usb: limit combined packets to 1 MiB (CVE-2021-3527)
[qemu/kevin.git] / hw / ppc / pnv_lpc.c
blobbcbca3db9743a2e64dd277b872a5ad6e08d5e283
1 /*
2 * QEMU PowerPC PowerNV LPC controller
4 * Copyright (c) 2016, IBM Corporation.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
21 #include "target/ppc/cpu.h"
22 #include "qapi/error.h"
23 #include "qemu/log.h"
24 #include "qemu/module.h"
25 #include "hw/irq.h"
26 #include "hw/isa/isa.h"
27 #include "hw/qdev-properties.h"
28 #include "hw/ppc/pnv.h"
29 #include "hw/ppc/pnv_lpc.h"
30 #include "hw/ppc/pnv_xscom.h"
31 #include "hw/ppc/fdt.h"
33 #include <libfdt.h>
35 enum {
36 ECCB_CTL = 0,
37 ECCB_RESET = 1,
38 ECCB_STAT = 2,
39 ECCB_DATA = 3,
42 /* OPB Master LS registers */
43 #define OPB_MASTER_LS_ROUTE0 0x8
44 #define OPB_MASTER_LS_ROUTE1 0xC
45 #define OPB_MASTER_LS_IRQ_STAT 0x50
46 #define OPB_MASTER_IRQ_LPC 0x00000800
47 #define OPB_MASTER_LS_IRQ_MASK 0x54
48 #define OPB_MASTER_LS_IRQ_POL 0x58
49 #define OPB_MASTER_LS_IRQ_INPUT 0x5c
51 /* LPC HC registers */
52 #define LPC_HC_FW_SEG_IDSEL 0x24
53 #define LPC_HC_FW_RD_ACC_SIZE 0x28
54 #define LPC_HC_FW_RD_1B 0x00000000
55 #define LPC_HC_FW_RD_2B 0x01000000
56 #define LPC_HC_FW_RD_4B 0x02000000
57 #define LPC_HC_FW_RD_16B 0x04000000
58 #define LPC_HC_FW_RD_128B 0x07000000
59 #define LPC_HC_IRQSER_CTRL 0x30
60 #define LPC_HC_IRQSER_EN 0x80000000
61 #define LPC_HC_IRQSER_QMODE 0x40000000
62 #define LPC_HC_IRQSER_START_MASK 0x03000000
63 #define LPC_HC_IRQSER_START_4CLK 0x00000000
64 #define LPC_HC_IRQSER_START_6CLK 0x01000000
65 #define LPC_HC_IRQSER_START_8CLK 0x02000000
66 #define LPC_HC_IRQMASK 0x34 /* same bit defs as LPC_HC_IRQSTAT */
67 #define LPC_HC_IRQSTAT 0x38
68 #define LPC_HC_IRQ_SERIRQ0 0x80000000 /* all bits down to ... */
69 #define LPC_HC_IRQ_SERIRQ16 0x00008000 /* IRQ16=IOCHK#, IRQ2=SMI# */
70 #define LPC_HC_IRQ_SERIRQ_ALL 0xffff8000
71 #define LPC_HC_IRQ_LRESET 0x00000400
72 #define LPC_HC_IRQ_SYNC_ABNORM_ERR 0x00000080
73 #define LPC_HC_IRQ_SYNC_NORESP_ERR 0x00000040
74 #define LPC_HC_IRQ_SYNC_NORM_ERR 0x00000020
75 #define LPC_HC_IRQ_SYNC_TIMEOUT_ERR 0x00000010
76 #define LPC_HC_IRQ_SYNC_TARG_TAR_ERR 0x00000008
77 #define LPC_HC_IRQ_SYNC_BM_TAR_ERR 0x00000004
78 #define LPC_HC_IRQ_SYNC_BM0_REQ 0x00000002
79 #define LPC_HC_IRQ_SYNC_BM1_REQ 0x00000001
80 #define LPC_HC_ERROR_ADDRESS 0x40
82 #define LPC_OPB_SIZE 0x100000000ull
84 #define ISA_IO_SIZE 0x00010000
85 #define ISA_MEM_SIZE 0x10000000
86 #define ISA_FW_SIZE 0x10000000
87 #define LPC_IO_OPB_ADDR 0xd0010000
88 #define LPC_IO_OPB_SIZE 0x00010000
89 #define LPC_MEM_OPB_ADDR 0xe0000000
90 #define LPC_MEM_OPB_SIZE 0x10000000
91 #define LPC_FW_OPB_ADDR 0xf0000000
92 #define LPC_FW_OPB_SIZE 0x10000000
94 #define LPC_OPB_REGS_OPB_ADDR 0xc0010000
95 #define LPC_OPB_REGS_OPB_SIZE 0x00000060
96 #define LPC_OPB_REGS_OPBA_ADDR 0xc0011000
97 #define LPC_OPB_REGS_OPBA_SIZE 0x00000008
98 #define LPC_HC_REGS_OPB_ADDR 0xc0012000
99 #define LPC_HC_REGS_OPB_SIZE 0x00000100
101 static int pnv_lpc_dt_xscom(PnvXScomInterface *dev, void *fdt, int xscom_offset)
103 const char compat[] = "ibm,power8-lpc\0ibm,lpc";
104 char *name;
105 int offset;
106 uint32_t lpc_pcba = PNV_XSCOM_LPC_BASE;
107 uint32_t reg[] = {
108 cpu_to_be32(lpc_pcba),
109 cpu_to_be32(PNV_XSCOM_LPC_SIZE)
112 name = g_strdup_printf("isa@%x", lpc_pcba);
113 offset = fdt_add_subnode(fdt, xscom_offset, name);
114 _FDT(offset);
115 g_free(name);
117 _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
118 _FDT((fdt_setprop_cell(fdt, offset, "#address-cells", 2)));
119 _FDT((fdt_setprop_cell(fdt, offset, "#size-cells", 1)));
120 _FDT((fdt_setprop(fdt, offset, "compatible", compat, sizeof(compat))));
121 return 0;
124 /* POWER9 only */
125 int pnv_dt_lpc(PnvChip *chip, void *fdt, int root_offset, uint64_t lpcm_addr,
126 uint64_t lpcm_size)
128 const char compat[] = "ibm,power9-lpcm-opb\0simple-bus";
129 const char lpc_compat[] = "ibm,power9-lpc\0ibm,lpc";
130 char *name;
131 int offset, lpcm_offset;
132 uint32_t opb_ranges[8] = { 0,
133 cpu_to_be32(lpcm_addr >> 32),
134 cpu_to_be32((uint32_t)lpcm_addr),
135 cpu_to_be32(lpcm_size / 2),
136 cpu_to_be32(lpcm_size / 2),
137 cpu_to_be32(lpcm_addr >> 32),
138 cpu_to_be32(lpcm_size / 2),
139 cpu_to_be32(lpcm_size / 2),
141 uint32_t opb_reg[4] = { cpu_to_be32(lpcm_addr >> 32),
142 cpu_to_be32((uint32_t)lpcm_addr),
143 cpu_to_be32(lpcm_size >> 32),
144 cpu_to_be32((uint32_t)lpcm_size),
146 uint32_t lpc_ranges[12] = { 0, 0,
147 cpu_to_be32(LPC_MEM_OPB_ADDR),
148 cpu_to_be32(LPC_MEM_OPB_SIZE),
149 cpu_to_be32(1), 0,
150 cpu_to_be32(LPC_IO_OPB_ADDR),
151 cpu_to_be32(LPC_IO_OPB_SIZE),
152 cpu_to_be32(3), 0,
153 cpu_to_be32(LPC_FW_OPB_ADDR),
154 cpu_to_be32(LPC_FW_OPB_SIZE),
156 uint32_t reg[2];
159 * OPB bus
161 name = g_strdup_printf("lpcm-opb@%"PRIx64, lpcm_addr);
162 lpcm_offset = fdt_add_subnode(fdt, root_offset, name);
163 _FDT(lpcm_offset);
164 g_free(name);
166 _FDT((fdt_setprop(fdt, lpcm_offset, "reg", opb_reg, sizeof(opb_reg))));
167 _FDT((fdt_setprop_cell(fdt, lpcm_offset, "#address-cells", 1)));
168 _FDT((fdt_setprop_cell(fdt, lpcm_offset, "#size-cells", 1)));
169 _FDT((fdt_setprop(fdt, lpcm_offset, "compatible", compat, sizeof(compat))));
170 _FDT((fdt_setprop_cell(fdt, lpcm_offset, "ibm,chip-id", chip->chip_id)));
171 _FDT((fdt_setprop(fdt, lpcm_offset, "ranges", opb_ranges,
172 sizeof(opb_ranges))));
175 * OPB Master registers
177 name = g_strdup_printf("opb-master@%x", LPC_OPB_REGS_OPB_ADDR);
178 offset = fdt_add_subnode(fdt, lpcm_offset, name);
179 _FDT(offset);
180 g_free(name);
182 reg[0] = cpu_to_be32(LPC_OPB_REGS_OPB_ADDR);
183 reg[1] = cpu_to_be32(LPC_OPB_REGS_OPB_SIZE);
184 _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
185 _FDT((fdt_setprop_string(fdt, offset, "compatible",
186 "ibm,power9-lpcm-opb-master")));
189 * OPB arbitrer registers
191 name = g_strdup_printf("opb-arbitrer@%x", LPC_OPB_REGS_OPBA_ADDR);
192 offset = fdt_add_subnode(fdt, lpcm_offset, name);
193 _FDT(offset);
194 g_free(name);
196 reg[0] = cpu_to_be32(LPC_OPB_REGS_OPBA_ADDR);
197 reg[1] = cpu_to_be32(LPC_OPB_REGS_OPBA_SIZE);
198 _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
199 _FDT((fdt_setprop_string(fdt, offset, "compatible",
200 "ibm,power9-lpcm-opb-arbiter")));
203 * LPC Host Controller registers
205 name = g_strdup_printf("lpc-controller@%x", LPC_HC_REGS_OPB_ADDR);
206 offset = fdt_add_subnode(fdt, lpcm_offset, name);
207 _FDT(offset);
208 g_free(name);
210 reg[0] = cpu_to_be32(LPC_HC_REGS_OPB_ADDR);
211 reg[1] = cpu_to_be32(LPC_HC_REGS_OPB_SIZE);
212 _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
213 _FDT((fdt_setprop_string(fdt, offset, "compatible",
214 "ibm,power9-lpc-controller")));
216 name = g_strdup_printf("lpc@0");
217 offset = fdt_add_subnode(fdt, lpcm_offset, name);
218 _FDT(offset);
219 g_free(name);
220 _FDT((fdt_setprop_cell(fdt, offset, "#address-cells", 2)));
221 _FDT((fdt_setprop_cell(fdt, offset, "#size-cells", 1)));
222 _FDT((fdt_setprop(fdt, offset, "compatible", lpc_compat,
223 sizeof(lpc_compat))));
224 _FDT((fdt_setprop(fdt, offset, "ranges", lpc_ranges,
225 sizeof(lpc_ranges))));
227 return 0;
231 * These read/write handlers of the OPB address space should be common
232 * with the P9 LPC Controller which uses direct MMIOs.
234 * TODO: rework to use address_space_stq() and address_space_ldq()
235 * instead.
237 static bool opb_read(PnvLpcController *lpc, uint32_t addr, uint8_t *data,
238 int sz)
240 /* XXX Handle access size limits and FW read caching here */
241 return !address_space_read(&lpc->opb_as, addr, MEMTXATTRS_UNSPECIFIED,
242 data, sz);
245 static bool opb_write(PnvLpcController *lpc, uint32_t addr, uint8_t *data,
246 int sz)
248 /* XXX Handle access size limits here */
249 return !address_space_write(&lpc->opb_as, addr, MEMTXATTRS_UNSPECIFIED,
250 data, sz);
253 #define ECCB_CTL_READ PPC_BIT(15)
254 #define ECCB_CTL_SZ_LSH (63 - 7)
255 #define ECCB_CTL_SZ_MASK PPC_BITMASK(4, 7)
256 #define ECCB_CTL_ADDR_MASK PPC_BITMASK(32, 63)
258 #define ECCB_STAT_OP_DONE PPC_BIT(52)
259 #define ECCB_STAT_OP_ERR PPC_BIT(52)
260 #define ECCB_STAT_RD_DATA_LSH (63 - 37)
261 #define ECCB_STAT_RD_DATA_MASK (0xffffffff << ECCB_STAT_RD_DATA_LSH)
263 static void pnv_lpc_do_eccb(PnvLpcController *lpc, uint64_t cmd)
265 /* XXX Check for magic bits at the top, addr size etc... */
266 unsigned int sz = (cmd & ECCB_CTL_SZ_MASK) >> ECCB_CTL_SZ_LSH;
267 uint32_t opb_addr = cmd & ECCB_CTL_ADDR_MASK;
268 uint8_t data[8];
269 bool success;
271 if (sz > sizeof(data)) {
272 qemu_log_mask(LOG_GUEST_ERROR,
273 "ECCB: invalid operation at @0x%08x size %d\n", opb_addr, sz);
274 return;
277 if (cmd & ECCB_CTL_READ) {
278 success = opb_read(lpc, opb_addr, data, sz);
279 if (success) {
280 lpc->eccb_stat_reg = ECCB_STAT_OP_DONE |
281 (((uint64_t)data[0]) << 24 |
282 ((uint64_t)data[1]) << 16 |
283 ((uint64_t)data[2]) << 8 |
284 ((uint64_t)data[3])) << ECCB_STAT_RD_DATA_LSH;
285 } else {
286 lpc->eccb_stat_reg = ECCB_STAT_OP_DONE |
287 (0xffffffffull << ECCB_STAT_RD_DATA_LSH);
289 } else {
290 data[0] = lpc->eccb_data_reg >> 24;
291 data[1] = lpc->eccb_data_reg >> 16;
292 data[2] = lpc->eccb_data_reg >> 8;
293 data[3] = lpc->eccb_data_reg;
295 success = opb_write(lpc, opb_addr, data, sz);
296 lpc->eccb_stat_reg = ECCB_STAT_OP_DONE;
298 /* XXX Which error bit (if any) to signal OPB error ? */
301 static uint64_t pnv_lpc_xscom_read(void *opaque, hwaddr addr, unsigned size)
303 PnvLpcController *lpc = PNV_LPC(opaque);
304 uint32_t offset = addr >> 3;
305 uint64_t val = 0;
307 switch (offset & 3) {
308 case ECCB_CTL:
309 case ECCB_RESET:
310 val = 0;
311 break;
312 case ECCB_STAT:
313 val = lpc->eccb_stat_reg;
314 lpc->eccb_stat_reg = 0;
315 break;
316 case ECCB_DATA:
317 val = ((uint64_t)lpc->eccb_data_reg) << 32;
318 break;
320 return val;
323 static void pnv_lpc_xscom_write(void *opaque, hwaddr addr,
324 uint64_t val, unsigned size)
326 PnvLpcController *lpc = PNV_LPC(opaque);
327 uint32_t offset = addr >> 3;
329 switch (offset & 3) {
330 case ECCB_CTL:
331 pnv_lpc_do_eccb(lpc, val);
332 break;
333 case ECCB_RESET:
334 /* XXXX */
335 break;
336 case ECCB_STAT:
337 break;
338 case ECCB_DATA:
339 lpc->eccb_data_reg = val >> 32;
340 break;
344 static const MemoryRegionOps pnv_lpc_xscom_ops = {
345 .read = pnv_lpc_xscom_read,
346 .write = pnv_lpc_xscom_write,
347 .valid.min_access_size = 8,
348 .valid.max_access_size = 8,
349 .impl.min_access_size = 8,
350 .impl.max_access_size = 8,
351 .endianness = DEVICE_BIG_ENDIAN,
354 static uint64_t pnv_lpc_mmio_read(void *opaque, hwaddr addr, unsigned size)
356 PnvLpcController *lpc = PNV_LPC(opaque);
357 uint64_t val = 0;
358 uint32_t opb_addr = addr & ECCB_CTL_ADDR_MASK;
359 MemTxResult result;
361 switch (size) {
362 case 4:
363 val = address_space_ldl(&lpc->opb_as, opb_addr, MEMTXATTRS_UNSPECIFIED,
364 &result);
365 break;
366 case 1:
367 val = address_space_ldub(&lpc->opb_as, opb_addr, MEMTXATTRS_UNSPECIFIED,
368 &result);
369 break;
370 default:
371 qemu_log_mask(LOG_GUEST_ERROR, "OPB read failed at @0x%"
372 HWADDR_PRIx " invalid size %d\n", addr, size);
373 return 0;
376 if (result != MEMTX_OK) {
377 qemu_log_mask(LOG_GUEST_ERROR, "OPB read failed at @0x%"
378 HWADDR_PRIx "\n", addr);
381 return val;
384 static void pnv_lpc_mmio_write(void *opaque, hwaddr addr,
385 uint64_t val, unsigned size)
387 PnvLpcController *lpc = PNV_LPC(opaque);
388 uint32_t opb_addr = addr & ECCB_CTL_ADDR_MASK;
389 MemTxResult result;
391 switch (size) {
392 case 4:
393 address_space_stl(&lpc->opb_as, opb_addr, val, MEMTXATTRS_UNSPECIFIED,
394 &result);
395 break;
396 case 1:
397 address_space_stb(&lpc->opb_as, opb_addr, val, MEMTXATTRS_UNSPECIFIED,
398 &result);
399 break;
400 default:
401 qemu_log_mask(LOG_GUEST_ERROR, "OPB write failed at @0x%"
402 HWADDR_PRIx " invalid size %d\n", addr, size);
403 return;
406 if (result != MEMTX_OK) {
407 qemu_log_mask(LOG_GUEST_ERROR, "OPB write failed at @0x%"
408 HWADDR_PRIx "\n", addr);
412 static const MemoryRegionOps pnv_lpc_mmio_ops = {
413 .read = pnv_lpc_mmio_read,
414 .write = pnv_lpc_mmio_write,
415 .impl = {
416 .min_access_size = 1,
417 .max_access_size = 4,
419 .endianness = DEVICE_BIG_ENDIAN,
422 static void pnv_lpc_eval_irqs(PnvLpcController *lpc)
424 bool lpc_to_opb_irq = false;
425 PnvLpcClass *plc = PNV_LPC_GET_CLASS(lpc);
427 /* Update LPC controller to OPB line */
428 if (lpc->lpc_hc_irqser_ctrl & LPC_HC_IRQSER_EN) {
429 uint32_t irqs;
431 irqs = lpc->lpc_hc_irqstat & lpc->lpc_hc_irqmask;
432 lpc_to_opb_irq = (irqs != 0);
435 /* We don't honor the polarity register, it's pointless and unused
436 * anyway
438 if (lpc_to_opb_irq) {
439 lpc->opb_irq_input |= OPB_MASTER_IRQ_LPC;
440 } else {
441 lpc->opb_irq_input &= ~OPB_MASTER_IRQ_LPC;
444 /* Update OPB internal latch */
445 lpc->opb_irq_stat |= lpc->opb_irq_input & lpc->opb_irq_mask;
447 /* Reflect the interrupt */
448 pnv_psi_irq_set(lpc->psi, plc->psi_irq, lpc->opb_irq_stat != 0);
451 static uint64_t lpc_hc_read(void *opaque, hwaddr addr, unsigned size)
453 PnvLpcController *lpc = opaque;
454 uint64_t val = 0xfffffffffffffffful;
456 switch (addr) {
457 case LPC_HC_FW_SEG_IDSEL:
458 val = lpc->lpc_hc_fw_seg_idsel;
459 break;
460 case LPC_HC_FW_RD_ACC_SIZE:
461 val = lpc->lpc_hc_fw_rd_acc_size;
462 break;
463 case LPC_HC_IRQSER_CTRL:
464 val = lpc->lpc_hc_irqser_ctrl;
465 break;
466 case LPC_HC_IRQMASK:
467 val = lpc->lpc_hc_irqmask;
468 break;
469 case LPC_HC_IRQSTAT:
470 val = lpc->lpc_hc_irqstat;
471 break;
472 case LPC_HC_ERROR_ADDRESS:
473 val = lpc->lpc_hc_error_addr;
474 break;
475 default:
476 qemu_log_mask(LOG_UNIMP, "LPC HC Unimplemented register: 0x%"
477 HWADDR_PRIx "\n", addr);
479 return val;
482 static void lpc_hc_write(void *opaque, hwaddr addr, uint64_t val,
483 unsigned size)
485 PnvLpcController *lpc = opaque;
487 /* XXX Filter out reserved bits */
489 switch (addr) {
490 case LPC_HC_FW_SEG_IDSEL:
491 /* XXX Actually figure out how that works as this impact
492 * memory regions/aliases
494 lpc->lpc_hc_fw_seg_idsel = val;
495 break;
496 case LPC_HC_FW_RD_ACC_SIZE:
497 lpc->lpc_hc_fw_rd_acc_size = val;
498 break;
499 case LPC_HC_IRQSER_CTRL:
500 lpc->lpc_hc_irqser_ctrl = val;
501 pnv_lpc_eval_irqs(lpc);
502 break;
503 case LPC_HC_IRQMASK:
504 lpc->lpc_hc_irqmask = val;
505 pnv_lpc_eval_irqs(lpc);
506 break;
507 case LPC_HC_IRQSTAT:
508 lpc->lpc_hc_irqstat &= ~val;
509 pnv_lpc_eval_irqs(lpc);
510 break;
511 case LPC_HC_ERROR_ADDRESS:
512 break;
513 default:
514 qemu_log_mask(LOG_UNIMP, "LPC HC Unimplemented register: 0x%"
515 HWADDR_PRIx "\n", addr);
519 static const MemoryRegionOps lpc_hc_ops = {
520 .read = lpc_hc_read,
521 .write = lpc_hc_write,
522 .endianness = DEVICE_BIG_ENDIAN,
523 .valid = {
524 .min_access_size = 4,
525 .max_access_size = 4,
527 .impl = {
528 .min_access_size = 4,
529 .max_access_size = 4,
533 static uint64_t opb_master_read(void *opaque, hwaddr addr, unsigned size)
535 PnvLpcController *lpc = opaque;
536 uint64_t val = 0xfffffffffffffffful;
538 switch (addr) {
539 case OPB_MASTER_LS_ROUTE0: /* TODO */
540 val = lpc->opb_irq_route0;
541 break;
542 case OPB_MASTER_LS_ROUTE1: /* TODO */
543 val = lpc->opb_irq_route1;
544 break;
545 case OPB_MASTER_LS_IRQ_STAT:
546 val = lpc->opb_irq_stat;
547 break;
548 case OPB_MASTER_LS_IRQ_MASK:
549 val = lpc->opb_irq_mask;
550 break;
551 case OPB_MASTER_LS_IRQ_POL:
552 val = lpc->opb_irq_pol;
553 break;
554 case OPB_MASTER_LS_IRQ_INPUT:
555 val = lpc->opb_irq_input;
556 break;
557 default:
558 qemu_log_mask(LOG_UNIMP, "OPBM: read on unimplemented register: 0x%"
559 HWADDR_PRIx "\n", addr);
562 return val;
565 static void opb_master_write(void *opaque, hwaddr addr,
566 uint64_t val, unsigned size)
568 PnvLpcController *lpc = opaque;
570 switch (addr) {
571 case OPB_MASTER_LS_ROUTE0: /* TODO */
572 lpc->opb_irq_route0 = val;
573 break;
574 case OPB_MASTER_LS_ROUTE1: /* TODO */
575 lpc->opb_irq_route1 = val;
576 break;
577 case OPB_MASTER_LS_IRQ_STAT:
578 lpc->opb_irq_stat &= ~val;
579 pnv_lpc_eval_irqs(lpc);
580 break;
581 case OPB_MASTER_LS_IRQ_MASK:
582 lpc->opb_irq_mask = val;
583 pnv_lpc_eval_irqs(lpc);
584 break;
585 case OPB_MASTER_LS_IRQ_POL:
586 lpc->opb_irq_pol = val;
587 pnv_lpc_eval_irqs(lpc);
588 break;
589 case OPB_MASTER_LS_IRQ_INPUT:
590 /* Read only */
591 break;
592 default:
593 qemu_log_mask(LOG_UNIMP, "OPBM: write on unimplemented register: 0x%"
594 HWADDR_PRIx " val=0x%08"PRIx64"\n", addr, val);
598 static const MemoryRegionOps opb_master_ops = {
599 .read = opb_master_read,
600 .write = opb_master_write,
601 .endianness = DEVICE_BIG_ENDIAN,
602 .valid = {
603 .min_access_size = 4,
604 .max_access_size = 4,
606 .impl = {
607 .min_access_size = 4,
608 .max_access_size = 4,
612 static void pnv_lpc_power8_realize(DeviceState *dev, Error **errp)
614 PnvLpcController *lpc = PNV_LPC(dev);
615 PnvLpcClass *plc = PNV_LPC_GET_CLASS(dev);
616 Error *local_err = NULL;
618 plc->parent_realize(dev, &local_err);
619 if (local_err) {
620 error_propagate(errp, local_err);
621 return;
624 /* P8 uses a XSCOM region for LPC registers */
625 pnv_xscom_region_init(&lpc->xscom_regs, OBJECT(lpc),
626 &pnv_lpc_xscom_ops, lpc, "xscom-lpc",
627 PNV_XSCOM_LPC_SIZE);
630 static void pnv_lpc_power8_class_init(ObjectClass *klass, void *data)
632 DeviceClass *dc = DEVICE_CLASS(klass);
633 PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
634 PnvLpcClass *plc = PNV_LPC_CLASS(klass);
636 dc->desc = "PowerNV LPC Controller POWER8";
638 xdc->dt_xscom = pnv_lpc_dt_xscom;
640 plc->psi_irq = PSIHB_IRQ_LPC_I2C;
642 device_class_set_parent_realize(dc, pnv_lpc_power8_realize,
643 &plc->parent_realize);
646 static const TypeInfo pnv_lpc_power8_info = {
647 .name = TYPE_PNV8_LPC,
648 .parent = TYPE_PNV_LPC,
649 .class_init = pnv_lpc_power8_class_init,
650 .interfaces = (InterfaceInfo[]) {
651 { TYPE_PNV_XSCOM_INTERFACE },
656 static void pnv_lpc_power9_realize(DeviceState *dev, Error **errp)
658 PnvLpcController *lpc = PNV_LPC(dev);
659 PnvLpcClass *plc = PNV_LPC_GET_CLASS(dev);
660 Error *local_err = NULL;
662 plc->parent_realize(dev, &local_err);
663 if (local_err) {
664 error_propagate(errp, local_err);
665 return;
668 /* P9 uses a MMIO region */
669 memory_region_init_io(&lpc->xscom_regs, OBJECT(lpc), &pnv_lpc_mmio_ops,
670 lpc, "lpcm", PNV9_LPCM_SIZE);
673 static void pnv_lpc_power9_class_init(ObjectClass *klass, void *data)
675 DeviceClass *dc = DEVICE_CLASS(klass);
676 PnvLpcClass *plc = PNV_LPC_CLASS(klass);
678 dc->desc = "PowerNV LPC Controller POWER9";
680 plc->psi_irq = PSIHB9_IRQ_LPCHC;
682 device_class_set_parent_realize(dc, pnv_lpc_power9_realize,
683 &plc->parent_realize);
686 static const TypeInfo pnv_lpc_power9_info = {
687 .name = TYPE_PNV9_LPC,
688 .parent = TYPE_PNV_LPC,
689 .class_init = pnv_lpc_power9_class_init,
692 static void pnv_lpc_power10_class_init(ObjectClass *klass, void *data)
694 DeviceClass *dc = DEVICE_CLASS(klass);
696 dc->desc = "PowerNV LPC Controller POWER10";
699 static const TypeInfo pnv_lpc_power10_info = {
700 .name = TYPE_PNV10_LPC,
701 .parent = TYPE_PNV9_LPC,
702 .class_init = pnv_lpc_power10_class_init,
705 static void pnv_lpc_realize(DeviceState *dev, Error **errp)
707 PnvLpcController *lpc = PNV_LPC(dev);
709 assert(lpc->psi);
711 /* Reg inits */
712 lpc->lpc_hc_fw_rd_acc_size = LPC_HC_FW_RD_4B;
714 /* Create address space and backing MR for the OPB bus */
715 memory_region_init(&lpc->opb_mr, OBJECT(dev), "lpc-opb", 0x100000000ull);
716 address_space_init(&lpc->opb_as, &lpc->opb_mr, "lpc-opb");
718 /* Create ISA IO and Mem space regions which are the root of
719 * the ISA bus (ie, ISA address spaces). We don't create a
720 * separate one for FW which we alias to memory.
722 memory_region_init(&lpc->isa_io, OBJECT(dev), "isa-io", ISA_IO_SIZE);
723 memory_region_init(&lpc->isa_mem, OBJECT(dev), "isa-mem", ISA_MEM_SIZE);
724 memory_region_init(&lpc->isa_fw, OBJECT(dev), "isa-fw", ISA_FW_SIZE);
726 /* Create windows from the OPB space to the ISA space */
727 memory_region_init_alias(&lpc->opb_isa_io, OBJECT(dev), "lpc-isa-io",
728 &lpc->isa_io, 0, LPC_IO_OPB_SIZE);
729 memory_region_add_subregion(&lpc->opb_mr, LPC_IO_OPB_ADDR,
730 &lpc->opb_isa_io);
731 memory_region_init_alias(&lpc->opb_isa_mem, OBJECT(dev), "lpc-isa-mem",
732 &lpc->isa_mem, 0, LPC_MEM_OPB_SIZE);
733 memory_region_add_subregion(&lpc->opb_mr, LPC_MEM_OPB_ADDR,
734 &lpc->opb_isa_mem);
735 memory_region_init_alias(&lpc->opb_isa_fw, OBJECT(dev), "lpc-isa-fw",
736 &lpc->isa_fw, 0, LPC_FW_OPB_SIZE);
737 memory_region_add_subregion(&lpc->opb_mr, LPC_FW_OPB_ADDR,
738 &lpc->opb_isa_fw);
740 /* Create MMIO regions for LPC HC and OPB registers */
741 memory_region_init_io(&lpc->opb_master_regs, OBJECT(dev), &opb_master_ops,
742 lpc, "lpc-opb-master", LPC_OPB_REGS_OPB_SIZE);
743 memory_region_add_subregion(&lpc->opb_mr, LPC_OPB_REGS_OPB_ADDR,
744 &lpc->opb_master_regs);
745 memory_region_init_io(&lpc->lpc_hc_regs, OBJECT(dev), &lpc_hc_ops, lpc,
746 "lpc-hc", LPC_HC_REGS_OPB_SIZE);
747 memory_region_add_subregion(&lpc->opb_mr, LPC_HC_REGS_OPB_ADDR,
748 &lpc->lpc_hc_regs);
751 static Property pnv_lpc_properties[] = {
752 DEFINE_PROP_LINK("psi", PnvLpcController, psi, TYPE_PNV_PSI, PnvPsi *),
753 DEFINE_PROP_END_OF_LIST(),
756 static void pnv_lpc_class_init(ObjectClass *klass, void *data)
758 DeviceClass *dc = DEVICE_CLASS(klass);
760 dc->realize = pnv_lpc_realize;
761 dc->desc = "PowerNV LPC Controller";
762 device_class_set_props(dc, pnv_lpc_properties);
763 dc->user_creatable = false;
766 static const TypeInfo pnv_lpc_info = {
767 .name = TYPE_PNV_LPC,
768 .parent = TYPE_DEVICE,
769 .instance_size = sizeof(PnvLpcController),
770 .class_init = pnv_lpc_class_init,
771 .class_size = sizeof(PnvLpcClass),
772 .abstract = true,
775 static void pnv_lpc_register_types(void)
777 type_register_static(&pnv_lpc_info);
778 type_register_static(&pnv_lpc_power8_info);
779 type_register_static(&pnv_lpc_power9_info);
780 type_register_static(&pnv_lpc_power10_info);
783 type_init(pnv_lpc_register_types)
785 /* If we don't use the built-in LPC interrupt deserializer, we need
786 * to provide a set of qirqs for the ISA bus or things will go bad.
788 * Most machines using pre-Naples chips (without said deserializer)
789 * have a CPLD that will collect the SerIRQ and shoot them as a
790 * single level interrupt to the P8 chip. So let's setup a hook
791 * for doing just that.
793 static void pnv_lpc_isa_irq_handler_cpld(void *opaque, int n, int level)
795 PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
796 uint32_t old_state = pnv->cpld_irqstate;
797 PnvLpcController *lpc = PNV_LPC(opaque);
799 if (level) {
800 pnv->cpld_irqstate |= 1u << n;
801 } else {
802 pnv->cpld_irqstate &= ~(1u << n);
805 if (pnv->cpld_irqstate != old_state) {
806 pnv_psi_irq_set(lpc->psi, PSIHB_IRQ_EXTERNAL, pnv->cpld_irqstate != 0);
810 static void pnv_lpc_isa_irq_handler(void *opaque, int n, int level)
812 PnvLpcController *lpc = PNV_LPC(opaque);
814 /* The Naples HW latches the 1 levels, clearing is done by SW */
815 if (level) {
816 lpc->lpc_hc_irqstat |= LPC_HC_IRQ_SERIRQ0 >> n;
817 pnv_lpc_eval_irqs(lpc);
821 ISABus *pnv_lpc_isa_create(PnvLpcController *lpc, bool use_cpld, Error **errp)
823 Error *local_err = NULL;
824 ISABus *isa_bus;
825 qemu_irq *irqs;
826 qemu_irq_handler handler;
828 /* let isa_bus_new() create its own bridge on SysBus otherwise
829 * devices specified on the command line won't find the bus and
830 * will fail to create.
832 isa_bus = isa_bus_new(NULL, &lpc->isa_mem, &lpc->isa_io, &local_err);
833 if (local_err) {
834 error_propagate(errp, local_err);
835 return NULL;
838 /* Not all variants have a working serial irq decoder. If not,
839 * handling of LPC interrupts becomes a platform issue (some
840 * platforms have a CPLD to do it).
842 if (use_cpld) {
843 handler = pnv_lpc_isa_irq_handler_cpld;
844 } else {
845 handler = pnv_lpc_isa_irq_handler;
848 irqs = qemu_allocate_irqs(handler, lpc, ISA_NUM_IRQS);
850 isa_bus_irqs(isa_bus, irqs);
852 return isa_bus;