hw/alpha/typhoon.c

   1 /*
   2  * DEC 21272 (TSUNAMI/TYPHOON) chipset emulation.
   3  *
   4  * Written by Richard Henderson.
   5  *
   6  * This work is licensed under the GNU GPL license version 2 or later.
   7  */
   8
   9 #include "qemu/osdep.h"
  10 #include "cpu.h"
  11 #include "hw/hw.h"
  12 #include "hw/devices.h"
  13 #include "sysemu/sysemu.h"
  14 #include "alpha_sys.h"
  15 #include "exec/address-spaces.h"
  16
  17
  18 #define TYPE_TYPHOON_PCI_HOST_BRIDGE "typhoon-pcihost"
  19
  20 typedef struct TyphoonCchip {
  21     MemoryRegion region;
  22     uint64_t misc;
  23     uint64_t drir;
  24     uint64_t dim[4];
  25     uint32_t iic[4];
  26     AlphaCPU *cpu[4];
  27 } TyphoonCchip;
  28
  29 typedef struct TyphoonWindow {
  30     uint64_t wba;
  31     uint64_t wsm;
  32     uint64_t tba;
  33 } TyphoonWindow;
  34
  35 typedef struct TyphoonPchip {
  36     MemoryRegion region;
  37     MemoryRegion reg_iack;
  38     MemoryRegion reg_mem;
  39     MemoryRegion reg_io;
  40     MemoryRegion reg_conf;
  41
  42     AddressSpace iommu_as;
  43     MemoryRegion iommu;
  44
  45     uint64_t ctl;
  46     TyphoonWindow win[4];
  47 } TyphoonPchip;
  48
  49 #define TYPHOON_PCI_HOST_BRIDGE(obj) \
  50     OBJECT_CHECK(TyphoonState, (obj), TYPE_TYPHOON_PCI_HOST_BRIDGE)
  51
  52 typedef struct TyphoonState {
  53     PCIHostState parent_obj;
  54
  55     TyphoonCchip cchip;
  56     TyphoonPchip pchip;
  57     MemoryRegion dchip_region;
  58     MemoryRegion ram_region;
  59 } TyphoonState;
  60
  61 /* Called when one of DRIR or DIM changes.  */
  62 static void cpu_irq_change(AlphaCPU *cpu, uint64_t req)
  63 {
  64     /* If there are any non-masked interrupts, tell the cpu.  */
  65     if (cpu != NULL) {
  66         CPUState *cs = CPU(cpu);
  67         if (req) {
  68             cpu_interrupt(cs, CPU_INTERRUPT_HARD);
  69         } else {
  70             cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
  71         }
  72     }
  73 }
  74
  75 static uint64_t cchip_read(void *opaque, hwaddr addr, unsigned size)
  76 {
  77     CPUState *cpu = current_cpu;
  78     TyphoonState *s = opaque;
  79     uint64_t ret = 0;
  80
  81     switch (addr) {
  82     case 0x0000:
  83         /* CSC: Cchip System Configuration Register.  */
  84         /* All sorts of data here; probably the only thing relevant is
  85            PIP<14> Pchip 1 Present = 0.  */
  86         break;
  87
  88     case 0x0040:
  89         /* MTR: Memory Timing Register.  */
  90         /* All sorts of stuff related to real DRAM.  */
  91         break;
  92
  93     case 0x0080:
  94         /* MISC: Miscellaneous Register.  */
  95         ret = s->cchip.misc | (cpu->cpu_index & 3);
  96         break;
  97
  98     case 0x00c0:
  99         /* MPD: Memory Presence Detect Register.  */
 100         break;
 101
 102     case 0x0100: /* AAR0 */
 103     case 0x0140: /* AAR1 */
 104     case 0x0180: /* AAR2 */
 105     case 0x01c0: /* AAR3 */
 106         /* AAR: Array Address Register.  */
 107         /* All sorts of information about DRAM.  */
 108         break;
 109
 110     case 0x0200:
 111         /* DIM0: Device Interrupt Mask Register, CPU0.  */
 112         ret = s->cchip.dim[0];
 113         break;
 114     case 0x0240:
 115         /* DIM1: Device Interrupt Mask Register, CPU1.  */
 116         ret = s->cchip.dim[1];
 117         break;
 118     case 0x0280:
 119         /* DIR0: Device Interrupt Request Register, CPU0.  */
 120         ret = s->cchip.dim[0] & s->cchip.drir;
 121         break;
 122     case 0x02c0:
 123         /* DIR1: Device Interrupt Request Register, CPU1.  */
 124         ret = s->cchip.dim[1] & s->cchip.drir;
 125         break;
 126     case 0x0300:
 127         /* DRIR: Device Raw Interrupt Request Register.  */
 128         ret = s->cchip.drir;
 129         break;
 130
 131     case 0x0340:
 132         /* PRBEN: Probe Enable Register.  */
 133         break;
 134
 135     case 0x0380:
 136         /* IIC0: Interval Ignore Count Register, CPU0.  */
 137         ret = s->cchip.iic[0];
 138         break;
 139     case 0x03c0:
 140         /* IIC1: Interval Ignore Count Register, CPU1.  */
 141         ret = s->cchip.iic[1];
 142         break;
 143
 144     case 0x0400: /* MPR0 */
 145     case 0x0440: /* MPR1 */
 146     case 0x0480: /* MPR2 */
 147     case 0x04c0: /* MPR3 */
 148         /* MPR: Memory Programming Register.  */
 149         break;
 150
 151     case 0x0580:
 152         /* TTR: TIGbus Timing Register.  */
 153         /* All sorts of stuff related to interrupt delivery timings.  */
 154         break;
 155     case 0x05c0:
 156         /* TDR: TIGbug Device Timing Register.  */
 157         break;
 158
 159     case 0x0600:
 160         /* DIM2: Device Interrupt Mask Register, CPU2.  */
 161         ret = s->cchip.dim[2];
 162         break;
 163     case 0x0640:
 164         /* DIM3: Device Interrupt Mask Register, CPU3.  */
 165         ret = s->cchip.dim[3];
 166         break;
 167     case 0x0680:
 168         /* DIR2: Device Interrupt Request Register, CPU2.  */
 169         ret = s->cchip.dim[2] & s->cchip.drir;
 170         break;
 171     case 0x06c0:
 172         /* DIR3: Device Interrupt Request Register, CPU3.  */
 173         ret = s->cchip.dim[3] & s->cchip.drir;
 174         break;
 175
 176     case 0x0700:
 177         /* IIC2: Interval Ignore Count Register, CPU2.  */
 178         ret = s->cchip.iic[2];
 179         break;
 180     case 0x0740:
 181         /* IIC3: Interval Ignore Count Register, CPU3.  */
 182         ret = s->cchip.iic[3];
 183         break;
 184
 185     case 0x0780:
 186         /* PWR: Power Management Control.   */
 187         break;
 188
 189     case 0x0c00: /* CMONCTLA */
 190     case 0x0c40: /* CMONCTLB */
 191     case 0x0c80: /* CMONCNT01 */
 192     case 0x0cc0: /* CMONCNT23 */
 193         break;
 194
 195     default:
 196         cpu_unassigned_access(cpu, addr, false, false, 0, size);
 197         return -1;
 198     }
 199
 200     return ret;
 201 }
 202
 203 static uint64_t dchip_read(void *opaque, hwaddr addr, unsigned size)
 204 {
 205     /* Skip this.  It's all related to DRAM timing and setup.  */
 206     return 0;
 207 }
 208
 209 static uint64_t pchip_read(void *opaque, hwaddr addr, unsigned size)
 210 {
 211     TyphoonState *s = opaque;
 212     uint64_t ret = 0;
 213
 214     switch (addr) {
 215     case 0x0000:
 216         /* WSBA0: Window Space Base Address Register.  */
 217         ret = s->pchip.win[0].wba;
 218         break;
 219     case 0x0040:
 220         /* WSBA1 */
 221         ret = s->pchip.win[1].wba;
 222         break;
 223     case 0x0080:
 224         /* WSBA2 */
 225         ret = s->pchip.win[2].wba;
 226         break;
 227     case 0x00c0:
 228         /* WSBA3 */
 229         ret = s->pchip.win[3].wba;
 230         break;
 231
 232     case 0x0100:
 233         /* WSM0: Window Space Mask Register.  */
 234         ret = s->pchip.win[0].wsm;
 235         break;
 236     case 0x0140:
 237         /* WSM1 */
 238         ret = s->pchip.win[1].wsm;
 239         break;
 240     case 0x0180:
 241         /* WSM2 */
 242         ret = s->pchip.win[2].wsm;
 243         break;
 244     case 0x01c0:
 245         /* WSM3 */
 246         ret = s->pchip.win[3].wsm;
 247         break;
 248
 249     case 0x0200:
 250         /* TBA0: Translated Base Address Register.  */
 251         ret = s->pchip.win[0].tba;
 252         break;
 253     case 0x0240:
 254         /* TBA1 */
 255         ret = s->pchip.win[1].tba;
 256         break;
 257     case 0x0280:
 258         /* TBA2 */
 259         ret = s->pchip.win[2].tba;
 260         break;
 261     case 0x02c0:
 262         /* TBA3 */
 263         ret = s->pchip.win[3].tba;
 264         break;
 265
 266     case 0x0300:
 267         /* PCTL: Pchip Control Register.  */
 268         ret = s->pchip.ctl;
 269         break;
 270     case 0x0340:
 271         /* PLAT: Pchip Master Latency Register.  */
 272         break;
 273     case 0x03c0:
 274         /* PERROR: Pchip Error Register.  */
 275         break;
 276     case 0x0400:
 277         /* PERRMASK: Pchip Error Mask Register.  */
 278         break;
 279     case 0x0440:
 280         /* PERRSET: Pchip Error Set Register.  */
 281         break;
 282     case 0x0480:
 283         /* TLBIV: Translation Buffer Invalidate Virtual Register (WO).  */
 284         break;
 285     case 0x04c0:
 286         /* TLBIA: Translation Buffer Invalidate All Register (WO).  */
 287         break;
 288     case 0x0500: /* PMONCTL */
 289     case 0x0540: /* PMONCNT */
 290     case 0x0800: /* SPRST */
 291         break;
 292
 293     default:
 294         cpu_unassigned_access(current_cpu, addr, false, false, 0, size);
 295         return -1;
 296     }
 297
 298     return ret;
 299 }
 300
 301 static void cchip_write(void *opaque, hwaddr addr,
 302                         uint64_t val, unsigned size)
 303 {
 304     TyphoonState *s = opaque;
 305     uint64_t oldval, newval;
 306
 307     switch (addr) {
 308     case 0x0000:
 309         /* CSC: Cchip System Configuration Register.  */
 310         /* All sorts of data here; nothing relevant RW.  */
 311         break;
 312
 313     case 0x0040:
 314         /* MTR: Memory Timing Register.  */
 315         /* All sorts of stuff related to real DRAM.  */
 316         break;
 317
 318     case 0x0080:
 319         /* MISC: Miscellaneous Register.  */
 320         newval = oldval = s->cchip.misc;
 321         newval &= ~(val & 0x10000ff0);     /* W1C fields */
 322         if (val & 0x100000) {
 323             newval &= ~0xff0000ull;        /* ACL clears ABT and ABW */
 324         } else {
 325             newval |= val & 0x00f00000;    /* ABT field is W1S */
 326             if ((newval & 0xf0000) == 0) {
 327                 newval |= val & 0xf0000;   /* ABW field is W1S iff zero */
 328             }
 329         }
 330         newval |= (val & 0xf000) >> 4;     /* IPREQ field sets IPINTR.  */
 331
 332         newval &= ~0xf0000000000ull;       /* WO and RW fields */
 333         newval |= val & 0xf0000000000ull;
 334         s->cchip.misc = newval;
 335
 336         /* Pass on changes to IPI and ITI state.  */
 337         if ((newval ^ oldval) & 0xff0) {
 338             int i;
 339             for (i = 0; i < 4; ++i) {
 340                 AlphaCPU *cpu = s->cchip.cpu[i];
 341                 if (cpu != NULL) {
 342                     CPUState *cs = CPU(cpu);
 343                     /* IPI can be either cleared or set by the write.  */
 344                     if (newval & (1 << (i + 8))) {
 345                         cpu_interrupt(cs, CPU_INTERRUPT_SMP);
 346                     } else {
 347                         cpu_reset_interrupt(cs, CPU_INTERRUPT_SMP);
 348                     }
 349
 350                     /* ITI can only be cleared by the write.  */
 351                     if ((newval & (1 << (i + 4))) == 0) {
 352                         cpu_reset_interrupt(cs, CPU_INTERRUPT_TIMER);
 353                     }
 354                 }
 355             }
 356         }
 357         break;
 358
 359     case 0x00c0:
 360         /* MPD: Memory Presence Detect Register.  */
 361         break;
 362
 363     case 0x0100: /* AAR0 */
 364     case 0x0140: /* AAR1 */
 365     case 0x0180: /* AAR2 */
 366     case 0x01c0: /* AAR3 */
 367         /* AAR: Array Address Register.  */
 368         /* All sorts of information about DRAM.  */
 369         break;
 370
 371     case 0x0200: /* DIM0 */
 372         /* DIM: Device Interrupt Mask Register, CPU0.  */
 373         s->cchip.dim[0] = val;
 374         cpu_irq_change(s->cchip.cpu[0], val & s->cchip.drir);
 375         break;
 376     case 0x0240: /* DIM1 */
 377         /* DIM: Device Interrupt Mask Register, CPU1.  */
 378         s->cchip.dim[0] = val;
 379         cpu_irq_change(s->cchip.cpu[1], val & s->cchip.drir);
 380         break;
 381
 382     case 0x0280: /* DIR0 (RO) */
 383     case 0x02c0: /* DIR1 (RO) */
 384     case 0x0300: /* DRIR (RO) */
 385         break;
 386
 387     case 0x0340:
 388         /* PRBEN: Probe Enable Register.  */
 389         break;
 390
 391     case 0x0380: /* IIC0 */
 392         s->cchip.iic[0] = val & 0xffffff;
 393         break;
 394     case 0x03c0: /* IIC1 */
 395         s->cchip.iic[1] = val & 0xffffff;
 396         break;
 397
 398     case 0x0400: /* MPR0 */
 399     case 0x0440: /* MPR1 */
 400     case 0x0480: /* MPR2 */
 401     case 0x04c0: /* MPR3 */
 402         /* MPR: Memory Programming Register.  */
 403         break;
 404
 405     case 0x0580:
 406         /* TTR: TIGbus Timing Register.  */
 407         /* All sorts of stuff related to interrupt delivery timings.  */
 408         break;
 409     case 0x05c0:
 410         /* TDR: TIGbug Device Timing Register.  */
 411         break;
 412
 413     case 0x0600:
 414         /* DIM2: Device Interrupt Mask Register, CPU2.  */
 415         s->cchip.dim[2] = val;
 416         cpu_irq_change(s->cchip.cpu[2], val & s->cchip.drir);
 417         break;
 418     case 0x0640:
 419         /* DIM3: Device Interrupt Mask Register, CPU3.  */
 420         s->cchip.dim[3] = val;
 421         cpu_irq_change(s->cchip.cpu[3], val & s->cchip.drir);
 422         break;
 423
 424     case 0x0680: /* DIR2 (RO) */
 425     case 0x06c0: /* DIR3 (RO) */
 426         break;
 427
 428     case 0x0700: /* IIC2 */
 429         s->cchip.iic[2] = val & 0xffffff;
 430         break;
 431     case 0x0740: /* IIC3 */
 432         s->cchip.iic[3] = val & 0xffffff;
 433         break;
 434
 435     case 0x0780:
 436         /* PWR: Power Management Control.   */
 437         break;
 438
 439     case 0x0c00: /* CMONCTLA */
 440     case 0x0c40: /* CMONCTLB */
 441     case 0x0c80: /* CMONCNT01 */
 442     case 0x0cc0: /* CMONCNT23 */
 443         break;
 444
 445     default:
 446         cpu_unassigned_access(current_cpu, addr, true, false, 0, size);
 447         return;
 448     }
 449 }
 450
 451 static void dchip_write(void *opaque, hwaddr addr,
 452                         uint64_t val, unsigned size)
 453 {
 454     /* Skip this.  It's all related to DRAM timing and setup.  */
 455 }
 456
 457 static void pchip_write(void *opaque, hwaddr addr,
 458                         uint64_t val, unsigned size)
 459 {
 460     TyphoonState *s = opaque;
 461     uint64_t oldval;
 462
 463     switch (addr) {
 464     case 0x0000:
 465         /* WSBA0: Window Space Base Address Register.  */
 466         s->pchip.win[0].wba = val & 0xfff00003u;
 467         break;
 468     case 0x0040:
 469         /* WSBA1 */
 470         s->pchip.win[1].wba = val & 0xfff00003u;
 471         break;
 472     case 0x0080:
 473         /* WSBA2 */
 474         s->pchip.win[2].wba = val & 0xfff00003u;
 475         break;
 476     case 0x00c0:
 477         /* WSBA3 */
 478         s->pchip.win[3].wba = (val & 0x80fff00001ull) | 2;
 479         break;
 480
 481     case 0x0100:
 482         /* WSM0: Window Space Mask Register.  */
 483         s->pchip.win[0].wsm = val & 0xfff00000u;
 484         break;
 485     case 0x0140:
 486         /* WSM1 */
 487         s->pchip.win[1].wsm = val & 0xfff00000u;
 488         break;
 489     case 0x0180:
 490         /* WSM2 */
 491         s->pchip.win[2].wsm = val & 0xfff00000u;
 492         break;
 493     case 0x01c0:
 494         /* WSM3 */
 495         s->pchip.win[3].wsm = val & 0xfff00000u;
 496         break;
 497
 498     case 0x0200:
 499         /* TBA0: Translated Base Address Register.  */
 500         s->pchip.win[0].tba = val & 0x7fffffc00ull;
 501         break;
 502     case 0x0240:
 503         /* TBA1 */
 504         s->pchip.win[1].tba = val & 0x7fffffc00ull;
 505         break;
 506     case 0x0280:
 507         /* TBA2 */
 508         s->pchip.win[2].tba = val & 0x7fffffc00ull;
 509         break;
 510     case 0x02c0:
 511         /* TBA3 */
 512         s->pchip.win[3].tba = val & 0x7fffffc00ull;
 513         break;
 514
 515     case 0x0300:
 516         /* PCTL: Pchip Control Register.  */
 517         oldval = s->pchip.ctl;
 518         oldval &= ~0x00001cff0fc7ffull;       /* RW fields */
 519         oldval |= val & 0x00001cff0fc7ffull;
 520         s->pchip.ctl = oldval;
 521         break;
 522
 523     case 0x0340:
 524         /* PLAT: Pchip Master Latency Register.  */
 525         break;
 526     case 0x03c0:
 527         /* PERROR: Pchip Error Register.  */
 528         break;
 529     case 0x0400:
 530         /* PERRMASK: Pchip Error Mask Register.  */
 531         break;
 532     case 0x0440:
 533         /* PERRSET: Pchip Error Set Register.  */
 534         break;
 535
 536     case 0x0480:
 537         /* TLBIV: Translation Buffer Invalidate Virtual Register.  */
 538         break;
 539
 540     case 0x04c0:
 541         /* TLBIA: Translation Buffer Invalidate All Register (WO).  */
 542         break;
 543
 544     case 0x0500:
 545         /* PMONCTL */
 546     case 0x0540:
 547         /* PMONCNT */
 548     case 0x0800:
 549         /* SPRST */
 550         break;
 551
 552     default:
 553         cpu_unassigned_access(current_cpu, addr, true, false, 0, size);
 554         return;
 555     }
 556 }
 557
 558 static const MemoryRegionOps cchip_ops = {
 559     .read = cchip_read,
 560     .write = cchip_write,
 561     .endianness = DEVICE_LITTLE_ENDIAN,
 562     .valid = {
 563         .min_access_size = 8,
 564         .max_access_size = 8,
 565     },
 566     .impl = {
 567         .min_access_size = 8,
 568         .max_access_size = 8,
 569     },
 570 };
 571
 572 static const MemoryRegionOps dchip_ops = {
 573     .read = dchip_read,
 574     .write = dchip_write,
 575     .endianness = DEVICE_LITTLE_ENDIAN,
 576     .valid = {
 577         .min_access_size = 8,
 578         .max_access_size = 8,
 579     },
 580     .impl = {
 581         .min_access_size = 8,
 582         .max_access_size = 8,
 583     },
 584 };
 585
 586 static const MemoryRegionOps pchip_ops = {
 587     .read = pchip_read,
 588     .write = pchip_write,
 589     .endianness = DEVICE_LITTLE_ENDIAN,
 590     .valid = {
 591         .min_access_size = 8,
 592         .max_access_size = 8,
 593     },
 594     .impl = {
 595         .min_access_size = 8,
 596         .max_access_size = 8,
 597     },
 598 };
 599
 600 /* A subroutine of typhoon_translate_iommu that builds an IOMMUTLBEntry
 601    using the given translated address and mask.  */
 602 static bool make_iommu_tlbe(hwaddr taddr, hwaddr mask, IOMMUTLBEntry *ret)
 603 {
 604     *ret = (IOMMUTLBEntry) {
 605         .target_as = &address_space_memory,
 606         .translated_addr = taddr,
 607         .addr_mask = mask,
 608         .perm = IOMMU_RW,
 609     };
 610     return true;
 611 }
 612
 613 /* A subroutine of typhoon_translate_iommu that handles scatter-gather
 614    translation, given the address of the PTE.  */
 615 static bool pte_translate(hwaddr pte_addr, IOMMUTLBEntry *ret)
 616 {
 617     uint64_t pte = address_space_ldq(&address_space_memory, pte_addr,
 618                                      MEMTXATTRS_UNSPECIFIED, NULL);
 619
 620     /* Check valid bit.  */
 621     if ((pte & 1) == 0) {
 622         return false;
 623     }
 624
 625     return make_iommu_tlbe((pte & 0x3ffffe) << 12, 0x1fff, ret);
 626 }
 627
 628 /* A subroutine of typhoon_translate_iommu that handles one of the
 629    four single-address-cycle translation windows.  */
 630 static bool window_translate(TyphoonWindow *win, hwaddr addr,
 631                              IOMMUTLBEntry *ret)
 632 {
 633     uint32_t wba = win->wba;
 634     uint64_t wsm = win->wsm;
 635     uint64_t tba = win->tba;
 636     uint64_t wsm_ext = wsm | 0xfffff;
 637
 638     /* Check for window disabled.  */
 639     if ((wba & 1) == 0) {
 640         return false;
 641     }
 642
 643     /* Check for window hit.  */
 644     if ((addr & ~wsm_ext) != (wba & 0xfff00000u)) {
 645         return false;
 646     }
 647
 648     if (wba & 2) {
 649         /* Scatter-gather translation.  */
 650         hwaddr pte_addr;
 651
 652         /* See table 10-6, Generating PTE address for PCI DMA Address.  */
 653         pte_addr  = tba & ~(wsm >> 10);
 654         pte_addr |= (addr & (wsm | 0xfe000)) >> 10;
 655         return pte_translate(pte_addr, ret);
 656     } else {
 657         /* Direct-mapped translation.  */
 658         return make_iommu_tlbe(tba & ~wsm_ext, wsm_ext, ret);
 659     }
 660 }
 661
 662 /* Handle PCI-to-system address translation.  */
 663 /* TODO: A translation failure here ought to set PCI error codes on the
 664    Pchip and generate a machine check interrupt.  */
 665 static IOMMUTLBEntry typhoon_translate_iommu(MemoryRegion *iommu, hwaddr addr,
 666                                              bool is_write)
 667 {
 668     TyphoonPchip *pchip = container_of(iommu, TyphoonPchip, iommu);
 669     IOMMUTLBEntry ret;
 670     int i;
 671
 672     if (addr <= 0xffffffffu) {
 673         /* Single-address cycle.  */
 674
 675         /* Check for the Window Hole, inhibiting matching.  */
 676         if ((pchip->ctl & 0x20)
 677             && addr >= 0x80000
 678             && addr <= 0xfffff) {
 679             goto failure;
 680         }
 681
 682         /* Check the first three windows.  */
 683         for (i = 0; i < 3; ++i) {
 684             if (window_translate(&pchip->win[i], addr, &ret)) {
 685                 goto success;
 686             }
 687         }
 688
 689         /* Check the fourth window for DAC disable.  */
 690         if ((pchip->win[3].wba & 0x80000000000ull) == 0
 691             && window_translate(&pchip->win[3], addr, &ret)) {
 692             goto success;
 693         }
 694     } else {
 695         /* Double-address cycle.  */
 696
 697         if (addr >= 0x10000000000ull && addr < 0x20000000000ull) {
 698             /* Check for the DMA monster window.  */
 699             if (pchip->ctl & 0x40) {
 700                 /* See 10.1.4.4; in particular <39:35> is ignored.  */
 701                 make_iommu_tlbe(0, 0x007ffffffffull, &ret);
 702                 goto success;
 703             }
 704         }
 705
 706         if (addr >= 0x80000000000ull && addr <= 0xfffffffffffull) {
 707             /* Check the fourth window for DAC enable and window enable.  */
 708             if ((pchip->win[3].wba & 0x80000000001ull) == 0x80000000001ull) {
 709                 uint64_t pte_addr;
 710
 711                 pte_addr  = pchip->win[3].tba & 0x7ffc00000ull;
 712                 pte_addr |= (addr & 0xffffe000u) >> 10;
 713                 if (pte_translate(pte_addr, &ret)) {
 714                         goto success;
 715                 }
 716             }
 717         }
 718     }
 719
 720  failure:
 721     ret = (IOMMUTLBEntry) { .perm = IOMMU_NONE };
 722  success:
 723     return ret;
 724 }
 725
 726 static const MemoryRegionIOMMUOps typhoon_iommu_ops = {
 727     .translate = typhoon_translate_iommu,
 728 };
 729
 730 static AddressSpace *typhoon_pci_dma_iommu(PCIBus *bus, void *opaque, int devfn)
 731 {
 732     TyphoonState *s = opaque;
 733     return &s->pchip.iommu_as;
 734 }
 735
 736 static void typhoon_set_irq(void *opaque, int irq, int level)
 737 {
 738     TyphoonState *s = opaque;
 739     uint64_t drir;
 740     int i;
 741
 742     /* Set/Reset the bit in CCHIP.DRIR based on IRQ+LEVEL.  */
 743     drir = s->cchip.drir;
 744     if (level) {
 745         drir |= 1ull << irq;
 746     } else {
 747         drir &= ~(1ull << irq);
 748     }
 749     s->cchip.drir = drir;
 750
 751     for (i = 0; i < 4; ++i) {
 752         cpu_irq_change(s->cchip.cpu[i], s->cchip.dim[i] & drir);
 753     }
 754 }
 755
 756 static void typhoon_set_isa_irq(void *opaque, int irq, int level)
 757 {
 758     typhoon_set_irq(opaque, 55, level);
 759 }
 760
 761 static void typhoon_set_timer_irq(void *opaque, int irq, int level)
 762 {
 763     TyphoonState *s = opaque;
 764     int i;
 765
 766     /* Thankfully, the mc146818rtc code doesn't track the IRQ state,
 767        and so we don't have to worry about missing interrupts just
 768        because we never actually ACK the interrupt.  Just ignore any
 769        case of the interrupt level going low.  */
 770     if (level == 0) {
 771         return;
 772     }
 773
 774     /* Deliver the interrupt to each CPU, considering each CPU's IIC.  */
 775     for (i = 0; i < 4; ++i) {
 776         AlphaCPU *cpu = s->cchip.cpu[i];
 777         if (cpu != NULL) {
 778             uint32_t iic = s->cchip.iic[i];
 779
 780             /* ??? The verbage in Section 10.2.2.10 isn't 100% clear.
 781                Bit 24 is the OverFlow bit, RO, and set when the count
 782                decrements past 0.  When is OF cleared?  My guess is that
 783                OF is actually cleared when the IIC is written, and that
 784                the ICNT field always decrements.  At least, that's an
 785                interpretation that makes sense, and "allows the CPU to
 786                determine exactly how mant interval timer ticks were
 787                skipped".  At least within the next 4M ticks...  */
 788
 789             iic = ((iic - 1) & 0x1ffffff) | (iic & 0x1000000);
 790             s->cchip.iic[i] = iic;
 791
 792             if (iic & 0x1000000) {
 793                 /* Set the ITI bit for this cpu.  */
 794                 s->cchip.misc |= 1 << (i + 4);
 795                 /* And signal the interrupt.  */
 796                 cpu_interrupt(CPU(cpu), CPU_INTERRUPT_TIMER);
 797             }
 798         }
 799     }
 800 }
 801
 802 static void typhoon_alarm_timer(void *opaque)
 803 {
 804     TyphoonState *s = (TyphoonState *)((uintptr_t)opaque & ~3);
 805     int cpu = (uintptr_t)opaque & 3;
 806
 807     /* Set the ITI bit for this cpu.  */
 808     s->cchip.misc |= 1 << (cpu + 4);
 809     cpu_interrupt(CPU(s->cchip.cpu[cpu]), CPU_INTERRUPT_TIMER);
 810 }
 811
 812 PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
 813                      qemu_irq *p_rtc_irq,
 814                      AlphaCPU *cpus[4], pci_map_irq_fn sys_map_irq)
 815 {
 816     const uint64_t MB = 1024 * 1024;
 817     const uint64_t GB = 1024 * MB;
 818     MemoryRegion *addr_space = get_system_memory();
 819     DeviceState *dev;
 820     TyphoonState *s;
 821     PCIHostState *phb;
 822     PCIBus *b;
 823     int i;
 824
 825     dev = qdev_create(NULL, TYPE_TYPHOON_PCI_HOST_BRIDGE);
 826     qdev_init_nofail(dev);
 827
 828     s = TYPHOON_PCI_HOST_BRIDGE(dev);
 829     phb = PCI_HOST_BRIDGE(dev);
 830
 831     s->cchip.misc = 0x800000000ull; /* Revision: Typhoon.  */
 832     s->pchip.win[3].wba = 2;        /* Window 3 SG always enabled. */
 833
 834     /* Remember the CPUs so that we can deliver interrupts to them.  */
 835     for (i = 0; i < 4; i++) {
 836         AlphaCPU *cpu = cpus[i];
 837         s->cchip.cpu[i] = cpu;
 838         if (cpu != NULL) {
 839             cpu->alarm_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
 840                                                  typhoon_alarm_timer,
 841                                                  (void *)((uintptr_t)s + i));
 842         }
 843     }
 844
 845     *p_rtc_irq = qemu_allocate_irq(typhoon_set_timer_irq, s, 0);
 846
 847     /* Main memory region, 0x00.0000.0000.  Real hardware supports 32GB,
 848        but the address space hole reserved at this point is 8TB.  */
 849     memory_region_allocate_system_memory(&s->ram_region, OBJECT(s), "ram",
 850                                          ram_size);
 851     memory_region_add_subregion(addr_space, 0, &s->ram_region);
 852
 853     /* TIGbus, 0x801.0000.0000, 1GB.  */
 854     /* ??? The TIGbus is used for delivering interrupts, and access to
 855        the flash ROM.  I'm not sure that we need to implement it at all.  */
 856
 857     /* Pchip0 CSRs, 0x801.8000.0000, 256MB.  */
 858     memory_region_init_io(&s->pchip.region, OBJECT(s), &pchip_ops, s, "pchip0",
 859                           256*MB);
 860     memory_region_add_subregion(addr_space, 0x80180000000ULL,
 861                                 &s->pchip.region);
 862
 863     /* Cchip CSRs, 0x801.A000.0000, 256MB.  */
 864     memory_region_init_io(&s->cchip.region, OBJECT(s), &cchip_ops, s, "cchip0",
 865                           256*MB);
 866     memory_region_add_subregion(addr_space, 0x801a0000000ULL,
 867                                 &s->cchip.region);
 868
 869     /* Dchip CSRs, 0x801.B000.0000, 256MB.  */
 870     memory_region_init_io(&s->dchip_region, OBJECT(s), &dchip_ops, s, "dchip0",
 871                           256*MB);
 872     memory_region_add_subregion(addr_space, 0x801b0000000ULL,
 873                                 &s->dchip_region);
 874
 875     /* Pchip0 PCI memory, 0x800.0000.0000, 4GB.  */
 876     memory_region_init(&s->pchip.reg_mem, OBJECT(s), "pci0-mem", 4*GB);
 877     memory_region_add_subregion(addr_space, 0x80000000000ULL,
 878                                 &s->pchip.reg_mem);
 879
 880     /* Pchip0 PCI I/O, 0x801.FC00.0000, 32MB.  */
 881     memory_region_init_io(&s->pchip.reg_io, OBJECT(s), &alpha_pci_ignore_ops,
 882                           NULL, "pci0-io", 32*MB);
 883     memory_region_add_subregion(addr_space, 0x801fc000000ULL,
 884                                 &s->pchip.reg_io);
 885
 886     b = pci_register_bus(dev, "pci",
 887                          typhoon_set_irq, sys_map_irq, s,
 888                          &s->pchip.reg_mem, &s->pchip.reg_io,
 889                          0, 64, TYPE_PCI_BUS);
 890     phb->bus = b;
 891
 892     /* Host memory as seen from the PCI side, via the IOMMU.  */
 893     memory_region_init_iommu(&s->pchip.iommu, OBJECT(s), &typhoon_iommu_ops,
 894                              "iommu-typhoon", UINT64_MAX);
 895     address_space_init(&s->pchip.iommu_as, &s->pchip.iommu, "pchip0-pci");
 896     pci_setup_iommu(b, typhoon_pci_dma_iommu, s);
 897
 898     /* Pchip0 PCI special/interrupt acknowledge, 0x801.F800.0000, 64MB.  */
 899     memory_region_init_io(&s->pchip.reg_iack, OBJECT(s), &alpha_pci_iack_ops,
 900                           b, "pci0-iack", 64*MB);
 901     memory_region_add_subregion(addr_space, 0x801f8000000ULL,
 902                                 &s->pchip.reg_iack);
 903
 904     /* Pchip0 PCI configuration, 0x801.FE00.0000, 16MB.  */
 905     memory_region_init_io(&s->pchip.reg_conf, OBJECT(s), &alpha_pci_conf1_ops,
 906                           b, "pci0-conf", 16*MB);
 907     memory_region_add_subregion(addr_space, 0x801fe000000ULL,
 908                                 &s->pchip.reg_conf);
 909
 910     /* For the record, these are the mappings for the second PCI bus.
 911        We can get away with not implementing them because we indicate
 912        via the Cchip.CSC<PIP> bit that Pchip1 is not present.  */
 913     /* Pchip1 PCI memory, 0x802.0000.0000, 4GB.  */
 914     /* Pchip1 CSRs, 0x802.8000.0000, 256MB.  */
 915     /* Pchip1 PCI special/interrupt acknowledge, 0x802.F800.0000, 64MB.  */
 916     /* Pchip1 PCI I/O, 0x802.FC00.0000, 32MB.  */
 917     /* Pchip1 PCI configuration, 0x802.FE00.0000, 16MB.  */
 918
 919     /* Init the ISA bus.  */
 920     /* ??? Technically there should be a cy82c693ub pci-isa bridge.  */
 921     {
 922         qemu_irq *isa_irqs;
 923
 924         *isa_bus = isa_bus_new(NULL, get_system_memory(), &s->pchip.reg_io,
 925                                &error_abort);
 926         isa_irqs = i8259_init(*isa_bus,
 927                               qemu_allocate_irq(typhoon_set_isa_irq, s, 0));
 928         isa_bus_irqs(*isa_bus, isa_irqs);
 929     }
 930
 931     return b;
 932 }
 933
 934 static int typhoon_pcihost_init(SysBusDevice *dev)
 935 {
 936     return 0;
 937 }
 938
 939 static void typhoon_pcihost_class_init(ObjectClass *klass, void *data)
 940 {
 941     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 942
 943     k->init = typhoon_pcihost_init;
 944 }
 945
 946 static const TypeInfo typhoon_pcihost_info = {
 947     .name          = TYPE_TYPHOON_PCI_HOST_BRIDGE,
 948     .parent        = TYPE_PCI_HOST_BRIDGE,
 949     .instance_size = sizeof(TyphoonState),
 950     .class_init    = typhoon_pcihost_class_init,
 951 };
 952
 953 static void typhoon_register_types(void)
 954 {
 955     type_register_static(&typhoon_pcihost_info);
 956 }
 957
 958 type_init(typhoon_register_types)