hw/intc/openpic.c

   1 /*
   2  * OpenPIC emulation
   3  *
   4  * Copyright (c) 2004 Jocelyn Mayer
   5  *               2011 Alexander Graf
   6  *
   7  * Permission is hereby granted, free of charge, to any person obtaining a copy
   8  * of this software and associated documentation files (the "Software"), to deal
   9  * in the Software without restriction, including without limitation the rights
  10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11  * copies of the Software, and to permit persons to whom the Software is
  12  * furnished to do so, subject to the following conditions:
  13  *
  14  * The above copyright notice and this permission notice shall be included in
  15  * all copies or substantial portions of the Software.
  16  *
  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23  * THE SOFTWARE.
  24  */
  25 /*
  26  *
  27  * Based on OpenPic implementations:
  28  * - Intel GW80314 I/O companion chip developer's manual
  29  * - Motorola MPC8245 & MPC8540 user manuals.
  30  * - Motorola MCP750 (aka Raven) programmer manual.
  31  * - Motorola Harrier programmer manuel
  32  *
  33  * Serial interrupts, as implemented in Raven chipset are not supported yet.
  34  *
  35  */
  36 #include "hw/hw.h"
  37 #include "hw/ppc/mac.h"
  38 #include "hw/pci/pci.h"
  39 #include "hw/ppc/openpic.h"
  40 #include "hw/ppc/ppc_e500.h"
  41 #include "hw/sysbus.h"
  42 #include "hw/pci/msi.h"
  43 #include "qemu/bitops.h"
  44 #include "qapi/qmp/qerror.h"
  45
  46 //#define DEBUG_OPENPIC
  47
  48 #ifdef DEBUG_OPENPIC
  49 static const int debug_openpic = 1;
  50 #else
  51 static const int debug_openpic = 0;
  52 #endif
  53
  54 #define DPRINTF(fmt, ...) do { \
  55         if (debug_openpic) { \
  56             printf(fmt , ## __VA_ARGS__); \
  57         } \
  58     } while (0)
  59
  60 #define MAX_CPU     32
  61 #define MAX_MSI     8
  62 #define VID         0x03 /* MPIC version ID */
  63
  64 /* OpenPIC capability flags */
  65 #define OPENPIC_FLAG_IDR_CRIT     (1 << 0)
  66 #define OPENPIC_FLAG_ILR          (2 << 0)
  67
  68 /* OpenPIC address map */
  69 #define OPENPIC_GLB_REG_START        0x0
  70 #define OPENPIC_GLB_REG_SIZE         0x10F0
  71 #define OPENPIC_TMR_REG_START        0x10F0
  72 #define OPENPIC_TMR_REG_SIZE         0x220
  73 #define OPENPIC_MSI_REG_START        0x1600
  74 #define OPENPIC_MSI_REG_SIZE         0x200
  75 #define OPENPIC_SUMMARY_REG_START   0x3800
  76 #define OPENPIC_SUMMARY_REG_SIZE    0x800
  77 #define OPENPIC_SRC_REG_START        0x10000
  78 #define OPENPIC_SRC_REG_SIZE         (OPENPIC_MAX_SRC * 0x20)
  79 #define OPENPIC_CPU_REG_START        0x20000
  80 #define OPENPIC_CPU_REG_SIZE         0x100 + ((MAX_CPU - 1) * 0x1000)
  81
  82 /* Raven */
  83 #define RAVEN_MAX_CPU      2
  84 #define RAVEN_MAX_EXT     48
  85 #define RAVEN_MAX_IRQ     64
  86 #define RAVEN_MAX_TMR      OPENPIC_MAX_TMR
  87 #define RAVEN_MAX_IPI      OPENPIC_MAX_IPI
  88
  89 /* Interrupt definitions */
  90 #define RAVEN_FE_IRQ     (RAVEN_MAX_EXT)     /* Internal functional IRQ */
  91 #define RAVEN_ERR_IRQ    (RAVEN_MAX_EXT + 1) /* Error IRQ */
  92 #define RAVEN_TMR_IRQ    (RAVEN_MAX_EXT + 2) /* First timer IRQ */
  93 #define RAVEN_IPI_IRQ    (RAVEN_TMR_IRQ + RAVEN_MAX_TMR) /* First IPI IRQ */
  94 /* First doorbell IRQ */
  95 #define RAVEN_DBL_IRQ    (RAVEN_IPI_IRQ + (RAVEN_MAX_CPU * RAVEN_MAX_IPI))
  96
  97 typedef struct FslMpicInfo {
  98     int max_ext;
  99 } FslMpicInfo;
 100
 101 static FslMpicInfo fsl_mpic_20 = {
 102     .max_ext = 12,
 103 };
 104
 105 static FslMpicInfo fsl_mpic_42 = {
 106     .max_ext = 12,
 107 };
 108
 109 #define FRR_NIRQ_SHIFT    16
 110 #define FRR_NCPU_SHIFT     8
 111 #define FRR_VID_SHIFT      0
 112
 113 #define VID_REVISION_1_2   2
 114 #define VID_REVISION_1_3   3
 115
 116 #define VIR_GENERIC      0x00000000 /* Generic Vendor ID */
 117
 118 #define GCR_RESET        0x80000000
 119 #define GCR_MODE_PASS    0x00000000
 120 #define GCR_MODE_MIXED   0x20000000
 121 #define GCR_MODE_PROXY   0x60000000
 122
 123 #define TBCR_CI           0x80000000 /* count inhibit */
 124 #define TCCR_TOG          0x80000000 /* toggles when decrement to zero */
 125
 126 #define IDR_EP_SHIFT      31
 127 #define IDR_EP_MASK       (1U << IDR_EP_SHIFT)
 128 #define IDR_CI0_SHIFT     30
 129 #define IDR_CI1_SHIFT     29
 130 #define IDR_P1_SHIFT      1
 131 #define IDR_P0_SHIFT      0
 132
 133 #define ILR_INTTGT_MASK   0x000000ff
 134 #define ILR_INTTGT_INT    0x00
 135 #define ILR_INTTGT_CINT   0x01 /* critical */
 136 #define ILR_INTTGT_MCP    0x02 /* machine check */
 137
 138 /* The currently supported INTTGT values happen to be the same as QEMU's
 139  * openpic output codes, but don't depend on this.  The output codes
 140  * could change (unlikely, but...) or support could be added for
 141  * more INTTGT values.
 142  */
 143 static const int inttgt_output[][2] = {
 144     { ILR_INTTGT_INT, OPENPIC_OUTPUT_INT },
 145     { ILR_INTTGT_CINT, OPENPIC_OUTPUT_CINT },
 146     { ILR_INTTGT_MCP, OPENPIC_OUTPUT_MCK },
 147 };
 148
 149 static int inttgt_to_output(int inttgt)
 150 {
 151     int i;
 152
 153     for (i = 0; i < ARRAY_SIZE(inttgt_output); i++) {
 154         if (inttgt_output[i][0] == inttgt) {
 155             return inttgt_output[i][1];
 156         }
 157     }
 158
 159     fprintf(stderr, "%s: unsupported inttgt %d\n", __func__, inttgt);
 160     return OPENPIC_OUTPUT_INT;
 161 }
 162
 163 static int output_to_inttgt(int output)
 164 {
 165     int i;
 166
 167     for (i = 0; i < ARRAY_SIZE(inttgt_output); i++) {
 168         if (inttgt_output[i][1] == output) {
 169             return inttgt_output[i][0];
 170         }
 171     }
 172
 173     abort();
 174 }
 175
 176 #define MSIIR_OFFSET       0x140
 177 #define MSIIR_SRS_SHIFT    29
 178 #define MSIIR_SRS_MASK     (0x7 << MSIIR_SRS_SHIFT)
 179 #define MSIIR_IBS_SHIFT    24
 180 #define MSIIR_IBS_MASK     (0x1f << MSIIR_IBS_SHIFT)
 181
 182 static int get_current_cpu(void)
 183 {
 184     if (!current_cpu) {
 185         return -1;
 186     }
 187
 188     return current_cpu->cpu_index;
 189 }
 190
 191 static uint32_t openpic_cpu_read_internal(void *opaque, hwaddr addr,
 192                                           int idx);
 193 static void openpic_cpu_write_internal(void *opaque, hwaddr addr,
 194                                        uint32_t val, int idx);
 195 static void openpic_reset(DeviceState *d);
 196
 197 typedef enum IRQType {
 198     IRQ_TYPE_NORMAL = 0,
 199     IRQ_TYPE_FSLINT,        /* FSL internal interrupt -- level only */
 200     IRQ_TYPE_FSLSPECIAL,    /* FSL timer/IPI interrupt, edge, no polarity */
 201 } IRQType;
 202
 203 /* Round up to the nearest 64 IRQs so that the queue length
 204  * won't change when moving between 32 and 64 bit hosts.
 205  */
 206 #define IRQQUEUE_SIZE_BITS ((OPENPIC_MAX_IRQ + 63) & ~63)
 207
 208 typedef struct IRQQueue {
 209     unsigned long *queue;
 210     int32_t queue_size; /* Only used for VMSTATE_BITMAP */
 211     int next;
 212     int priority;
 213 } IRQQueue;
 214
 215 typedef struct IRQSource {
 216     uint32_t ivpr;  /* IRQ vector/priority register */
 217     uint32_t idr;   /* IRQ destination register */
 218     uint32_t destmask; /* bitmap of CPU destinations */
 219     int last_cpu;
 220     int output;     /* IRQ level, e.g. OPENPIC_OUTPUT_INT */
 221     int pending;    /* TRUE if IRQ is pending */
 222     IRQType type;
 223     bool level:1;   /* level-triggered */
 224     bool nomask:1;  /* critical interrupts ignore mask on some FSL MPICs */
 225 } IRQSource;
 226
 227 #define IVPR_MASK_SHIFT       31
 228 #define IVPR_MASK_MASK        (1U << IVPR_MASK_SHIFT)
 229 #define IVPR_ACTIVITY_SHIFT   30
 230 #define IVPR_ACTIVITY_MASK    (1U << IVPR_ACTIVITY_SHIFT)
 231 #define IVPR_MODE_SHIFT       29
 232 #define IVPR_MODE_MASK        (1U << IVPR_MODE_SHIFT)
 233 #define IVPR_POLARITY_SHIFT   23
 234 #define IVPR_POLARITY_MASK    (1U << IVPR_POLARITY_SHIFT)
 235 #define IVPR_SENSE_SHIFT      22
 236 #define IVPR_SENSE_MASK       (1U << IVPR_SENSE_SHIFT)
 237
 238 #define IVPR_PRIORITY_MASK     (0xFU << 16)
 239 #define IVPR_PRIORITY(_ivprr_) ((int)(((_ivprr_) & IVPR_PRIORITY_MASK) >> 16))
 240 #define IVPR_VECTOR(opp, _ivprr_) ((_ivprr_) & (opp)->vector_mask)
 241
 242 /* IDR[EP/CI] are only for FSL MPIC prior to v4.0 */
 243 #define IDR_EP      0x80000000  /* external pin */
 244 #define IDR_CI      0x40000000  /* critical interrupt */
 245
 246 typedef struct OpenPICTimer {
 247     uint32_t tccr;  /* Global timer current count register */
 248     uint32_t tbcr;  /* Global timer base count register */
 249 } OpenPICTimer;
 250
 251 typedef struct OpenPICMSI {
 252     uint32_t msir;   /* Shared Message Signaled Interrupt Register */
 253 } OpenPICMSI;
 254
 255 typedef struct IRQDest {
 256     int32_t ctpr; /* CPU current task priority */
 257     IRQQueue raised;
 258     IRQQueue servicing;
 259     qemu_irq *irqs;
 260
 261     /* Count of IRQ sources asserting on non-INT outputs */
 262     uint32_t outputs_active[OPENPIC_OUTPUT_NB];
 263 } IRQDest;
 264
 265 #define OPENPIC(obj) OBJECT_CHECK(OpenPICState, (obj), TYPE_OPENPIC)
 266
 267 typedef struct OpenPICState {
 268     /*< private >*/
 269     SysBusDevice parent_obj;
 270     /*< public >*/
 271
 272     MemoryRegion mem;
 273
 274     /* Behavior control */
 275     FslMpicInfo *fsl;
 276     uint32_t model;
 277     uint32_t flags;
 278     uint32_t nb_irqs;
 279     uint32_t vid;
 280     uint32_t vir; /* Vendor identification register */
 281     uint32_t vector_mask;
 282     uint32_t tfrr_reset;
 283     uint32_t ivpr_reset;
 284     uint32_t idr_reset;
 285     uint32_t brr1;
 286     uint32_t mpic_mode_mask;
 287
 288     /* Sub-regions */
 289     MemoryRegion sub_io_mem[6];
 290
 291     /* Global registers */
 292     uint32_t frr; /* Feature reporting register */
 293     uint32_t gcr; /* Global configuration register  */
 294     uint32_t pir; /* Processor initialization register */
 295     uint32_t spve; /* Spurious vector register */
 296     uint32_t tfrr; /* Timer frequency reporting register */
 297     /* Source registers */
 298     IRQSource src[OPENPIC_MAX_IRQ];
 299     /* Local registers per output pin */
 300     IRQDest dst[MAX_CPU];
 301     uint32_t nb_cpus;
 302     /* Timer registers */
 303     OpenPICTimer timers[OPENPIC_MAX_TMR];
 304     /* Shared MSI registers */
 305     OpenPICMSI msi[MAX_MSI];
 306     uint32_t max_irq;
 307     uint32_t irq_ipi0;
 308     uint32_t irq_tim0;
 309     uint32_t irq_msi;
 310 } OpenPICState;
 311
 312 static inline void IRQ_setbit(IRQQueue *q, int n_IRQ)
 313 {
 314     set_bit(n_IRQ, q->queue);
 315 }
 316
 317 static inline void IRQ_resetbit(IRQQueue *q, int n_IRQ)
 318 {
 319     clear_bit(n_IRQ, q->queue);
 320 }
 321
 322 static void IRQ_check(OpenPICState *opp, IRQQueue *q)
 323 {
 324     int irq = -1;
 325     int next = -1;
 326     int priority = -1;
 327
 328     for (;;) {
 329         irq = find_next_bit(q->queue, opp->max_irq, irq + 1);
 330         if (irq == opp->max_irq) {
 331             break;
 332         }
 333
 334         DPRINTF("IRQ_check: irq %d set ivpr_pr=%d pr=%d\n",
 335                 irq, IVPR_PRIORITY(opp->src[irq].ivpr), priority);
 336
 337         if (IVPR_PRIORITY(opp->src[irq].ivpr) > priority) {
 338             next = irq;
 339             priority = IVPR_PRIORITY(opp->src[irq].ivpr);
 340         }
 341     }
 342
 343     q->next = next;
 344     q->priority = priority;
 345 }
 346
 347 static int IRQ_get_next(OpenPICState *opp, IRQQueue *q)
 348 {
 349     /* XXX: optimize */
 350     IRQ_check(opp, q);
 351
 352     return q->next;
 353 }
 354
 355 static void IRQ_local_pipe(OpenPICState *opp, int n_CPU, int n_IRQ,
 356                            bool active, bool was_active)
 357 {
 358     IRQDest *dst;
 359     IRQSource *src;
 360     int priority;
 361
 362     dst = &opp->dst[n_CPU];
 363     src = &opp->src[n_IRQ];
 364
 365     DPRINTF("%s: IRQ %d active %d was %d\n",
 366             __func__, n_IRQ, active, was_active);
 367
 368     if (src->output != OPENPIC_OUTPUT_INT) {
 369         DPRINTF("%s: output %d irq %d active %d was %d count %d\n",
 370                 __func__, src->output, n_IRQ, active, was_active,
 371                 dst->outputs_active[src->output]);
 372
 373         /* On Freescale MPIC, critical interrupts ignore priority,
 374          * IACK, EOI, etc.  Before MPIC v4.1 they also ignore
 375          * masking.
 376          */
 377         if (active) {
 378             if (!was_active && dst->outputs_active[src->output]++ == 0) {
 379                 DPRINTF("%s: Raise OpenPIC output %d cpu %d irq %d\n",
 380                         __func__, src->output, n_CPU, n_IRQ);
 381                 qemu_irq_raise(dst->irqs[src->output]);
 382             }
 383         } else {
 384             if (was_active && --dst->outputs_active[src->output] == 0) {
 385                 DPRINTF("%s: Lower OpenPIC output %d cpu %d irq %d\n",
 386                         __func__, src->output, n_CPU, n_IRQ);
 387                 qemu_irq_lower(dst->irqs[src->output]);
 388             }
 389         }
 390
 391         return;
 392     }
 393
 394     priority = IVPR_PRIORITY(src->ivpr);
 395
 396     /* Even if the interrupt doesn't have enough priority,
 397      * it is still raised, in case ctpr is lowered later.
 398      */
 399     if (active) {
 400         IRQ_setbit(&dst->raised, n_IRQ);
 401     } else {
 402         IRQ_resetbit(&dst->raised, n_IRQ);
 403     }
 404
 405     IRQ_check(opp, &dst->raised);
 406
 407     if (active && priority <= dst->ctpr) {
 408         DPRINTF("%s: IRQ %d priority %d too low for ctpr %d on CPU %d\n",
 409                 __func__, n_IRQ, priority, dst->ctpr, n_CPU);
 410         active = 0;
 411     }
 412
 413     if (active) {
 414         if (IRQ_get_next(opp, &dst->servicing) >= 0 &&
 415                 priority <= dst->servicing.priority) {
 416             DPRINTF("%s: IRQ %d is hidden by servicing IRQ %d on CPU %d\n",
 417                     __func__, n_IRQ, dst->servicing.next, n_CPU);
 418         } else {
 419             DPRINTF("%s: Raise OpenPIC INT output cpu %d irq %d/%d\n",
 420                     __func__, n_CPU, n_IRQ, dst->raised.next);
 421             qemu_irq_raise(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);
 422         }
 423     } else {
 424         IRQ_get_next(opp, &dst->servicing);
 425         if (dst->raised.priority > dst->ctpr &&
 426                 dst->raised.priority > dst->servicing.priority) {
 427             DPRINTF("%s: IRQ %d inactive, IRQ %d prio %d above %d/%d, CPU %d\n",
 428                     __func__, n_IRQ, dst->raised.next, dst->raised.priority,
 429                     dst->ctpr, dst->servicing.priority, n_CPU);
 430             /* IRQ line stays asserted */
 431         } else {
 432             DPRINTF("%s: IRQ %d inactive, current prio %d/%d, CPU %d\n",
 433                     __func__, n_IRQ, dst->ctpr, dst->servicing.priority, n_CPU);
 434             qemu_irq_lower(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);
 435         }
 436     }
 437 }
 438
 439 /* update pic state because registers for n_IRQ have changed value */
 440 static void openpic_update_irq(OpenPICState *opp, int n_IRQ)
 441 {
 442     IRQSource *src;
 443     bool active, was_active;
 444     int i;
 445
 446     src = &opp->src[n_IRQ];
 447     active = src->pending;
 448
 449     if ((src->ivpr & IVPR_MASK_MASK) && !src->nomask) {
 450         /* Interrupt source is disabled */
 451         DPRINTF("%s: IRQ %d is disabled\n", __func__, n_IRQ);
 452         active = false;
 453     }
 454
 455     was_active = !!(src->ivpr & IVPR_ACTIVITY_MASK);
 456
 457     /*
 458      * We don't have a similar check for already-active because
 459      * ctpr may have changed and we need to withdraw the interrupt.
 460      */
 461     if (!active && !was_active) {
 462         DPRINTF("%s: IRQ %d is already inactive\n", __func__, n_IRQ);
 463         return;
 464     }
 465
 466     if (active) {
 467         src->ivpr |= IVPR_ACTIVITY_MASK;
 468     } else {
 469         src->ivpr &= ~IVPR_ACTIVITY_MASK;
 470     }
 471
 472     if (src->destmask == 0) {
 473         /* No target */
 474         DPRINTF("%s: IRQ %d has no target\n", __func__, n_IRQ);
 475         return;
 476     }
 477
 478     if (src->destmask == (1 << src->last_cpu)) {
 479         /* Only one CPU is allowed to receive this IRQ */
 480         IRQ_local_pipe(opp, src->last_cpu, n_IRQ, active, was_active);
 481     } else if (!(src->ivpr & IVPR_MODE_MASK)) {
 482         /* Directed delivery mode */
 483         for (i = 0; i < opp->nb_cpus; i++) {
 484             if (src->destmask & (1 << i)) {
 485                 IRQ_local_pipe(opp, i, n_IRQ, active, was_active);
 486             }
 487         }
 488     } else {
 489         /* Distributed delivery mode */
 490         for (i = src->last_cpu + 1; i != src->last_cpu; i++) {
 491             if (i == opp->nb_cpus) {
 492                 i = 0;
 493             }
 494             if (src->destmask & (1 << i)) {
 495                 IRQ_local_pipe(opp, i, n_IRQ, active, was_active);
 496                 src->last_cpu = i;
 497                 break;
 498             }
 499         }
 500     }
 501 }
 502
 503 static void openpic_set_irq(void *opaque, int n_IRQ, int level)
 504 {
 505     OpenPICState *opp = opaque;
 506     IRQSource *src;
 507
 508     if (n_IRQ >= OPENPIC_MAX_IRQ) {
 509         fprintf(stderr, "%s: IRQ %d out of range\n", __func__, n_IRQ);
 510         abort();
 511     }
 512
 513     src = &opp->src[n_IRQ];
 514     DPRINTF("openpic: set irq %d = %d ivpr=0x%08x\n",
 515             n_IRQ, level, src->ivpr);
 516     if (src->level) {
 517         /* level-sensitive irq */
 518         src->pending = level;
 519         openpic_update_irq(opp, n_IRQ);
 520     } else {
 521         /* edge-sensitive irq */
 522         if (level) {
 523             src->pending = 1;
 524             openpic_update_irq(opp, n_IRQ);
 525         }
 526
 527         if (src->output != OPENPIC_OUTPUT_INT) {
 528             /* Edge-triggered interrupts shouldn't be used
 529              * with non-INT delivery, but just in case,
 530              * try to make it do something sane rather than
 531              * cause an interrupt storm.  This is close to
 532              * what you'd probably see happen in real hardware.
 533              */
 534             src->pending = 0;
 535             openpic_update_irq(opp, n_IRQ);
 536         }
 537     }
 538 }
 539
 540 static inline uint32_t read_IRQreg_idr(OpenPICState *opp, int n_IRQ)
 541 {
 542     return opp->src[n_IRQ].idr;
 543 }
 544
 545 static inline uint32_t read_IRQreg_ilr(OpenPICState *opp, int n_IRQ)
 546 {
 547     if (opp->flags & OPENPIC_FLAG_ILR) {
 548         return output_to_inttgt(opp->src[n_IRQ].output);
 549     }
 550
 551     return 0xffffffff;
 552 }
 553
 554 static inline uint32_t read_IRQreg_ivpr(OpenPICState *opp, int n_IRQ)
 555 {
 556     return opp->src[n_IRQ].ivpr;
 557 }
 558
 559 static inline void write_IRQreg_idr(OpenPICState *opp, int n_IRQ, uint32_t val)
 560 {
 561     IRQSource *src = &opp->src[n_IRQ];
 562     uint32_t normal_mask = (1UL << opp->nb_cpus) - 1;
 563     uint32_t crit_mask = 0;
 564     uint32_t mask = normal_mask;
 565     int crit_shift = IDR_EP_SHIFT - opp->nb_cpus;
 566     int i;
 567
 568     if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
 569         crit_mask = mask << crit_shift;
 570         mask |= crit_mask | IDR_EP;
 571     }
 572
 573     src->idr = val & mask;
 574     DPRINTF("Set IDR %d to 0x%08x\n", n_IRQ, src->idr);
 575
 576     if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
 577         if (src->idr & crit_mask) {
 578             if (src->idr & normal_mask) {
 579                 DPRINTF("%s: IRQ configured for multiple output types, using "
 580                         "critical\n", __func__);
 581             }
 582
 583             src->output = OPENPIC_OUTPUT_CINT;
 584             src->nomask = true;
 585             src->destmask = 0;
 586
 587             for (i = 0; i < opp->nb_cpus; i++) {
 588                 int n_ci = IDR_CI0_SHIFT - i;
 589
 590                 if (src->idr & (1UL << n_ci)) {
 591                     src->destmask |= 1UL << i;
 592                 }
 593             }
 594         } else {
 595             src->output = OPENPIC_OUTPUT_INT;
 596             src->nomask = false;
 597             src->destmask = src->idr & normal_mask;
 598         }
 599     } else {
 600         src->destmask = src->idr;
 601     }
 602 }
 603
 604 static inline void write_IRQreg_ilr(OpenPICState *opp, int n_IRQ, uint32_t val)
 605 {
 606     if (opp->flags & OPENPIC_FLAG_ILR) {
 607         IRQSource *src = &opp->src[n_IRQ];
 608
 609         src->output = inttgt_to_output(val & ILR_INTTGT_MASK);
 610         DPRINTF("Set ILR %d to 0x%08x, output %d\n", n_IRQ, src->idr,
 611                 src->output);
 612
 613         /* TODO: on MPIC v4.0 only, set nomask for non-INT */
 614     }
 615 }
 616
 617 static inline void write_IRQreg_ivpr(OpenPICState *opp, int n_IRQ, uint32_t val)
 618 {
 619     uint32_t mask;
 620
 621     /* NOTE when implementing newer FSL MPIC models: starting with v4.0,
 622      * the polarity bit is read-only on internal interrupts.
 623      */
 624     mask = IVPR_MASK_MASK | IVPR_PRIORITY_MASK | IVPR_SENSE_MASK |
 625            IVPR_POLARITY_MASK | opp->vector_mask;
 626
 627     /* ACTIVITY bit is read-only */
 628     opp->src[n_IRQ].ivpr =
 629         (opp->src[n_IRQ].ivpr & IVPR_ACTIVITY_MASK) | (val & mask);
 630
 631     /* For FSL internal interrupts, The sense bit is reserved and zero,
 632      * and the interrupt is always level-triggered.  Timers and IPIs
 633      * have no sense or polarity bits, and are edge-triggered.
 634      */
 635     switch (opp->src[n_IRQ].type) {
 636     case IRQ_TYPE_NORMAL:
 637         opp->src[n_IRQ].level = !!(opp->src[n_IRQ].ivpr & IVPR_SENSE_MASK);
 638         break;
 639
 640     case IRQ_TYPE_FSLINT:
 641         opp->src[n_IRQ].ivpr &= ~IVPR_SENSE_MASK;
 642         break;
 643
 644     case IRQ_TYPE_FSLSPECIAL:
 645         opp->src[n_IRQ].ivpr &= ~(IVPR_POLARITY_MASK | IVPR_SENSE_MASK);
 646         break;
 647     }
 648
 649     openpic_update_irq(opp, n_IRQ);
 650     DPRINTF("Set IVPR %d to 0x%08x -> 0x%08x\n", n_IRQ, val,
 651             opp->src[n_IRQ].ivpr);
 652 }
 653
 654 static void openpic_gcr_write(OpenPICState *opp, uint64_t val)
 655 {
 656     bool mpic_proxy = false;
 657
 658     if (val & GCR_RESET) {
 659         openpic_reset(DEVICE(opp));
 660         return;
 661     }
 662
 663     opp->gcr &= ~opp->mpic_mode_mask;
 664     opp->gcr |= val & opp->mpic_mode_mask;
 665
 666     /* Set external proxy mode */
 667     if ((val & opp->mpic_mode_mask) == GCR_MODE_PROXY) {
 668         mpic_proxy = true;
 669     }
 670
 671     ppce500_set_mpic_proxy(mpic_proxy);
 672 }
 673
 674 static void openpic_gbl_write(void *opaque, hwaddr addr, uint64_t val,
 675                               unsigned len)
 676 {
 677     OpenPICState *opp = opaque;
 678     IRQDest *dst;
 679     int idx;
 680
 681     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64 "\n",
 682             __func__, addr, val);
 683     if (addr & 0xF) {
 684         return;
 685     }
 686     switch (addr) {
 687     case 0x00: /* Block Revision Register1 (BRR1) is Readonly */
 688         break;
 689     case 0x40:
 690     case 0x50:
 691     case 0x60:
 692     case 0x70:
 693     case 0x80:
 694     case 0x90:
 695     case 0xA0:
 696     case 0xB0:
 697         openpic_cpu_write_internal(opp, addr, val, get_current_cpu());
 698         break;
 699     case 0x1000: /* FRR */
 700         break;
 701     case 0x1020: /* GCR */
 702         openpic_gcr_write(opp, val);
 703         break;
 704     case 0x1080: /* VIR */
 705         break;
 706     case 0x1090: /* PIR */
 707         for (idx = 0; idx < opp->nb_cpus; idx++) {
 708             if ((val & (1 << idx)) && !(opp->pir & (1 << idx))) {
 709                 DPRINTF("Raise OpenPIC RESET output for CPU %d\n", idx);
 710                 dst = &opp->dst[idx];
 711                 qemu_irq_raise(dst->irqs[OPENPIC_OUTPUT_RESET]);
 712             } else if (!(val & (1 << idx)) && (opp->pir & (1 << idx))) {
 713                 DPRINTF("Lower OpenPIC RESET output for CPU %d\n", idx);
 714                 dst = &opp->dst[idx];
 715                 qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_RESET]);
 716             }
 717         }
 718         opp->pir = val;
 719         break;
 720     case 0x10A0: /* IPI_IVPR */
 721     case 0x10B0:
 722     case 0x10C0:
 723     case 0x10D0:
 724         {
 725             int idx;
 726             idx = (addr - 0x10A0) >> 4;
 727             write_IRQreg_ivpr(opp, opp->irq_ipi0 + idx, val);
 728         }
 729         break;
 730     case 0x10E0: /* SPVE */
 731         opp->spve = val & opp->vector_mask;
 732         break;
 733     default:
 734         break;
 735     }
 736 }
 737
 738 static uint64_t openpic_gbl_read(void *opaque, hwaddr addr, unsigned len)
 739 {
 740     OpenPICState *opp = opaque;
 741     uint32_t retval;
 742
 743     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
 744     retval = 0xFFFFFFFF;
 745     if (addr & 0xF) {
 746         return retval;
 747     }
 748     switch (addr) {
 749     case 0x1000: /* FRR */
 750         retval = opp->frr;
 751         break;
 752     case 0x1020: /* GCR */
 753         retval = opp->gcr;
 754         break;
 755     case 0x1080: /* VIR */
 756         retval = opp->vir;
 757         break;
 758     case 0x1090: /* PIR */
 759         retval = 0x00000000;
 760         break;
 761     case 0x00: /* Block Revision Register1 (BRR1) */
 762         retval = opp->brr1;
 763         break;
 764     case 0x40:
 765     case 0x50:
 766     case 0x60:
 767     case 0x70:
 768     case 0x80:
 769     case 0x90:
 770     case 0xA0:
 771     case 0xB0:
 772         retval = openpic_cpu_read_internal(opp, addr, get_current_cpu());
 773         break;
 774     case 0x10A0: /* IPI_IVPR */
 775     case 0x10B0:
 776     case 0x10C0:
 777     case 0x10D0:
 778         {
 779             int idx;
 780             idx = (addr - 0x10A0) >> 4;
 781             retval = read_IRQreg_ivpr(opp, opp->irq_ipi0 + idx);
 782         }
 783         break;
 784     case 0x10E0: /* SPVE */
 785         retval = opp->spve;
 786         break;
 787     default:
 788         break;
 789     }
 790     DPRINTF("%s: => 0x%08x\n", __func__, retval);
 791
 792     return retval;
 793 }
 794
 795 static void openpic_tmr_write(void *opaque, hwaddr addr, uint64_t val,
 796                                 unsigned len)
 797 {
 798     OpenPICState *opp = opaque;
 799     int idx;
 800
 801     addr += 0x10f0;
 802
 803     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64 "\n",
 804             __func__, addr, val);
 805     if (addr & 0xF) {
 806         return;
 807     }
 808
 809     if (addr == 0x10f0) {
 810         /* TFRR */
 811         opp->tfrr = val;
 812         return;
 813     }
 814
 815     idx = (addr >> 6) & 0x3;
 816     addr = addr & 0x30;
 817
 818     switch (addr & 0x30) {
 819     case 0x00: /* TCCR */
 820         break;
 821     case 0x10: /* TBCR */
 822         if ((opp->timers[idx].tccr & TCCR_TOG) != 0 &&
 823             (val & TBCR_CI) == 0 &&
 824             (opp->timers[idx].tbcr & TBCR_CI) != 0) {
 825             opp->timers[idx].tccr &= ~TCCR_TOG;
 826         }
 827         opp->timers[idx].tbcr = val;
 828         break;
 829     case 0x20: /* TVPR */
 830         write_IRQreg_ivpr(opp, opp->irq_tim0 + idx, val);
 831         break;
 832     case 0x30: /* TDR */
 833         write_IRQreg_idr(opp, opp->irq_tim0 + idx, val);
 834         break;
 835     }
 836 }
 837
 838 static uint64_t openpic_tmr_read(void *opaque, hwaddr addr, unsigned len)
 839 {
 840     OpenPICState *opp = opaque;
 841     uint32_t retval = -1;
 842     int idx;
 843
 844     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
 845     if (addr & 0xF) {
 846         goto out;
 847     }
 848     idx = (addr >> 6) & 0x3;
 849     if (addr == 0x0) {
 850         /* TFRR */
 851         retval = opp->tfrr;
 852         goto out;
 853     }
 854     switch (addr & 0x30) {
 855     case 0x00: /* TCCR */
 856         retval = opp->timers[idx].tccr;
 857         break;
 858     case 0x10: /* TBCR */
 859         retval = opp->timers[idx].tbcr;
 860         break;
 861     case 0x20: /* TIPV */
 862         retval = read_IRQreg_ivpr(opp, opp->irq_tim0 + idx);
 863         break;
 864     case 0x30: /* TIDE (TIDR) */
 865         retval = read_IRQreg_idr(opp, opp->irq_tim0 + idx);
 866         break;
 867     }
 868
 869 out:
 870     DPRINTF("%s: => 0x%08x\n", __func__, retval);
 871
 872     return retval;
 873 }
 874
 875 static void openpic_src_write(void *opaque, hwaddr addr, uint64_t val,
 876                               unsigned len)
 877 {
 878     OpenPICState *opp = opaque;
 879     int idx;
 880
 881     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64 "\n",
 882             __func__, addr, val);
 883
 884     addr = addr & 0xffff;
 885     idx = addr >> 5;
 886
 887     switch (addr & 0x1f) {
 888     case 0x00:
 889         write_IRQreg_ivpr(opp, idx, val);
 890         break;
 891     case 0x10:
 892         write_IRQreg_idr(opp, idx, val);
 893         break;
 894     case 0x18:
 895         write_IRQreg_ilr(opp, idx, val);
 896         break;
 897     }
 898 }
 899
 900 static uint64_t openpic_src_read(void *opaque, uint64_t addr, unsigned len)
 901 {
 902     OpenPICState *opp = opaque;
 903     uint32_t retval;
 904     int idx;
 905
 906     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
 907     retval = 0xFFFFFFFF;
 908
 909     addr = addr & 0xffff;
 910     idx = addr >> 5;
 911
 912     switch (addr & 0x1f) {
 913     case 0x00:
 914         retval = read_IRQreg_ivpr(opp, idx);
 915         break;
 916     case 0x10:
 917         retval = read_IRQreg_idr(opp, idx);
 918         break;
 919     case 0x18:
 920         retval = read_IRQreg_ilr(opp, idx);
 921         break;
 922     }
 923
 924     DPRINTF("%s: => 0x%08x\n", __func__, retval);
 925     return retval;
 926 }
 927
 928 static void openpic_msi_write(void *opaque, hwaddr addr, uint64_t val,
 929                               unsigned size)
 930 {
 931     OpenPICState *opp = opaque;
 932     int idx = opp->irq_msi;
 933     int srs, ibs;
 934
 935     DPRINTF("%s: addr %#" HWADDR_PRIx " <= 0x%08" PRIx64 "\n",
 936             __func__, addr, val);
 937     if (addr & 0xF) {
 938         return;
 939     }
 940
 941     switch (addr) {
 942     case MSIIR_OFFSET:
 943         srs = val >> MSIIR_SRS_SHIFT;
 944         idx += srs;
 945         ibs = (val & MSIIR_IBS_MASK) >> MSIIR_IBS_SHIFT;
 946         opp->msi[srs].msir |= 1 << ibs;
 947         openpic_set_irq(opp, idx, 1);
 948         break;
 949     default:
 950         /* most registers are read-only, thus ignored */
 951         break;
 952     }
 953 }
 954
 955 static uint64_t openpic_msi_read(void *opaque, hwaddr addr, unsigned size)
 956 {
 957     OpenPICState *opp = opaque;
 958     uint64_t r = 0;
 959     int i, srs;
 960
 961     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
 962     if (addr & 0xF) {
 963         return -1;
 964     }
 965
 966     srs = addr >> 4;
 967
 968     switch (addr) {
 969     case 0x00:
 970     case 0x10:
 971     case 0x20:
 972     case 0x30:
 973     case 0x40:
 974     case 0x50:
 975     case 0x60:
 976     case 0x70: /* MSIRs */
 977         r = opp->msi[srs].msir;
 978         /* Clear on read */
 979         opp->msi[srs].msir = 0;
 980         openpic_set_irq(opp, opp->irq_msi + srs, 0);
 981         break;
 982     case 0x120: /* MSISR */
 983         for (i = 0; i < MAX_MSI; i++) {
 984             r |= (opp->msi[i].msir ? 1 : 0) << i;
 985         }
 986         break;
 987     }
 988
 989     return r;
 990 }
 991
 992 static uint64_t openpic_summary_read(void *opaque, hwaddr addr, unsigned size)
 993 {
 994     uint64_t r = 0;
 995
 996     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
 997
 998     /* TODO: EISR/EIMR */
 999
1000     return r;
1001 }
1002
1003 static void openpic_summary_write(void *opaque, hwaddr addr, uint64_t val,
1004                                   unsigned size)
1005 {
1006     DPRINTF("%s: addr %#" HWADDR_PRIx " <= 0x%08" PRIx64 "\n",
1007             __func__, addr, val);
1008
1009     /* TODO: EISR/EIMR */
1010 }
1011
1012 static void openpic_cpu_write_internal(void *opaque, hwaddr addr,
1013                                        uint32_t val, int idx)
1014 {
1015     OpenPICState *opp = opaque;
1016     IRQSource *src;
1017     IRQDest *dst;
1018     int s_IRQ, n_IRQ;
1019
1020     DPRINTF("%s: cpu %d addr %#" HWADDR_PRIx " <= 0x%08x\n", __func__, idx,
1021             addr, val);
1022
1023     if (idx < 0 || idx >= opp->nb_cpus) {
1024         return;
1025     }
1026
1027     if (addr & 0xF) {
1028         return;
1029     }
1030     dst = &opp->dst[idx];
1031     addr &= 0xFF0;
1032     switch (addr) {
1033     case 0x40: /* IPIDR */
1034     case 0x50:
1035     case 0x60:
1036     case 0x70:
1037         idx = (addr - 0x40) >> 4;
1038         /* we use IDE as mask which CPUs to deliver the IPI to still. */
1039         opp->src[opp->irq_ipi0 + idx].destmask |= val;
1040         openpic_set_irq(opp, opp->irq_ipi0 + idx, 1);
1041         openpic_set_irq(opp, opp->irq_ipi0 + idx, 0);
1042         break;
1043     case 0x80: /* CTPR */
1044         dst->ctpr = val & 0x0000000F;
1045
1046         DPRINTF("%s: set CPU %d ctpr to %d, raised %d servicing %d\n",
1047                 __func__, idx, dst->ctpr, dst->raised.priority,
1048                 dst->servicing.priority);
1049
1050         if (dst->raised.priority <= dst->ctpr) {
1051             DPRINTF("%s: Lower OpenPIC INT output cpu %d due to ctpr\n",
1052                     __func__, idx);
1053             qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_INT]);
1054         } else if (dst->raised.priority > dst->servicing.priority) {
1055             DPRINTF("%s: Raise OpenPIC INT output cpu %d irq %d\n",
1056                     __func__, idx, dst->raised.next);
1057             qemu_irq_raise(dst->irqs[OPENPIC_OUTPUT_INT]);
1058         }
1059
1060         break;
1061     case 0x90: /* WHOAMI */
1062         /* Read-only register */
1063         break;
1064     case 0xA0: /* IACK */
1065         /* Read-only register */
1066         break;
1067     case 0xB0: /* EOI */
1068         DPRINTF("EOI\n");
1069         s_IRQ = IRQ_get_next(opp, &dst->servicing);
1070
1071         if (s_IRQ < 0) {
1072             DPRINTF("%s: EOI with no interrupt in service\n", __func__);
1073             break;
1074         }
1075
1076         IRQ_resetbit(&dst->servicing, s_IRQ);
1077         /* Set up next servicing IRQ */
1078         s_IRQ = IRQ_get_next(opp, &dst->servicing);
1079         /* Check queued interrupts. */
1080         n_IRQ = IRQ_get_next(opp, &dst->raised);
1081         src = &opp->src[n_IRQ];
1082         if (n_IRQ != -1 &&
1083             (s_IRQ == -1 ||
1084              IVPR_PRIORITY(src->ivpr) > dst->servicing.priority)) {
1085             DPRINTF("Raise OpenPIC INT output cpu %d irq %d\n",
1086                     idx, n_IRQ);
1087             qemu_irq_raise(opp->dst[idx].irqs[OPENPIC_OUTPUT_INT]);
1088         }
1089         break;
1090     default:
1091         break;
1092     }
1093 }
1094
1095 static void openpic_cpu_write(void *opaque, hwaddr addr, uint64_t val,
1096                               unsigned len)
1097 {
1098     openpic_cpu_write_internal(opaque, addr, val, (addr & 0x1f000) >> 12);
1099 }
1100
1101
1102 static uint32_t openpic_iack(OpenPICState *opp, IRQDest *dst, int cpu)
1103 {
1104     IRQSource *src;
1105     int retval, irq;
1106
1107     DPRINTF("Lower OpenPIC INT output\n");
1108     qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_INT]);
1109
1110     irq = IRQ_get_next(opp, &dst->raised);
1111     DPRINTF("IACK: irq=%d\n", irq);
1112
1113     if (irq == -1) {
1114         /* No more interrupt pending */
1115         return opp->spve;
1116     }
1117
1118     src = &opp->src[irq];
1119     if (!(src->ivpr & IVPR_ACTIVITY_MASK) ||
1120             !(IVPR_PRIORITY(src->ivpr) > dst->ctpr)) {
1121         fprintf(stderr, "%s: bad raised IRQ %d ctpr %d ivpr 0x%08x\n",
1122                 __func__, irq, dst->ctpr, src->ivpr);
1123         openpic_update_irq(opp, irq);
1124         retval = opp->spve;
1125     } else {
1126         /* IRQ enter servicing state */
1127         IRQ_setbit(&dst->servicing, irq);
1128         retval = IVPR_VECTOR(opp, src->ivpr);
1129     }
1130
1131     if (!src->level) {
1132         /* edge-sensitive IRQ */
1133         src->ivpr &= ~IVPR_ACTIVITY_MASK;
1134         src->pending = 0;
1135         IRQ_resetbit(&dst->raised, irq);
1136     }
1137
1138     if ((irq >= opp->irq_ipi0) &&  (irq < (opp->irq_ipi0 + OPENPIC_MAX_IPI))) {
1139         src->destmask &= ~(1 << cpu);
1140         if (src->destmask && !src->level) {
1141             /* trigger on CPUs that didn't know about it yet */
1142             openpic_set_irq(opp, irq, 1);
1143             openpic_set_irq(opp, irq, 0);
1144             /* if all CPUs knew about it, set active bit again */
1145             src->ivpr |= IVPR_ACTIVITY_MASK;
1146         }
1147     }
1148
1149     return retval;
1150 }
1151
1152 static uint32_t openpic_cpu_read_internal(void *opaque, hwaddr addr,
1153                                           int idx)
1154 {
1155     OpenPICState *opp = opaque;
1156     IRQDest *dst;
1157     uint32_t retval;
1158
1159     DPRINTF("%s: cpu %d addr %#" HWADDR_PRIx "\n", __func__, idx, addr);
1160     retval = 0xFFFFFFFF;
1161
1162     if (idx < 0 || idx >= opp->nb_cpus) {
1163         return retval;
1164     }
1165
1166     if (addr & 0xF) {
1167         return retval;
1168     }
1169     dst = &opp->dst[idx];
1170     addr &= 0xFF0;
1171     switch (addr) {
1172     case 0x80: /* CTPR */
1173         retval = dst->ctpr;
1174         break;
1175     case 0x90: /* WHOAMI */
1176         retval = idx;
1177         break;
1178     case 0xA0: /* IACK */
1179         retval = openpic_iack(opp, dst, idx);
1180         break;
1181     case 0xB0: /* EOI */
1182         retval = 0;
1183         break;
1184     default:
1185         break;
1186     }
1187     DPRINTF("%s: => 0x%08x\n", __func__, retval);
1188
1189     return retval;
1190 }
1191
1192 static uint64_t openpic_cpu_read(void *opaque, hwaddr addr, unsigned len)
1193 {
1194     return openpic_cpu_read_internal(opaque, addr, (addr & 0x1f000) >> 12);
1195 }
1196
1197 static const MemoryRegionOps openpic_glb_ops_le = {
1198     .write = openpic_gbl_write,
1199     .read  = openpic_gbl_read,
1200     .endianness = DEVICE_LITTLE_ENDIAN,
1201     .impl = {
1202         .min_access_size = 4,
1203         .max_access_size = 4,
1204     },
1205 };
1206
1207 static const MemoryRegionOps openpic_glb_ops_be = {
1208     .write = openpic_gbl_write,
1209     .read  = openpic_gbl_read,
1210     .endianness = DEVICE_BIG_ENDIAN,
1211     .impl = {
1212         .min_access_size = 4,
1213         .max_access_size = 4,
1214     },
1215 };
1216
1217 static const MemoryRegionOps openpic_tmr_ops_le = {
1218     .write = openpic_tmr_write,
1219     .read  = openpic_tmr_read,
1220     .endianness = DEVICE_LITTLE_ENDIAN,
1221     .impl = {
1222         .min_access_size = 4,
1223         .max_access_size = 4,
1224     },
1225 };
1226
1227 static const MemoryRegionOps openpic_tmr_ops_be = {
1228     .write = openpic_tmr_write,
1229     .read  = openpic_tmr_read,
1230     .endianness = DEVICE_BIG_ENDIAN,
1231     .impl = {
1232         .min_access_size = 4,
1233         .max_access_size = 4,
1234     },
1235 };
1236
1237 static const MemoryRegionOps openpic_cpu_ops_le = {
1238     .write = openpic_cpu_write,
1239     .read  = openpic_cpu_read,
1240     .endianness = DEVICE_LITTLE_ENDIAN,
1241     .impl = {
1242         .min_access_size = 4,
1243         .max_access_size = 4,
1244     },
1245 };
1246
1247 static const MemoryRegionOps openpic_cpu_ops_be = {
1248     .write = openpic_cpu_write,
1249     .read  = openpic_cpu_read,
1250     .endianness = DEVICE_BIG_ENDIAN,
1251     .impl = {
1252         .min_access_size = 4,
1253         .max_access_size = 4,
1254     },
1255 };
1256
1257 static const MemoryRegionOps openpic_src_ops_le = {
1258     .write = openpic_src_write,
1259     .read  = openpic_src_read,
1260     .endianness = DEVICE_LITTLE_ENDIAN,
1261     .impl = {
1262         .min_access_size = 4,
1263         .max_access_size = 4,
1264     },
1265 };
1266
1267 static const MemoryRegionOps openpic_src_ops_be = {
1268     .write = openpic_src_write,
1269     .read  = openpic_src_read,
1270     .endianness = DEVICE_BIG_ENDIAN,
1271     .impl = {
1272         .min_access_size = 4,
1273         .max_access_size = 4,
1274     },
1275 };
1276
1277 static const MemoryRegionOps openpic_msi_ops_be = {
1278     .read = openpic_msi_read,
1279     .write = openpic_msi_write,
1280     .endianness = DEVICE_BIG_ENDIAN,
1281     .impl = {
1282         .min_access_size = 4,
1283         .max_access_size = 4,
1284     },
1285 };
1286
1287 static const MemoryRegionOps openpic_summary_ops_be = {
1288     .read = openpic_summary_read,
1289     .write = openpic_summary_write,
1290     .endianness = DEVICE_BIG_ENDIAN,
1291     .impl = {
1292         .min_access_size = 4,
1293         .max_access_size = 4,
1294     },
1295 };
1296
1297 static void openpic_reset(DeviceState *d)
1298 {
1299     OpenPICState *opp = OPENPIC(d);
1300     int i;
1301
1302     opp->gcr = GCR_RESET;
1303     /* Initialise controller registers */
1304     opp->frr = ((opp->nb_irqs - 1) << FRR_NIRQ_SHIFT) |
1305                ((opp->nb_cpus - 1) << FRR_NCPU_SHIFT) |
1306                (opp->vid << FRR_VID_SHIFT);
1307
1308     opp->pir = 0;
1309     opp->spve = -1 & opp->vector_mask;
1310     opp->tfrr = opp->tfrr_reset;
1311     /* Initialise IRQ sources */
1312     for (i = 0; i < opp->max_irq; i++) {
1313         opp->src[i].ivpr = opp->ivpr_reset;
1314         switch (opp->src[i].type) {
1315         case IRQ_TYPE_NORMAL:
1316             opp->src[i].level = !!(opp->ivpr_reset & IVPR_SENSE_MASK);
1317             break;
1318
1319         case IRQ_TYPE_FSLINT:
1320             opp->src[i].ivpr |= IVPR_POLARITY_MASK;
1321             break;
1322
1323         case IRQ_TYPE_FSLSPECIAL:
1324             break;
1325         }
1326
1327         write_IRQreg_idr(opp, i, opp->idr_reset);
1328     }
1329     /* Initialise IRQ destinations */
1330     for (i = 0; i < opp->nb_cpus; i++) {
1331         opp->dst[i].ctpr      = 15;
1332         opp->dst[i].raised.next = -1;
1333         opp->dst[i].raised.priority = 0;
1334         bitmap_clear(opp->dst[i].raised.queue, 0, IRQQUEUE_SIZE_BITS);
1335         opp->dst[i].servicing.next = -1;
1336         opp->dst[i].servicing.priority = 0;
1337         bitmap_clear(opp->dst[i].servicing.queue, 0, IRQQUEUE_SIZE_BITS);
1338     }
1339     /* Initialise timers */
1340     for (i = 0; i < OPENPIC_MAX_TMR; i++) {
1341         opp->timers[i].tccr = 0;
1342         opp->timers[i].tbcr = TBCR_CI;
1343     }
1344     /* Go out of RESET state */
1345     opp->gcr = 0;
1346 }
1347
1348 typedef struct MemReg {
1349     const char             *name;
1350     MemoryRegionOps const  *ops;
1351     hwaddr      start_addr;
1352     ram_addr_t              size;
1353 } MemReg;
1354
1355 static void fsl_common_init(OpenPICState *opp)
1356 {
1357     int i;
1358     int virq = OPENPIC_MAX_SRC;
1359
1360     opp->vid = VID_REVISION_1_2;
1361     opp->vir = VIR_GENERIC;
1362     opp->vector_mask = 0xFFFF;
1363     opp->tfrr_reset = 0;
1364     opp->ivpr_reset = IVPR_MASK_MASK;
1365     opp->idr_reset = 1 << 0;
1366     opp->max_irq = OPENPIC_MAX_IRQ;
1367
1368     opp->irq_ipi0 = virq;
1369     virq += OPENPIC_MAX_IPI;
1370     opp->irq_tim0 = virq;
1371     virq += OPENPIC_MAX_TMR;
1372
1373     assert(virq <= OPENPIC_MAX_IRQ);
1374
1375     opp->irq_msi = 224;
1376
1377     msi_supported = true;
1378     for (i = 0; i < opp->fsl->max_ext; i++) {
1379         opp->src[i].level = false;
1380     }
1381
1382     /* Internal interrupts, including message and MSI */
1383     for (i = 16; i < OPENPIC_MAX_SRC; i++) {
1384         opp->src[i].type = IRQ_TYPE_FSLINT;
1385         opp->src[i].level = true;
1386     }
1387
1388     /* timers and IPIs */
1389     for (i = OPENPIC_MAX_SRC; i < virq; i++) {
1390         opp->src[i].type = IRQ_TYPE_FSLSPECIAL;
1391         opp->src[i].level = false;
1392     }
1393 }
1394
1395 static void map_list(OpenPICState *opp, const MemReg *list, int *count)
1396 {
1397     while (list->name) {
1398         assert(*count < ARRAY_SIZE(opp->sub_io_mem));
1399
1400         memory_region_init_io(&opp->sub_io_mem[*count], OBJECT(opp), list->ops,
1401                               opp, list->name, list->size);
1402
1403         memory_region_add_subregion(&opp->mem, list->start_addr,
1404                                     &opp->sub_io_mem[*count]);
1405
1406         (*count)++;
1407         list++;
1408     }
1409 }
1410
1411 static const VMStateDescription vmstate_openpic_irq_queue = {
1412     .name = "openpic_irq_queue",
1413     .version_id = 0,
1414     .minimum_version_id = 0,
1415     .fields = (VMStateField[]) {
1416         VMSTATE_BITMAP(queue, IRQQueue, 0, queue_size),
1417         VMSTATE_INT32(next, IRQQueue),
1418         VMSTATE_INT32(priority, IRQQueue),
1419         VMSTATE_END_OF_LIST()
1420     }
1421 };
1422
1423 static const VMStateDescription vmstate_openpic_irqdest = {
1424     .name = "openpic_irqdest",
1425     .version_id = 0,
1426     .minimum_version_id = 0,
1427     .fields = (VMStateField[]) {
1428         VMSTATE_INT32(ctpr, IRQDest),
1429         VMSTATE_STRUCT(raised, IRQDest, 0, vmstate_openpic_irq_queue,
1430                        IRQQueue),
1431         VMSTATE_STRUCT(servicing, IRQDest, 0, vmstate_openpic_irq_queue,
1432                        IRQQueue),
1433         VMSTATE_UINT32_ARRAY(outputs_active, IRQDest, OPENPIC_OUTPUT_NB),
1434         VMSTATE_END_OF_LIST()
1435     }
1436 };
1437
1438 static const VMStateDescription vmstate_openpic_irqsource = {
1439     .name = "openpic_irqsource",
1440     .version_id = 0,
1441     .minimum_version_id = 0,
1442     .fields = (VMStateField[]) {
1443         VMSTATE_UINT32(ivpr, IRQSource),
1444         VMSTATE_UINT32(idr, IRQSource),
1445         VMSTATE_UINT32(destmask, IRQSource),
1446         VMSTATE_INT32(last_cpu, IRQSource),
1447         VMSTATE_INT32(pending, IRQSource),
1448         VMSTATE_END_OF_LIST()
1449     }
1450 };
1451
1452 static const VMStateDescription vmstate_openpic_timer = {
1453     .name = "openpic_timer",
1454     .version_id = 0,
1455     .minimum_version_id = 0,
1456     .fields = (VMStateField[]) {
1457         VMSTATE_UINT32(tccr, OpenPICTimer),
1458         VMSTATE_UINT32(tbcr, OpenPICTimer),
1459         VMSTATE_END_OF_LIST()
1460     }
1461 };
1462
1463 static const VMStateDescription vmstate_openpic_msi = {
1464     .name = "openpic_msi",
1465     .version_id = 0,
1466     .minimum_version_id = 0,
1467     .fields = (VMStateField[]) {
1468         VMSTATE_UINT32(msir, OpenPICMSI),
1469         VMSTATE_END_OF_LIST()
1470     }
1471 };
1472
1473 static int openpic_post_load(void *opaque, int version_id)
1474 {
1475     OpenPICState *opp = (OpenPICState *)opaque;
1476     int i;
1477
1478     /* Update internal ivpr and idr variables */
1479     for (i = 0; i < opp->max_irq; i++) {
1480         write_IRQreg_idr(opp, i, opp->src[i].idr);
1481         write_IRQreg_ivpr(opp, i, opp->src[i].ivpr);
1482     }
1483
1484     return 0;
1485 }
1486
1487 static const VMStateDescription vmstate_openpic = {
1488     .name = "openpic",
1489     .version_id = 3,
1490     .minimum_version_id = 3,
1491     .post_load = openpic_post_load,
1492     .fields = (VMStateField[]) {
1493         VMSTATE_UINT32(gcr, OpenPICState),
1494         VMSTATE_UINT32(vir, OpenPICState),
1495         VMSTATE_UINT32(pir, OpenPICState),
1496         VMSTATE_UINT32(spve, OpenPICState),
1497         VMSTATE_UINT32(tfrr, OpenPICState),
1498         VMSTATE_UINT32(max_irq, OpenPICState),
1499         VMSTATE_STRUCT_VARRAY_UINT32(src, OpenPICState, max_irq, 0,
1500                                      vmstate_openpic_irqsource, IRQSource),
1501         VMSTATE_UINT32_EQUAL(nb_cpus, OpenPICState),
1502         VMSTATE_STRUCT_VARRAY_UINT32(dst, OpenPICState, nb_cpus, 0,
1503                                      vmstate_openpic_irqdest, IRQDest),
1504         VMSTATE_STRUCT_ARRAY(timers, OpenPICState, OPENPIC_MAX_TMR, 0,
1505                              vmstate_openpic_timer, OpenPICTimer),
1506         VMSTATE_STRUCT_ARRAY(msi, OpenPICState, MAX_MSI, 0,
1507                              vmstate_openpic_msi, OpenPICMSI),
1508         VMSTATE_UINT32(irq_ipi0, OpenPICState),
1509         VMSTATE_UINT32(irq_tim0, OpenPICState),
1510         VMSTATE_UINT32(irq_msi, OpenPICState),
1511         VMSTATE_END_OF_LIST()
1512     }
1513 };
1514
1515 static void openpic_init(Object *obj)
1516 {
1517     OpenPICState *opp = OPENPIC(obj);
1518
1519     memory_region_init(&opp->mem, obj, "openpic", 0x40000);
1520 }
1521
1522 static void openpic_realize(DeviceState *dev, Error **errp)
1523 {
1524     SysBusDevice *d = SYS_BUS_DEVICE(dev);
1525     OpenPICState *opp = OPENPIC(dev);
1526     int i, j;
1527     int list_count = 0;
1528     static const MemReg list_le[] = {
1529         {"glb", &openpic_glb_ops_le,
1530                 OPENPIC_GLB_REG_START, OPENPIC_GLB_REG_SIZE},
1531         {"tmr", &openpic_tmr_ops_le,
1532                 OPENPIC_TMR_REG_START, OPENPIC_TMR_REG_SIZE},
1533         {"src", &openpic_src_ops_le,
1534                 OPENPIC_SRC_REG_START, OPENPIC_SRC_REG_SIZE},
1535         {"cpu", &openpic_cpu_ops_le,
1536                 OPENPIC_CPU_REG_START, OPENPIC_CPU_REG_SIZE},
1537         {NULL}
1538     };
1539     static const MemReg list_be[] = {
1540         {"glb", &openpic_glb_ops_be,
1541                 OPENPIC_GLB_REG_START, OPENPIC_GLB_REG_SIZE},
1542         {"tmr", &openpic_tmr_ops_be,
1543                 OPENPIC_TMR_REG_START, OPENPIC_TMR_REG_SIZE},
1544         {"src", &openpic_src_ops_be,
1545                 OPENPIC_SRC_REG_START, OPENPIC_SRC_REG_SIZE},
1546         {"cpu", &openpic_cpu_ops_be,
1547                 OPENPIC_CPU_REG_START, OPENPIC_CPU_REG_SIZE},
1548         {NULL}
1549     };
1550     static const MemReg list_fsl[] = {
1551         {"msi", &openpic_msi_ops_be,
1552                 OPENPIC_MSI_REG_START, OPENPIC_MSI_REG_SIZE},
1553         {"summary", &openpic_summary_ops_be,
1554                 OPENPIC_SUMMARY_REG_START, OPENPIC_SUMMARY_REG_SIZE},
1555         {NULL}
1556     };
1557
1558     if (opp->nb_cpus > MAX_CPU) {
1559         error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE,
1560                   TYPE_OPENPIC, "nb_cpus", (uint64_t)opp->nb_cpus,
1561                   (uint64_t)0, (uint64_t)MAX_CPU);
1562         return;
1563     }
1564
1565     switch (opp->model) {
1566     case OPENPIC_MODEL_FSL_MPIC_20:
1567     default:
1568         opp->fsl = &fsl_mpic_20;
1569         opp->brr1 = 0x00400200;
1570         opp->flags |= OPENPIC_FLAG_IDR_CRIT;
1571         opp->nb_irqs = 80;
1572         opp->mpic_mode_mask = GCR_MODE_MIXED;
1573
1574         fsl_common_init(opp);
1575         map_list(opp, list_be, &list_count);
1576         map_list(opp, list_fsl, &list_count);
1577
1578         break;
1579
1580     case OPENPIC_MODEL_FSL_MPIC_42:
1581         opp->fsl = &fsl_mpic_42;
1582         opp->brr1 = 0x00400402;
1583         opp->flags |= OPENPIC_FLAG_ILR;
1584         opp->nb_irqs = 196;
1585         opp->mpic_mode_mask = GCR_MODE_PROXY;
1586
1587         fsl_common_init(opp);
1588         map_list(opp, list_be, &list_count);
1589         map_list(opp, list_fsl, &list_count);
1590
1591         break;
1592
1593     case OPENPIC_MODEL_RAVEN:
1594         opp->nb_irqs = RAVEN_MAX_EXT;
1595         opp->vid = VID_REVISION_1_3;
1596         opp->vir = VIR_GENERIC;
1597         opp->vector_mask = 0xFF;
1598         opp->tfrr_reset = 4160000;
1599         opp->ivpr_reset = IVPR_MASK_MASK | IVPR_MODE_MASK;
1600         opp->idr_reset = 0;
1601         opp->max_irq = RAVEN_MAX_IRQ;
1602         opp->irq_ipi0 = RAVEN_IPI_IRQ;
1603         opp->irq_tim0 = RAVEN_TMR_IRQ;
1604         opp->brr1 = -1;
1605         opp->mpic_mode_mask = GCR_MODE_MIXED;
1606
1607         if (opp->nb_cpus != 1) {
1608             error_setg(errp, "Only UP supported today");
1609             return;
1610         }
1611
1612         map_list(opp, list_le, &list_count);
1613         break;
1614     }
1615
1616     for (i = 0; i < opp->nb_cpus; i++) {
1617         opp->dst[i].irqs = g_new0(qemu_irq, OPENPIC_OUTPUT_NB);
1618         for (j = 0; j < OPENPIC_OUTPUT_NB; j++) {
1619             sysbus_init_irq(d, &opp->dst[i].irqs[j]);
1620         }
1621
1622         opp->dst[i].raised.queue_size = IRQQUEUE_SIZE_BITS;
1623         opp->dst[i].raised.queue = bitmap_new(IRQQUEUE_SIZE_BITS);
1624         opp->dst[i].servicing.queue_size = IRQQUEUE_SIZE_BITS;
1625         opp->dst[i].servicing.queue = bitmap_new(IRQQUEUE_SIZE_BITS);
1626     }
1627
1628     sysbus_init_mmio(d, &opp->mem);
1629     qdev_init_gpio_in(dev, openpic_set_irq, opp->max_irq);
1630 }
1631
1632 static Property openpic_properties[] = {
1633     DEFINE_PROP_UINT32("model", OpenPICState, model, OPENPIC_MODEL_FSL_MPIC_20),
1634     DEFINE_PROP_UINT32("nb_cpus", OpenPICState, nb_cpus, 1),
1635     DEFINE_PROP_END_OF_LIST(),
1636 };
1637
1638 static void openpic_class_init(ObjectClass *oc, void *data)
1639 {
1640     DeviceClass *dc = DEVICE_CLASS(oc);
1641
1642     dc->realize = openpic_realize;
1643     dc->props = openpic_properties;
1644     dc->reset = openpic_reset;
1645     dc->vmsd = &vmstate_openpic;
1646 }
1647
1648 static const TypeInfo openpic_info = {
1649     .name          = TYPE_OPENPIC,
1650     .parent        = TYPE_SYS_BUS_DEVICE,
1651     .instance_size = sizeof(OpenPICState),
1652     .instance_init = openpic_init,
1653     .class_init    = openpic_class_init,
1654 };
1655
1656 static void openpic_register_types(void)
1657 {
1658     type_register_static(&openpic_info);
1659 }
1660
1661 type_init(openpic_register_types)