qemu

1
/*
2
 * QEMU ICH9 Emulation
3
 *
4
 * Copyright (c) 2006 Fabrice Bellard
5
 * Copyright (c) 2009, 2010, 2011
6
 *               Isaku Yamahata <yamahata at valinux co jp>
7
 *               VA Linux Systems Japan K.K.
8
 * Copyright (C) 2012 Jason Baron <jbaron@redhat.com>
9
 *
10
 * This is based on piix.c, but heavily modified.
11
 *
12
 * Permission is hereby granted, free of charge, to any person obtaining a copy
13
 * of this software and associated documentation files (the "Software"), to deal
14
 * in the Software without restriction, including without limitation the rights
15
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
16
 * copies of the Software, and to permit persons to whom the Software is
17
 * furnished to do so, subject to the following conditions:
18
 *
19
 * The above copyright notice and this permission notice shall be included in
20
 * all copies or substantial portions of the Software.
21
 *
22
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
23
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
24
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
25
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
26
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
27
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
28
 * THE SOFTWARE.
29
 */
30

31
#include "qemu/osdep.h"
32
#include "qemu/log.h"
33
#include "cpu.h"
34
#include "qapi/error.h"
35
#include "qapi/visitor.h"
36
#include "qemu/range.h"
37
#include "hw/dma/i8257.h"
38
#include "hw/isa/isa.h"
39
#include "migration/vmstate.h"
40
#include "hw/irq.h"
41
#include "hw/isa/apm.h"
42
#include "hw/pci/pci.h"
43
#include "hw/southbridge/ich9.h"
44
#include "hw/acpi/acpi.h"
45
#include "hw/acpi/ich9.h"
46
#include "hw/pci/pci_bus.h"
47
#include "hw/qdev-properties.h"
48
#include "sysemu/runstate.h"
49
#include "sysemu/sysemu.h"
50
#include "hw/core/cpu.h"
51
#include "hw/nvram/fw_cfg.h"
52
#include "qemu/cutils.h"
53
#include "hw/acpi/acpi_aml_interface.h"
54
#include "trace.h"
55

56
/*****************************************************************************/
57
/* ICH9 LPC PCI to ISA bridge */
58

59
/* chipset configuration register
60
 * to access chipset configuration registers, pci_[sg]et_{byte, word, long}
61
 * are used.
62
 * Although it's not pci configuration space, it's little endian as Intel.
63
 */
64

65
static void ich9_cc_update_ir(uint8_t irr[PCI_NUM_PINS], uint16_t ir)
66
{
67
    int intx;
68
    for (intx = 0; intx < PCI_NUM_PINS; intx++) {
69
        irr[intx] = (ir >> (intx * ICH9_CC_DIR_SHIFT)) & ICH9_CC_DIR_MASK;
70
    }
71
}
72

73
static void ich9_cc_update(ICH9LPCState *lpc)
74
{
75
    int slot;
76
    int pci_intx;
77

78
    const int reg_offsets[] = {
79
        ICH9_CC_D25IR,
80
        ICH9_CC_D26IR,
81
        ICH9_CC_D27IR,
82
        ICH9_CC_D28IR,
83
        ICH9_CC_D29IR,
84
        ICH9_CC_D30IR,
85
        ICH9_CC_D31IR,
86
    };
87
    const int *offset;
88

89
    /* D{25 - 31}IR, but D30IR is read only to 0. */
90
    for (slot = 25, offset = reg_offsets; slot < 32; slot++, offset++) {
91
        if (slot == 30) {
92
            continue;
93
        }
94
        ich9_cc_update_ir(lpc->irr[slot],
95
                          pci_get_word(lpc->chip_config + *offset));
96
    }
97

98
    /*
99
     * D30: DMI2PCI bridge
100
     * It is arbitrarily decided how INTx lines of PCI devices behind
101
     * the bridge are connected to pirq lines. Our choice is PIRQ[E-H].
102
     * INT[A-D] are connected to PIRQ[E-H]
103
     */
104
    for (pci_intx = 0; pci_intx < PCI_NUM_PINS; pci_intx++) {
105
        lpc->irr[30][pci_intx] = pci_intx + 4;
106
    }
107
}
108

109
static void ich9_cc_init(ICH9LPCState *lpc)
110
{
111
    int slot;
112
    int intx;
113

114
    /* the default irq routing is arbitrary as long as it matches with
115
     * acpi irq routing table.
116
     * The one that is incompatible with piix_pci(= bochs) one is
117
     * intentionally chosen to let the users know that the different
118
     * board is used.
119
     *
120
     * int[A-D] -> pirq[E-F]
121
     * avoid pirq A-D because they are used for pci express port
122
     */
123
    for (slot = 0; slot < PCI_SLOT_MAX; slot++) {
124
        for (intx = 0; intx < PCI_NUM_PINS; intx++) {
125
            lpc->irr[slot][intx] = (slot + intx) % 4 + 4;
126
        }
127
    }
128
    ich9_cc_update(lpc);
129
}
130

131
static void ich9_cc_reset(ICH9LPCState *lpc)
132
{
133
    uint8_t *c = lpc->chip_config;
134

135
    memset(lpc->chip_config, 0, sizeof(lpc->chip_config));
136

137
    pci_set_long(c + ICH9_CC_D31IR, ICH9_CC_DIR_DEFAULT);
138
    pci_set_long(c + ICH9_CC_D30IR, ICH9_CC_D30IR_DEFAULT);
139
    pci_set_long(c + ICH9_CC_D29IR, ICH9_CC_DIR_DEFAULT);
140
    pci_set_long(c + ICH9_CC_D28IR, ICH9_CC_DIR_DEFAULT);
141
    pci_set_long(c + ICH9_CC_D27IR, ICH9_CC_DIR_DEFAULT);
142
    pci_set_long(c + ICH9_CC_D26IR, ICH9_CC_DIR_DEFAULT);
143
    pci_set_long(c + ICH9_CC_D25IR, ICH9_CC_DIR_DEFAULT);
144
    pci_set_long(c + ICH9_CC_GCS, ICH9_CC_GCS_DEFAULT);
145

146
    ich9_cc_update(lpc);
147
}
148

149
static void ich9_cc_addr_len(uint64_t *addr, unsigned *len)
150
{
151
    *addr &= ICH9_CC_ADDR_MASK;
152
    if (*addr + *len >= ICH9_CC_SIZE) {
153
        *len = ICH9_CC_SIZE - *addr;
154
    }
155
}
156

157
/* val: little endian */
158
static void ich9_cc_write(void *opaque, hwaddr addr,
159
                          uint64_t val, unsigned len)
160
{
161
    ICH9LPCState *lpc = (ICH9LPCState *)opaque;
162

163
    trace_ich9_cc_write(addr, val, len);
164
    ich9_cc_addr_len(&addr, &len);
165
    memcpy(lpc->chip_config + addr, &val, len);
166
    pci_bus_fire_intx_routing_notifier(pci_get_bus(&lpc->d));
167
    ich9_cc_update(lpc);
168
}
169

170
/* return value: little endian */
171
static uint64_t ich9_cc_read(void *opaque, hwaddr addr,
172
                              unsigned len)
173
{
174
    ICH9LPCState *lpc = (ICH9LPCState *)opaque;
175

176
    uint32_t val = 0;
177
    ich9_cc_addr_len(&addr, &len);
178
    memcpy(&val, lpc->chip_config + addr, len);
179
    trace_ich9_cc_read(addr, val, len);
180
    return val;
181
}
182

183
/* IRQ routing */
184
/* */
185
static void ich9_lpc_rout(uint8_t pirq_rout, int *pic_irq, int *pic_dis)
186
{
187
    *pic_irq = pirq_rout & ICH9_LPC_PIRQ_ROUT_MASK;
188
    *pic_dis = pirq_rout & ICH9_LPC_PIRQ_ROUT_IRQEN;
189
}
190

191
static void ich9_lpc_pic_irq(ICH9LPCState *lpc, int pirq_num,
192
                             int *pic_irq, int *pic_dis)
193
{
194
    switch (pirq_num) {
195
    case 0 ... 3: /* A-D */
196
        ich9_lpc_rout(lpc->d.config[ICH9_LPC_PIRQA_ROUT + pirq_num],
197
                      pic_irq, pic_dis);
198
        return;
199
    case 4 ... 7: /* E-H */
200
        ich9_lpc_rout(lpc->d.config[ICH9_LPC_PIRQE_ROUT + (pirq_num - 4)],
201
                      pic_irq, pic_dis);
202
        return;
203
    default:
204
        break;
205
    }
206
    abort();
207
}
208

209
/* gsi: i8259+ioapic irq 0-15, otherwise assert */
210
static void ich9_lpc_update_pic(ICH9LPCState *lpc, int gsi)
211
{
212
    int i, pic_level;
213

214
    assert(gsi < ICH9_LPC_PIC_NUM_PINS);
215

216
    /* The pic level is the logical OR of all the PCI irqs mapped to it */
217
    pic_level = 0;
218
    for (i = 0; i < ICH9_LPC_NB_PIRQS; i++) {
219
        int tmp_irq;
220
        int tmp_dis;
221
        ich9_lpc_pic_irq(lpc, i, &tmp_irq, &tmp_dis);
222
        if (!tmp_dis && tmp_irq == gsi) {
223
            pic_level |= pci_bus_get_irq_level(pci_get_bus(&lpc->d), i);
224
        }
225
    }
226
    if (gsi == lpc->sci_gsi) {
227
        pic_level |= lpc->sci_level;
228
    }
229

230
    qemu_set_irq(lpc->gsi[gsi], pic_level);
231
}
232

233
/* APIC mode: GSIx: PIRQ[A-H] -> GSI 16, ... no pirq shares same APIC pins. */
234
static int ich9_pirq_to_gsi(int pirq)
235
{
236
    return pirq + ICH9_LPC_PIC_NUM_PINS;
237
}
238

239
static int ich9_gsi_to_pirq(int gsi)
240
{
241
    return gsi - ICH9_LPC_PIC_NUM_PINS;
242
}
243

244
/* gsi: ioapic irq 16-23, otherwise assert */
245
static void ich9_lpc_update_apic(ICH9LPCState *lpc, int gsi)
246
{
247
    int level = 0;
248

249
    assert(gsi >= ICH9_LPC_PIC_NUM_PINS);
250

251
    level |= pci_bus_get_irq_level(pci_get_bus(&lpc->d), ich9_gsi_to_pirq(gsi));
252
    if (gsi == lpc->sci_gsi) {
253
        level |= lpc->sci_level;
254
    }
255

256
    qemu_set_irq(lpc->gsi[gsi], level);
257
}
258

259
static void ich9_lpc_set_irq(void *opaque, int pirq, int level)
260
{
261
    ICH9LPCState *lpc = opaque;
262
    int pic_irq, pic_dis;
263

264
    assert(0 <= pirq);
265
    assert(pirq < ICH9_LPC_NB_PIRQS);
266

267
    ich9_lpc_update_apic(lpc, ich9_pirq_to_gsi(pirq));
268
    ich9_lpc_pic_irq(lpc, pirq, &pic_irq, &pic_dis);
269
    ich9_lpc_update_pic(lpc, pic_irq);
270
}
271

272
/* return the pirq number (PIRQ[A-H]:0-7) corresponding to
273
 * a given device irq pin.
274
 */
275
static int ich9_lpc_map_irq(PCIDevice *pci_dev, int intx)
276
{
277
    BusState *bus = qdev_get_parent_bus(&pci_dev->qdev);
278
    PCIBus *pci_bus = PCI_BUS(bus);
279
    PCIDevice *lpc_pdev =
280
            pci_bus->devices[PCI_DEVFN(ICH9_LPC_DEV, ICH9_LPC_FUNC)];
281
    ICH9LPCState *lpc = ICH9_LPC_DEVICE(lpc_pdev);
282

283
    return lpc->irr[PCI_SLOT(pci_dev->devfn)][intx];
284
}
285

286
static PCIINTxRoute ich9_route_intx_pin_to_irq(void *opaque, int pirq_pin)
287
{
288
    ICH9LPCState *lpc = opaque;
289
    PCIINTxRoute route;
290
    int pic_irq;
291
    int pic_dis;
292

293
    assert(0 <= pirq_pin);
294
    assert(pirq_pin < ICH9_LPC_NB_PIRQS);
295

296
    route.mode = PCI_INTX_ENABLED;
297
    ich9_lpc_pic_irq(lpc, pirq_pin, &pic_irq, &pic_dis);
298
    if (!pic_dis) {
299
        if (pic_irq < ICH9_LPC_PIC_NUM_PINS) {
300
            route.irq = pic_irq;
301
        } else {
302
            route.mode = PCI_INTX_DISABLED;
303
            route.irq = -1;
304
        }
305
    } else {
306
        /*
307
         * Strictly speaking, this is wrong. The PIRQ should be routed
308
         * to *both* the I/O APIC and the PIC, on different pins. The
309
         * I/O APIC has a fixed mapping to IRQ16-23, while the PIC is
310
         * routed according to the PIRQx_ROUT configuration. But QEMU
311
         * doesn't (yet) cope with the concept of pin numbers differing
312
         * between PIC and I/O APIC, and neither does the in-kernel KVM
313
         * irqchip support. So we route to the I/O APIC *only* if the
314
         * routing to the PIC is disabled in the PIRQx_ROUT settings.
315
         *
316
         * This seems to work even if we boot a Linux guest with 'noapic'
317
         * to make it use the legacy PIC, and then kexec directly into a
318
         * new kernel which uses the I/O APIC. The new kernel explicitly
319
         * disables the PIRQ routing even though it doesn't need to care.
320
         */
321
        route.irq = ich9_pirq_to_gsi(pirq_pin);
322
    }
323

324
    return route;
325
}
326

327
void ich9_generate_smi(void)
328
{
329
    cpu_interrupt(first_cpu, CPU_INTERRUPT_SMI);
330
}
331

332
/* Returns -1 on error, IRQ number on success */
333
static int ich9_lpc_sci_irq(ICH9LPCState *lpc)
334
{
335
    uint8_t sel = lpc->d.config[ICH9_LPC_ACPI_CTRL] &
336
                  ICH9_LPC_ACPI_CTRL_SCI_IRQ_SEL_MASK;
337
    switch (sel) {
338
    case ICH9_LPC_ACPI_CTRL_9:
339
        return 9;
340
    case ICH9_LPC_ACPI_CTRL_10:
341
        return 10;
342
    case ICH9_LPC_ACPI_CTRL_11:
343
        return 11;
344
    case ICH9_LPC_ACPI_CTRL_20:
345
        return 20;
346
    case ICH9_LPC_ACPI_CTRL_21:
347
        return 21;
348
    default:
349
        /* reserved */
350
        qemu_log_mask(LOG_GUEST_ERROR,
351
                      "ICH9 LPC: SCI IRQ SEL #%u is reserved\n", sel);
352
        break;
353
    }
354
    return -1;
355
}
356

357
static void ich9_set_sci(void *opaque, int irq_num, int level)
358
{
359
    ICH9LPCState *lpc = opaque;
360
    int irq;
361

362
    assert(irq_num == 0);
363
    level = !!level;
364
    if (level == lpc->sci_level) {
365
        return;
366
    }
367
    lpc->sci_level = level;
368

369
    irq = lpc->sci_gsi;
370
    if (irq < 0) {
371
        return;
372
    }
373

374
    if (irq >= ICH9_LPC_PIC_NUM_PINS) {
375
        ich9_lpc_update_apic(lpc, irq);
376
    } else {
377
        ich9_lpc_update_pic(lpc, irq);
378
    }
379
}
380

381
static void smi_features_ok_callback(void *opaque)
382
{
383
    ICH9LPCState *lpc = opaque;
384
    uint64_t guest_features;
385
    uint64_t guest_cpu_hotplug_features;
386

387
    if (lpc->smi_features_ok) {
388
        /* negotiation already complete, features locked */
389
        return;
390
    }
391

392
    memcpy(&guest_features, lpc->smi_guest_features_le, sizeof guest_features);
393
    le64_to_cpus(&guest_features);
394
    if (guest_features & ~lpc->smi_host_features) {
395
        /* guest requests invalid features, leave @features_ok at zero */
396
        return;
397
    }
398

399
    guest_cpu_hotplug_features = guest_features &
400
                                 (BIT_ULL(ICH9_LPC_SMI_F_CPU_HOTPLUG_BIT) |
401
                                  BIT_ULL(ICH9_LPC_SMI_F_CPU_HOT_UNPLUG_BIT));
402
    if (!(guest_features & BIT_ULL(ICH9_LPC_SMI_F_BROADCAST_BIT)) &&
403
        guest_cpu_hotplug_features) {
404
        /*
405
         * cpu hot-[un]plug with SMI requires SMI broadcast,
406
         * leave @features_ok at zero
407
         */
408
        return;
409
    }
410

411
    if (guest_cpu_hotplug_features ==
412
        BIT_ULL(ICH9_LPC_SMI_F_CPU_HOT_UNPLUG_BIT)) {
413
        /* cpu hot-unplug is unsupported without cpu-hotplug */
414
        return;
415
    }
416

417
    /* valid feature subset requested, lock it down, report success */
418
    lpc->smi_negotiated_features = guest_features;
419
    lpc->smi_features_ok = 1;
420
}
421

422
static void ich9_lpc_pm_init(ICH9LPCState *lpc)
423
{
424
    qemu_irq sci_irq;
425
    FWCfgState *fw_cfg = fw_cfg_find();
426

427
    sci_irq = qemu_allocate_irq(ich9_set_sci, lpc, 0);
428
    ich9_pm_init(PCI_DEVICE(lpc), &lpc->pm, sci_irq);
429

430
    if (lpc->smi_host_features && fw_cfg) {
431
        uint64_t host_features_le;
432

433
        host_features_le = cpu_to_le64(lpc->smi_host_features);
434
        memcpy(lpc->smi_host_features_le, &host_features_le,
435
               sizeof host_features_le);
436
        fw_cfg_add_file(fw_cfg, "etc/smi/supported-features",
437
                        lpc->smi_host_features_le,
438
                        sizeof lpc->smi_host_features_le);
439

440
        /* The other two guest-visible fields are cleared on device reset, we
441
         * just link them into fw_cfg here.
442
         */
443
        fw_cfg_add_file_callback(fw_cfg, "etc/smi/requested-features",
444
                                 NULL, NULL, NULL,
445
                                 lpc->smi_guest_features_le,
446
                                 sizeof lpc->smi_guest_features_le,
447
                                 false);
448
        fw_cfg_add_file_callback(fw_cfg, "etc/smi/features-ok",
449
                                 smi_features_ok_callback, NULL, lpc,
450
                                 &lpc->smi_features_ok,
451
                                 sizeof lpc->smi_features_ok,
452
                                 true);
453
    }
454
}
455

456
/* APM */
457

458
static void ich9_apm_ctrl_changed(uint32_t val, void *arg)
459
{
460
    ICH9LPCState *lpc = arg;
461

462
    /* ACPI specs 3.0, 4.7.2.5 */
463
    acpi_pm1_cnt_update(&lpc->pm.acpi_regs,
464
                        val == ICH9_APM_ACPI_ENABLE,
465
                        val == ICH9_APM_ACPI_DISABLE);
466
    if (val == ICH9_APM_ACPI_ENABLE || val == ICH9_APM_ACPI_DISABLE) {
467
        return;
468
    }
469

470
    /* SMI_EN = PMBASE + 30. SMI control and enable register */
471
    if (lpc->pm.smi_en & ICH9_PMIO_SMI_EN_APMC_EN) {
472
        if (lpc->smi_negotiated_features &
473
            (UINT64_C(1) << ICH9_LPC_SMI_F_BROADCAST_BIT)) {
474
            CPUState *cs;
475
            CPU_FOREACH(cs) {
476
                cpu_interrupt(cs, CPU_INTERRUPT_SMI);
477
            }
478
        } else {
479
            cpu_interrupt(current_cpu, CPU_INTERRUPT_SMI);
480
        }
481
    }
482
}
483

484
/* config:PMBASE */
485
static void
486
ich9_lpc_pmbase_sci_update(ICH9LPCState *lpc)
487
{
488
    uint32_t pm_io_base = pci_get_long(lpc->d.config + ICH9_LPC_PMBASE);
489
    uint8_t acpi_cntl = pci_get_long(lpc->d.config + ICH9_LPC_ACPI_CTRL);
490
    int new_gsi;
491

492
    if (acpi_cntl & ICH9_LPC_ACPI_CTRL_ACPI_EN) {
493
        pm_io_base &= ICH9_LPC_PMBASE_BASE_ADDRESS_MASK;
494
    } else {
495
        pm_io_base = 0;
496
    }
497

498
    ich9_pm_iospace_update(&lpc->pm, pm_io_base);
499

500
    new_gsi = ich9_lpc_sci_irq(lpc);
501
    if (new_gsi == -1) {
502
        return;
503
    }
504
    if (lpc->sci_level && new_gsi != lpc->sci_gsi) {
505
        qemu_set_irq(lpc->pm.irq, 0);
506
        lpc->sci_gsi = new_gsi;
507
        qemu_set_irq(lpc->pm.irq, 1);
508
    }
509
    lpc->sci_gsi = new_gsi;
510
}
511

512
/* config:RCBA */
513
static void ich9_lpc_rcba_update(ICH9LPCState *lpc, uint32_t rcba_old)
514
{
515
    uint32_t rcba = pci_get_long(lpc->d.config + ICH9_LPC_RCBA);
516

517
    if (rcba_old & ICH9_LPC_RCBA_EN) {
518
        memory_region_del_subregion(get_system_memory(), &lpc->rcrb_mem);
519
    }
520
    if (rcba & ICH9_LPC_RCBA_EN) {
521
        memory_region_add_subregion_overlap(get_system_memory(),
522
                                            rcba & ICH9_LPC_RCBA_BA_MASK,
523
                                            &lpc->rcrb_mem, 1);
524
    }
525
}
526

527
/* config:GEN_PMCON* */
528
static void
529
ich9_lpc_pmcon_update(ICH9LPCState *lpc)
530
{
531
    uint16_t gen_pmcon_1 = pci_get_word(lpc->d.config + ICH9_LPC_GEN_PMCON_1);
532
    uint16_t wmask;
533

534
    if (gen_pmcon_1 & ICH9_LPC_GEN_PMCON_1_SMI_LOCK) {
535
        wmask = pci_get_word(lpc->d.wmask + ICH9_LPC_GEN_PMCON_1);
536
        wmask &= ~ICH9_LPC_GEN_PMCON_1_SMI_LOCK;
537
        pci_set_word(lpc->d.wmask + ICH9_LPC_GEN_PMCON_1, wmask);
538
        lpc->pm.smi_en_wmask &= ~1;
539
    }
540
}
541

542
static int ich9_lpc_post_load(void *opaque, int version_id)
543
{
544
    ICH9LPCState *lpc = opaque;
545

546
    ich9_lpc_pmbase_sci_update(lpc);
547
    ich9_lpc_rcba_update(lpc, 0 /* disabled ICH9_LPC_RCBA_EN */);
548
    ich9_lpc_pmcon_update(lpc);
549
    return 0;
550
}
551

552
static void ich9_lpc_config_write(PCIDevice *d,
553
                                  uint32_t addr, uint32_t val, int len)
554
{
555
    ICH9LPCState *lpc = ICH9_LPC_DEVICE(d);
556
    uint32_t rcba_old = pci_get_long(d->config + ICH9_LPC_RCBA);
557

558
    pci_default_write_config(d, addr, val, len);
559
    if (ranges_overlap(addr, len, ICH9_LPC_PMBASE, 4) ||
560
        ranges_overlap(addr, len, ICH9_LPC_ACPI_CTRL, 1)) {
561
        ich9_lpc_pmbase_sci_update(lpc);
562
    }
563
    if (ranges_overlap(addr, len, ICH9_LPC_RCBA, 4)) {
564
        ich9_lpc_rcba_update(lpc, rcba_old);
565
    }
566
    if (ranges_overlap(addr, len, ICH9_LPC_PIRQA_ROUT, 4)) {
567
        pci_bus_fire_intx_routing_notifier(pci_get_bus(&lpc->d));
568
    }
569
    if (ranges_overlap(addr, len, ICH9_LPC_PIRQE_ROUT, 4)) {
570
        pci_bus_fire_intx_routing_notifier(pci_get_bus(&lpc->d));
571
    }
572
    if (ranges_overlap(addr, len, ICH9_LPC_GEN_PMCON_1, 8)) {
573
        ich9_lpc_pmcon_update(lpc);
574
    }
575
}
576

577
static void ich9_lpc_reset(DeviceState *qdev)
578
{
579
    PCIDevice *d = PCI_DEVICE(qdev);
580
    ICH9LPCState *lpc = ICH9_LPC_DEVICE(d);
581
    uint32_t rcba_old = pci_get_long(d->config + ICH9_LPC_RCBA);
582
    int i;
583

584
    for (i = 0; i < 4; i++) {
585
        pci_set_byte(d->config + ICH9_LPC_PIRQA_ROUT + i,
586
                     ICH9_LPC_PIRQ_ROUT_DEFAULT);
587
    }
588
    for (i = 0; i < 4; i++) {
589
        pci_set_byte(d->config + ICH9_LPC_PIRQE_ROUT + i,
590
                     ICH9_LPC_PIRQ_ROUT_DEFAULT);
591
    }
592
    pci_set_byte(d->config + ICH9_LPC_ACPI_CTRL, ICH9_LPC_ACPI_CTRL_DEFAULT);
593

594
    pci_set_long(d->config + ICH9_LPC_PMBASE, ICH9_LPC_PMBASE_DEFAULT);
595
    pci_set_long(d->config + ICH9_LPC_RCBA, ICH9_LPC_RCBA_DEFAULT);
596

597
    ich9_cc_reset(lpc);
598

599
    ich9_lpc_pmbase_sci_update(lpc);
600
    ich9_lpc_rcba_update(lpc, rcba_old);
601

602
    lpc->sci_level = 0;
603
    lpc->rst_cnt = 0;
604

605
    memset(lpc->smi_guest_features_le, 0, sizeof lpc->smi_guest_features_le);
606
    lpc->smi_features_ok = 0;
607
    lpc->smi_negotiated_features = 0;
608
}
609

610
/* root complex register block is mapped into memory space */
611
static const MemoryRegionOps rcrb_mmio_ops = {
612
    .read = ich9_cc_read,
613
    .write = ich9_cc_write,
614
    .endianness = DEVICE_LITTLE_ENDIAN,
615
};
616

617
static void ich9_lpc_machine_ready(Notifier *n, void *opaque)
618
{
619
    ICH9LPCState *s = container_of(n, ICH9LPCState, machine_ready);
620
    MemoryRegion *io_as = pci_address_space_io(&s->d);
621
    uint8_t *pci_conf;
622

623
    pci_conf = s->d.config;
624
    if (memory_region_present(io_as, 0x3f8)) {
625
        /* com1 */
626
        pci_conf[0x82] |= 0x01;
627
    }
628
    if (memory_region_present(io_as, 0x2f8)) {
629
        /* com2 */
630
        pci_conf[0x82] |= 0x02;
631
    }
632
    if (memory_region_present(io_as, 0x378)) {
633
        /* lpt */
634
        pci_conf[0x82] |= 0x04;
635
    }
636
    if (memory_region_present(io_as, 0x3f2)) {
637
        /* floppy */
638
        pci_conf[0x82] |= 0x08;
639
    }
640
}
641

642
/* reset control */
643
static void ich9_rst_cnt_write(void *opaque, hwaddr addr, uint64_t val,
644
                               unsigned len)
645
{
646
    ICH9LPCState *lpc = opaque;
647

648
    if (val & 4) {
649
        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
650
        return;
651
    }
652
    lpc->rst_cnt = val & 0xA; /* keep FULL_RST (bit 3) and SYS_RST (bit 1) */
653
}
654

655
static uint64_t ich9_rst_cnt_read(void *opaque, hwaddr addr, unsigned len)
656
{
657
    ICH9LPCState *lpc = opaque;
658

659
    return lpc->rst_cnt;
660
}
661

662
static const MemoryRegionOps ich9_rst_cnt_ops = {
663
    .read = ich9_rst_cnt_read,
664
    .write = ich9_rst_cnt_write,
665
    .endianness = DEVICE_LITTLE_ENDIAN
666
};
667

668
static void ich9_lpc_initfn(Object *obj)
669
{
670
    ICH9LPCState *lpc = ICH9_LPC_DEVICE(obj);
671

672
    static const uint8_t acpi_enable_cmd = ICH9_APM_ACPI_ENABLE;
673
    static const uint8_t acpi_disable_cmd = ICH9_APM_ACPI_DISABLE;
674

675
    object_initialize_child(obj, "rtc", &lpc->rtc, TYPE_MC146818_RTC);
676

677
    qdev_init_gpio_out_named(DEVICE(lpc), lpc->gsi, ICH9_GPIO_GSI,
678
                             IOAPIC_NUM_PINS);
679

680
    object_property_add_uint8_ptr(obj, ACPI_PM_PROP_SCI_INT,
681
                                  &lpc->sci_gsi, OBJ_PROP_FLAG_READ);
682
    object_property_add_uint8_ptr(OBJECT(lpc), ACPI_PM_PROP_ACPI_ENABLE_CMD,
683
                                  &acpi_enable_cmd, OBJ_PROP_FLAG_READ);
684
    object_property_add_uint8_ptr(OBJECT(lpc), ACPI_PM_PROP_ACPI_DISABLE_CMD,
685
                                  &acpi_disable_cmd, OBJ_PROP_FLAG_READ);
686
    object_property_add_uint64_ptr(obj, ICH9_LPC_SMI_NEGOTIATED_FEAT_PROP,
687
                                   &lpc->smi_negotiated_features,
688
                                   OBJ_PROP_FLAG_READ);
689

690
    ich9_pm_add_properties(obj, &lpc->pm);
691
}
692

693
static void ich9_lpc_realize(PCIDevice *d, Error **errp)
694
{
695
    ICH9LPCState *lpc = ICH9_LPC_DEVICE(d);
696
    PCIBus *pci_bus = pci_get_bus(d);
697
    ISABus *isa_bus;
698
    uint32_t irq;
699

700
    if ((lpc->smi_host_features & BIT_ULL(ICH9_LPC_SMI_F_CPU_HOT_UNPLUG_BIT)) &&
701
        !(lpc->smi_host_features & BIT_ULL(ICH9_LPC_SMI_F_CPU_HOTPLUG_BIT))) {
702
        /*
703
         * smi_features_ok_callback() throws an error on this.
704
         *
705
         * So bail out here instead of advertizing the invalid
706
         * configuration and get obscure firmware failures from that.
707
         */
708
        error_setg(errp, "cpu hot-unplug requires cpu hot-plug");
709
        return;
710
    }
711

712
    isa_bus = isa_bus_new(DEVICE(d), get_system_memory(), get_system_io(),
713
                          errp);
714
    if (!isa_bus) {
715
        return;
716
    }
717

718
    pci_set_long(d->wmask + ICH9_LPC_PMBASE,
719
                 ICH9_LPC_PMBASE_BASE_ADDRESS_MASK);
720
    pci_set_byte(d->wmask + ICH9_LPC_PMBASE,
721
                 ICH9_LPC_ACPI_CTRL_ACPI_EN |
722
                 ICH9_LPC_ACPI_CTRL_SCI_IRQ_SEL_MASK);
723

724
    memory_region_init_io(&lpc->rcrb_mem, OBJECT(d), &rcrb_mmio_ops, lpc,
725
                          "lpc-rcrb-mmio", ICH9_CC_SIZE);
726

727
    ich9_cc_init(lpc);
728
    apm_init(d, &lpc->apm, ich9_apm_ctrl_changed, lpc);
729

730
    lpc->machine_ready.notify = ich9_lpc_machine_ready;
731
    qemu_add_machine_init_done_notifier(&lpc->machine_ready);
732

733
    memory_region_init_io(&lpc->rst_cnt_mem, OBJECT(d), &ich9_rst_cnt_ops, lpc,
734
                          "lpc-reset-control", 1);
735
    memory_region_add_subregion_overlap(pci_address_space_io(d),
736
                                        ICH9_RST_CNT_IOPORT, &lpc->rst_cnt_mem,
737
                                        1);
738

739
    isa_bus_register_input_irqs(isa_bus, lpc->gsi);
740

741
    i8257_dma_init(OBJECT(d), isa_bus, 0);
742

743
    /* RTC */
744
    qdev_prop_set_int32(DEVICE(&lpc->rtc), "base_year", 2000);
745
    if (!qdev_realize(DEVICE(&lpc->rtc), BUS(isa_bus), errp)) {
746
        return;
747
    }
748
    irq = object_property_get_uint(OBJECT(&lpc->rtc), "irq", &error_fatal);
749
    isa_connect_gpio_out(ISA_DEVICE(&lpc->rtc), 0, irq);
750

751
    pci_bus_irqs(pci_bus, ich9_lpc_set_irq, d, ICH9_LPC_NB_PIRQS);
752
    pci_bus_map_irqs(pci_bus, ich9_lpc_map_irq);
753
    pci_bus_set_route_irq_fn(pci_bus, ich9_route_intx_pin_to_irq);
754

755
    ich9_lpc_pm_init(lpc);
756
}
757

758
static bool ich9_rst_cnt_needed(void *opaque)
759
{
760
    ICH9LPCState *lpc = opaque;
761

762
    return (lpc->rst_cnt != 0);
763
}
764

765
static const VMStateDescription vmstate_ich9_rst_cnt = {
766
    .name = "ICH9LPC/rst_cnt",
767
    .version_id = 1,
768
    .minimum_version_id = 1,
769
    .needed = ich9_rst_cnt_needed,
770
    .fields = (const VMStateField[]) {
771
        VMSTATE_UINT8(rst_cnt, ICH9LPCState),
772
        VMSTATE_END_OF_LIST()
773
    }
774
};
775

776
static bool ich9_smi_feat_needed(void *opaque)
777
{
778
    ICH9LPCState *lpc = opaque;
779

780
    return !buffer_is_zero(lpc->smi_guest_features_le,
781
                           sizeof lpc->smi_guest_features_le) ||
782
           lpc->smi_features_ok;
783
}
784

785
static const VMStateDescription vmstate_ich9_smi_feat = {
786
    .name = "ICH9LPC/smi_feat",
787
    .version_id = 1,
788
    .minimum_version_id = 1,
789
    .needed = ich9_smi_feat_needed,
790
    .fields = (const VMStateField[]) {
791
        VMSTATE_UINT8_ARRAY(smi_guest_features_le, ICH9LPCState,
792
                            sizeof(uint64_t)),
793
        VMSTATE_UINT8(smi_features_ok, ICH9LPCState),
794
        VMSTATE_UINT64(smi_negotiated_features, ICH9LPCState),
795
        VMSTATE_END_OF_LIST()
796
    }
797
};
798

799
static const VMStateDescription vmstate_ich9_lpc = {
800
    .name = "ICH9LPC",
801
    .version_id = 1,
802
    .minimum_version_id = 1,
803
    .post_load = ich9_lpc_post_load,
804
    .fields = (const VMStateField[]) {
805
        VMSTATE_PCI_DEVICE(d, ICH9LPCState),
806
        VMSTATE_STRUCT(apm, ICH9LPCState, 0, vmstate_apm, APMState),
807
        VMSTATE_STRUCT(pm, ICH9LPCState, 0, vmstate_ich9_pm, ICH9LPCPMRegs),
808
        VMSTATE_UINT8_ARRAY(chip_config, ICH9LPCState, ICH9_CC_SIZE),
809
        VMSTATE_UINT32(sci_level, ICH9LPCState),
810
        VMSTATE_END_OF_LIST()
811
    },
812
    .subsections = (const VMStateDescription * const []) {
813
        &vmstate_ich9_rst_cnt,
814
        &vmstate_ich9_smi_feat,
815
        NULL
816
    }
817
};
818

819
static Property ich9_lpc_properties[] = {
820
    DEFINE_PROP_BOOL("noreboot", ICH9LPCState, pin_strap.spkr_hi, false),
821
    DEFINE_PROP_BOOL("smm-compat", ICH9LPCState, pm.smm_compat, false),
822
    DEFINE_PROP_BOOL("smm-enabled", ICH9LPCState, pm.smm_enabled, false),
823
    DEFINE_PROP_BIT64("x-smi-broadcast", ICH9LPCState, smi_host_features,
824
                      ICH9_LPC_SMI_F_BROADCAST_BIT, true),
825
    DEFINE_PROP_BIT64("x-smi-cpu-hotplug", ICH9LPCState, smi_host_features,
826
                      ICH9_LPC_SMI_F_CPU_HOTPLUG_BIT, true),
827
    DEFINE_PROP_BIT64("x-smi-cpu-hotunplug", ICH9LPCState, smi_host_features,
828
                      ICH9_LPC_SMI_F_CPU_HOT_UNPLUG_BIT, true),
829
    DEFINE_PROP_END_OF_LIST(),
830
};
831

832
static void ich9_send_gpe(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
833
{
834
    ICH9LPCState *s = ICH9_LPC_DEVICE(adev);
835

836
    acpi_send_gpe_event(&s->pm.acpi_regs, s->pm.irq, ev);
837
}
838

839
static void build_ich9_isa_aml(AcpiDevAmlIf *adev, Aml *scope)
840
{
841
    Aml *field;
842
    BusState *bus = qdev_get_child_bus(DEVICE(adev), "isa.0");
843
    Aml *sb_scope = aml_scope("\\_SB");
844

845
    /* ICH9 PCI to ISA irq remapping */
846
    aml_append(scope, aml_operation_region("PIRQ", AML_PCI_CONFIG,
847
                                           aml_int(0x60), 0x0C));
848
    /* Fields declarion has to happen *after* operation region */
849
    field = aml_field("PCI0.SF8.PIRQ", AML_BYTE_ACC, AML_NOLOCK, AML_PRESERVE);
850
    aml_append(field, aml_named_field("PRQA", 8));
851
    aml_append(field, aml_named_field("PRQB", 8));
852
    aml_append(field, aml_named_field("PRQC", 8));
853
    aml_append(field, aml_named_field("PRQD", 8));
854
    aml_append(field, aml_reserved_field(0x20));
855
    aml_append(field, aml_named_field("PRQE", 8));
856
    aml_append(field, aml_named_field("PRQF", 8));
857
    aml_append(field, aml_named_field("PRQG", 8));
858
    aml_append(field, aml_named_field("PRQH", 8));
859
    aml_append(sb_scope, field);
860
    aml_append(scope, sb_scope);
861

862
    qbus_build_aml(bus, scope);
863
}
864

865
static void ich9_lpc_class_init(ObjectClass *klass, void *data)
866
{
867
    DeviceClass *dc = DEVICE_CLASS(klass);
868
    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
869
    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
870
    AcpiDeviceIfClass *adevc = ACPI_DEVICE_IF_CLASS(klass);
871
    AcpiDevAmlIfClass *amldevc = ACPI_DEV_AML_IF_CLASS(klass);
872

873
    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
874
    dc->reset = ich9_lpc_reset;
875
    k->realize = ich9_lpc_realize;
876
    dc->vmsd = &vmstate_ich9_lpc;
877
    device_class_set_props(dc, ich9_lpc_properties);
878
    k->config_write = ich9_lpc_config_write;
879
    dc->desc = "ICH9 LPC bridge";
880
    k->vendor_id = PCI_VENDOR_ID_INTEL;
881
    k->device_id = PCI_DEVICE_ID_INTEL_ICH9_8;
882
    k->revision = ICH9_A2_LPC_REVISION;
883
    k->class_id = PCI_CLASS_BRIDGE_ISA;
884
    /*
885
     * Reason: part of ICH9 southbridge, needs to be wired up by
886
     * pc_q35_init()
887
     */
888
    dc->user_creatable = false;
889
    hc->pre_plug = ich9_pm_device_pre_plug_cb;
890
    hc->plug = ich9_pm_device_plug_cb;
891
    hc->unplug_request = ich9_pm_device_unplug_request_cb;
892
    hc->unplug = ich9_pm_device_unplug_cb;
893
    hc->is_hotpluggable_bus = ich9_pm_is_hotpluggable_bus;
894
    adevc->ospm_status = ich9_pm_ospm_status;
895
    adevc->send_event = ich9_send_gpe;
896
    amldevc->build_dev_aml = build_ich9_isa_aml;
897
}
898

899
static const TypeInfo ich9_lpc_info = {
900
    .name       = TYPE_ICH9_LPC_DEVICE,
901
    .parent     = TYPE_PCI_DEVICE,
902
    .instance_size = sizeof(ICH9LPCState),
903
    .instance_init = ich9_lpc_initfn,
904
    .class_init  = ich9_lpc_class_init,
905
    .interfaces = (InterfaceInfo[]) {
906
        { TYPE_HOTPLUG_HANDLER },
907
        { TYPE_ACPI_DEVICE_IF },
908
        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
909
        { TYPE_ACPI_DEV_AML_IF },
910
        { }
911
    }
912
};
913

914
static void ich9_lpc_register(void)
915
{
916
    type_register_static(&ich9_lpc_info);
917
}
918

919
type_init(ich9_lpc_register);
920