hw/ppc/pnv_lpc.c

   1 /*
   2  * QEMU PowerPC PowerNV LPC controller
   3  *
   4  * Copyright (c) 2016, IBM Corporation.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "qemu/osdep.h"
  21 #include "target/ppc/cpu.h"
  22 #include "qapi/error.h"
  23 #include "qemu/log.h"
  24 #include "qemu/module.h"
  25 #include "hw/irq.h"
  26 #include "hw/isa/isa.h"
  27 #include "hw/qdev-properties.h"
  28 #include "hw/ppc/pnv.h"
  29 #include "hw/ppc/pnv_chip.h"
  30 #include "hw/ppc/pnv_lpc.h"
  31 #include "hw/ppc/pnv_xscom.h"
  32 #include "hw/ppc/fdt.h"
  33
  34 #include <libfdt.h>
  35
  36 enum {
  37     ECCB_CTL    = 0,
  38     ECCB_RESET  = 1,
  39     ECCB_STAT   = 2,
  40     ECCB_DATA   = 3,
  41 };
  42
  43 /* OPB Master LS registers */
  44 #define OPB_MASTER_LS_ROUTE0    0x8
  45 #define OPB_MASTER_LS_ROUTE1    0xC
  46 #define OPB_MASTER_LS_IRQ_STAT  0x50
  47 #define   OPB_MASTER_IRQ_LPC            0x00000800
  48 #define OPB_MASTER_LS_IRQ_MASK  0x54
  49 #define OPB_MASTER_LS_IRQ_POL   0x58
  50 #define OPB_MASTER_LS_IRQ_INPUT 0x5c
  51
  52 /* LPC HC registers */
  53 #define LPC_HC_FW_SEG_IDSEL     0x24
  54 #define LPC_HC_FW_RD_ACC_SIZE   0x28
  55 #define   LPC_HC_FW_RD_1B               0x00000000
  56 #define   LPC_HC_FW_RD_2B               0x01000000
  57 #define   LPC_HC_FW_RD_4B               0x02000000
  58 #define   LPC_HC_FW_RD_16B              0x04000000
  59 #define   LPC_HC_FW_RD_128B             0x07000000
  60 #define LPC_HC_IRQSER_CTRL      0x30
  61 #define   LPC_HC_IRQSER_EN              0x80000000
  62 #define   LPC_HC_IRQSER_QMODE           0x40000000
  63 #define   LPC_HC_IRQSER_START_MASK      0x03000000
  64 #define   LPC_HC_IRQSER_START_4CLK      0x00000000
  65 #define   LPC_HC_IRQSER_START_6CLK      0x01000000
  66 #define   LPC_HC_IRQSER_START_8CLK      0x02000000
  67 #define   LPC_HC_IRQSER_AUTO_CLEAR      0x00800000
  68 #define LPC_HC_IRQMASK          0x34    /* same bit defs as LPC_HC_IRQSTAT */
  69 #define LPC_HC_IRQSTAT          0x38
  70 #define   LPC_HC_IRQ_SERIRQ0            0x80000000 /* all bits down to ... */
  71 #define   LPC_HC_IRQ_SERIRQ16           0x00008000 /* IRQ16=IOCHK#, IRQ2=SMI# */
  72 #define   LPC_HC_IRQ_SERIRQ_ALL         0xffff8000
  73 #define   LPC_HC_IRQ_LRESET             0x00000400
  74 #define   LPC_HC_IRQ_SYNC_ABNORM_ERR    0x00000080
  75 #define   LPC_HC_IRQ_SYNC_NORESP_ERR    0x00000040
  76 #define   LPC_HC_IRQ_SYNC_NORM_ERR      0x00000020
  77 #define   LPC_HC_IRQ_SYNC_TIMEOUT_ERR   0x00000010
  78 #define   LPC_HC_IRQ_SYNC_TARG_TAR_ERR  0x00000008
  79 #define   LPC_HC_IRQ_SYNC_BM_TAR_ERR    0x00000004
  80 #define   LPC_HC_IRQ_SYNC_BM0_REQ       0x00000002
  81 #define   LPC_HC_IRQ_SYNC_BM1_REQ       0x00000001
  82 #define LPC_HC_ERROR_ADDRESS    0x40
  83
  84 #define LPC_OPB_SIZE            0x100000000ull
  85
  86 #define ISA_IO_SIZE             0x00010000
  87 #define ISA_MEM_SIZE            0x10000000
  88 #define ISA_FW_SIZE             0x10000000
  89 #define LPC_IO_OPB_ADDR         0xd0010000
  90 #define LPC_IO_OPB_SIZE         0x00010000
  91 #define LPC_MEM_OPB_ADDR        0xe0000000
  92 #define LPC_MEM_OPB_SIZE        0x10000000
  93 #define LPC_FW_OPB_ADDR         0xf0000000
  94 #define LPC_FW_OPB_SIZE         0x10000000
  95
  96 #define LPC_OPB_REGS_OPB_ADDR   0xc0010000
  97 #define LPC_OPB_REGS_OPB_SIZE   0x00000060
  98 #define LPC_OPB_REGS_OPBA_ADDR  0xc0011000
  99 #define LPC_OPB_REGS_OPBA_SIZE  0x00000008
 100 #define LPC_HC_REGS_OPB_ADDR    0xc0012000
 101 #define LPC_HC_REGS_OPB_SIZE    0x00000100
 102
 103 static int pnv_lpc_dt_xscom(PnvXScomInterface *dev, void *fdt, int xscom_offset)
 104 {
 105     const char compat[] = "ibm,power8-lpc\0ibm,lpc";
 106     char *name;
 107     int offset;
 108     uint32_t lpc_pcba = PNV_XSCOM_LPC_BASE;
 109     uint32_t reg[] = {
 110         cpu_to_be32(lpc_pcba),
 111         cpu_to_be32(PNV_XSCOM_LPC_SIZE)
 112     };
 113
 114     name = g_strdup_printf("isa@%x", lpc_pcba);
 115     offset = fdt_add_subnode(fdt, xscom_offset, name);
 116     _FDT(offset);
 117     g_free(name);
 118
 119     _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
 120     _FDT((fdt_setprop_cell(fdt, offset, "#address-cells", 2)));
 121     _FDT((fdt_setprop_cell(fdt, offset, "#size-cells", 1)));
 122     _FDT((fdt_setprop(fdt, offset, "compatible", compat, sizeof(compat))));
 123     return 0;
 124 }
 125
 126 /* POWER9 only */
 127 int pnv_dt_lpc(PnvChip *chip, void *fdt, int root_offset, uint64_t lpcm_addr,
 128                uint64_t lpcm_size)
 129 {
 130     const char compat[] = "ibm,power9-lpcm-opb\0simple-bus";
 131     const char lpc_compat[] = "ibm,power9-lpc\0ibm,lpc";
 132     char *name;
 133     int offset, lpcm_offset;
 134     uint32_t opb_ranges[8] = { 0,
 135                                cpu_to_be32(lpcm_addr >> 32),
 136                                cpu_to_be32((uint32_t)lpcm_addr),
 137                                cpu_to_be32(lpcm_size / 2),
 138                                cpu_to_be32(lpcm_size / 2),
 139                                cpu_to_be32(lpcm_addr >> 32),
 140                                cpu_to_be32(lpcm_size / 2),
 141                                cpu_to_be32(lpcm_size / 2),
 142     };
 143     uint32_t opb_reg[4] = { cpu_to_be32(lpcm_addr >> 32),
 144                             cpu_to_be32((uint32_t)lpcm_addr),
 145                             cpu_to_be32(lpcm_size >> 32),
 146                             cpu_to_be32((uint32_t)lpcm_size),
 147     };
 148     uint32_t lpc_ranges[12] = { 0, 0,
 149                                 cpu_to_be32(LPC_MEM_OPB_ADDR),
 150                                 cpu_to_be32(LPC_MEM_OPB_SIZE),
 151                                 cpu_to_be32(1), 0,
 152                                 cpu_to_be32(LPC_IO_OPB_ADDR),
 153                                 cpu_to_be32(LPC_IO_OPB_SIZE),
 154                                 cpu_to_be32(3), 0,
 155                                 cpu_to_be32(LPC_FW_OPB_ADDR),
 156                                 cpu_to_be32(LPC_FW_OPB_SIZE),
 157     };
 158     uint32_t reg[2];
 159
 160     /*
 161      * OPB bus
 162      */
 163     name = g_strdup_printf("lpcm-opb@%"PRIx64, lpcm_addr);
 164     lpcm_offset = fdt_add_subnode(fdt, root_offset, name);
 165     _FDT(lpcm_offset);
 166     g_free(name);
 167
 168     _FDT((fdt_setprop(fdt, lpcm_offset, "reg", opb_reg, sizeof(opb_reg))));
 169     _FDT((fdt_setprop_cell(fdt, lpcm_offset, "#address-cells", 1)));
 170     _FDT((fdt_setprop_cell(fdt, lpcm_offset, "#size-cells", 1)));
 171     _FDT((fdt_setprop(fdt, lpcm_offset, "compatible", compat, sizeof(compat))));
 172     _FDT((fdt_setprop_cell(fdt, lpcm_offset, "ibm,chip-id", chip->chip_id)));
 173     _FDT((fdt_setprop(fdt, lpcm_offset, "ranges", opb_ranges,
 174                       sizeof(opb_ranges))));
 175
 176     /*
 177      * OPB Master registers
 178      */
 179     name = g_strdup_printf("opb-master@%x", LPC_OPB_REGS_OPB_ADDR);
 180     offset = fdt_add_subnode(fdt, lpcm_offset, name);
 181     _FDT(offset);
 182     g_free(name);
 183
 184     reg[0] = cpu_to_be32(LPC_OPB_REGS_OPB_ADDR);
 185     reg[1] = cpu_to_be32(LPC_OPB_REGS_OPB_SIZE);
 186     _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
 187     _FDT((fdt_setprop_string(fdt, offset, "compatible",
 188                              "ibm,power9-lpcm-opb-master")));
 189
 190     /*
 191      * OPB arbitrer registers
 192      */
 193     name = g_strdup_printf("opb-arbitrer@%x", LPC_OPB_REGS_OPBA_ADDR);
 194     offset = fdt_add_subnode(fdt, lpcm_offset, name);
 195     _FDT(offset);
 196     g_free(name);
 197
 198     reg[0] = cpu_to_be32(LPC_OPB_REGS_OPBA_ADDR);
 199     reg[1] = cpu_to_be32(LPC_OPB_REGS_OPBA_SIZE);
 200     _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
 201     _FDT((fdt_setprop_string(fdt, offset, "compatible",
 202                              "ibm,power9-lpcm-opb-arbiter")));
 203
 204     /*
 205      * LPC Host Controller registers
 206      */
 207     name = g_strdup_printf("lpc-controller@%x", LPC_HC_REGS_OPB_ADDR);
 208     offset = fdt_add_subnode(fdt, lpcm_offset, name);
 209     _FDT(offset);
 210     g_free(name);
 211
 212     reg[0] = cpu_to_be32(LPC_HC_REGS_OPB_ADDR);
 213     reg[1] = cpu_to_be32(LPC_HC_REGS_OPB_SIZE);
 214     _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
 215     _FDT((fdt_setprop_string(fdt, offset, "compatible",
 216                              "ibm,power9-lpc-controller")));
 217
 218     name = g_strdup_printf("lpc@0");
 219     offset = fdt_add_subnode(fdt, lpcm_offset, name);
 220     _FDT(offset);
 221     g_free(name);
 222     _FDT((fdt_setprop_cell(fdt, offset, "#address-cells", 2)));
 223     _FDT((fdt_setprop_cell(fdt, offset, "#size-cells", 1)));
 224     _FDT((fdt_setprop(fdt, offset, "compatible", lpc_compat,
 225                       sizeof(lpc_compat))));
 226     _FDT((fdt_setprop(fdt, offset, "ranges", lpc_ranges,
 227                       sizeof(lpc_ranges))));
 228
 229     return 0;
 230 }
 231
 232 /*
 233  * These read/write handlers of the OPB address space should be common
 234  * with the P9 LPC Controller which uses direct MMIOs.
 235  *
 236  * TODO: rework to use address_space_stq() and address_space_ldq()
 237  * instead.
 238  */
 239 bool pnv_lpc_opb_read(PnvLpcController *lpc, uint32_t addr,
 240                       uint8_t *data, int sz)
 241 {
 242     /* XXX Handle access size limits and FW read caching here */
 243     return !address_space_read(&lpc->opb_as, addr, MEMTXATTRS_UNSPECIFIED,
 244                                data, sz);
 245 }
 246
 247 bool pnv_lpc_opb_write(PnvLpcController *lpc, uint32_t addr,
 248                        uint8_t *data, int sz)
 249 {
 250     /* XXX Handle access size limits here */
 251     return !address_space_write(&lpc->opb_as, addr, MEMTXATTRS_UNSPECIFIED,
 252                                 data, sz);
 253 }
 254
 255 #define ECCB_CTL_READ           PPC_BIT(15)
 256 #define ECCB_CTL_SZ_LSH         (63 - 7)
 257 #define ECCB_CTL_SZ_MASK        PPC_BITMASK(4, 7)
 258 #define ECCB_CTL_ADDR_MASK      PPC_BITMASK(32, 63)
 259
 260 #define ECCB_STAT_OP_DONE       PPC_BIT(52)
 261 #define ECCB_STAT_OP_ERR        PPC_BIT(52)
 262 #define ECCB_STAT_RD_DATA_LSH   (63 - 37)
 263 #define ECCB_STAT_RD_DATA_MASK  (0xffffffff << ECCB_STAT_RD_DATA_LSH)
 264
 265 static void pnv_lpc_do_eccb(PnvLpcController *lpc, uint64_t cmd)
 266 {
 267     /* XXX Check for magic bits at the top, addr size etc... */
 268     unsigned int sz = (cmd & ECCB_CTL_SZ_MASK) >> ECCB_CTL_SZ_LSH;
 269     uint32_t opb_addr = cmd & ECCB_CTL_ADDR_MASK;
 270     uint8_t data[8];
 271     bool success;
 272
 273     if (sz > sizeof(data)) {
 274         qemu_log_mask(LOG_GUEST_ERROR,
 275             "ECCB: invalid operation at @0x%08x size %d\n", opb_addr, sz);
 276         return;
 277     }
 278
 279     if (cmd & ECCB_CTL_READ) {
 280         success = pnv_lpc_opb_read(lpc, opb_addr, data, sz);
 281         if (success) {
 282             lpc->eccb_stat_reg = ECCB_STAT_OP_DONE |
 283                     (((uint64_t)data[0]) << 24 |
 284                      ((uint64_t)data[1]) << 16 |
 285                      ((uint64_t)data[2]) <<  8 |
 286                      ((uint64_t)data[3])) << ECCB_STAT_RD_DATA_LSH;
 287         } else {
 288             lpc->eccb_stat_reg = ECCB_STAT_OP_DONE |
 289                     (0xffffffffull << ECCB_STAT_RD_DATA_LSH);
 290         }
 291     } else {
 292         data[0] = lpc->eccb_data_reg >> 24;
 293         data[1] = lpc->eccb_data_reg >> 16;
 294         data[2] = lpc->eccb_data_reg >>  8;
 295         data[3] = lpc->eccb_data_reg;
 296
 297         success = pnv_lpc_opb_write(lpc, opb_addr, data, sz);
 298         lpc->eccb_stat_reg = ECCB_STAT_OP_DONE;
 299     }
 300     /* XXX Which error bit (if any) to signal OPB error ? */
 301 }
 302
 303 static uint64_t pnv_lpc_xscom_read(void *opaque, hwaddr addr, unsigned size)
 304 {
 305     PnvLpcController *lpc = PNV_LPC(opaque);
 306     uint32_t offset = addr >> 3;
 307     uint64_t val = 0;
 308
 309     switch (offset & 3) {
 310     case ECCB_CTL:
 311     case ECCB_RESET:
 312         val = 0;
 313         break;
 314     case ECCB_STAT:
 315         val = lpc->eccb_stat_reg;
 316         lpc->eccb_stat_reg = 0;
 317         break;
 318     case ECCB_DATA:
 319         val = ((uint64_t)lpc->eccb_data_reg) << 32;
 320         break;
 321     }
 322     return val;
 323 }
 324
 325 static void pnv_lpc_xscom_write(void *opaque, hwaddr addr,
 326                                 uint64_t val, unsigned size)
 327 {
 328     PnvLpcController *lpc = PNV_LPC(opaque);
 329     uint32_t offset = addr >> 3;
 330
 331     switch (offset & 3) {
 332     case ECCB_CTL:
 333         pnv_lpc_do_eccb(lpc, val);
 334         break;
 335     case ECCB_RESET:
 336         /*  XXXX  */
 337         break;
 338     case ECCB_STAT:
 339         break;
 340     case ECCB_DATA:
 341         lpc->eccb_data_reg = val >> 32;
 342         break;
 343     }
 344 }
 345
 346 static const MemoryRegionOps pnv_lpc_xscom_ops = {
 347     .read = pnv_lpc_xscom_read,
 348     .write = pnv_lpc_xscom_write,
 349     .valid.min_access_size = 8,
 350     .valid.max_access_size = 8,
 351     .impl.min_access_size = 8,
 352     .impl.max_access_size = 8,
 353     .endianness = DEVICE_BIG_ENDIAN,
 354 };
 355
 356 static uint64_t pnv_lpc_mmio_read(void *opaque, hwaddr addr, unsigned size)
 357 {
 358     PnvLpcController *lpc = PNV_LPC(opaque);
 359     uint64_t val = 0;
 360     uint32_t opb_addr = addr & ECCB_CTL_ADDR_MASK;
 361     MemTxResult result;
 362
 363     switch (size) {
 364     case 4:
 365         val = address_space_ldl(&lpc->opb_as, opb_addr, MEMTXATTRS_UNSPECIFIED,
 366                                 &result);
 367         break;
 368     case 1:
 369         val = address_space_ldub(&lpc->opb_as, opb_addr, MEMTXATTRS_UNSPECIFIED,
 370                                  &result);
 371         break;
 372     default:
 373         qemu_log_mask(LOG_GUEST_ERROR, "OPB read failed at @0x%"
 374                       HWADDR_PRIx " invalid size %d\n", addr, size);
 375         return 0;
 376     }
 377
 378     if (result != MEMTX_OK) {
 379         qemu_log_mask(LOG_GUEST_ERROR, "OPB read failed at @0x%"
 380                       HWADDR_PRIx "\n", addr);
 381     }
 382
 383     return val;
 384 }
 385
 386 static void pnv_lpc_mmio_write(void *opaque, hwaddr addr,
 387                                 uint64_t val, unsigned size)
 388 {
 389     PnvLpcController *lpc = PNV_LPC(opaque);
 390     uint32_t opb_addr = addr & ECCB_CTL_ADDR_MASK;
 391     MemTxResult result;
 392
 393     switch (size) {
 394     case 4:
 395         address_space_stl(&lpc->opb_as, opb_addr, val, MEMTXATTRS_UNSPECIFIED,
 396                           &result);
 397          break;
 398     case 1:
 399         address_space_stb(&lpc->opb_as, opb_addr, val, MEMTXATTRS_UNSPECIFIED,
 400                           &result);
 401         break;
 402     default:
 403         qemu_log_mask(LOG_GUEST_ERROR, "OPB write failed at @0x%"
 404                       HWADDR_PRIx " invalid size %d\n", addr, size);
 405         return;
 406     }
 407
 408     if (result != MEMTX_OK) {
 409         qemu_log_mask(LOG_GUEST_ERROR, "OPB write failed at @0x%"
 410                       HWADDR_PRIx "\n", addr);
 411     }
 412 }
 413
 414 static const MemoryRegionOps pnv_lpc_mmio_ops = {
 415     .read = pnv_lpc_mmio_read,
 416     .write = pnv_lpc_mmio_write,
 417     .impl = {
 418         .min_access_size = 1,
 419         .max_access_size = 4,
 420     },
 421     .endianness = DEVICE_BIG_ENDIAN,
 422 };
 423
 424 /* Program the POWER9 LPC irq to PSI serirq routing table */
 425 static void pnv_lpc_eval_serirq_routes(PnvLpcController *lpc)
 426 {
 427     int irq;
 428
 429     if (!lpc->psi_has_serirq) {
 430         if ((lpc->opb_irq_route0 & PPC_BITMASK(8, 13)) ||
 431             (lpc->opb_irq_route1 & PPC_BITMASK(4, 31))) {
 432             qemu_log_mask(LOG_GUEST_ERROR,
 433                 "OPB: setting serirq routing on POWER8 system, ignoring.\n");
 434         }
 435         return;
 436     }
 437
 438     for (irq = 0; irq <= 13; irq++) {
 439         int serirq = (lpc->opb_irq_route1 >> (31 - 5 - (irq * 2))) & 0x3;
 440         lpc->irq_to_serirq_route[irq] = serirq;
 441     }
 442
 443     for (irq = 14; irq < ISA_NUM_IRQS; irq++) {
 444         int serirq = (lpc->opb_irq_route0 >> (31 - 9 - (irq * 2))) & 0x3;
 445         lpc->irq_to_serirq_route[irq] = serirq;
 446     }
 447 }
 448
 449 static void pnv_lpc_eval_irqs(PnvLpcController *lpc)
 450 {
 451     uint32_t active_irqs = 0;
 452
 453     if (lpc->lpc_hc_irqstat & PPC_BITMASK32(16, 31)) {
 454         qemu_log_mask(LOG_UNIMP, "LPC HC Unimplemented irqs in IRQSTAT: "
 455                                  "0x%08"PRIx32"\n", lpc->lpc_hc_irqstat);
 456     }
 457
 458     if (lpc->lpc_hc_irqser_ctrl & LPC_HC_IRQSER_EN) {
 459         active_irqs = lpc->lpc_hc_irqstat & lpc->lpc_hc_irqmask;
 460     }
 461
 462     /* Reflect the interrupt */
 463     if (!lpc->psi_has_serirq) {
 464         /*
 465          * POWER8 ORs all irqs together (also with LPCHC internal interrupt
 466          * sources) and outputs a single line that raises the PSI LPCHC irq
 467          * which then latches an OPB IRQ status register that sends the irq
 468          * to PSI.
 469          *
 470          * We don't honor the polarity register, it's pointless and unused
 471          * anyway
 472          */
 473         if (active_irqs) {
 474             lpc->opb_irq_input |= OPB_MASTER_IRQ_LPC;
 475         } else {
 476             lpc->opb_irq_input &= ~OPB_MASTER_IRQ_LPC;
 477         }
 478
 479         /* Update OPB internal latch */
 480         lpc->opb_irq_stat |= lpc->opb_irq_input & lpc->opb_irq_mask;
 481
 482         qemu_set_irq(lpc->psi_irq_lpchc, lpc->opb_irq_stat != 0);
 483     } else {
 484         /*
 485          * POWER9 and POWER10 have routing fields in OPB master registers that
 486          * send LPC irqs to 4 output lines that raise the PSI SERIRQ irqs.
 487          * These don't appear to get latched into an OPB register like the
 488          * LPCHC irqs.
 489          *
 490          * POWER9 LPC controller internal irqs still go via the OPB
 491          * and LPCHC PSI irqs like P8, but we have no such internal sources
 492          * modelled yet.
 493          */
 494         bool serirq_out[4] = { false, false, false, false };
 495         int irq;
 496
 497         for (irq = 0; irq < ISA_NUM_IRQS; irq++) {
 498             if (active_irqs & (LPC_HC_IRQ_SERIRQ0 >> irq)) {
 499                 serirq_out[lpc->irq_to_serirq_route[irq]] = true;
 500             }
 501         }
 502
 503         qemu_set_irq(lpc->psi_irq_serirq[0], serirq_out[0]);
 504         qemu_set_irq(lpc->psi_irq_serirq[1], serirq_out[1]);
 505         qemu_set_irq(lpc->psi_irq_serirq[2], serirq_out[2]);
 506         qemu_set_irq(lpc->psi_irq_serirq[3], serirq_out[3]);
 507     }
 508 }
 509
 510 static uint64_t lpc_hc_read(void *opaque, hwaddr addr, unsigned size)
 511 {
 512     PnvLpcController *lpc = opaque;
 513     uint64_t val = 0xfffffffffffffffful;
 514
 515     switch (addr) {
 516     case LPC_HC_FW_SEG_IDSEL:
 517         val =  lpc->lpc_hc_fw_seg_idsel;
 518         break;
 519     case LPC_HC_FW_RD_ACC_SIZE:
 520         val =  lpc->lpc_hc_fw_rd_acc_size;
 521         break;
 522     case LPC_HC_IRQSER_CTRL:
 523         val =  lpc->lpc_hc_irqser_ctrl;
 524         break;
 525     case LPC_HC_IRQMASK:
 526         val =  lpc->lpc_hc_irqmask;
 527         break;
 528     case LPC_HC_IRQSTAT:
 529         val =  lpc->lpc_hc_irqstat;
 530         break;
 531     case LPC_HC_ERROR_ADDRESS:
 532         val =  lpc->lpc_hc_error_addr;
 533         break;
 534     default:
 535         qemu_log_mask(LOG_UNIMP, "LPC HC Unimplemented register: 0x%"
 536                       HWADDR_PRIx "\n", addr);
 537     }
 538     return val;
 539 }
 540
 541 static void lpc_hc_write(void *opaque, hwaddr addr, uint64_t val,
 542                          unsigned size)
 543 {
 544     PnvLpcController *lpc = opaque;
 545
 546     /* XXX Filter out reserved bits */
 547
 548     switch (addr) {
 549     case LPC_HC_FW_SEG_IDSEL:
 550         /* XXX Actually figure out how that works as this impact
 551          * memory regions/aliases
 552          */
 553         lpc->lpc_hc_fw_seg_idsel = val;
 554         break;
 555     case LPC_HC_FW_RD_ACC_SIZE:
 556         lpc->lpc_hc_fw_rd_acc_size = val;
 557         break;
 558     case LPC_HC_IRQSER_CTRL:
 559         lpc->lpc_hc_irqser_ctrl = val;
 560         pnv_lpc_eval_irqs(lpc);
 561         break;
 562     case LPC_HC_IRQMASK:
 563         lpc->lpc_hc_irqmask = val;
 564         pnv_lpc_eval_irqs(lpc);
 565         break;
 566     case LPC_HC_IRQSTAT:
 567         /*
 568          * This register is write-to-clear for the IRQSER (LPC device IRQ)
 569          * status. However if the device has not de-asserted its interrupt
 570          * that will just raise this IRQ status bit again. Model this by
 571          * keeping track of the inputs and only clearing if the inputs are
 572          * deasserted.
 573          */
 574         lpc->lpc_hc_irqstat &= ~(val & ~lpc->lpc_hc_irq_inputs);
 575         pnv_lpc_eval_irqs(lpc);
 576         break;
 577     case LPC_HC_ERROR_ADDRESS:
 578         break;
 579     default:
 580         qemu_log_mask(LOG_UNIMP, "LPC HC Unimplemented register: 0x%"
 581                       HWADDR_PRIx "\n", addr);
 582     }
 583 }
 584
 585 static const MemoryRegionOps lpc_hc_ops = {
 586     .read = lpc_hc_read,
 587     .write = lpc_hc_write,
 588     .endianness = DEVICE_BIG_ENDIAN,
 589     .valid = {
 590         .min_access_size = 4,
 591         .max_access_size = 4,
 592     },
 593     .impl = {
 594         .min_access_size = 4,
 595         .max_access_size = 4,
 596     },
 597 };
 598
 599 static uint64_t opb_master_read(void *opaque, hwaddr addr, unsigned size)
 600 {
 601     PnvLpcController *lpc = opaque;
 602     uint64_t val = 0xfffffffffffffffful;
 603
 604     switch (addr) {
 605     case OPB_MASTER_LS_ROUTE0:
 606         val = lpc->opb_irq_route0;
 607         break;
 608     case OPB_MASTER_LS_ROUTE1:
 609         val = lpc->opb_irq_route1;
 610         break;
 611     case OPB_MASTER_LS_IRQ_STAT:
 612         val = lpc->opb_irq_stat;
 613         break;
 614     case OPB_MASTER_LS_IRQ_MASK:
 615         val = lpc->opb_irq_mask;
 616         break;
 617     case OPB_MASTER_LS_IRQ_POL:
 618         val = lpc->opb_irq_pol;
 619         break;
 620     case OPB_MASTER_LS_IRQ_INPUT:
 621         val = lpc->opb_irq_input;
 622         break;
 623     default:
 624         qemu_log_mask(LOG_UNIMP, "OPBM: read on unimplemented register: 0x%"
 625                       HWADDR_PRIx "\n", addr);
 626     }
 627
 628     return val;
 629 }
 630
 631 static void opb_master_write(void *opaque, hwaddr addr,
 632                              uint64_t val, unsigned size)
 633 {
 634     PnvLpcController *lpc = opaque;
 635
 636     switch (addr) {
 637     case OPB_MASTER_LS_ROUTE0:
 638         lpc->opb_irq_route0 = val;
 639         pnv_lpc_eval_serirq_routes(lpc);
 640         pnv_lpc_eval_irqs(lpc);
 641         break;
 642     case OPB_MASTER_LS_ROUTE1:
 643         lpc->opb_irq_route1 = val;
 644         pnv_lpc_eval_serirq_routes(lpc);
 645         pnv_lpc_eval_irqs(lpc);
 646         break;
 647     case OPB_MASTER_LS_IRQ_STAT:
 648         lpc->opb_irq_stat &= ~val;
 649         pnv_lpc_eval_irqs(lpc);
 650         break;
 651     case OPB_MASTER_LS_IRQ_MASK:
 652         lpc->opb_irq_mask = val;
 653         pnv_lpc_eval_irqs(lpc);
 654         break;
 655     case OPB_MASTER_LS_IRQ_POL:
 656         lpc->opb_irq_pol = val;
 657         pnv_lpc_eval_irqs(lpc);
 658         break;
 659     case OPB_MASTER_LS_IRQ_INPUT:
 660         /* Read only */
 661         break;
 662     default:
 663         qemu_log_mask(LOG_UNIMP, "OPBM: write on unimplemented register: 0x%"
 664                       HWADDR_PRIx " val=0x%08"PRIx64"\n", addr, val);
 665     }
 666 }
 667
 668 static const MemoryRegionOps opb_master_ops = {
 669     .read = opb_master_read,
 670     .write = opb_master_write,
 671     .endianness = DEVICE_BIG_ENDIAN,
 672     .valid = {
 673         .min_access_size = 4,
 674         .max_access_size = 4,
 675     },
 676     .impl = {
 677         .min_access_size = 4,
 678         .max_access_size = 4,
 679     },
 680 };
 681
 682 static void pnv_lpc_power8_realize(DeviceState *dev, Error **errp)
 683 {
 684     PnvLpcController *lpc = PNV_LPC(dev);
 685     PnvLpcClass *plc = PNV_LPC_GET_CLASS(dev);
 686     Error *local_err = NULL;
 687
 688     plc->parent_realize(dev, &local_err);
 689     if (local_err) {
 690         error_propagate(errp, local_err);
 691         return;
 692     }
 693
 694     /* P8 uses a XSCOM region for LPC registers */
 695     pnv_xscom_region_init(&lpc->xscom_regs, OBJECT(lpc),
 696                           &pnv_lpc_xscom_ops, lpc, "xscom-lpc",
 697                           PNV_XSCOM_LPC_SIZE);
 698 }
 699
 700 static void pnv_lpc_power8_class_init(ObjectClass *klass, void *data)
 701 {
 702     DeviceClass *dc = DEVICE_CLASS(klass);
 703     PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
 704     PnvLpcClass *plc = PNV_LPC_CLASS(klass);
 705
 706     dc->desc = "PowerNV LPC Controller POWER8";
 707
 708     xdc->dt_xscom = pnv_lpc_dt_xscom;
 709
 710     device_class_set_parent_realize(dc, pnv_lpc_power8_realize,
 711                                     &plc->parent_realize);
 712 }
 713
 714 static const TypeInfo pnv_lpc_power8_info = {
 715     .name          = TYPE_PNV8_LPC,
 716     .parent        = TYPE_PNV_LPC,
 717     .class_init    = pnv_lpc_power8_class_init,
 718     .interfaces = (InterfaceInfo[]) {
 719         { TYPE_PNV_XSCOM_INTERFACE },
 720         { }
 721     }
 722 };
 723
 724 static void pnv_lpc_power9_realize(DeviceState *dev, Error **errp)
 725 {
 726     PnvLpcController *lpc = PNV_LPC(dev);
 727     PnvLpcClass *plc = PNV_LPC_GET_CLASS(dev);
 728     Error *local_err = NULL;
 729
 730     object_property_set_bool(OBJECT(lpc), "psi-serirq", true, &error_abort);
 731
 732     plc->parent_realize(dev, &local_err);
 733     if (local_err) {
 734         error_propagate(errp, local_err);
 735         return;
 736     }
 737
 738     /* P9 uses a MMIO region */
 739     memory_region_init_io(&lpc->xscom_regs, OBJECT(lpc), &pnv_lpc_mmio_ops,
 740                           lpc, "lpcm", PNV9_LPCM_SIZE);
 741
 742     /* P9 LPC routes ISA irqs to 4 PSI SERIRQ lines */
 743     qdev_init_gpio_out_named(dev, lpc->psi_irq_serirq, "SERIRQ", 4);
 744 }
 745
 746 static void pnv_lpc_power9_class_init(ObjectClass *klass, void *data)
 747 {
 748     DeviceClass *dc = DEVICE_CLASS(klass);
 749     PnvLpcClass *plc = PNV_LPC_CLASS(klass);
 750
 751     dc->desc = "PowerNV LPC Controller POWER9";
 752
 753     device_class_set_parent_realize(dc, pnv_lpc_power9_realize,
 754                                     &plc->parent_realize);
 755 }
 756
 757 static const TypeInfo pnv_lpc_power9_info = {
 758     .name          = TYPE_PNV9_LPC,
 759     .parent        = TYPE_PNV_LPC,
 760     .class_init    = pnv_lpc_power9_class_init,
 761 };
 762
 763 static void pnv_lpc_power10_class_init(ObjectClass *klass, void *data)
 764 {
 765     DeviceClass *dc = DEVICE_CLASS(klass);
 766
 767     dc->desc = "PowerNV LPC Controller POWER10";
 768 }
 769
 770 static const TypeInfo pnv_lpc_power10_info = {
 771     .name          = TYPE_PNV10_LPC,
 772     .parent        = TYPE_PNV9_LPC,
 773     .class_init    = pnv_lpc_power10_class_init,
 774 };
 775
 776 static void pnv_lpc_realize(DeviceState *dev, Error **errp)
 777 {
 778     PnvLpcController *lpc = PNV_LPC(dev);
 779
 780     /* Reg inits */
 781     lpc->lpc_hc_fw_rd_acc_size = LPC_HC_FW_RD_4B;
 782
 783     /* Create address space and backing MR for the OPB bus */
 784     memory_region_init(&lpc->opb_mr, OBJECT(dev), "lpc-opb", 0x100000000ull);
 785     address_space_init(&lpc->opb_as, &lpc->opb_mr, "lpc-opb");
 786
 787     /* Create ISA IO and Mem space regions which are the root of
 788      * the ISA bus (ie, ISA address spaces). We don't create a
 789      * separate one for FW which we alias to memory.
 790      */
 791     memory_region_init(&lpc->isa_io, OBJECT(dev), "isa-io", ISA_IO_SIZE);
 792     memory_region_init(&lpc->isa_mem, OBJECT(dev), "isa-mem", ISA_MEM_SIZE);
 793     memory_region_init(&lpc->isa_fw, OBJECT(dev),  "isa-fw", ISA_FW_SIZE);
 794
 795     /* Create windows from the OPB space to the ISA space */
 796     memory_region_init_alias(&lpc->opb_isa_io, OBJECT(dev), "lpc-isa-io",
 797                              &lpc->isa_io, 0, LPC_IO_OPB_SIZE);
 798     memory_region_add_subregion(&lpc->opb_mr, LPC_IO_OPB_ADDR,
 799                                 &lpc->opb_isa_io);
 800     memory_region_init_alias(&lpc->opb_isa_mem, OBJECT(dev), "lpc-isa-mem",
 801                              &lpc->isa_mem, 0, LPC_MEM_OPB_SIZE);
 802     memory_region_add_subregion(&lpc->opb_mr, LPC_MEM_OPB_ADDR,
 803                                 &lpc->opb_isa_mem);
 804     memory_region_init_alias(&lpc->opb_isa_fw, OBJECT(dev), "lpc-isa-fw",
 805                              &lpc->isa_fw, 0, LPC_FW_OPB_SIZE);
 806     memory_region_add_subregion(&lpc->opb_mr, LPC_FW_OPB_ADDR,
 807                                 &lpc->opb_isa_fw);
 808
 809     /* Create MMIO regions for LPC HC and OPB registers */
 810     memory_region_init_io(&lpc->opb_master_regs, OBJECT(dev), &opb_master_ops,
 811                           lpc, "lpc-opb-master", LPC_OPB_REGS_OPB_SIZE);
 812     lpc->opb_master_regs.disable_reentrancy_guard = true;
 813     memory_region_add_subregion(&lpc->opb_mr, LPC_OPB_REGS_OPB_ADDR,
 814                                 &lpc->opb_master_regs);
 815     memory_region_init_io(&lpc->lpc_hc_regs, OBJECT(dev), &lpc_hc_ops, lpc,
 816                           "lpc-hc", LPC_HC_REGS_OPB_SIZE);
 817     /* xscom writes to lpc-hc. As such mark lpc-hc re-entrancy safe */
 818     lpc->lpc_hc_regs.disable_reentrancy_guard = true;
 819     memory_region_add_subregion(&lpc->opb_mr, LPC_HC_REGS_OPB_ADDR,
 820                                 &lpc->lpc_hc_regs);
 821
 822     qdev_init_gpio_out_named(dev, &lpc->psi_irq_lpchc, "LPCHC", 1);
 823 }
 824
 825 static Property pnv_lpc_properties[] = {
 826     DEFINE_PROP_BOOL("psi-serirq", PnvLpcController, psi_has_serirq, false),
 827     DEFINE_PROP_END_OF_LIST(),
 828 };
 829
 830 static void pnv_lpc_class_init(ObjectClass *klass, void *data)
 831 {
 832     DeviceClass *dc = DEVICE_CLASS(klass);
 833
 834     device_class_set_props(dc, pnv_lpc_properties);
 835     dc->realize = pnv_lpc_realize;
 836     dc->desc = "PowerNV LPC Controller";
 837     dc->user_creatable = false;
 838 }
 839
 840 static const TypeInfo pnv_lpc_info = {
 841     .name          = TYPE_PNV_LPC,
 842     .parent        = TYPE_DEVICE,
 843     .instance_size = sizeof(PnvLpcController),
 844     .class_init    = pnv_lpc_class_init,
 845     .class_size    = sizeof(PnvLpcClass),
 846     .abstract      = true,
 847 };
 848
 849 static void pnv_lpc_register_types(void)
 850 {
 851     type_register_static(&pnv_lpc_info);
 852     type_register_static(&pnv_lpc_power8_info);
 853     type_register_static(&pnv_lpc_power9_info);
 854     type_register_static(&pnv_lpc_power10_info);
 855 }
 856
 857 type_init(pnv_lpc_register_types)
 858
 859 /* If we don't use the built-in LPC interrupt deserializer, we need
 860  * to provide a set of qirqs for the ISA bus or things will go bad.
 861  *
 862  * Most machines using pre-Naples chips (without said deserializer)
 863  * have a CPLD that will collect the SerIRQ and shoot them as a
 864  * single level interrupt to the P8 chip. So let's setup a hook
 865  * for doing just that.
 866  */
 867 static void pnv_lpc_isa_irq_handler_cpld(void *opaque, int n, int level)
 868 {
 869     PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
 870     uint32_t old_state = pnv->cpld_irqstate;
 871     PnvLpcController *lpc = PNV_LPC(opaque);
 872
 873     if (level) {
 874         pnv->cpld_irqstate |= 1u << n;
 875     } else {
 876         pnv->cpld_irqstate &= ~(1u << n);
 877     }
 878
 879     if (pnv->cpld_irqstate != old_state) {
 880         qemu_set_irq(lpc->psi_irq_lpchc, pnv->cpld_irqstate != 0);
 881     }
 882 }
 883
 884 static void pnv_lpc_isa_irq_handler(void *opaque, int n, int level)
 885 {
 886     PnvLpcController *lpc = PNV_LPC(opaque);
 887     uint32_t irq_bit = LPC_HC_IRQ_SERIRQ0 >> n;
 888
 889     if (level) {
 890         lpc->lpc_hc_irq_inputs |= irq_bit;
 891
 892         /*
 893          * The LPC HC in Naples and later latches LPC IRQ into a bit field in
 894          * the IRQSTAT register, and that drives the PSI IRQ to the IC.
 895          * Software clears this bit manually (see LPC_HC_IRQSTAT handler).
 896          */
 897         lpc->lpc_hc_irqstat |= irq_bit;
 898         pnv_lpc_eval_irqs(lpc);
 899     } else {
 900         lpc->lpc_hc_irq_inputs &= ~irq_bit;
 901
 902         /* POWER9 adds an auto-clear mode that clears IRQSTAT bits on EOI */
 903         if (lpc->psi_has_serirq &&
 904             (lpc->lpc_hc_irqser_ctrl & LPC_HC_IRQSER_AUTO_CLEAR)) {
 905             lpc->lpc_hc_irqstat &= ~irq_bit;
 906             pnv_lpc_eval_irqs(lpc);
 907         }
 908     }
 909 }
 910
 911 ISABus *pnv_lpc_isa_create(PnvLpcController *lpc, bool use_cpld, Error **errp)
 912 {
 913     Error *local_err = NULL;
 914     ISABus *isa_bus;
 915     qemu_irq *irqs;
 916     qemu_irq_handler handler;
 917
 918     /* let isa_bus_new() create its own bridge on SysBus otherwise
 919      * devices specified on the command line won't find the bus and
 920      * will fail to create.
 921      */
 922     isa_bus = isa_bus_new(NULL, &lpc->isa_mem, &lpc->isa_io, &local_err);
 923     if (local_err) {
 924         error_propagate(errp, local_err);
 925         return NULL;
 926     }
 927
 928     /* Not all variants have a working serial irq decoder. If not,
 929      * handling of LPC interrupts becomes a platform issue (some
 930      * platforms have a CPLD to do it).
 931      */
 932     if (use_cpld) {
 933         handler = pnv_lpc_isa_irq_handler_cpld;
 934     } else {
 935         handler = pnv_lpc_isa_irq_handler;
 936     }
 937
 938     /* POWER has a 17th irq, QEMU only implements the 16 regular device irqs */
 939     irqs = qemu_allocate_irqs(handler, lpc, ISA_NUM_IRQS);
 940
 941     isa_bus_register_input_irqs(isa_bus, irqs);
 942
 943     return isa_bus;
 944 }