master
c 664 lines 18.2 KB
Raw
1 /*
2 * QEMU I3C bus interface.
3 *
4 * Copyright 2025 Google LLC
5 *
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
8
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qapi/error.h"
12 #include "trace.h"
13 #include "hw/i3c/i3c.h"
14 #include "hw/core/hotplug.h"
15 #include "hw/core/qdev-properties.h"
16
17 /*
18 * In test mode (enabled by ENTTM CCC) we're supposed to send a random PID
19 * during ENTDAA, so we'll just send "QEMU".
20 */
21 #define TEST_MODE_PROVISIONED_ID 0x0000554d4551ULL
22
23 static const Property i3c_props[] = {
24 DEFINE_PROP_UINT8("static-address", struct I3CTarget, static_address, 0),
25 DEFINE_PROP_UINT8("dcr", struct I3CTarget, dcr, 0),
26 DEFINE_PROP_UINT8("bcr", struct I3CTarget, bcr, 0),
27 DEFINE_PROP_UINT64("pid", struct I3CTarget, pid, 0),
28 };
29
30 static void i3c_realize(BusState *bus, Error **errp)
31 {
32 qbus_set_bus_hotplug_handler(bus);
33 }
34
35 static void i3c_class_init(ObjectClass *klass, const void *data)
36 {
37 BusClass *k = BUS_CLASS(klass);
38 k->realize = i3c_realize;
39 }
40
41 I3CBus *i3c_init_bus(DeviceState *parent, const char *name)
42 {
43 return i3c_init_bus_type(TYPE_I3C_BUS, parent, name);
44 }
45
46 I3CBus *i3c_init_bus_type(const char *type, DeviceState *parent,
47 const char *name)
48 {
49 I3CBus *bus;
50
51 bus = I3C_BUS(qbus_new(type, parent, name));
52 QLIST_INIT(&bus->current_devs);
53 bus->broadcast = false;
54 bus->in_entdaa = false;
55 bus->in_ccc = false;
56
57 /* I2C init. */
58 g_autofree gchar *i2c_bus_name = g_strdup_printf("%s-legacy-i2c", name);
59 bus->i2c_bus = i2c_init_bus(parent, i2c_bus_name);
60
61 return bus;
62 }
63
64 bool i3c_bus_busy(I3CBus *bus)
65 {
66 return !QLIST_EMPTY(&bus->current_devs);
67 }
68
69 static bool i3c_target_match(I3CTarget *candidate, uint8_t address,
70 bool is_recv, bool broadcast, bool in_entdaa)
71 {
72 /* Once a target has a dynamic address, it only responds to that. */
73 uint8_t targ_addr = candidate->address ? candidate->address :
74 candidate->static_address;
75
76 if (in_entdaa) {
77 if (address != I3C_BROADCAST) {
78 g_autofree char *path =
79 object_get_canonical_path(OBJECT(candidate));
80 qemu_log_mask(LOG_GUEST_ERROR, "%s: I3C Address 0x%.2x sent during "
81 "ENTDAA instead of a broadcast address\n",
82 path, address);
83 return false;
84 }
85
86 /*
87 * Targets should only ACK ENTDAA broadcasts if they have no dynamic
88 * address.
89 */
90 return candidate->address == 0;
91 }
92
93 /* Return if our addresses match, or if it's a broadcast. */
94 return targ_addr == address || broadcast;
95 }
96
97 bool i3c_target_match_and_add(I3CBus *bus, I3CTarget *target, uint8_t address,
98 enum I3CEvent event)
99 {
100 I3CTargetClass *tc = I3C_TARGET_GET_CLASS(target);
101 bool matched = tc->target_match(target, address, event == I3C_START_RECV,
102 bus->broadcast, bus->in_entdaa);
103
104 if (matched) {
105 I3CNode *node = g_new(struct I3CNode, 1);
106 node->target = target;
107 QLIST_INSERT_HEAD(&bus->current_devs, node, next);
108 }
109 return matched;
110 }
111
112 bool i3c_scan_bus(I3CBus *bus, uint8_t address, enum I3CEvent event)
113 {
114 BusChild *child;
115 I3CNode *node, *next;
116
117 /* Clear out any devices from a previous (re-)START. */
118 QLIST_FOREACH_SAFE(node, &bus->current_devs, next, next) {
119 QLIST_REMOVE(node, next);
120 g_free(node);
121 }
122
123 QTAILQ_FOREACH(child, &bus->parent_obj.children, sibling) {
124 DeviceState *qdev = child->child;
125 I3CTarget *target = I3C_TARGET(qdev);
126
127 if (i3c_target_match_and_add(bus, target, address, event)) {
128 return true;
129 }
130 }
131
132 /* No one on the bus could respond. */
133 return false;
134 }
135
136 /* Class-level event handling, since we do some CCCs at the class level. */
137 static int i3c_target_event(I3CTarget *t, enum I3CEvent event)
138 {
139 I3CTargetClass *tc = I3C_TARGET_GET_CLASS(t);
140 trace_i3c_target_event(t->address, event);
141
142 if (event == I3C_STOP) {
143 t->curr_ccc = 0;
144 t->ccc_byte_offset = 0;
145 t->in_ccc = false;
146 }
147 return tc->event(t, event);
148 }
149
150 /*
151 * Sends a START or repeated START and the address for an I3C transaction.
152 *
153 * This function returns 0 if a device on the bus was able to respond to the
154 * address, and non-zero otherwise.
155 * A non-zero return represents a NACK.
156 */
157 static int i3c_do_start_transfer(I3CBus *bus, uint8_t address,
158 enum I3CEvent event)
159 {
160 I3CTargetClass *tc;
161 I3CNode *node;
162
163 if (address == I3C_BROADCAST) {
164 bus->broadcast = true;
165 /* If we're not in ENTDAA, a broadcast is the start of a new CCC. */
166 if (!bus->in_entdaa) {
167 bus->in_ccc = false;
168 }
169 } else {
170 bus->broadcast = false;
171 }
172
173 /* No one responded to the address, NACK it. */
174 if (!i3c_scan_bus(bus, address, event)) {
175 return -1;
176 }
177
178 QLIST_FOREACH(node, &bus->current_devs, next) {
179 I3CTarget *t = node->target;
180
181 tc = I3C_TARGET_GET_CLASS(t);
182 if (tc->event) {
183 int rv = i3c_target_event(t, event);
184 if (rv && !bus->broadcast) {
185 return rv;
186 }
187 }
188 }
189
190 return 0;
191 }
192
193 int i3c_start_transfer(I3CBus *bus, uint8_t address, bool is_recv)
194 {
195 trace_i3c_start_transfer(address, is_recv);
196 return i3c_do_start_transfer(bus, address, is_recv
197 ? I3C_START_RECV
198 : I3C_START_SEND);
199 }
200
201 int i3c_start_recv(I3CBus *bus, uint8_t address)
202 {
203 trace_i3c_start_transfer(address, true);
204 return i3c_do_start_transfer(bus, address, I3C_START_RECV);
205 }
206
207 int i3c_start_send(I3CBus *bus, uint8_t address)
208 {
209 trace_i3c_start_transfer(address, false);
210 return i3c_do_start_transfer(bus, address, I3C_START_SEND);
211 }
212
213 void i3c_end_transfer(I3CBus *bus)
214 {
215 I3CTargetClass *tc;
216 I3CNode *node, *next;
217
218 trace_i3c_end_transfer();
219
220 /*
221 * If we're in ENTDAA, we need to notify all devices when ENTDAA is done.
222 * This is because everyone initially participates due to the broadcast,
223 * but gradually drops out as they get assigned addresses.
224 * Since the current_devs list only stores who's currently participating,
225 * and not everyone who previously participated, we send the STOP to all
226 * children.
227 */
228 if (bus->in_entdaa) {
229 BusChild *child;
230
231 QTAILQ_FOREACH(child, &bus->parent_obj.children, sibling) {
232 DeviceState *qdev = child->child;
233 I3CTarget *t = I3C_TARGET(qdev);
234 tc = I3C_TARGET_GET_CLASS(t);
235 if (tc->event) {
236 i3c_target_event(t, I3C_STOP);
237 }
238 }
239 } else {
240 QLIST_FOREACH_SAFE(node, &bus->current_devs, next, next) {
241 I3CTarget *t = node->target;
242 tc = I3C_TARGET_GET_CLASS(t);
243 if (tc->event) {
244 i3c_target_event(t, I3C_STOP);
245 }
246 QLIST_REMOVE(node, next);
247 g_free(node);
248 }
249 }
250 bus->broadcast = false;
251 bus->in_entdaa = false;
252 bus->in_ccc = false;
253 }
254
255 /*
256 * Any CCCs that are universal across all I3C devices should be handled here.
257 * Once they're handled, we pass the CCC up to the I3C target to do anything
258 * else it may want with the bytes.
259 */
260 static int i3c_target_handle_ccc_write(I3CTarget *t, const uint8_t *data,
261 uint32_t num_to_send, uint32_t *num_sent)
262 {
263 I3CTargetClass *tc = I3C_TARGET_GET_CLASS(t);
264 *num_sent = 0;
265
266 /* Is this the start of a new CCC? */
267 if (!t->in_ccc) {
268 t->curr_ccc = *data;
269 t->in_ccc = true;
270 *num_sent = 1;
271 trace_i3c_target_handle_ccc(t->address, t->curr_ccc);
272 }
273
274 switch (t->curr_ccc) {
275 case I3C_CCC_ENTDAA:
276 /*
277 * This is the last byte of ENTDAA, the controller is assigning us an
278 * address.
279 */
280 if (t->ccc_byte_offset == 8) {
281 t->address = *data;
282 t->in_ccc = false;
283 t->curr_ccc = 0;
284 t->ccc_byte_offset = 0;
285 *num_sent = 1;
286 }
287 break;
288 case I3C_CCCD_SETDASA:
289 t->address = t->static_address;
290 break;
291 case I3C_CCC_SETAASA:
292 t->address = t->static_address;
293 break;
294 case I3C_CCC_RSTDAA:
295 t->address = 0;
296 break;
297 case I3C_CCCD_SETNEWDA:
298 /* If this isn't the CCC byte, it's our new address. */
299 if (*num_sent == 0) {
300 t->address = *data;
301 *num_sent = 1;
302 }
303 break;
304 case I3C_CCC_ENTTM:
305 /*
306 * If there are still more to look at, the next byte is the test mode
307 * byte.
308 */
309 if (*num_sent != num_to_send) {
310 /* Enter test mode if the byte is non-zero. Otherwise exit. */
311 t->in_test_mode = !!data[*num_sent];
312 ++*num_sent;
313 }
314 break;
315 /* Ignore other CCCs it's better to handle on a device-by-device basis. */
316 default:
317 break;
318 }
319 return tc->handle_ccc_write(t, data, num_to_send, num_sent);
320 }
321
322 int i3c_send_byte(I3CBus *bus, uint8_t data)
323 {
324 /*
325 * Ignored, the caller can determine how many were sent based on if this was
326 * ACKed/NACKed.
327 */
328 uint32_t num_sent = 0;
329 return i3c_send(bus, &data, 1, &num_sent);
330 }
331
332 int i3c_send(I3CBus *bus, const uint8_t *data, uint32_t num_to_send,
333 uint32_t *num_sent)
334 {
335 I3CTargetClass *tc;
336 I3CTarget *t;
337 I3CNode *node;
338 int ret = 0;
339
340 /* If this message is a broadcast and no CCC has been found, grab it. */
341 if (bus->broadcast && !bus->in_ccc) {
342 bus->ccc = *data;
343 bus->in_ccc = true;
344 /*
345 * We need to keep track if we're currently in ENTDAA.
346 * On any other CCC, the CCC is over on a RESTART or STOP, but ENTDAA
347 * is only over on a STOP.
348 */
349 if (bus->ccc == I3C_CCC_ENTDAA) {
350 bus->in_entdaa = true;
351 }
352 }
353
354 QLIST_FOREACH(node, &bus->current_devs, next) {
355 t = node->target;
356 tc = I3C_TARGET_GET_CLASS(t);
357 if (bus->in_ccc) {
358 if (!tc->handle_ccc_write) {
359 ret = -1;
360 continue;
361 }
362 ret = i3c_target_handle_ccc_write(t, data, num_to_send, num_sent);
363 /* Targets should only NACK on a direct CCC. */
364 if (ret && !CCC_IS_DIRECT(bus->ccc)) {
365 ret = 0;
366 }
367 } else {
368 if (tc->send) {
369 ret = ret || tc->send(t, data, num_to_send, num_sent);
370 } else {
371 ret = -1;
372 }
373 }
374 }
375
376 trace_i3c_send(*num_sent, num_to_send, ret == 0);
377
378 return ret ? -1 : 0;
379 }
380
381 static int i3c_target_handle_ccc_read(I3CTarget *t, uint8_t *data,
382 uint32_t num_to_read, uint32_t *num_read)
383 {
384 I3CTargetClass *tc = I3C_TARGET_GET_CLASS(t);
385 uint8_t read_count = 0;
386 uint64_t pid;
387
388 switch (t->curr_ccc) {
389 case I3C_CCC_ENTDAA:
390 if (t->in_test_mode) {
391 pid = TEST_MODE_PROVISIONED_ID;
392 } else {
393 pid = t->pid;
394 }
395 /* Return the 6-byte PID, followed by BCR then DCR. */
396 while (t->ccc_byte_offset < 6) {
397 if (read_count >= num_to_read) {
398 break;
399 }
400 data[read_count] = (pid >> (t->ccc_byte_offset * 8)) & 0xff;
401 t->ccc_byte_offset++;
402 read_count++;
403 }
404 if (read_count < num_to_read) {
405 data[read_count] = t->bcr;
406 t->ccc_byte_offset++;
407 read_count++;
408 }
409 if (read_count < num_to_read) {
410 data[read_count] = t->dcr;
411 t->ccc_byte_offset++;
412 read_count++;
413 }
414 *num_read = read_count;
415 break;
416 case I3C_CCCD_GETPID:
417 while (t->ccc_byte_offset < 6) {
418 if (read_count >= num_to_read) {
419 break;
420 }
421 data[read_count] = (t->pid >> (t->ccc_byte_offset * 8)) & 0xff;
422 t->ccc_byte_offset++;
423 read_count++;
424 }
425 *num_read = read_count;
426 break;
427 case I3C_CCCD_GETBCR:
428 *data = t->bcr;
429 *num_read = 1;
430 break;
431 case I3C_CCCD_GETDCR:
432 *data = t->dcr;
433 *num_read = 1;
434 break;
435 default:
436 /* Unhandled on the I3CTarget class level. */
437 break;
438 }
439
440 return tc->handle_ccc_read(t, data, num_to_read, num_read);
441 }
442
443 int i3c_recv_byte(I3CBus *bus, uint8_t *data)
444 {
445 /*
446 * Ignored, the caller can determine how many bytes were read based on if
447 * this is ACKed/NACKed.
448 */
449 uint32_t num_read;
450 return i3c_recv(bus, data, 1, &num_read);
451 }
452
453 int i3c_recv(I3CBus *bus, uint8_t *data, uint32_t num_to_read,
454 uint32_t *num_read)
455 {
456 int ret = 0;
457 I3CTargetClass *tc;
458 I3CTarget *t;
459
460 *data = 0xff;
461 if (!QLIST_EMPTY(&bus->current_devs)) {
462 tc = I3C_TARGET_GET_CLASS(QLIST_FIRST(&bus->current_devs)->target);
463 t = QLIST_FIRST(&bus->current_devs)->target;
464 if (bus->in_ccc) {
465 if (!tc->handle_ccc_read) {
466 return -1;
467 }
468 ret = i3c_target_handle_ccc_read(t, data, num_to_read, num_read);
469 } else {
470 if (tc->recv) {
471 /*
472 * Targets cannot NACK on a direct transfer, so the data
473 * is returned directly.
474 */
475 *num_read = tc->recv(t, data, num_to_read);
476 }
477 }
478 }
479
480 trace_i3c_recv(*num_read, num_to_read, ret == 0);
481
482 return ret;
483 }
484
485 void i3c_nack(I3CBus *bus)
486 {
487 I3CTargetClass *tc;
488 I3CNode *node;
489
490 if (QLIST_EMPTY(&bus->current_devs)) {
491 return;
492 }
493
494 QLIST_FOREACH(node, &bus->current_devs, next) {
495 tc = I3C_TARGET_GET_CLASS(node->target);
496 if (tc->event) {
497 i3c_target_event(node->target, I3C_NACK);
498 }
499 }
500 }
501
502 int i3c_target_send_ibi(I3CTarget *t, uint8_t addr, bool is_recv)
503 {
504 I3CBus *bus = I3C_BUS(t->parent_obj.parent_bus);
505 I3CBusClass *bc = I3C_BUS_GET_CLASS(bus);
506 trace_i3c_target_send_ibi(addr, is_recv);
507 return bc->ibi_handle(bus, addr, is_recv);
508 }
509
510 int i3c_target_send_ibi_bytes(I3CTarget *t, uint8_t data)
511 {
512 I3CBus *bus = I3C_BUS(t->parent_obj.parent_bus);
513 I3CBusClass *bc = I3C_BUS_GET_CLASS(bus);
514 trace_i3c_target_send_ibi_bytes(data);
515 return bc->ibi_recv(bus, data);
516 }
517
518 int i3c_target_ibi_finish(I3CTarget *t, uint8_t data)
519 {
520 I3CBus *bus = I3C_BUS(t->parent_obj.parent_bus);
521 I3CBusClass *bc = I3C_BUS_GET_CLASS(bus);
522 trace_i3c_target_ibi_finish();
523 return bc->ibi_finish(bus);
524 }
525
526 static bool i3c_addr_is_rsvd(uint8_t addr)
527 {
528 static const bool is_rsvd[256] = {
529 [0x00] = true,
530 [0x01] = true,
531 [0x02] = true,
532 [0x3e] = true,
533 [0x5e] = true,
534 [0x6e] = true,
535 [0x76] = true,
536 [0x7a] = true,
537 [0x7c] = true,
538 [0x7e] = true,
539 [0x7f] = true,
540 };
541
542 return is_rsvd[addr];
543 }
544
545 I3CTarget *i3c_target_new(const char *name, uint8_t addr, uint8_t dcr,
546 uint8_t bcr, uint64_t pid)
547 {
548 DeviceState *dev;
549
550 dev = qdev_new(name);
551 qdev_prop_set_uint8(dev, "static-address", addr);
552 qdev_prop_set_uint8(dev, "dcr", dcr);
553 qdev_prop_set_uint8(dev, "bcr", bcr);
554 qdev_prop_set_uint64(dev, "pid", pid);
555
556 if (i3c_addr_is_rsvd(addr)) {
557 g_autofree char *path = object_get_canonical_path(OBJECT(dev));
558 qemu_log_mask(LOG_GUEST_ERROR, "%s: I3C target created with reserved "
559 "address 0x%.2x\n", path, addr);
560 }
561 return I3C_TARGET(dev);
562 }
563
564 bool i3c_target_realize_and_unref(I3CTarget *dev, I3CBus *bus, Error **errp)
565 {
566 return qdev_realize_and_unref(&dev->parent_obj, &bus->parent_obj, errp);
567 }
568
569 I3CTarget *i3c_target_create_simple(I3CBus *bus, const char *name, uint8_t addr,
570 uint8_t dcr, uint8_t bcr, uint64_t pid)
571 {
572 I3CTarget *dev = i3c_target_new(name, addr, dcr, bcr, pid);
573 dev->address = 0;
574 i3c_target_realize_and_unref(dev, bus, &error_abort);
575
576 return dev;
577 }
578
579 /* Legacy I2C functions. */
580 void legacy_i2c_nack(I3CBus *bus)
581 {
582 trace_legacy_i2c_nack();
583 i2c_nack(bus->i2c_bus);
584 }
585
586 uint8_t legacy_i2c_recv(I3CBus *bus)
587 {
588 uint8_t byte = i2c_recv(bus->i2c_bus);
589 trace_legacy_i2c_recv(byte);
590 return byte;
591 }
592
593 int legacy_i2c_send(I3CBus *bus, uint8_t data)
594 {
595 trace_legacy_i2c_send(data);
596 return i2c_send(bus->i2c_bus, data);
597 }
598
599 int legacy_i2c_start_transfer(I3CBus *bus, uint8_t address, bool is_recv)
600 {
601 trace_legacy_i2c_start_transfer(address, is_recv);
602 return i2c_start_transfer(bus->i2c_bus, address, is_recv);
603 }
604
605 int legacy_i2c_start_recv(I3CBus *bus, uint8_t address)
606 {
607 trace_legacy_i2c_start_transfer(address, true);
608 return i2c_start_transfer(bus->i2c_bus, address, /*is_recv=*/true);
609 }
610
611 int legacy_i2c_start_send(I3CBus *bus, uint8_t address)
612 {
613 trace_legacy_i2c_start_transfer(address, false);
614 return i2c_start_transfer(bus->i2c_bus, address, /*is_recv=*/false);
615 }
616
617 void legacy_i2c_end_transfer(I3CBus *bus)
618 {
619 trace_legacy_i2c_end_transfer();
620 i2c_end_transfer(bus->i2c_bus);
621 }
622
623 I2CSlave *legacy_i2c_device_create_simple(I3CBus *bus, const char *name,
624 uint8_t addr)
625 {
626 I2CSlave *dev = i2c_slave_new(name, addr);
627
628 i2c_slave_realize_and_unref(dev, bus->i2c_bus, &error_abort);
629 return dev;
630 }
631
632 static void i3c_target_class_init(ObjectClass *klass, const void *data)
633 {
634 DeviceClass *k = DEVICE_CLASS(klass);
635 I3CTargetClass *sc = I3C_TARGET_CLASS(klass);
636 set_bit(DEVICE_CATEGORY_MISC, k->categories);
637 k->bus_type = TYPE_I3C_BUS;
638 device_class_set_props(k, i3c_props);
639 sc->target_match = i3c_target_match;
640 }
641
642 static const TypeInfo i3c_types[] = {
643 {
644 .name = TYPE_I3C_BUS,
645 .parent = TYPE_BUS,
646 .instance_size = sizeof(I3CBus),
647 .class_size = sizeof(I3CBusClass),
648 .class_init = i3c_class_init,
649 .interfaces = (InterfaceInfo[]) {
650 { TYPE_HOTPLUG_HANDLER },
651 { }
652 }
653 },
654 {
655 .name = TYPE_I3C_TARGET,
656 .parent = TYPE_DEVICE,
657 .instance_size = sizeof(I3CTarget),
658 .abstract = true,
659 .class_size = sizeof(I3CTargetClass),
660 .class_init = i3c_target_class_init,
661 },
662 };
663
664 DEFINE_TYPES(i3c_types)