2 * QEMU ISA IPMI BT emulation
4 * Copyright (c) 2015 Corey Minyard, MontaVista Software, LLC
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 #include "qemu/osdep.h"
27 #include "qemu/module.h"
28 #include "qapi/error.h"
30 #include "hw/ipmi/ipmi.h"
31 #include "hw/isa/isa.h"
33 /* Control register */
34 #define IPMI_BT_CLR_WR_BIT 0
35 #define IPMI_BT_CLR_RD_BIT 1
36 #define IPMI_BT_H2B_ATN_BIT 2
37 #define IPMI_BT_B2H_ATN_BIT 3
38 #define IPMI_BT_SMS_ATN_BIT 4
39 #define IPMI_BT_HBUSY_BIT 6
40 #define IPMI_BT_BBUSY_BIT 7
42 #define IPMI_BT_GET_CLR_WR(d) (((d) >> IPMI_BT_CLR_WR_BIT) & 0x1)
44 #define IPMI_BT_GET_CLR_RD(d) (((d) >> IPMI_BT_CLR_RD_BIT) & 0x1)
46 #define IPMI_BT_GET_H2B_ATN(d) (((d) >> IPMI_BT_H2B_ATN_BIT) & 0x1)
48 #define IPMI_BT_B2H_ATN_MASK (1 << IPMI_BT_B2H_ATN_BIT)
49 #define IPMI_BT_GET_B2H_ATN(d) (((d) >> IPMI_BT_B2H_ATN_BIT) & 0x1)
50 #define IPMI_BT_SET_B2H_ATN(d, v) ((d) = (((d) & ~IPMI_BT_B2H_ATN_MASK) | \
51 (!!(v) << IPMI_BT_B2H_ATN_BIT)))
53 #define IPMI_BT_SMS_ATN_MASK (1 << IPMI_BT_SMS_ATN_BIT)
54 #define IPMI_BT_GET_SMS_ATN(d) (((d) >> IPMI_BT_SMS_ATN_BIT) & 0x1)
55 #define IPMI_BT_SET_SMS_ATN(d, v) ((d) = (((d) & ~IPMI_BT_SMS_ATN_MASK) | \
56 (!!(v) << IPMI_BT_SMS_ATN_BIT)))
58 #define IPMI_BT_HBUSY_MASK (1 << IPMI_BT_HBUSY_BIT)
59 #define IPMI_BT_GET_HBUSY(d) (((d) >> IPMI_BT_HBUSY_BIT) & 0x1)
60 #define IPMI_BT_SET_HBUSY(d, v) ((d) = (((d) & ~IPMI_BT_HBUSY_MASK) | \
61 (!!(v) << IPMI_BT_HBUSY_BIT)))
63 #define IPMI_BT_BBUSY_MASK (1 << IPMI_BT_BBUSY_BIT)
64 #define IPMI_BT_SET_BBUSY(d, v) ((d) = (((d) & ~IPMI_BT_BBUSY_MASK) | \
65 (!!(v) << IPMI_BT_BBUSY_BIT)))
69 #define IPMI_BT_B2H_IRQ_EN_BIT 0
70 #define IPMI_BT_B2H_IRQ_BIT 1
72 #define IPMI_BT_B2H_IRQ_EN_MASK (1 << IPMI_BT_B2H_IRQ_EN_BIT)
73 #define IPMI_BT_GET_B2H_IRQ_EN(d) (((d) >> IPMI_BT_B2H_IRQ_EN_BIT) & 0x1)
74 #define IPMI_BT_SET_B2H_IRQ_EN(d, v) ((d) = (((d) & ~IPMI_BT_B2H_IRQ_EN_MASK) |\
75 (!!(v) << IPMI_BT_B2H_IRQ_EN_BIT)))
77 #define IPMI_BT_B2H_IRQ_MASK (1 << IPMI_BT_B2H_IRQ_BIT)
78 #define IPMI_BT_GET_B2H_IRQ(d) (((d) >> IPMI_BT_B2H_IRQ_BIT) & 0x1)
79 #define IPMI_BT_SET_B2H_IRQ(d, v) ((d) = (((d) & ~IPMI_BT_B2H_IRQ_MASK) | \
80 (!!(v) << IPMI_BT_B2H_IRQ_BIT)))
82 typedef struct IPMIBT
{
90 unsigned long io_length
;
98 uint8_t outmsg
[MAX_IPMI_MSG_SIZE
];
102 uint8_t inmsg
[MAX_IPMI_MSG_SIZE
];
109 * This is a response number that we send with the command to make
110 * sure that the response matches the command.
116 #define IPMI_CMD_GET_BT_INTF_CAP 0x36
118 static void ipmi_bt_handle_event(IPMIInterface
*ii
)
120 IPMIInterfaceClass
*iic
= IPMI_INTERFACE_GET_CLASS(ii
);
121 IPMIBT
*ib
= iic
->get_backend_data(ii
);
126 /* Note that overruns are handled by handle_command */
127 if (ib
->inmsg
[0] != (ib
->inlen
- 1)) {
128 /* Length mismatch, just ignore. */
129 IPMI_BT_SET_BBUSY(ib
->control_reg
, 1);
133 if ((ib
->inmsg
[1] == (IPMI_NETFN_APP
<< 2)) &&
134 (ib
->inmsg
[3] == IPMI_CMD_GET_BT_INTF_CAP
)) {
135 /* We handle this one ourselves. */
137 ib
->outmsg
[1] = ib
->inmsg
[1] | 0x04;
138 ib
->outmsg
[2] = ib
->inmsg
[2];
139 ib
->outmsg
[3] = ib
->inmsg
[3];
141 ib
->outmsg
[5] = 1; /* Only support 1 outstanding request. */
142 if (sizeof(ib
->inmsg
) > 0xff) { /* Input buffer size */
143 ib
->outmsg
[6] = 0xff;
145 ib
->outmsg
[6] = (unsigned char) sizeof(ib
->inmsg
);
147 if (sizeof(ib
->outmsg
) > 0xff) { /* Output buffer size */
148 ib
->outmsg
[7] = 0xff;
150 ib
->outmsg
[7] = (unsigned char) sizeof(ib
->outmsg
);
152 ib
->outmsg
[8] = 10; /* Max request to response time */
153 ib
->outmsg
[9] = 0; /* Don't recommend retries */
155 IPMI_BT_SET_BBUSY(ib
->control_reg
, 0);
156 IPMI_BT_SET_B2H_ATN(ib
->control_reg
, 1);
157 if (ib
->use_irq
&& ib
->irqs_enabled
&&
158 !IPMI_BT_GET_B2H_IRQ(ib
->mask_reg
) &&
159 IPMI_BT_GET_B2H_IRQ_EN(ib
->mask_reg
)) {
160 IPMI_BT_SET_B2H_IRQ(ib
->mask_reg
, 1);
161 qemu_irq_raise(ib
->irq
);
165 ib
->waiting_seq
= ib
->inmsg
[2];
166 ib
->inmsg
[2] = ib
->inmsg
[1];
168 IPMIBmcClass
*bk
= IPMI_BMC_GET_CLASS(ib
->bmc
);
169 bk
->handle_command(ib
->bmc
, ib
->inmsg
+ 2, ib
->inlen
- 2,
170 sizeof(ib
->inmsg
), ib
->waiting_rsp
);
176 static void ipmi_bt_handle_rsp(IPMIInterface
*ii
, uint8_t msg_id
,
177 unsigned char *rsp
, unsigned int rsp_len
)
179 IPMIInterfaceClass
*iic
= IPMI_INTERFACE_GET_CLASS(ii
);
180 IPMIBT
*ib
= iic
->get_backend_data(ii
);
182 if (ib
->waiting_rsp
== msg_id
) {
184 if (rsp_len
> (sizeof(ib
->outmsg
) - 2)) {
186 ib
->outmsg
[1] = rsp
[0];
187 ib
->outmsg
[2] = ib
->waiting_seq
;
188 ib
->outmsg
[3] = rsp
[1];
189 ib
->outmsg
[4] = IPMI_CC_CANNOT_RETURN_REQ_NUM_BYTES
;
192 ib
->outmsg
[0] = rsp_len
+ 1;
193 ib
->outmsg
[1] = rsp
[0];
194 ib
->outmsg
[2] = ib
->waiting_seq
;
195 memcpy(ib
->outmsg
+ 3, rsp
+ 1, rsp_len
- 1);
196 ib
->outlen
= rsp_len
+ 2;
198 IPMI_BT_SET_BBUSY(ib
->control_reg
, 0);
199 IPMI_BT_SET_B2H_ATN(ib
->control_reg
, 1);
200 if (ib
->use_irq
&& ib
->irqs_enabled
&&
201 !IPMI_BT_GET_B2H_IRQ(ib
->mask_reg
) &&
202 IPMI_BT_GET_B2H_IRQ_EN(ib
->mask_reg
)) {
203 IPMI_BT_SET_B2H_IRQ(ib
->mask_reg
, 1);
204 qemu_irq_raise(ib
->irq
);
210 static uint64_t ipmi_bt_ioport_read(void *opaque
, hwaddr addr
, unsigned size
)
212 IPMIInterface
*ii
= opaque
;
213 IPMIInterfaceClass
*iic
= IPMI_INTERFACE_GET_CLASS(ii
);
214 IPMIBT
*ib
= iic
->get_backend_data(ii
);
219 ret
= ib
->control_reg
;
222 if (ib
->outpos
< ib
->outlen
) {
223 ret
= ib
->outmsg
[ib
->outpos
];
225 if (ib
->outpos
== ib
->outlen
) {
240 static void ipmi_bt_signal(IPMIBT
*ib
, IPMIInterface
*ii
)
242 IPMIInterfaceClass
*iic
= IPMI_INTERFACE_GET_CLASS(ii
);
245 while (ib
->do_wake
) {
247 iic
->handle_if_event(ii
);
251 static void ipmi_bt_ioport_write(void *opaque
, hwaddr addr
, uint64_t val
,
254 IPMIInterface
*ii
= opaque
;
255 IPMIInterfaceClass
*iic
= IPMI_INTERFACE_GET_CLASS(ii
);
256 IPMIBT
*ib
= iic
->get_backend_data(ii
);
260 if (IPMI_BT_GET_CLR_WR(val
)) {
263 if (IPMI_BT_GET_CLR_RD(val
)) {
266 if (IPMI_BT_GET_B2H_ATN(val
)) {
267 IPMI_BT_SET_B2H_ATN(ib
->control_reg
, 0);
269 if (IPMI_BT_GET_SMS_ATN(val
)) {
270 IPMI_BT_SET_SMS_ATN(ib
->control_reg
, 0);
272 if (IPMI_BT_GET_HBUSY(val
)) {
274 IPMI_BT_SET_HBUSY(ib
->control_reg
,
275 !IPMI_BT_GET_HBUSY(ib
->control_reg
));
277 if (IPMI_BT_GET_H2B_ATN(val
)) {
278 IPMI_BT_SET_BBUSY(ib
->control_reg
, 1);
279 ipmi_bt_signal(ib
, ii
);
284 if (ib
->inlen
< sizeof(ib
->inmsg
)) {
285 ib
->inmsg
[ib
->inlen
] = val
;
291 if (IPMI_BT_GET_B2H_IRQ_EN(val
) !=
292 IPMI_BT_GET_B2H_IRQ_EN(ib
->mask_reg
)) {
293 if (IPMI_BT_GET_B2H_IRQ_EN(val
)) {
294 if (IPMI_BT_GET_B2H_ATN(ib
->control_reg
) ||
295 IPMI_BT_GET_SMS_ATN(ib
->control_reg
)) {
296 IPMI_BT_SET_B2H_IRQ(ib
->mask_reg
, 1);
297 qemu_irq_raise(ib
->irq
);
299 IPMI_BT_SET_B2H_IRQ_EN(ib
->mask_reg
, 1);
301 if (IPMI_BT_GET_B2H_IRQ(ib
->mask_reg
)) {
302 IPMI_BT_SET_B2H_IRQ(ib
->mask_reg
, 0);
303 qemu_irq_lower(ib
->irq
);
305 IPMI_BT_SET_B2H_IRQ_EN(ib
->mask_reg
, 0);
308 if (IPMI_BT_GET_B2H_IRQ(val
) && IPMI_BT_GET_B2H_IRQ(ib
->mask_reg
)) {
309 IPMI_BT_SET_B2H_IRQ(ib
->mask_reg
, 0);
310 qemu_irq_lower(ib
->irq
);
316 static const MemoryRegionOps ipmi_bt_io_ops
= {
317 .read
= ipmi_bt_ioport_read
,
318 .write
= ipmi_bt_ioport_write
,
320 .min_access_size
= 1,
321 .max_access_size
= 1,
323 .endianness
= DEVICE_LITTLE_ENDIAN
,
326 static void ipmi_bt_set_atn(IPMIInterface
*ii
, int val
, int irq
)
328 IPMIInterfaceClass
*iic
= IPMI_INTERFACE_GET_CLASS(ii
);
329 IPMIBT
*ib
= iic
->get_backend_data(ii
);
331 if (!!val
== IPMI_BT_GET_SMS_ATN(ib
->control_reg
)) {
335 IPMI_BT_SET_SMS_ATN(ib
->control_reg
, val
);
337 if (irq
&& ib
->use_irq
&& ib
->irqs_enabled
&&
338 !IPMI_BT_GET_B2H_ATN(ib
->control_reg
) &&
339 IPMI_BT_GET_B2H_IRQ_EN(ib
->mask_reg
)) {
340 IPMI_BT_SET_B2H_IRQ(ib
->mask_reg
, 1);
341 qemu_irq_raise(ib
->irq
);
344 if (!IPMI_BT_GET_B2H_ATN(ib
->control_reg
) &&
345 IPMI_BT_GET_B2H_IRQ(ib
->mask_reg
)) {
346 IPMI_BT_SET_B2H_IRQ(ib
->mask_reg
, 0);
347 qemu_irq_lower(ib
->irq
);
352 static void ipmi_bt_handle_reset(IPMIInterface
*ii
, bool is_cold
)
354 IPMIInterfaceClass
*iic
= IPMI_INTERFACE_GET_CLASS(ii
);
355 IPMIBT
*ib
= iic
->get_backend_data(ii
);
358 /* Disable the BT interrupt on reset */
359 if (IPMI_BT_GET_B2H_IRQ(ib
->mask_reg
)) {
360 IPMI_BT_SET_B2H_IRQ(ib
->mask_reg
, 0);
361 qemu_irq_lower(ib
->irq
);
363 IPMI_BT_SET_B2H_IRQ_EN(ib
->mask_reg
, 0);
367 static void ipmi_bt_set_irq_enable(IPMIInterface
*ii
, int val
)
369 IPMIInterfaceClass
*iic
= IPMI_INTERFACE_GET_CLASS(ii
);
370 IPMIBT
*ib
= iic
->get_backend_data(ii
);
372 ib
->irqs_enabled
= val
;
375 static void ipmi_bt_init(IPMIInterface
*ii
, Error
**errp
)
377 IPMIInterfaceClass
*iic
= IPMI_INTERFACE_GET_CLASS(ii
);
378 IPMIBT
*ib
= iic
->get_backend_data(ii
);
382 memory_region_init_io(&ib
->io
, NULL
, &ipmi_bt_io_ops
, ii
, "ipmi-bt", 3);
386 #define TYPE_ISA_IPMI_BT "isa-ipmi-bt"
387 #define ISA_IPMI_BT(obj) OBJECT_CHECK(ISAIPMIBTDevice, (obj), \
390 typedef struct ISAIPMIBTDevice
{
397 static void ipmi_bt_get_fwinfo(struct IPMIInterface
*ii
, IPMIFwInfo
*info
)
399 ISAIPMIBTDevice
*iib
= ISA_IPMI_BT(ii
);
401 info
->interface_name
= "bt";
402 info
->interface_type
= IPMI_SMBIOS_BT
;
403 info
->ipmi_spec_major_revision
= 2;
404 info
->ipmi_spec_minor_revision
= 0;
405 info
->base_address
= iib
->bt
.io_base
;
406 info
->register_length
= iib
->bt
.io_length
;
407 info
->register_spacing
= 1;
408 info
->memspace
= IPMI_MEMSPACE_IO
;
409 info
->irq_type
= IPMI_LEVEL_IRQ
;
410 info
->interrupt_number
= iib
->isairq
;
411 info
->i2c_slave_address
= iib
->bt
.bmc
->slave_addr
;
412 info
->uuid
= iib
->uuid
;
415 static void ipmi_bt_class_init(IPMIInterfaceClass
*iic
)
417 iic
->init
= ipmi_bt_init
;
418 iic
->set_atn
= ipmi_bt_set_atn
;
419 iic
->handle_rsp
= ipmi_bt_handle_rsp
;
420 iic
->handle_if_event
= ipmi_bt_handle_event
;
421 iic
->set_irq_enable
= ipmi_bt_set_irq_enable
;
422 iic
->reset
= ipmi_bt_handle_reset
;
423 iic
->get_fwinfo
= ipmi_bt_get_fwinfo
;
426 static void isa_ipmi_bt_realize(DeviceState
*dev
, Error
**errp
)
428 ISADevice
*isadev
= ISA_DEVICE(dev
);
429 ISAIPMIBTDevice
*iib
= ISA_IPMI_BT(dev
);
430 IPMIInterface
*ii
= IPMI_INTERFACE(dev
);
431 IPMIInterfaceClass
*iic
= IPMI_INTERFACE_GET_CLASS(ii
);
434 error_setg(errp
, "IPMI device requires a bmc attribute to be set");
438 iib
->uuid
= ipmi_next_uuid();
440 iib
->bt
.bmc
->intf
= ii
;
446 if (iib
->isairq
> 0) {
447 isa_init_irq(isadev
, &iib
->bt
.irq
, iib
->isairq
);
451 qdev_set_legacy_instance_id(dev
, iib
->bt
.io_base
, iib
->bt
.io_length
);
453 isa_register_ioport(isadev
, &iib
->bt
.io
, iib
->bt
.io_base
);
456 static int ipmi_bt_vmstate_post_load(void *opaque
, int version
)
460 /* Make sure all the values are sane. */
461 if (ib
->outpos
>= MAX_IPMI_MSG_SIZE
|| ib
->outlen
>= MAX_IPMI_MSG_SIZE
||
462 ib
->outpos
>= ib
->outlen
) {
463 qemu_log_mask(LOG_GUEST_ERROR
,
464 "ipmi:bt: vmstate transfer received bad out values: %d %d\n",
465 ib
->outpos
, ib
->outlen
);
470 if (ib
->inlen
>= MAX_IPMI_MSG_SIZE
) {
471 qemu_log_mask(LOG_GUEST_ERROR
,
472 "ipmi:bt: vmstate transfer received bad in value: %d\n",
480 const VMStateDescription vmstate_IPMIBT
= {
481 .name
= TYPE_IPMI_INTERFACE_PREFIX
"bt",
483 .minimum_version_id
= 1,
484 .post_load
= ipmi_bt_vmstate_post_load
,
485 .fields
= (VMStateField
[]) {
486 VMSTATE_BOOL(obf_irq_set
, IPMIBT
),
487 VMSTATE_BOOL(atn_irq_set
, IPMIBT
),
488 VMSTATE_BOOL(irqs_enabled
, IPMIBT
),
489 VMSTATE_UINT32(outpos
, IPMIBT
),
490 VMSTATE_UINT32(outlen
, IPMIBT
),
491 VMSTATE_UINT8_ARRAY(outmsg
, IPMIBT
, MAX_IPMI_MSG_SIZE
),
492 VMSTATE_UINT32(inlen
, IPMIBT
),
493 VMSTATE_UINT8_ARRAY(inmsg
, IPMIBT
, MAX_IPMI_MSG_SIZE
),
494 VMSTATE_UINT8(control_reg
, IPMIBT
),
495 VMSTATE_UINT8(mask_reg
, IPMIBT
),
496 VMSTATE_UINT8(waiting_rsp
, IPMIBT
),
497 VMSTATE_UINT8(waiting_seq
, IPMIBT
),
498 VMSTATE_END_OF_LIST()
502 static const VMStateDescription vmstate_ISAIPMIBTDevice
= {
503 .name
= TYPE_IPMI_INTERFACE_PREFIX
"isa-bt",
505 .minimum_version_id
= 2,
507 * Version 1 had messed up the array transfer, it's not even usable
508 * because it used VMSTATE_VBUFFER_UINT32, but it did not transfer
509 * the buffer length, so random things would happen.
511 .fields
= (VMStateField
[]) {
512 VMSTATE_STRUCT(bt
, ISAIPMIBTDevice
, 1, vmstate_IPMIBT
, IPMIBT
),
513 VMSTATE_END_OF_LIST()
517 static void isa_ipmi_bt_init(Object
*obj
)
519 ISAIPMIBTDevice
*iib
= ISA_IPMI_BT(obj
);
521 ipmi_bmc_find_and_link(obj
, (Object
**) &iib
->bt
.bmc
);
523 vmstate_register(NULL
, 0, &vmstate_ISAIPMIBTDevice
, iib
);
526 static void *isa_ipmi_bt_get_backend_data(IPMIInterface
*ii
)
528 ISAIPMIBTDevice
*iib
= ISA_IPMI_BT(ii
);
533 static Property ipmi_isa_properties
[] = {
534 DEFINE_PROP_UINT32("ioport", ISAIPMIBTDevice
, bt
.io_base
, 0xe4),
535 DEFINE_PROP_INT32("irq", ISAIPMIBTDevice
, isairq
, 5),
536 DEFINE_PROP_END_OF_LIST(),
539 static void isa_ipmi_bt_class_init(ObjectClass
*oc
, void *data
)
541 DeviceClass
*dc
= DEVICE_CLASS(oc
);
542 IPMIInterfaceClass
*iic
= IPMI_INTERFACE_CLASS(oc
);
544 dc
->realize
= isa_ipmi_bt_realize
;
545 dc
->props
= ipmi_isa_properties
;
547 iic
->get_backend_data
= isa_ipmi_bt_get_backend_data
;
548 ipmi_bt_class_init(iic
);
551 static const TypeInfo isa_ipmi_bt_info
= {
552 .name
= TYPE_ISA_IPMI_BT
,
553 .parent
= TYPE_ISA_DEVICE
,
554 .instance_size
= sizeof(ISAIPMIBTDevice
),
555 .instance_init
= isa_ipmi_bt_init
,
556 .class_init
= isa_ipmi_bt_class_init
,
557 .interfaces
= (InterfaceInfo
[]) {
558 { TYPE_IPMI_INTERFACE
},
563 static void ipmi_register_types(void)
565 type_register_static(&isa_ipmi_bt_info
);
568 type_init(ipmi_register_types
)