xref: /openbmc/qemu/hw/ppc/ppc440_uc.c (revision 5f7effe4df91702add08e3e3dc1871fd35a8903f)
1 /*
2  * QEMU PowerPC 440 embedded processors emulation
3  *
4  * Copyright (c) 2012 François Revol
5  * Copyright (c) 2016-2019 BALATON Zoltan
6  *
7  * This work is licensed under the GNU GPL license version 2 or later.
8  *
9  */
10 
11 #include "qemu/osdep.h"
12 #include "qemu/units.h"
13 #include "qemu/error-report.h"
14 #include "qapi/error.h"
15 #include "qemu/log.h"
16 #include "qemu/module.h"
17 #include "hw/irq.h"
18 #include "exec/memory.h"
19 #include "cpu.h"
20 #include "hw/ppc/ppc4xx.h"
21 #include "hw/qdev-properties.h"
22 #include "hw/pci/pci.h"
23 #include "sysemu/block-backend.h"
24 #include "sysemu/reset.h"
25 #include "ppc440.h"
26 #include "qom/object.h"
27 #include "trace.h"
28 
29 /*****************************************************************************/
30 /* L2 Cache as SRAM */
31 /* FIXME:fix names */
32 enum {
33     DCR_L2CACHE_BASE  = 0x30,
34     DCR_L2CACHE_CFG   = DCR_L2CACHE_BASE,
35     DCR_L2CACHE_CMD,
36     DCR_L2CACHE_ADDR,
37     DCR_L2CACHE_DATA,
38     DCR_L2CACHE_STAT,
39     DCR_L2CACHE_CVER,
40     DCR_L2CACHE_SNP0,
41     DCR_L2CACHE_SNP1,
42     DCR_L2CACHE_END   = DCR_L2CACHE_SNP1,
43 };
44 
45 /* base is 460ex-specific, cf. U-Boot, ppc4xx-isram.h */
46 enum {
47     DCR_ISRAM0_BASE   = 0x20,
48     DCR_ISRAM0_SB0CR  = DCR_ISRAM0_BASE,
49     DCR_ISRAM0_SB1CR,
50     DCR_ISRAM0_SB2CR,
51     DCR_ISRAM0_SB3CR,
52     DCR_ISRAM0_BEAR,
53     DCR_ISRAM0_BESR0,
54     DCR_ISRAM0_BESR1,
55     DCR_ISRAM0_PMEG,
56     DCR_ISRAM0_CID,
57     DCR_ISRAM0_REVID,
58     DCR_ISRAM0_DPC,
59     DCR_ISRAM0_END    = DCR_ISRAM0_DPC
60 };
61 
62 enum {
63     DCR_ISRAM1_BASE   = 0xb0,
64     DCR_ISRAM1_SB0CR  = DCR_ISRAM1_BASE,
65     /* single bank */
66     DCR_ISRAM1_BEAR   = DCR_ISRAM1_BASE + 0x04,
67     DCR_ISRAM1_BESR0,
68     DCR_ISRAM1_BESR1,
69     DCR_ISRAM1_PMEG,
70     DCR_ISRAM1_CID,
71     DCR_ISRAM1_REVID,
72     DCR_ISRAM1_DPC,
73     DCR_ISRAM1_END    = DCR_ISRAM1_DPC
74 };
75 
76 typedef struct ppc4xx_l2sram_t {
77     MemoryRegion bank[4];
78     uint32_t l2cache[8];
79     uint32_t isram0[11];
80 } ppc4xx_l2sram_t;
81 
82 #ifdef MAP_L2SRAM
83 static void l2sram_update_mappings(ppc4xx_l2sram_t *l2sram,
84                                    uint32_t isarc, uint32_t isacntl,
85                                    uint32_t dsarc, uint32_t dsacntl)
86 {
87     if (l2sram->isarc != isarc ||
88         (l2sram->isacntl & 0x80000000) != (isacntl & 0x80000000)) {
89         if (l2sram->isacntl & 0x80000000) {
90             /* Unmap previously assigned memory region */
91             memory_region_del_subregion(get_system_memory(),
92                                         &l2sram->isarc_ram);
93         }
94         if (isacntl & 0x80000000) {
95             /* Map new instruction memory region */
96             memory_region_add_subregion(get_system_memory(), isarc,
97                                         &l2sram->isarc_ram);
98         }
99     }
100     if (l2sram->dsarc != dsarc ||
101         (l2sram->dsacntl & 0x80000000) != (dsacntl & 0x80000000)) {
102         if (l2sram->dsacntl & 0x80000000) {
103             /* Beware not to unmap the region we just mapped */
104             if (!(isacntl & 0x80000000) || l2sram->dsarc != isarc) {
105                 /* Unmap previously assigned memory region */
106                 memory_region_del_subregion(get_system_memory(),
107                                             &l2sram->dsarc_ram);
108             }
109         }
110         if (dsacntl & 0x80000000) {
111             /* Beware not to remap the region we just mapped */
112             if (!(isacntl & 0x80000000) || dsarc != isarc) {
113                 /* Map new data memory region */
114                 memory_region_add_subregion(get_system_memory(), dsarc,
115                                             &l2sram->dsarc_ram);
116             }
117         }
118     }
119 }
120 #endif
121 
122 static uint32_t dcr_read_l2sram(void *opaque, int dcrn)
123 {
124     ppc4xx_l2sram_t *l2sram = opaque;
125     uint32_t ret = 0;
126 
127     switch (dcrn) {
128     case DCR_L2CACHE_CFG:
129     case DCR_L2CACHE_CMD:
130     case DCR_L2CACHE_ADDR:
131     case DCR_L2CACHE_DATA:
132     case DCR_L2CACHE_STAT:
133     case DCR_L2CACHE_CVER:
134     case DCR_L2CACHE_SNP0:
135     case DCR_L2CACHE_SNP1:
136         ret = l2sram->l2cache[dcrn - DCR_L2CACHE_BASE];
137         break;
138 
139     case DCR_ISRAM0_SB0CR:
140     case DCR_ISRAM0_SB1CR:
141     case DCR_ISRAM0_SB2CR:
142     case DCR_ISRAM0_SB3CR:
143     case DCR_ISRAM0_BEAR:
144     case DCR_ISRAM0_BESR0:
145     case DCR_ISRAM0_BESR1:
146     case DCR_ISRAM0_PMEG:
147     case DCR_ISRAM0_CID:
148     case DCR_ISRAM0_REVID:
149     case DCR_ISRAM0_DPC:
150         ret = l2sram->isram0[dcrn - DCR_ISRAM0_BASE];
151         break;
152 
153     default:
154         break;
155     }
156 
157     return ret;
158 }
159 
160 static void dcr_write_l2sram(void *opaque, int dcrn, uint32_t val)
161 {
162     /*ppc4xx_l2sram_t *l2sram = opaque;*/
163     /* FIXME: Actually handle L2 cache mapping */
164 
165     switch (dcrn) {
166     case DCR_L2CACHE_CFG:
167     case DCR_L2CACHE_CMD:
168     case DCR_L2CACHE_ADDR:
169     case DCR_L2CACHE_DATA:
170     case DCR_L2CACHE_STAT:
171     case DCR_L2CACHE_CVER:
172     case DCR_L2CACHE_SNP0:
173     case DCR_L2CACHE_SNP1:
174         /*l2sram->l2cache[dcrn - DCR_L2CACHE_BASE] = val;*/
175         break;
176 
177     case DCR_ISRAM0_SB0CR:
178     case DCR_ISRAM0_SB1CR:
179     case DCR_ISRAM0_SB2CR:
180     case DCR_ISRAM0_SB3CR:
181     case DCR_ISRAM0_BEAR:
182     case DCR_ISRAM0_BESR0:
183     case DCR_ISRAM0_BESR1:
184     case DCR_ISRAM0_PMEG:
185     case DCR_ISRAM0_CID:
186     case DCR_ISRAM0_REVID:
187     case DCR_ISRAM0_DPC:
188         /*l2sram->isram0[dcrn - DCR_L2CACHE_BASE] = val;*/
189         break;
190 
191     case DCR_ISRAM1_SB0CR:
192     case DCR_ISRAM1_BEAR:
193     case DCR_ISRAM1_BESR0:
194     case DCR_ISRAM1_BESR1:
195     case DCR_ISRAM1_PMEG:
196     case DCR_ISRAM1_CID:
197     case DCR_ISRAM1_REVID:
198     case DCR_ISRAM1_DPC:
199         /*l2sram->isram1[dcrn - DCR_L2CACHE_BASE] = val;*/
200         break;
201     }
202     /*l2sram_update_mappings(l2sram, isarc, isacntl, dsarc, dsacntl);*/
203 }
204 
205 static void l2sram_reset(void *opaque)
206 {
207     ppc4xx_l2sram_t *l2sram = opaque;
208 
209     memset(l2sram->l2cache, 0, sizeof(l2sram->l2cache));
210     l2sram->l2cache[DCR_L2CACHE_STAT - DCR_L2CACHE_BASE] = 0x80000000;
211     memset(l2sram->isram0, 0, sizeof(l2sram->isram0));
212     /*l2sram_update_mappings(l2sram, isarc, isacntl, dsarc, dsacntl);*/
213 }
214 
215 void ppc4xx_l2sram_init(CPUPPCState *env)
216 {
217     ppc4xx_l2sram_t *l2sram;
218 
219     l2sram = g_malloc0(sizeof(*l2sram));
220     /* XXX: Size is 4*64kB for 460ex, cf. U-Boot, ppc4xx-isram.h */
221     memory_region_init_ram(&l2sram->bank[0], NULL, "ppc4xx.l2sram_bank0",
222                            64 * KiB, &error_abort);
223     memory_region_init_ram(&l2sram->bank[1], NULL, "ppc4xx.l2sram_bank1",
224                            64 * KiB, &error_abort);
225     memory_region_init_ram(&l2sram->bank[2], NULL, "ppc4xx.l2sram_bank2",
226                            64 * KiB, &error_abort);
227     memory_region_init_ram(&l2sram->bank[3], NULL, "ppc4xx.l2sram_bank3",
228                            64 * KiB, &error_abort);
229     qemu_register_reset(&l2sram_reset, l2sram);
230     ppc_dcr_register(env, DCR_L2CACHE_CFG,
231                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
232     ppc_dcr_register(env, DCR_L2CACHE_CMD,
233                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
234     ppc_dcr_register(env, DCR_L2CACHE_ADDR,
235                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
236     ppc_dcr_register(env, DCR_L2CACHE_DATA,
237                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
238     ppc_dcr_register(env, DCR_L2CACHE_STAT,
239                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
240     ppc_dcr_register(env, DCR_L2CACHE_CVER,
241                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
242     ppc_dcr_register(env, DCR_L2CACHE_SNP0,
243                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
244     ppc_dcr_register(env, DCR_L2CACHE_SNP1,
245                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
246 
247     ppc_dcr_register(env, DCR_ISRAM0_SB0CR,
248                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
249     ppc_dcr_register(env, DCR_ISRAM0_SB1CR,
250                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
251     ppc_dcr_register(env, DCR_ISRAM0_SB2CR,
252                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
253     ppc_dcr_register(env, DCR_ISRAM0_SB3CR,
254                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
255     ppc_dcr_register(env, DCR_ISRAM0_PMEG,
256                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
257     ppc_dcr_register(env, DCR_ISRAM0_DPC,
258                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
259 
260     ppc_dcr_register(env, DCR_ISRAM1_SB0CR,
261                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
262     ppc_dcr_register(env, DCR_ISRAM1_PMEG,
263                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
264     ppc_dcr_register(env, DCR_ISRAM1_DPC,
265                      l2sram, &dcr_read_l2sram, &dcr_write_l2sram);
266 }
267 
268 /*****************************************************************************/
269 /* Clocking Power on Reset */
270 enum {
271     CPR0_CFGADDR = 0xC,
272     CPR0_CFGDATA = 0xD,
273 
274     CPR0_PLLD = 0x060,
275     CPR0_PLBED = 0x080,
276     CPR0_OPBD = 0x0C0,
277     CPR0_PERD = 0x0E0,
278     CPR0_AHBD = 0x100,
279 };
280 
281 typedef struct ppc4xx_cpr_t {
282     uint32_t addr;
283 } ppc4xx_cpr_t;
284 
285 static uint32_t dcr_read_cpr(void *opaque, int dcrn)
286 {
287     ppc4xx_cpr_t *cpr = opaque;
288     uint32_t ret = 0;
289 
290     switch (dcrn) {
291     case CPR0_CFGADDR:
292         ret = cpr->addr;
293         break;
294     case CPR0_CFGDATA:
295         switch (cpr->addr) {
296         case CPR0_PLLD:
297             ret = (0xb5 << 24) | (1 << 16) | (9 << 8);
298             break;
299         case CPR0_PLBED:
300             ret = (5 << 24);
301             break;
302         case CPR0_OPBD:
303             ret = (2 << 24);
304             break;
305         case CPR0_PERD:
306         case CPR0_AHBD:
307             ret = (1 << 24);
308             break;
309         default:
310             break;
311         }
312         break;
313     default:
314         break;
315     }
316 
317     return ret;
318 }
319 
320 static void dcr_write_cpr(void *opaque, int dcrn, uint32_t val)
321 {
322     ppc4xx_cpr_t *cpr = opaque;
323 
324     switch (dcrn) {
325     case CPR0_CFGADDR:
326         cpr->addr = val;
327         break;
328     case CPR0_CFGDATA:
329         break;
330     default:
331         break;
332     }
333 }
334 
335 static void ppc4xx_cpr_reset(void *opaque)
336 {
337     ppc4xx_cpr_t *cpr = opaque;
338 
339     cpr->addr = 0;
340 }
341 
342 void ppc4xx_cpr_init(CPUPPCState *env)
343 {
344     ppc4xx_cpr_t *cpr;
345 
346     cpr = g_malloc0(sizeof(*cpr));
347     ppc_dcr_register(env, CPR0_CFGADDR, cpr, &dcr_read_cpr, &dcr_write_cpr);
348     ppc_dcr_register(env, CPR0_CFGDATA, cpr, &dcr_read_cpr, &dcr_write_cpr);
349     qemu_register_reset(ppc4xx_cpr_reset, cpr);
350 }
351 
352 /*****************************************************************************/
353 /* System DCRs */
354 typedef struct ppc4xx_sdr_t ppc4xx_sdr_t;
355 struct ppc4xx_sdr_t {
356     uint32_t addr;
357 };
358 
359 enum {
360     SDR0_CFGADDR = 0x00e,
361     SDR0_CFGDATA,
362     SDR0_STRP0 = 0x020,
363     SDR0_STRP1,
364     SDR0_102 = 0x66,
365     SDR0_103,
366     SDR0_128 = 0x80,
367     SDR0_ECID3 = 0x083,
368     SDR0_DDR0 = 0x0e1,
369     SDR0_USB0 = 0x320,
370 };
371 
372 enum {
373     PESDR0_LOOP = 0x303,
374     PESDR0_RCSSET,
375     PESDR0_RCSSTS,
376     PESDR0_RSTSTA = 0x310,
377     PESDR1_LOOP = 0x343,
378     PESDR1_RCSSET,
379     PESDR1_RCSSTS,
380     PESDR1_RSTSTA = 0x365,
381 };
382 
383 #define SDR0_DDR0_DDRM_ENCODE(n)  ((((unsigned long)(n)) & 0x03) << 29)
384 #define SDR0_DDR0_DDRM_DDR1       0x20000000
385 #define SDR0_DDR0_DDRM_DDR2       0x40000000
386 
387 static uint32_t dcr_read_sdr(void *opaque, int dcrn)
388 {
389     ppc4xx_sdr_t *sdr = opaque;
390     uint32_t ret = 0;
391 
392     switch (dcrn) {
393     case SDR0_CFGADDR:
394         ret = sdr->addr;
395         break;
396     case SDR0_CFGDATA:
397         switch (sdr->addr) {
398         case SDR0_STRP0:
399             ret = (0xb5 << 8) | (1 << 4) | 9;
400             break;
401         case SDR0_STRP1:
402             ret = (5 << 29) | (2 << 26) | (1 << 24);
403             break;
404         case SDR0_ECID3:
405             ret = 1 << 20; /* No Security/Kasumi support */
406             break;
407         case SDR0_DDR0:
408             ret = SDR0_DDR0_DDRM_ENCODE(1) | SDR0_DDR0_DDRM_DDR1;
409             break;
410         case PESDR0_RCSSET:
411         case PESDR1_RCSSET:
412             ret = (1 << 24) | (1 << 16);
413             break;
414         case PESDR0_RCSSTS:
415         case PESDR1_RCSSTS:
416             ret = (1 << 16) | (1 << 12);
417             break;
418         case PESDR0_RSTSTA:
419         case PESDR1_RSTSTA:
420             ret = 1;
421             break;
422         case PESDR0_LOOP:
423         case PESDR1_LOOP:
424             ret = 1 << 12;
425             break;
426         default:
427             break;
428         }
429         break;
430     default:
431         break;
432     }
433 
434     return ret;
435 }
436 
437 static void dcr_write_sdr(void *opaque, int dcrn, uint32_t val)
438 {
439     ppc4xx_sdr_t *sdr = opaque;
440 
441     switch (dcrn) {
442     case SDR0_CFGADDR:
443         sdr->addr = val;
444         break;
445     case SDR0_CFGDATA:
446         switch (sdr->addr) {
447         case 0x00: /* B0CR */
448             break;
449         default:
450             break;
451         }
452         break;
453     default:
454         break;
455     }
456 }
457 
458 static void sdr_reset(void *opaque)
459 {
460     ppc4xx_sdr_t *sdr = opaque;
461 
462     sdr->addr = 0;
463 }
464 
465 void ppc4xx_sdr_init(CPUPPCState *env)
466 {
467     ppc4xx_sdr_t *sdr;
468 
469     sdr = g_malloc0(sizeof(*sdr));
470     qemu_register_reset(&sdr_reset, sdr);
471     ppc_dcr_register(env, SDR0_CFGADDR,
472                      sdr, &dcr_read_sdr, &dcr_write_sdr);
473     ppc_dcr_register(env, SDR0_CFGDATA,
474                      sdr, &dcr_read_sdr, &dcr_write_sdr);
475     ppc_dcr_register(env, SDR0_102,
476                      sdr, &dcr_read_sdr, &dcr_write_sdr);
477     ppc_dcr_register(env, SDR0_103,
478                      sdr, &dcr_read_sdr, &dcr_write_sdr);
479     ppc_dcr_register(env, SDR0_128,
480                      sdr, &dcr_read_sdr, &dcr_write_sdr);
481     ppc_dcr_register(env, SDR0_USB0,
482                      sdr, &dcr_read_sdr, &dcr_write_sdr);
483 }
484 
485 /*****************************************************************************/
486 /* SDRAM controller */
487 enum {
488     SDRAM0_CFGADDR = 0x10,
489     SDRAM0_CFGDATA,
490     SDRAM_R0BAS = 0x40,
491     SDRAM_R1BAS,
492     SDRAM_R2BAS,
493     SDRAM_R3BAS,
494     SDRAM_CONF1HB = 0x45,
495     SDRAM_PLBADDULL = 0x4a,
496     SDRAM_CONF1LL = 0x4b,
497     SDRAM_CONFPATHB = 0x4f,
498     SDRAM_PLBADDUHB = 0x50,
499 };
500 
501 static uint32_t sdram_ddr2_bcr(hwaddr ram_base, hwaddr ram_size)
502 {
503     uint32_t bcr;
504 
505     switch (ram_size) {
506     case (8 * MiB):
507         bcr = 0xffc0;
508         break;
509     case (16 * MiB):
510         bcr = 0xff80;
511         break;
512     case (32 * MiB):
513         bcr = 0xff00;
514         break;
515     case (64 * MiB):
516         bcr = 0xfe00;
517         break;
518     case (128 * MiB):
519         bcr = 0xfc00;
520         break;
521     case (256 * MiB):
522         bcr = 0xf800;
523         break;
524     case (512 * MiB):
525         bcr = 0xf000;
526         break;
527     case (1 * GiB):
528         bcr = 0xe000;
529         break;
530     case (2 * GiB):
531         bcr = 0xc000;
532         break;
533     case (4 * GiB):
534         bcr = 0x8000;
535         break;
536     default:
537         error_report("invalid RAM size " TARGET_FMT_plx, ram_size);
538         return 0;
539     }
540     bcr |= ram_base >> 2 & 0xffe00000;
541     bcr |= 1;
542 
543     return bcr;
544 }
545 
546 static inline hwaddr sdram_ddr2_base(uint32_t bcr)
547 {
548     return (bcr & 0xffe00000) << 2;
549 }
550 
551 static uint64_t sdram_ddr2_size(uint32_t bcr)
552 {
553     uint64_t size;
554     int sh;
555 
556     sh = 1024 - ((bcr >> 6) & 0x3ff);
557     size = 8 * MiB * sh;
558 
559     return size;
560 }
561 
562 static void sdram_bank_map(Ppc4xxSdramBank *bank)
563 {
564     memory_region_init(&bank->container, NULL, "sdram-container", bank->size);
565     memory_region_add_subregion(&bank->container, 0, &bank->ram);
566     memory_region_add_subregion(get_system_memory(), bank->base,
567                                 &bank->container);
568 }
569 
570 static void sdram_bank_unmap(Ppc4xxSdramBank *bank)
571 {
572     memory_region_del_subregion(get_system_memory(), &bank->container);
573     memory_region_del_subregion(&bank->container, &bank->ram);
574     object_unparent(OBJECT(&bank->container));
575 }
576 
577 static void sdram_ddr2_set_bcr(Ppc4xxSdramDdr2State *sdram, int i,
578                                uint32_t bcr, int enabled)
579 {
580     if (sdram->bank[i].bcr & 1) {
581         /* First unmap RAM if enabled */
582         trace_ppc4xx_sdram_unmap(sdram_ddr2_base(sdram->bank[i].bcr),
583                                  sdram_ddr2_size(sdram->bank[i].bcr));
584         sdram_bank_unmap(&sdram->bank[i]);
585     }
586     sdram->bank[i].bcr = bcr & 0xffe0ffc1;
587     if (enabled && (bcr & 1)) {
588         trace_ppc4xx_sdram_map(sdram_ddr2_base(bcr), sdram_ddr2_size(bcr));
589         sdram_bank_map(&sdram->bank[i]);
590     }
591 }
592 
593 static void sdram_ddr2_map_bcr(Ppc4xxSdramDdr2State *sdram)
594 {
595     int i;
596 
597     for (i = 0; i < sdram->nbanks; i++) {
598         if (sdram->bank[i].size) {
599             sdram_ddr2_set_bcr(sdram, i,
600                                sdram_ddr2_bcr(sdram->bank[i].base,
601                                               sdram->bank[i].size), 1);
602         } else {
603             sdram_ddr2_set_bcr(sdram, i, 0, 0);
604         }
605     }
606 }
607 
608 static void sdram_ddr2_unmap_bcr(Ppc4xxSdramDdr2State *sdram)
609 {
610     int i;
611 
612     for (i = 0; i < sdram->nbanks; i++) {
613         if (sdram->bank[i].size) {
614             sdram_ddr2_set_bcr(sdram, i, sdram->bank[i].bcr & ~1, 0);
615         }
616     }
617 }
618 
619 static uint32_t sdram_ddr2_dcr_read(void *opaque, int dcrn)
620 {
621     Ppc4xxSdramDdr2State *sdram = opaque;
622     uint32_t ret = 0;
623 
624     switch (dcrn) {
625     case SDRAM_R0BAS:
626     case SDRAM_R1BAS:
627     case SDRAM_R2BAS:
628     case SDRAM_R3BAS:
629         if (sdram->bank[dcrn - SDRAM_R0BAS].size) {
630             ret = sdram_ddr2_bcr(sdram->bank[dcrn - SDRAM_R0BAS].base,
631                                  sdram->bank[dcrn - SDRAM_R0BAS].size);
632         }
633         break;
634     case SDRAM_CONF1HB:
635     case SDRAM_CONF1LL:
636     case SDRAM_CONFPATHB:
637     case SDRAM_PLBADDULL:
638     case SDRAM_PLBADDUHB:
639         break;
640     case SDRAM0_CFGADDR:
641         ret = sdram->addr;
642         break;
643     case SDRAM0_CFGDATA:
644         switch (sdram->addr) {
645         case 0x14: /* SDRAM_MCSTAT (405EX) */
646         case 0x1F:
647             ret = 0x80000000;
648             break;
649         case 0x21: /* SDRAM_MCOPT2 */
650             ret = sdram->mcopt2;
651             break;
652         case 0x40: /* SDRAM_MB0CF */
653             ret = 0x00008001;
654             break;
655         case 0x7A: /* SDRAM_DLCR */
656             ret = 0x02000000;
657             break;
658         case 0xE1: /* SDR0_DDR0 */
659             ret = SDR0_DDR0_DDRM_ENCODE(1) | SDR0_DDR0_DDRM_DDR1;
660             break;
661         default:
662             break;
663         }
664         break;
665     default:
666         break;
667     }
668 
669     return ret;
670 }
671 
672 #define SDRAM_DDR2_MCOPT2_DCEN BIT(27)
673 
674 static void sdram_ddr2_dcr_write(void *opaque, int dcrn, uint32_t val)
675 {
676     Ppc4xxSdramDdr2State *sdram = opaque;
677 
678     switch (dcrn) {
679     case SDRAM_R0BAS:
680     case SDRAM_R1BAS:
681     case SDRAM_R2BAS:
682     case SDRAM_R3BAS:
683     case SDRAM_CONF1HB:
684     case SDRAM_CONF1LL:
685     case SDRAM_CONFPATHB:
686     case SDRAM_PLBADDULL:
687     case SDRAM_PLBADDUHB:
688         break;
689     case SDRAM0_CFGADDR:
690         sdram->addr = val;
691         break;
692     case SDRAM0_CFGDATA:
693         switch (sdram->addr) {
694         case 0x00: /* B0CR */
695             break;
696         case 0x21: /* SDRAM_MCOPT2 */
697             if (!(sdram->mcopt2 & SDRAM_DDR2_MCOPT2_DCEN) &&
698                 (val & SDRAM_DDR2_MCOPT2_DCEN)) {
699                 trace_ppc4xx_sdram_enable("enable");
700                 /* validate all RAM mappings */
701                 sdram_ddr2_map_bcr(sdram);
702                 sdram->mcopt2 |= SDRAM_DDR2_MCOPT2_DCEN;
703             } else if ((sdram->mcopt2 & SDRAM_DDR2_MCOPT2_DCEN) &&
704                        !(val & SDRAM_DDR2_MCOPT2_DCEN)) {
705                 trace_ppc4xx_sdram_enable("disable");
706                 /* invalidate all RAM mappings */
707                 sdram_ddr2_unmap_bcr(sdram);
708                 sdram->mcopt2 &= ~SDRAM_DDR2_MCOPT2_DCEN;
709             }
710             break;
711         default:
712             break;
713         }
714         break;
715     default:
716         break;
717     }
718 }
719 
720 static void ppc4xx_sdram_ddr2_reset(DeviceState *dev)
721 {
722     Ppc4xxSdramDdr2State *sdram = PPC4xx_SDRAM_DDR2(dev);
723 
724     sdram->addr = 0;
725     sdram->mcopt2 = 0;
726 }
727 
728 static void ppc4xx_sdram_ddr2_realize(DeviceState *dev, Error **errp)
729 {
730     Ppc4xxSdramDdr2State *s = PPC4xx_SDRAM_DDR2(dev);
731     Ppc4xxDcrDeviceState *dcr = PPC4xx_DCR_DEVICE(dev);
732     /*
733      * SoC also has 4 GiB but that causes problem with 32 bit
734      * builds (4*GiB overflows the 32 bit ram_addr_t).
735      */
736     const ram_addr_t valid_bank_sizes[] = {
737         2 * GiB, 1 * GiB, 512 * MiB, 256 * MiB, 128 * MiB,
738         64 * MiB, 32 * MiB, 16 * MiB, 8 * MiB, 0
739     };
740 
741     if (s->nbanks < 1 || s->nbanks > 4) {
742         error_setg(errp, "Invalid number of RAM banks");
743         return;
744     }
745     if (!s->dram_mr) {
746         error_setg(errp, "Missing dram memory region");
747         return;
748     }
749     ppc4xx_sdram_banks(s->dram_mr, s->nbanks, s->bank, valid_bank_sizes);
750 
751     ppc4xx_dcr_register(dcr, SDRAM0_CFGADDR,
752                         s, &sdram_ddr2_dcr_read, &sdram_ddr2_dcr_write);
753     ppc4xx_dcr_register(dcr, SDRAM0_CFGDATA,
754                         s, &sdram_ddr2_dcr_read, &sdram_ddr2_dcr_write);
755 
756     ppc4xx_dcr_register(dcr, SDRAM_R0BAS,
757                         s, &sdram_ddr2_dcr_read, &sdram_ddr2_dcr_write);
758     ppc4xx_dcr_register(dcr, SDRAM_R1BAS,
759                         s, &sdram_ddr2_dcr_read, &sdram_ddr2_dcr_write);
760     ppc4xx_dcr_register(dcr, SDRAM_R2BAS,
761                         s, &sdram_ddr2_dcr_read, &sdram_ddr2_dcr_write);
762     ppc4xx_dcr_register(dcr, SDRAM_R3BAS,
763                         s, &sdram_ddr2_dcr_read, &sdram_ddr2_dcr_write);
764     ppc4xx_dcr_register(dcr, SDRAM_CONF1HB,
765                         s, &sdram_ddr2_dcr_read, &sdram_ddr2_dcr_write);
766     ppc4xx_dcr_register(dcr, SDRAM_PLBADDULL,
767                         s, &sdram_ddr2_dcr_read, &sdram_ddr2_dcr_write);
768     ppc4xx_dcr_register(dcr, SDRAM_CONF1LL,
769                         s, &sdram_ddr2_dcr_read, &sdram_ddr2_dcr_write);
770     ppc4xx_dcr_register(dcr, SDRAM_CONFPATHB,
771                         s, &sdram_ddr2_dcr_read, &sdram_ddr2_dcr_write);
772     ppc4xx_dcr_register(dcr, SDRAM_PLBADDUHB,
773                         s, &sdram_ddr2_dcr_read, &sdram_ddr2_dcr_write);
774 }
775 
776 static Property ppc4xx_sdram_ddr2_props[] = {
777     DEFINE_PROP_LINK("dram", Ppc4xxSdramDdr2State, dram_mr, TYPE_MEMORY_REGION,
778                      MemoryRegion *),
779     DEFINE_PROP_UINT32("nbanks", Ppc4xxSdramDdr2State, nbanks, 4),
780     DEFINE_PROP_END_OF_LIST(),
781 };
782 
783 static void ppc4xx_sdram_ddr2_class_init(ObjectClass *oc, void *data)
784 {
785     DeviceClass *dc = DEVICE_CLASS(oc);
786 
787     dc->realize = ppc4xx_sdram_ddr2_realize;
788     dc->reset = ppc4xx_sdram_ddr2_reset;
789     /* Reason: only works as function of a ppc4xx SoC */
790     dc->user_creatable = false;
791     device_class_set_props(dc, ppc4xx_sdram_ddr2_props);
792 }
793 
794 void ppc4xx_sdram_ddr2_enable(Ppc4xxSdramDdr2State *s)
795 {
796     sdram_ddr2_dcr_write(s, SDRAM0_CFGADDR, 0x21);
797     sdram_ddr2_dcr_write(s, SDRAM0_CFGDATA, 0x08000000);
798 }
799 
800 static const TypeInfo ppc4xx_types[] = {
801     {
802         .name           = TYPE_PPC4xx_SDRAM_DDR2,
803         .parent         = TYPE_PPC4xx_DCR_DEVICE,
804         .instance_size  = sizeof(Ppc4xxSdramDdr2State),
805         .class_init     = ppc4xx_sdram_ddr2_class_init,
806     }
807 };
808 DEFINE_TYPES(ppc4xx_types)
809 
810 /*****************************************************************************/
811 /* PLB to AHB bridge */
812 enum {
813     AHB_TOP    = 0xA4,
814     AHB_BOT    = 0xA5,
815 };
816 
817 typedef struct ppc4xx_ahb_t {
818     uint32_t top;
819     uint32_t bot;
820 } ppc4xx_ahb_t;
821 
822 static uint32_t dcr_read_ahb(void *opaque, int dcrn)
823 {
824     ppc4xx_ahb_t *ahb = opaque;
825     uint32_t ret = 0;
826 
827     switch (dcrn) {
828     case AHB_TOP:
829         ret = ahb->top;
830         break;
831     case AHB_BOT:
832         ret = ahb->bot;
833         break;
834     default:
835         break;
836     }
837 
838     return ret;
839 }
840 
841 static void dcr_write_ahb(void *opaque, int dcrn, uint32_t val)
842 {
843     ppc4xx_ahb_t *ahb = opaque;
844 
845     switch (dcrn) {
846     case AHB_TOP:
847         ahb->top = val;
848         break;
849     case AHB_BOT:
850         ahb->bot = val;
851         break;
852     }
853 }
854 
855 static void ppc4xx_ahb_reset(void *opaque)
856 {
857     ppc4xx_ahb_t *ahb = opaque;
858 
859     /* No error */
860     ahb->top = 0;
861     ahb->bot = 0;
862 }
863 
864 void ppc4xx_ahb_init(CPUPPCState *env)
865 {
866     ppc4xx_ahb_t *ahb;
867 
868     ahb = g_malloc0(sizeof(*ahb));
869     ppc_dcr_register(env, AHB_TOP, ahb, &dcr_read_ahb, &dcr_write_ahb);
870     ppc_dcr_register(env, AHB_BOT, ahb, &dcr_read_ahb, &dcr_write_ahb);
871     qemu_register_reset(ppc4xx_ahb_reset, ahb);
872 }
873 
874 /*****************************************************************************/
875 /* DMA controller */
876 
877 #define DMA0_CR_CE  (1 << 31)
878 #define DMA0_CR_PW  (1 << 26 | 1 << 25)
879 #define DMA0_CR_DAI (1 << 24)
880 #define DMA0_CR_SAI (1 << 23)
881 #define DMA0_CR_DEC (1 << 2)
882 
883 enum {
884     DMA0_CR  = 0x00,
885     DMA0_CT,
886     DMA0_SAH,
887     DMA0_SAL,
888     DMA0_DAH,
889     DMA0_DAL,
890     DMA0_SGH,
891     DMA0_SGL,
892 
893     DMA0_SR  = 0x20,
894     DMA0_SGC = 0x23,
895     DMA0_SLP = 0x25,
896     DMA0_POL = 0x26,
897 };
898 
899 typedef struct {
900     uint32_t cr;
901     uint32_t ct;
902     uint64_t sa;
903     uint64_t da;
904     uint64_t sg;
905 } PPC4xxDmaChnl;
906 
907 typedef struct {
908     int base;
909     PPC4xxDmaChnl ch[4];
910     uint32_t sr;
911 } PPC4xxDmaState;
912 
913 static uint32_t dcr_read_dma(void *opaque, int dcrn)
914 {
915     PPC4xxDmaState *dma = opaque;
916     uint32_t val = 0;
917     int addr = dcrn - dma->base;
918     int chnl = addr / 8;
919 
920     switch (addr) {
921     case 0x00 ... 0x1f:
922         switch (addr % 8) {
923         case DMA0_CR:
924             val = dma->ch[chnl].cr;
925             break;
926         case DMA0_CT:
927             val = dma->ch[chnl].ct;
928             break;
929         case DMA0_SAH:
930             val = dma->ch[chnl].sa >> 32;
931             break;
932         case DMA0_SAL:
933             val = dma->ch[chnl].sa;
934             break;
935         case DMA0_DAH:
936             val = dma->ch[chnl].da >> 32;
937             break;
938         case DMA0_DAL:
939             val = dma->ch[chnl].da;
940             break;
941         case DMA0_SGH:
942             val = dma->ch[chnl].sg >> 32;
943             break;
944         case DMA0_SGL:
945             val = dma->ch[chnl].sg;
946             break;
947         }
948         break;
949     case DMA0_SR:
950         val = dma->sr;
951         break;
952     default:
953         qemu_log_mask(LOG_UNIMP, "%s: unimplemented register %x (%d, %x)\n",
954                       __func__, dcrn, chnl, addr);
955     }
956 
957     return val;
958 }
959 
960 static void dcr_write_dma(void *opaque, int dcrn, uint32_t val)
961 {
962     PPC4xxDmaState *dma = opaque;
963     int addr = dcrn - dma->base;
964     int chnl = addr / 8;
965 
966     switch (addr) {
967     case 0x00 ... 0x1f:
968         switch (addr % 8) {
969         case DMA0_CR:
970             dma->ch[chnl].cr = val;
971             if (val & DMA0_CR_CE) {
972                 int count = dma->ch[chnl].ct & 0xffff;
973 
974                 if (count) {
975                     int width, i, sidx, didx;
976                     uint8_t *rptr, *wptr;
977                     hwaddr rlen, wlen;
978                     hwaddr xferlen;
979 
980                     sidx = didx = 0;
981                     width = 1 << ((val & DMA0_CR_PW) >> 25);
982                     xferlen = count * width;
983                     wlen = rlen = xferlen;
984                     rptr = cpu_physical_memory_map(dma->ch[chnl].sa, &rlen,
985                                                    false);
986                     wptr = cpu_physical_memory_map(dma->ch[chnl].da, &wlen,
987                                                    true);
988                     if (rptr && rlen == xferlen && wptr && wlen == xferlen) {
989                         if (!(val & DMA0_CR_DEC) &&
990                             val & DMA0_CR_SAI && val & DMA0_CR_DAI) {
991                             /* optimise common case */
992                             memmove(wptr, rptr, count * width);
993                             sidx = didx = count * width;
994                         } else {
995                             /* do it the slow way */
996                             for (sidx = didx = i = 0; i < count; i++) {
997                                 uint64_t v = ldn_le_p(rptr + sidx, width);
998                                 stn_le_p(wptr + didx, width, v);
999                                 if (val & DMA0_CR_SAI) {
1000                                     sidx += width;
1001                                 }
1002                                 if (val & DMA0_CR_DAI) {
1003                                     didx += width;
1004                                 }
1005                             }
1006                         }
1007                     }
1008                     if (wptr) {
1009                         cpu_physical_memory_unmap(wptr, wlen, 1, didx);
1010                     }
1011                     if (rptr) {
1012                         cpu_physical_memory_unmap(rptr, rlen, 0, sidx);
1013                     }
1014                 }
1015             }
1016             break;
1017         case DMA0_CT:
1018             dma->ch[chnl].ct = val;
1019             break;
1020         case DMA0_SAH:
1021             dma->ch[chnl].sa &= 0xffffffffULL;
1022             dma->ch[chnl].sa |= (uint64_t)val << 32;
1023             break;
1024         case DMA0_SAL:
1025             dma->ch[chnl].sa &= 0xffffffff00000000ULL;
1026             dma->ch[chnl].sa |= val;
1027             break;
1028         case DMA0_DAH:
1029             dma->ch[chnl].da &= 0xffffffffULL;
1030             dma->ch[chnl].da |= (uint64_t)val << 32;
1031             break;
1032         case DMA0_DAL:
1033             dma->ch[chnl].da &= 0xffffffff00000000ULL;
1034             dma->ch[chnl].da |= val;
1035             break;
1036         case DMA0_SGH:
1037             dma->ch[chnl].sg &= 0xffffffffULL;
1038             dma->ch[chnl].sg |= (uint64_t)val << 32;
1039             break;
1040         case DMA0_SGL:
1041             dma->ch[chnl].sg &= 0xffffffff00000000ULL;
1042             dma->ch[chnl].sg |= val;
1043             break;
1044         }
1045         break;
1046     case DMA0_SR:
1047         dma->sr &= ~val;
1048         break;
1049     default:
1050         qemu_log_mask(LOG_UNIMP, "%s: unimplemented register %x (%d, %x)\n",
1051                       __func__, dcrn, chnl, addr);
1052     }
1053 }
1054 
1055 static void ppc4xx_dma_reset(void *opaque)
1056 {
1057     PPC4xxDmaState *dma = opaque;
1058     int dma_base = dma->base;
1059 
1060     memset(dma, 0, sizeof(*dma));
1061     dma->base = dma_base;
1062 }
1063 
1064 void ppc4xx_dma_init(CPUPPCState *env, int dcr_base)
1065 {
1066     PPC4xxDmaState *dma;
1067     int i;
1068 
1069     dma = g_malloc0(sizeof(*dma));
1070     dma->base = dcr_base;
1071     qemu_register_reset(&ppc4xx_dma_reset, dma);
1072     for (i = 0; i < 4; i++) {
1073         ppc_dcr_register(env, dcr_base + i * 8 + DMA0_CR,
1074                          dma, &dcr_read_dma, &dcr_write_dma);
1075         ppc_dcr_register(env, dcr_base + i * 8 + DMA0_CT,
1076                          dma, &dcr_read_dma, &dcr_write_dma);
1077         ppc_dcr_register(env, dcr_base + i * 8 + DMA0_SAH,
1078                          dma, &dcr_read_dma, &dcr_write_dma);
1079         ppc_dcr_register(env, dcr_base + i * 8 + DMA0_SAL,
1080                          dma, &dcr_read_dma, &dcr_write_dma);
1081         ppc_dcr_register(env, dcr_base + i * 8 + DMA0_DAH,
1082                          dma, &dcr_read_dma, &dcr_write_dma);
1083         ppc_dcr_register(env, dcr_base + i * 8 + DMA0_DAL,
1084                          dma, &dcr_read_dma, &dcr_write_dma);
1085         ppc_dcr_register(env, dcr_base + i * 8 + DMA0_SGH,
1086                          dma, &dcr_read_dma, &dcr_write_dma);
1087         ppc_dcr_register(env, dcr_base + i * 8 + DMA0_SGL,
1088                          dma, &dcr_read_dma, &dcr_write_dma);
1089     }
1090     ppc_dcr_register(env, dcr_base + DMA0_SR,
1091                      dma, &dcr_read_dma, &dcr_write_dma);
1092     ppc_dcr_register(env, dcr_base + DMA0_SGC,
1093                      dma, &dcr_read_dma, &dcr_write_dma);
1094     ppc_dcr_register(env, dcr_base + DMA0_SLP,
1095                      dma, &dcr_read_dma, &dcr_write_dma);
1096     ppc_dcr_register(env, dcr_base + DMA0_POL,
1097                      dma, &dcr_read_dma, &dcr_write_dma);
1098 }
1099 
1100 /*****************************************************************************/
1101 /* PCI Express controller */
1102 /*
1103  * FIXME: This is not complete and does not work, only implemented partially
1104  * to allow firmware and guests to find an empty bus. Cards should use PCI.
1105  */
1106 #include "hw/pci/pcie_host.h"
1107 
1108 #define TYPE_PPC460EX_PCIE_HOST "ppc460ex-pcie-host"
1109 OBJECT_DECLARE_SIMPLE_TYPE(PPC460EXPCIEState, PPC460EX_PCIE_HOST)
1110 
1111 struct PPC460EXPCIEState {
1112     PCIExpressHost host;
1113 
1114     MemoryRegion iomem;
1115     qemu_irq irq[4];
1116     int32_t dcrn_base;
1117 
1118     uint64_t cfg_base;
1119     uint32_t cfg_mask;
1120     uint64_t msg_base;
1121     uint32_t msg_mask;
1122     uint64_t omr1_base;
1123     uint64_t omr1_mask;
1124     uint64_t omr2_base;
1125     uint64_t omr2_mask;
1126     uint64_t omr3_base;
1127     uint64_t omr3_mask;
1128     uint64_t reg_base;
1129     uint32_t reg_mask;
1130     uint32_t special;
1131     uint32_t cfg;
1132 };
1133 
1134 #define DCRN_PCIE0_BASE 0x100
1135 #define DCRN_PCIE1_BASE 0x120
1136 
1137 enum {
1138     PEGPL_CFGBAH = 0x0,
1139     PEGPL_CFGBAL,
1140     PEGPL_CFGMSK,
1141     PEGPL_MSGBAH,
1142     PEGPL_MSGBAL,
1143     PEGPL_MSGMSK,
1144     PEGPL_OMR1BAH,
1145     PEGPL_OMR1BAL,
1146     PEGPL_OMR1MSKH,
1147     PEGPL_OMR1MSKL,
1148     PEGPL_OMR2BAH,
1149     PEGPL_OMR2BAL,
1150     PEGPL_OMR2MSKH,
1151     PEGPL_OMR2MSKL,
1152     PEGPL_OMR3BAH,
1153     PEGPL_OMR3BAL,
1154     PEGPL_OMR3MSKH,
1155     PEGPL_OMR3MSKL,
1156     PEGPL_REGBAH,
1157     PEGPL_REGBAL,
1158     PEGPL_REGMSK,
1159     PEGPL_SPECIAL,
1160     PEGPL_CFG,
1161 };
1162 
1163 static uint32_t dcr_read_pcie(void *opaque, int dcrn)
1164 {
1165     PPC460EXPCIEState *state = opaque;
1166     uint32_t ret = 0;
1167 
1168     switch (dcrn - state->dcrn_base) {
1169     case PEGPL_CFGBAH:
1170         ret = state->cfg_base >> 32;
1171         break;
1172     case PEGPL_CFGBAL:
1173         ret = state->cfg_base;
1174         break;
1175     case PEGPL_CFGMSK:
1176         ret = state->cfg_mask;
1177         break;
1178     case PEGPL_MSGBAH:
1179         ret = state->msg_base >> 32;
1180         break;
1181     case PEGPL_MSGBAL:
1182         ret = state->msg_base;
1183         break;
1184     case PEGPL_MSGMSK:
1185         ret = state->msg_mask;
1186         break;
1187     case PEGPL_OMR1BAH:
1188         ret = state->omr1_base >> 32;
1189         break;
1190     case PEGPL_OMR1BAL:
1191         ret = state->omr1_base;
1192         break;
1193     case PEGPL_OMR1MSKH:
1194         ret = state->omr1_mask >> 32;
1195         break;
1196     case PEGPL_OMR1MSKL:
1197         ret = state->omr1_mask;
1198         break;
1199     case PEGPL_OMR2BAH:
1200         ret = state->omr2_base >> 32;
1201         break;
1202     case PEGPL_OMR2BAL:
1203         ret = state->omr2_base;
1204         break;
1205     case PEGPL_OMR2MSKH:
1206         ret = state->omr2_mask >> 32;
1207         break;
1208     case PEGPL_OMR2MSKL:
1209         ret = state->omr3_mask;
1210         break;
1211     case PEGPL_OMR3BAH:
1212         ret = state->omr3_base >> 32;
1213         break;
1214     case PEGPL_OMR3BAL:
1215         ret = state->omr3_base;
1216         break;
1217     case PEGPL_OMR3MSKH:
1218         ret = state->omr3_mask >> 32;
1219         break;
1220     case PEGPL_OMR3MSKL:
1221         ret = state->omr3_mask;
1222         break;
1223     case PEGPL_REGBAH:
1224         ret = state->reg_base >> 32;
1225         break;
1226     case PEGPL_REGBAL:
1227         ret = state->reg_base;
1228         break;
1229     case PEGPL_REGMSK:
1230         ret = state->reg_mask;
1231         break;
1232     case PEGPL_SPECIAL:
1233         ret = state->special;
1234         break;
1235     case PEGPL_CFG:
1236         ret = state->cfg;
1237         break;
1238     }
1239 
1240     return ret;
1241 }
1242 
1243 static void dcr_write_pcie(void *opaque, int dcrn, uint32_t val)
1244 {
1245     PPC460EXPCIEState *s = opaque;
1246     uint64_t size;
1247 
1248     switch (dcrn - s->dcrn_base) {
1249     case PEGPL_CFGBAH:
1250         s->cfg_base = ((uint64_t)val << 32) | (s->cfg_base & 0xffffffff);
1251         break;
1252     case PEGPL_CFGBAL:
1253         s->cfg_base = (s->cfg_base & 0xffffffff00000000ULL) | val;
1254         break;
1255     case PEGPL_CFGMSK:
1256         s->cfg_mask = val;
1257         size = ~(val & 0xfffffffe) + 1;
1258         /*
1259          * Firmware sets this register to E0000001. Why we are not sure,
1260          * but the current guess is anything above PCIE_MMCFG_SIZE_MAX is
1261          * ignored.
1262          */
1263         if (size > PCIE_MMCFG_SIZE_MAX) {
1264             size = PCIE_MMCFG_SIZE_MAX;
1265         }
1266         pcie_host_mmcfg_update(PCIE_HOST_BRIDGE(s), val & 1, s->cfg_base, size);
1267         break;
1268     case PEGPL_MSGBAH:
1269         s->msg_base = ((uint64_t)val << 32) | (s->msg_base & 0xffffffff);
1270         break;
1271     case PEGPL_MSGBAL:
1272         s->msg_base = (s->msg_base & 0xffffffff00000000ULL) | val;
1273         break;
1274     case PEGPL_MSGMSK:
1275         s->msg_mask = val;
1276         break;
1277     case PEGPL_OMR1BAH:
1278         s->omr1_base = ((uint64_t)val << 32) | (s->omr1_base & 0xffffffff);
1279         break;
1280     case PEGPL_OMR1BAL:
1281         s->omr1_base = (s->omr1_base & 0xffffffff00000000ULL) | val;
1282         break;
1283     case PEGPL_OMR1MSKH:
1284         s->omr1_mask = ((uint64_t)val << 32) | (s->omr1_mask & 0xffffffff);
1285         break;
1286     case PEGPL_OMR1MSKL:
1287         s->omr1_mask = (s->omr1_mask & 0xffffffff00000000ULL) | val;
1288         break;
1289     case PEGPL_OMR2BAH:
1290         s->omr2_base = ((uint64_t)val << 32) | (s->omr2_base & 0xffffffff);
1291         break;
1292     case PEGPL_OMR2BAL:
1293         s->omr2_base = (s->omr2_base & 0xffffffff00000000ULL) | val;
1294         break;
1295     case PEGPL_OMR2MSKH:
1296         s->omr2_mask = ((uint64_t)val << 32) | (s->omr2_mask & 0xffffffff);
1297         break;
1298     case PEGPL_OMR2MSKL:
1299         s->omr2_mask = (s->omr2_mask & 0xffffffff00000000ULL) | val;
1300         break;
1301     case PEGPL_OMR3BAH:
1302         s->omr3_base = ((uint64_t)val << 32) | (s->omr3_base & 0xffffffff);
1303         break;
1304     case PEGPL_OMR3BAL:
1305         s->omr3_base = (s->omr3_base & 0xffffffff00000000ULL) | val;
1306         break;
1307     case PEGPL_OMR3MSKH:
1308         s->omr3_mask = ((uint64_t)val << 32) | (s->omr3_mask & 0xffffffff);
1309         break;
1310     case PEGPL_OMR3MSKL:
1311         s->omr3_mask = (s->omr3_mask & 0xffffffff00000000ULL) | val;
1312         break;
1313     case PEGPL_REGBAH:
1314         s->reg_base = ((uint64_t)val << 32) | (s->reg_base & 0xffffffff);
1315         break;
1316     case PEGPL_REGBAL:
1317         s->reg_base = (s->reg_base & 0xffffffff00000000ULL) | val;
1318         break;
1319     case PEGPL_REGMSK:
1320         s->reg_mask = val;
1321         /* FIXME: how is size encoded? */
1322         size = (val == 0x7001 ? 4096 : ~(val & 0xfffffffe) + 1);
1323         break;
1324     case PEGPL_SPECIAL:
1325         s->special = val;
1326         break;
1327     case PEGPL_CFG:
1328         s->cfg = val;
1329         break;
1330     }
1331 }
1332 
1333 static void ppc460ex_set_irq(void *opaque, int irq_num, int level)
1334 {
1335        PPC460EXPCIEState *s = opaque;
1336        qemu_set_irq(s->irq[irq_num], level);
1337 }
1338 
1339 static void ppc460ex_pcie_realize(DeviceState *dev, Error **errp)
1340 {
1341     PPC460EXPCIEState *s = PPC460EX_PCIE_HOST(dev);
1342     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
1343     int i, id;
1344     char buf[16];
1345 
1346     switch (s->dcrn_base) {
1347     case DCRN_PCIE0_BASE:
1348         id = 0;
1349         break;
1350     case DCRN_PCIE1_BASE:
1351         id = 1;
1352         break;
1353     default:
1354         error_setg(errp, "invalid PCIe DCRN base");
1355         return;
1356     }
1357     snprintf(buf, sizeof(buf), "pcie%d-io", id);
1358     memory_region_init(&s->iomem, OBJECT(s), buf, UINT64_MAX);
1359     for (i = 0; i < 4; i++) {
1360         sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq[i]);
1361     }
1362     snprintf(buf, sizeof(buf), "pcie.%d", id);
1363     pci->bus = pci_register_root_bus(DEVICE(s), buf, ppc460ex_set_irq,
1364                                 pci_swizzle_map_irq_fn, s, &s->iomem,
1365                                 get_system_io(), 0, 4, TYPE_PCIE_BUS);
1366 }
1367 
1368 static Property ppc460ex_pcie_props[] = {
1369     DEFINE_PROP_INT32("dcrn-base", PPC460EXPCIEState, dcrn_base, -1),
1370     DEFINE_PROP_END_OF_LIST(),
1371 };
1372 
1373 static void ppc460ex_pcie_class_init(ObjectClass *klass, void *data)
1374 {
1375     DeviceClass *dc = DEVICE_CLASS(klass);
1376 
1377     set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
1378     dc->realize = ppc460ex_pcie_realize;
1379     device_class_set_props(dc, ppc460ex_pcie_props);
1380     dc->hotpluggable = false;
1381 }
1382 
1383 static const TypeInfo ppc460ex_pcie_host_info = {
1384     .name = TYPE_PPC460EX_PCIE_HOST,
1385     .parent = TYPE_PCIE_HOST_BRIDGE,
1386     .instance_size = sizeof(PPC460EXPCIEState),
1387     .class_init = ppc460ex_pcie_class_init,
1388 };
1389 
1390 static void ppc460ex_pcie_register(void)
1391 {
1392     type_register_static(&ppc460ex_pcie_host_info);
1393 }
1394 
1395 type_init(ppc460ex_pcie_register)
1396 
1397 static void ppc460ex_pcie_register_dcrs(PPC460EXPCIEState *s, CPUPPCState *env)
1398 {
1399     ppc_dcr_register(env, s->dcrn_base + PEGPL_CFGBAH, s,
1400                      &dcr_read_pcie, &dcr_write_pcie);
1401     ppc_dcr_register(env, s->dcrn_base + PEGPL_CFGBAL, s,
1402                      &dcr_read_pcie, &dcr_write_pcie);
1403     ppc_dcr_register(env, s->dcrn_base + PEGPL_CFGMSK, s,
1404                      &dcr_read_pcie, &dcr_write_pcie);
1405     ppc_dcr_register(env, s->dcrn_base + PEGPL_MSGBAH, s,
1406                      &dcr_read_pcie, &dcr_write_pcie);
1407     ppc_dcr_register(env, s->dcrn_base + PEGPL_MSGBAL, s,
1408                      &dcr_read_pcie, &dcr_write_pcie);
1409     ppc_dcr_register(env, s->dcrn_base + PEGPL_MSGMSK, s,
1410                      &dcr_read_pcie, &dcr_write_pcie);
1411     ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR1BAH, s,
1412                      &dcr_read_pcie, &dcr_write_pcie);
1413     ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR1BAL, s,
1414                      &dcr_read_pcie, &dcr_write_pcie);
1415     ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR1MSKH, s,
1416                      &dcr_read_pcie, &dcr_write_pcie);
1417     ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR1MSKL, s,
1418                      &dcr_read_pcie, &dcr_write_pcie);
1419     ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR2BAH, s,
1420                      &dcr_read_pcie, &dcr_write_pcie);
1421     ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR2BAL, s,
1422                      &dcr_read_pcie, &dcr_write_pcie);
1423     ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR2MSKH, s,
1424                      &dcr_read_pcie, &dcr_write_pcie);
1425     ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR2MSKL, s,
1426                      &dcr_read_pcie, &dcr_write_pcie);
1427     ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR3BAH, s,
1428                      &dcr_read_pcie, &dcr_write_pcie);
1429     ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR3BAL, s,
1430                      &dcr_read_pcie, &dcr_write_pcie);
1431     ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR3MSKH, s,
1432                      &dcr_read_pcie, &dcr_write_pcie);
1433     ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR3MSKL, s,
1434                      &dcr_read_pcie, &dcr_write_pcie);
1435     ppc_dcr_register(env, s->dcrn_base + PEGPL_REGBAH, s,
1436                      &dcr_read_pcie, &dcr_write_pcie);
1437     ppc_dcr_register(env, s->dcrn_base + PEGPL_REGBAL, s,
1438                      &dcr_read_pcie, &dcr_write_pcie);
1439     ppc_dcr_register(env, s->dcrn_base + PEGPL_REGMSK, s,
1440                      &dcr_read_pcie, &dcr_write_pcie);
1441     ppc_dcr_register(env, s->dcrn_base + PEGPL_SPECIAL, s,
1442                      &dcr_read_pcie, &dcr_write_pcie);
1443     ppc_dcr_register(env, s->dcrn_base + PEGPL_CFG, s,
1444                      &dcr_read_pcie, &dcr_write_pcie);
1445 }
1446 
1447 void ppc460ex_pcie_init(CPUPPCState *env)
1448 {
1449     DeviceState *dev;
1450 
1451     dev = qdev_new(TYPE_PPC460EX_PCIE_HOST);
1452     qdev_prop_set_int32(dev, "dcrn-base", DCRN_PCIE0_BASE);
1453     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
1454     ppc460ex_pcie_register_dcrs(PPC460EX_PCIE_HOST(dev), env);
1455 
1456     dev = qdev_new(TYPE_PPC460EX_PCIE_HOST);
1457     qdev_prop_set_int32(dev, "dcrn-base", DCRN_PCIE1_BASE);
1458     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
1459     ppc460ex_pcie_register_dcrs(PPC460EX_PCIE_HOST(dev), env);
1460 }
1461