cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

openpic.c (47243B)


      1/*
      2 * OpenPIC emulation
      3 *
      4 * Copyright (c) 2004 Jocelyn Mayer
      5 *               2011 Alexander Graf
      6 *
      7 * Permission is hereby granted, free of charge, to any person obtaining a copy
      8 * of this software and associated documentation files (the "Software"), to deal
      9 * in the Software without restriction, including without limitation the rights
     10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     11 * copies of the Software, and to permit persons to whom the Software is
     12 * furnished to do so, subject to the following conditions:
     13 *
     14 * The above copyright notice and this permission notice shall be included in
     15 * all copies or substantial portions of the Software.
     16 *
     17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     23 * THE SOFTWARE.
     24 */
     25/*
     26 *
     27 * Based on OpenPic implementations:
     28 * - Motorola MPC8245 & MPC8540 user manuals.
     29 * - Motorola Harrier programmer manual
     30 *
     31 */
     32
     33#include "qemu/osdep.h"
     34#include "hw/irq.h"
     35#include "hw/ppc/mac.h"
     36#include "hw/pci/pci.h"
     37#include "hw/ppc/openpic.h"
     38#include "hw/ppc/ppc_e500.h"
     39#include "hw/qdev-properties.h"
     40#include "hw/sysbus.h"
     41#include "migration/vmstate.h"
     42#include "hw/pci/msi.h"
     43#include "qapi/error.h"
     44#include "qemu/bitops.h"
     45#include "qapi/qmp/qerror.h"
     46#include "qemu/module.h"
     47#include "qemu/timer.h"
     48#include "qemu/error-report.h"
     49
     50/* #define DEBUG_OPENPIC */
     51
     52#ifdef DEBUG_OPENPIC
     53static const int debug_openpic = 1;
     54#else
     55static const int debug_openpic = 0;
     56#endif
     57
     58static int get_current_cpu(void);
     59#define DPRINTF(fmt, ...) do { \
     60        if (debug_openpic) { \
     61            info_report("Core%d: " fmt, get_current_cpu(), ## __VA_ARGS__); \
     62        } \
     63    } while (0)
     64
     65/* OpenPIC capability flags */
     66#define OPENPIC_FLAG_IDR_CRIT     (1 << 0)
     67#define OPENPIC_FLAG_ILR          (2 << 0)
     68
     69/* OpenPIC address map */
     70#define OPENPIC_GLB_REG_START        0x0
     71#define OPENPIC_GLB_REG_SIZE         0x10F0
     72#define OPENPIC_TMR_REG_START        0x10F0
     73#define OPENPIC_TMR_REG_SIZE         0x220
     74#define OPENPIC_MSI_REG_START        0x1600
     75#define OPENPIC_MSI_REG_SIZE         0x200
     76#define OPENPIC_SUMMARY_REG_START   0x3800
     77#define OPENPIC_SUMMARY_REG_SIZE    0x800
     78#define OPENPIC_SRC_REG_START        0x10000
     79#define OPENPIC_SRC_REG_SIZE         (OPENPIC_MAX_SRC * 0x20)
     80#define OPENPIC_CPU_REG_START        0x20000
     81#define OPENPIC_CPU_REG_SIZE         0x100 + ((MAX_CPU - 1) * 0x1000)
     82
     83static FslMpicInfo fsl_mpic_20 = {
     84    .max_ext = 12,
     85};
     86
     87static FslMpicInfo fsl_mpic_42 = {
     88    .max_ext = 12,
     89};
     90
     91#define FRR_NIRQ_SHIFT    16
     92#define FRR_NCPU_SHIFT     8
     93#define FRR_VID_SHIFT      0
     94
     95#define VID_REVISION_1_2   2
     96#define VID_REVISION_1_3   3
     97
     98#define VIR_GENERIC      0x00000000 /* Generic Vendor ID */
     99#define VIR_MPIC2A       0x00004614 /* IBM MPIC-2A */
    100
    101#define GCR_RESET        0x80000000
    102#define GCR_MODE_PASS    0x00000000
    103#define GCR_MODE_MIXED   0x20000000
    104#define GCR_MODE_PROXY   0x60000000
    105
    106#define TBCR_CI           0x80000000 /* count inhibit */
    107#define TCCR_TOG          0x80000000 /* toggles when decrement to zero */
    108
    109#define IDR_EP_SHIFT      31
    110#define IDR_EP_MASK       (1U << IDR_EP_SHIFT)
    111#define IDR_CI0_SHIFT     30
    112#define IDR_CI1_SHIFT     29
    113#define IDR_P1_SHIFT      1
    114#define IDR_P0_SHIFT      0
    115
    116#define ILR_INTTGT_MASK   0x000000ff
    117#define ILR_INTTGT_INT    0x00
    118#define ILR_INTTGT_CINT   0x01 /* critical */
    119#define ILR_INTTGT_MCP    0x02 /* machine check */
    120
    121/*
    122 * The currently supported INTTGT values happen to be the same as QEMU's
    123 * openpic output codes, but don't depend on this.  The output codes
    124 * could change (unlikely, but...) or support could be added for
    125 * more INTTGT values.
    126 */
    127static const int inttgt_output[][2] = {
    128    { ILR_INTTGT_INT, OPENPIC_OUTPUT_INT },
    129    { ILR_INTTGT_CINT, OPENPIC_OUTPUT_CINT },
    130    { ILR_INTTGT_MCP, OPENPIC_OUTPUT_MCK },
    131};
    132
    133static int inttgt_to_output(int inttgt)
    134{
    135    int i;
    136
    137    for (i = 0; i < ARRAY_SIZE(inttgt_output); i++) {
    138        if (inttgt_output[i][0] == inttgt) {
    139            return inttgt_output[i][1];
    140        }
    141    }
    142
    143    error_report("%s: unsupported inttgt %d", __func__, inttgt);
    144    return OPENPIC_OUTPUT_INT;
    145}
    146
    147static int output_to_inttgt(int output)
    148{
    149    int i;
    150
    151    for (i = 0; i < ARRAY_SIZE(inttgt_output); i++) {
    152        if (inttgt_output[i][1] == output) {
    153            return inttgt_output[i][0];
    154        }
    155    }
    156
    157    abort();
    158}
    159
    160#define MSIIR_OFFSET       0x140
    161#define MSIIR_SRS_SHIFT    29
    162#define MSIIR_SRS_MASK     (0x7 << MSIIR_SRS_SHIFT)
    163#define MSIIR_IBS_SHIFT    24
    164#define MSIIR_IBS_MASK     (0x1f << MSIIR_IBS_SHIFT)
    165
    166static int get_current_cpu(void)
    167{
    168    if (!current_cpu) {
    169        return -1;
    170    }
    171
    172    return current_cpu->cpu_index;
    173}
    174
    175static uint32_t openpic_cpu_read_internal(void *opaque, hwaddr addr,
    176                                          int idx);
    177static void openpic_cpu_write_internal(void *opaque, hwaddr addr,
    178                                       uint32_t val, int idx);
    179static void openpic_reset(DeviceState *d);
    180
    181/*
    182 * Convert between openpic clock ticks and nanosecs.  In the hardware the clock
    183 * frequency is driven by board inputs to the PIC which the PIC would then
    184 * divide by 4 or 8.  For now hard code to 25MZ.
    185 */
    186#define OPENPIC_TIMER_FREQ_MHZ 25
    187#define OPENPIC_TIMER_NS_PER_TICK (1000 / OPENPIC_TIMER_FREQ_MHZ)
    188static inline uint64_t ns_to_ticks(uint64_t ns)
    189{
    190    return ns    / OPENPIC_TIMER_NS_PER_TICK;
    191}
    192static inline uint64_t ticks_to_ns(uint64_t ticks)
    193{
    194    return ticks * OPENPIC_TIMER_NS_PER_TICK;
    195}
    196
    197static inline void IRQ_setbit(IRQQueue *q, int n_IRQ)
    198{
    199    set_bit(n_IRQ, q->queue);
    200}
    201
    202static inline void IRQ_resetbit(IRQQueue *q, int n_IRQ)
    203{
    204    clear_bit(n_IRQ, q->queue);
    205}
    206
    207static void IRQ_check(OpenPICState *opp, IRQQueue *q)
    208{
    209    int irq = -1;
    210    int next = -1;
    211    int priority = -1;
    212
    213    for (;;) {
    214        irq = find_next_bit(q->queue, opp->max_irq, irq + 1);
    215        if (irq == opp->max_irq) {
    216            break;
    217        }
    218
    219        DPRINTF("IRQ_check: irq %d set ivpr_pr=%d pr=%d",
    220                irq, IVPR_PRIORITY(opp->src[irq].ivpr), priority);
    221
    222        if (IVPR_PRIORITY(opp->src[irq].ivpr) > priority) {
    223            next = irq;
    224            priority = IVPR_PRIORITY(opp->src[irq].ivpr);
    225        }
    226    }
    227
    228    q->next = next;
    229    q->priority = priority;
    230}
    231
    232static int IRQ_get_next(OpenPICState *opp, IRQQueue *q)
    233{
    234    /* XXX: optimize */
    235    IRQ_check(opp, q);
    236
    237    return q->next;
    238}
    239
    240static void IRQ_local_pipe(OpenPICState *opp, int n_CPU, int n_IRQ,
    241                           bool active, bool was_active)
    242{
    243    IRQDest *dst;
    244    IRQSource *src;
    245    int priority;
    246
    247    dst = &opp->dst[n_CPU];
    248    src = &opp->src[n_IRQ];
    249
    250    DPRINTF("%s: IRQ %d active %d was %d",
    251            __func__, n_IRQ, active, was_active);
    252
    253    if (src->output != OPENPIC_OUTPUT_INT) {
    254        DPRINTF("%s: output %d irq %d active %d was %d count %d",
    255                __func__, src->output, n_IRQ, active, was_active,
    256                dst->outputs_active[src->output]);
    257
    258        /*
    259         * On Freescale MPIC, critical interrupts ignore priority,
    260         * IACK, EOI, etc.  Before MPIC v4.1 they also ignore
    261         * masking.
    262         */
    263        if (active) {
    264            if (!was_active && dst->outputs_active[src->output]++ == 0) {
    265                DPRINTF("%s: Raise OpenPIC output %d cpu %d irq %d",
    266                        __func__, src->output, n_CPU, n_IRQ);
    267                qemu_irq_raise(dst->irqs[src->output]);
    268            }
    269        } else {
    270            if (was_active && --dst->outputs_active[src->output] == 0) {
    271                DPRINTF("%s: Lower OpenPIC output %d cpu %d irq %d",
    272                        __func__, src->output, n_CPU, n_IRQ);
    273                qemu_irq_lower(dst->irqs[src->output]);
    274            }
    275        }
    276
    277        return;
    278    }
    279
    280    priority = IVPR_PRIORITY(src->ivpr);
    281
    282    /*
    283     * Even if the interrupt doesn't have enough priority,
    284     * it is still raised, in case ctpr is lowered later.
    285     */
    286    if (active) {
    287        IRQ_setbit(&dst->raised, n_IRQ);
    288    } else {
    289        IRQ_resetbit(&dst->raised, n_IRQ);
    290    }
    291
    292    IRQ_check(opp, &dst->raised);
    293
    294    if (active && priority <= dst->ctpr) {
    295        DPRINTF("%s: IRQ %d priority %d too low for ctpr %d on CPU %d",
    296                __func__, n_IRQ, priority, dst->ctpr, n_CPU);
    297        active = 0;
    298    }
    299
    300    if (active) {
    301        if (IRQ_get_next(opp, &dst->servicing) >= 0 &&
    302                priority <= dst->servicing.priority) {
    303            DPRINTF("%s: IRQ %d is hidden by servicing IRQ %d on CPU %d",
    304                    __func__, n_IRQ, dst->servicing.next, n_CPU);
    305        } else {
    306            DPRINTF("%s: Raise OpenPIC INT output cpu %d irq %d/%d",
    307                    __func__, n_CPU, n_IRQ, dst->raised.next);
    308            qemu_irq_raise(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);
    309        }
    310    } else {
    311        IRQ_get_next(opp, &dst->servicing);
    312        if (dst->raised.priority > dst->ctpr &&
    313                dst->raised.priority > dst->servicing.priority) {
    314            DPRINTF("%s: IRQ %d inactive, IRQ %d prio %d above %d/%d, CPU %d",
    315                    __func__, n_IRQ, dst->raised.next, dst->raised.priority,
    316                    dst->ctpr, dst->servicing.priority, n_CPU);
    317            /* IRQ line stays asserted */
    318        } else {
    319            DPRINTF("%s: IRQ %d inactive, current prio %d/%d, CPU %d",
    320                    __func__, n_IRQ, dst->ctpr, dst->servicing.priority, n_CPU);
    321            qemu_irq_lower(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);
    322        }
    323    }
    324}
    325
    326/* update pic state because registers for n_IRQ have changed value */
    327static void openpic_update_irq(OpenPICState *opp, int n_IRQ)
    328{
    329    IRQSource *src;
    330    bool active, was_active;
    331    int i;
    332
    333    src = &opp->src[n_IRQ];
    334    active = src->pending;
    335
    336    if ((src->ivpr & IVPR_MASK_MASK) && !src->nomask) {
    337        /* Interrupt source is disabled */
    338        DPRINTF("%s: IRQ %d is disabled", __func__, n_IRQ);
    339        active = false;
    340    }
    341
    342    was_active = !!(src->ivpr & IVPR_ACTIVITY_MASK);
    343
    344    /*
    345     * We don't have a similar check for already-active because
    346     * ctpr may have changed and we need to withdraw the interrupt.
    347     */
    348    if (!active && !was_active) {
    349        DPRINTF("%s: IRQ %d is already inactive", __func__, n_IRQ);
    350        return;
    351    }
    352
    353    if (active) {
    354        src->ivpr |= IVPR_ACTIVITY_MASK;
    355    } else {
    356        src->ivpr &= ~IVPR_ACTIVITY_MASK;
    357    }
    358
    359    if (src->destmask == 0) {
    360        /* No target */
    361        DPRINTF("%s: IRQ %d has no target", __func__, n_IRQ);
    362        return;
    363    }
    364
    365    if (src->destmask == (1 << src->last_cpu)) {
    366        /* Only one CPU is allowed to receive this IRQ */
    367        IRQ_local_pipe(opp, src->last_cpu, n_IRQ, active, was_active);
    368    } else if (!(src->ivpr & IVPR_MODE_MASK)) {
    369        /* Directed delivery mode */
    370        for (i = 0; i < opp->nb_cpus; i++) {
    371            if (src->destmask & (1 << i)) {
    372                IRQ_local_pipe(opp, i, n_IRQ, active, was_active);
    373            }
    374        }
    375    } else {
    376        /* Distributed delivery mode */
    377        for (i = src->last_cpu + 1; i != src->last_cpu; i++) {
    378            if (i == opp->nb_cpus) {
    379                i = 0;
    380            }
    381            if (src->destmask & (1 << i)) {
    382                IRQ_local_pipe(opp, i, n_IRQ, active, was_active);
    383                src->last_cpu = i;
    384                break;
    385            }
    386        }
    387    }
    388}
    389
    390static void openpic_set_irq(void *opaque, int n_IRQ, int level)
    391{
    392    OpenPICState *opp = opaque;
    393    IRQSource *src;
    394
    395    if (n_IRQ >= OPENPIC_MAX_IRQ) {
    396        error_report("%s: IRQ %d out of range", __func__, n_IRQ);
    397        abort();
    398    }
    399
    400    src = &opp->src[n_IRQ];
    401    DPRINTF("openpic: set irq %d = %d ivpr=0x%08x",
    402            n_IRQ, level, src->ivpr);
    403    if (src->level) {
    404        /* level-sensitive irq */
    405        src->pending = level;
    406        openpic_update_irq(opp, n_IRQ);
    407    } else {
    408        /* edge-sensitive irq */
    409        if (level) {
    410            src->pending = 1;
    411            openpic_update_irq(opp, n_IRQ);
    412        }
    413
    414        if (src->output != OPENPIC_OUTPUT_INT) {
    415            /*
    416             * Edge-triggered interrupts shouldn't be used
    417             * with non-INT delivery, but just in case,
    418             * try to make it do something sane rather than
    419             * cause an interrupt storm.  This is close to
    420             * what you'd probably see happen in real hardware.
    421             */
    422            src->pending = 0;
    423            openpic_update_irq(opp, n_IRQ);
    424        }
    425    }
    426}
    427
    428static inline uint32_t read_IRQreg_idr(OpenPICState *opp, int n_IRQ)
    429{
    430    return opp->src[n_IRQ].idr;
    431}
    432
    433static inline uint32_t read_IRQreg_ilr(OpenPICState *opp, int n_IRQ)
    434{
    435    if (opp->flags & OPENPIC_FLAG_ILR) {
    436        return output_to_inttgt(opp->src[n_IRQ].output);
    437    }
    438
    439    return 0xffffffff;
    440}
    441
    442static inline uint32_t read_IRQreg_ivpr(OpenPICState *opp, int n_IRQ)
    443{
    444    return opp->src[n_IRQ].ivpr;
    445}
    446
    447static inline void write_IRQreg_idr(OpenPICState *opp, int n_IRQ, uint32_t val)
    448{
    449    IRQSource *src = &opp->src[n_IRQ];
    450    uint32_t normal_mask = (1UL << opp->nb_cpus) - 1;
    451    uint32_t crit_mask = 0;
    452    uint32_t mask = normal_mask;
    453    int crit_shift = IDR_EP_SHIFT - opp->nb_cpus;
    454    int i;
    455
    456    if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
    457        crit_mask = mask << crit_shift;
    458        mask |= crit_mask | IDR_EP;
    459    }
    460
    461    src->idr = val & mask;
    462    DPRINTF("Set IDR %d to 0x%08x", n_IRQ, src->idr);
    463
    464    if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
    465        if (src->idr & crit_mask) {
    466            if (src->idr & normal_mask) {
    467                DPRINTF("%s: IRQ configured for multiple output types, using "
    468                        "critical", __func__);
    469            }
    470
    471            src->output = OPENPIC_OUTPUT_CINT;
    472            src->nomask = true;
    473            src->destmask = 0;
    474
    475            for (i = 0; i < opp->nb_cpus; i++) {
    476                int n_ci = IDR_CI0_SHIFT - i;
    477
    478                if (src->idr & (1UL << n_ci)) {
    479                    src->destmask |= 1UL << i;
    480                }
    481            }
    482        } else {
    483            src->output = OPENPIC_OUTPUT_INT;
    484            src->nomask = false;
    485            src->destmask = src->idr & normal_mask;
    486        }
    487    } else {
    488        src->destmask = src->idr;
    489    }
    490}
    491
    492static inline void write_IRQreg_ilr(OpenPICState *opp, int n_IRQ, uint32_t val)
    493{
    494    if (opp->flags & OPENPIC_FLAG_ILR) {
    495        IRQSource *src = &opp->src[n_IRQ];
    496
    497        src->output = inttgt_to_output(val & ILR_INTTGT_MASK);
    498        DPRINTF("Set ILR %d to 0x%08x, output %d", n_IRQ, src->idr,
    499                src->output);
    500
    501        /* TODO: on MPIC v4.0 only, set nomask for non-INT */
    502    }
    503}
    504
    505static inline void write_IRQreg_ivpr(OpenPICState *opp, int n_IRQ, uint32_t val)
    506{
    507    uint32_t mask;
    508
    509    /*
    510     * NOTE when implementing newer FSL MPIC models: starting with v4.0,
    511     * the polarity bit is read-only on internal interrupts.
    512     */
    513    mask = IVPR_MASK_MASK | IVPR_PRIORITY_MASK | IVPR_SENSE_MASK |
    514           IVPR_POLARITY_MASK | opp->vector_mask;
    515
    516    /* ACTIVITY bit is read-only */
    517    opp->src[n_IRQ].ivpr =
    518        (opp->src[n_IRQ].ivpr & IVPR_ACTIVITY_MASK) | (val & mask);
    519
    520    /*
    521     * For FSL internal interrupts, The sense bit is reserved and zero,
    522     * and the interrupt is always level-triggered.  Timers and IPIs
    523     * have no sense or polarity bits, and are edge-triggered.
    524     */
    525    switch (opp->src[n_IRQ].type) {
    526    case IRQ_TYPE_NORMAL:
    527        opp->src[n_IRQ].level = !!(opp->src[n_IRQ].ivpr & IVPR_SENSE_MASK);
    528        break;
    529
    530    case IRQ_TYPE_FSLINT:
    531        opp->src[n_IRQ].ivpr &= ~IVPR_SENSE_MASK;
    532        break;
    533
    534    case IRQ_TYPE_FSLSPECIAL:
    535        opp->src[n_IRQ].ivpr &= ~(IVPR_POLARITY_MASK | IVPR_SENSE_MASK);
    536        break;
    537    }
    538
    539    openpic_update_irq(opp, n_IRQ);
    540    DPRINTF("Set IVPR %d to 0x%08x -> 0x%08x", n_IRQ, val,
    541            opp->src[n_IRQ].ivpr);
    542}
    543
    544static void openpic_gcr_write(OpenPICState *opp, uint64_t val)
    545{
    546    bool mpic_proxy = false;
    547
    548    if (val & GCR_RESET) {
    549        openpic_reset(DEVICE(opp));
    550        return;
    551    }
    552
    553    opp->gcr &= ~opp->mpic_mode_mask;
    554    opp->gcr |= val & opp->mpic_mode_mask;
    555
    556    /* Set external proxy mode */
    557    if ((val & opp->mpic_mode_mask) == GCR_MODE_PROXY) {
    558        mpic_proxy = true;
    559    }
    560
    561    ppce500_set_mpic_proxy(mpic_proxy);
    562}
    563
    564static void openpic_gbl_write(void *opaque, hwaddr addr, uint64_t val,
    565                              unsigned len)
    566{
    567    OpenPICState *opp = opaque;
    568    IRQDest *dst;
    569    int idx;
    570
    571    DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64,
    572            __func__, addr, val);
    573    if (addr & 0xF) {
    574        return;
    575    }
    576    switch (addr) {
    577    case 0x00: /* Block Revision Register1 (BRR1) is Readonly */
    578        break;
    579    case 0x40:
    580    case 0x50:
    581    case 0x60:
    582    case 0x70:
    583    case 0x80:
    584    case 0x90:
    585    case 0xA0:
    586    case 0xB0:
    587        openpic_cpu_write_internal(opp, addr, val, get_current_cpu());
    588        break;
    589    case 0x1000: /* FRR */
    590        break;
    591    case 0x1020: /* GCR */
    592        openpic_gcr_write(opp, val);
    593        break;
    594    case 0x1080: /* VIR */
    595        break;
    596    case 0x1090: /* PIR */
    597        for (idx = 0; idx < opp->nb_cpus; idx++) {
    598            if ((val & (1 << idx)) && !(opp->pir & (1 << idx))) {
    599                DPRINTF("Raise OpenPIC RESET output for CPU %d", idx);
    600                dst = &opp->dst[idx];
    601                qemu_irq_raise(dst->irqs[OPENPIC_OUTPUT_RESET]);
    602            } else if (!(val & (1 << idx)) && (opp->pir & (1 << idx))) {
    603                DPRINTF("Lower OpenPIC RESET output for CPU %d", idx);
    604                dst = &opp->dst[idx];
    605                qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_RESET]);
    606            }
    607        }
    608        opp->pir = val;
    609        break;
    610    case 0x10A0: /* IPI_IVPR */
    611    case 0x10B0:
    612    case 0x10C0:
    613    case 0x10D0:
    614        {
    615            int idx;
    616            idx = (addr - 0x10A0) >> 4;
    617            write_IRQreg_ivpr(opp, opp->irq_ipi0 + idx, val);
    618        }
    619        break;
    620    case 0x10E0: /* SPVE */
    621        opp->spve = val & opp->vector_mask;
    622        break;
    623    default:
    624        break;
    625    }
    626}
    627
    628static uint64_t openpic_gbl_read(void *opaque, hwaddr addr, unsigned len)
    629{
    630    OpenPICState *opp = opaque;
    631    uint32_t retval;
    632
    633    DPRINTF("%s: addr %#" HWADDR_PRIx, __func__, addr);
    634    retval = 0xFFFFFFFF;
    635    if (addr & 0xF) {
    636        return retval;
    637    }
    638    switch (addr) {
    639    case 0x1000: /* FRR */
    640        retval = opp->frr;
    641        break;
    642    case 0x1020: /* GCR */
    643        retval = opp->gcr;
    644        break;
    645    case 0x1080: /* VIR */
    646        retval = opp->vir;
    647        break;
    648    case 0x1090: /* PIR */
    649        retval = 0x00000000;
    650        break;
    651    case 0x00: /* Block Revision Register1 (BRR1) */
    652        retval = opp->brr1;
    653        break;
    654    case 0x40:
    655    case 0x50:
    656    case 0x60:
    657    case 0x70:
    658    case 0x80:
    659    case 0x90:
    660    case 0xA0:
    661    case 0xB0:
    662        retval = openpic_cpu_read_internal(opp, addr, get_current_cpu());
    663        break;
    664    case 0x10A0: /* IPI_IVPR */
    665    case 0x10B0:
    666    case 0x10C0:
    667    case 0x10D0:
    668        {
    669            int idx;
    670            idx = (addr - 0x10A0) >> 4;
    671            retval = read_IRQreg_ivpr(opp, opp->irq_ipi0 + idx);
    672        }
    673        break;
    674    case 0x10E0: /* SPVE */
    675        retval = opp->spve;
    676        break;
    677    default:
    678        break;
    679    }
    680    DPRINTF("%s: => 0x%08x", __func__, retval);
    681
    682    return retval;
    683}
    684
    685static void openpic_tmr_set_tmr(OpenPICTimer *tmr, uint32_t val, bool enabled);
    686
    687static void qemu_timer_cb(void *opaque)
    688{
    689    OpenPICTimer *tmr = opaque;
    690    OpenPICState *opp = tmr->opp;
    691    uint32_t    n_IRQ = tmr->n_IRQ;
    692    uint32_t val =   tmr->tbcr & ~TBCR_CI;
    693    uint32_t tog = ((tmr->tccr & TCCR_TOG) ^ TCCR_TOG);  /* invert toggle. */
    694
    695    DPRINTF("%s n_IRQ=%d", __func__, n_IRQ);
    696    /* Reload current count from base count and setup timer. */
    697    tmr->tccr = val | tog;
    698    openpic_tmr_set_tmr(tmr, val, /*enabled=*/true);
    699    /* Raise the interrupt. */
    700    opp->src[n_IRQ].destmask = read_IRQreg_idr(opp, n_IRQ);
    701    openpic_set_irq(opp, n_IRQ, 1);
    702    openpic_set_irq(opp, n_IRQ, 0);
    703}
    704
    705/*
    706 * If enabled is true, arranges for an interrupt to be raised val clocks into
    707 * the future, if enabled is false cancels the timer.
    708 */
    709static void openpic_tmr_set_tmr(OpenPICTimer *tmr, uint32_t val, bool enabled)
    710{
    711    uint64_t ns = ticks_to_ns(val & ~TCCR_TOG);
    712    /*
    713     * A count of zero causes a timer to be set to expire immediately.  This
    714     * effectively stops the simulation since the timer is constantly expiring
    715     * which prevents guest code execution, so we don't honor that
    716     * configuration.  On real hardware, this situation would generate an
    717     * interrupt on every clock cycle if the interrupt was unmasked.
    718     */
    719    if ((ns == 0) || !enabled) {
    720        tmr->qemu_timer_active = false;
    721        tmr->tccr = tmr->tccr & TCCR_TOG;
    722        timer_del(tmr->qemu_timer); /* set timer to never expire. */
    723    } else {
    724        tmr->qemu_timer_active = true;
    725        uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
    726        tmr->origin_time = now;
    727        timer_mod(tmr->qemu_timer, now + ns);     /* set timer expiration. */
    728    }
    729}
    730
    731/*
    732 * Returns the currrent tccr value, i.e., timer value (in clocks) with
    733 * appropriate TOG.
    734 */
    735static uint64_t openpic_tmr_get_timer(OpenPICTimer *tmr)
    736{
    737    uint64_t retval;
    738    if (!tmr->qemu_timer_active) {
    739        retval = tmr->tccr;
    740    } else {
    741        uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
    742        uint64_t used = now - tmr->origin_time;  /* nsecs */
    743        uint32_t used_ticks = (uint32_t)ns_to_ticks(used);
    744        uint32_t count = (tmr->tccr & ~TCCR_TOG) - used_ticks;
    745        retval = (uint32_t)((tmr->tccr & TCCR_TOG) | (count & ~TCCR_TOG));
    746    }
    747    return retval;
    748}
    749
    750static void openpic_tmr_write(void *opaque, hwaddr addr, uint64_t val,
    751                              unsigned len)
    752{
    753    OpenPICState *opp = opaque;
    754    int idx;
    755
    756    DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64,
    757            __func__, (addr + 0x10f0), val);
    758    if (addr & 0xF) {
    759        return;
    760    }
    761
    762    if (addr == 0) {
    763        /* TFRR */
    764        opp->tfrr = val;
    765        return;
    766    }
    767    addr -= 0x10;  /* correct for TFRR */
    768    idx = (addr >> 6) & 0x3;
    769
    770    switch (addr & 0x30) {
    771    case 0x00: /* TCCR */
    772        break;
    773    case 0x10: /* TBCR */
    774        /* Did the enable status change? */
    775        if ((opp->timers[idx].tbcr & TBCR_CI) != (val & TBCR_CI)) {
    776            /* Did "Count Inhibit" transition from 1 to 0? */
    777            if ((val & TBCR_CI) == 0) {
    778                opp->timers[idx].tccr = val & ~TCCR_TOG;
    779            }
    780            openpic_tmr_set_tmr(&opp->timers[idx],
    781                                (val & ~TBCR_CI),
    782                                /*enabled=*/((val & TBCR_CI) == 0));
    783        }
    784        opp->timers[idx].tbcr = val;
    785        break;
    786    case 0x20: /* TVPR */
    787        write_IRQreg_ivpr(opp, opp->irq_tim0 + idx, val);
    788        break;
    789    case 0x30: /* TDR */
    790        write_IRQreg_idr(opp, opp->irq_tim0 + idx, val);
    791        break;
    792    }
    793}
    794
    795static uint64_t openpic_tmr_read(void *opaque, hwaddr addr, unsigned len)
    796{
    797    OpenPICState *opp = opaque;
    798    uint32_t retval = -1;
    799    int idx;
    800
    801    DPRINTF("%s: addr %#" HWADDR_PRIx, __func__, addr + 0x10f0);
    802    if (addr & 0xF) {
    803        goto out;
    804    }
    805    if (addr == 0) {
    806        /* TFRR */
    807        retval = opp->tfrr;
    808        goto out;
    809    }
    810    addr -= 0x10;  /* correct for TFRR */
    811    idx = (addr >> 6) & 0x3;
    812    switch (addr & 0x30) {
    813    case 0x00: /* TCCR */
    814        retval = openpic_tmr_get_timer(&opp->timers[idx]);
    815        break;
    816    case 0x10: /* TBCR */
    817        retval = opp->timers[idx].tbcr;
    818        break;
    819    case 0x20: /* TVPR */
    820        retval = read_IRQreg_ivpr(opp, opp->irq_tim0 + idx);
    821        break;
    822    case 0x30: /* TDR */
    823        retval = read_IRQreg_idr(opp, opp->irq_tim0 + idx);
    824        break;
    825    }
    826
    827out:
    828    DPRINTF("%s: => 0x%08x", __func__, retval);
    829
    830    return retval;
    831}
    832
    833static void openpic_src_write(void *opaque, hwaddr addr, uint64_t val,
    834                              unsigned len)
    835{
    836    OpenPICState *opp = opaque;
    837    int idx;
    838
    839    DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64,
    840            __func__, addr, val);
    841
    842    addr = addr & 0xffff;
    843    idx = addr >> 5;
    844
    845    switch (addr & 0x1f) {
    846    case 0x00:
    847        write_IRQreg_ivpr(opp, idx, val);
    848        break;
    849    case 0x10:
    850        write_IRQreg_idr(opp, idx, val);
    851        break;
    852    case 0x18:
    853        write_IRQreg_ilr(opp, idx, val);
    854        break;
    855    }
    856}
    857
    858static uint64_t openpic_src_read(void *opaque, uint64_t addr, unsigned len)
    859{
    860    OpenPICState *opp = opaque;
    861    uint32_t retval;
    862    int idx;
    863
    864    DPRINTF("%s: addr %#" HWADDR_PRIx, __func__, addr);
    865    retval = 0xFFFFFFFF;
    866
    867    addr = addr & 0xffff;
    868    idx = addr >> 5;
    869
    870    switch (addr & 0x1f) {
    871    case 0x00:
    872        retval = read_IRQreg_ivpr(opp, idx);
    873        break;
    874    case 0x10:
    875        retval = read_IRQreg_idr(opp, idx);
    876        break;
    877    case 0x18:
    878        retval = read_IRQreg_ilr(opp, idx);
    879        break;
    880    }
    881
    882    DPRINTF("%s: => 0x%08x", __func__, retval);
    883    return retval;
    884}
    885
    886static void openpic_msi_write(void *opaque, hwaddr addr, uint64_t val,
    887                              unsigned size)
    888{
    889    OpenPICState *opp = opaque;
    890    int idx = opp->irq_msi;
    891    int srs, ibs;
    892
    893    DPRINTF("%s: addr %#" HWADDR_PRIx " <= 0x%08" PRIx64,
    894            __func__, addr, val);
    895    if (addr & 0xF) {
    896        return;
    897    }
    898
    899    switch (addr) {
    900    case MSIIR_OFFSET:
    901        srs = val >> MSIIR_SRS_SHIFT;
    902        idx += srs;
    903        ibs = (val & MSIIR_IBS_MASK) >> MSIIR_IBS_SHIFT;
    904        opp->msi[srs].msir |= 1 << ibs;
    905        openpic_set_irq(opp, idx, 1);
    906        break;
    907    default:
    908        /* most registers are read-only, thus ignored */
    909        break;
    910    }
    911}
    912
    913static uint64_t openpic_msi_read(void *opaque, hwaddr addr, unsigned size)
    914{
    915    OpenPICState *opp = opaque;
    916    uint64_t r = 0;
    917    int i, srs;
    918
    919    DPRINTF("%s: addr %#" HWADDR_PRIx, __func__, addr);
    920    if (addr & 0xF) {
    921        return -1;
    922    }
    923
    924    srs = addr >> 4;
    925
    926    switch (addr) {
    927    case 0x00:
    928    case 0x10:
    929    case 0x20:
    930    case 0x30:
    931    case 0x40:
    932    case 0x50:
    933    case 0x60:
    934    case 0x70: /* MSIRs */
    935        r = opp->msi[srs].msir;
    936        /* Clear on read */
    937        opp->msi[srs].msir = 0;
    938        openpic_set_irq(opp, opp->irq_msi + srs, 0);
    939        break;
    940    case 0x120: /* MSISR */
    941        for (i = 0; i < MAX_MSI; i++) {
    942            r |= (opp->msi[i].msir ? 1 : 0) << i;
    943        }
    944        break;
    945    }
    946
    947    return r;
    948}
    949
    950static uint64_t openpic_summary_read(void *opaque, hwaddr addr, unsigned size)
    951{
    952    uint64_t r = 0;
    953
    954    DPRINTF("%s: addr %#" HWADDR_PRIx, __func__, addr);
    955
    956    /* TODO: EISR/EIMR */
    957
    958    return r;
    959}
    960
    961static void openpic_summary_write(void *opaque, hwaddr addr, uint64_t val,
    962                                  unsigned size)
    963{
    964    DPRINTF("%s: addr %#" HWADDR_PRIx " <= 0x%08" PRIx64,
    965            __func__, addr, val);
    966
    967    /* TODO: EISR/EIMR */
    968}
    969
    970static void openpic_cpu_write_internal(void *opaque, hwaddr addr,
    971                                       uint32_t val, int idx)
    972{
    973    OpenPICState *opp = opaque;
    974    IRQSource *src;
    975    IRQDest *dst;
    976    int s_IRQ, n_IRQ;
    977
    978    DPRINTF("%s: cpu %d addr %#" HWADDR_PRIx " <= 0x%08x", __func__, idx,
    979            addr, val);
    980
    981    if (idx < 0 || idx >= opp->nb_cpus) {
    982        return;
    983    }
    984
    985    if (addr & 0xF) {
    986        return;
    987    }
    988    dst = &opp->dst[idx];
    989    addr &= 0xFF0;
    990    switch (addr) {
    991    case 0x40: /* IPIDR */
    992    case 0x50:
    993    case 0x60:
    994    case 0x70:
    995        idx = (addr - 0x40) >> 4;
    996        /* we use IDE as mask which CPUs to deliver the IPI to still. */
    997        opp->src[opp->irq_ipi0 + idx].destmask |= val;
    998        openpic_set_irq(opp, opp->irq_ipi0 + idx, 1);
    999        openpic_set_irq(opp, opp->irq_ipi0 + idx, 0);
   1000        break;
   1001    case 0x80: /* CTPR */
   1002        dst->ctpr = val & 0x0000000F;
   1003
   1004        DPRINTF("%s: set CPU %d ctpr to %d, raised %d servicing %d",
   1005                __func__, idx, dst->ctpr, dst->raised.priority,
   1006                dst->servicing.priority);
   1007
   1008        if (dst->raised.priority <= dst->ctpr) {
   1009            DPRINTF("%s: Lower OpenPIC INT output cpu %d due to ctpr",
   1010                    __func__, idx);
   1011            qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_INT]);
   1012        } else if (dst->raised.priority > dst->servicing.priority) {
   1013            DPRINTF("%s: Raise OpenPIC INT output cpu %d irq %d",
   1014                    __func__, idx, dst->raised.next);
   1015            qemu_irq_raise(dst->irqs[OPENPIC_OUTPUT_INT]);
   1016        }
   1017
   1018        break;
   1019    case 0x90: /* WHOAMI */
   1020        /* Read-only register */
   1021        break;
   1022    case 0xA0: /* IACK */
   1023        /* Read-only register */
   1024        break;
   1025    case 0xB0: /* EOI */
   1026        DPRINTF("EOI");
   1027        s_IRQ = IRQ_get_next(opp, &dst->servicing);
   1028
   1029        if (s_IRQ < 0) {
   1030            DPRINTF("%s: EOI with no interrupt in service", __func__);
   1031            break;
   1032        }
   1033
   1034        IRQ_resetbit(&dst->servicing, s_IRQ);
   1035        /* Set up next servicing IRQ */
   1036        s_IRQ = IRQ_get_next(opp, &dst->servicing);
   1037        /* Check queued interrupts. */
   1038        n_IRQ = IRQ_get_next(opp, &dst->raised);
   1039        src = &opp->src[n_IRQ];
   1040        if (n_IRQ != -1 &&
   1041            (s_IRQ == -1 ||
   1042             IVPR_PRIORITY(src->ivpr) > dst->servicing.priority)) {
   1043            DPRINTF("Raise OpenPIC INT output cpu %d irq %d",
   1044                    idx, n_IRQ);
   1045            qemu_irq_raise(opp->dst[idx].irqs[OPENPIC_OUTPUT_INT]);
   1046        }
   1047        break;
   1048    default:
   1049        break;
   1050    }
   1051}
   1052
   1053static void openpic_cpu_write(void *opaque, hwaddr addr, uint64_t val,
   1054                              unsigned len)
   1055{
   1056    openpic_cpu_write_internal(opaque, addr, val, (addr & 0x1f000) >> 12);
   1057}
   1058
   1059
   1060static uint32_t openpic_iack(OpenPICState *opp, IRQDest *dst, int cpu)
   1061{
   1062    IRQSource *src;
   1063    int retval, irq;
   1064
   1065    DPRINTF("Lower OpenPIC INT output");
   1066    qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_INT]);
   1067
   1068    irq = IRQ_get_next(opp, &dst->raised);
   1069    DPRINTF("IACK: irq=%d", irq);
   1070
   1071    if (irq == -1) {
   1072        /* No more interrupt pending */
   1073        return opp->spve;
   1074    }
   1075
   1076    src = &opp->src[irq];
   1077    if (!(src->ivpr & IVPR_ACTIVITY_MASK) ||
   1078            !(IVPR_PRIORITY(src->ivpr) > dst->ctpr)) {
   1079        error_report("%s: bad raised IRQ %d ctpr %d ivpr 0x%08x",
   1080                __func__, irq, dst->ctpr, src->ivpr);
   1081        openpic_update_irq(opp, irq);
   1082        retval = opp->spve;
   1083    } else {
   1084        /* IRQ enter servicing state */
   1085        IRQ_setbit(&dst->servicing, irq);
   1086        retval = IVPR_VECTOR(opp, src->ivpr);
   1087    }
   1088
   1089    if (!src->level) {
   1090        /* edge-sensitive IRQ */
   1091        src->ivpr &= ~IVPR_ACTIVITY_MASK;
   1092        src->pending = 0;
   1093        IRQ_resetbit(&dst->raised, irq);
   1094    }
   1095
   1096    /* Timers and IPIs support multicast. */
   1097    if (((irq >= opp->irq_ipi0) && (irq < (opp->irq_ipi0 + OPENPIC_MAX_IPI))) ||
   1098        ((irq >= opp->irq_tim0) && (irq < (opp->irq_tim0 + OPENPIC_MAX_TMR)))) {
   1099        DPRINTF("irq is IPI or TMR");
   1100        src->destmask &= ~(1 << cpu);
   1101        if (src->destmask && !src->level) {
   1102            /* trigger on CPUs that didn't know about it yet */
   1103            openpic_set_irq(opp, irq, 1);
   1104            openpic_set_irq(opp, irq, 0);
   1105            /* if all CPUs knew about it, set active bit again */
   1106            src->ivpr |= IVPR_ACTIVITY_MASK;
   1107        }
   1108    }
   1109
   1110    return retval;
   1111}
   1112
   1113static uint32_t openpic_cpu_read_internal(void *opaque, hwaddr addr,
   1114                                          int idx)
   1115{
   1116    OpenPICState *opp = opaque;
   1117    IRQDest *dst;
   1118    uint32_t retval;
   1119
   1120    DPRINTF("%s: cpu %d addr %#" HWADDR_PRIx, __func__, idx, addr);
   1121    retval = 0xFFFFFFFF;
   1122
   1123    if (idx < 0 || idx >= opp->nb_cpus) {
   1124        return retval;
   1125    }
   1126
   1127    if (addr & 0xF) {
   1128        return retval;
   1129    }
   1130    dst = &opp->dst[idx];
   1131    addr &= 0xFF0;
   1132    switch (addr) {
   1133    case 0x80: /* CTPR */
   1134        retval = dst->ctpr;
   1135        break;
   1136    case 0x90: /* WHOAMI */
   1137        retval = idx;
   1138        break;
   1139    case 0xA0: /* IACK */
   1140        retval = openpic_iack(opp, dst, idx);
   1141        break;
   1142    case 0xB0: /* EOI */
   1143        retval = 0;
   1144        break;
   1145    default:
   1146        break;
   1147    }
   1148    DPRINTF("%s: => 0x%08x", __func__, retval);
   1149
   1150    return retval;
   1151}
   1152
   1153static uint64_t openpic_cpu_read(void *opaque, hwaddr addr, unsigned len)
   1154{
   1155    return openpic_cpu_read_internal(opaque, addr, (addr & 0x1f000) >> 12);
   1156}
   1157
   1158static const MemoryRegionOps openpic_glb_ops_le = {
   1159    .write = openpic_gbl_write,
   1160    .read  = openpic_gbl_read,
   1161    .endianness = DEVICE_LITTLE_ENDIAN,
   1162    .impl = {
   1163        .min_access_size = 4,
   1164        .max_access_size = 4,
   1165    },
   1166};
   1167
   1168static const MemoryRegionOps openpic_glb_ops_be = {
   1169    .write = openpic_gbl_write,
   1170    .read  = openpic_gbl_read,
   1171    .endianness = DEVICE_BIG_ENDIAN,
   1172    .impl = {
   1173        .min_access_size = 4,
   1174        .max_access_size = 4,
   1175    },
   1176};
   1177
   1178static const MemoryRegionOps openpic_tmr_ops_le = {
   1179    .write = openpic_tmr_write,
   1180    .read  = openpic_tmr_read,
   1181    .endianness = DEVICE_LITTLE_ENDIAN,
   1182    .impl = {
   1183        .min_access_size = 4,
   1184        .max_access_size = 4,
   1185    },
   1186};
   1187
   1188static const MemoryRegionOps openpic_tmr_ops_be = {
   1189    .write = openpic_tmr_write,
   1190    .read  = openpic_tmr_read,
   1191    .endianness = DEVICE_BIG_ENDIAN,
   1192    .impl = {
   1193        .min_access_size = 4,
   1194        .max_access_size = 4,
   1195    },
   1196};
   1197
   1198static const MemoryRegionOps openpic_cpu_ops_le = {
   1199    .write = openpic_cpu_write,
   1200    .read  = openpic_cpu_read,
   1201    .endianness = DEVICE_LITTLE_ENDIAN,
   1202    .impl = {
   1203        .min_access_size = 4,
   1204        .max_access_size = 4,
   1205    },
   1206};
   1207
   1208static const MemoryRegionOps openpic_cpu_ops_be = {
   1209    .write = openpic_cpu_write,
   1210    .read  = openpic_cpu_read,
   1211    .endianness = DEVICE_BIG_ENDIAN,
   1212    .impl = {
   1213        .min_access_size = 4,
   1214        .max_access_size = 4,
   1215    },
   1216};
   1217
   1218static const MemoryRegionOps openpic_src_ops_le = {
   1219    .write = openpic_src_write,
   1220    .read  = openpic_src_read,
   1221    .endianness = DEVICE_LITTLE_ENDIAN,
   1222    .impl = {
   1223        .min_access_size = 4,
   1224        .max_access_size = 4,
   1225    },
   1226};
   1227
   1228static const MemoryRegionOps openpic_src_ops_be = {
   1229    .write = openpic_src_write,
   1230    .read  = openpic_src_read,
   1231    .endianness = DEVICE_BIG_ENDIAN,
   1232    .impl = {
   1233        .min_access_size = 4,
   1234        .max_access_size = 4,
   1235    },
   1236};
   1237
   1238static const MemoryRegionOps openpic_msi_ops_be = {
   1239    .read = openpic_msi_read,
   1240    .write = openpic_msi_write,
   1241    .endianness = DEVICE_BIG_ENDIAN,
   1242    .impl = {
   1243        .min_access_size = 4,
   1244        .max_access_size = 4,
   1245    },
   1246};
   1247
   1248static const MemoryRegionOps openpic_summary_ops_be = {
   1249    .read = openpic_summary_read,
   1250    .write = openpic_summary_write,
   1251    .endianness = DEVICE_BIG_ENDIAN,
   1252    .impl = {
   1253        .min_access_size = 4,
   1254        .max_access_size = 4,
   1255    },
   1256};
   1257
   1258static void openpic_reset(DeviceState *d)
   1259{
   1260    OpenPICState *opp = OPENPIC(d);
   1261    int i;
   1262
   1263    opp->gcr = GCR_RESET;
   1264    /* Initialise controller registers */
   1265    opp->frr = ((opp->nb_irqs - 1) << FRR_NIRQ_SHIFT) |
   1266               ((opp->nb_cpus - 1) << FRR_NCPU_SHIFT) |
   1267               (opp->vid << FRR_VID_SHIFT);
   1268
   1269    opp->pir = 0;
   1270    opp->spve = -1 & opp->vector_mask;
   1271    opp->tfrr = opp->tfrr_reset;
   1272    /* Initialise IRQ sources */
   1273    for (i = 0; i < opp->max_irq; i++) {
   1274        opp->src[i].ivpr = opp->ivpr_reset;
   1275        switch (opp->src[i].type) {
   1276        case IRQ_TYPE_NORMAL:
   1277            opp->src[i].level = !!(opp->ivpr_reset & IVPR_SENSE_MASK);
   1278            break;
   1279
   1280        case IRQ_TYPE_FSLINT:
   1281            opp->src[i].ivpr |= IVPR_POLARITY_MASK;
   1282            break;
   1283
   1284        case IRQ_TYPE_FSLSPECIAL:
   1285            break;
   1286        }
   1287
   1288        /* Mask all IPI interrupts for Freescale OpenPIC */
   1289        if ((opp->model == OPENPIC_MODEL_FSL_MPIC_20) ||
   1290            (opp->model == OPENPIC_MODEL_FSL_MPIC_42)) {
   1291            if (i >= opp->irq_ipi0 && i < opp->irq_tim0) {
   1292                write_IRQreg_idr(opp, i, 0);
   1293                continue;
   1294            }
   1295        }
   1296
   1297        write_IRQreg_idr(opp, i, opp->idr_reset);
   1298    }
   1299    /* Initialise IRQ destinations */
   1300    for (i = 0; i < opp->nb_cpus; i++) {
   1301        opp->dst[i].ctpr      = 15;
   1302        opp->dst[i].raised.next = -1;
   1303        opp->dst[i].raised.priority = 0;
   1304        bitmap_clear(opp->dst[i].raised.queue, 0, IRQQUEUE_SIZE_BITS);
   1305        opp->dst[i].servicing.next = -1;
   1306        opp->dst[i].servicing.priority = 0;
   1307        bitmap_clear(opp->dst[i].servicing.queue, 0, IRQQUEUE_SIZE_BITS);
   1308    }
   1309    /* Initialise timers */
   1310    for (i = 0; i < OPENPIC_MAX_TMR; i++) {
   1311        opp->timers[i].tccr = 0;
   1312        opp->timers[i].tbcr = TBCR_CI;
   1313        if (opp->timers[i].qemu_timer_active) {
   1314            timer_del(opp->timers[i].qemu_timer);  /* Inhibit timer */
   1315            opp->timers[i].qemu_timer_active = false;
   1316        }
   1317    }
   1318    /* Go out of RESET state */
   1319    opp->gcr = 0;
   1320}
   1321
   1322typedef struct MemReg {
   1323    const char             *name;
   1324    MemoryRegionOps const  *ops;
   1325    hwaddr                  start_addr;
   1326    ram_addr_t              size;
   1327} MemReg;
   1328
   1329static void fsl_common_init(OpenPICState *opp)
   1330{
   1331    int i;
   1332    int virq = OPENPIC_MAX_SRC;
   1333
   1334    opp->vid = VID_REVISION_1_2;
   1335    opp->vir = VIR_GENERIC;
   1336    opp->vector_mask = 0xFFFF;
   1337    opp->tfrr_reset = 0;
   1338    opp->ivpr_reset = IVPR_MASK_MASK;
   1339    opp->idr_reset = 1 << 0;
   1340    opp->max_irq = OPENPIC_MAX_IRQ;
   1341
   1342    opp->irq_ipi0 = virq;
   1343    virq += OPENPIC_MAX_IPI;
   1344    opp->irq_tim0 = virq;
   1345    virq += OPENPIC_MAX_TMR;
   1346
   1347    assert(virq <= OPENPIC_MAX_IRQ);
   1348
   1349    opp->irq_msi = 224;
   1350
   1351    msi_nonbroken = true;
   1352    for (i = 0; i < opp->fsl->max_ext; i++) {
   1353        opp->src[i].level = false;
   1354    }
   1355
   1356    /* Internal interrupts, including message and MSI */
   1357    for (i = 16; i < OPENPIC_MAX_SRC; i++) {
   1358        opp->src[i].type = IRQ_TYPE_FSLINT;
   1359        opp->src[i].level = true;
   1360    }
   1361
   1362    /* timers and IPIs */
   1363    for (i = OPENPIC_MAX_SRC; i < virq; i++) {
   1364        opp->src[i].type = IRQ_TYPE_FSLSPECIAL;
   1365        opp->src[i].level = false;
   1366    }
   1367
   1368    for (i = 0; i < OPENPIC_MAX_TMR; i++) {
   1369        opp->timers[i].n_IRQ = opp->irq_tim0 + i;
   1370        opp->timers[i].qemu_timer_active = false;
   1371        opp->timers[i].qemu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
   1372                                                 &qemu_timer_cb,
   1373                                                 &opp->timers[i]);
   1374        opp->timers[i].opp = opp;
   1375    }
   1376}
   1377
   1378static void map_list(OpenPICState *opp, const MemReg *list, int *count)
   1379{
   1380    while (list->name) {
   1381        assert(*count < ARRAY_SIZE(opp->sub_io_mem));
   1382
   1383        memory_region_init_io(&opp->sub_io_mem[*count], OBJECT(opp), list->ops,
   1384                              opp, list->name, list->size);
   1385
   1386        memory_region_add_subregion(&opp->mem, list->start_addr,
   1387                                    &opp->sub_io_mem[*count]);
   1388
   1389        (*count)++;
   1390        list++;
   1391    }
   1392}
   1393
   1394static const VMStateDescription vmstate_openpic_irq_queue = {
   1395    .name = "openpic_irq_queue",
   1396    .version_id = 0,
   1397    .minimum_version_id = 0,
   1398    .fields = (VMStateField[]) {
   1399        VMSTATE_BITMAP(queue, IRQQueue, 0, queue_size),
   1400        VMSTATE_INT32(next, IRQQueue),
   1401        VMSTATE_INT32(priority, IRQQueue),
   1402        VMSTATE_END_OF_LIST()
   1403    }
   1404};
   1405
   1406static const VMStateDescription vmstate_openpic_irqdest = {
   1407    .name = "openpic_irqdest",
   1408    .version_id = 0,
   1409    .minimum_version_id = 0,
   1410    .fields = (VMStateField[]) {
   1411        VMSTATE_INT32(ctpr, IRQDest),
   1412        VMSTATE_STRUCT(raised, IRQDest, 0, vmstate_openpic_irq_queue,
   1413                       IRQQueue),
   1414        VMSTATE_STRUCT(servicing, IRQDest, 0, vmstate_openpic_irq_queue,
   1415                       IRQQueue),
   1416        VMSTATE_UINT32_ARRAY(outputs_active, IRQDest, OPENPIC_OUTPUT_NB),
   1417        VMSTATE_END_OF_LIST()
   1418    }
   1419};
   1420
   1421static const VMStateDescription vmstate_openpic_irqsource = {
   1422    .name = "openpic_irqsource",
   1423    .version_id = 0,
   1424    .minimum_version_id = 0,
   1425    .fields = (VMStateField[]) {
   1426        VMSTATE_UINT32(ivpr, IRQSource),
   1427        VMSTATE_UINT32(idr, IRQSource),
   1428        VMSTATE_UINT32(destmask, IRQSource),
   1429        VMSTATE_INT32(last_cpu, IRQSource),
   1430        VMSTATE_INT32(pending, IRQSource),
   1431        VMSTATE_END_OF_LIST()
   1432    }
   1433};
   1434
   1435static const VMStateDescription vmstate_openpic_timer = {
   1436    .name = "openpic_timer",
   1437    .version_id = 0,
   1438    .minimum_version_id = 0,
   1439    .fields = (VMStateField[]) {
   1440        VMSTATE_UINT32(tccr, OpenPICTimer),
   1441        VMSTATE_UINT32(tbcr, OpenPICTimer),
   1442        VMSTATE_END_OF_LIST()
   1443    }
   1444};
   1445
   1446static const VMStateDescription vmstate_openpic_msi = {
   1447    .name = "openpic_msi",
   1448    .version_id = 0,
   1449    .minimum_version_id = 0,
   1450    .fields = (VMStateField[]) {
   1451        VMSTATE_UINT32(msir, OpenPICMSI),
   1452        VMSTATE_END_OF_LIST()
   1453    }
   1454};
   1455
   1456static int openpic_post_load(void *opaque, int version_id)
   1457{
   1458    OpenPICState *opp = (OpenPICState *)opaque;
   1459    int i;
   1460
   1461    /* Update internal ivpr and idr variables */
   1462    for (i = 0; i < opp->max_irq; i++) {
   1463        write_IRQreg_idr(opp, i, opp->src[i].idr);
   1464        write_IRQreg_ivpr(opp, i, opp->src[i].ivpr);
   1465    }
   1466
   1467    return 0;
   1468}
   1469
   1470static const VMStateDescription vmstate_openpic = {
   1471    .name = "openpic",
   1472    .version_id = 3,
   1473    .minimum_version_id = 3,
   1474    .post_load = openpic_post_load,
   1475    .fields = (VMStateField[]) {
   1476        VMSTATE_UINT32(gcr, OpenPICState),
   1477        VMSTATE_UINT32(vir, OpenPICState),
   1478        VMSTATE_UINT32(pir, OpenPICState),
   1479        VMSTATE_UINT32(spve, OpenPICState),
   1480        VMSTATE_UINT32(tfrr, OpenPICState),
   1481        VMSTATE_UINT32(max_irq, OpenPICState),
   1482        VMSTATE_STRUCT_VARRAY_UINT32(src, OpenPICState, max_irq, 0,
   1483                                     vmstate_openpic_irqsource, IRQSource),
   1484        VMSTATE_UINT32_EQUAL(nb_cpus, OpenPICState, NULL),
   1485        VMSTATE_STRUCT_VARRAY_UINT32(dst, OpenPICState, nb_cpus, 0,
   1486                                     vmstate_openpic_irqdest, IRQDest),
   1487        VMSTATE_STRUCT_ARRAY(timers, OpenPICState, OPENPIC_MAX_TMR, 0,
   1488                             vmstate_openpic_timer, OpenPICTimer),
   1489        VMSTATE_STRUCT_ARRAY(msi, OpenPICState, MAX_MSI, 0,
   1490                             vmstate_openpic_msi, OpenPICMSI),
   1491        VMSTATE_UINT32(irq_ipi0, OpenPICState),
   1492        VMSTATE_UINT32(irq_tim0, OpenPICState),
   1493        VMSTATE_UINT32(irq_msi, OpenPICState),
   1494        VMSTATE_END_OF_LIST()
   1495    }
   1496};
   1497
   1498static void openpic_init(Object *obj)
   1499{
   1500    OpenPICState *opp = OPENPIC(obj);
   1501
   1502    memory_region_init(&opp->mem, obj, "openpic", 0x40000);
   1503}
   1504
   1505static void openpic_realize(DeviceState *dev, Error **errp)
   1506{
   1507    SysBusDevice *d = SYS_BUS_DEVICE(dev);
   1508    OpenPICState *opp = OPENPIC(dev);
   1509    int i, j;
   1510    int list_count = 0;
   1511    static const MemReg list_le[] = {
   1512        {"glb", &openpic_glb_ops_le,
   1513                OPENPIC_GLB_REG_START, OPENPIC_GLB_REG_SIZE},
   1514        {"tmr", &openpic_tmr_ops_le,
   1515                OPENPIC_TMR_REG_START, OPENPIC_TMR_REG_SIZE},
   1516        {"src", &openpic_src_ops_le,
   1517                OPENPIC_SRC_REG_START, OPENPIC_SRC_REG_SIZE},
   1518        {"cpu", &openpic_cpu_ops_le,
   1519                OPENPIC_CPU_REG_START, OPENPIC_CPU_REG_SIZE},
   1520        {NULL}
   1521    };
   1522    static const MemReg list_be[] = {
   1523        {"glb", &openpic_glb_ops_be,
   1524                OPENPIC_GLB_REG_START, OPENPIC_GLB_REG_SIZE},
   1525        {"tmr", &openpic_tmr_ops_be,
   1526                OPENPIC_TMR_REG_START, OPENPIC_TMR_REG_SIZE},
   1527        {"src", &openpic_src_ops_be,
   1528                OPENPIC_SRC_REG_START, OPENPIC_SRC_REG_SIZE},
   1529        {"cpu", &openpic_cpu_ops_be,
   1530                OPENPIC_CPU_REG_START, OPENPIC_CPU_REG_SIZE},
   1531        {NULL}
   1532    };
   1533    static const MemReg list_fsl[] = {
   1534        {"msi", &openpic_msi_ops_be,
   1535                OPENPIC_MSI_REG_START, OPENPIC_MSI_REG_SIZE},
   1536        {"summary", &openpic_summary_ops_be,
   1537                OPENPIC_SUMMARY_REG_START, OPENPIC_SUMMARY_REG_SIZE},
   1538        {NULL}
   1539    };
   1540
   1541    if (opp->nb_cpus > MAX_CPU) {
   1542        error_setg(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE,
   1543                   TYPE_OPENPIC, "nb_cpus", (uint64_t)opp->nb_cpus,
   1544                   (uint64_t)0, (uint64_t)MAX_CPU);
   1545        return;
   1546    }
   1547
   1548    switch (opp->model) {
   1549    case OPENPIC_MODEL_FSL_MPIC_20:
   1550    default:
   1551        opp->fsl = &fsl_mpic_20;
   1552        opp->brr1 = 0x00400200;
   1553        opp->flags |= OPENPIC_FLAG_IDR_CRIT;
   1554        opp->nb_irqs = 80;
   1555        opp->mpic_mode_mask = GCR_MODE_MIXED;
   1556
   1557        fsl_common_init(opp);
   1558        map_list(opp, list_be, &list_count);
   1559        map_list(opp, list_fsl, &list_count);
   1560
   1561        break;
   1562
   1563    case OPENPIC_MODEL_FSL_MPIC_42:
   1564        opp->fsl = &fsl_mpic_42;
   1565        opp->brr1 = 0x00400402;
   1566        opp->flags |= OPENPIC_FLAG_ILR;
   1567        opp->nb_irqs = 196;
   1568        opp->mpic_mode_mask = GCR_MODE_PROXY;
   1569
   1570        fsl_common_init(opp);
   1571        map_list(opp, list_be, &list_count);
   1572        map_list(opp, list_fsl, &list_count);
   1573
   1574        break;
   1575
   1576    case OPENPIC_MODEL_KEYLARGO:
   1577        opp->nb_irqs = KEYLARGO_MAX_EXT;
   1578        opp->vid = VID_REVISION_1_2;
   1579        opp->vir = VIR_GENERIC;
   1580        opp->vector_mask = 0xFF;
   1581        opp->tfrr_reset = 4160000;
   1582        opp->ivpr_reset = IVPR_MASK_MASK | IVPR_MODE_MASK;
   1583        opp->idr_reset = 0;
   1584        opp->max_irq = KEYLARGO_MAX_IRQ;
   1585        opp->irq_ipi0 = KEYLARGO_IPI_IRQ;
   1586        opp->irq_tim0 = KEYLARGO_TMR_IRQ;
   1587        opp->brr1 = -1;
   1588        opp->mpic_mode_mask = GCR_MODE_MIXED;
   1589
   1590        if (opp->nb_cpus != 1) {
   1591            error_setg(errp, "Only UP supported today");
   1592            return;
   1593        }
   1594
   1595        map_list(opp, list_le, &list_count);
   1596        break;
   1597    }
   1598
   1599    for (i = 0; i < opp->nb_cpus; i++) {
   1600        opp->dst[i].irqs = g_new0(qemu_irq, OPENPIC_OUTPUT_NB);
   1601        for (j = 0; j < OPENPIC_OUTPUT_NB; j++) {
   1602            sysbus_init_irq(d, &opp->dst[i].irqs[j]);
   1603        }
   1604
   1605        opp->dst[i].raised.queue_size = IRQQUEUE_SIZE_BITS;
   1606        opp->dst[i].raised.queue = bitmap_new(IRQQUEUE_SIZE_BITS);
   1607        opp->dst[i].servicing.queue_size = IRQQUEUE_SIZE_BITS;
   1608        opp->dst[i].servicing.queue = bitmap_new(IRQQUEUE_SIZE_BITS);
   1609    }
   1610
   1611    sysbus_init_mmio(d, &opp->mem);
   1612    qdev_init_gpio_in(dev, openpic_set_irq, opp->max_irq);
   1613}
   1614
   1615static Property openpic_properties[] = {
   1616    DEFINE_PROP_UINT32("model", OpenPICState, model, OPENPIC_MODEL_FSL_MPIC_20),
   1617    DEFINE_PROP_UINT32("nb_cpus", OpenPICState, nb_cpus, 1),
   1618    DEFINE_PROP_END_OF_LIST(),
   1619};
   1620
   1621static void openpic_class_init(ObjectClass *oc, void *data)
   1622{
   1623    DeviceClass *dc = DEVICE_CLASS(oc);
   1624
   1625    dc->realize = openpic_realize;
   1626    device_class_set_props(dc, openpic_properties);
   1627    dc->reset = openpic_reset;
   1628    dc->vmsd = &vmstate_openpic;
   1629    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
   1630}
   1631
   1632static const TypeInfo openpic_info = {
   1633    .name          = TYPE_OPENPIC,
   1634    .parent        = TYPE_SYS_BUS_DEVICE,
   1635    .instance_size = sizeof(OpenPICState),
   1636    .instance_init = openpic_init,
   1637    .class_init    = openpic_class_init,
   1638};
   1639
   1640static void openpic_register_types(void)
   1641{
   1642    type_register_static(&openpic_info);
   1643}
   1644
   1645type_init(openpic_register_types)