xref: /openbmc/qemu/hw/intc/openpic.c (revision f0984d40)
1 /*
2  * OpenPIC emulation
3  *
4  * Copyright (c) 2004 Jocelyn Mayer
5  *               2011 Alexander Graf
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 /*
26  *
27  * Based on OpenPic implementations:
28  * - Motorola MPC8245 & MPC8540 user manuals.
29  * - Motorola Harrier programmer manual
30  *
31  */
32 
33 #include "qemu/osdep.h"
34 #include "hw/irq.h"
35 #include "hw/pci/pci.h"
36 #include "hw/ppc/openpic.h"
37 #include "hw/ppc/ppc_e500.h"
38 #include "hw/qdev-properties.h"
39 #include "hw/sysbus.h"
40 #include "migration/vmstate.h"
41 #include "hw/pci/msi.h"
42 #include "qapi/error.h"
43 #include "qemu/bitops.h"
44 #include "qapi/qmp/qerror.h"
45 #include "qemu/module.h"
46 #include "qemu/timer.h"
47 #include "qemu/error-report.h"
48 
49 /* #define DEBUG_OPENPIC */
50 
51 #ifdef DEBUG_OPENPIC
52 static const int debug_openpic = 1;
53 #else
54 static const int debug_openpic = 0;
55 #endif
56 
57 static int get_current_cpu(void);
58 #define DPRINTF(fmt, ...) do { \
59         if (debug_openpic) { \
60             info_report("Core%d: " fmt, get_current_cpu(), ## __VA_ARGS__); \
61         } \
62     } while (0)
63 
64 /* OpenPIC capability flags */
65 #define OPENPIC_FLAG_IDR_CRIT     (1 << 0)
66 #define OPENPIC_FLAG_ILR          (2 << 0)
67 
68 /* OpenPIC address map */
69 #define OPENPIC_GLB_REG_START        0x0
70 #define OPENPIC_GLB_REG_SIZE         0x10F0
71 #define OPENPIC_TMR_REG_START        0x10F0
72 #define OPENPIC_TMR_REG_SIZE         0x220
73 #define OPENPIC_MSI_REG_START        0x1600
74 #define OPENPIC_MSI_REG_SIZE         0x200
75 #define OPENPIC_SUMMARY_REG_START   0x3800
76 #define OPENPIC_SUMMARY_REG_SIZE    0x800
77 #define OPENPIC_SRC_REG_START        0x10000
78 #define OPENPIC_SRC_REG_SIZE         (OPENPIC_MAX_SRC * 0x20)
79 #define OPENPIC_CPU_REG_START        0x20000
80 #define OPENPIC_CPU_REG_SIZE         0x100 + ((MAX_CPU - 1) * 0x1000)
81 
82 static FslMpicInfo fsl_mpic_20 = {
83     .max_ext = 12,
84 };
85 
86 static FslMpicInfo fsl_mpic_42 = {
87     .max_ext = 12,
88 };
89 
90 #define FRR_NIRQ_SHIFT    16
91 #define FRR_NCPU_SHIFT     8
92 #define FRR_VID_SHIFT      0
93 
94 #define VID_REVISION_1_2   2
95 #define VID_REVISION_1_3   3
96 
97 #define VIR_GENERIC      0x00000000 /* Generic Vendor ID */
98 #define VIR_MPIC2A       0x00004614 /* IBM MPIC-2A */
99 
100 #define GCR_RESET        0x80000000
101 #define GCR_MODE_PASS    0x00000000
102 #define GCR_MODE_MIXED   0x20000000
103 #define GCR_MODE_PROXY   0x60000000
104 
105 #define TBCR_CI           0x80000000 /* count inhibit */
106 #define TCCR_TOG          0x80000000 /* toggles when decrement to zero */
107 
108 #define IDR_EP_SHIFT      31
109 #define IDR_EP_MASK       (1U << IDR_EP_SHIFT)
110 #define IDR_CI0_SHIFT     30
111 #define IDR_CI1_SHIFT     29
112 #define IDR_P1_SHIFT      1
113 #define IDR_P0_SHIFT      0
114 
115 #define ILR_INTTGT_MASK   0x000000ff
116 #define ILR_INTTGT_INT    0x00
117 #define ILR_INTTGT_CINT   0x01 /* critical */
118 #define ILR_INTTGT_MCP    0x02 /* machine check */
119 
120 /*
121  * The currently supported INTTGT values happen to be the same as QEMU's
122  * openpic output codes, but don't depend on this.  The output codes
123  * could change (unlikely, but...) or support could be added for
124  * more INTTGT values.
125  */
126 static const int inttgt_output[][2] = {
127     { ILR_INTTGT_INT, OPENPIC_OUTPUT_INT },
128     { ILR_INTTGT_CINT, OPENPIC_OUTPUT_CINT },
129     { ILR_INTTGT_MCP, OPENPIC_OUTPUT_MCK },
130 };
131 
132 static int inttgt_to_output(int inttgt)
133 {
134     int i;
135 
136     for (i = 0; i < ARRAY_SIZE(inttgt_output); i++) {
137         if (inttgt_output[i][0] == inttgt) {
138             return inttgt_output[i][1];
139         }
140     }
141 
142     error_report("%s: unsupported inttgt %d", __func__, inttgt);
143     return OPENPIC_OUTPUT_INT;
144 }
145 
146 static int output_to_inttgt(int output)
147 {
148     int i;
149 
150     for (i = 0; i < ARRAY_SIZE(inttgt_output); i++) {
151         if (inttgt_output[i][1] == output) {
152             return inttgt_output[i][0];
153         }
154     }
155 
156     abort();
157 }
158 
159 #define MSIIR_OFFSET       0x140
160 #define MSIIR_SRS_SHIFT    29
161 #define MSIIR_SRS_MASK     (0x7 << MSIIR_SRS_SHIFT)
162 #define MSIIR_IBS_SHIFT    24
163 #define MSIIR_IBS_MASK     (0x1f << MSIIR_IBS_SHIFT)
164 
165 static int get_current_cpu(void)
166 {
167     if (!current_cpu) {
168         return -1;
169     }
170 
171     return current_cpu->cpu_index;
172 }
173 
174 static uint32_t openpic_cpu_read_internal(void *opaque, hwaddr addr,
175                                           int idx);
176 static void openpic_cpu_write_internal(void *opaque, hwaddr addr,
177                                        uint32_t val, int idx);
178 static void openpic_reset(DeviceState *d);
179 
180 /*
181  * Convert between openpic clock ticks and nanosecs.  In the hardware the clock
182  * frequency is driven by board inputs to the PIC which the PIC would then
183  * divide by 4 or 8.  For now hard code to 25MZ.
184  */
185 #define OPENPIC_TIMER_FREQ_MHZ 25
186 #define OPENPIC_TIMER_NS_PER_TICK (1000 / OPENPIC_TIMER_FREQ_MHZ)
187 static inline uint64_t ns_to_ticks(uint64_t ns)
188 {
189     return ns    / OPENPIC_TIMER_NS_PER_TICK;
190 }
191 static inline uint64_t ticks_to_ns(uint64_t ticks)
192 {
193     return ticks * OPENPIC_TIMER_NS_PER_TICK;
194 }
195 
196 static inline void IRQ_setbit(IRQQueue *q, int n_IRQ)
197 {
198     set_bit(n_IRQ, q->queue);
199 }
200 
201 static inline void IRQ_resetbit(IRQQueue *q, int n_IRQ)
202 {
203     clear_bit(n_IRQ, q->queue);
204 }
205 
206 static void IRQ_check(OpenPICState *opp, IRQQueue *q)
207 {
208     int irq = -1;
209     int next = -1;
210     int priority = -1;
211 
212     for (;;) {
213         irq = find_next_bit(q->queue, opp->max_irq, irq + 1);
214         if (irq == opp->max_irq) {
215             break;
216         }
217 
218         DPRINTF("IRQ_check: irq %d set ivpr_pr=%d pr=%d",
219                 irq, IVPR_PRIORITY(opp->src[irq].ivpr), priority);
220 
221         if (IVPR_PRIORITY(opp->src[irq].ivpr) > priority) {
222             next = irq;
223             priority = IVPR_PRIORITY(opp->src[irq].ivpr);
224         }
225     }
226 
227     q->next = next;
228     q->priority = priority;
229 }
230 
231 static int IRQ_get_next(OpenPICState *opp, IRQQueue *q)
232 {
233     /* XXX: optimize */
234     IRQ_check(opp, q);
235 
236     return q->next;
237 }
238 
239 static void IRQ_local_pipe(OpenPICState *opp, int n_CPU, int n_IRQ,
240                            bool active, bool was_active)
241 {
242     IRQDest *dst;
243     IRQSource *src;
244     int priority;
245 
246     dst = &opp->dst[n_CPU];
247     src = &opp->src[n_IRQ];
248 
249     DPRINTF("%s: IRQ %d active %d was %d",
250             __func__, n_IRQ, active, was_active);
251 
252     if (src->output != OPENPIC_OUTPUT_INT) {
253         DPRINTF("%s: output %d irq %d active %d was %d count %d",
254                 __func__, src->output, n_IRQ, active, was_active,
255                 dst->outputs_active[src->output]);
256 
257         /*
258          * On Freescale MPIC, critical interrupts ignore priority,
259          * IACK, EOI, etc.  Before MPIC v4.1 they also ignore
260          * masking.
261          */
262         if (active) {
263             if (!was_active && dst->outputs_active[src->output]++ == 0) {
264                 DPRINTF("%s: Raise OpenPIC output %d cpu %d irq %d",
265                         __func__, src->output, n_CPU, n_IRQ);
266                 qemu_irq_raise(dst->irqs[src->output]);
267             }
268         } else {
269             if (was_active && --dst->outputs_active[src->output] == 0) {
270                 DPRINTF("%s: Lower OpenPIC output %d cpu %d irq %d",
271                         __func__, src->output, n_CPU, n_IRQ);
272                 qemu_irq_lower(dst->irqs[src->output]);
273             }
274         }
275 
276         return;
277     }
278 
279     priority = IVPR_PRIORITY(src->ivpr);
280 
281     /*
282      * Even if the interrupt doesn't have enough priority,
283      * it is still raised, in case ctpr is lowered later.
284      */
285     if (active) {
286         IRQ_setbit(&dst->raised, n_IRQ);
287     } else {
288         IRQ_resetbit(&dst->raised, n_IRQ);
289     }
290 
291     IRQ_check(opp, &dst->raised);
292 
293     if (active && priority <= dst->ctpr) {
294         DPRINTF("%s: IRQ %d priority %d too low for ctpr %d on CPU %d",
295                 __func__, n_IRQ, priority, dst->ctpr, n_CPU);
296         active = 0;
297     }
298 
299     if (active) {
300         if (IRQ_get_next(opp, &dst->servicing) >= 0 &&
301                 priority <= dst->servicing.priority) {
302             DPRINTF("%s: IRQ %d is hidden by servicing IRQ %d on CPU %d",
303                     __func__, n_IRQ, dst->servicing.next, n_CPU);
304         } else {
305             DPRINTF("%s: Raise OpenPIC INT output cpu %d irq %d/%d",
306                     __func__, n_CPU, n_IRQ, dst->raised.next);
307             qemu_irq_raise(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);
308         }
309     } else {
310         IRQ_get_next(opp, &dst->servicing);
311         if (dst->raised.priority > dst->ctpr &&
312                 dst->raised.priority > dst->servicing.priority) {
313             DPRINTF("%s: IRQ %d inactive, IRQ %d prio %d above %d/%d, CPU %d",
314                     __func__, n_IRQ, dst->raised.next, dst->raised.priority,
315                     dst->ctpr, dst->servicing.priority, n_CPU);
316             /* IRQ line stays asserted */
317         } else {
318             DPRINTF("%s: IRQ %d inactive, current prio %d/%d, CPU %d",
319                     __func__, n_IRQ, dst->ctpr, dst->servicing.priority, n_CPU);
320             qemu_irq_lower(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);
321         }
322     }
323 }
324 
325 /* update pic state because registers for n_IRQ have changed value */
326 static void openpic_update_irq(OpenPICState *opp, int n_IRQ)
327 {
328     IRQSource *src;
329     bool active, was_active;
330     int i;
331 
332     src = &opp->src[n_IRQ];
333     active = src->pending;
334 
335     if ((src->ivpr & IVPR_MASK_MASK) && !src->nomask) {
336         /* Interrupt source is disabled */
337         DPRINTF("%s: IRQ %d is disabled", __func__, n_IRQ);
338         active = false;
339     }
340 
341     was_active = !!(src->ivpr & IVPR_ACTIVITY_MASK);
342 
343     /*
344      * We don't have a similar check for already-active because
345      * ctpr may have changed and we need to withdraw the interrupt.
346      */
347     if (!active && !was_active) {
348         DPRINTF("%s: IRQ %d is already inactive", __func__, n_IRQ);
349         return;
350     }
351 
352     if (active) {
353         src->ivpr |= IVPR_ACTIVITY_MASK;
354     } else {
355         src->ivpr &= ~IVPR_ACTIVITY_MASK;
356     }
357 
358     if (src->destmask == 0) {
359         /* No target */
360         DPRINTF("%s: IRQ %d has no target", __func__, n_IRQ);
361         return;
362     }
363 
364     if (src->destmask == (1 << src->last_cpu)) {
365         /* Only one CPU is allowed to receive this IRQ */
366         IRQ_local_pipe(opp, src->last_cpu, n_IRQ, active, was_active);
367     } else if (!(src->ivpr & IVPR_MODE_MASK)) {
368         /* Directed delivery mode */
369         for (i = 0; i < opp->nb_cpus; i++) {
370             if (src->destmask & (1 << i)) {
371                 IRQ_local_pipe(opp, i, n_IRQ, active, was_active);
372             }
373         }
374     } else {
375         /* Distributed delivery mode */
376         for (i = src->last_cpu + 1; i != src->last_cpu; i++) {
377             if (i == opp->nb_cpus) {
378                 i = 0;
379             }
380             if (src->destmask & (1 << i)) {
381                 IRQ_local_pipe(opp, i, n_IRQ, active, was_active);
382                 src->last_cpu = i;
383                 break;
384             }
385         }
386     }
387 }
388 
389 static void openpic_set_irq(void *opaque, int n_IRQ, int level)
390 {
391     OpenPICState *opp = opaque;
392     IRQSource *src;
393 
394     if (n_IRQ >= OPENPIC_MAX_IRQ) {
395         error_report("%s: IRQ %d out of range", __func__, n_IRQ);
396         abort();
397     }
398 
399     src = &opp->src[n_IRQ];
400     DPRINTF("openpic: set irq %d = %d ivpr=0x%08x",
401             n_IRQ, level, src->ivpr);
402     if (src->level) {
403         /* level-sensitive irq */
404         src->pending = level;
405         openpic_update_irq(opp, n_IRQ);
406     } else {
407         /* edge-sensitive irq */
408         if (level) {
409             src->pending = 1;
410             openpic_update_irq(opp, n_IRQ);
411         }
412 
413         if (src->output != OPENPIC_OUTPUT_INT) {
414             /*
415              * Edge-triggered interrupts shouldn't be used
416              * with non-INT delivery, but just in case,
417              * try to make it do something sane rather than
418              * cause an interrupt storm.  This is close to
419              * what you'd probably see happen in real hardware.
420              */
421             src->pending = 0;
422             openpic_update_irq(opp, n_IRQ);
423         }
424     }
425 }
426 
427 static inline uint32_t read_IRQreg_idr(OpenPICState *opp, int n_IRQ)
428 {
429     return opp->src[n_IRQ].idr;
430 }
431 
432 static inline uint32_t read_IRQreg_ilr(OpenPICState *opp, int n_IRQ)
433 {
434     if (opp->flags & OPENPIC_FLAG_ILR) {
435         return output_to_inttgt(opp->src[n_IRQ].output);
436     }
437 
438     return 0xffffffff;
439 }
440 
441 static inline uint32_t read_IRQreg_ivpr(OpenPICState *opp, int n_IRQ)
442 {
443     return opp->src[n_IRQ].ivpr;
444 }
445 
446 static inline void write_IRQreg_idr(OpenPICState *opp, int n_IRQ, uint32_t val)
447 {
448     IRQSource *src = &opp->src[n_IRQ];
449     uint32_t normal_mask = (1UL << opp->nb_cpus) - 1;
450     uint32_t crit_mask = 0;
451     uint32_t mask = normal_mask;
452     int crit_shift = IDR_EP_SHIFT - opp->nb_cpus;
453     int i;
454 
455     if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
456         crit_mask = mask << crit_shift;
457         mask |= crit_mask | IDR_EP;
458     }
459 
460     src->idr = val & mask;
461     DPRINTF("Set IDR %d to 0x%08x", n_IRQ, src->idr);
462 
463     if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
464         if (src->idr & crit_mask) {
465             if (src->idr & normal_mask) {
466                 DPRINTF("%s: IRQ configured for multiple output types, using "
467                         "critical", __func__);
468             }
469 
470             src->output = OPENPIC_OUTPUT_CINT;
471             src->nomask = true;
472             src->destmask = 0;
473 
474             for (i = 0; i < opp->nb_cpus; i++) {
475                 int n_ci = IDR_CI0_SHIFT - i;
476 
477                 if (src->idr & (1UL << n_ci)) {
478                     src->destmask |= 1UL << i;
479                 }
480             }
481         } else {
482             src->output = OPENPIC_OUTPUT_INT;
483             src->nomask = false;
484             src->destmask = src->idr & normal_mask;
485         }
486     } else {
487         src->destmask = src->idr;
488     }
489 }
490 
491 static inline void write_IRQreg_ilr(OpenPICState *opp, int n_IRQ, uint32_t val)
492 {
493     if (opp->flags & OPENPIC_FLAG_ILR) {
494         IRQSource *src = &opp->src[n_IRQ];
495 
496         src->output = inttgt_to_output(val & ILR_INTTGT_MASK);
497         DPRINTF("Set ILR %d to 0x%08x, output %d", n_IRQ, src->idr,
498                 src->output);
499 
500         /* TODO: on MPIC v4.0 only, set nomask for non-INT */
501     }
502 }
503 
504 static inline void write_IRQreg_ivpr(OpenPICState *opp, int n_IRQ, uint32_t val)
505 {
506     uint32_t mask;
507 
508     /*
509      * NOTE when implementing newer FSL MPIC models: starting with v4.0,
510      * the polarity bit is read-only on internal interrupts.
511      */
512     mask = IVPR_MASK_MASK | IVPR_PRIORITY_MASK | IVPR_SENSE_MASK |
513            IVPR_POLARITY_MASK | opp->vector_mask;
514 
515     /* ACTIVITY bit is read-only */
516     opp->src[n_IRQ].ivpr =
517         (opp->src[n_IRQ].ivpr & IVPR_ACTIVITY_MASK) | (val & mask);
518 
519     /*
520      * For FSL internal interrupts, The sense bit is reserved and zero,
521      * and the interrupt is always level-triggered.  Timers and IPIs
522      * have no sense or polarity bits, and are edge-triggered.
523      */
524     switch (opp->src[n_IRQ].type) {
525     case IRQ_TYPE_NORMAL:
526         opp->src[n_IRQ].level = !!(opp->src[n_IRQ].ivpr & IVPR_SENSE_MASK);
527         break;
528 
529     case IRQ_TYPE_FSLINT:
530         opp->src[n_IRQ].ivpr &= ~IVPR_SENSE_MASK;
531         break;
532 
533     case IRQ_TYPE_FSLSPECIAL:
534         opp->src[n_IRQ].ivpr &= ~(IVPR_POLARITY_MASK | IVPR_SENSE_MASK);
535         break;
536     }
537 
538     openpic_update_irq(opp, n_IRQ);
539     DPRINTF("Set IVPR %d to 0x%08x -> 0x%08x", n_IRQ, val,
540             opp->src[n_IRQ].ivpr);
541 }
542 
543 static void openpic_gcr_write(OpenPICState *opp, uint64_t val)
544 {
545     bool mpic_proxy = false;
546 
547     if (val & GCR_RESET) {
548         openpic_reset(DEVICE(opp));
549         return;
550     }
551 
552     opp->gcr &= ~opp->mpic_mode_mask;
553     opp->gcr |= val & opp->mpic_mode_mask;
554 
555     /* Set external proxy mode */
556     if ((val & opp->mpic_mode_mask) == GCR_MODE_PROXY) {
557         mpic_proxy = true;
558     }
559 
560     ppce500_set_mpic_proxy(mpic_proxy);
561 }
562 
563 static void openpic_gbl_write(void *opaque, hwaddr addr, uint64_t val,
564                               unsigned len)
565 {
566     OpenPICState *opp = opaque;
567     IRQDest *dst;
568     int idx;
569 
570     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64,
571             __func__, addr, val);
572     if (addr & 0xF) {
573         return;
574     }
575     switch (addr) {
576     case 0x00: /* Block Revision Register1 (BRR1) is Readonly */
577         break;
578     case 0x40:
579     case 0x50:
580     case 0x60:
581     case 0x70:
582     case 0x80:
583     case 0x90:
584     case 0xA0:
585     case 0xB0:
586         openpic_cpu_write_internal(opp, addr, val, get_current_cpu());
587         break;
588     case 0x1000: /* FRR */
589         break;
590     case 0x1020: /* GCR */
591         openpic_gcr_write(opp, val);
592         break;
593     case 0x1080: /* VIR */
594         break;
595     case 0x1090: /* PIR */
596         for (idx = 0; idx < opp->nb_cpus; idx++) {
597             if ((val & (1 << idx)) && !(opp->pir & (1 << idx))) {
598                 DPRINTF("Raise OpenPIC RESET output for CPU %d", idx);
599                 dst = &opp->dst[idx];
600                 qemu_irq_raise(dst->irqs[OPENPIC_OUTPUT_RESET]);
601             } else if (!(val & (1 << idx)) && (opp->pir & (1 << idx))) {
602                 DPRINTF("Lower OpenPIC RESET output for CPU %d", idx);
603                 dst = &opp->dst[idx];
604                 qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_RESET]);
605             }
606         }
607         opp->pir = val;
608         break;
609     case 0x10A0: /* IPI_IVPR */
610     case 0x10B0:
611     case 0x10C0:
612     case 0x10D0:
613         {
614             int idx;
615             idx = (addr - 0x10A0) >> 4;
616             write_IRQreg_ivpr(opp, opp->irq_ipi0 + idx, val);
617         }
618         break;
619     case 0x10E0: /* SPVE */
620         opp->spve = val & opp->vector_mask;
621         break;
622     default:
623         break;
624     }
625 }
626 
627 static uint64_t openpic_gbl_read(void *opaque, hwaddr addr, unsigned len)
628 {
629     OpenPICState *opp = opaque;
630     uint32_t retval;
631 
632     DPRINTF("%s: addr %#" HWADDR_PRIx, __func__, addr);
633     retval = 0xFFFFFFFF;
634     if (addr & 0xF) {
635         return retval;
636     }
637     switch (addr) {
638     case 0x1000: /* FRR */
639         retval = opp->frr;
640         break;
641     case 0x1020: /* GCR */
642         retval = opp->gcr;
643         break;
644     case 0x1080: /* VIR */
645         retval = opp->vir;
646         break;
647     case 0x1090: /* PIR */
648         retval = 0x00000000;
649         break;
650     case 0x00: /* Block Revision Register1 (BRR1) */
651         retval = opp->brr1;
652         break;
653     case 0x40:
654     case 0x50:
655     case 0x60:
656     case 0x70:
657     case 0x80:
658     case 0x90:
659     case 0xA0:
660     case 0xB0:
661         retval = openpic_cpu_read_internal(opp, addr, get_current_cpu());
662         break;
663     case 0x10A0: /* IPI_IVPR */
664     case 0x10B0:
665     case 0x10C0:
666     case 0x10D0:
667         {
668             int idx;
669             idx = (addr - 0x10A0) >> 4;
670             retval = read_IRQreg_ivpr(opp, opp->irq_ipi0 + idx);
671         }
672         break;
673     case 0x10E0: /* SPVE */
674         retval = opp->spve;
675         break;
676     default:
677         break;
678     }
679     DPRINTF("%s: => 0x%08x", __func__, retval);
680 
681     return retval;
682 }
683 
684 static void openpic_tmr_set_tmr(OpenPICTimer *tmr, uint32_t val, bool enabled);
685 
686 static void qemu_timer_cb(void *opaque)
687 {
688     OpenPICTimer *tmr = opaque;
689     OpenPICState *opp = tmr->opp;
690     uint32_t    n_IRQ = tmr->n_IRQ;
691     uint32_t val =   tmr->tbcr & ~TBCR_CI;
692     uint32_t tog = ((tmr->tccr & TCCR_TOG) ^ TCCR_TOG);  /* invert toggle. */
693 
694     DPRINTF("%s n_IRQ=%d", __func__, n_IRQ);
695     /* Reload current count from base count and setup timer. */
696     tmr->tccr = val | tog;
697     openpic_tmr_set_tmr(tmr, val, /*enabled=*/true);
698     /* Raise the interrupt. */
699     opp->src[n_IRQ].destmask = read_IRQreg_idr(opp, n_IRQ);
700     openpic_set_irq(opp, n_IRQ, 1);
701     openpic_set_irq(opp, n_IRQ, 0);
702 }
703 
704 /*
705  * If enabled is true, arranges for an interrupt to be raised val clocks into
706  * the future, if enabled is false cancels the timer.
707  */
708 static void openpic_tmr_set_tmr(OpenPICTimer *tmr, uint32_t val, bool enabled)
709 {
710     uint64_t ns = ticks_to_ns(val & ~TCCR_TOG);
711     /*
712      * A count of zero causes a timer to be set to expire immediately.  This
713      * effectively stops the simulation since the timer is constantly expiring
714      * which prevents guest code execution, so we don't honor that
715      * configuration.  On real hardware, this situation would generate an
716      * interrupt on every clock cycle if the interrupt was unmasked.
717      */
718     if ((ns == 0) || !enabled) {
719         tmr->qemu_timer_active = false;
720         tmr->tccr = tmr->tccr & TCCR_TOG;
721         timer_del(tmr->qemu_timer); /* set timer to never expire. */
722     } else {
723         tmr->qemu_timer_active = true;
724         uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
725         tmr->origin_time = now;
726         timer_mod(tmr->qemu_timer, now + ns);     /* set timer expiration. */
727     }
728 }
729 
730 /*
731  * Returns the current tccr value, i.e., timer value (in clocks) with
732  * appropriate TOG.
733  */
734 static uint64_t openpic_tmr_get_timer(OpenPICTimer *tmr)
735 {
736     uint64_t retval;
737     if (!tmr->qemu_timer_active) {
738         retval = tmr->tccr;
739     } else {
740         uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
741         uint64_t used = now - tmr->origin_time;  /* nsecs */
742         uint32_t used_ticks = (uint32_t)ns_to_ticks(used);
743         uint32_t count = (tmr->tccr & ~TCCR_TOG) - used_ticks;
744         retval = (uint32_t)((tmr->tccr & TCCR_TOG) | (count & ~TCCR_TOG));
745     }
746     return retval;
747 }
748 
749 static void openpic_tmr_write(void *opaque, hwaddr addr, uint64_t val,
750                               unsigned len)
751 {
752     OpenPICState *opp = opaque;
753     int idx;
754 
755     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64,
756             __func__, (addr + 0x10f0), val);
757     if (addr & 0xF) {
758         return;
759     }
760 
761     if (addr == 0) {
762         /* TFRR */
763         opp->tfrr = val;
764         return;
765     }
766     addr -= 0x10;  /* correct for TFRR */
767     idx = (addr >> 6) & 0x3;
768 
769     switch (addr & 0x30) {
770     case 0x00: /* TCCR */
771         break;
772     case 0x10: /* TBCR */
773         /* Did the enable status change? */
774         if ((opp->timers[idx].tbcr & TBCR_CI) != (val & TBCR_CI)) {
775             /* Did "Count Inhibit" transition from 1 to 0? */
776             if ((val & TBCR_CI) == 0) {
777                 opp->timers[idx].tccr = val & ~TCCR_TOG;
778             }
779             openpic_tmr_set_tmr(&opp->timers[idx],
780                                 (val & ~TBCR_CI),
781                                 /*enabled=*/((val & TBCR_CI) == 0));
782         }
783         opp->timers[idx].tbcr = val;
784         break;
785     case 0x20: /* TVPR */
786         write_IRQreg_ivpr(opp, opp->irq_tim0 + idx, val);
787         break;
788     case 0x30: /* TDR */
789         write_IRQreg_idr(opp, opp->irq_tim0 + idx, val);
790         break;
791     }
792 }
793 
794 static uint64_t openpic_tmr_read(void *opaque, hwaddr addr, unsigned len)
795 {
796     OpenPICState *opp = opaque;
797     uint32_t retval = -1;
798     int idx;
799 
800     DPRINTF("%s: addr %#" HWADDR_PRIx, __func__, addr + 0x10f0);
801     if (addr & 0xF) {
802         goto out;
803     }
804     if (addr == 0) {
805         /* TFRR */
806         retval = opp->tfrr;
807         goto out;
808     }
809     addr -= 0x10;  /* correct for TFRR */
810     idx = (addr >> 6) & 0x3;
811     switch (addr & 0x30) {
812     case 0x00: /* TCCR */
813         retval = openpic_tmr_get_timer(&opp->timers[idx]);
814         break;
815     case 0x10: /* TBCR */
816         retval = opp->timers[idx].tbcr;
817         break;
818     case 0x20: /* TVPR */
819         retval = read_IRQreg_ivpr(opp, opp->irq_tim0 + idx);
820         break;
821     case 0x30: /* TDR */
822         retval = read_IRQreg_idr(opp, opp->irq_tim0 + idx);
823         break;
824     }
825 
826 out:
827     DPRINTF("%s: => 0x%08x", __func__, retval);
828 
829     return retval;
830 }
831 
832 static void openpic_src_write(void *opaque, hwaddr addr, uint64_t val,
833                               unsigned len)
834 {
835     OpenPICState *opp = opaque;
836     int idx;
837 
838     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64,
839             __func__, addr, val);
840 
841     addr = addr & 0xffff;
842     idx = addr >> 5;
843 
844     switch (addr & 0x1f) {
845     case 0x00:
846         write_IRQreg_ivpr(opp, idx, val);
847         break;
848     case 0x10:
849         write_IRQreg_idr(opp, idx, val);
850         break;
851     case 0x18:
852         write_IRQreg_ilr(opp, idx, val);
853         break;
854     }
855 }
856 
857 static uint64_t openpic_src_read(void *opaque, uint64_t addr, unsigned len)
858 {
859     OpenPICState *opp = opaque;
860     uint32_t retval;
861     int idx;
862 
863     DPRINTF("%s: addr %#" HWADDR_PRIx, __func__, addr);
864     retval = 0xFFFFFFFF;
865 
866     addr = addr & 0xffff;
867     idx = addr >> 5;
868 
869     switch (addr & 0x1f) {
870     case 0x00:
871         retval = read_IRQreg_ivpr(opp, idx);
872         break;
873     case 0x10:
874         retval = read_IRQreg_idr(opp, idx);
875         break;
876     case 0x18:
877         retval = read_IRQreg_ilr(opp, idx);
878         break;
879     }
880 
881     DPRINTF("%s: => 0x%08x", __func__, retval);
882     return retval;
883 }
884 
885 static void openpic_msi_write(void *opaque, hwaddr addr, uint64_t val,
886                               unsigned size)
887 {
888     OpenPICState *opp = opaque;
889     int idx = opp->irq_msi;
890     int srs, ibs;
891 
892     DPRINTF("%s: addr %#" HWADDR_PRIx " <= 0x%08" PRIx64,
893             __func__, addr, val);
894     if (addr & 0xF) {
895         return;
896     }
897 
898     switch (addr) {
899     case MSIIR_OFFSET:
900         srs = val >> MSIIR_SRS_SHIFT;
901         idx += srs;
902         ibs = (val & MSIIR_IBS_MASK) >> MSIIR_IBS_SHIFT;
903         opp->msi[srs].msir |= 1 << ibs;
904         openpic_set_irq(opp, idx, 1);
905         break;
906     default:
907         /* most registers are read-only, thus ignored */
908         break;
909     }
910 }
911 
912 static uint64_t openpic_msi_read(void *opaque, hwaddr addr, unsigned size)
913 {
914     OpenPICState *opp = opaque;
915     uint64_t r = 0;
916     int i, srs;
917 
918     DPRINTF("%s: addr %#" HWADDR_PRIx, __func__, addr);
919     if (addr & 0xF) {
920         return -1;
921     }
922 
923     srs = addr >> 4;
924 
925     switch (addr) {
926     case 0x00:
927     case 0x10:
928     case 0x20:
929     case 0x30:
930     case 0x40:
931     case 0x50:
932     case 0x60:
933     case 0x70: /* MSIRs */
934         r = opp->msi[srs].msir;
935         /* Clear on read */
936         opp->msi[srs].msir = 0;
937         openpic_set_irq(opp, opp->irq_msi + srs, 0);
938         break;
939     case 0x120: /* MSISR */
940         for (i = 0; i < MAX_MSI; i++) {
941             r |= (opp->msi[i].msir ? 1 : 0) << i;
942         }
943         break;
944     }
945 
946     return r;
947 }
948 
949 static uint64_t openpic_summary_read(void *opaque, hwaddr addr, unsigned size)
950 {
951     uint64_t r = 0;
952 
953     DPRINTF("%s: addr %#" HWADDR_PRIx, __func__, addr);
954 
955     /* TODO: EISR/EIMR */
956 
957     return r;
958 }
959 
960 static void openpic_summary_write(void *opaque, hwaddr addr, uint64_t val,
961                                   unsigned size)
962 {
963     DPRINTF("%s: addr %#" HWADDR_PRIx " <= 0x%08" PRIx64,
964             __func__, addr, val);
965 
966     /* TODO: EISR/EIMR */
967 }
968 
969 static void openpic_cpu_write_internal(void *opaque, hwaddr addr,
970                                        uint32_t val, int idx)
971 {
972     OpenPICState *opp = opaque;
973     IRQSource *src;
974     IRQDest *dst;
975     int s_IRQ, n_IRQ;
976 
977     DPRINTF("%s: cpu %d addr %#" HWADDR_PRIx " <= 0x%08x", __func__, idx,
978             addr, val);
979 
980     if (idx < 0 || idx >= opp->nb_cpus) {
981         return;
982     }
983 
984     if (addr & 0xF) {
985         return;
986     }
987     dst = &opp->dst[idx];
988     addr &= 0xFF0;
989     switch (addr) {
990     case 0x40: /* IPIDR */
991     case 0x50:
992     case 0x60:
993     case 0x70:
994         idx = (addr - 0x40) >> 4;
995         /* we use IDE as mask which CPUs to deliver the IPI to still. */
996         opp->src[opp->irq_ipi0 + idx].destmask |= val;
997         openpic_set_irq(opp, opp->irq_ipi0 + idx, 1);
998         openpic_set_irq(opp, opp->irq_ipi0 + idx, 0);
999         break;
1000     case 0x80: /* CTPR */
1001         dst->ctpr = val & 0x0000000F;
1002 
1003         DPRINTF("%s: set CPU %d ctpr to %d, raised %d servicing %d",
1004                 __func__, idx, dst->ctpr, dst->raised.priority,
1005                 dst->servicing.priority);
1006 
1007         if (dst->raised.priority <= dst->ctpr) {
1008             DPRINTF("%s: Lower OpenPIC INT output cpu %d due to ctpr",
1009                     __func__, idx);
1010             qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_INT]);
1011         } else if (dst->raised.priority > dst->servicing.priority) {
1012             DPRINTF("%s: Raise OpenPIC INT output cpu %d irq %d",
1013                     __func__, idx, dst->raised.next);
1014             qemu_irq_raise(dst->irqs[OPENPIC_OUTPUT_INT]);
1015         }
1016 
1017         break;
1018     case 0x90: /* WHOAMI */
1019         /* Read-only register */
1020         break;
1021     case 0xA0: /* IACK */
1022         /* Read-only register */
1023         break;
1024     case 0xB0: /* EOI */
1025         DPRINTF("EOI");
1026         s_IRQ = IRQ_get_next(opp, &dst->servicing);
1027 
1028         if (s_IRQ < 0) {
1029             DPRINTF("%s: EOI with no interrupt in service", __func__);
1030             break;
1031         }
1032 
1033         IRQ_resetbit(&dst->servicing, s_IRQ);
1034         /* Set up next servicing IRQ */
1035         s_IRQ = IRQ_get_next(opp, &dst->servicing);
1036         /* Check queued interrupts. */
1037         n_IRQ = IRQ_get_next(opp, &dst->raised);
1038         src = &opp->src[n_IRQ];
1039         if (n_IRQ != -1 &&
1040             (s_IRQ == -1 ||
1041              IVPR_PRIORITY(src->ivpr) > dst->servicing.priority)) {
1042             DPRINTF("Raise OpenPIC INT output cpu %d irq %d",
1043                     idx, n_IRQ);
1044             qemu_irq_raise(opp->dst[idx].irqs[OPENPIC_OUTPUT_INT]);
1045         }
1046         break;
1047     default:
1048         break;
1049     }
1050 }
1051 
1052 static void openpic_cpu_write(void *opaque, hwaddr addr, uint64_t val,
1053                               unsigned len)
1054 {
1055     openpic_cpu_write_internal(opaque, addr, val, (addr & 0x1f000) >> 12);
1056 }
1057 
1058 
1059 static uint32_t openpic_iack(OpenPICState *opp, IRQDest *dst, int cpu)
1060 {
1061     IRQSource *src;
1062     int retval, irq;
1063 
1064     DPRINTF("Lower OpenPIC INT output");
1065     qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_INT]);
1066 
1067     irq = IRQ_get_next(opp, &dst->raised);
1068     DPRINTF("IACK: irq=%d", irq);
1069 
1070     if (irq == -1) {
1071         /* No more interrupt pending */
1072         return opp->spve;
1073     }
1074 
1075     src = &opp->src[irq];
1076     if (!(src->ivpr & IVPR_ACTIVITY_MASK) ||
1077             !(IVPR_PRIORITY(src->ivpr) > dst->ctpr)) {
1078         error_report("%s: bad raised IRQ %d ctpr %d ivpr 0x%08x",
1079                 __func__, irq, dst->ctpr, src->ivpr);
1080         openpic_update_irq(opp, irq);
1081         retval = opp->spve;
1082     } else {
1083         /* IRQ enter servicing state */
1084         IRQ_setbit(&dst->servicing, irq);
1085         retval = IVPR_VECTOR(opp, src->ivpr);
1086     }
1087 
1088     if (!src->level) {
1089         /* edge-sensitive IRQ */
1090         src->ivpr &= ~IVPR_ACTIVITY_MASK;
1091         src->pending = 0;
1092         IRQ_resetbit(&dst->raised, irq);
1093     }
1094 
1095     /* Timers and IPIs support multicast. */
1096     if (((irq >= opp->irq_ipi0) && (irq < (opp->irq_ipi0 + OPENPIC_MAX_IPI))) ||
1097         ((irq >= opp->irq_tim0) && (irq < (opp->irq_tim0 + OPENPIC_MAX_TMR)))) {
1098         DPRINTF("irq is IPI or TMR");
1099         src->destmask &= ~(1 << cpu);
1100         if (src->destmask && !src->level) {
1101             /* trigger on CPUs that didn't know about it yet */
1102             openpic_set_irq(opp, irq, 1);
1103             openpic_set_irq(opp, irq, 0);
1104             /* if all CPUs knew about it, set active bit again */
1105             src->ivpr |= IVPR_ACTIVITY_MASK;
1106         }
1107     }
1108 
1109     return retval;
1110 }
1111 
1112 static uint32_t openpic_cpu_read_internal(void *opaque, hwaddr addr,
1113                                           int idx)
1114 {
1115     OpenPICState *opp = opaque;
1116     IRQDest *dst;
1117     uint32_t retval;
1118 
1119     DPRINTF("%s: cpu %d addr %#" HWADDR_PRIx, __func__, idx, addr);
1120     retval = 0xFFFFFFFF;
1121 
1122     if (idx < 0 || idx >= opp->nb_cpus) {
1123         return retval;
1124     }
1125 
1126     if (addr & 0xF) {
1127         return retval;
1128     }
1129     dst = &opp->dst[idx];
1130     addr &= 0xFF0;
1131     switch (addr) {
1132     case 0x80: /* CTPR */
1133         retval = dst->ctpr;
1134         break;
1135     case 0x90: /* WHOAMI */
1136         retval = idx;
1137         break;
1138     case 0xA0: /* IACK */
1139         retval = openpic_iack(opp, dst, idx);
1140         break;
1141     case 0xB0: /* EOI */
1142         retval = 0;
1143         break;
1144     default:
1145         break;
1146     }
1147     DPRINTF("%s: => 0x%08x", __func__, retval);
1148 
1149     return retval;
1150 }
1151 
1152 static uint64_t openpic_cpu_read(void *opaque, hwaddr addr, unsigned len)
1153 {
1154     return openpic_cpu_read_internal(opaque, addr, (addr & 0x1f000) >> 12);
1155 }
1156 
1157 static const MemoryRegionOps openpic_glb_ops_le = {
1158     .write = openpic_gbl_write,
1159     .read  = openpic_gbl_read,
1160     .endianness = DEVICE_LITTLE_ENDIAN,
1161     .impl = {
1162         .min_access_size = 4,
1163         .max_access_size = 4,
1164     },
1165 };
1166 
1167 static const MemoryRegionOps openpic_glb_ops_be = {
1168     .write = openpic_gbl_write,
1169     .read  = openpic_gbl_read,
1170     .endianness = DEVICE_BIG_ENDIAN,
1171     .impl = {
1172         .min_access_size = 4,
1173         .max_access_size = 4,
1174     },
1175 };
1176 
1177 static const MemoryRegionOps openpic_tmr_ops_le = {
1178     .write = openpic_tmr_write,
1179     .read  = openpic_tmr_read,
1180     .endianness = DEVICE_LITTLE_ENDIAN,
1181     .impl = {
1182         .min_access_size = 4,
1183         .max_access_size = 4,
1184     },
1185 };
1186 
1187 static const MemoryRegionOps openpic_tmr_ops_be = {
1188     .write = openpic_tmr_write,
1189     .read  = openpic_tmr_read,
1190     .endianness = DEVICE_BIG_ENDIAN,
1191     .impl = {
1192         .min_access_size = 4,
1193         .max_access_size = 4,
1194     },
1195 };
1196 
1197 static const MemoryRegionOps openpic_cpu_ops_le = {
1198     .write = openpic_cpu_write,
1199     .read  = openpic_cpu_read,
1200     .endianness = DEVICE_LITTLE_ENDIAN,
1201     .impl = {
1202         .min_access_size = 4,
1203         .max_access_size = 4,
1204     },
1205 };
1206 
1207 static const MemoryRegionOps openpic_cpu_ops_be = {
1208     .write = openpic_cpu_write,
1209     .read  = openpic_cpu_read,
1210     .endianness = DEVICE_BIG_ENDIAN,
1211     .impl = {
1212         .min_access_size = 4,
1213         .max_access_size = 4,
1214     },
1215 };
1216 
1217 static const MemoryRegionOps openpic_src_ops_le = {
1218     .write = openpic_src_write,
1219     .read  = openpic_src_read,
1220     .endianness = DEVICE_LITTLE_ENDIAN,
1221     .impl = {
1222         .min_access_size = 4,
1223         .max_access_size = 4,
1224     },
1225 };
1226 
1227 static const MemoryRegionOps openpic_src_ops_be = {
1228     .write = openpic_src_write,
1229     .read  = openpic_src_read,
1230     .endianness = DEVICE_BIG_ENDIAN,
1231     .impl = {
1232         .min_access_size = 4,
1233         .max_access_size = 4,
1234     },
1235 };
1236 
1237 static const MemoryRegionOps openpic_msi_ops_be = {
1238     .read = openpic_msi_read,
1239     .write = openpic_msi_write,
1240     .endianness = DEVICE_BIG_ENDIAN,
1241     .impl = {
1242         .min_access_size = 4,
1243         .max_access_size = 4,
1244     },
1245 };
1246 
1247 static const MemoryRegionOps openpic_summary_ops_be = {
1248     .read = openpic_summary_read,
1249     .write = openpic_summary_write,
1250     .endianness = DEVICE_BIG_ENDIAN,
1251     .impl = {
1252         .min_access_size = 4,
1253         .max_access_size = 4,
1254     },
1255 };
1256 
1257 static void openpic_reset(DeviceState *d)
1258 {
1259     OpenPICState *opp = OPENPIC(d);
1260     int i;
1261 
1262     opp->gcr = GCR_RESET;
1263     /* Initialise controller registers */
1264     opp->frr = ((opp->nb_irqs - 1) << FRR_NIRQ_SHIFT) |
1265                ((opp->nb_cpus - 1) << FRR_NCPU_SHIFT) |
1266                (opp->vid << FRR_VID_SHIFT);
1267 
1268     opp->pir = 0;
1269     opp->spve = -1 & opp->vector_mask;
1270     opp->tfrr = opp->tfrr_reset;
1271     /* Initialise IRQ sources */
1272     for (i = 0; i < opp->max_irq; i++) {
1273         opp->src[i].ivpr = opp->ivpr_reset;
1274         switch (opp->src[i].type) {
1275         case IRQ_TYPE_NORMAL:
1276             opp->src[i].level = !!(opp->ivpr_reset & IVPR_SENSE_MASK);
1277             break;
1278 
1279         case IRQ_TYPE_FSLINT:
1280             opp->src[i].ivpr |= IVPR_POLARITY_MASK;
1281             break;
1282 
1283         case IRQ_TYPE_FSLSPECIAL:
1284             break;
1285         }
1286 
1287         /* Mask all IPI interrupts for Freescale OpenPIC */
1288         if ((opp->model == OPENPIC_MODEL_FSL_MPIC_20) ||
1289             (opp->model == OPENPIC_MODEL_FSL_MPIC_42)) {
1290             if (i >= opp->irq_ipi0 && i < opp->irq_tim0) {
1291                 write_IRQreg_idr(opp, i, 0);
1292                 continue;
1293             }
1294         }
1295 
1296         write_IRQreg_idr(opp, i, opp->idr_reset);
1297     }
1298     /* Initialise IRQ destinations */
1299     for (i = 0; i < opp->nb_cpus; i++) {
1300         opp->dst[i].ctpr      = 15;
1301         opp->dst[i].raised.next = -1;
1302         opp->dst[i].raised.priority = 0;
1303         bitmap_clear(opp->dst[i].raised.queue, 0, IRQQUEUE_SIZE_BITS);
1304         opp->dst[i].servicing.next = -1;
1305         opp->dst[i].servicing.priority = 0;
1306         bitmap_clear(opp->dst[i].servicing.queue, 0, IRQQUEUE_SIZE_BITS);
1307     }
1308     /* Initialise timers */
1309     for (i = 0; i < OPENPIC_MAX_TMR; i++) {
1310         opp->timers[i].tccr = 0;
1311         opp->timers[i].tbcr = TBCR_CI;
1312         if (opp->timers[i].qemu_timer_active) {
1313             timer_del(opp->timers[i].qemu_timer);  /* Inhibit timer */
1314             opp->timers[i].qemu_timer_active = false;
1315         }
1316     }
1317     /* Go out of RESET state */
1318     opp->gcr = 0;
1319 }
1320 
1321 typedef struct MemReg {
1322     const char             *name;
1323     MemoryRegionOps const  *ops;
1324     hwaddr                  start_addr;
1325     ram_addr_t              size;
1326 } MemReg;
1327 
1328 static void fsl_common_init(OpenPICState *opp)
1329 {
1330     int i;
1331     int virq = OPENPIC_MAX_SRC;
1332 
1333     opp->vid = VID_REVISION_1_2;
1334     opp->vir = VIR_GENERIC;
1335     opp->vector_mask = 0xFFFF;
1336     opp->tfrr_reset = 0;
1337     opp->ivpr_reset = IVPR_MASK_MASK;
1338     opp->idr_reset = 1 << 0;
1339     opp->max_irq = OPENPIC_MAX_IRQ;
1340 
1341     opp->irq_ipi0 = virq;
1342     virq += OPENPIC_MAX_IPI;
1343     opp->irq_tim0 = virq;
1344     virq += OPENPIC_MAX_TMR;
1345 
1346     assert(virq <= OPENPIC_MAX_IRQ);
1347 
1348     opp->irq_msi = 224;
1349 
1350     msi_nonbroken = true;
1351     for (i = 0; i < opp->fsl->max_ext; i++) {
1352         opp->src[i].level = false;
1353     }
1354 
1355     /* Internal interrupts, including message and MSI */
1356     for (i = 16; i < OPENPIC_MAX_SRC; i++) {
1357         opp->src[i].type = IRQ_TYPE_FSLINT;
1358         opp->src[i].level = true;
1359     }
1360 
1361     /* timers and IPIs */
1362     for (i = OPENPIC_MAX_SRC; i < virq; i++) {
1363         opp->src[i].type = IRQ_TYPE_FSLSPECIAL;
1364         opp->src[i].level = false;
1365     }
1366 
1367     for (i = 0; i < OPENPIC_MAX_TMR; i++) {
1368         opp->timers[i].n_IRQ = opp->irq_tim0 + i;
1369         opp->timers[i].qemu_timer_active = false;
1370         opp->timers[i].qemu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
1371                                                  &qemu_timer_cb,
1372                                                  &opp->timers[i]);
1373         opp->timers[i].opp = opp;
1374     }
1375 }
1376 
1377 static void map_list(OpenPICState *opp, const MemReg *list, int *count)
1378 {
1379     while (list->name) {
1380         assert(*count < ARRAY_SIZE(opp->sub_io_mem));
1381 
1382         memory_region_init_io(&opp->sub_io_mem[*count], OBJECT(opp), list->ops,
1383                               opp, list->name, list->size);
1384 
1385         memory_region_add_subregion(&opp->mem, list->start_addr,
1386                                     &opp->sub_io_mem[*count]);
1387 
1388         (*count)++;
1389         list++;
1390     }
1391 }
1392 
1393 static const VMStateDescription vmstate_openpic_irq_queue = {
1394     .name = "openpic_irq_queue",
1395     .version_id = 0,
1396     .minimum_version_id = 0,
1397     .fields = (VMStateField[]) {
1398         VMSTATE_BITMAP(queue, IRQQueue, 0, queue_size),
1399         VMSTATE_INT32(next, IRQQueue),
1400         VMSTATE_INT32(priority, IRQQueue),
1401         VMSTATE_END_OF_LIST()
1402     }
1403 };
1404 
1405 static const VMStateDescription vmstate_openpic_irqdest = {
1406     .name = "openpic_irqdest",
1407     .version_id = 0,
1408     .minimum_version_id = 0,
1409     .fields = (VMStateField[]) {
1410         VMSTATE_INT32(ctpr, IRQDest),
1411         VMSTATE_STRUCT(raised, IRQDest, 0, vmstate_openpic_irq_queue,
1412                        IRQQueue),
1413         VMSTATE_STRUCT(servicing, IRQDest, 0, vmstate_openpic_irq_queue,
1414                        IRQQueue),
1415         VMSTATE_UINT32_ARRAY(outputs_active, IRQDest, OPENPIC_OUTPUT_NB),
1416         VMSTATE_END_OF_LIST()
1417     }
1418 };
1419 
1420 static const VMStateDescription vmstate_openpic_irqsource = {
1421     .name = "openpic_irqsource",
1422     .version_id = 0,
1423     .minimum_version_id = 0,
1424     .fields = (VMStateField[]) {
1425         VMSTATE_UINT32(ivpr, IRQSource),
1426         VMSTATE_UINT32(idr, IRQSource),
1427         VMSTATE_UINT32(destmask, IRQSource),
1428         VMSTATE_INT32(last_cpu, IRQSource),
1429         VMSTATE_INT32(pending, IRQSource),
1430         VMSTATE_END_OF_LIST()
1431     }
1432 };
1433 
1434 static const VMStateDescription vmstate_openpic_timer = {
1435     .name = "openpic_timer",
1436     .version_id = 0,
1437     .minimum_version_id = 0,
1438     .fields = (VMStateField[]) {
1439         VMSTATE_UINT32(tccr, OpenPICTimer),
1440         VMSTATE_UINT32(tbcr, OpenPICTimer),
1441         VMSTATE_END_OF_LIST()
1442     }
1443 };
1444 
1445 static const VMStateDescription vmstate_openpic_msi = {
1446     .name = "openpic_msi",
1447     .version_id = 0,
1448     .minimum_version_id = 0,
1449     .fields = (VMStateField[]) {
1450         VMSTATE_UINT32(msir, OpenPICMSI),
1451         VMSTATE_END_OF_LIST()
1452     }
1453 };
1454 
1455 static int openpic_post_load(void *opaque, int version_id)
1456 {
1457     OpenPICState *opp = (OpenPICState *)opaque;
1458     int i;
1459 
1460     /* Update internal ivpr and idr variables */
1461     for (i = 0; i < opp->max_irq; i++) {
1462         write_IRQreg_idr(opp, i, opp->src[i].idr);
1463         write_IRQreg_ivpr(opp, i, opp->src[i].ivpr);
1464     }
1465 
1466     return 0;
1467 }
1468 
1469 static const VMStateDescription vmstate_openpic = {
1470     .name = "openpic",
1471     .version_id = 3,
1472     .minimum_version_id = 3,
1473     .post_load = openpic_post_load,
1474     .fields = (VMStateField[]) {
1475         VMSTATE_UINT32(gcr, OpenPICState),
1476         VMSTATE_UINT32(vir, OpenPICState),
1477         VMSTATE_UINT32(pir, OpenPICState),
1478         VMSTATE_UINT32(spve, OpenPICState),
1479         VMSTATE_UINT32(tfrr, OpenPICState),
1480         VMSTATE_UINT32(max_irq, OpenPICState),
1481         VMSTATE_STRUCT_VARRAY_UINT32(src, OpenPICState, max_irq, 0,
1482                                      vmstate_openpic_irqsource, IRQSource),
1483         VMSTATE_UINT32_EQUAL(nb_cpus, OpenPICState, NULL),
1484         VMSTATE_STRUCT_VARRAY_UINT32(dst, OpenPICState, nb_cpus, 0,
1485                                      vmstate_openpic_irqdest, IRQDest),
1486         VMSTATE_STRUCT_ARRAY(timers, OpenPICState, OPENPIC_MAX_TMR, 0,
1487                              vmstate_openpic_timer, OpenPICTimer),
1488         VMSTATE_STRUCT_ARRAY(msi, OpenPICState, MAX_MSI, 0,
1489                              vmstate_openpic_msi, OpenPICMSI),
1490         VMSTATE_UINT32(irq_ipi0, OpenPICState),
1491         VMSTATE_UINT32(irq_tim0, OpenPICState),
1492         VMSTATE_UINT32(irq_msi, OpenPICState),
1493         VMSTATE_END_OF_LIST()
1494     }
1495 };
1496 
1497 static void openpic_init(Object *obj)
1498 {
1499     OpenPICState *opp = OPENPIC(obj);
1500 
1501     memory_region_init(&opp->mem, obj, "openpic", 0x40000);
1502 }
1503 
1504 static void openpic_realize(DeviceState *dev, Error **errp)
1505 {
1506     SysBusDevice *d = SYS_BUS_DEVICE(dev);
1507     OpenPICState *opp = OPENPIC(dev);
1508     int i, j;
1509     int list_count = 0;
1510     static const MemReg list_le[] = {
1511         {"glb", &openpic_glb_ops_le,
1512                 OPENPIC_GLB_REG_START, OPENPIC_GLB_REG_SIZE},
1513         {"tmr", &openpic_tmr_ops_le,
1514                 OPENPIC_TMR_REG_START, OPENPIC_TMR_REG_SIZE},
1515         {"src", &openpic_src_ops_le,
1516                 OPENPIC_SRC_REG_START, OPENPIC_SRC_REG_SIZE},
1517         {"cpu", &openpic_cpu_ops_le,
1518                 OPENPIC_CPU_REG_START, OPENPIC_CPU_REG_SIZE},
1519         {NULL}
1520     };
1521     static const MemReg list_be[] = {
1522         {"glb", &openpic_glb_ops_be,
1523                 OPENPIC_GLB_REG_START, OPENPIC_GLB_REG_SIZE},
1524         {"tmr", &openpic_tmr_ops_be,
1525                 OPENPIC_TMR_REG_START, OPENPIC_TMR_REG_SIZE},
1526         {"src", &openpic_src_ops_be,
1527                 OPENPIC_SRC_REG_START, OPENPIC_SRC_REG_SIZE},
1528         {"cpu", &openpic_cpu_ops_be,
1529                 OPENPIC_CPU_REG_START, OPENPIC_CPU_REG_SIZE},
1530         {NULL}
1531     };
1532     static const MemReg list_fsl[] = {
1533         {"msi", &openpic_msi_ops_be,
1534                 OPENPIC_MSI_REG_START, OPENPIC_MSI_REG_SIZE},
1535         {"summary", &openpic_summary_ops_be,
1536                 OPENPIC_SUMMARY_REG_START, OPENPIC_SUMMARY_REG_SIZE},
1537         {NULL}
1538     };
1539 
1540     if (opp->nb_cpus > MAX_CPU) {
1541         error_setg(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE,
1542                    TYPE_OPENPIC, "nb_cpus", (uint64_t)opp->nb_cpus,
1543                    (uint64_t)0, (uint64_t)MAX_CPU);
1544         return;
1545     }
1546 
1547     switch (opp->model) {
1548     case OPENPIC_MODEL_FSL_MPIC_20:
1549     default:
1550         opp->fsl = &fsl_mpic_20;
1551         opp->brr1 = 0x00400200;
1552         opp->flags |= OPENPIC_FLAG_IDR_CRIT;
1553         opp->nb_irqs = 80;
1554         opp->mpic_mode_mask = GCR_MODE_MIXED;
1555 
1556         fsl_common_init(opp);
1557         map_list(opp, list_be, &list_count);
1558         map_list(opp, list_fsl, &list_count);
1559 
1560         break;
1561 
1562     case OPENPIC_MODEL_FSL_MPIC_42:
1563         opp->fsl = &fsl_mpic_42;
1564         opp->brr1 = 0x00400402;
1565         opp->flags |= OPENPIC_FLAG_ILR;
1566         opp->nb_irqs = 196;
1567         opp->mpic_mode_mask = GCR_MODE_PROXY;
1568 
1569         fsl_common_init(opp);
1570         map_list(opp, list_be, &list_count);
1571         map_list(opp, list_fsl, &list_count);
1572 
1573         break;
1574 
1575     case OPENPIC_MODEL_KEYLARGO:
1576         opp->nb_irqs = KEYLARGO_MAX_EXT;
1577         opp->vid = VID_REVISION_1_2;
1578         opp->vir = VIR_GENERIC;
1579         opp->vector_mask = 0xFF;
1580         opp->tfrr_reset = 4160000;
1581         opp->ivpr_reset = IVPR_MASK_MASK | IVPR_MODE_MASK;
1582         opp->idr_reset = 0;
1583         opp->max_irq = KEYLARGO_MAX_IRQ;
1584         opp->irq_ipi0 = KEYLARGO_IPI_IRQ;
1585         opp->irq_tim0 = KEYLARGO_TMR_IRQ;
1586         opp->brr1 = -1;
1587         opp->mpic_mode_mask = GCR_MODE_MIXED;
1588 
1589         if (opp->nb_cpus != 1) {
1590             error_setg(errp, "Only UP supported today");
1591             return;
1592         }
1593 
1594         map_list(opp, list_le, &list_count);
1595         break;
1596     }
1597 
1598     for (i = 0; i < opp->nb_cpus; i++) {
1599         opp->dst[i].irqs = g_new0(qemu_irq, OPENPIC_OUTPUT_NB);
1600         for (j = 0; j < OPENPIC_OUTPUT_NB; j++) {
1601             sysbus_init_irq(d, &opp->dst[i].irqs[j]);
1602         }
1603 
1604         opp->dst[i].raised.queue_size = IRQQUEUE_SIZE_BITS;
1605         opp->dst[i].raised.queue = bitmap_new(IRQQUEUE_SIZE_BITS);
1606         opp->dst[i].servicing.queue_size = IRQQUEUE_SIZE_BITS;
1607         opp->dst[i].servicing.queue = bitmap_new(IRQQUEUE_SIZE_BITS);
1608     }
1609 
1610     sysbus_init_mmio(d, &opp->mem);
1611     qdev_init_gpio_in(dev, openpic_set_irq, opp->max_irq);
1612 }
1613 
1614 static Property openpic_properties[] = {
1615     DEFINE_PROP_UINT32("model", OpenPICState, model, OPENPIC_MODEL_FSL_MPIC_20),
1616     DEFINE_PROP_UINT32("nb_cpus", OpenPICState, nb_cpus, 1),
1617     DEFINE_PROP_END_OF_LIST(),
1618 };
1619 
1620 static void openpic_class_init(ObjectClass *oc, void *data)
1621 {
1622     DeviceClass *dc = DEVICE_CLASS(oc);
1623 
1624     dc->realize = openpic_realize;
1625     device_class_set_props(dc, openpic_properties);
1626     dc->reset = openpic_reset;
1627     dc->vmsd = &vmstate_openpic;
1628     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
1629 }
1630 
1631 static const TypeInfo openpic_info = {
1632     .name          = TYPE_OPENPIC,
1633     .parent        = TYPE_SYS_BUS_DEVICE,
1634     .instance_size = sizeof(OpenPICState),
1635     .instance_init = openpic_init,
1636     .class_init    = openpic_class_init,
1637 };
1638 
1639 static void openpic_register_types(void)
1640 {
1641     type_register_static(&openpic_info);
1642 }
1643 
1644 type_init(openpic_register_types)
1645