xref: /openbmc/qemu/hw/intc/openpic.c (revision 2ada66f944c0db9d037c7cf3ff1a4fd43283338d)
1 /*
2  * OpenPIC emulation
3  *
4  * Copyright (c) 2004 Jocelyn Mayer
5  *               2011 Alexander Graf
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 /*
26  *
27  * Based on OpenPic implementations:
28  * - Intel GW80314 I/O companion chip developer's manual
29  * - Motorola MPC8245 & MPC8540 user manuals.
30  * - Motorola MCP750 (aka Raven) programmer manual.
31  * - Motorola Harrier programmer manuel
32  *
33  * Serial interrupts, as implemented in Raven chipset are not supported yet.
34  *
35  */
36 #include "hw/hw.h"
37 #include "hw/ppc/mac.h"
38 #include "hw/pci/pci.h"
39 #include "hw/ppc/openpic.h"
40 #include "hw/ppc/ppc_e500.h"
41 #include "hw/sysbus.h"
42 #include "hw/pci/msi.h"
43 #include "qemu/bitops.h"
44 #include "qapi/qmp/qerror.h"
45 
46 //#define DEBUG_OPENPIC
47 
48 #ifdef DEBUG_OPENPIC
49 static const int debug_openpic = 1;
50 #else
51 static const int debug_openpic = 0;
52 #endif
53 
54 #define DPRINTF(fmt, ...) do { \
55         if (debug_openpic) { \
56             printf(fmt , ## __VA_ARGS__); \
57         } \
58     } while (0)
59 
60 #define MAX_CPU     32
61 #define MAX_MSI     8
62 #define VID         0x03 /* MPIC version ID */
63 
64 /* OpenPIC capability flags */
65 #define OPENPIC_FLAG_IDR_CRIT     (1 << 0)
66 #define OPENPIC_FLAG_ILR          (2 << 0)
67 
68 /* OpenPIC address map */
69 #define OPENPIC_GLB_REG_START        0x0
70 #define OPENPIC_GLB_REG_SIZE         0x10F0
71 #define OPENPIC_TMR_REG_START        0x10F0
72 #define OPENPIC_TMR_REG_SIZE         0x220
73 #define OPENPIC_MSI_REG_START        0x1600
74 #define OPENPIC_MSI_REG_SIZE         0x200
75 #define OPENPIC_SUMMARY_REG_START   0x3800
76 #define OPENPIC_SUMMARY_REG_SIZE    0x800
77 #define OPENPIC_SRC_REG_START        0x10000
78 #define OPENPIC_SRC_REG_SIZE         (OPENPIC_MAX_SRC * 0x20)
79 #define OPENPIC_CPU_REG_START        0x20000
80 #define OPENPIC_CPU_REG_SIZE         0x100 + ((MAX_CPU - 1) * 0x1000)
81 
82 /* Raven */
83 #define RAVEN_MAX_CPU      2
84 #define RAVEN_MAX_EXT     48
85 #define RAVEN_MAX_IRQ     64
86 #define RAVEN_MAX_TMR      OPENPIC_MAX_TMR
87 #define RAVEN_MAX_IPI      OPENPIC_MAX_IPI
88 
89 /* Interrupt definitions */
90 #define RAVEN_FE_IRQ     (RAVEN_MAX_EXT)     /* Internal functional IRQ */
91 #define RAVEN_ERR_IRQ    (RAVEN_MAX_EXT + 1) /* Error IRQ */
92 #define RAVEN_TMR_IRQ    (RAVEN_MAX_EXT + 2) /* First timer IRQ */
93 #define RAVEN_IPI_IRQ    (RAVEN_TMR_IRQ + RAVEN_MAX_TMR) /* First IPI IRQ */
94 /* First doorbell IRQ */
95 #define RAVEN_DBL_IRQ    (RAVEN_IPI_IRQ + (RAVEN_MAX_CPU * RAVEN_MAX_IPI))
96 
97 typedef struct FslMpicInfo {
98     int max_ext;
99 } FslMpicInfo;
100 
101 static FslMpicInfo fsl_mpic_20 = {
102     .max_ext = 12,
103 };
104 
105 static FslMpicInfo fsl_mpic_42 = {
106     .max_ext = 12,
107 };
108 
109 #define FRR_NIRQ_SHIFT    16
110 #define FRR_NCPU_SHIFT     8
111 #define FRR_VID_SHIFT      0
112 
113 #define VID_REVISION_1_2   2
114 #define VID_REVISION_1_3   3
115 
116 #define VIR_GENERIC      0x00000000 /* Generic Vendor ID */
117 
118 #define GCR_RESET        0x80000000
119 #define GCR_MODE_PASS    0x00000000
120 #define GCR_MODE_MIXED   0x20000000
121 #define GCR_MODE_PROXY   0x60000000
122 
123 #define TBCR_CI           0x80000000 /* count inhibit */
124 #define TCCR_TOG          0x80000000 /* toggles when decrement to zero */
125 
126 #define IDR_EP_SHIFT      31
127 #define IDR_EP_MASK       (1U << IDR_EP_SHIFT)
128 #define IDR_CI0_SHIFT     30
129 #define IDR_CI1_SHIFT     29
130 #define IDR_P1_SHIFT      1
131 #define IDR_P0_SHIFT      0
132 
133 #define ILR_INTTGT_MASK   0x000000ff
134 #define ILR_INTTGT_INT    0x00
135 #define ILR_INTTGT_CINT   0x01 /* critical */
136 #define ILR_INTTGT_MCP    0x02 /* machine check */
137 
138 /* The currently supported INTTGT values happen to be the same as QEMU's
139  * openpic output codes, but don't depend on this.  The output codes
140  * could change (unlikely, but...) or support could be added for
141  * more INTTGT values.
142  */
143 static const int inttgt_output[][2] = {
144     { ILR_INTTGT_INT, OPENPIC_OUTPUT_INT },
145     { ILR_INTTGT_CINT, OPENPIC_OUTPUT_CINT },
146     { ILR_INTTGT_MCP, OPENPIC_OUTPUT_MCK },
147 };
148 
149 static int inttgt_to_output(int inttgt)
150 {
151     int i;
152 
153     for (i = 0; i < ARRAY_SIZE(inttgt_output); i++) {
154         if (inttgt_output[i][0] == inttgt) {
155             return inttgt_output[i][1];
156         }
157     }
158 
159     fprintf(stderr, "%s: unsupported inttgt %d\n", __func__, inttgt);
160     return OPENPIC_OUTPUT_INT;
161 }
162 
163 static int output_to_inttgt(int output)
164 {
165     int i;
166 
167     for (i = 0; i < ARRAY_SIZE(inttgt_output); i++) {
168         if (inttgt_output[i][1] == output) {
169             return inttgt_output[i][0];
170         }
171     }
172 
173     abort();
174 }
175 
176 #define MSIIR_OFFSET       0x140
177 #define MSIIR_SRS_SHIFT    29
178 #define MSIIR_SRS_MASK     (0x7 << MSIIR_SRS_SHIFT)
179 #define MSIIR_IBS_SHIFT    24
180 #define MSIIR_IBS_MASK     (0x1f << MSIIR_IBS_SHIFT)
181 
182 static int get_current_cpu(void)
183 {
184     if (!current_cpu) {
185         return -1;
186     }
187 
188     return current_cpu->cpu_index;
189 }
190 
191 static uint32_t openpic_cpu_read_internal(void *opaque, hwaddr addr,
192                                           int idx);
193 static void openpic_cpu_write_internal(void *opaque, hwaddr addr,
194                                        uint32_t val, int idx);
195 static void openpic_reset(DeviceState *d);
196 
197 typedef enum IRQType {
198     IRQ_TYPE_NORMAL = 0,
199     IRQ_TYPE_FSLINT,        /* FSL internal interrupt -- level only */
200     IRQ_TYPE_FSLSPECIAL,    /* FSL timer/IPI interrupt, edge, no polarity */
201 } IRQType;
202 
203 /* Round up to the nearest 64 IRQs so that the queue length
204  * won't change when moving between 32 and 64 bit hosts.
205  */
206 #define IRQQUEUE_SIZE_BITS ((OPENPIC_MAX_IRQ + 63) & ~63)
207 
208 typedef struct IRQQueue {
209     unsigned long *queue;
210     int next;
211     int priority;
212 } IRQQueue;
213 
214 typedef struct IRQSource {
215     uint32_t ivpr;  /* IRQ vector/priority register */
216     uint32_t idr;   /* IRQ destination register */
217     uint32_t destmask; /* bitmap of CPU destinations */
218     int last_cpu;
219     int output;     /* IRQ level, e.g. OPENPIC_OUTPUT_INT */
220     int pending;    /* TRUE if IRQ is pending */
221     IRQType type;
222     bool level:1;   /* level-triggered */
223     bool nomask:1;  /* critical interrupts ignore mask on some FSL MPICs */
224 } IRQSource;
225 
226 #define IVPR_MASK_SHIFT       31
227 #define IVPR_MASK_MASK        (1U << IVPR_MASK_SHIFT)
228 #define IVPR_ACTIVITY_SHIFT   30
229 #define IVPR_ACTIVITY_MASK    (1U << IVPR_ACTIVITY_SHIFT)
230 #define IVPR_MODE_SHIFT       29
231 #define IVPR_MODE_MASK        (1U << IVPR_MODE_SHIFT)
232 #define IVPR_POLARITY_SHIFT   23
233 #define IVPR_POLARITY_MASK    (1U << IVPR_POLARITY_SHIFT)
234 #define IVPR_SENSE_SHIFT      22
235 #define IVPR_SENSE_MASK       (1U << IVPR_SENSE_SHIFT)
236 
237 #define IVPR_PRIORITY_MASK     (0xFU << 16)
238 #define IVPR_PRIORITY(_ivprr_) ((int)(((_ivprr_) & IVPR_PRIORITY_MASK) >> 16))
239 #define IVPR_VECTOR(opp, _ivprr_) ((_ivprr_) & (opp)->vector_mask)
240 
241 /* IDR[EP/CI] are only for FSL MPIC prior to v4.0 */
242 #define IDR_EP      0x80000000  /* external pin */
243 #define IDR_CI      0x40000000  /* critical interrupt */
244 
245 typedef struct IRQDest {
246     int32_t ctpr; /* CPU current task priority */
247     IRQQueue raised;
248     IRQQueue servicing;
249     qemu_irq *irqs;
250 
251     /* Count of IRQ sources asserting on non-INT outputs */
252     uint32_t outputs_active[OPENPIC_OUTPUT_NB];
253 } IRQDest;
254 
255 #define OPENPIC(obj) OBJECT_CHECK(OpenPICState, (obj), TYPE_OPENPIC)
256 
257 typedef struct OpenPICState {
258     /*< private >*/
259     SysBusDevice parent_obj;
260     /*< public >*/
261 
262     MemoryRegion mem;
263 
264     /* Behavior control */
265     FslMpicInfo *fsl;
266     uint32_t model;
267     uint32_t flags;
268     uint32_t nb_irqs;
269     uint32_t vid;
270     uint32_t vir; /* Vendor identification register */
271     uint32_t vector_mask;
272     uint32_t tfrr_reset;
273     uint32_t ivpr_reset;
274     uint32_t idr_reset;
275     uint32_t brr1;
276     uint32_t mpic_mode_mask;
277 
278     /* Sub-regions */
279     MemoryRegion sub_io_mem[6];
280 
281     /* Global registers */
282     uint32_t frr; /* Feature reporting register */
283     uint32_t gcr; /* Global configuration register  */
284     uint32_t pir; /* Processor initialization register */
285     uint32_t spve; /* Spurious vector register */
286     uint32_t tfrr; /* Timer frequency reporting register */
287     /* Source registers */
288     IRQSource src[OPENPIC_MAX_IRQ];
289     /* Local registers per output pin */
290     IRQDest dst[MAX_CPU];
291     uint32_t nb_cpus;
292     /* Timer registers */
293     struct {
294         uint32_t tccr;  /* Global timer current count register */
295         uint32_t tbcr;  /* Global timer base count register */
296     } timers[OPENPIC_MAX_TMR];
297     /* Shared MSI registers */
298     struct {
299         uint32_t msir;   /* Shared Message Signaled Interrupt Register */
300     } msi[MAX_MSI];
301     uint32_t max_irq;
302     uint32_t irq_ipi0;
303     uint32_t irq_tim0;
304     uint32_t irq_msi;
305 } OpenPICState;
306 
307 static inline void IRQ_setbit(IRQQueue *q, int n_IRQ)
308 {
309     set_bit(n_IRQ, q->queue);
310 }
311 
312 static inline void IRQ_resetbit(IRQQueue *q, int n_IRQ)
313 {
314     clear_bit(n_IRQ, q->queue);
315 }
316 
317 static void IRQ_check(OpenPICState *opp, IRQQueue *q)
318 {
319     int irq = -1;
320     int next = -1;
321     int priority = -1;
322 
323     for (;;) {
324         irq = find_next_bit(q->queue, opp->max_irq, irq + 1);
325         if (irq == opp->max_irq) {
326             break;
327         }
328 
329         DPRINTF("IRQ_check: irq %d set ivpr_pr=%d pr=%d\n",
330                 irq, IVPR_PRIORITY(opp->src[irq].ivpr), priority);
331 
332         if (IVPR_PRIORITY(opp->src[irq].ivpr) > priority) {
333             next = irq;
334             priority = IVPR_PRIORITY(opp->src[irq].ivpr);
335         }
336     }
337 
338     q->next = next;
339     q->priority = priority;
340 }
341 
342 static int IRQ_get_next(OpenPICState *opp, IRQQueue *q)
343 {
344     /* XXX: optimize */
345     IRQ_check(opp, q);
346 
347     return q->next;
348 }
349 
350 static void IRQ_local_pipe(OpenPICState *opp, int n_CPU, int n_IRQ,
351                            bool active, bool was_active)
352 {
353     IRQDest *dst;
354     IRQSource *src;
355     int priority;
356 
357     dst = &opp->dst[n_CPU];
358     src = &opp->src[n_IRQ];
359 
360     DPRINTF("%s: IRQ %d active %d was %d\n",
361             __func__, n_IRQ, active, was_active);
362 
363     if (src->output != OPENPIC_OUTPUT_INT) {
364         DPRINTF("%s: output %d irq %d active %d was %d count %d\n",
365                 __func__, src->output, n_IRQ, active, was_active,
366                 dst->outputs_active[src->output]);
367 
368         /* On Freescale MPIC, critical interrupts ignore priority,
369          * IACK, EOI, etc.  Before MPIC v4.1 they also ignore
370          * masking.
371          */
372         if (active) {
373             if (!was_active && dst->outputs_active[src->output]++ == 0) {
374                 DPRINTF("%s: Raise OpenPIC output %d cpu %d irq %d\n",
375                         __func__, src->output, n_CPU, n_IRQ);
376                 qemu_irq_raise(dst->irqs[src->output]);
377             }
378         } else {
379             if (was_active && --dst->outputs_active[src->output] == 0) {
380                 DPRINTF("%s: Lower OpenPIC output %d cpu %d irq %d\n",
381                         __func__, src->output, n_CPU, n_IRQ);
382                 qemu_irq_lower(dst->irqs[src->output]);
383             }
384         }
385 
386         return;
387     }
388 
389     priority = IVPR_PRIORITY(src->ivpr);
390 
391     /* Even if the interrupt doesn't have enough priority,
392      * it is still raised, in case ctpr is lowered later.
393      */
394     if (active) {
395         IRQ_setbit(&dst->raised, n_IRQ);
396     } else {
397         IRQ_resetbit(&dst->raised, n_IRQ);
398     }
399 
400     IRQ_check(opp, &dst->raised);
401 
402     if (active && priority <= dst->ctpr) {
403         DPRINTF("%s: IRQ %d priority %d too low for ctpr %d on CPU %d\n",
404                 __func__, n_IRQ, priority, dst->ctpr, n_CPU);
405         active = 0;
406     }
407 
408     if (active) {
409         if (IRQ_get_next(opp, &dst->servicing) >= 0 &&
410                 priority <= dst->servicing.priority) {
411             DPRINTF("%s: IRQ %d is hidden by servicing IRQ %d on CPU %d\n",
412                     __func__, n_IRQ, dst->servicing.next, n_CPU);
413         } else {
414             DPRINTF("%s: Raise OpenPIC INT output cpu %d irq %d/%d\n",
415                     __func__, n_CPU, n_IRQ, dst->raised.next);
416             qemu_irq_raise(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);
417         }
418     } else {
419         IRQ_get_next(opp, &dst->servicing);
420         if (dst->raised.priority > dst->ctpr &&
421                 dst->raised.priority > dst->servicing.priority) {
422             DPRINTF("%s: IRQ %d inactive, IRQ %d prio %d above %d/%d, CPU %d\n",
423                     __func__, n_IRQ, dst->raised.next, dst->raised.priority,
424                     dst->ctpr, dst->servicing.priority, n_CPU);
425             /* IRQ line stays asserted */
426         } else {
427             DPRINTF("%s: IRQ %d inactive, current prio %d/%d, CPU %d\n",
428                     __func__, n_IRQ, dst->ctpr, dst->servicing.priority, n_CPU);
429             qemu_irq_lower(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);
430         }
431     }
432 }
433 
434 /* update pic state because registers for n_IRQ have changed value */
435 static void openpic_update_irq(OpenPICState *opp, int n_IRQ)
436 {
437     IRQSource *src;
438     bool active, was_active;
439     int i;
440 
441     src = &opp->src[n_IRQ];
442     active = src->pending;
443 
444     if ((src->ivpr & IVPR_MASK_MASK) && !src->nomask) {
445         /* Interrupt source is disabled */
446         DPRINTF("%s: IRQ %d is disabled\n", __func__, n_IRQ);
447         active = false;
448     }
449 
450     was_active = !!(src->ivpr & IVPR_ACTIVITY_MASK);
451 
452     /*
453      * We don't have a similar check for already-active because
454      * ctpr may have changed and we need to withdraw the interrupt.
455      */
456     if (!active && !was_active) {
457         DPRINTF("%s: IRQ %d is already inactive\n", __func__, n_IRQ);
458         return;
459     }
460 
461     if (active) {
462         src->ivpr |= IVPR_ACTIVITY_MASK;
463     } else {
464         src->ivpr &= ~IVPR_ACTIVITY_MASK;
465     }
466 
467     if (src->destmask == 0) {
468         /* No target */
469         DPRINTF("%s: IRQ %d has no target\n", __func__, n_IRQ);
470         return;
471     }
472 
473     if (src->destmask == (1 << src->last_cpu)) {
474         /* Only one CPU is allowed to receive this IRQ */
475         IRQ_local_pipe(opp, src->last_cpu, n_IRQ, active, was_active);
476     } else if (!(src->ivpr & IVPR_MODE_MASK)) {
477         /* Directed delivery mode */
478         for (i = 0; i < opp->nb_cpus; i++) {
479             if (src->destmask & (1 << i)) {
480                 IRQ_local_pipe(opp, i, n_IRQ, active, was_active);
481             }
482         }
483     } else {
484         /* Distributed delivery mode */
485         for (i = src->last_cpu + 1; i != src->last_cpu; i++) {
486             if (i == opp->nb_cpus) {
487                 i = 0;
488             }
489             if (src->destmask & (1 << i)) {
490                 IRQ_local_pipe(opp, i, n_IRQ, active, was_active);
491                 src->last_cpu = i;
492                 break;
493             }
494         }
495     }
496 }
497 
498 static void openpic_set_irq(void *opaque, int n_IRQ, int level)
499 {
500     OpenPICState *opp = opaque;
501     IRQSource *src;
502 
503     if (n_IRQ >= OPENPIC_MAX_IRQ) {
504         fprintf(stderr, "%s: IRQ %d out of range\n", __func__, n_IRQ);
505         abort();
506     }
507 
508     src = &opp->src[n_IRQ];
509     DPRINTF("openpic: set irq %d = %d ivpr=0x%08x\n",
510             n_IRQ, level, src->ivpr);
511     if (src->level) {
512         /* level-sensitive irq */
513         src->pending = level;
514         openpic_update_irq(opp, n_IRQ);
515     } else {
516         /* edge-sensitive irq */
517         if (level) {
518             src->pending = 1;
519             openpic_update_irq(opp, n_IRQ);
520         }
521 
522         if (src->output != OPENPIC_OUTPUT_INT) {
523             /* Edge-triggered interrupts shouldn't be used
524              * with non-INT delivery, but just in case,
525              * try to make it do something sane rather than
526              * cause an interrupt storm.  This is close to
527              * what you'd probably see happen in real hardware.
528              */
529             src->pending = 0;
530             openpic_update_irq(opp, n_IRQ);
531         }
532     }
533 }
534 
535 static inline uint32_t read_IRQreg_idr(OpenPICState *opp, int n_IRQ)
536 {
537     return opp->src[n_IRQ].idr;
538 }
539 
540 static inline uint32_t read_IRQreg_ilr(OpenPICState *opp, int n_IRQ)
541 {
542     if (opp->flags & OPENPIC_FLAG_ILR) {
543         return output_to_inttgt(opp->src[n_IRQ].output);
544     }
545 
546     return 0xffffffff;
547 }
548 
549 static inline uint32_t read_IRQreg_ivpr(OpenPICState *opp, int n_IRQ)
550 {
551     return opp->src[n_IRQ].ivpr;
552 }
553 
554 static inline void write_IRQreg_idr(OpenPICState *opp, int n_IRQ, uint32_t val)
555 {
556     IRQSource *src = &opp->src[n_IRQ];
557     uint32_t normal_mask = (1UL << opp->nb_cpus) - 1;
558     uint32_t crit_mask = 0;
559     uint32_t mask = normal_mask;
560     int crit_shift = IDR_EP_SHIFT - opp->nb_cpus;
561     int i;
562 
563     if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
564         crit_mask = mask << crit_shift;
565         mask |= crit_mask | IDR_EP;
566     }
567 
568     src->idr = val & mask;
569     DPRINTF("Set IDR %d to 0x%08x\n", n_IRQ, src->idr);
570 
571     if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
572         if (src->idr & crit_mask) {
573             if (src->idr & normal_mask) {
574                 DPRINTF("%s: IRQ configured for multiple output types, using "
575                         "critical\n", __func__);
576             }
577 
578             src->output = OPENPIC_OUTPUT_CINT;
579             src->nomask = true;
580             src->destmask = 0;
581 
582             for (i = 0; i < opp->nb_cpus; i++) {
583                 int n_ci = IDR_CI0_SHIFT - i;
584 
585                 if (src->idr & (1UL << n_ci)) {
586                     src->destmask |= 1UL << i;
587                 }
588             }
589         } else {
590             src->output = OPENPIC_OUTPUT_INT;
591             src->nomask = false;
592             src->destmask = src->idr & normal_mask;
593         }
594     } else {
595         src->destmask = src->idr;
596     }
597 }
598 
599 static inline void write_IRQreg_ilr(OpenPICState *opp, int n_IRQ, uint32_t val)
600 {
601     if (opp->flags & OPENPIC_FLAG_ILR) {
602         IRQSource *src = &opp->src[n_IRQ];
603 
604         src->output = inttgt_to_output(val & ILR_INTTGT_MASK);
605         DPRINTF("Set ILR %d to 0x%08x, output %d\n", n_IRQ, src->idr,
606                 src->output);
607 
608         /* TODO: on MPIC v4.0 only, set nomask for non-INT */
609     }
610 }
611 
612 static inline void write_IRQreg_ivpr(OpenPICState *opp, int n_IRQ, uint32_t val)
613 {
614     uint32_t mask;
615 
616     /* NOTE when implementing newer FSL MPIC models: starting with v4.0,
617      * the polarity bit is read-only on internal interrupts.
618      */
619     mask = IVPR_MASK_MASK | IVPR_PRIORITY_MASK | IVPR_SENSE_MASK |
620            IVPR_POLARITY_MASK | opp->vector_mask;
621 
622     /* ACTIVITY bit is read-only */
623     opp->src[n_IRQ].ivpr =
624         (opp->src[n_IRQ].ivpr & IVPR_ACTIVITY_MASK) | (val & mask);
625 
626     /* For FSL internal interrupts, The sense bit is reserved and zero,
627      * and the interrupt is always level-triggered.  Timers and IPIs
628      * have no sense or polarity bits, and are edge-triggered.
629      */
630     switch (opp->src[n_IRQ].type) {
631     case IRQ_TYPE_NORMAL:
632         opp->src[n_IRQ].level = !!(opp->src[n_IRQ].ivpr & IVPR_SENSE_MASK);
633         break;
634 
635     case IRQ_TYPE_FSLINT:
636         opp->src[n_IRQ].ivpr &= ~IVPR_SENSE_MASK;
637         break;
638 
639     case IRQ_TYPE_FSLSPECIAL:
640         opp->src[n_IRQ].ivpr &= ~(IVPR_POLARITY_MASK | IVPR_SENSE_MASK);
641         break;
642     }
643 
644     openpic_update_irq(opp, n_IRQ);
645     DPRINTF("Set IVPR %d to 0x%08x -> 0x%08x\n", n_IRQ, val,
646             opp->src[n_IRQ].ivpr);
647 }
648 
649 static void openpic_gcr_write(OpenPICState *opp, uint64_t val)
650 {
651     bool mpic_proxy = false;
652 
653     if (val & GCR_RESET) {
654         openpic_reset(DEVICE(opp));
655         return;
656     }
657 
658     opp->gcr &= ~opp->mpic_mode_mask;
659     opp->gcr |= val & opp->mpic_mode_mask;
660 
661     /* Set external proxy mode */
662     if ((val & opp->mpic_mode_mask) == GCR_MODE_PROXY) {
663         mpic_proxy = true;
664     }
665 
666     ppce500_set_mpic_proxy(mpic_proxy);
667 }
668 
669 static void openpic_gbl_write(void *opaque, hwaddr addr, uint64_t val,
670                               unsigned len)
671 {
672     OpenPICState *opp = opaque;
673     IRQDest *dst;
674     int idx;
675 
676     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64 "\n",
677             __func__, addr, val);
678     if (addr & 0xF) {
679         return;
680     }
681     switch (addr) {
682     case 0x00: /* Block Revision Register1 (BRR1) is Readonly */
683         break;
684     case 0x40:
685     case 0x50:
686     case 0x60:
687     case 0x70:
688     case 0x80:
689     case 0x90:
690     case 0xA0:
691     case 0xB0:
692         openpic_cpu_write_internal(opp, addr, val, get_current_cpu());
693         break;
694     case 0x1000: /* FRR */
695         break;
696     case 0x1020: /* GCR */
697         openpic_gcr_write(opp, val);
698         break;
699     case 0x1080: /* VIR */
700         break;
701     case 0x1090: /* PIR */
702         for (idx = 0; idx < opp->nb_cpus; idx++) {
703             if ((val & (1 << idx)) && !(opp->pir & (1 << idx))) {
704                 DPRINTF("Raise OpenPIC RESET output for CPU %d\n", idx);
705                 dst = &opp->dst[idx];
706                 qemu_irq_raise(dst->irqs[OPENPIC_OUTPUT_RESET]);
707             } else if (!(val & (1 << idx)) && (opp->pir & (1 << idx))) {
708                 DPRINTF("Lower OpenPIC RESET output for CPU %d\n", idx);
709                 dst = &opp->dst[idx];
710                 qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_RESET]);
711             }
712         }
713         opp->pir = val;
714         break;
715     case 0x10A0: /* IPI_IVPR */
716     case 0x10B0:
717     case 0x10C0:
718     case 0x10D0:
719         {
720             int idx;
721             idx = (addr - 0x10A0) >> 4;
722             write_IRQreg_ivpr(opp, opp->irq_ipi0 + idx, val);
723         }
724         break;
725     case 0x10E0: /* SPVE */
726         opp->spve = val & opp->vector_mask;
727         break;
728     default:
729         break;
730     }
731 }
732 
733 static uint64_t openpic_gbl_read(void *opaque, hwaddr addr, unsigned len)
734 {
735     OpenPICState *opp = opaque;
736     uint32_t retval;
737 
738     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
739     retval = 0xFFFFFFFF;
740     if (addr & 0xF) {
741         return retval;
742     }
743     switch (addr) {
744     case 0x1000: /* FRR */
745         retval = opp->frr;
746         break;
747     case 0x1020: /* GCR */
748         retval = opp->gcr;
749         break;
750     case 0x1080: /* VIR */
751         retval = opp->vir;
752         break;
753     case 0x1090: /* PIR */
754         retval = 0x00000000;
755         break;
756     case 0x00: /* Block Revision Register1 (BRR1) */
757         retval = opp->brr1;
758         break;
759     case 0x40:
760     case 0x50:
761     case 0x60:
762     case 0x70:
763     case 0x80:
764     case 0x90:
765     case 0xA0:
766     case 0xB0:
767         retval = openpic_cpu_read_internal(opp, addr, get_current_cpu());
768         break;
769     case 0x10A0: /* IPI_IVPR */
770     case 0x10B0:
771     case 0x10C0:
772     case 0x10D0:
773         {
774             int idx;
775             idx = (addr - 0x10A0) >> 4;
776             retval = read_IRQreg_ivpr(opp, opp->irq_ipi0 + idx);
777         }
778         break;
779     case 0x10E0: /* SPVE */
780         retval = opp->spve;
781         break;
782     default:
783         break;
784     }
785     DPRINTF("%s: => 0x%08x\n", __func__, retval);
786 
787     return retval;
788 }
789 
790 static void openpic_tmr_write(void *opaque, hwaddr addr, uint64_t val,
791                                 unsigned len)
792 {
793     OpenPICState *opp = opaque;
794     int idx;
795 
796     addr += 0x10f0;
797 
798     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64 "\n",
799             __func__, addr, val);
800     if (addr & 0xF) {
801         return;
802     }
803 
804     if (addr == 0x10f0) {
805         /* TFRR */
806         opp->tfrr = val;
807         return;
808     }
809 
810     idx = (addr >> 6) & 0x3;
811     addr = addr & 0x30;
812 
813     switch (addr & 0x30) {
814     case 0x00: /* TCCR */
815         break;
816     case 0x10: /* TBCR */
817         if ((opp->timers[idx].tccr & TCCR_TOG) != 0 &&
818             (val & TBCR_CI) == 0 &&
819             (opp->timers[idx].tbcr & TBCR_CI) != 0) {
820             opp->timers[idx].tccr &= ~TCCR_TOG;
821         }
822         opp->timers[idx].tbcr = val;
823         break;
824     case 0x20: /* TVPR */
825         write_IRQreg_ivpr(opp, opp->irq_tim0 + idx, val);
826         break;
827     case 0x30: /* TDR */
828         write_IRQreg_idr(opp, opp->irq_tim0 + idx, val);
829         break;
830     }
831 }
832 
833 static uint64_t openpic_tmr_read(void *opaque, hwaddr addr, unsigned len)
834 {
835     OpenPICState *opp = opaque;
836     uint32_t retval = -1;
837     int idx;
838 
839     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
840     if (addr & 0xF) {
841         goto out;
842     }
843     idx = (addr >> 6) & 0x3;
844     if (addr == 0x0) {
845         /* TFRR */
846         retval = opp->tfrr;
847         goto out;
848     }
849     switch (addr & 0x30) {
850     case 0x00: /* TCCR */
851         retval = opp->timers[idx].tccr;
852         break;
853     case 0x10: /* TBCR */
854         retval = opp->timers[idx].tbcr;
855         break;
856     case 0x20: /* TIPV */
857         retval = read_IRQreg_ivpr(opp, opp->irq_tim0 + idx);
858         break;
859     case 0x30: /* TIDE (TIDR) */
860         retval = read_IRQreg_idr(opp, opp->irq_tim0 + idx);
861         break;
862     }
863 
864 out:
865     DPRINTF("%s: => 0x%08x\n", __func__, retval);
866 
867     return retval;
868 }
869 
870 static void openpic_src_write(void *opaque, hwaddr addr, uint64_t val,
871                               unsigned len)
872 {
873     OpenPICState *opp = opaque;
874     int idx;
875 
876     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64 "\n",
877             __func__, addr, val);
878 
879     addr = addr & 0xffff;
880     idx = addr >> 5;
881 
882     switch (addr & 0x1f) {
883     case 0x00:
884         write_IRQreg_ivpr(opp, idx, val);
885         break;
886     case 0x10:
887         write_IRQreg_idr(opp, idx, val);
888         break;
889     case 0x18:
890         write_IRQreg_ilr(opp, idx, val);
891         break;
892     }
893 }
894 
895 static uint64_t openpic_src_read(void *opaque, uint64_t addr, unsigned len)
896 {
897     OpenPICState *opp = opaque;
898     uint32_t retval;
899     int idx;
900 
901     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
902     retval = 0xFFFFFFFF;
903 
904     addr = addr & 0xffff;
905     idx = addr >> 5;
906 
907     switch (addr & 0x1f) {
908     case 0x00:
909         retval = read_IRQreg_ivpr(opp, idx);
910         break;
911     case 0x10:
912         retval = read_IRQreg_idr(opp, idx);
913         break;
914     case 0x18:
915         retval = read_IRQreg_ilr(opp, idx);
916         break;
917     }
918 
919     DPRINTF("%s: => 0x%08x\n", __func__, retval);
920     return retval;
921 }
922 
923 static void openpic_msi_write(void *opaque, hwaddr addr, uint64_t val,
924                               unsigned size)
925 {
926     OpenPICState *opp = opaque;
927     int idx = opp->irq_msi;
928     int srs, ibs;
929 
930     DPRINTF("%s: addr %#" HWADDR_PRIx " <= 0x%08" PRIx64 "\n",
931             __func__, addr, val);
932     if (addr & 0xF) {
933         return;
934     }
935 
936     switch (addr) {
937     case MSIIR_OFFSET:
938         srs = val >> MSIIR_SRS_SHIFT;
939         idx += srs;
940         ibs = (val & MSIIR_IBS_MASK) >> MSIIR_IBS_SHIFT;
941         opp->msi[srs].msir |= 1 << ibs;
942         openpic_set_irq(opp, idx, 1);
943         break;
944     default:
945         /* most registers are read-only, thus ignored */
946         break;
947     }
948 }
949 
950 static uint64_t openpic_msi_read(void *opaque, hwaddr addr, unsigned size)
951 {
952     OpenPICState *opp = opaque;
953     uint64_t r = 0;
954     int i, srs;
955 
956     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
957     if (addr & 0xF) {
958         return -1;
959     }
960 
961     srs = addr >> 4;
962 
963     switch (addr) {
964     case 0x00:
965     case 0x10:
966     case 0x20:
967     case 0x30:
968     case 0x40:
969     case 0x50:
970     case 0x60:
971     case 0x70: /* MSIRs */
972         r = opp->msi[srs].msir;
973         /* Clear on read */
974         opp->msi[srs].msir = 0;
975         openpic_set_irq(opp, opp->irq_msi + srs, 0);
976         break;
977     case 0x120: /* MSISR */
978         for (i = 0; i < MAX_MSI; i++) {
979             r |= (opp->msi[i].msir ? 1 : 0) << i;
980         }
981         break;
982     }
983 
984     return r;
985 }
986 
987 static uint64_t openpic_summary_read(void *opaque, hwaddr addr, unsigned size)
988 {
989     uint64_t r = 0;
990 
991     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
992 
993     /* TODO: EISR/EIMR */
994 
995     return r;
996 }
997 
998 static void openpic_summary_write(void *opaque, hwaddr addr, uint64_t val,
999                                   unsigned size)
1000 {
1001     DPRINTF("%s: addr %#" HWADDR_PRIx " <= 0x%08" PRIx64 "\n",
1002             __func__, addr, val);
1003 
1004     /* TODO: EISR/EIMR */
1005 }
1006 
1007 static void openpic_cpu_write_internal(void *opaque, hwaddr addr,
1008                                        uint32_t val, int idx)
1009 {
1010     OpenPICState *opp = opaque;
1011     IRQSource *src;
1012     IRQDest *dst;
1013     int s_IRQ, n_IRQ;
1014 
1015     DPRINTF("%s: cpu %d addr %#" HWADDR_PRIx " <= 0x%08x\n", __func__, idx,
1016             addr, val);
1017 
1018     if (idx < 0 || idx >= opp->nb_cpus) {
1019         return;
1020     }
1021 
1022     if (addr & 0xF) {
1023         return;
1024     }
1025     dst = &opp->dst[idx];
1026     addr &= 0xFF0;
1027     switch (addr) {
1028     case 0x40: /* IPIDR */
1029     case 0x50:
1030     case 0x60:
1031     case 0x70:
1032         idx = (addr - 0x40) >> 4;
1033         /* we use IDE as mask which CPUs to deliver the IPI to still. */
1034         opp->src[opp->irq_ipi0 + idx].destmask |= val;
1035         openpic_set_irq(opp, opp->irq_ipi0 + idx, 1);
1036         openpic_set_irq(opp, opp->irq_ipi0 + idx, 0);
1037         break;
1038     case 0x80: /* CTPR */
1039         dst->ctpr = val & 0x0000000F;
1040 
1041         DPRINTF("%s: set CPU %d ctpr to %d, raised %d servicing %d\n",
1042                 __func__, idx, dst->ctpr, dst->raised.priority,
1043                 dst->servicing.priority);
1044 
1045         if (dst->raised.priority <= dst->ctpr) {
1046             DPRINTF("%s: Lower OpenPIC INT output cpu %d due to ctpr\n",
1047                     __func__, idx);
1048             qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_INT]);
1049         } else if (dst->raised.priority > dst->servicing.priority) {
1050             DPRINTF("%s: Raise OpenPIC INT output cpu %d irq %d\n",
1051                     __func__, idx, dst->raised.next);
1052             qemu_irq_raise(dst->irqs[OPENPIC_OUTPUT_INT]);
1053         }
1054 
1055         break;
1056     case 0x90: /* WHOAMI */
1057         /* Read-only register */
1058         break;
1059     case 0xA0: /* IACK */
1060         /* Read-only register */
1061         break;
1062     case 0xB0: /* EOI */
1063         DPRINTF("EOI\n");
1064         s_IRQ = IRQ_get_next(opp, &dst->servicing);
1065 
1066         if (s_IRQ < 0) {
1067             DPRINTF("%s: EOI with no interrupt in service\n", __func__);
1068             break;
1069         }
1070 
1071         IRQ_resetbit(&dst->servicing, s_IRQ);
1072         /* Set up next servicing IRQ */
1073         s_IRQ = IRQ_get_next(opp, &dst->servicing);
1074         /* Check queued interrupts. */
1075         n_IRQ = IRQ_get_next(opp, &dst->raised);
1076         src = &opp->src[n_IRQ];
1077         if (n_IRQ != -1 &&
1078             (s_IRQ == -1 ||
1079              IVPR_PRIORITY(src->ivpr) > dst->servicing.priority)) {
1080             DPRINTF("Raise OpenPIC INT output cpu %d irq %d\n",
1081                     idx, n_IRQ);
1082             qemu_irq_raise(opp->dst[idx].irqs[OPENPIC_OUTPUT_INT]);
1083         }
1084         break;
1085     default:
1086         break;
1087     }
1088 }
1089 
1090 static void openpic_cpu_write(void *opaque, hwaddr addr, uint64_t val,
1091                               unsigned len)
1092 {
1093     openpic_cpu_write_internal(opaque, addr, val, (addr & 0x1f000) >> 12);
1094 }
1095 
1096 
1097 static uint32_t openpic_iack(OpenPICState *opp, IRQDest *dst, int cpu)
1098 {
1099     IRQSource *src;
1100     int retval, irq;
1101 
1102     DPRINTF("Lower OpenPIC INT output\n");
1103     qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_INT]);
1104 
1105     irq = IRQ_get_next(opp, &dst->raised);
1106     DPRINTF("IACK: irq=%d\n", irq);
1107 
1108     if (irq == -1) {
1109         /* No more interrupt pending */
1110         return opp->spve;
1111     }
1112 
1113     src = &opp->src[irq];
1114     if (!(src->ivpr & IVPR_ACTIVITY_MASK) ||
1115             !(IVPR_PRIORITY(src->ivpr) > dst->ctpr)) {
1116         fprintf(stderr, "%s: bad raised IRQ %d ctpr %d ivpr 0x%08x\n",
1117                 __func__, irq, dst->ctpr, src->ivpr);
1118         openpic_update_irq(opp, irq);
1119         retval = opp->spve;
1120     } else {
1121         /* IRQ enter servicing state */
1122         IRQ_setbit(&dst->servicing, irq);
1123         retval = IVPR_VECTOR(opp, src->ivpr);
1124     }
1125 
1126     if (!src->level) {
1127         /* edge-sensitive IRQ */
1128         src->ivpr &= ~IVPR_ACTIVITY_MASK;
1129         src->pending = 0;
1130         IRQ_resetbit(&dst->raised, irq);
1131     }
1132 
1133     if ((irq >= opp->irq_ipi0) &&  (irq < (opp->irq_ipi0 + OPENPIC_MAX_IPI))) {
1134         src->destmask &= ~(1 << cpu);
1135         if (src->destmask && !src->level) {
1136             /* trigger on CPUs that didn't know about it yet */
1137             openpic_set_irq(opp, irq, 1);
1138             openpic_set_irq(opp, irq, 0);
1139             /* if all CPUs knew about it, set active bit again */
1140             src->ivpr |= IVPR_ACTIVITY_MASK;
1141         }
1142     }
1143 
1144     return retval;
1145 }
1146 
1147 static uint32_t openpic_cpu_read_internal(void *opaque, hwaddr addr,
1148                                           int idx)
1149 {
1150     OpenPICState *opp = opaque;
1151     IRQDest *dst;
1152     uint32_t retval;
1153 
1154     DPRINTF("%s: cpu %d addr %#" HWADDR_PRIx "\n", __func__, idx, addr);
1155     retval = 0xFFFFFFFF;
1156 
1157     if (idx < 0 || idx >= opp->nb_cpus) {
1158         return retval;
1159     }
1160 
1161     if (addr & 0xF) {
1162         return retval;
1163     }
1164     dst = &opp->dst[idx];
1165     addr &= 0xFF0;
1166     switch (addr) {
1167     case 0x80: /* CTPR */
1168         retval = dst->ctpr;
1169         break;
1170     case 0x90: /* WHOAMI */
1171         retval = idx;
1172         break;
1173     case 0xA0: /* IACK */
1174         retval = openpic_iack(opp, dst, idx);
1175         break;
1176     case 0xB0: /* EOI */
1177         retval = 0;
1178         break;
1179     default:
1180         break;
1181     }
1182     DPRINTF("%s: => 0x%08x\n", __func__, retval);
1183 
1184     return retval;
1185 }
1186 
1187 static uint64_t openpic_cpu_read(void *opaque, hwaddr addr, unsigned len)
1188 {
1189     return openpic_cpu_read_internal(opaque, addr, (addr & 0x1f000) >> 12);
1190 }
1191 
1192 static const MemoryRegionOps openpic_glb_ops_le = {
1193     .write = openpic_gbl_write,
1194     .read  = openpic_gbl_read,
1195     .endianness = DEVICE_LITTLE_ENDIAN,
1196     .impl = {
1197         .min_access_size = 4,
1198         .max_access_size = 4,
1199     },
1200 };
1201 
1202 static const MemoryRegionOps openpic_glb_ops_be = {
1203     .write = openpic_gbl_write,
1204     .read  = openpic_gbl_read,
1205     .endianness = DEVICE_BIG_ENDIAN,
1206     .impl = {
1207         .min_access_size = 4,
1208         .max_access_size = 4,
1209     },
1210 };
1211 
1212 static const MemoryRegionOps openpic_tmr_ops_le = {
1213     .write = openpic_tmr_write,
1214     .read  = openpic_tmr_read,
1215     .endianness = DEVICE_LITTLE_ENDIAN,
1216     .impl = {
1217         .min_access_size = 4,
1218         .max_access_size = 4,
1219     },
1220 };
1221 
1222 static const MemoryRegionOps openpic_tmr_ops_be = {
1223     .write = openpic_tmr_write,
1224     .read  = openpic_tmr_read,
1225     .endianness = DEVICE_BIG_ENDIAN,
1226     .impl = {
1227         .min_access_size = 4,
1228         .max_access_size = 4,
1229     },
1230 };
1231 
1232 static const MemoryRegionOps openpic_cpu_ops_le = {
1233     .write = openpic_cpu_write,
1234     .read  = openpic_cpu_read,
1235     .endianness = DEVICE_LITTLE_ENDIAN,
1236     .impl = {
1237         .min_access_size = 4,
1238         .max_access_size = 4,
1239     },
1240 };
1241 
1242 static const MemoryRegionOps openpic_cpu_ops_be = {
1243     .write = openpic_cpu_write,
1244     .read  = openpic_cpu_read,
1245     .endianness = DEVICE_BIG_ENDIAN,
1246     .impl = {
1247         .min_access_size = 4,
1248         .max_access_size = 4,
1249     },
1250 };
1251 
1252 static const MemoryRegionOps openpic_src_ops_le = {
1253     .write = openpic_src_write,
1254     .read  = openpic_src_read,
1255     .endianness = DEVICE_LITTLE_ENDIAN,
1256     .impl = {
1257         .min_access_size = 4,
1258         .max_access_size = 4,
1259     },
1260 };
1261 
1262 static const MemoryRegionOps openpic_src_ops_be = {
1263     .write = openpic_src_write,
1264     .read  = openpic_src_read,
1265     .endianness = DEVICE_BIG_ENDIAN,
1266     .impl = {
1267         .min_access_size = 4,
1268         .max_access_size = 4,
1269     },
1270 };
1271 
1272 static const MemoryRegionOps openpic_msi_ops_be = {
1273     .read = openpic_msi_read,
1274     .write = openpic_msi_write,
1275     .endianness = DEVICE_BIG_ENDIAN,
1276     .impl = {
1277         .min_access_size = 4,
1278         .max_access_size = 4,
1279     },
1280 };
1281 
1282 static const MemoryRegionOps openpic_summary_ops_be = {
1283     .read = openpic_summary_read,
1284     .write = openpic_summary_write,
1285     .endianness = DEVICE_BIG_ENDIAN,
1286     .impl = {
1287         .min_access_size = 4,
1288         .max_access_size = 4,
1289     },
1290 };
1291 
1292 static void openpic_save_IRQ_queue(QEMUFile* f, IRQQueue *q)
1293 {
1294     unsigned int i;
1295 
1296     for (i = 0; i < BITS_TO_LONGS(IRQQUEUE_SIZE_BITS); i++) {
1297         /* Always put the lower half of a 64-bit long first, in case we
1298          * restore on a 32-bit host.  The least significant bits correspond
1299          * to lower IRQ numbers in the bitmap.
1300          */
1301         qemu_put_be32(f, (uint32_t)q->queue[i]);
1302 #if LONG_MAX > 0x7FFFFFFF
1303         qemu_put_be32(f, (uint32_t)(q->queue[i] >> 32));
1304 #endif
1305     }
1306 
1307     qemu_put_sbe32s(f, &q->next);
1308     qemu_put_sbe32s(f, &q->priority);
1309 }
1310 
1311 static void openpic_save(QEMUFile* f, void *opaque)
1312 {
1313     OpenPICState *opp = (OpenPICState *)opaque;
1314     unsigned int i;
1315 
1316     qemu_put_be32s(f, &opp->gcr);
1317     qemu_put_be32s(f, &opp->vir);
1318     qemu_put_be32s(f, &opp->pir);
1319     qemu_put_be32s(f, &opp->spve);
1320     qemu_put_be32s(f, &opp->tfrr);
1321 
1322     qemu_put_be32s(f, &opp->nb_cpus);
1323 
1324     for (i = 0; i < opp->nb_cpus; i++) {
1325         qemu_put_sbe32s(f, &opp->dst[i].ctpr);
1326         openpic_save_IRQ_queue(f, &opp->dst[i].raised);
1327         openpic_save_IRQ_queue(f, &opp->dst[i].servicing);
1328         qemu_put_buffer(f, (uint8_t *)&opp->dst[i].outputs_active,
1329                         sizeof(opp->dst[i].outputs_active));
1330     }
1331 
1332     for (i = 0; i < OPENPIC_MAX_TMR; i++) {
1333         qemu_put_be32s(f, &opp->timers[i].tccr);
1334         qemu_put_be32s(f, &opp->timers[i].tbcr);
1335     }
1336 
1337     for (i = 0; i < opp->max_irq; i++) {
1338         qemu_put_be32s(f, &opp->src[i].ivpr);
1339         qemu_put_be32s(f, &opp->src[i].idr);
1340         qemu_put_be32s(f, &opp->src[i].destmask);
1341         qemu_put_sbe32s(f, &opp->src[i].last_cpu);
1342         qemu_put_sbe32s(f, &opp->src[i].pending);
1343     }
1344 }
1345 
1346 static void openpic_load_IRQ_queue(QEMUFile* f, IRQQueue *q)
1347 {
1348     unsigned int i;
1349 
1350     for (i = 0; i < BITS_TO_LONGS(IRQQUEUE_SIZE_BITS); i++) {
1351         unsigned long val;
1352 
1353         val = qemu_get_be32(f);
1354 #if LONG_MAX > 0x7FFFFFFF
1355         val <<= 32;
1356         val |= qemu_get_be32(f);
1357 #endif
1358 
1359         q->queue[i] = val;
1360     }
1361 
1362     qemu_get_sbe32s(f, &q->next);
1363     qemu_get_sbe32s(f, &q->priority);
1364 }
1365 
1366 static int openpic_load(QEMUFile* f, void *opaque, int version_id)
1367 {
1368     OpenPICState *opp = (OpenPICState *)opaque;
1369     unsigned int i, nb_cpus;
1370 
1371     if (version_id != 2) {
1372         return -EINVAL;
1373     }
1374 
1375     qemu_get_be32s(f, &opp->gcr);
1376     qemu_get_be32s(f, &opp->vir);
1377     qemu_get_be32s(f, &opp->pir);
1378     qemu_get_be32s(f, &opp->spve);
1379     qemu_get_be32s(f, &opp->tfrr);
1380 
1381     qemu_get_be32s(f, &nb_cpus);
1382     if (opp->nb_cpus != nb_cpus) {
1383         return -EINVAL;
1384     }
1385     assert(nb_cpus > 0 && nb_cpus <= MAX_CPU);
1386 
1387     for (i = 0; i < opp->nb_cpus; i++) {
1388         qemu_get_sbe32s(f, &opp->dst[i].ctpr);
1389         openpic_load_IRQ_queue(f, &opp->dst[i].raised);
1390         openpic_load_IRQ_queue(f, &opp->dst[i].servicing);
1391         qemu_get_buffer(f, (uint8_t *)&opp->dst[i].outputs_active,
1392                         sizeof(opp->dst[i].outputs_active));
1393     }
1394 
1395     for (i = 0; i < OPENPIC_MAX_TMR; i++) {
1396         qemu_get_be32s(f, &opp->timers[i].tccr);
1397         qemu_get_be32s(f, &opp->timers[i].tbcr);
1398     }
1399 
1400     for (i = 0; i < opp->max_irq; i++) {
1401         uint32_t val;
1402 
1403         val = qemu_get_be32(f);
1404         write_IRQreg_ivpr(opp, i, val);
1405         val = qemu_get_be32(f);
1406         write_IRQreg_idr(opp, i, val);
1407 
1408         qemu_get_be32s(f, &opp->src[i].destmask);
1409         qemu_get_sbe32s(f, &opp->src[i].last_cpu);
1410         qemu_get_sbe32s(f, &opp->src[i].pending);
1411     }
1412 
1413     return 0;
1414 }
1415 
1416 static void openpic_reset(DeviceState *d)
1417 {
1418     OpenPICState *opp = OPENPIC(d);
1419     int i;
1420 
1421     opp->gcr = GCR_RESET;
1422     /* Initialise controller registers */
1423     opp->frr = ((opp->nb_irqs - 1) << FRR_NIRQ_SHIFT) |
1424                ((opp->nb_cpus - 1) << FRR_NCPU_SHIFT) |
1425                (opp->vid << FRR_VID_SHIFT);
1426 
1427     opp->pir = 0;
1428     opp->spve = -1 & opp->vector_mask;
1429     opp->tfrr = opp->tfrr_reset;
1430     /* Initialise IRQ sources */
1431     for (i = 0; i < opp->max_irq; i++) {
1432         opp->src[i].ivpr = opp->ivpr_reset;
1433         switch (opp->src[i].type) {
1434         case IRQ_TYPE_NORMAL:
1435             opp->src[i].level = !!(opp->ivpr_reset & IVPR_SENSE_MASK);
1436             break;
1437 
1438         case IRQ_TYPE_FSLINT:
1439             opp->src[i].ivpr |= IVPR_POLARITY_MASK;
1440             break;
1441 
1442         case IRQ_TYPE_FSLSPECIAL:
1443             break;
1444         }
1445 
1446         write_IRQreg_idr(opp, i, opp->idr_reset);
1447     }
1448     /* Initialise IRQ destinations */
1449     for (i = 0; i < opp->nb_cpus; i++) {
1450         opp->dst[i].ctpr      = 15;
1451         opp->dst[i].raised.next = -1;
1452         opp->dst[i].raised.priority = 0;
1453         bitmap_clear(opp->dst[i].raised.queue, 0, IRQQUEUE_SIZE_BITS);
1454         opp->dst[i].servicing.next = -1;
1455         opp->dst[i].servicing.priority = 0;
1456         bitmap_clear(opp->dst[i].servicing.queue, 0, IRQQUEUE_SIZE_BITS);
1457     }
1458     /* Initialise timers */
1459     for (i = 0; i < OPENPIC_MAX_TMR; i++) {
1460         opp->timers[i].tccr = 0;
1461         opp->timers[i].tbcr = TBCR_CI;
1462     }
1463     /* Go out of RESET state */
1464     opp->gcr = 0;
1465 }
1466 
1467 typedef struct MemReg {
1468     const char             *name;
1469     MemoryRegionOps const  *ops;
1470     hwaddr      start_addr;
1471     ram_addr_t              size;
1472 } MemReg;
1473 
1474 static void fsl_common_init(OpenPICState *opp)
1475 {
1476     int i;
1477     int virq = OPENPIC_MAX_SRC;
1478 
1479     opp->vid = VID_REVISION_1_2;
1480     opp->vir = VIR_GENERIC;
1481     opp->vector_mask = 0xFFFF;
1482     opp->tfrr_reset = 0;
1483     opp->ivpr_reset = IVPR_MASK_MASK;
1484     opp->idr_reset = 1 << 0;
1485     opp->max_irq = OPENPIC_MAX_IRQ;
1486 
1487     opp->irq_ipi0 = virq;
1488     virq += OPENPIC_MAX_IPI;
1489     opp->irq_tim0 = virq;
1490     virq += OPENPIC_MAX_TMR;
1491 
1492     assert(virq <= OPENPIC_MAX_IRQ);
1493 
1494     opp->irq_msi = 224;
1495 
1496     msi_supported = true;
1497     for (i = 0; i < opp->fsl->max_ext; i++) {
1498         opp->src[i].level = false;
1499     }
1500 
1501     /* Internal interrupts, including message and MSI */
1502     for (i = 16; i < OPENPIC_MAX_SRC; i++) {
1503         opp->src[i].type = IRQ_TYPE_FSLINT;
1504         opp->src[i].level = true;
1505     }
1506 
1507     /* timers and IPIs */
1508     for (i = OPENPIC_MAX_SRC; i < virq; i++) {
1509         opp->src[i].type = IRQ_TYPE_FSLSPECIAL;
1510         opp->src[i].level = false;
1511     }
1512 }
1513 
1514 static void map_list(OpenPICState *opp, const MemReg *list, int *count)
1515 {
1516     while (list->name) {
1517         assert(*count < ARRAY_SIZE(opp->sub_io_mem));
1518 
1519         memory_region_init_io(&opp->sub_io_mem[*count], OBJECT(opp), list->ops,
1520                               opp, list->name, list->size);
1521 
1522         memory_region_add_subregion(&opp->mem, list->start_addr,
1523                                     &opp->sub_io_mem[*count]);
1524 
1525         (*count)++;
1526         list++;
1527     }
1528 }
1529 
1530 static void openpic_init(Object *obj)
1531 {
1532     OpenPICState *opp = OPENPIC(obj);
1533 
1534     memory_region_init(&opp->mem, obj, "openpic", 0x40000);
1535 }
1536 
1537 static void openpic_realize(DeviceState *dev, Error **errp)
1538 {
1539     SysBusDevice *d = SYS_BUS_DEVICE(dev);
1540     OpenPICState *opp = OPENPIC(dev);
1541     int i, j;
1542     int list_count = 0;
1543     static const MemReg list_le[] = {
1544         {"glb", &openpic_glb_ops_le,
1545                 OPENPIC_GLB_REG_START, OPENPIC_GLB_REG_SIZE},
1546         {"tmr", &openpic_tmr_ops_le,
1547                 OPENPIC_TMR_REG_START, OPENPIC_TMR_REG_SIZE},
1548         {"src", &openpic_src_ops_le,
1549                 OPENPIC_SRC_REG_START, OPENPIC_SRC_REG_SIZE},
1550         {"cpu", &openpic_cpu_ops_le,
1551                 OPENPIC_CPU_REG_START, OPENPIC_CPU_REG_SIZE},
1552         {NULL}
1553     };
1554     static const MemReg list_be[] = {
1555         {"glb", &openpic_glb_ops_be,
1556                 OPENPIC_GLB_REG_START, OPENPIC_GLB_REG_SIZE},
1557         {"tmr", &openpic_tmr_ops_be,
1558                 OPENPIC_TMR_REG_START, OPENPIC_TMR_REG_SIZE},
1559         {"src", &openpic_src_ops_be,
1560                 OPENPIC_SRC_REG_START, OPENPIC_SRC_REG_SIZE},
1561         {"cpu", &openpic_cpu_ops_be,
1562                 OPENPIC_CPU_REG_START, OPENPIC_CPU_REG_SIZE},
1563         {NULL}
1564     };
1565     static const MemReg list_fsl[] = {
1566         {"msi", &openpic_msi_ops_be,
1567                 OPENPIC_MSI_REG_START, OPENPIC_MSI_REG_SIZE},
1568         {"summary", &openpic_summary_ops_be,
1569                 OPENPIC_SUMMARY_REG_START, OPENPIC_SUMMARY_REG_SIZE},
1570         {NULL}
1571     };
1572 
1573     if (opp->nb_cpus > MAX_CPU) {
1574         error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE,
1575                   TYPE_OPENPIC, "nb_cpus", (uint64_t)opp->nb_cpus,
1576                   (uint64_t)0, (uint64_t)MAX_CPU);
1577         return;
1578     }
1579 
1580     switch (opp->model) {
1581     case OPENPIC_MODEL_FSL_MPIC_20:
1582     default:
1583         opp->fsl = &fsl_mpic_20;
1584         opp->brr1 = 0x00400200;
1585         opp->flags |= OPENPIC_FLAG_IDR_CRIT;
1586         opp->nb_irqs = 80;
1587         opp->mpic_mode_mask = GCR_MODE_MIXED;
1588 
1589         fsl_common_init(opp);
1590         map_list(opp, list_be, &list_count);
1591         map_list(opp, list_fsl, &list_count);
1592 
1593         break;
1594 
1595     case OPENPIC_MODEL_FSL_MPIC_42:
1596         opp->fsl = &fsl_mpic_42;
1597         opp->brr1 = 0x00400402;
1598         opp->flags |= OPENPIC_FLAG_ILR;
1599         opp->nb_irqs = 196;
1600         opp->mpic_mode_mask = GCR_MODE_PROXY;
1601 
1602         fsl_common_init(opp);
1603         map_list(opp, list_be, &list_count);
1604         map_list(opp, list_fsl, &list_count);
1605 
1606         break;
1607 
1608     case OPENPIC_MODEL_RAVEN:
1609         opp->nb_irqs = RAVEN_MAX_EXT;
1610         opp->vid = VID_REVISION_1_3;
1611         opp->vir = VIR_GENERIC;
1612         opp->vector_mask = 0xFF;
1613         opp->tfrr_reset = 4160000;
1614         opp->ivpr_reset = IVPR_MASK_MASK | IVPR_MODE_MASK;
1615         opp->idr_reset = 0;
1616         opp->max_irq = RAVEN_MAX_IRQ;
1617         opp->irq_ipi0 = RAVEN_IPI_IRQ;
1618         opp->irq_tim0 = RAVEN_TMR_IRQ;
1619         opp->brr1 = -1;
1620         opp->mpic_mode_mask = GCR_MODE_MIXED;
1621 
1622         if (opp->nb_cpus != 1) {
1623             error_setg(errp, "Only UP supported today");
1624             return;
1625         }
1626 
1627         map_list(opp, list_le, &list_count);
1628         break;
1629     }
1630 
1631     for (i = 0; i < opp->nb_cpus; i++) {
1632         opp->dst[i].irqs = g_new0(qemu_irq, OPENPIC_OUTPUT_NB);
1633         for (j = 0; j < OPENPIC_OUTPUT_NB; j++) {
1634             sysbus_init_irq(d, &opp->dst[i].irqs[j]);
1635         }
1636 
1637         opp->dst[i].raised.queue = bitmap_new(IRQQUEUE_SIZE_BITS);
1638         opp->dst[i].servicing.queue = bitmap_new(IRQQUEUE_SIZE_BITS);
1639     }
1640 
1641     register_savevm(dev, "openpic", 0, 2,
1642                     openpic_save, openpic_load, opp);
1643 
1644     sysbus_init_mmio(d, &opp->mem);
1645     qdev_init_gpio_in(dev, openpic_set_irq, opp->max_irq);
1646 }
1647 
1648 static Property openpic_properties[] = {
1649     DEFINE_PROP_UINT32("model", OpenPICState, model, OPENPIC_MODEL_FSL_MPIC_20),
1650     DEFINE_PROP_UINT32("nb_cpus", OpenPICState, nb_cpus, 1),
1651     DEFINE_PROP_END_OF_LIST(),
1652 };
1653 
1654 static void openpic_class_init(ObjectClass *oc, void *data)
1655 {
1656     DeviceClass *dc = DEVICE_CLASS(oc);
1657 
1658     dc->realize = openpic_realize;
1659     dc->props = openpic_properties;
1660     dc->reset = openpic_reset;
1661 }
1662 
1663 static const TypeInfo openpic_info = {
1664     .name          = TYPE_OPENPIC,
1665     .parent        = TYPE_SYS_BUS_DEVICE,
1666     .instance_size = sizeof(OpenPICState),
1667     .instance_init = openpic_init,
1668     .class_init    = openpic_class_init,
1669 };
1670 
1671 static void openpic_register_types(void)
1672 {
1673     type_register_static(&openpic_info);
1674 }
1675 
1676 type_init(openpic_register_types)
1677