xref: /openbmc/qemu/hw/intc/openpic.c (revision fee5b753)
1 /*
2  * OpenPIC emulation
3  *
4  * Copyright (c) 2004 Jocelyn Mayer
5  *               2011 Alexander Graf
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 /*
26  *
27  * Based on OpenPic implementations:
28  * - Intel GW80314 I/O companion chip developer's manual
29  * - Motorola MPC8245 & MPC8540 user manuals.
30  * - Motorola MCP750 (aka Raven) programmer manual.
31  * - Motorola Harrier programmer manuel
32  *
33  * Serial interrupts, as implemented in Raven chipset are not supported yet.
34  *
35  */
36 #include "qemu/osdep.h"
37 #include "hw/hw.h"
38 #include "hw/ppc/mac.h"
39 #include "hw/pci/pci.h"
40 #include "hw/ppc/openpic.h"
41 #include "hw/ppc/ppc_e500.h"
42 #include "hw/sysbus.h"
43 #include "hw/pci/msi.h"
44 #include "qemu/bitops.h"
45 #include "qapi/qmp/qerror.h"
46 
47 //#define DEBUG_OPENPIC
48 
49 #ifdef DEBUG_OPENPIC
50 static const int debug_openpic = 1;
51 #else
52 static const int debug_openpic = 0;
53 #endif
54 
55 #define DPRINTF(fmt, ...) do { \
56         if (debug_openpic) { \
57             printf(fmt , ## __VA_ARGS__); \
58         } \
59     } while (0)
60 
61 #define MAX_CPU     32
62 #define MAX_MSI     8
63 #define VID         0x03 /* MPIC version ID */
64 
65 /* OpenPIC capability flags */
66 #define OPENPIC_FLAG_IDR_CRIT     (1 << 0)
67 #define OPENPIC_FLAG_ILR          (2 << 0)
68 
69 /* OpenPIC address map */
70 #define OPENPIC_GLB_REG_START        0x0
71 #define OPENPIC_GLB_REG_SIZE         0x10F0
72 #define OPENPIC_TMR_REG_START        0x10F0
73 #define OPENPIC_TMR_REG_SIZE         0x220
74 #define OPENPIC_MSI_REG_START        0x1600
75 #define OPENPIC_MSI_REG_SIZE         0x200
76 #define OPENPIC_SUMMARY_REG_START   0x3800
77 #define OPENPIC_SUMMARY_REG_SIZE    0x800
78 #define OPENPIC_SRC_REG_START        0x10000
79 #define OPENPIC_SRC_REG_SIZE         (OPENPIC_MAX_SRC * 0x20)
80 #define OPENPIC_CPU_REG_START        0x20000
81 #define OPENPIC_CPU_REG_SIZE         0x100 + ((MAX_CPU - 1) * 0x1000)
82 
83 /* Raven */
84 #define RAVEN_MAX_CPU      2
85 #define RAVEN_MAX_EXT     48
86 #define RAVEN_MAX_IRQ     64
87 #define RAVEN_MAX_TMR      OPENPIC_MAX_TMR
88 #define RAVEN_MAX_IPI      OPENPIC_MAX_IPI
89 
90 /* Interrupt definitions */
91 #define RAVEN_FE_IRQ     (RAVEN_MAX_EXT)     /* Internal functional IRQ */
92 #define RAVEN_ERR_IRQ    (RAVEN_MAX_EXT + 1) /* Error IRQ */
93 #define RAVEN_TMR_IRQ    (RAVEN_MAX_EXT + 2) /* First timer IRQ */
94 #define RAVEN_IPI_IRQ    (RAVEN_TMR_IRQ + RAVEN_MAX_TMR) /* First IPI IRQ */
95 /* First doorbell IRQ */
96 #define RAVEN_DBL_IRQ    (RAVEN_IPI_IRQ + (RAVEN_MAX_CPU * RAVEN_MAX_IPI))
97 
98 typedef struct FslMpicInfo {
99     int max_ext;
100 } FslMpicInfo;
101 
102 static FslMpicInfo fsl_mpic_20 = {
103     .max_ext = 12,
104 };
105 
106 static FslMpicInfo fsl_mpic_42 = {
107     .max_ext = 12,
108 };
109 
110 #define FRR_NIRQ_SHIFT    16
111 #define FRR_NCPU_SHIFT     8
112 #define FRR_VID_SHIFT      0
113 
114 #define VID_REVISION_1_2   2
115 #define VID_REVISION_1_3   3
116 
117 #define VIR_GENERIC      0x00000000 /* Generic Vendor ID */
118 
119 #define GCR_RESET        0x80000000
120 #define GCR_MODE_PASS    0x00000000
121 #define GCR_MODE_MIXED   0x20000000
122 #define GCR_MODE_PROXY   0x60000000
123 
124 #define TBCR_CI           0x80000000 /* count inhibit */
125 #define TCCR_TOG          0x80000000 /* toggles when decrement to zero */
126 
127 #define IDR_EP_SHIFT      31
128 #define IDR_EP_MASK       (1U << IDR_EP_SHIFT)
129 #define IDR_CI0_SHIFT     30
130 #define IDR_CI1_SHIFT     29
131 #define IDR_P1_SHIFT      1
132 #define IDR_P0_SHIFT      0
133 
134 #define ILR_INTTGT_MASK   0x000000ff
135 #define ILR_INTTGT_INT    0x00
136 #define ILR_INTTGT_CINT   0x01 /* critical */
137 #define ILR_INTTGT_MCP    0x02 /* machine check */
138 
139 /* The currently supported INTTGT values happen to be the same as QEMU's
140  * openpic output codes, but don't depend on this.  The output codes
141  * could change (unlikely, but...) or support could be added for
142  * more INTTGT values.
143  */
144 static const int inttgt_output[][2] = {
145     { ILR_INTTGT_INT, OPENPIC_OUTPUT_INT },
146     { ILR_INTTGT_CINT, OPENPIC_OUTPUT_CINT },
147     { ILR_INTTGT_MCP, OPENPIC_OUTPUT_MCK },
148 };
149 
150 static int inttgt_to_output(int inttgt)
151 {
152     int i;
153 
154     for (i = 0; i < ARRAY_SIZE(inttgt_output); i++) {
155         if (inttgt_output[i][0] == inttgt) {
156             return inttgt_output[i][1];
157         }
158     }
159 
160     fprintf(stderr, "%s: unsupported inttgt %d\n", __func__, inttgt);
161     return OPENPIC_OUTPUT_INT;
162 }
163 
164 static int output_to_inttgt(int output)
165 {
166     int i;
167 
168     for (i = 0; i < ARRAY_SIZE(inttgt_output); i++) {
169         if (inttgt_output[i][1] == output) {
170             return inttgt_output[i][0];
171         }
172     }
173 
174     abort();
175 }
176 
177 #define MSIIR_OFFSET       0x140
178 #define MSIIR_SRS_SHIFT    29
179 #define MSIIR_SRS_MASK     (0x7 << MSIIR_SRS_SHIFT)
180 #define MSIIR_IBS_SHIFT    24
181 #define MSIIR_IBS_MASK     (0x1f << MSIIR_IBS_SHIFT)
182 
183 static int get_current_cpu(void)
184 {
185     if (!current_cpu) {
186         return -1;
187     }
188 
189     return current_cpu->cpu_index;
190 }
191 
192 static uint32_t openpic_cpu_read_internal(void *opaque, hwaddr addr,
193                                           int idx);
194 static void openpic_cpu_write_internal(void *opaque, hwaddr addr,
195                                        uint32_t val, int idx);
196 static void openpic_reset(DeviceState *d);
197 
198 typedef enum IRQType {
199     IRQ_TYPE_NORMAL = 0,
200     IRQ_TYPE_FSLINT,        /* FSL internal interrupt -- level only */
201     IRQ_TYPE_FSLSPECIAL,    /* FSL timer/IPI interrupt, edge, no polarity */
202 } IRQType;
203 
204 /* Round up to the nearest 64 IRQs so that the queue length
205  * won't change when moving between 32 and 64 bit hosts.
206  */
207 #define IRQQUEUE_SIZE_BITS ((OPENPIC_MAX_IRQ + 63) & ~63)
208 
209 typedef struct IRQQueue {
210     unsigned long *queue;
211     int32_t queue_size; /* Only used for VMSTATE_BITMAP */
212     int next;
213     int priority;
214 } IRQQueue;
215 
216 typedef struct IRQSource {
217     uint32_t ivpr;  /* IRQ vector/priority register */
218     uint32_t idr;   /* IRQ destination register */
219     uint32_t destmask; /* bitmap of CPU destinations */
220     int last_cpu;
221     int output;     /* IRQ level, e.g. OPENPIC_OUTPUT_INT */
222     int pending;    /* TRUE if IRQ is pending */
223     IRQType type;
224     bool level:1;   /* level-triggered */
225     bool nomask:1;  /* critical interrupts ignore mask on some FSL MPICs */
226 } IRQSource;
227 
228 #define IVPR_MASK_SHIFT       31
229 #define IVPR_MASK_MASK        (1U << IVPR_MASK_SHIFT)
230 #define IVPR_ACTIVITY_SHIFT   30
231 #define IVPR_ACTIVITY_MASK    (1U << IVPR_ACTIVITY_SHIFT)
232 #define IVPR_MODE_SHIFT       29
233 #define IVPR_MODE_MASK        (1U << IVPR_MODE_SHIFT)
234 #define IVPR_POLARITY_SHIFT   23
235 #define IVPR_POLARITY_MASK    (1U << IVPR_POLARITY_SHIFT)
236 #define IVPR_SENSE_SHIFT      22
237 #define IVPR_SENSE_MASK       (1U << IVPR_SENSE_SHIFT)
238 
239 #define IVPR_PRIORITY_MASK     (0xFU << 16)
240 #define IVPR_PRIORITY(_ivprr_) ((int)(((_ivprr_) & IVPR_PRIORITY_MASK) >> 16))
241 #define IVPR_VECTOR(opp, _ivprr_) ((_ivprr_) & (opp)->vector_mask)
242 
243 /* IDR[EP/CI] are only for FSL MPIC prior to v4.0 */
244 #define IDR_EP      0x80000000  /* external pin */
245 #define IDR_CI      0x40000000  /* critical interrupt */
246 
247 typedef struct OpenPICTimer {
248     uint32_t tccr;  /* Global timer current count register */
249     uint32_t tbcr;  /* Global timer base count register */
250 } OpenPICTimer;
251 
252 typedef struct OpenPICMSI {
253     uint32_t msir;   /* Shared Message Signaled Interrupt Register */
254 } OpenPICMSI;
255 
256 typedef struct IRQDest {
257     int32_t ctpr; /* CPU current task priority */
258     IRQQueue raised;
259     IRQQueue servicing;
260     qemu_irq *irqs;
261 
262     /* Count of IRQ sources asserting on non-INT outputs */
263     uint32_t outputs_active[OPENPIC_OUTPUT_NB];
264 } IRQDest;
265 
266 #define OPENPIC(obj) OBJECT_CHECK(OpenPICState, (obj), TYPE_OPENPIC)
267 
268 typedef struct OpenPICState {
269     /*< private >*/
270     SysBusDevice parent_obj;
271     /*< public >*/
272 
273     MemoryRegion mem;
274 
275     /* Behavior control */
276     FslMpicInfo *fsl;
277     uint32_t model;
278     uint32_t flags;
279     uint32_t nb_irqs;
280     uint32_t vid;
281     uint32_t vir; /* Vendor identification register */
282     uint32_t vector_mask;
283     uint32_t tfrr_reset;
284     uint32_t ivpr_reset;
285     uint32_t idr_reset;
286     uint32_t brr1;
287     uint32_t mpic_mode_mask;
288 
289     /* Sub-regions */
290     MemoryRegion sub_io_mem[6];
291 
292     /* Global registers */
293     uint32_t frr; /* Feature reporting register */
294     uint32_t gcr; /* Global configuration register  */
295     uint32_t pir; /* Processor initialization register */
296     uint32_t spve; /* Spurious vector register */
297     uint32_t tfrr; /* Timer frequency reporting register */
298     /* Source registers */
299     IRQSource src[OPENPIC_MAX_IRQ];
300     /* Local registers per output pin */
301     IRQDest dst[MAX_CPU];
302     uint32_t nb_cpus;
303     /* Timer registers */
304     OpenPICTimer timers[OPENPIC_MAX_TMR];
305     /* Shared MSI registers */
306     OpenPICMSI msi[MAX_MSI];
307     uint32_t max_irq;
308     uint32_t irq_ipi0;
309     uint32_t irq_tim0;
310     uint32_t irq_msi;
311 } OpenPICState;
312 
313 static inline void IRQ_setbit(IRQQueue *q, int n_IRQ)
314 {
315     set_bit(n_IRQ, q->queue);
316 }
317 
318 static inline void IRQ_resetbit(IRQQueue *q, int n_IRQ)
319 {
320     clear_bit(n_IRQ, q->queue);
321 }
322 
323 static void IRQ_check(OpenPICState *opp, IRQQueue *q)
324 {
325     int irq = -1;
326     int next = -1;
327     int priority = -1;
328 
329     for (;;) {
330         irq = find_next_bit(q->queue, opp->max_irq, irq + 1);
331         if (irq == opp->max_irq) {
332             break;
333         }
334 
335         DPRINTF("IRQ_check: irq %d set ivpr_pr=%d pr=%d\n",
336                 irq, IVPR_PRIORITY(opp->src[irq].ivpr), priority);
337 
338         if (IVPR_PRIORITY(opp->src[irq].ivpr) > priority) {
339             next = irq;
340             priority = IVPR_PRIORITY(opp->src[irq].ivpr);
341         }
342     }
343 
344     q->next = next;
345     q->priority = priority;
346 }
347 
348 static int IRQ_get_next(OpenPICState *opp, IRQQueue *q)
349 {
350     /* XXX: optimize */
351     IRQ_check(opp, q);
352 
353     return q->next;
354 }
355 
356 static void IRQ_local_pipe(OpenPICState *opp, int n_CPU, int n_IRQ,
357                            bool active, bool was_active)
358 {
359     IRQDest *dst;
360     IRQSource *src;
361     int priority;
362 
363     dst = &opp->dst[n_CPU];
364     src = &opp->src[n_IRQ];
365 
366     DPRINTF("%s: IRQ %d active %d was %d\n",
367             __func__, n_IRQ, active, was_active);
368 
369     if (src->output != OPENPIC_OUTPUT_INT) {
370         DPRINTF("%s: output %d irq %d active %d was %d count %d\n",
371                 __func__, src->output, n_IRQ, active, was_active,
372                 dst->outputs_active[src->output]);
373 
374         /* On Freescale MPIC, critical interrupts ignore priority,
375          * IACK, EOI, etc.  Before MPIC v4.1 they also ignore
376          * masking.
377          */
378         if (active) {
379             if (!was_active && dst->outputs_active[src->output]++ == 0) {
380                 DPRINTF("%s: Raise OpenPIC output %d cpu %d irq %d\n",
381                         __func__, src->output, n_CPU, n_IRQ);
382                 qemu_irq_raise(dst->irqs[src->output]);
383             }
384         } else {
385             if (was_active && --dst->outputs_active[src->output] == 0) {
386                 DPRINTF("%s: Lower OpenPIC output %d cpu %d irq %d\n",
387                         __func__, src->output, n_CPU, n_IRQ);
388                 qemu_irq_lower(dst->irqs[src->output]);
389             }
390         }
391 
392         return;
393     }
394 
395     priority = IVPR_PRIORITY(src->ivpr);
396 
397     /* Even if the interrupt doesn't have enough priority,
398      * it is still raised, in case ctpr is lowered later.
399      */
400     if (active) {
401         IRQ_setbit(&dst->raised, n_IRQ);
402     } else {
403         IRQ_resetbit(&dst->raised, n_IRQ);
404     }
405 
406     IRQ_check(opp, &dst->raised);
407 
408     if (active && priority <= dst->ctpr) {
409         DPRINTF("%s: IRQ %d priority %d too low for ctpr %d on CPU %d\n",
410                 __func__, n_IRQ, priority, dst->ctpr, n_CPU);
411         active = 0;
412     }
413 
414     if (active) {
415         if (IRQ_get_next(opp, &dst->servicing) >= 0 &&
416                 priority <= dst->servicing.priority) {
417             DPRINTF("%s: IRQ %d is hidden by servicing IRQ %d on CPU %d\n",
418                     __func__, n_IRQ, dst->servicing.next, n_CPU);
419         } else {
420             DPRINTF("%s: Raise OpenPIC INT output cpu %d irq %d/%d\n",
421                     __func__, n_CPU, n_IRQ, dst->raised.next);
422             qemu_irq_raise(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);
423         }
424     } else {
425         IRQ_get_next(opp, &dst->servicing);
426         if (dst->raised.priority > dst->ctpr &&
427                 dst->raised.priority > dst->servicing.priority) {
428             DPRINTF("%s: IRQ %d inactive, IRQ %d prio %d above %d/%d, CPU %d\n",
429                     __func__, n_IRQ, dst->raised.next, dst->raised.priority,
430                     dst->ctpr, dst->servicing.priority, n_CPU);
431             /* IRQ line stays asserted */
432         } else {
433             DPRINTF("%s: IRQ %d inactive, current prio %d/%d, CPU %d\n",
434                     __func__, n_IRQ, dst->ctpr, dst->servicing.priority, n_CPU);
435             qemu_irq_lower(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);
436         }
437     }
438 }
439 
440 /* update pic state because registers for n_IRQ have changed value */
441 static void openpic_update_irq(OpenPICState *opp, int n_IRQ)
442 {
443     IRQSource *src;
444     bool active, was_active;
445     int i;
446 
447     src = &opp->src[n_IRQ];
448     active = src->pending;
449 
450     if ((src->ivpr & IVPR_MASK_MASK) && !src->nomask) {
451         /* Interrupt source is disabled */
452         DPRINTF("%s: IRQ %d is disabled\n", __func__, n_IRQ);
453         active = false;
454     }
455 
456     was_active = !!(src->ivpr & IVPR_ACTIVITY_MASK);
457 
458     /*
459      * We don't have a similar check for already-active because
460      * ctpr may have changed and we need to withdraw the interrupt.
461      */
462     if (!active && !was_active) {
463         DPRINTF("%s: IRQ %d is already inactive\n", __func__, n_IRQ);
464         return;
465     }
466 
467     if (active) {
468         src->ivpr |= IVPR_ACTIVITY_MASK;
469     } else {
470         src->ivpr &= ~IVPR_ACTIVITY_MASK;
471     }
472 
473     if (src->destmask == 0) {
474         /* No target */
475         DPRINTF("%s: IRQ %d has no target\n", __func__, n_IRQ);
476         return;
477     }
478 
479     if (src->destmask == (1 << src->last_cpu)) {
480         /* Only one CPU is allowed to receive this IRQ */
481         IRQ_local_pipe(opp, src->last_cpu, n_IRQ, active, was_active);
482     } else if (!(src->ivpr & IVPR_MODE_MASK)) {
483         /* Directed delivery mode */
484         for (i = 0; i < opp->nb_cpus; i++) {
485             if (src->destmask & (1 << i)) {
486                 IRQ_local_pipe(opp, i, n_IRQ, active, was_active);
487             }
488         }
489     } else {
490         /* Distributed delivery mode */
491         for (i = src->last_cpu + 1; i != src->last_cpu; i++) {
492             if (i == opp->nb_cpus) {
493                 i = 0;
494             }
495             if (src->destmask & (1 << i)) {
496                 IRQ_local_pipe(opp, i, n_IRQ, active, was_active);
497                 src->last_cpu = i;
498                 break;
499             }
500         }
501     }
502 }
503 
504 static void openpic_set_irq(void *opaque, int n_IRQ, int level)
505 {
506     OpenPICState *opp = opaque;
507     IRQSource *src;
508 
509     if (n_IRQ >= OPENPIC_MAX_IRQ) {
510         fprintf(stderr, "%s: IRQ %d out of range\n", __func__, n_IRQ);
511         abort();
512     }
513 
514     src = &opp->src[n_IRQ];
515     DPRINTF("openpic: set irq %d = %d ivpr=0x%08x\n",
516             n_IRQ, level, src->ivpr);
517     if (src->level) {
518         /* level-sensitive irq */
519         src->pending = level;
520         openpic_update_irq(opp, n_IRQ);
521     } else {
522         /* edge-sensitive irq */
523         if (level) {
524             src->pending = 1;
525             openpic_update_irq(opp, n_IRQ);
526         }
527 
528         if (src->output != OPENPIC_OUTPUT_INT) {
529             /* Edge-triggered interrupts shouldn't be used
530              * with non-INT delivery, but just in case,
531              * try to make it do something sane rather than
532              * cause an interrupt storm.  This is close to
533              * what you'd probably see happen in real hardware.
534              */
535             src->pending = 0;
536             openpic_update_irq(opp, n_IRQ);
537         }
538     }
539 }
540 
541 static inline uint32_t read_IRQreg_idr(OpenPICState *opp, int n_IRQ)
542 {
543     return opp->src[n_IRQ].idr;
544 }
545 
546 static inline uint32_t read_IRQreg_ilr(OpenPICState *opp, int n_IRQ)
547 {
548     if (opp->flags & OPENPIC_FLAG_ILR) {
549         return output_to_inttgt(opp->src[n_IRQ].output);
550     }
551 
552     return 0xffffffff;
553 }
554 
555 static inline uint32_t read_IRQreg_ivpr(OpenPICState *opp, int n_IRQ)
556 {
557     return opp->src[n_IRQ].ivpr;
558 }
559 
560 static inline void write_IRQreg_idr(OpenPICState *opp, int n_IRQ, uint32_t val)
561 {
562     IRQSource *src = &opp->src[n_IRQ];
563     uint32_t normal_mask = (1UL << opp->nb_cpus) - 1;
564     uint32_t crit_mask = 0;
565     uint32_t mask = normal_mask;
566     int crit_shift = IDR_EP_SHIFT - opp->nb_cpus;
567     int i;
568 
569     if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
570         crit_mask = mask << crit_shift;
571         mask |= crit_mask | IDR_EP;
572     }
573 
574     src->idr = val & mask;
575     DPRINTF("Set IDR %d to 0x%08x\n", n_IRQ, src->idr);
576 
577     if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
578         if (src->idr & crit_mask) {
579             if (src->idr & normal_mask) {
580                 DPRINTF("%s: IRQ configured for multiple output types, using "
581                         "critical\n", __func__);
582             }
583 
584             src->output = OPENPIC_OUTPUT_CINT;
585             src->nomask = true;
586             src->destmask = 0;
587 
588             for (i = 0; i < opp->nb_cpus; i++) {
589                 int n_ci = IDR_CI0_SHIFT - i;
590 
591                 if (src->idr & (1UL << n_ci)) {
592                     src->destmask |= 1UL << i;
593                 }
594             }
595         } else {
596             src->output = OPENPIC_OUTPUT_INT;
597             src->nomask = false;
598             src->destmask = src->idr & normal_mask;
599         }
600     } else {
601         src->destmask = src->idr;
602     }
603 }
604 
605 static inline void write_IRQreg_ilr(OpenPICState *opp, int n_IRQ, uint32_t val)
606 {
607     if (opp->flags & OPENPIC_FLAG_ILR) {
608         IRQSource *src = &opp->src[n_IRQ];
609 
610         src->output = inttgt_to_output(val & ILR_INTTGT_MASK);
611         DPRINTF("Set ILR %d to 0x%08x, output %d\n", n_IRQ, src->idr,
612                 src->output);
613 
614         /* TODO: on MPIC v4.0 only, set nomask for non-INT */
615     }
616 }
617 
618 static inline void write_IRQreg_ivpr(OpenPICState *opp, int n_IRQ, uint32_t val)
619 {
620     uint32_t mask;
621 
622     /* NOTE when implementing newer FSL MPIC models: starting with v4.0,
623      * the polarity bit is read-only on internal interrupts.
624      */
625     mask = IVPR_MASK_MASK | IVPR_PRIORITY_MASK | IVPR_SENSE_MASK |
626            IVPR_POLARITY_MASK | opp->vector_mask;
627 
628     /* ACTIVITY bit is read-only */
629     opp->src[n_IRQ].ivpr =
630         (opp->src[n_IRQ].ivpr & IVPR_ACTIVITY_MASK) | (val & mask);
631 
632     /* For FSL internal interrupts, The sense bit is reserved and zero,
633      * and the interrupt is always level-triggered.  Timers and IPIs
634      * have no sense or polarity bits, and are edge-triggered.
635      */
636     switch (opp->src[n_IRQ].type) {
637     case IRQ_TYPE_NORMAL:
638         opp->src[n_IRQ].level = !!(opp->src[n_IRQ].ivpr & IVPR_SENSE_MASK);
639         break;
640 
641     case IRQ_TYPE_FSLINT:
642         opp->src[n_IRQ].ivpr &= ~IVPR_SENSE_MASK;
643         break;
644 
645     case IRQ_TYPE_FSLSPECIAL:
646         opp->src[n_IRQ].ivpr &= ~(IVPR_POLARITY_MASK | IVPR_SENSE_MASK);
647         break;
648     }
649 
650     openpic_update_irq(opp, n_IRQ);
651     DPRINTF("Set IVPR %d to 0x%08x -> 0x%08x\n", n_IRQ, val,
652             opp->src[n_IRQ].ivpr);
653 }
654 
655 static void openpic_gcr_write(OpenPICState *opp, uint64_t val)
656 {
657     bool mpic_proxy = false;
658 
659     if (val & GCR_RESET) {
660         openpic_reset(DEVICE(opp));
661         return;
662     }
663 
664     opp->gcr &= ~opp->mpic_mode_mask;
665     opp->gcr |= val & opp->mpic_mode_mask;
666 
667     /* Set external proxy mode */
668     if ((val & opp->mpic_mode_mask) == GCR_MODE_PROXY) {
669         mpic_proxy = true;
670     }
671 
672     ppce500_set_mpic_proxy(mpic_proxy);
673 }
674 
675 static void openpic_gbl_write(void *opaque, hwaddr addr, uint64_t val,
676                               unsigned len)
677 {
678     OpenPICState *opp = opaque;
679     IRQDest *dst;
680     int idx;
681 
682     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64 "\n",
683             __func__, addr, val);
684     if (addr & 0xF) {
685         return;
686     }
687     switch (addr) {
688     case 0x00: /* Block Revision Register1 (BRR1) is Readonly */
689         break;
690     case 0x40:
691     case 0x50:
692     case 0x60:
693     case 0x70:
694     case 0x80:
695     case 0x90:
696     case 0xA0:
697     case 0xB0:
698         openpic_cpu_write_internal(opp, addr, val, get_current_cpu());
699         break;
700     case 0x1000: /* FRR */
701         break;
702     case 0x1020: /* GCR */
703         openpic_gcr_write(opp, val);
704         break;
705     case 0x1080: /* VIR */
706         break;
707     case 0x1090: /* PIR */
708         for (idx = 0; idx < opp->nb_cpus; idx++) {
709             if ((val & (1 << idx)) && !(opp->pir & (1 << idx))) {
710                 DPRINTF("Raise OpenPIC RESET output for CPU %d\n", idx);
711                 dst = &opp->dst[idx];
712                 qemu_irq_raise(dst->irqs[OPENPIC_OUTPUT_RESET]);
713             } else if (!(val & (1 << idx)) && (opp->pir & (1 << idx))) {
714                 DPRINTF("Lower OpenPIC RESET output for CPU %d\n", idx);
715                 dst = &opp->dst[idx];
716                 qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_RESET]);
717             }
718         }
719         opp->pir = val;
720         break;
721     case 0x10A0: /* IPI_IVPR */
722     case 0x10B0:
723     case 0x10C0:
724     case 0x10D0:
725         {
726             int idx;
727             idx = (addr - 0x10A0) >> 4;
728             write_IRQreg_ivpr(opp, opp->irq_ipi0 + idx, val);
729         }
730         break;
731     case 0x10E0: /* SPVE */
732         opp->spve = val & opp->vector_mask;
733         break;
734     default:
735         break;
736     }
737 }
738 
739 static uint64_t openpic_gbl_read(void *opaque, hwaddr addr, unsigned len)
740 {
741     OpenPICState *opp = opaque;
742     uint32_t retval;
743 
744     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
745     retval = 0xFFFFFFFF;
746     if (addr & 0xF) {
747         return retval;
748     }
749     switch (addr) {
750     case 0x1000: /* FRR */
751         retval = opp->frr;
752         break;
753     case 0x1020: /* GCR */
754         retval = opp->gcr;
755         break;
756     case 0x1080: /* VIR */
757         retval = opp->vir;
758         break;
759     case 0x1090: /* PIR */
760         retval = 0x00000000;
761         break;
762     case 0x00: /* Block Revision Register1 (BRR1) */
763         retval = opp->brr1;
764         break;
765     case 0x40:
766     case 0x50:
767     case 0x60:
768     case 0x70:
769     case 0x80:
770     case 0x90:
771     case 0xA0:
772     case 0xB0:
773         retval = openpic_cpu_read_internal(opp, addr, get_current_cpu());
774         break;
775     case 0x10A0: /* IPI_IVPR */
776     case 0x10B0:
777     case 0x10C0:
778     case 0x10D0:
779         {
780             int idx;
781             idx = (addr - 0x10A0) >> 4;
782             retval = read_IRQreg_ivpr(opp, opp->irq_ipi0 + idx);
783         }
784         break;
785     case 0x10E0: /* SPVE */
786         retval = opp->spve;
787         break;
788     default:
789         break;
790     }
791     DPRINTF("%s: => 0x%08x\n", __func__, retval);
792 
793     return retval;
794 }
795 
796 static void openpic_tmr_write(void *opaque, hwaddr addr, uint64_t val,
797                                 unsigned len)
798 {
799     OpenPICState *opp = opaque;
800     int idx;
801 
802     addr += 0x10f0;
803 
804     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64 "\n",
805             __func__, addr, val);
806     if (addr & 0xF) {
807         return;
808     }
809 
810     if (addr == 0x10f0) {
811         /* TFRR */
812         opp->tfrr = val;
813         return;
814     }
815 
816     idx = (addr >> 6) & 0x3;
817     addr = addr & 0x30;
818 
819     switch (addr & 0x30) {
820     case 0x00: /* TCCR */
821         break;
822     case 0x10: /* TBCR */
823         if ((opp->timers[idx].tccr & TCCR_TOG) != 0 &&
824             (val & TBCR_CI) == 0 &&
825             (opp->timers[idx].tbcr & TBCR_CI) != 0) {
826             opp->timers[idx].tccr &= ~TCCR_TOG;
827         }
828         opp->timers[idx].tbcr = val;
829         break;
830     case 0x20: /* TVPR */
831         write_IRQreg_ivpr(opp, opp->irq_tim0 + idx, val);
832         break;
833     case 0x30: /* TDR */
834         write_IRQreg_idr(opp, opp->irq_tim0 + idx, val);
835         break;
836     }
837 }
838 
839 static uint64_t openpic_tmr_read(void *opaque, hwaddr addr, unsigned len)
840 {
841     OpenPICState *opp = opaque;
842     uint32_t retval = -1;
843     int idx;
844 
845     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
846     if (addr & 0xF) {
847         goto out;
848     }
849     idx = (addr >> 6) & 0x3;
850     if (addr == 0x0) {
851         /* TFRR */
852         retval = opp->tfrr;
853         goto out;
854     }
855     switch (addr & 0x30) {
856     case 0x00: /* TCCR */
857         retval = opp->timers[idx].tccr;
858         break;
859     case 0x10: /* TBCR */
860         retval = opp->timers[idx].tbcr;
861         break;
862     case 0x20: /* TIPV */
863         retval = read_IRQreg_ivpr(opp, opp->irq_tim0 + idx);
864         break;
865     case 0x30: /* TIDE (TIDR) */
866         retval = read_IRQreg_idr(opp, opp->irq_tim0 + idx);
867         break;
868     }
869 
870 out:
871     DPRINTF("%s: => 0x%08x\n", __func__, retval);
872 
873     return retval;
874 }
875 
876 static void openpic_src_write(void *opaque, hwaddr addr, uint64_t val,
877                               unsigned len)
878 {
879     OpenPICState *opp = opaque;
880     int idx;
881 
882     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64 "\n",
883             __func__, addr, val);
884 
885     addr = addr & 0xffff;
886     idx = addr >> 5;
887 
888     switch (addr & 0x1f) {
889     case 0x00:
890         write_IRQreg_ivpr(opp, idx, val);
891         break;
892     case 0x10:
893         write_IRQreg_idr(opp, idx, val);
894         break;
895     case 0x18:
896         write_IRQreg_ilr(opp, idx, val);
897         break;
898     }
899 }
900 
901 static uint64_t openpic_src_read(void *opaque, uint64_t addr, unsigned len)
902 {
903     OpenPICState *opp = opaque;
904     uint32_t retval;
905     int idx;
906 
907     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
908     retval = 0xFFFFFFFF;
909 
910     addr = addr & 0xffff;
911     idx = addr >> 5;
912 
913     switch (addr & 0x1f) {
914     case 0x00:
915         retval = read_IRQreg_ivpr(opp, idx);
916         break;
917     case 0x10:
918         retval = read_IRQreg_idr(opp, idx);
919         break;
920     case 0x18:
921         retval = read_IRQreg_ilr(opp, idx);
922         break;
923     }
924 
925     DPRINTF("%s: => 0x%08x\n", __func__, retval);
926     return retval;
927 }
928 
929 static void openpic_msi_write(void *opaque, hwaddr addr, uint64_t val,
930                               unsigned size)
931 {
932     OpenPICState *opp = opaque;
933     int idx = opp->irq_msi;
934     int srs, ibs;
935 
936     DPRINTF("%s: addr %#" HWADDR_PRIx " <= 0x%08" PRIx64 "\n",
937             __func__, addr, val);
938     if (addr & 0xF) {
939         return;
940     }
941 
942     switch (addr) {
943     case MSIIR_OFFSET:
944         srs = val >> MSIIR_SRS_SHIFT;
945         idx += srs;
946         ibs = (val & MSIIR_IBS_MASK) >> MSIIR_IBS_SHIFT;
947         opp->msi[srs].msir |= 1 << ibs;
948         openpic_set_irq(opp, idx, 1);
949         break;
950     default:
951         /* most registers are read-only, thus ignored */
952         break;
953     }
954 }
955 
956 static uint64_t openpic_msi_read(void *opaque, hwaddr addr, unsigned size)
957 {
958     OpenPICState *opp = opaque;
959     uint64_t r = 0;
960     int i, srs;
961 
962     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
963     if (addr & 0xF) {
964         return -1;
965     }
966 
967     srs = addr >> 4;
968 
969     switch (addr) {
970     case 0x00:
971     case 0x10:
972     case 0x20:
973     case 0x30:
974     case 0x40:
975     case 0x50:
976     case 0x60:
977     case 0x70: /* MSIRs */
978         r = opp->msi[srs].msir;
979         /* Clear on read */
980         opp->msi[srs].msir = 0;
981         openpic_set_irq(opp, opp->irq_msi + srs, 0);
982         break;
983     case 0x120: /* MSISR */
984         for (i = 0; i < MAX_MSI; i++) {
985             r |= (opp->msi[i].msir ? 1 : 0) << i;
986         }
987         break;
988     }
989 
990     return r;
991 }
992 
993 static uint64_t openpic_summary_read(void *opaque, hwaddr addr, unsigned size)
994 {
995     uint64_t r = 0;
996 
997     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
998 
999     /* TODO: EISR/EIMR */
1000 
1001     return r;
1002 }
1003 
1004 static void openpic_summary_write(void *opaque, hwaddr addr, uint64_t val,
1005                                   unsigned size)
1006 {
1007     DPRINTF("%s: addr %#" HWADDR_PRIx " <= 0x%08" PRIx64 "\n",
1008             __func__, addr, val);
1009 
1010     /* TODO: EISR/EIMR */
1011 }
1012 
1013 static void openpic_cpu_write_internal(void *opaque, hwaddr addr,
1014                                        uint32_t val, int idx)
1015 {
1016     OpenPICState *opp = opaque;
1017     IRQSource *src;
1018     IRQDest *dst;
1019     int s_IRQ, n_IRQ;
1020 
1021     DPRINTF("%s: cpu %d addr %#" HWADDR_PRIx " <= 0x%08x\n", __func__, idx,
1022             addr, val);
1023 
1024     if (idx < 0 || idx >= opp->nb_cpus) {
1025         return;
1026     }
1027 
1028     if (addr & 0xF) {
1029         return;
1030     }
1031     dst = &opp->dst[idx];
1032     addr &= 0xFF0;
1033     switch (addr) {
1034     case 0x40: /* IPIDR */
1035     case 0x50:
1036     case 0x60:
1037     case 0x70:
1038         idx = (addr - 0x40) >> 4;
1039         /* we use IDE as mask which CPUs to deliver the IPI to still. */
1040         opp->src[opp->irq_ipi0 + idx].destmask |= val;
1041         openpic_set_irq(opp, opp->irq_ipi0 + idx, 1);
1042         openpic_set_irq(opp, opp->irq_ipi0 + idx, 0);
1043         break;
1044     case 0x80: /* CTPR */
1045         dst->ctpr = val & 0x0000000F;
1046 
1047         DPRINTF("%s: set CPU %d ctpr to %d, raised %d servicing %d\n",
1048                 __func__, idx, dst->ctpr, dst->raised.priority,
1049                 dst->servicing.priority);
1050 
1051         if (dst->raised.priority <= dst->ctpr) {
1052             DPRINTF("%s: Lower OpenPIC INT output cpu %d due to ctpr\n",
1053                     __func__, idx);
1054             qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_INT]);
1055         } else if (dst->raised.priority > dst->servicing.priority) {
1056             DPRINTF("%s: Raise OpenPIC INT output cpu %d irq %d\n",
1057                     __func__, idx, dst->raised.next);
1058             qemu_irq_raise(dst->irqs[OPENPIC_OUTPUT_INT]);
1059         }
1060 
1061         break;
1062     case 0x90: /* WHOAMI */
1063         /* Read-only register */
1064         break;
1065     case 0xA0: /* IACK */
1066         /* Read-only register */
1067         break;
1068     case 0xB0: /* EOI */
1069         DPRINTF("EOI\n");
1070         s_IRQ = IRQ_get_next(opp, &dst->servicing);
1071 
1072         if (s_IRQ < 0) {
1073             DPRINTF("%s: EOI with no interrupt in service\n", __func__);
1074             break;
1075         }
1076 
1077         IRQ_resetbit(&dst->servicing, s_IRQ);
1078         /* Set up next servicing IRQ */
1079         s_IRQ = IRQ_get_next(opp, &dst->servicing);
1080         /* Check queued interrupts. */
1081         n_IRQ = IRQ_get_next(opp, &dst->raised);
1082         src = &opp->src[n_IRQ];
1083         if (n_IRQ != -1 &&
1084             (s_IRQ == -1 ||
1085              IVPR_PRIORITY(src->ivpr) > dst->servicing.priority)) {
1086             DPRINTF("Raise OpenPIC INT output cpu %d irq %d\n",
1087                     idx, n_IRQ);
1088             qemu_irq_raise(opp->dst[idx].irqs[OPENPIC_OUTPUT_INT]);
1089         }
1090         break;
1091     default:
1092         break;
1093     }
1094 }
1095 
1096 static void openpic_cpu_write(void *opaque, hwaddr addr, uint64_t val,
1097                               unsigned len)
1098 {
1099     openpic_cpu_write_internal(opaque, addr, val, (addr & 0x1f000) >> 12);
1100 }
1101 
1102 
1103 static uint32_t openpic_iack(OpenPICState *opp, IRQDest *dst, int cpu)
1104 {
1105     IRQSource *src;
1106     int retval, irq;
1107 
1108     DPRINTF("Lower OpenPIC INT output\n");
1109     qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_INT]);
1110 
1111     irq = IRQ_get_next(opp, &dst->raised);
1112     DPRINTF("IACK: irq=%d\n", irq);
1113 
1114     if (irq == -1) {
1115         /* No more interrupt pending */
1116         return opp->spve;
1117     }
1118 
1119     src = &opp->src[irq];
1120     if (!(src->ivpr & IVPR_ACTIVITY_MASK) ||
1121             !(IVPR_PRIORITY(src->ivpr) > dst->ctpr)) {
1122         fprintf(stderr, "%s: bad raised IRQ %d ctpr %d ivpr 0x%08x\n",
1123                 __func__, irq, dst->ctpr, src->ivpr);
1124         openpic_update_irq(opp, irq);
1125         retval = opp->spve;
1126     } else {
1127         /* IRQ enter servicing state */
1128         IRQ_setbit(&dst->servicing, irq);
1129         retval = IVPR_VECTOR(opp, src->ivpr);
1130     }
1131 
1132     if (!src->level) {
1133         /* edge-sensitive IRQ */
1134         src->ivpr &= ~IVPR_ACTIVITY_MASK;
1135         src->pending = 0;
1136         IRQ_resetbit(&dst->raised, irq);
1137     }
1138 
1139     if ((irq >= opp->irq_ipi0) &&  (irq < (opp->irq_ipi0 + OPENPIC_MAX_IPI))) {
1140         src->destmask &= ~(1 << cpu);
1141         if (src->destmask && !src->level) {
1142             /* trigger on CPUs that didn't know about it yet */
1143             openpic_set_irq(opp, irq, 1);
1144             openpic_set_irq(opp, irq, 0);
1145             /* if all CPUs knew about it, set active bit again */
1146             src->ivpr |= IVPR_ACTIVITY_MASK;
1147         }
1148     }
1149 
1150     return retval;
1151 }
1152 
1153 static uint32_t openpic_cpu_read_internal(void *opaque, hwaddr addr,
1154                                           int idx)
1155 {
1156     OpenPICState *opp = opaque;
1157     IRQDest *dst;
1158     uint32_t retval;
1159 
1160     DPRINTF("%s: cpu %d addr %#" HWADDR_PRIx "\n", __func__, idx, addr);
1161     retval = 0xFFFFFFFF;
1162 
1163     if (idx < 0 || idx >= opp->nb_cpus) {
1164         return retval;
1165     }
1166 
1167     if (addr & 0xF) {
1168         return retval;
1169     }
1170     dst = &opp->dst[idx];
1171     addr &= 0xFF0;
1172     switch (addr) {
1173     case 0x80: /* CTPR */
1174         retval = dst->ctpr;
1175         break;
1176     case 0x90: /* WHOAMI */
1177         retval = idx;
1178         break;
1179     case 0xA0: /* IACK */
1180         retval = openpic_iack(opp, dst, idx);
1181         break;
1182     case 0xB0: /* EOI */
1183         retval = 0;
1184         break;
1185     default:
1186         break;
1187     }
1188     DPRINTF("%s: => 0x%08x\n", __func__, retval);
1189 
1190     return retval;
1191 }
1192 
1193 static uint64_t openpic_cpu_read(void *opaque, hwaddr addr, unsigned len)
1194 {
1195     return openpic_cpu_read_internal(opaque, addr, (addr & 0x1f000) >> 12);
1196 }
1197 
1198 static const MemoryRegionOps openpic_glb_ops_le = {
1199     .write = openpic_gbl_write,
1200     .read  = openpic_gbl_read,
1201     .endianness = DEVICE_LITTLE_ENDIAN,
1202     .impl = {
1203         .min_access_size = 4,
1204         .max_access_size = 4,
1205     },
1206 };
1207 
1208 static const MemoryRegionOps openpic_glb_ops_be = {
1209     .write = openpic_gbl_write,
1210     .read  = openpic_gbl_read,
1211     .endianness = DEVICE_BIG_ENDIAN,
1212     .impl = {
1213         .min_access_size = 4,
1214         .max_access_size = 4,
1215     },
1216 };
1217 
1218 static const MemoryRegionOps openpic_tmr_ops_le = {
1219     .write = openpic_tmr_write,
1220     .read  = openpic_tmr_read,
1221     .endianness = DEVICE_LITTLE_ENDIAN,
1222     .impl = {
1223         .min_access_size = 4,
1224         .max_access_size = 4,
1225     },
1226 };
1227 
1228 static const MemoryRegionOps openpic_tmr_ops_be = {
1229     .write = openpic_tmr_write,
1230     .read  = openpic_tmr_read,
1231     .endianness = DEVICE_BIG_ENDIAN,
1232     .impl = {
1233         .min_access_size = 4,
1234         .max_access_size = 4,
1235     },
1236 };
1237 
1238 static const MemoryRegionOps openpic_cpu_ops_le = {
1239     .write = openpic_cpu_write,
1240     .read  = openpic_cpu_read,
1241     .endianness = DEVICE_LITTLE_ENDIAN,
1242     .impl = {
1243         .min_access_size = 4,
1244         .max_access_size = 4,
1245     },
1246 };
1247 
1248 static const MemoryRegionOps openpic_cpu_ops_be = {
1249     .write = openpic_cpu_write,
1250     .read  = openpic_cpu_read,
1251     .endianness = DEVICE_BIG_ENDIAN,
1252     .impl = {
1253         .min_access_size = 4,
1254         .max_access_size = 4,
1255     },
1256 };
1257 
1258 static const MemoryRegionOps openpic_src_ops_le = {
1259     .write = openpic_src_write,
1260     .read  = openpic_src_read,
1261     .endianness = DEVICE_LITTLE_ENDIAN,
1262     .impl = {
1263         .min_access_size = 4,
1264         .max_access_size = 4,
1265     },
1266 };
1267 
1268 static const MemoryRegionOps openpic_src_ops_be = {
1269     .write = openpic_src_write,
1270     .read  = openpic_src_read,
1271     .endianness = DEVICE_BIG_ENDIAN,
1272     .impl = {
1273         .min_access_size = 4,
1274         .max_access_size = 4,
1275     },
1276 };
1277 
1278 static const MemoryRegionOps openpic_msi_ops_be = {
1279     .read = openpic_msi_read,
1280     .write = openpic_msi_write,
1281     .endianness = DEVICE_BIG_ENDIAN,
1282     .impl = {
1283         .min_access_size = 4,
1284         .max_access_size = 4,
1285     },
1286 };
1287 
1288 static const MemoryRegionOps openpic_summary_ops_be = {
1289     .read = openpic_summary_read,
1290     .write = openpic_summary_write,
1291     .endianness = DEVICE_BIG_ENDIAN,
1292     .impl = {
1293         .min_access_size = 4,
1294         .max_access_size = 4,
1295     },
1296 };
1297 
1298 static void openpic_reset(DeviceState *d)
1299 {
1300     OpenPICState *opp = OPENPIC(d);
1301     int i;
1302 
1303     opp->gcr = GCR_RESET;
1304     /* Initialise controller registers */
1305     opp->frr = ((opp->nb_irqs - 1) << FRR_NIRQ_SHIFT) |
1306                ((opp->nb_cpus - 1) << FRR_NCPU_SHIFT) |
1307                (opp->vid << FRR_VID_SHIFT);
1308 
1309     opp->pir = 0;
1310     opp->spve = -1 & opp->vector_mask;
1311     opp->tfrr = opp->tfrr_reset;
1312     /* Initialise IRQ sources */
1313     for (i = 0; i < opp->max_irq; i++) {
1314         opp->src[i].ivpr = opp->ivpr_reset;
1315         switch (opp->src[i].type) {
1316         case IRQ_TYPE_NORMAL:
1317             opp->src[i].level = !!(opp->ivpr_reset & IVPR_SENSE_MASK);
1318             break;
1319 
1320         case IRQ_TYPE_FSLINT:
1321             opp->src[i].ivpr |= IVPR_POLARITY_MASK;
1322             break;
1323 
1324         case IRQ_TYPE_FSLSPECIAL:
1325             break;
1326         }
1327 
1328         write_IRQreg_idr(opp, i, opp->idr_reset);
1329     }
1330     /* Initialise IRQ destinations */
1331     for (i = 0; i < opp->nb_cpus; i++) {
1332         opp->dst[i].ctpr      = 15;
1333         opp->dst[i].raised.next = -1;
1334         opp->dst[i].raised.priority = 0;
1335         bitmap_clear(opp->dst[i].raised.queue, 0, IRQQUEUE_SIZE_BITS);
1336         opp->dst[i].servicing.next = -1;
1337         opp->dst[i].servicing.priority = 0;
1338         bitmap_clear(opp->dst[i].servicing.queue, 0, IRQQUEUE_SIZE_BITS);
1339     }
1340     /* Initialise timers */
1341     for (i = 0; i < OPENPIC_MAX_TMR; i++) {
1342         opp->timers[i].tccr = 0;
1343         opp->timers[i].tbcr = TBCR_CI;
1344     }
1345     /* Go out of RESET state */
1346     opp->gcr = 0;
1347 }
1348 
1349 typedef struct MemReg {
1350     const char             *name;
1351     MemoryRegionOps const  *ops;
1352     hwaddr      start_addr;
1353     ram_addr_t              size;
1354 } MemReg;
1355 
1356 static void fsl_common_init(OpenPICState *opp)
1357 {
1358     int i;
1359     int virq = OPENPIC_MAX_SRC;
1360 
1361     opp->vid = VID_REVISION_1_2;
1362     opp->vir = VIR_GENERIC;
1363     opp->vector_mask = 0xFFFF;
1364     opp->tfrr_reset = 0;
1365     opp->ivpr_reset = IVPR_MASK_MASK;
1366     opp->idr_reset = 1 << 0;
1367     opp->max_irq = OPENPIC_MAX_IRQ;
1368 
1369     opp->irq_ipi0 = virq;
1370     virq += OPENPIC_MAX_IPI;
1371     opp->irq_tim0 = virq;
1372     virq += OPENPIC_MAX_TMR;
1373 
1374     assert(virq <= OPENPIC_MAX_IRQ);
1375 
1376     opp->irq_msi = 224;
1377 
1378     msi_supported = true;
1379     for (i = 0; i < opp->fsl->max_ext; i++) {
1380         opp->src[i].level = false;
1381     }
1382 
1383     /* Internal interrupts, including message and MSI */
1384     for (i = 16; i < OPENPIC_MAX_SRC; i++) {
1385         opp->src[i].type = IRQ_TYPE_FSLINT;
1386         opp->src[i].level = true;
1387     }
1388 
1389     /* timers and IPIs */
1390     for (i = OPENPIC_MAX_SRC; i < virq; i++) {
1391         opp->src[i].type = IRQ_TYPE_FSLSPECIAL;
1392         opp->src[i].level = false;
1393     }
1394 }
1395 
1396 static void map_list(OpenPICState *opp, const MemReg *list, int *count)
1397 {
1398     while (list->name) {
1399         assert(*count < ARRAY_SIZE(opp->sub_io_mem));
1400 
1401         memory_region_init_io(&opp->sub_io_mem[*count], OBJECT(opp), list->ops,
1402                               opp, list->name, list->size);
1403 
1404         memory_region_add_subregion(&opp->mem, list->start_addr,
1405                                     &opp->sub_io_mem[*count]);
1406 
1407         (*count)++;
1408         list++;
1409     }
1410 }
1411 
1412 static const VMStateDescription vmstate_openpic_irq_queue = {
1413     .name = "openpic_irq_queue",
1414     .version_id = 0,
1415     .minimum_version_id = 0,
1416     .fields = (VMStateField[]) {
1417         VMSTATE_BITMAP(queue, IRQQueue, 0, queue_size),
1418         VMSTATE_INT32(next, IRQQueue),
1419         VMSTATE_INT32(priority, IRQQueue),
1420         VMSTATE_END_OF_LIST()
1421     }
1422 };
1423 
1424 static const VMStateDescription vmstate_openpic_irqdest = {
1425     .name = "openpic_irqdest",
1426     .version_id = 0,
1427     .minimum_version_id = 0,
1428     .fields = (VMStateField[]) {
1429         VMSTATE_INT32(ctpr, IRQDest),
1430         VMSTATE_STRUCT(raised, IRQDest, 0, vmstate_openpic_irq_queue,
1431                        IRQQueue),
1432         VMSTATE_STRUCT(servicing, IRQDest, 0, vmstate_openpic_irq_queue,
1433                        IRQQueue),
1434         VMSTATE_UINT32_ARRAY(outputs_active, IRQDest, OPENPIC_OUTPUT_NB),
1435         VMSTATE_END_OF_LIST()
1436     }
1437 };
1438 
1439 static const VMStateDescription vmstate_openpic_irqsource = {
1440     .name = "openpic_irqsource",
1441     .version_id = 0,
1442     .minimum_version_id = 0,
1443     .fields = (VMStateField[]) {
1444         VMSTATE_UINT32(ivpr, IRQSource),
1445         VMSTATE_UINT32(idr, IRQSource),
1446         VMSTATE_UINT32(destmask, IRQSource),
1447         VMSTATE_INT32(last_cpu, IRQSource),
1448         VMSTATE_INT32(pending, IRQSource),
1449         VMSTATE_END_OF_LIST()
1450     }
1451 };
1452 
1453 static const VMStateDescription vmstate_openpic_timer = {
1454     .name = "openpic_timer",
1455     .version_id = 0,
1456     .minimum_version_id = 0,
1457     .fields = (VMStateField[]) {
1458         VMSTATE_UINT32(tccr, OpenPICTimer),
1459         VMSTATE_UINT32(tbcr, OpenPICTimer),
1460         VMSTATE_END_OF_LIST()
1461     }
1462 };
1463 
1464 static const VMStateDescription vmstate_openpic_msi = {
1465     .name = "openpic_msi",
1466     .version_id = 0,
1467     .minimum_version_id = 0,
1468     .fields = (VMStateField[]) {
1469         VMSTATE_UINT32(msir, OpenPICMSI),
1470         VMSTATE_END_OF_LIST()
1471     }
1472 };
1473 
1474 static int openpic_post_load(void *opaque, int version_id)
1475 {
1476     OpenPICState *opp = (OpenPICState *)opaque;
1477     int i;
1478 
1479     /* Update internal ivpr and idr variables */
1480     for (i = 0; i < opp->max_irq; i++) {
1481         write_IRQreg_idr(opp, i, opp->src[i].idr);
1482         write_IRQreg_ivpr(opp, i, opp->src[i].ivpr);
1483     }
1484 
1485     return 0;
1486 }
1487 
1488 static const VMStateDescription vmstate_openpic = {
1489     .name = "openpic",
1490     .version_id = 3,
1491     .minimum_version_id = 3,
1492     .post_load = openpic_post_load,
1493     .fields = (VMStateField[]) {
1494         VMSTATE_UINT32(gcr, OpenPICState),
1495         VMSTATE_UINT32(vir, OpenPICState),
1496         VMSTATE_UINT32(pir, OpenPICState),
1497         VMSTATE_UINT32(spve, OpenPICState),
1498         VMSTATE_UINT32(tfrr, OpenPICState),
1499         VMSTATE_UINT32(max_irq, OpenPICState),
1500         VMSTATE_STRUCT_VARRAY_UINT32(src, OpenPICState, max_irq, 0,
1501                                      vmstate_openpic_irqsource, IRQSource),
1502         VMSTATE_UINT32_EQUAL(nb_cpus, OpenPICState),
1503         VMSTATE_STRUCT_VARRAY_UINT32(dst, OpenPICState, nb_cpus, 0,
1504                                      vmstate_openpic_irqdest, IRQDest),
1505         VMSTATE_STRUCT_ARRAY(timers, OpenPICState, OPENPIC_MAX_TMR, 0,
1506                              vmstate_openpic_timer, OpenPICTimer),
1507         VMSTATE_STRUCT_ARRAY(msi, OpenPICState, MAX_MSI, 0,
1508                              vmstate_openpic_msi, OpenPICMSI),
1509         VMSTATE_UINT32(irq_ipi0, OpenPICState),
1510         VMSTATE_UINT32(irq_tim0, OpenPICState),
1511         VMSTATE_UINT32(irq_msi, OpenPICState),
1512         VMSTATE_END_OF_LIST()
1513     }
1514 };
1515 
1516 static void openpic_init(Object *obj)
1517 {
1518     OpenPICState *opp = OPENPIC(obj);
1519 
1520     memory_region_init(&opp->mem, obj, "openpic", 0x40000);
1521 }
1522 
1523 static void openpic_realize(DeviceState *dev, Error **errp)
1524 {
1525     SysBusDevice *d = SYS_BUS_DEVICE(dev);
1526     OpenPICState *opp = OPENPIC(dev);
1527     int i, j;
1528     int list_count = 0;
1529     static const MemReg list_le[] = {
1530         {"glb", &openpic_glb_ops_le,
1531                 OPENPIC_GLB_REG_START, OPENPIC_GLB_REG_SIZE},
1532         {"tmr", &openpic_tmr_ops_le,
1533                 OPENPIC_TMR_REG_START, OPENPIC_TMR_REG_SIZE},
1534         {"src", &openpic_src_ops_le,
1535                 OPENPIC_SRC_REG_START, OPENPIC_SRC_REG_SIZE},
1536         {"cpu", &openpic_cpu_ops_le,
1537                 OPENPIC_CPU_REG_START, OPENPIC_CPU_REG_SIZE},
1538         {NULL}
1539     };
1540     static const MemReg list_be[] = {
1541         {"glb", &openpic_glb_ops_be,
1542                 OPENPIC_GLB_REG_START, OPENPIC_GLB_REG_SIZE},
1543         {"tmr", &openpic_tmr_ops_be,
1544                 OPENPIC_TMR_REG_START, OPENPIC_TMR_REG_SIZE},
1545         {"src", &openpic_src_ops_be,
1546                 OPENPIC_SRC_REG_START, OPENPIC_SRC_REG_SIZE},
1547         {"cpu", &openpic_cpu_ops_be,
1548                 OPENPIC_CPU_REG_START, OPENPIC_CPU_REG_SIZE},
1549         {NULL}
1550     };
1551     static const MemReg list_fsl[] = {
1552         {"msi", &openpic_msi_ops_be,
1553                 OPENPIC_MSI_REG_START, OPENPIC_MSI_REG_SIZE},
1554         {"summary", &openpic_summary_ops_be,
1555                 OPENPIC_SUMMARY_REG_START, OPENPIC_SUMMARY_REG_SIZE},
1556         {NULL}
1557     };
1558 
1559     if (opp->nb_cpus > MAX_CPU) {
1560         error_setg(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE,
1561                    TYPE_OPENPIC, "nb_cpus", (uint64_t)opp->nb_cpus,
1562                    (uint64_t)0, (uint64_t)MAX_CPU);
1563         return;
1564     }
1565 
1566     switch (opp->model) {
1567     case OPENPIC_MODEL_FSL_MPIC_20:
1568     default:
1569         opp->fsl = &fsl_mpic_20;
1570         opp->brr1 = 0x00400200;
1571         opp->flags |= OPENPIC_FLAG_IDR_CRIT;
1572         opp->nb_irqs = 80;
1573         opp->mpic_mode_mask = GCR_MODE_MIXED;
1574 
1575         fsl_common_init(opp);
1576         map_list(opp, list_be, &list_count);
1577         map_list(opp, list_fsl, &list_count);
1578 
1579         break;
1580 
1581     case OPENPIC_MODEL_FSL_MPIC_42:
1582         opp->fsl = &fsl_mpic_42;
1583         opp->brr1 = 0x00400402;
1584         opp->flags |= OPENPIC_FLAG_ILR;
1585         opp->nb_irqs = 196;
1586         opp->mpic_mode_mask = GCR_MODE_PROXY;
1587 
1588         fsl_common_init(opp);
1589         map_list(opp, list_be, &list_count);
1590         map_list(opp, list_fsl, &list_count);
1591 
1592         break;
1593 
1594     case OPENPIC_MODEL_RAVEN:
1595         opp->nb_irqs = RAVEN_MAX_EXT;
1596         opp->vid = VID_REVISION_1_3;
1597         opp->vir = VIR_GENERIC;
1598         opp->vector_mask = 0xFF;
1599         opp->tfrr_reset = 4160000;
1600         opp->ivpr_reset = IVPR_MASK_MASK | IVPR_MODE_MASK;
1601         opp->idr_reset = 0;
1602         opp->max_irq = RAVEN_MAX_IRQ;
1603         opp->irq_ipi0 = RAVEN_IPI_IRQ;
1604         opp->irq_tim0 = RAVEN_TMR_IRQ;
1605         opp->brr1 = -1;
1606         opp->mpic_mode_mask = GCR_MODE_MIXED;
1607 
1608         if (opp->nb_cpus != 1) {
1609             error_setg(errp, "Only UP supported today");
1610             return;
1611         }
1612 
1613         map_list(opp, list_le, &list_count);
1614         break;
1615     }
1616 
1617     for (i = 0; i < opp->nb_cpus; i++) {
1618         opp->dst[i].irqs = g_new0(qemu_irq, OPENPIC_OUTPUT_NB);
1619         for (j = 0; j < OPENPIC_OUTPUT_NB; j++) {
1620             sysbus_init_irq(d, &opp->dst[i].irqs[j]);
1621         }
1622 
1623         opp->dst[i].raised.queue_size = IRQQUEUE_SIZE_BITS;
1624         opp->dst[i].raised.queue = bitmap_new(IRQQUEUE_SIZE_BITS);
1625         opp->dst[i].servicing.queue_size = IRQQUEUE_SIZE_BITS;
1626         opp->dst[i].servicing.queue = bitmap_new(IRQQUEUE_SIZE_BITS);
1627     }
1628 
1629     sysbus_init_mmio(d, &opp->mem);
1630     qdev_init_gpio_in(dev, openpic_set_irq, opp->max_irq);
1631 }
1632 
1633 static Property openpic_properties[] = {
1634     DEFINE_PROP_UINT32("model", OpenPICState, model, OPENPIC_MODEL_FSL_MPIC_20),
1635     DEFINE_PROP_UINT32("nb_cpus", OpenPICState, nb_cpus, 1),
1636     DEFINE_PROP_END_OF_LIST(),
1637 };
1638 
1639 static void openpic_class_init(ObjectClass *oc, void *data)
1640 {
1641     DeviceClass *dc = DEVICE_CLASS(oc);
1642 
1643     dc->realize = openpic_realize;
1644     dc->props = openpic_properties;
1645     dc->reset = openpic_reset;
1646     dc->vmsd = &vmstate_openpic;
1647     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
1648 }
1649 
1650 static const TypeInfo openpic_info = {
1651     .name          = TYPE_OPENPIC,
1652     .parent        = TYPE_SYS_BUS_DEVICE,
1653     .instance_size = sizeof(OpenPICState),
1654     .instance_init = openpic_init,
1655     .class_init    = openpic_class_init,
1656 };
1657 
1658 static void openpic_register_types(void)
1659 {
1660     type_register_static(&openpic_info);
1661 }
1662 
1663 type_init(openpic_register_types)
1664