #define LPC_HC_IRQSTAT 0x38 70 #define LPC_HC_IRQ_SERIRQ0 0x80000000 /* all bits down to ... */ 71 #define LPC_HC_IRQ_SERIRQ16 0x00008000 /* IRQ16=IOCHK#, IRQ2=SMI# */ 72 #define LPC_HC_IRQ_SERIRQ_ALL 0xffff8000 73 #define LPC_HC_IRQ_LRESET 0x00000400 74 #define LPC_HC_IRQ_SYNC_ABNORM_ERR 0x00000080 75 #define LPC_HC_IRQ_SYNC_NORESP_ERR 0x00000040 76 #define LPC_HC_IRQ_SYNC_NORM_ERR 0x00000020 77 #define LPC_HC_IRQ_SYNC_TIMEOUT_ERR 0x00000010 78 #define LPC_HC_IRQ_SYNC_TARG_TAR_ERR 0x00000008 79 #define LPC_HC_IRQ_SYNC_BM_TAR_ERR 0x00000004 80 #define LPC_HC_IRQ_SYNC_BM0_REQ 0x00000002 81 #define LPC_HC_IRQ_SYNC_BM1_REQ 0x00000001 82 #define LPC_HC_ERROR_ADDRESS 0x40 83 84 #define LPC_OPB_SIZE 0x100000000ull 85 86 #define ISA_IO_SIZE 0x00010000 87 #define ISA_MEM_SIZE 0x10000000 88 #define ISA_FW_SIZE 0x10000000 89 #define LPC_IO_OPB_ADDR 0xd0010000 90 #define LPC_IO_OPB_SIZE 0x00010000 91 #define LPC_MEM_OPB_ADDR 0xe0000000 92 #define LPC_MEM_OPB_SIZE 0x10000000 93 #define LPC_FW_OPB_ADDR 0xf0000000 94 #define LPC_FW_OPB_SIZE 0x10000000 95 96 #define LPC_OPB_REGS_OPB_ADDR 0xc0010000 97 #define LPC_OPB_REGS_OPB_SIZE 0x00000060 98 #define LPC_OPB_REGS_OPBA_ADDR 0xc0011000 99 #define LPC_OPB_REGS_OPBA_SIZE 0x00000008 100 #define LPC_HC_REGS_OPB_ADDR 0xc0012000 101 #define LPC_HC_REGS_OPB_SIZE 0x00000100 102 103 static int pnv_lpc_dt_xscom(PnvXScomInterface *dev, void *fdt, int xscom_offset) 104 { 105 const char compat[] = "ibm,power8-lpc\0ibm,lpc"; 106 char *name; 107 int offset; 108 uint32_t lpc_pcba = PNV_XSCOM_LPC_BASE; 109 uint32_t reg[] = { 110 cpu_to_be32(lpc_pcba), 111 cpu_to_be32(PNV_XSCOM_LPC_SIZE) 112 }; 113 114 name = g_strdup_printf("isa@%x", lpc_pcba); 115 offset = fdt_add_subnode(fdt, xscom_offset, name); 116 _FDT(offset); 117 g_free(name); 118 119 _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg)))); 120 _FDT((fdt_setprop_cell(fdt, offset, "#address-cells", 2))); 121 _FDT((fdt_setprop_cell(fdt, offset, "#size-cells", 1))); 122 _FDT((fdt_setprop(fdt, offset, "compatible", compat, sizeof(compat)))); 123 return 0; 124 } 125 126 /* POWER9 only */ 127 int pnv_dt_lpc(PnvChip *chip, void *fdt, int root_offset, uint64_t lpcm_addr, 128 uint64_t lpcm_size) 129 { 130 const char compat[] = "ibm,power9-lpcm-opb\0simple-bus"; 131 const char lpc_compat[] = "ibm,power9-lpc\0ibm,lpc"; 132 char *name; 133 int offset, lpcm_offset; 134 uint32_t opb_ranges[8] = { 0, 135 cpu_to_be32(lpcm_addr >> 32), 136 cpu_to_be32((uint32_t)lpcm_addr), 137 cpu_to_be32(lpcm_size / 2), 138 cpu_to_be32(lpcm_size / 2), 139 cpu_to_be32(lpcm_addr >> 32), 140 cpu_to_be32(lpcm_size / 2), 141 cpu_to_be32(lpcm_size / 2), 142 }; 143 uint32_t opb_reg[4] = { cpu_to_be32(lpcm_addr >> 32), 144 cpu_to_be32((uint32_t)lpcm_addr), 145 cpu_to_be32(lpcm_size >> 32), 146 cpu_to_be32((uint32_t)lpcm_size), 147 }; 148 uint32_t lpc_ranges[12] = { 0, 0, 149 cpu_to_be32(LPC_MEM_OPB_ADDR), 150 cpu_to_be32(LPC_MEM_OPB_SIZE), 151 cpu_to_be32(1), 0, 152 cpu_to_be32(LPC_IO_OPB_ADDR), 153 cpu_to_be32(LPC_IO_OPB_SIZE), 154 cpu_to_be32(3), 0, 155 cpu_to_be32(LPC_FW_OPB_ADDR), 156 cpu_to_be32(LPC_FW_OPB_SIZE), 157 }; 158 uint32_t reg[2]; 159 160 /* 161 * OPB bus 162 */ 163 name = g_strdup_printf("lpcm-opb@%"PRIx64, lpcm_addr); 164 lpcm_offset = fdt_add_subnode(fdt, root_offset, name); 165 _FDT(lpcm_offset); 166 g_free(name); 167 168 _FDT((fdt_setprop(fdt, lpcm_offset, "reg", opb_reg, sizeof(opb_reg)))); 169 _FDT((fdt_setprop_cell(fdt, lpcm_offset, "#address-cells", 1))); 170 _FDT((fdt_setprop_cell(fdt, lpcm_offset, "#size-cells", 1))); 171 _FDT((fdt_setprop(fdt, lpcm_offset, "compatible", compat, sizeof(compat)))); 172 _FDT((fdt_setprop_cell(fdt, lpcm_offset, "ibm,chip-id", chip->chip_id))); 173 _FDT((fdt_setprop(fdt, lpcm_offset, "ranges", opb_ranges, 174 sizeof(opb_ranges)))); 175 176 /* 177 * OPB Master registers 178 */ 179 name = g_strdup_printf("opb-master@%x", LPC_OPB_REGS_OPB_ADDR); 180 offset = fdt_add_subnode(fdt, lpcm_offset, name); 181 _FDT(offset); 182 g_free(name); 183 184 reg[0] = cpu_to_be32(LPC_OPB_REGS_OPB_ADDR); 185 reg[1] = cpu_to_be32(LPC_OPB_REGS_OPB_SIZE); 186 _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg)))); 187 _FDT((fdt_setprop_string(fdt, offset, "compatible", 188 "ibm,power9-lpcm-opb-master"))); 189 190 /* 191 * OPB arbitrer registers 192 */ 193 name = g_strdup_printf("opb-arbitrer@%x", LPC_OPB_REGS_OPBA_ADDR); 194 offset = fdt_add_subnode(fdt, lpcm_offset, name); 195 _FDT(offset); 196 g_free(name); 197 198 reg[0] = cpu_to_be32(LPC_OPB_REGS_OPBA_ADDR); 199 reg[1] = cpu_to_be32(LPC_OPB_REGS_OPBA_SIZE); 200 _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg)))); 201 _FDT((fdt_setprop_string(fdt, offset, "compatible", 202 "ibm,power9-lpcm-opb-arbiter"))); 203 204 /* 205 * LPC Host Controller registers 206 */ 207 name = g_strdup_printf("lpc-controller@%x", LPC_HC_REGS_OPB_ADDR); 208 offset = fdt_add_subnode(fdt, lpcm_offset, name); 209 _FDT(offset); 210 g_free(name); 211 212 reg[0] = cpu_to_be32(LPC_HC_REGS_OPB_ADDR); 213 reg[1] = cpu_to_be32(LPC_HC_REGS_OPB_SIZE); 214 _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg)))); 215 _FDT((fdt_setprop_string(fdt, offset, "compatible", 216 "ibm,power9-lpc-controller"))); 217 218 name = g_strdup_printf("lpc@0"); 219 offset = fdt_add_subnode(fdt, lpcm_offset, name); 220 _FDT(offset); 221 g_free(name); 222 _FDT((fdt_setprop_cell(fdt, offset, "#address-cells", 2))); 223 _FDT((fdt_setprop_cell(fdt, offset, "#size-cells", 1))); 224 _FDT((fdt_setprop(fdt, offset, "compatible", lpc_compat, 225 sizeof(lpc_compat)))); 226 _FDT((fdt_setprop(fdt, offset, "ranges", lpc_ranges, 227 sizeof(lpc_ranges)))); 228 229 return 0; 230 } 231 232 /* 233 * These read/write handlers of the OPB address space should be common 234 * with the P9 LPC Controller which uses direct MMIOs. 235 * 236 * TODO: rework to use address_space_stq() and address_space_ldq() 237 * instead. 238 */ 239 bool pnv_lpc_opb_read(PnvLpcController *lpc, uint32_t addr, 240 uint8_t *data, int sz) 241 { 242 /* XXX Handle access size limits and FW read caching here */ 243 return !address_space_read(&lpc->opb_as, addr, MEMTXATTRS_UNSPECIFIED, 244 data, sz); 245 } 246 247 bool pnv_lpc_opb_write(PnvLpcController *lpc, uint32_t addr, 248 uint8_t *data, int sz) 249 { 250 /* XXX Handle access size limits here */ 251 return !address_space_write(&lpc->opb_as, addr, MEMTXATTRS_UNSPECIFIED, 252 data, sz); 253 } 254 255 #define ECCB_CTL_READ PPC_BIT(15) 256 #define ECCB_CTL_SZ_LSH (63 - 7) 257 #define ECCB_CTL_SZ_MASK PPC_BITMASK(4, 7) 258 #define ECCB_CTL_ADDR_MASK PPC_BITMASK(32, 63) 259 260 #define ECCB_STAT_OP_DONE PPC_BIT(52) 261 #define ECCB_STAT_OP_ERR PPC_BIT(52) 262 #define ECCB_STAT_RD_DATA_LSH (63 - 37) 263 #define ECCB_STAT_RD_DATA_MASK (0xffffffff << ECCB_STAT_RD_DATA_LSH) 264 265 static void pnv_lpc_do_eccb(PnvLpcController *lpc, uint64_t cmd) 266 { 267 /* XXX Check for magic bits at the top, addr size etc... */ 268 unsigned int sz = (cmd & ECCB_CTL_SZ_MASK) >> ECCB_CTL_SZ_LSH; 269 uint32_t opb_addr = cmd & ECCB_CTL_ADDR_MASK; 270 uint8_t data[8]; 271 bool success; 272 273 if (sz > sizeof(data)) { 274 qemu_log_mask(LOG_GUEST_ERROR, 275 "ECCB: invalid operation at @0x%08x size %d\n", opb_addr, sz); 276 return; 277 } 278 279 if (cmd & ECCB_CTL_READ) { 280 success = pnv_lpc_opb_read(lpc, opb_addr, data, sz); 281 if (success) { 282 lpc->eccb_stat_reg = ECCB_STAT_OP_DONE | 283 (((uint64_t)data[0]) << 24 | 284 ((uint64_t)data[1]) << 16 | 285 ((uint64_t)data[2]) << 8 | 286 ((uint64_t)data[3])) << ECCB_STAT_RD_DATA_LSH; 287 } else { 288 lpc->eccb_stat_reg = ECCB_STAT_OP_DONE | 289 (0xffffffffull << ECCB_STAT_RD_DATA_LSH); 290 } 291 } else { 292 data[0] = lpc->eccb_data_reg >> 24; 293 data[1] = lpc->eccb_data_reg >> 16; 294 data[2] = lpc->eccb_data_reg >> 8; 295 data[3] = lpc->eccb_data_reg; 296 297 success = pnv_lpc_opb_write(lpc, opb_addr, data, sz); 298 lpc->eccb_stat_reg = ECCB_STAT_OP_DONE; 299 } 300 /* XXX Which error bit (if any) to signal OPB error ? */ 301 } 302 303 static uint64_t pnv_lpc_xscom_read(void *opaque, hwaddr addr, unsigned size) 304 { 305 PnvLpcController *lpc = PNV_LPC(opaque); 306 uint32_t offset = addr >> 3; 307 uint64_t val = 0; 308 309 switch (offset & 3) { 310 case ECCB_CTL: 311 case ECCB_RESET: 312 val = 0; 313 break; 314 case ECCB_STAT: 315 val = lpc->eccb_stat_reg; 316 lpc->eccb_stat_reg = 0; 317 break; 318 case ECCB_DATA: 319 val = ((uint64_t)lpc->eccb_data_reg) << 32; 320 break; 321 } 322 return val; 323 } 324 325 static void pnv_lpc_xscom_write(void *opaque, hwaddr addr, 326 uint64_t val, unsigned size) 327 { 328 PnvLpcController *lpc = PNV_LPC(opaque); 329 uint32_t offset = addr >> 3; 330 331 switch (offset & 3) { 332 case ECCB_CTL: 333 pnv_lpc_do_eccb(lpc, val); 334 break; 335 case ECCB_RESET: 336 /* XXXX */ 337 break; 338 case ECCB_STAT: 339 break; 340 case ECCB_DATA: 341 lpc->eccb_data_reg = val >> 32; 342 break; 343 } 344 } 345 346 static const MemoryRegionOps pnv_lpc_xscom_ops = { 347 .read = pnv_lpc_xscom_read, 348 .write = pnv_lpc_xscom_write, 349 .valid.min_access_size = 8, 350 .valid.max_access_size = 8, 351 .impl.min_access_size = 8, 352 .impl.max_access_size = 8, 353 .endianness = DEVICE_BIG_ENDIAN, 354 }; 355 356 static uint64_t pnv_lpc_mmio_read(void *opaque, hwaddr addr, unsigned size) 357 { 358 PnvLpcController *lpc = PNV_LPC(opaque); 359 uint64_t val = 0; 360 uint32_t opb_addr = addr & ECCB_CTL_ADDR_MASK; 361 MemTxResult result; 362 363 switch (size) { 364 case 4: 365 val = address_space_ldl(&lpc->opb_as, opb_addr, MEMTXATTRS_UNSPECIFIED, 366 &result); 367 break; 368 case 1: 369 val = address_space_ldub(&lpc->opb_as, opb_addr, MEMTXATTRS_UNSPECIFIED, 370 &result); 371 break; 372 default: 373 qemu_log_mask(LOG_GUEST_ERROR, "OPB read failed at @0x%" 374 HWADDR_PRIx " invalid size %d\n", addr, size); 375 return 0; 376 } 377 378 if (result != MEMTX_OK) { 379 qemu_log_mask(LOG_GUEST_ERROR, "OPB read failed at @0x%" 380 HWADDR_PRIx "\n", addr); 381 } 382 383 return val; 384 } 385 386 static void pnv_lpc_mmio_write(void *opaque, hwaddr addr, 387 uint64_t val, unsigned size) 388 { 389 PnvLpcController *lpc = PNV_LPC(opaque); 390 uint32_t opb_addr = addr & ECCB_CTL_ADDR_MASK; 391 MemTxResult result; 392 393 switch (size) { 394 case 4: 395 address_space_stl(&lpc->opb_as, opb_addr, val, MEMTXATTRS_UNSPECIFIED, 396 &result); 397 break; 398 case 1: 399 address_space_stb(&lpc->opb_as, opb_addr, val, MEMTXATTRS_UNSPECIFIED, 400 &result); 401 break; 402 default: 403 qemu_log_mask(LOG_GUEST_ERROR, "OPB write failed at @0x%" 404 HWADDR_PRIx " invalid size %d\n", addr, size); 405 return; 406 } 407 408 if (result != MEMTX_OK) { 409 qemu_log_mask(LOG_GUEST_ERROR, "OPB write failed at @0x%" 410 HWADDR_PRIx "\n", addr); 411 } 412 } 413 414 static const MemoryRegionOps pnv_lpc_mmio_ops = { 415 .read = pnv_lpc_mmio_read, 416 .write = pnv_lpc_mmio_write, 417 .impl = { 418 .min_access_size = 1, 419 .max_access_size = 4, 420 }, 421 .endianness = DEVICE_BIG_ENDIAN, 422 }; 423 424 /* Program the POWER9 LPC irq to PSI serirq routing table */ 425 static void pnv_lpc_eval_serirq_routes(PnvLpcController *lpc) 426 { 427 int irq; 428 429 if (!lpc->psi_has_serirq) { 430 if ((lpc->opb_irq_route0 & PPC_BITMASK(8, 13)) || 431 (lpc->opb_irq_route1 & PPC_BITMASK(4, 31))) { 432 qemu_log_mask(LOG_GUEST_ERROR, 433 "OPB: setting serirq routing on POWER8 system, ignoring.\n"); 434 } 435 return; 436 } 437 438 for (irq = 0; irq <= 13; irq++) { 439 int serirq = (lpc->opb_irq_route1 >> (31 - 5 - (irq * 2))) & 0x3; 440 lpc->irq_to_serirq_route[irq] = serirq; 441 } 442 443 for (irq = 14; irq < ISA_NUM_IRQS; irq++) { 444 int serirq = (lpc->opb_irq_route0 >> (31 - 9 - (irq * 2))) & 0x3; 445 lpc->irq_to_serirq_route[irq] = serirq; 446 } 447 } 448 449 static void pnv_lpc_eval_irqs(PnvLpcController *lpc) 450 { 451 uint32_t active_irqs = 0; 452 453 if (lpc->lpc_hc_irqstat & PPC_BITMASK32(16, 31)) { 454 qemu_log_mask(LOG_UNIMP, "LPC HC Unimplemented irqs in IRQSTAT: " 455 "0x%08"PRIx32"\n", lpc->lpc_hc_irqstat); 456 } 457 458 if (lpc->lpc_hc_irqser_ctrl & LPC_HC_IRQSER_EN) { 459 active_irqs = lpc->lpc_hc_irqstat & lpc->lpc_hc_irqmask; 460 } 461 462 /* Reflect the interrupt */ 463 if (!lpc->psi_has_serirq) { 464 /* 465 * POWER8 ORs all irqs together (also with LPCHC internal interrupt 466 * sources) and outputs a single line that raises the PSI LPCHC irq 467 * which then latches an OPB IRQ status register that sends the irq 468 * to PSI. 469 * 470 * We don't honor the polarity register, it's pointless and unused 471 * anyway 472 */ 473 if (active_irqs) { 474 lpc->opb_irq_input |= OPB_MASTER_IRQ_LPC; 475 } else { 476 lpc->opb_irq_input &= ~OPB_MASTER_IRQ_LPC; 477 } 478 479 /* Update OPB internal latch */ 480 lpc->opb_irq_stat |= lpc->opb_irq_input & lpc->opb_irq_mask; 481 482 qemu_set_irq(lpc->psi_irq_lpchc, lpc->opb_irq_stat != 0); 483 } else { 484 /* 485 * POWER9 and POWER10 have routing fields in OPB master registers that 486 * send LPC irqs to 4 output lines that raise the PSI SERIRQ irqs. 487 * These don't appear to get latched into an OPB register like the 488 * LPCHC irqs. 489 * 490 * POWER9 LPC controller internal irqs still go via the OPB 491 * and LPCHC PSI irqs like P8, but we have no such internal sources 492 * modelled yet. 493 */ 494 bool serirq_out[4] = { false, false, false, false }; 495 int irq; 496 497 for (irq = 0; irq < ISA_NUM_IRQS; irq++) { 498 if (active_irqs & (LPC_HC_IRQ_SERIRQ0 >> irq)) { 499 serirq_out[lpc->irq_to_serirq_route[irq]] = true; 500 } 501 } 502 503 qemu_set_irq(lpc->psi_irq_serirq[0], serirq_out[0]); 504 qemu_set_irq(lpc->psi_irq_serirq[1], serirq_out[1]); 505 qemu_set_irq(lpc->psi_irq_serirq[2], serirq_out[2]); 506 qemu_set_irq(lpc->psi_irq_serirq[3], serirq_out[3]); 507 } 508 } 509 510 static uint64_t lpc_hc_read(void *opaque, hwaddr addr, unsigned size) 511 { 512 PnvLpcController *lpc = opaque; 513 uint64_t val = 0xfffffffffffffffful; 514 515 switch (addr) { 516 case LPC_HC_FW_SEG_IDSEL: 517 val = lpc->lpc_hc_fw_seg_idsel; 518 break; 519 case LPC_HC_FW_RD_ACC_SIZE: 520 val = lpc->lpc_hc_fw_rd_acc_size; 521 break; 522 case LPC_HC_IRQSER_CTRL: 523 val = lpc->lpc_hc_irqser_ctrl; 524 break; 525 case LPC_HC_IRQMASK: 526 val = lpc->lpc_hc_irqmask; 527 break; 528 case LPC_HC_IRQSTAT: 529 val = lpc->lpc_hc_irqstat; 530 break; 531 case LPC_HC_ERROR_ADDRESS: 532 val = lpc->lpc_hc_error_addr; 533 break; 534 default: 535 qemu_log_mask(LOG_UNIMP, "LPC HC Unimplemented register: 0x%" 536 HWADDR_PRIx "\n", addr); 537 } 538 return val; 539 } 540 541 static void lpc_hc_write(void *opaque, hwaddr addr, uint64_t val, 542 unsigned size) 543 { 544 PnvLpcController *lpc = opaque; 545 546 /* XXX Filter out reserved bits */ 547 548 switch (addr) { 549 case LPC_HC_FW_SEG_IDSEL: 550 /* XXX Actually figure out how that works as this impact 551 * memory regions/aliases 552 */ 553 lpc->lpc_hc_fw_seg_idsel = val; 554 break; 555 case LPC_HC_FW_RD_ACC_SIZE: 556 lpc->lpc_hc_fw_rd_acc_size = val; 557 break; 558 case LPC_HC_IRQSER_CTRL: 559 lpc->lpc_hc_irqser_ctrl = val; 560 pnv_lpc_eval_irqs(lpc); 561 break; 562 case LPC_HC_IRQMASK: 563 lpc->lpc_hc_irqmask = val; 564 pnv_lpc_eval_irqs(lpc); 565 break; 566 case LPC_HC_IRQSTAT: 567 /* 568 * This register is write-to-clear for the IRQSER (LPC device IRQ) 569 * status. However if the device has not de-asserted its interrupt 570 * that will just raise this IRQ status bit again. Model this by 571 * keeping track of the inputs and only clearing if the inputs are 572 * deasserted. 573 */ 574 lpc->lpc_hc_irqstat &= ~(val & ~lpc->lpc_hc_irq_inputs); 575 pnv_lpc_eval_irqs(lpc); 576 break; 577 case LPC_HC_ERROR_ADDRESS: 578 break; 579 default: 580 qemu_log_mask(LOG_UNIMP, "LPC HC Unimplemented register: 0x%" 581 HWADDR_PRIx "\n", addr); 582 } 583 } 584 585 static const MemoryRegionOps lpc_hc_ops = { 586 .read = lpc_hc_read, 587 .write = lpc_hc_write, 588 .endianness = DEVICE_BIG_ENDIAN, 589 .valid = { 590 .min_access_size = 4, 591 .max_access_size = 4, 592 }, 593 .impl = { 594 .min_access_size = 4, 595 .max_access_size = 4, 596 }, 597 }; 598 599 static uint64_t opb_master_read(void *opaque, hwaddr addr, unsigned size) 600 { 601 PnvLpcController *lpc = opaque; 602 uint64_t val = 0xfffffffffffffffful; 603 604 switch (addr) { 605 case OPB_MASTER_LS_ROUTE0: 606 val = lpc->opb_irq_route0; 607 break; 608 case OPB_MASTER_LS_ROUTE1: 609 val = lpc->opb_irq_route1; 610 break; 611 case OPB_MASTER_LS_IRQ_STAT: 612 val = lpc->opb_irq_stat; 613 break; 614 case OPB_MASTER_LS_IRQ_MASK: 615 val = lpc->opb_irq_mask; 616 break; 617 case OPB_MASTER_LS_IRQ_POL: 618 val = lpc->opb_irq_pol; 619 break; 620 case OPB_MASTER_LS_IRQ_INPUT: 621 val = lpc->opb_irq_input; 622 break; 623 default: 624 qemu_log_mask(LOG_UNIMP, "OPBM: read on unimplemented register: 0x%" 625 HWADDR_PRIx "\n", addr); 626 } 627 628 return val; 629 } 630 631 static void opb_master_write(void *opaque, hwaddr addr, 632 uint64_t val, unsigned size) 633 { 634 PnvLpcController *lpc = opaque; 635 636 switch (addr) { 637 case OPB_MASTER_LS_ROUTE0: 638 lpc->opb_irq_route0 = val; 639 pnv_lpc_eval_serirq_routes(lpc); 640 pnv_lpc_eval_irqs(lpc); 641 break; 642 case OPB_MASTER_LS_ROUTE1: 643 lpc->opb_irq_route1 = val; 644 pnv_lpc_eval_serirq_routes(lpc); 645 pnv_lpc_eval_irqs(lpc); 646 break; 647 case OPB_MASTER_LS_IRQ_STAT: 648 lpc->opb_irq_stat &= ~val; 649 pnv_lpc_eval_irqs(lpc); 650 break; 651 case OPB_MASTER_LS_IRQ_MASK: 652 lpc->opb_irq_mask = val; 653 pnv_lpc_eval_irqs(lpc); 654 break; 655 case OPB_MASTER_LS_IRQ_POL: 656 lpc->opb_irq_pol = val; 657 pnv_lpc_eval_irqs(lpc); 658 break; 659 case OPB_MASTER_LS_IRQ_INPUT: 660 /* Read only */ 661 break; 662 default: 663 qemu_log_mask(LOG_UNIMP, "OPBM: write on unimplemented register: 0x%" 664 HWADDR_PRIx " val=0x%08"PRIx64"\n", addr, val); 665 } 666 } 667 668 static const MemoryRegionOps opb_master_ops = { 669 .read = opb_master_read, 670 .write = opb_master_write, 671 .endianness = DEVICE_BIG_ENDIAN, 672 .valid = { 673 .min_access_size = 4, 674 .max_access_size = 4, 675 }, 676 .impl = { 677 .min_access_size = 4, 678 .max_access_size = 4, 679 }, 680 }; 681 682 static void pnv_lpc_power8_realize(DeviceState *dev, Error **errp) 683 { 684 PnvLpcController *lpc = PNV_LPC(dev); 685 PnvLpcClass *plc = PNV_LPC_GET_CLASS(dev); 686 Error *local_err = NULL; 687 688 plc->parent_realize(dev, &local_err); 689 if (local_err) { 690 error_propagate(errp, local_err); 691 return; 692 } 693 694 /* P8 uses a XSCOM region for LPC registers */ 695 pnv_xscom_region_init(&lpc->xscom_regs, OBJECT(lpc), 696 &pnv_lpc_xscom_ops, lpc, "xscom-lpc", 697 PNV_XSCOM_LPC_SIZE); 698 } 699 700 static void pnv_lpc_power8_class_init(ObjectClass *klass, void *data) 701 { 702 DeviceClass *dc = DEVICE_CLASS(klass); 703 PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass); 704 PnvLpcClass *plc = PNV_LPC_CLASS(klass); 705 706 dc->desc = "PowerNV LPC Controller POWER8"; 707 708 xdc->dt_xscom = pnv_lpc_dt_xscom; 709 710 device_class_set_parent_realize(dc, pnv_lpc_power8_realize, 711 &plc->parent_realize); 712 } 713 714 static const TypeInfo pnv_lpc_power8_info = { 715 .name = TYPE_PNV8_LPC, 716 .parent = TYPE_PNV_LPC, 717 .class_init = pnv_lpc_power8_class_init, 718 .interfaces = (InterfaceInfo[]) { 719 { TYPE_PNV_XSCOM_INTERFACE }, 720 { } 721 } 722 }; 723 724 static void pnv_lpc_power9_realize(DeviceState *dev, Error **errp) 725 { 726 PnvLpcController *lpc = PNV_LPC(dev); 727 PnvLpcClass *plc = PNV_LPC_GET_CLASS(dev); 728 Error *local_err = NULL; 729 730 object_property_set_bool(OBJECT(lpc), "psi-serirq", true, &error_abort); 731 732 plc->parent_realize(dev, &local_err); 733 if (local_err) { 734 error_propagate(errp, local_err); 735 return; 736 } 737 738 /* P9 uses a MMIO region */ 739 memory_region_init_io(&lpc->xscom_regs, OBJECT(lpc), &pnv_lpc_mmio_ops, 740 lpc, "lpcm", PNV9_LPCM_SIZE); 741 742 /* P9 LPC routes ISA irqs to 4 PSI SERIRQ lines */ 743 qdev_init_gpio_out_named(dev, lpc->psi_irq_serirq, "SERIRQ", 4); 744 } 745 746 static void pnv_lpc_power9_class_init(ObjectClass *klass, void *data) 747 { 748 DeviceClass *dc = DEVICE_CLASS(klass); 749 PnvLpcClass *plc = PNV_LPC_CLASS(klass); 750 751 dc->desc = "PowerNV LPC Controller POWER9"; 752 753 device_class_set_parent_realize(dc, pnv_lpc_power9_realize, 754 &plc->parent_realize); 755 } 756 757 static const TypeInfo pnv_lpc_power9_info = { 758 .name = TYPE_PNV9_LPC, 759 .parent = TYPE_PNV_LPC, 760 .class_init = pnv_lpc_power9_class_init, 761 }; 762 763 static void pnv_lpc_power10_class_init(ObjectClass *klass, void *data) 764 { 765 DeviceClass *dc = DEVICE_CLASS(klass); 766 767 dc->desc = "PowerNV LPC Controller POWER10"; 768 } 769 770 static const TypeInfo pnv_lpc_power10_info = { 771 .name = TYPE_PNV10_LPC, 772 .parent = TYPE_PNV9_LPC, 773 .class_init = pnv_lpc_power10_class_init, 774 }; 775 776 static void pnv_lpc_realize(DeviceState *dev, Error **errp) 777 { 778 PnvLpcController *lpc = PNV_LPC(dev); 779 780 /* Reg inits */ 781 lpc->lpc_hc_fw_rd_acc_size = LPC_HC_FW_RD_4B; 782 783 /* Create address space and backing MR for the OPB bus */ 784 memory_region_init(&lpc->opb_mr, OBJECT(dev), "lpc-opb", 0x100000000ull); 785 address_space_init(&lpc->opb_as, &lpc->opb_mr, "lpc-opb"); 786 787 /* Create ISA IO and Mem space regions which are the root of 788 * the ISA bus (ie, ISA address spaces). We don't create a 789 * separate one for FW which we alias to memory. 790 */ 791 memory_region_init(&lpc->isa_io, OBJECT(dev), "isa-io", ISA_IO_SIZE); 792 memory_region_init(&lpc->isa_mem, OBJECT(dev), "isa-mem", ISA_MEM_SIZE); 793 memory_region_init(&lpc->isa_fw, OBJECT(dev), "isa-fw", ISA_FW_SIZE); 794 795 /* Create windows from the OPB space to the ISA space */ 796 memory_region_init_alias(&lpc->opb_isa_io, OBJECT(dev), "lpc-isa-io", 797 &lpc->isa_io, 0, LPC_IO_OPB_SIZE); 798 memory_region_add_subregion(&lpc->opb_mr, LPC_IO_OPB_ADDR, 799 &lpc->opb_isa_io); 800 memory_region_init_alias(&lpc->opb_isa_mem, OBJECT(dev), "lpc-isa-mem", 801 &lpc->isa_mem, 0, LPC_MEM_OPB_SIZE); 802 memory_region_add_subregion(&lpc->opb_mr, LPC_MEM_OPB_ADDR, 803 &lpc->opb_isa_mem); 804 memory_region_init_alias(&lpc->opb_isa_fw, OBJECT(dev), "lpc-isa-fw", 805 &lpc->isa_fw, 0, LPC_FW_OPB_SIZE); 806 memory_region_add_subregion(&lpc->opb_mr, LPC_FW_OPB_ADDR, 807 &lpc->opb_isa_fw); 808 809 /* Create MMIO regions for LPC HC and OPB registers */ 810 memory_region_init_io(&lpc->opb_master_regs, OBJECT(dev), &opb_master_ops, 811 lpc, "lpc-opb-master", LPC_OPB_REGS_OPB_SIZE); 812 lpc->opb_master_regs.disable_reentrancy_guard = true; 813 memory_region_add_subregion(&lpc->opb_mr, LPC_OPB_REGS_OPB_ADDR, 814 &lpc->opb_master_regs); 815 memory_region_init_io(&lpc->lpc_hc_regs, OBJECT(dev), &lpc_hc_ops, lpc, 816 "lpc-hc", LPC_HC_REGS_OPB_SIZE); 817 /* xscom writes to lpc-hc. As such mark lpc-hc re-entrancy safe */ 818 lpc->lpc_hc_regs.disable_reentrancy_guard = true; 819 memory_region_add_subregion(&lpc->opb_mr, LPC_HC_REGS_OPB_ADDR, 820 &lpc->lpc_hc_regs); 821 822 qdev_init_gpio_out_named(dev, &lpc->psi_irq_lpchc, "LPCHC", 1); 823 } 824 825 static Property pnv_lpc_properties[] = { 826 DEFINE_PROP_BOOL("psi-serirq", PnvLpcController, psi_has_serirq, false), 827 DEFINE_PROP_END_OF_LIST(), 828 }; 829 830 static void pnv_lpc_class_init(ObjectClass *klass, void *data) 831 { 832 DeviceClass *dc = DEVICE_CLASS(klass); 833 834 device_class_set_props(dc, pnv_lpc_properties); 835 dc->realize = pnv_lpc_realize; 836 dc->desc = "PowerNV LPC Controller"; 837 dc->user_creatable = false; 838 } 839 840 static const TypeInfo pnv_lpc_info = { 841 .name = TYPE_PNV_LPC, 842 .parent = TYPE_DEVICE, 843 .instance_size = sizeof(PnvLpcController), 844 .class_init = pnv_lpc_class_init, 845 .class_size = sizeof(PnvLpcClass), 846 .abstract = true, 847 }; 848 849 static void pnv_lpc_register_types(void) 850 { 851 type_register_static(&pnv_lpc_info); 852 type_register_static(&pnv_lpc_power8_info); 853 type_register_static(&pnv_lpc_power9_info); 854 type_register_static(&pnv_lpc_power10_info); 855 } 856 857 type_init(pnv_lpc_register_types) 858 859 /* If we don't use the built-in LPC interrupt deserializer, we need 860 * to provide a set of qirqs for the ISA bus or things will go bad. 861 * 862 * Most machines using pre-Naples chips (without said deserializer) 863 * have a CPLD that will collect the SerIRQ and shoot them as a 864 * single level interrupt to the P8 chip. So let's setup a hook 865 * for doing just that. 866 */ 867 static void pnv_lpc_isa_irq_handler_cpld(void *opaque, int n, int level) 868 { 869 PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine()); 870 uint32_t old_state = pnv->cpld_irqstate; 871 PnvLpcController *lpc = PNV_LPC(opaque); 872 873 if (level) { 874 pnv->cpld_irqstate |= 1u << n; 875 } else { 876 pnv->cpld_irqstate &= ~(1u << n); 877 } 878 879 if (pnv->cpld_irqstate != old_state) { 880 qemu_set_irq(lpc->psi_irq_lpchc, pnv->cpld_irqstate != 0); 881 } 882 } 883 884 static void pnv_lpc_isa_irq_handler(void *opaque, int n, int level) 885 { 886 PnvLpcController *lpc = PNV_LPC(opaque); 887 uint32_t irq_bit = LPC_HC_IRQ_SERIRQ0 >> n; 888 889 if (level) { 890 lpc->lpc_hc_irq_inputs |= irq_bit; 891 892 /* 893 * The LPC HC in Naples and later latches LPC IRQ into a bit field in 894 * the IRQSTAT register, and that drives the PSI IRQ to the IC. 895 * Software clears this bit manually (see LPC_HC_IRQSTAT handler). 896 */ 897 lpc->lpc_hc_irqstat |= irq_bit; 898 pnv_lpc_eval_irqs(lpc); 899 } else { 900 lpc->lpc_hc_irq_inputs &= ~irq_bit; 901 902 /* POWER9 adds an auto-clear mode that clears IRQSTAT bits on EOI */ 903 if (lpc->psi_has_serirq && 904 (lpc->lpc_hc_irqser_ctrl & LPC_HC_IRQSER_AUTO_CLEAR)) { 905 lpc->lpc_hc_irqstat &= ~irq_bit; 906 pnv_lpc_eval_irqs(lpc); 907 } 908 } 909 } 910 911 ISABus *pnv_lpc_isa_create(PnvLpcController *lpc, bool use_cpld, Error **errp) 912 { 913 Error *local_err = NULL; 914 ISABus *isa_bus; 915 qemu_irq *irqs; 916 qemu_irq_handler handler; 917 918 /* let isa_bus_new() create its own bridge on SysBus otherwise 919 * devices specified on the command line won't find the bus and 920 * will fail to create. 921 */ 922 isa_bus = isa_bus_new(NULL, &lpc->isa_mem, &lpc->isa_io, &local_err); 923 if (local_err) { 924 error_propagate(errp, local_err); 925 return NULL; 926 } 927 928 /* Not all variants have a working serial irq decoder. If not, 929 * handling of LPC interrupts becomes a platform issue (some 930 * platforms have a CPLD to do it). 931 */ 932 if (use_cpld) { 933 handler = pnv_lpc_isa_irq_handler_cpld; 934 } else { 935 handler = pnv_lpc_isa_irq_handler; 936 } 937 938 /* POWER has a 17th irq, QEMU only implements the 16 regular device irqs */ 939 irqs = qemu_allocate_irqs(handler, lpc, ISA_NUM_IRQS); 940 941 isa_bus_register_input_irqs(isa_bus, irqs); 942 943 return isa_bus; 944 } 945