1 /*
2 * QEMU PowerPC PowerNV LPC controller
3 *
4 * Copyright (c) 2016, IBM Corporation.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "qemu/osdep.h"
21 #include "target/ppc/cpu.h"
22 #include "qapi/error.h"
23 #include "qemu/log.h"
24 #include "qemu/module.h"
25 #include "hw/irq.h"
26 #include "hw/isa/isa.h"
27 #include "hw/qdev-properties.h"
28 #include "hw/ppc/pnv.h"
29 #include "hw/ppc/pnv_chip.h"
30 #include "hw/ppc/pnv_lpc.h"
31 #include "hw/ppc/pnv_xscom.h"
32 #include "hw/ppc/fdt.h"
33
34 #include <libfdt.h>
35
36 enum {
37 ECCB_CTL = 0,
38 ECCB_RESET = 1,
39 ECCB_STAT = 2,
40 ECCB_DATA = 3,
41 };
42
43 /* OPB Master LS registers */
44 #define OPB_MASTER_LS_ROUTE0 0x8
45 #define OPB_MASTER_LS_ROUTE1 0xC
46 #define OPB_MASTER_LS_IRQ_STAT 0x50
47 #define OPB_MASTER_IRQ_LPC 0x00000800
48 #define OPB_MASTER_LS_IRQ_MASK 0x54
49 #define OPB_MASTER_LS_IRQ_POL 0x58
50 #define OPB_MASTER_LS_IRQ_INPUT 0x5c
51
52 /* LPC HC registers */
53 #define LPC_HC_FW_SEG_IDSEL 0x24
54 #define LPC_HC_FW_RD_ACC_SIZE 0x28
55 #define LPC_HC_FW_RD_1B 0x00000000
56 #define LPC_HC_FW_RD_2B 0x01000000
57 #define LPC_HC_FW_RD_4B 0x02000000
58 #define LPC_HC_FW_RD_16B 0x04000000
59 #define LPC_HC_FW_RD_128B 0x07000000
60 #define LPC_HC_IRQSER_CTRL 0x30
61 #define LPC_HC_IRQSER_EN 0x80000000
62 #define LPC_HC_IRQSER_QMODE 0x40000000
63 #define LPC_HC_IRQSER_START_MASK 0x03000000
64 #define LPC_HC_IRQSER_START_4CLK 0x00000000
65 #define LPC_HC_IRQSER_START_6CLK 0x01000000
66 #define LPC_HC_IRQSER_START_8CLK 0x02000000
67 #define LPC_HC_IRQSER_AUTO_CLEAR 0x00800000
68 #define LPC_HC_IRQMASK 0x34 /* same bit defs as LPC_HC_IRQSTAT */
69 #define LPC_HC_IRQSTAT 0x38
70 #define LPC_HC_IRQ_SERIRQ0 0x80000000 /* all bits down to ... */
71 #define LPC_HC_IRQ_SERIRQ16 0x00008000 /* IRQ16=IOCHK#, IRQ2=SMI# */
72 #define LPC_HC_IRQ_SERIRQ_ALL 0xffff8000
73 #define LPC_HC_IRQ_LRESET 0x00000400
74 #define LPC_HC_IRQ_SYNC_ABNORM_ERR 0x00000080
75 #define LPC_HC_IRQ_SYNC_NORESP_ERR 0x00000040
76 #define LPC_HC_IRQ_SYNC_NORM_ERR 0x00000020
77 #define LPC_HC_IRQ_SYNC_TIMEOUT_ERR 0x00000010
78 #define LPC_HC_IRQ_SYNC_TARG_TAR_ERR 0x00000008
79 #define LPC_HC_IRQ_SYNC_BM_TAR_ERR 0x00000004
80 #define LPC_HC_IRQ_SYNC_BM0_REQ 0x00000002
81 #define LPC_HC_IRQ_SYNC_BM1_REQ 0x00000001
82 #define LPC_HC_ERROR_ADDRESS 0x40
83
84 #define LPC_OPB_SIZE 0x100000000ull
85
86 #define ISA_IO_SIZE 0x00010000
87 #define ISA_MEM_SIZE 0x10000000
88 #define ISA_FW_SIZE 0x10000000
89 #define LPC_IO_OPB_ADDR 0xd0010000
90 #define LPC_IO_OPB_SIZE 0x00010000
91 #define LPC_MEM_OPB_ADDR 0xe0000000
92 #define LPC_MEM_OPB_SIZE 0x10000000
93 #define LPC_FW_OPB_ADDR 0xf0000000
94 #define LPC_FW_OPB_SIZE 0x10000000
95
96 #define LPC_OPB_REGS_OPB_ADDR 0xc0010000
97 #define LPC_OPB_REGS_OPB_SIZE 0x00000060
98 #define LPC_OPB_REGS_OPBA_ADDR 0xc0011000
99 #define LPC_OPB_REGS_OPBA_SIZE 0x00000008
100 #define LPC_HC_REGS_OPB_ADDR 0xc0012000
101 #define LPC_HC_REGS_OPB_SIZE 0x00000100
102
pnv_lpc_dt_xscom(PnvXScomInterface * dev,void * fdt,int xscom_offset)103 static int pnv_lpc_dt_xscom(PnvXScomInterface *dev, void *fdt, int xscom_offset)
104 {
105 const char compat[] = "ibm,power8-lpc\0ibm,lpc";
106 char *name;
107 int offset;
108 uint32_t lpc_pcba = PNV_XSCOM_LPC_BASE;
109 uint32_t reg[] = {
110 cpu_to_be32(lpc_pcba),
111 cpu_to_be32(PNV_XSCOM_LPC_SIZE)
112 };
113
114 name = g_strdup_printf("isa@%x", lpc_pcba);
115 offset = fdt_add_subnode(fdt, xscom_offset, name);
116 _FDT(offset);
117 g_free(name);
118
119 _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
120 _FDT((fdt_setprop_cell(fdt, offset, "#address-cells", 2)));
121 _FDT((fdt_setprop_cell(fdt, offset, "#size-cells", 1)));
122 _FDT((fdt_setprop(fdt, offset, "compatible", compat, sizeof(compat))));
123 return 0;
124 }
125
126 /* POWER9 only */
pnv_dt_lpc(PnvChip * chip,void * fdt,int root_offset,uint64_t lpcm_addr,uint64_t lpcm_size)127 int pnv_dt_lpc(PnvChip *chip, void *fdt, int root_offset, uint64_t lpcm_addr,
128 uint64_t lpcm_size)
129 {
130 const char compat[] = "ibm,power9-lpcm-opb\0simple-bus";
131 const char lpc_compat[] = "ibm,power9-lpc\0ibm,lpc";
132 char *name;
133 int offset, lpcm_offset;
134 uint32_t opb_ranges[8] = { 0,
135 cpu_to_be32(lpcm_addr >> 32),
136 cpu_to_be32((uint32_t)lpcm_addr),
137 cpu_to_be32(lpcm_size / 2),
138 cpu_to_be32(lpcm_size / 2),
139 cpu_to_be32(lpcm_addr >> 32),
140 cpu_to_be32(lpcm_size / 2),
141 cpu_to_be32(lpcm_size / 2),
142 };
143 uint32_t opb_reg[4] = { cpu_to_be32(lpcm_addr >> 32),
144 cpu_to_be32((uint32_t)lpcm_addr),
145 cpu_to_be32(lpcm_size >> 32),
146 cpu_to_be32((uint32_t)lpcm_size),
147 };
148 uint32_t lpc_ranges[12] = { 0, 0,
149 cpu_to_be32(LPC_MEM_OPB_ADDR),
150 cpu_to_be32(LPC_MEM_OPB_SIZE),
151 cpu_to_be32(1), 0,
152 cpu_to_be32(LPC_IO_OPB_ADDR),
153 cpu_to_be32(LPC_IO_OPB_SIZE),
154 cpu_to_be32(3), 0,
155 cpu_to_be32(LPC_FW_OPB_ADDR),
156 cpu_to_be32(LPC_FW_OPB_SIZE),
157 };
158 uint32_t reg[2];
159
160 /*
161 * OPB bus
162 */
163 name = g_strdup_printf("lpcm-opb@%"PRIx64, lpcm_addr);
164 lpcm_offset = fdt_add_subnode(fdt, root_offset, name);
165 _FDT(lpcm_offset);
166 g_free(name);
167
168 _FDT((fdt_setprop(fdt, lpcm_offset, "reg", opb_reg, sizeof(opb_reg))));
169 _FDT((fdt_setprop_cell(fdt, lpcm_offset, "#address-cells", 1)));
170 _FDT((fdt_setprop_cell(fdt, lpcm_offset, "#size-cells", 1)));
171 _FDT((fdt_setprop(fdt, lpcm_offset, "compatible", compat, sizeof(compat))));
172 _FDT((fdt_setprop_cell(fdt, lpcm_offset, "ibm,chip-id", chip->chip_id)));
173 _FDT((fdt_setprop(fdt, lpcm_offset, "ranges", opb_ranges,
174 sizeof(opb_ranges))));
175
176 /*
177 * OPB Master registers
178 */
179 name = g_strdup_printf("opb-master@%x", LPC_OPB_REGS_OPB_ADDR);
180 offset = fdt_add_subnode(fdt, lpcm_offset, name);
181 _FDT(offset);
182 g_free(name);
183
184 reg[0] = cpu_to_be32(LPC_OPB_REGS_OPB_ADDR);
185 reg[1] = cpu_to_be32(LPC_OPB_REGS_OPB_SIZE);
186 _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
187 _FDT((fdt_setprop_string(fdt, offset, "compatible",
188 "ibm,power9-lpcm-opb-master")));
189
190 /*
191 * OPB arbitrer registers
192 */
193 name = g_strdup_printf("opb-arbitrer@%x", LPC_OPB_REGS_OPBA_ADDR);
194 offset = fdt_add_subnode(fdt, lpcm_offset, name);
195 _FDT(offset);
196 g_free(name);
197
198 reg[0] = cpu_to_be32(LPC_OPB_REGS_OPBA_ADDR);
199 reg[1] = cpu_to_be32(LPC_OPB_REGS_OPBA_SIZE);
200 _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
201 _FDT((fdt_setprop_string(fdt, offset, "compatible",
202 "ibm,power9-lpcm-opb-arbiter")));
203
204 /*
205 * LPC Host Controller registers
206 */
207 name = g_strdup_printf("lpc-controller@%x", LPC_HC_REGS_OPB_ADDR);
208 offset = fdt_add_subnode(fdt, lpcm_offset, name);
209 _FDT(offset);
210 g_free(name);
211
212 reg[0] = cpu_to_be32(LPC_HC_REGS_OPB_ADDR);
213 reg[1] = cpu_to_be32(LPC_HC_REGS_OPB_SIZE);
214 _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
215 _FDT((fdt_setprop_string(fdt, offset, "compatible",
216 "ibm,power9-lpc-controller")));
217
218 name = g_strdup_printf("lpc@0");
219 offset = fdt_add_subnode(fdt, lpcm_offset, name);
220 _FDT(offset);
221 g_free(name);
222 _FDT((fdt_setprop_cell(fdt, offset, "#address-cells", 2)));
223 _FDT((fdt_setprop_cell(fdt, offset, "#size-cells", 1)));
224 _FDT((fdt_setprop(fdt, offset, "compatible", lpc_compat,
225 sizeof(lpc_compat))));
226 _FDT((fdt_setprop(fdt, offset, "ranges", lpc_ranges,
227 sizeof(lpc_ranges))));
228
229 return 0;
230 }
231
232 /*
233 * These read/write handlers of the OPB address space should be common
234 * with the P9 LPC Controller which uses direct MMIOs.
235 *
236 * TODO: rework to use address_space_stq() and address_space_ldq()
237 * instead.
238 */
pnv_lpc_opb_read(PnvLpcController * lpc,uint32_t addr,uint8_t * data,int sz)239 bool pnv_lpc_opb_read(PnvLpcController *lpc, uint32_t addr,
240 uint8_t *data, int sz)
241 {
242 /* XXX Handle access size limits and FW read caching here */
243 return !address_space_read(&lpc->opb_as, addr, MEMTXATTRS_UNSPECIFIED,
244 data, sz);
245 }
246
pnv_lpc_opb_write(PnvLpcController * lpc,uint32_t addr,uint8_t * data,int sz)247 bool pnv_lpc_opb_write(PnvLpcController *lpc, uint32_t addr,
248 uint8_t *data, int sz)
249 {
250 /* XXX Handle access size limits here */
251 return !address_space_write(&lpc->opb_as, addr, MEMTXATTRS_UNSPECIFIED,
252 data, sz);
253 }
254
255 #define ECCB_CTL_READ PPC_BIT(15)
256 #define ECCB_CTL_SZ_LSH (63 - 7)
257 #define ECCB_CTL_SZ_MASK PPC_BITMASK(4, 7)
258 #define ECCB_CTL_ADDR_MASK PPC_BITMASK(32, 63)
259
260 #define ECCB_STAT_OP_DONE PPC_BIT(52)
261 #define ECCB_STAT_OP_ERR PPC_BIT(52)
262 #define ECCB_STAT_RD_DATA_LSH (63 - 37)
263 #define ECCB_STAT_RD_DATA_MASK (0xffffffff << ECCB_STAT_RD_DATA_LSH)
264
pnv_lpc_do_eccb(PnvLpcController * lpc,uint64_t cmd)265 static void pnv_lpc_do_eccb(PnvLpcController *lpc, uint64_t cmd)
266 {
267 /* XXX Check for magic bits at the top, addr size etc... */
268 unsigned int sz = (cmd & ECCB_CTL_SZ_MASK) >> ECCB_CTL_SZ_LSH;
269 uint32_t opb_addr = cmd & ECCB_CTL_ADDR_MASK;
270 uint8_t data[8];
271 bool success;
272
273 if (sz > sizeof(data)) {
274 qemu_log_mask(LOG_GUEST_ERROR,
275 "ECCB: invalid operation at @0x%08x size %d\n", opb_addr, sz);
276 return;
277 }
278
279 if (cmd & ECCB_CTL_READ) {
280 success = pnv_lpc_opb_read(lpc, opb_addr, data, sz);
281 if (success) {
282 lpc->eccb_stat_reg = ECCB_STAT_OP_DONE |
283 (((uint64_t)data[0]) << 24 |
284 ((uint64_t)data[1]) << 16 |
285 ((uint64_t)data[2]) << 8 |
286 ((uint64_t)data[3])) << ECCB_STAT_RD_DATA_LSH;
287 } else {
288 lpc->eccb_stat_reg = ECCB_STAT_OP_DONE |
289 (0xffffffffull << ECCB_STAT_RD_DATA_LSH);
290 }
291 } else {
292 data[0] = lpc->eccb_data_reg >> 24;
293 data[1] = lpc->eccb_data_reg >> 16;
294 data[2] = lpc->eccb_data_reg >> 8;
295 data[3] = lpc->eccb_data_reg;
296
297 success = pnv_lpc_opb_write(lpc, opb_addr, data, sz);
298 lpc->eccb_stat_reg = ECCB_STAT_OP_DONE;
299 }
300 /* XXX Which error bit (if any) to signal OPB error ? */
301 }
302
pnv_lpc_xscom_read(void * opaque,hwaddr addr,unsigned size)303 static uint64_t pnv_lpc_xscom_read(void *opaque, hwaddr addr, unsigned size)
304 {
305 PnvLpcController *lpc = PNV_LPC(opaque);
306 uint32_t offset = addr >> 3;
307 uint64_t val = 0;
308
309 switch (offset & 3) {
310 case ECCB_CTL:
311 case ECCB_RESET:
312 val = 0;
313 break;
314 case ECCB_STAT:
315 val = lpc->eccb_stat_reg;
316 lpc->eccb_stat_reg = 0;
317 break;
318 case ECCB_DATA:
319 val = ((uint64_t)lpc->eccb_data_reg) << 32;
320 break;
321 }
322 return val;
323 }
324
pnv_lpc_xscom_write(void * opaque,hwaddr addr,uint64_t val,unsigned size)325 static void pnv_lpc_xscom_write(void *opaque, hwaddr addr,
326 uint64_t val, unsigned size)
327 {
328 PnvLpcController *lpc = PNV_LPC(opaque);
329 uint32_t offset = addr >> 3;
330
331 switch (offset & 3) {
332 case ECCB_CTL:
333 pnv_lpc_do_eccb(lpc, val);
334 break;
335 case ECCB_RESET:
336 /* XXXX */
337 break;
338 case ECCB_STAT:
339 break;
340 case ECCB_DATA:
341 lpc->eccb_data_reg = val >> 32;
342 break;
343 }
344 }
345
346 static const MemoryRegionOps pnv_lpc_xscom_ops = {
347 .read = pnv_lpc_xscom_read,
348 .write = pnv_lpc_xscom_write,
349 .valid.min_access_size = 8,
350 .valid.max_access_size = 8,
351 .impl.min_access_size = 8,
352 .impl.max_access_size = 8,
353 .endianness = DEVICE_BIG_ENDIAN,
354 };
355
pnv_lpc_mmio_read(void * opaque,hwaddr addr,unsigned size)356 static uint64_t pnv_lpc_mmio_read(void *opaque, hwaddr addr, unsigned size)
357 {
358 PnvLpcController *lpc = PNV_LPC(opaque);
359 uint64_t val = 0;
360 uint32_t opb_addr = addr & ECCB_CTL_ADDR_MASK;
361 MemTxResult result;
362
363 switch (size) {
364 case 4:
365 val = address_space_ldl(&lpc->opb_as, opb_addr, MEMTXATTRS_UNSPECIFIED,
366 &result);
367 break;
368 case 1:
369 val = address_space_ldub(&lpc->opb_as, opb_addr, MEMTXATTRS_UNSPECIFIED,
370 &result);
371 break;
372 default:
373 qemu_log_mask(LOG_GUEST_ERROR, "OPB read failed at @0x%"
374 HWADDR_PRIx " invalid size %d\n", addr, size);
375 return 0;
376 }
377
378 if (result != MEMTX_OK) {
379 qemu_log_mask(LOG_GUEST_ERROR, "OPB read failed at @0x%"
380 HWADDR_PRIx "\n", addr);
381 }
382
383 return val;
384 }
385
pnv_lpc_mmio_write(void * opaque,hwaddr addr,uint64_t val,unsigned size)386 static void pnv_lpc_mmio_write(void *opaque, hwaddr addr,
387 uint64_t val, unsigned size)
388 {
389 PnvLpcController *lpc = PNV_LPC(opaque);
390 uint32_t opb_addr = addr & ECCB_CTL_ADDR_MASK;
391 MemTxResult result;
392
393 switch (size) {
394 case 4:
395 address_space_stl(&lpc->opb_as, opb_addr, val, MEMTXATTRS_UNSPECIFIED,
396 &result);
397 break;
398 case 1:
399 address_space_stb(&lpc->opb_as, opb_addr, val, MEMTXATTRS_UNSPECIFIED,
400 &result);
401 break;
402 default:
403 qemu_log_mask(LOG_GUEST_ERROR, "OPB write failed at @0x%"
404 HWADDR_PRIx " invalid size %d\n", addr, size);
405 return;
406 }
407
408 if (result != MEMTX_OK) {
409 qemu_log_mask(LOG_GUEST_ERROR, "OPB write failed at @0x%"
410 HWADDR_PRIx "\n", addr);
411 }
412 }
413
414 static const MemoryRegionOps pnv_lpc_mmio_ops = {
415 .read = pnv_lpc_mmio_read,
416 .write = pnv_lpc_mmio_write,
417 .impl = {
418 .min_access_size = 1,
419 .max_access_size = 4,
420 },
421 .endianness = DEVICE_BIG_ENDIAN,
422 };
423
424 /* Program the POWER9 LPC irq to PSI serirq routing table */
pnv_lpc_eval_serirq_routes(PnvLpcController * lpc)425 static void pnv_lpc_eval_serirq_routes(PnvLpcController *lpc)
426 {
427 int irq;
428
429 if (!lpc->psi_has_serirq) {
430 if ((lpc->opb_irq_route0 & PPC_BITMASK32(8, 13)) ||
431 (lpc->opb_irq_route1 & PPC_BITMASK32(4, 31))) {
432 qemu_log_mask(LOG_GUEST_ERROR,
433 "OPB: setting serirq routing on POWER8 system, ignoring.\n");
434 }
435 return;
436 }
437
438 /*
439 * Each of the ISA irqs is routed to one of the 4 SERIRQ irqs with 2
440 * bits, split across 2 OPB registers.
441 */
442 for (irq = 0; irq <= 13; irq++) {
443 int serirq = extract32(lpc->opb_irq_route1,
444 PPC_BIT32_NR(5 + irq * 2), 2);
445 lpc->irq_to_serirq_route[irq] = serirq;
446 }
447
448 for (irq = 14; irq < ISA_NUM_IRQS; irq++) {
449 int serirq = extract32(lpc->opb_irq_route0,
450 PPC_BIT32_NR(9 + (irq - 14) * 2), 2);
451 lpc->irq_to_serirq_route[irq] = serirq;
452 }
453 }
454
pnv_lpc_eval_irqs(PnvLpcController * lpc)455 static void pnv_lpc_eval_irqs(PnvLpcController *lpc)
456 {
457 uint32_t active_irqs = 0;
458
459 if (lpc->lpc_hc_irqstat & PPC_BITMASK32(16, 31)) {
460 qemu_log_mask(LOG_UNIMP, "LPC HC Unimplemented irqs in IRQSTAT: "
461 "0x%08"PRIx32"\n", lpc->lpc_hc_irqstat);
462 }
463
464 if (lpc->lpc_hc_irqser_ctrl & LPC_HC_IRQSER_EN) {
465 active_irqs = lpc->lpc_hc_irqstat & lpc->lpc_hc_irqmask;
466 }
467
468 /* Reflect the interrupt */
469 if (!lpc->psi_has_serirq) {
470 /*
471 * POWER8 ORs all irqs together (also with LPCHC internal interrupt
472 * sources) and outputs a single line that raises the PSI LPCHC irq
473 * which then latches an OPB IRQ status register that sends the irq
474 * to PSI.
475 *
476 * We don't honor the polarity register, it's pointless and unused
477 * anyway
478 */
479 if (active_irqs) {
480 lpc->opb_irq_input |= OPB_MASTER_IRQ_LPC;
481 } else {
482 lpc->opb_irq_input &= ~OPB_MASTER_IRQ_LPC;
483 }
484
485 /* Update OPB internal latch */
486 lpc->opb_irq_stat |= lpc->opb_irq_input & lpc->opb_irq_mask;
487
488 qemu_set_irq(lpc->psi_irq_lpchc, lpc->opb_irq_stat != 0);
489 } else {
490 /*
491 * POWER9 and POWER10 have routing fields in OPB master registers that
492 * send LPC irqs to 4 output lines that raise the PSI SERIRQ irqs.
493 * These don't appear to get latched into an OPB register like the
494 * LPCHC irqs.
495 *
496 * POWER9 LPC controller internal irqs still go via the OPB
497 * and LPCHC PSI irqs like P8, but we have no such internal sources
498 * modelled yet.
499 */
500 bool serirq_out[4] = { false, false, false, false };
501 int irq;
502
503 for (irq = 0; irq < ISA_NUM_IRQS; irq++) {
504 if (active_irqs & (LPC_HC_IRQ_SERIRQ0 >> irq)) {
505 serirq_out[lpc->irq_to_serirq_route[irq]] = true;
506 }
507 }
508
509 qemu_set_irq(lpc->psi_irq_serirq[0], serirq_out[0]);
510 qemu_set_irq(lpc->psi_irq_serirq[1], serirq_out[1]);
511 qemu_set_irq(lpc->psi_irq_serirq[2], serirq_out[2]);
512 qemu_set_irq(lpc->psi_irq_serirq[3], serirq_out[3]);
513 }
514 }
515
lpc_hc_read(void * opaque,hwaddr addr,unsigned size)516 static uint64_t lpc_hc_read(void *opaque, hwaddr addr, unsigned size)
517 {
518 PnvLpcController *lpc = opaque;
519 uint64_t val = 0xfffffffffffffffful;
520
521 switch (addr) {
522 case LPC_HC_FW_SEG_IDSEL:
523 val = lpc->lpc_hc_fw_seg_idsel;
524 break;
525 case LPC_HC_FW_RD_ACC_SIZE:
526 val = lpc->lpc_hc_fw_rd_acc_size;
527 break;
528 case LPC_HC_IRQSER_CTRL:
529 val = lpc->lpc_hc_irqser_ctrl;
530 break;
531 case LPC_HC_IRQMASK:
532 val = lpc->lpc_hc_irqmask;
533 break;
534 case LPC_HC_IRQSTAT:
535 val = lpc->lpc_hc_irqstat;
536 break;
537 case LPC_HC_ERROR_ADDRESS:
538 val = lpc->lpc_hc_error_addr;
539 break;
540 default:
541 qemu_log_mask(LOG_UNIMP, "LPC HC Unimplemented register: 0x%"
542 HWADDR_PRIx "\n", addr);
543 }
544 return val;
545 }
546
lpc_hc_write(void * opaque,hwaddr addr,uint64_t val,unsigned size)547 static void lpc_hc_write(void *opaque, hwaddr addr, uint64_t val,
548 unsigned size)
549 {
550 PnvLpcController *lpc = opaque;
551
552 /* XXX Filter out reserved bits */
553
554 switch (addr) {
555 case LPC_HC_FW_SEG_IDSEL:
556 /* XXX Actually figure out how that works as this impact
557 * memory regions/aliases
558 */
559 lpc->lpc_hc_fw_seg_idsel = val;
560 break;
561 case LPC_HC_FW_RD_ACC_SIZE:
562 lpc->lpc_hc_fw_rd_acc_size = val;
563 break;
564 case LPC_HC_IRQSER_CTRL:
565 lpc->lpc_hc_irqser_ctrl = val;
566 pnv_lpc_eval_irqs(lpc);
567 break;
568 case LPC_HC_IRQMASK:
569 lpc->lpc_hc_irqmask = val;
570 pnv_lpc_eval_irqs(lpc);
571 break;
572 case LPC_HC_IRQSTAT:
573 /*
574 * This register is write-to-clear for the IRQSER (LPC device IRQ)
575 * status. However if the device has not de-asserted its interrupt
576 * that will just raise this IRQ status bit again. Model this by
577 * keeping track of the inputs and only clearing if the inputs are
578 * deasserted.
579 */
580 lpc->lpc_hc_irqstat &= ~(val & ~lpc->lpc_hc_irq_inputs);
581 pnv_lpc_eval_irqs(lpc);
582 break;
583 case LPC_HC_ERROR_ADDRESS:
584 break;
585 default:
586 qemu_log_mask(LOG_UNIMP, "LPC HC Unimplemented register: 0x%"
587 HWADDR_PRIx "\n", addr);
588 }
589 }
590
591 static const MemoryRegionOps lpc_hc_ops = {
592 .read = lpc_hc_read,
593 .write = lpc_hc_write,
594 .endianness = DEVICE_BIG_ENDIAN,
595 .valid = {
596 .min_access_size = 4,
597 .max_access_size = 4,
598 },
599 .impl = {
600 .min_access_size = 4,
601 .max_access_size = 4,
602 },
603 };
604
opb_master_read(void * opaque,hwaddr addr,unsigned size)605 static uint64_t opb_master_read(void *opaque, hwaddr addr, unsigned size)
606 {
607 PnvLpcController *lpc = opaque;
608 uint64_t val = 0xfffffffffffffffful;
609
610 switch (addr) {
611 case OPB_MASTER_LS_ROUTE0:
612 val = lpc->opb_irq_route0;
613 break;
614 case OPB_MASTER_LS_ROUTE1:
615 val = lpc->opb_irq_route1;
616 break;
617 case OPB_MASTER_LS_IRQ_STAT:
618 val = lpc->opb_irq_stat;
619 break;
620 case OPB_MASTER_LS_IRQ_MASK:
621 val = lpc->opb_irq_mask;
622 break;
623 case OPB_MASTER_LS_IRQ_POL:
624 val = lpc->opb_irq_pol;
625 break;
626 case OPB_MASTER_LS_IRQ_INPUT:
627 val = lpc->opb_irq_input;
628 break;
629 default:
630 qemu_log_mask(LOG_UNIMP, "OPBM: read on unimplemented register: 0x%"
631 HWADDR_PRIx "\n", addr);
632 }
633
634 return val;
635 }
636
opb_master_write(void * opaque,hwaddr addr,uint64_t val,unsigned size)637 static void opb_master_write(void *opaque, hwaddr addr,
638 uint64_t val, unsigned size)
639 {
640 PnvLpcController *lpc = opaque;
641
642 switch (addr) {
643 case OPB_MASTER_LS_ROUTE0:
644 lpc->opb_irq_route0 = val;
645 pnv_lpc_eval_serirq_routes(lpc);
646 pnv_lpc_eval_irqs(lpc);
647 break;
648 case OPB_MASTER_LS_ROUTE1:
649 lpc->opb_irq_route1 = val;
650 pnv_lpc_eval_serirq_routes(lpc);
651 pnv_lpc_eval_irqs(lpc);
652 break;
653 case OPB_MASTER_LS_IRQ_STAT:
654 lpc->opb_irq_stat &= ~val;
655 pnv_lpc_eval_irqs(lpc);
656 break;
657 case OPB_MASTER_LS_IRQ_MASK:
658 lpc->opb_irq_mask = val;
659 pnv_lpc_eval_irqs(lpc);
660 break;
661 case OPB_MASTER_LS_IRQ_POL:
662 lpc->opb_irq_pol = val;
663 pnv_lpc_eval_irqs(lpc);
664 break;
665 case OPB_MASTER_LS_IRQ_INPUT:
666 /* Read only */
667 break;
668 default:
669 qemu_log_mask(LOG_UNIMP, "OPBM: write on unimplemented register: 0x%"
670 HWADDR_PRIx " val=0x%08"PRIx64"\n", addr, val);
671 }
672 }
673
674 static const MemoryRegionOps opb_master_ops = {
675 .read = opb_master_read,
676 .write = opb_master_write,
677 .endianness = DEVICE_BIG_ENDIAN,
678 .valid = {
679 .min_access_size = 4,
680 .max_access_size = 4,
681 },
682 .impl = {
683 .min_access_size = 4,
684 .max_access_size = 4,
685 },
686 };
687
pnv_lpc_power8_realize(DeviceState * dev,Error ** errp)688 static void pnv_lpc_power8_realize(DeviceState *dev, Error **errp)
689 {
690 PnvLpcController *lpc = PNV_LPC(dev);
691 PnvLpcClass *plc = PNV_LPC_GET_CLASS(dev);
692 Error *local_err = NULL;
693
694 plc->parent_realize(dev, &local_err);
695 if (local_err) {
696 error_propagate(errp, local_err);
697 return;
698 }
699
700 /* P8 uses a XSCOM region for LPC registers */
701 pnv_xscom_region_init(&lpc->xscom_regs, OBJECT(lpc),
702 &pnv_lpc_xscom_ops, lpc, "xscom-lpc",
703 PNV_XSCOM_LPC_SIZE);
704 }
705
pnv_lpc_power8_class_init(ObjectClass * klass,void * data)706 static void pnv_lpc_power8_class_init(ObjectClass *klass, void *data)
707 {
708 DeviceClass *dc = DEVICE_CLASS(klass);
709 PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
710 PnvLpcClass *plc = PNV_LPC_CLASS(klass);
711
712 dc->desc = "PowerNV LPC Controller POWER8";
713
714 xdc->dt_xscom = pnv_lpc_dt_xscom;
715
716 device_class_set_parent_realize(dc, pnv_lpc_power8_realize,
717 &plc->parent_realize);
718 }
719
720 static const TypeInfo pnv_lpc_power8_info = {
721 .name = TYPE_PNV8_LPC,
722 .parent = TYPE_PNV_LPC,
723 .class_init = pnv_lpc_power8_class_init,
724 .interfaces = (InterfaceInfo[]) {
725 { TYPE_PNV_XSCOM_INTERFACE },
726 { }
727 }
728 };
729
pnv_lpc_power9_realize(DeviceState * dev,Error ** errp)730 static void pnv_lpc_power9_realize(DeviceState *dev, Error **errp)
731 {
732 PnvLpcController *lpc = PNV_LPC(dev);
733 PnvLpcClass *plc = PNV_LPC_GET_CLASS(dev);
734 Error *local_err = NULL;
735
736 object_property_set_bool(OBJECT(lpc), "psi-serirq", true, &error_abort);
737
738 plc->parent_realize(dev, &local_err);
739 if (local_err) {
740 error_propagate(errp, local_err);
741 return;
742 }
743
744 /* P9 uses a MMIO region */
745 memory_region_init_io(&lpc->xscom_regs, OBJECT(lpc), &pnv_lpc_mmio_ops,
746 lpc, "lpcm", PNV9_LPCM_SIZE);
747
748 /* P9 LPC routes ISA irqs to 4 PSI SERIRQ lines */
749 qdev_init_gpio_out_named(dev, lpc->psi_irq_serirq, "SERIRQ", 4);
750 }
751
pnv_lpc_power9_class_init(ObjectClass * klass,void * data)752 static void pnv_lpc_power9_class_init(ObjectClass *klass, void *data)
753 {
754 DeviceClass *dc = DEVICE_CLASS(klass);
755 PnvLpcClass *plc = PNV_LPC_CLASS(klass);
756
757 dc->desc = "PowerNV LPC Controller POWER9";
758
759 device_class_set_parent_realize(dc, pnv_lpc_power9_realize,
760 &plc->parent_realize);
761 }
762
763 static const TypeInfo pnv_lpc_power9_info = {
764 .name = TYPE_PNV9_LPC,
765 .parent = TYPE_PNV_LPC,
766 .class_init = pnv_lpc_power9_class_init,
767 };
768
pnv_lpc_power10_class_init(ObjectClass * klass,void * data)769 static void pnv_lpc_power10_class_init(ObjectClass *klass, void *data)
770 {
771 DeviceClass *dc = DEVICE_CLASS(klass);
772
773 dc->desc = "PowerNV LPC Controller POWER10";
774 }
775
776 static const TypeInfo pnv_lpc_power10_info = {
777 .name = TYPE_PNV10_LPC,
778 .parent = TYPE_PNV9_LPC,
779 .class_init = pnv_lpc_power10_class_init,
780 };
781
pnv_lpc_realize(DeviceState * dev,Error ** errp)782 static void pnv_lpc_realize(DeviceState *dev, Error **errp)
783 {
784 PnvLpcController *lpc = PNV_LPC(dev);
785
786 /* Reg inits */
787 lpc->lpc_hc_fw_rd_acc_size = LPC_HC_FW_RD_4B;
788
789 /* Create address space and backing MR for the OPB bus */
790 memory_region_init(&lpc->opb_mr, OBJECT(dev), "lpc-opb", 0x100000000ull);
791 address_space_init(&lpc->opb_as, &lpc->opb_mr, "lpc-opb");
792
793 /* Create ISA IO and Mem space regions which are the root of
794 * the ISA bus (ie, ISA address spaces). We don't create a
795 * separate one for FW which we alias to memory.
796 */
797 memory_region_init(&lpc->isa_io, OBJECT(dev), "isa-io", ISA_IO_SIZE);
798 memory_region_init(&lpc->isa_mem, OBJECT(dev), "isa-mem", ISA_MEM_SIZE);
799 memory_region_init(&lpc->isa_fw, OBJECT(dev), "isa-fw", ISA_FW_SIZE);
800
801 /* Create windows from the OPB space to the ISA space */
802 memory_region_init_alias(&lpc->opb_isa_io, OBJECT(dev), "lpc-isa-io",
803 &lpc->isa_io, 0, LPC_IO_OPB_SIZE);
804 memory_region_add_subregion(&lpc->opb_mr, LPC_IO_OPB_ADDR,
805 &lpc->opb_isa_io);
806 memory_region_init_alias(&lpc->opb_isa_mem, OBJECT(dev), "lpc-isa-mem",
807 &lpc->isa_mem, 0, LPC_MEM_OPB_SIZE);
808 memory_region_add_subregion(&lpc->opb_mr, LPC_MEM_OPB_ADDR,
809 &lpc->opb_isa_mem);
810 memory_region_init_alias(&lpc->opb_isa_fw, OBJECT(dev), "lpc-isa-fw",
811 &lpc->isa_fw, 0, LPC_FW_OPB_SIZE);
812 memory_region_add_subregion(&lpc->opb_mr, LPC_FW_OPB_ADDR,
813 &lpc->opb_isa_fw);
814
815 /* Create MMIO regions for LPC HC and OPB registers */
816 memory_region_init_io(&lpc->opb_master_regs, OBJECT(dev), &opb_master_ops,
817 lpc, "lpc-opb-master", LPC_OPB_REGS_OPB_SIZE);
818 lpc->opb_master_regs.disable_reentrancy_guard = true;
819 memory_region_add_subregion(&lpc->opb_mr, LPC_OPB_REGS_OPB_ADDR,
820 &lpc->opb_master_regs);
821 memory_region_init_io(&lpc->lpc_hc_regs, OBJECT(dev), &lpc_hc_ops, lpc,
822 "lpc-hc", LPC_HC_REGS_OPB_SIZE);
823 /* xscom writes to lpc-hc. As such mark lpc-hc re-entrancy safe */
824 lpc->lpc_hc_regs.disable_reentrancy_guard = true;
825 memory_region_add_subregion(&lpc->opb_mr, LPC_HC_REGS_OPB_ADDR,
826 &lpc->lpc_hc_regs);
827
828 qdev_init_gpio_out_named(dev, &lpc->psi_irq_lpchc, "LPCHC", 1);
829 }
830
831 static Property pnv_lpc_properties[] = {
832 DEFINE_PROP_BOOL("psi-serirq", PnvLpcController, psi_has_serirq, false),
833 DEFINE_PROP_END_OF_LIST(),
834 };
835
pnv_lpc_class_init(ObjectClass * klass,void * data)836 static void pnv_lpc_class_init(ObjectClass *klass, void *data)
837 {
838 DeviceClass *dc = DEVICE_CLASS(klass);
839
840 device_class_set_props(dc, pnv_lpc_properties);
841 dc->realize = pnv_lpc_realize;
842 dc->desc = "PowerNV LPC Controller";
843 dc->user_creatable = false;
844 }
845
846 static const TypeInfo pnv_lpc_info = {
847 .name = TYPE_PNV_LPC,
848 .parent = TYPE_DEVICE,
849 .instance_size = sizeof(PnvLpcController),
850 .class_init = pnv_lpc_class_init,
851 .class_size = sizeof(PnvLpcClass),
852 .abstract = true,
853 };
854
pnv_lpc_register_types(void)855 static void pnv_lpc_register_types(void)
856 {
857 type_register_static(&pnv_lpc_info);
858 type_register_static(&pnv_lpc_power8_info);
859 type_register_static(&pnv_lpc_power9_info);
860 type_register_static(&pnv_lpc_power10_info);
861 }
862
type_init(pnv_lpc_register_types)863 type_init(pnv_lpc_register_types)
864
865 /* If we don't use the built-in LPC interrupt deserializer, we need
866 * to provide a set of qirqs for the ISA bus or things will go bad.
867 *
868 * Most machines using pre-Naples chips (without said deserializer)
869 * have a CPLD that will collect the SerIRQ and shoot them as a
870 * single level interrupt to the P8 chip. So let's setup a hook
871 * for doing just that.
872 */
873 static void pnv_lpc_isa_irq_handler_cpld(void *opaque, int n, int level)
874 {
875 PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
876 uint32_t old_state = pnv->cpld_irqstate;
877 PnvLpcController *lpc = PNV_LPC(opaque);
878
879 if (level) {
880 pnv->cpld_irqstate |= 1u << n;
881 } else {
882 pnv->cpld_irqstate &= ~(1u << n);
883 }
884
885 if (pnv->cpld_irqstate != old_state) {
886 qemu_set_irq(lpc->psi_irq_lpchc, pnv->cpld_irqstate != 0);
887 }
888 }
889
pnv_lpc_isa_irq_handler(void * opaque,int n,int level)890 static void pnv_lpc_isa_irq_handler(void *opaque, int n, int level)
891 {
892 PnvLpcController *lpc = PNV_LPC(opaque);
893 uint32_t irq_bit = LPC_HC_IRQ_SERIRQ0 >> n;
894
895 if (level) {
896 lpc->lpc_hc_irq_inputs |= irq_bit;
897
898 /*
899 * The LPC HC in Naples and later latches LPC IRQ into a bit field in
900 * the IRQSTAT register, and that drives the PSI IRQ to the IC.
901 * Software clears this bit manually (see LPC_HC_IRQSTAT handler).
902 */
903 lpc->lpc_hc_irqstat |= irq_bit;
904 pnv_lpc_eval_irqs(lpc);
905 } else {
906 lpc->lpc_hc_irq_inputs &= ~irq_bit;
907
908 /* POWER9 adds an auto-clear mode that clears IRQSTAT bits on EOI */
909 if (lpc->psi_has_serirq &&
910 (lpc->lpc_hc_irqser_ctrl & LPC_HC_IRQSER_AUTO_CLEAR)) {
911 lpc->lpc_hc_irqstat &= ~irq_bit;
912 pnv_lpc_eval_irqs(lpc);
913 }
914 }
915 }
916
pnv_lpc_isa_create(PnvLpcController * lpc,bool use_cpld,Error ** errp)917 ISABus *pnv_lpc_isa_create(PnvLpcController *lpc, bool use_cpld, Error **errp)
918 {
919 Error *local_err = NULL;
920 ISABus *isa_bus;
921 qemu_irq *irqs;
922 qemu_irq_handler handler;
923
924 /* let isa_bus_new() create its own bridge on SysBus otherwise
925 * devices specified on the command line won't find the bus and
926 * will fail to create.
927 */
928 isa_bus = isa_bus_new(NULL, &lpc->isa_mem, &lpc->isa_io, &local_err);
929 if (local_err) {
930 error_propagate(errp, local_err);
931 return NULL;
932 }
933
934 /* Not all variants have a working serial irq decoder. If not,
935 * handling of LPC interrupts becomes a platform issue (some
936 * platforms have a CPLD to do it).
937 */
938 if (use_cpld) {
939 handler = pnv_lpc_isa_irq_handler_cpld;
940 } else {
941 handler = pnv_lpc_isa_irq_handler;
942 }
943
944 /* POWER has a 17th irq, QEMU only implements the 16 regular device irqs */
945 irqs = qemu_allocate_irqs(handler, lpc, ISA_NUM_IRQS);
946
947 isa_bus_register_input_irqs(isa_bus, irqs);
948
949 return isa_bus;
950 }
951