hw/openpic.c

   1 /*
   2  * OpenPIC emulation
   3  *
   4  * Copyright (c) 2004 Jocelyn Mayer
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 /*
  25  *
  26  * Based on OpenPic implementations:
  27  * - Intel GW80314 I/O companion chip developer's manual
  28  * - Motorola MPC8245 & MPC8540 user manuals.
  29  * - Motorola MCP750 (aka Raven) programmer manual.
  30  * - Motorola Harrier programmer manuel
  31  *
  32  * Serial interrupts, as implemented in Raven chipset are not supported yet.
  33  *
  34  */
  35 #include "hw.h"
  36 #include "ppc_mac.h"
  37 #include "pci.h"
  38 #include "openpic.h"
  39
  40 //#define DEBUG_OPENPIC
  41
  42 #ifdef DEBUG_OPENPIC
  43 #define DPRINTF(fmt, ...) do { printf(fmt , ## __VA_ARGS__); } while (0)
  44 #else
  45 #define DPRINTF(fmt, ...) do { } while (0)
  46 #endif
  47
  48 #define USE_MPCxxx /* Intel model is broken, for now */
  49
  50 #if defined (USE_INTEL_GW80314)
  51 /* Intel GW80314 I/O Companion chip */
  52
  53 #define MAX_CPU     4
  54 #define MAX_IRQ    32
  55 #define MAX_DBL     4
  56 #define MAX_MBX     4
  57 #define MAX_TMR     4
  58 #define VECTOR_BITS 8
  59 #define MAX_IPI     0
  60
  61 #define VID (0x00000000)
  62
  63 #elif defined(USE_MPCxxx)
  64
  65 #define MAX_CPU     2
  66 #define MAX_IRQ   128
  67 #define MAX_DBL     0
  68 #define MAX_MBX     0
  69 #define MAX_TMR     4
  70 #define VECTOR_BITS 8
  71 #define MAX_IPI     4
  72 #define VID         0x03 /* MPIC version ID */
  73 #define VENI        0x00000000 /* Vendor ID */
  74
  75 enum {
  76     IRQ_IPVP = 0,
  77     IRQ_IDE,
  78 };
  79
  80 /* OpenPIC */
  81 #define OPENPIC_MAX_CPU      2
  82 #define OPENPIC_MAX_IRQ     64
  83 #define OPENPIC_EXT_IRQ     48
  84 #define OPENPIC_MAX_TMR      MAX_TMR
  85 #define OPENPIC_MAX_IPI      MAX_IPI
  86
  87 /* Interrupt definitions */
  88 #define OPENPIC_IRQ_FE     (OPENPIC_EXT_IRQ)     /* Internal functional IRQ */
  89 #define OPENPIC_IRQ_ERR    (OPENPIC_EXT_IRQ + 1) /* Error IRQ */
  90 #define OPENPIC_IRQ_TIM0   (OPENPIC_EXT_IRQ + 2) /* First timer IRQ */
  91 #if OPENPIC_MAX_IPI > 0
  92 #define OPENPIC_IRQ_IPI0   (OPENPIC_IRQ_TIM0 + OPENPIC_MAX_TMR) /* First IPI IRQ */
  93 #define OPENPIC_IRQ_DBL0   (OPENPIC_IRQ_IPI0 + (OPENPIC_MAX_CPU * OPENPIC_MAX_IPI)) /* First doorbell IRQ */
  94 #else
  95 #define OPENPIC_IRQ_DBL0   (OPENPIC_IRQ_TIM0 + OPENPIC_MAX_TMR) /* First doorbell IRQ */
  96 #define OPENPIC_IRQ_MBX0   (OPENPIC_IRQ_DBL0 + OPENPIC_MAX_DBL) /* First mailbox IRQ */
  97 #endif
  98
  99 /* MPIC */
 100 #define MPIC_MAX_CPU      1
 101 #define MPIC_MAX_EXT     12
 102 #define MPIC_MAX_INT     64
 103 #define MPIC_MAX_MSG      4
 104 #define MPIC_MAX_MSI      8
 105 #define MPIC_MAX_TMR      MAX_TMR
 106 #define MPIC_MAX_IPI      MAX_IPI
 107 #define MPIC_MAX_IRQ     (MPIC_MAX_EXT + MPIC_MAX_INT + MPIC_MAX_TMR + MPIC_MAX_MSG + MPIC_MAX_MSI + (MPIC_MAX_IPI * MPIC_MAX_CPU))
 108
 109 /* Interrupt definitions */
 110 #define MPIC_EXT_IRQ      0
 111 #define MPIC_INT_IRQ      (MPIC_EXT_IRQ + MPIC_MAX_EXT)
 112 #define MPIC_TMR_IRQ      (MPIC_INT_IRQ + MPIC_MAX_INT)
 113 #define MPIC_MSG_IRQ      (MPIC_TMR_IRQ + MPIC_MAX_TMR)
 114 #define MPIC_MSI_IRQ      (MPIC_MSG_IRQ + MPIC_MAX_MSG)
 115 #define MPIC_IPI_IRQ      (MPIC_MSI_IRQ + MPIC_MAX_MSI)
 116
 117 #define MPIC_GLB_REG_START        0x0
 118 #define MPIC_GLB_REG_SIZE         0x10F0
 119 #define MPIC_TMR_REG_START        0x10F0
 120 #define MPIC_TMR_REG_SIZE         0x220
 121 #define MPIC_EXT_REG_START        0x10000
 122 #define MPIC_EXT_REG_SIZE         0x180
 123 #define MPIC_INT_REG_START        0x10200
 124 #define MPIC_INT_REG_SIZE         0x800
 125 #define MPIC_MSG_REG_START        0x11600
 126 #define MPIC_MSG_REG_SIZE         0x100
 127 #define MPIC_MSI_REG_START        0x11C00
 128 #define MPIC_MSI_REG_SIZE         0x100
 129 #define MPIC_CPU_REG_START        0x20000
 130 #define MPIC_CPU_REG_SIZE         0x100
 131
 132 enum mpic_ide_bits {
 133     IDR_EP     = 0,
 134     IDR_CI0     = 1,
 135     IDR_CI1     = 2,
 136     IDR_P1     = 30,
 137     IDR_P0     = 31,
 138 };
 139
 140 #else
 141 #error "Please select which OpenPic implementation is to be emulated"
 142 #endif
 143
 144 #define OPENPIC_PAGE_SIZE 4096
 145
 146 #define BF_WIDTH(_bits_) \
 147 (((_bits_) + (sizeof(uint32_t) * 8) - 1) / (sizeof(uint32_t) * 8))
 148
 149 static inline void set_bit (uint32_t *field, int bit)
 150 {
 151     field[bit >> 5] |= 1 << (bit & 0x1F);
 152 }
 153
 154 static inline void reset_bit (uint32_t *field, int bit)
 155 {
 156     field[bit >> 5] &= ~(1 << (bit & 0x1F));
 157 }
 158
 159 static inline int test_bit (uint32_t *field, int bit)
 160 {
 161     return (field[bit >> 5] & 1 << (bit & 0x1F)) != 0;
 162 }
 163
 164 enum {
 165     IRQ_EXTERNAL = 0x01,
 166     IRQ_INTERNAL = 0x02,
 167     IRQ_TIMER    = 0x04,
 168     IRQ_SPECIAL  = 0x08,
 169 };
 170
 171 typedef struct IRQ_queue_t {
 172     uint32_t queue[BF_WIDTH(MAX_IRQ)];
 173     int next;
 174     int priority;
 175 } IRQ_queue_t;
 176
 177 typedef struct IRQ_src_t {
 178     uint32_t ipvp;  /* IRQ vector/priority register */
 179     uint32_t ide;   /* IRQ destination register */
 180     int type;
 181     int last_cpu;
 182     int pending;    /* TRUE if IRQ is pending */
 183 } IRQ_src_t;
 184
 185 enum IPVP_bits {
 186     IPVP_MASK     = 31,
 187     IPVP_ACTIVITY = 30,
 188     IPVP_MODE     = 29,
 189     IPVP_POLARITY = 23,
 190     IPVP_SENSE    = 22,
 191 };
 192 #define IPVP_PRIORITY_MASK     (0x1F << 16)
 193 #define IPVP_PRIORITY(_ipvpr_) ((int)(((_ipvpr_) & IPVP_PRIORITY_MASK) >> 16))
 194 #define IPVP_VECTOR_MASK       ((1 << VECTOR_BITS) - 1)
 195 #define IPVP_VECTOR(_ipvpr_)   ((_ipvpr_) & IPVP_VECTOR_MASK)
 196
 197 typedef struct IRQ_dst_t {
 198     uint32_t tfrr;
 199     uint32_t pctp; /* CPU current task priority */
 200     uint32_t pcsr; /* CPU sensitivity register */
 201     IRQ_queue_t raised;
 202     IRQ_queue_t servicing;
 203     qemu_irq *irqs;
 204 } IRQ_dst_t;
 205
 206 typedef struct openpic_t {
 207     PCIDevice pci_dev;
 208     MemoryRegion mem;
 209     /* Global registers */
 210     uint32_t frep; /* Feature reporting register */
 211     uint32_t glbc; /* Global configuration register  */
 212     uint32_t micr; /* MPIC interrupt configuration register */
 213     uint32_t veni; /* Vendor identification register */
 214     uint32_t pint; /* Processor initialization register */
 215     uint32_t spve; /* Spurious vector register */
 216     uint32_t tifr; /* Timer frequency reporting register */
 217     /* Source registers */
 218     IRQ_src_t src[MAX_IRQ];
 219     /* Local registers per output pin */
 220     IRQ_dst_t dst[MAX_CPU];
 221     int nb_cpus;
 222     /* Timer registers */
 223     struct {
 224         uint32_t ticc;  /* Global timer current count register */
 225         uint32_t tibc;  /* Global timer base count register */
 226     } timers[MAX_TMR];
 227 #if MAX_DBL > 0
 228     /* Doorbell registers */
 229     uint32_t dar;        /* Doorbell activate register */
 230     struct {
 231         uint32_t dmr;    /* Doorbell messaging register */
 232     } doorbells[MAX_DBL];
 233 #endif
 234 #if MAX_MBX > 0
 235     /* Mailbox registers */
 236     struct {
 237         uint32_t mbr;    /* Mailbox register */
 238     } mailboxes[MAX_MAILBOXES];
 239 #endif
 240     /* IRQ out is used when in bypass mode (not implemented) */
 241     qemu_irq irq_out;
 242     int max_irq;
 243     int irq_ipi0;
 244     int irq_tim0;
 245     void (*reset) (void *);
 246     void (*irq_raise) (struct openpic_t *, int, IRQ_src_t *);
 247 } openpic_t;
 248
 249 static inline void IRQ_setbit (IRQ_queue_t *q, int n_IRQ)
 250 {
 251     set_bit(q->queue, n_IRQ);
 252 }
 253
 254 static inline void IRQ_resetbit (IRQ_queue_t *q, int n_IRQ)
 255 {
 256     reset_bit(q->queue, n_IRQ);
 257 }
 258
 259 static inline int IRQ_testbit (IRQ_queue_t *q, int n_IRQ)
 260 {
 261     return test_bit(q->queue, n_IRQ);
 262 }
 263
 264 static void IRQ_check (openpic_t *opp, IRQ_queue_t *q)
 265 {
 266     int next, i;
 267     int priority;
 268
 269     next = -1;
 270     priority = -1;
 271     for (i = 0; i < opp->max_irq; i++) {
 272         if (IRQ_testbit(q, i)) {
 273             DPRINTF("IRQ_check: irq %d set ipvp_pr=%d pr=%d\n",
 274                     i, IPVP_PRIORITY(opp->src[i].ipvp), priority);
 275             if (IPVP_PRIORITY(opp->src[i].ipvp) > priority) {
 276                 next = i;
 277                 priority = IPVP_PRIORITY(opp->src[i].ipvp);
 278             }
 279         }
 280     }
 281     q->next = next;
 282     q->priority = priority;
 283 }
 284
 285 static int IRQ_get_next (openpic_t *opp, IRQ_queue_t *q)
 286 {
 287     if (q->next == -1) {
 288         /* XXX: optimize */
 289         IRQ_check(opp, q);
 290     }
 291
 292     return q->next;
 293 }
 294
 295 static void IRQ_local_pipe (openpic_t *opp, int n_CPU, int n_IRQ)
 296 {
 297     IRQ_dst_t *dst;
 298     IRQ_src_t *src;
 299     int priority;
 300
 301     dst = &opp->dst[n_CPU];
 302     src = &opp->src[n_IRQ];
 303     priority = IPVP_PRIORITY(src->ipvp);
 304     if (priority <= dst->pctp) {
 305         /* Too low priority */
 306         DPRINTF("%s: IRQ %d has too low priority on CPU %d\n",
 307                 __func__, n_IRQ, n_CPU);
 308         return;
 309     }
 310     if (IRQ_testbit(&dst->raised, n_IRQ)) {
 311         /* Interrupt miss */
 312         DPRINTF("%s: IRQ %d was missed on CPU %d\n",
 313                 __func__, n_IRQ, n_CPU);
 314         return;
 315     }
 316     set_bit(&src->ipvp, IPVP_ACTIVITY);
 317     IRQ_setbit(&dst->raised, n_IRQ);
 318     if (priority < dst->raised.priority) {
 319         /* An higher priority IRQ is already raised */
 320         DPRINTF("%s: IRQ %d is hidden by raised IRQ %d on CPU %d\n",
 321                 __func__, n_IRQ, dst->raised.next, n_CPU);
 322         return;
 323     }
 324     IRQ_get_next(opp, &dst->raised);
 325     if (IRQ_get_next(opp, &dst->servicing) != -1 &&
 326         priority <= dst->servicing.priority) {
 327         DPRINTF("%s: IRQ %d is hidden by servicing IRQ %d on CPU %d\n",
 328                 __func__, n_IRQ, dst->servicing.next, n_CPU);
 329         /* Already servicing a higher priority IRQ */
 330         return;
 331     }
 332     DPRINTF("Raise OpenPIC INT output cpu %d irq %d\n", n_CPU, n_IRQ);
 333     opp->irq_raise(opp, n_CPU, src);
 334 }
 335
 336 /* update pic state because registers for n_IRQ have changed value */
 337 static void openpic_update_irq(openpic_t *opp, int n_IRQ)
 338 {
 339     IRQ_src_t *src;
 340     int i;
 341
 342     src = &opp->src[n_IRQ];
 343
 344     if (!src->pending) {
 345         /* no irq pending */
 346         DPRINTF("%s: IRQ %d is not pending\n", __func__, n_IRQ);
 347         return;
 348     }
 349     if (test_bit(&src->ipvp, IPVP_MASK)) {
 350         /* Interrupt source is disabled */
 351         DPRINTF("%s: IRQ %d is disabled\n", __func__, n_IRQ);
 352         return;
 353     }
 354     if (IPVP_PRIORITY(src->ipvp) == 0) {
 355         /* Priority set to zero */
 356         DPRINTF("%s: IRQ %d has 0 priority\n", __func__, n_IRQ);
 357         return;
 358     }
 359     if (test_bit(&src->ipvp, IPVP_ACTIVITY)) {
 360         /* IRQ already active */
 361         DPRINTF("%s: IRQ %d is already active\n", __func__, n_IRQ);
 362         return;
 363     }
 364     if (src->ide == 0x00000000) {
 365         /* No target */
 366         DPRINTF("%s: IRQ %d has no target\n", __func__, n_IRQ);
 367         return;
 368     }
 369
 370     if (src->ide == (1 << src->last_cpu)) {
 371         /* Only one CPU is allowed to receive this IRQ */
 372         IRQ_local_pipe(opp, src->last_cpu, n_IRQ);
 373     } else if (!test_bit(&src->ipvp, IPVP_MODE)) {
 374         /* Directed delivery mode */
 375         for (i = 0; i < opp->nb_cpus; i++) {
 376             if (test_bit(&src->ide, i))
 377                 IRQ_local_pipe(opp, i, n_IRQ);
 378         }
 379     } else {
 380         /* Distributed delivery mode */
 381         for (i = src->last_cpu + 1; i != src->last_cpu; i++) {
 382             if (i == opp->nb_cpus)
 383                 i = 0;
 384             if (test_bit(&src->ide, i)) {
 385                 IRQ_local_pipe(opp, i, n_IRQ);
 386                 src->last_cpu = i;
 387                 break;
 388             }
 389         }
 390     }
 391 }
 392
 393 static void openpic_set_irq(void *opaque, int n_IRQ, int level)
 394 {
 395     openpic_t *opp = opaque;
 396     IRQ_src_t *src;
 397
 398     src = &opp->src[n_IRQ];
 399     DPRINTF("openpic: set irq %d = %d ipvp=%08x\n",
 400             n_IRQ, level, src->ipvp);
 401     if (test_bit(&src->ipvp, IPVP_SENSE)) {
 402         /* level-sensitive irq */
 403         src->pending = level;
 404         if (!level)
 405             reset_bit(&src->ipvp, IPVP_ACTIVITY);
 406     } else {
 407         /* edge-sensitive irq */
 408         if (level)
 409             src->pending = 1;
 410     }
 411     openpic_update_irq(opp, n_IRQ);
 412 }
 413
 414 static void openpic_reset (void *opaque)
 415 {
 416     openpic_t *opp = (openpic_t *)opaque;
 417     int i;
 418
 419     opp->glbc = 0x80000000;
 420     /* Initialise controller registers */
 421     opp->frep = ((OPENPIC_EXT_IRQ - 1) << 16) | ((MAX_CPU - 1) << 8) | VID;
 422     opp->veni = VENI;
 423     opp->pint = 0x00000000;
 424     opp->spve = 0x000000FF;
 425     opp->tifr = 0x003F7A00;
 426     /* ? */
 427     opp->micr = 0x00000000;
 428     /* Initialise IRQ sources */
 429     for (i = 0; i < opp->max_irq; i++) {
 430         opp->src[i].ipvp = 0xA0000000;
 431         opp->src[i].ide  = 0x00000000;
 432     }
 433     /* Initialise IRQ destinations */
 434     for (i = 0; i < MAX_CPU; i++) {
 435         opp->dst[i].pctp      = 0x0000000F;
 436         opp->dst[i].pcsr      = 0x00000000;
 437         memset(&opp->dst[i].raised, 0, sizeof(IRQ_queue_t));
 438         opp->dst[i].raised.next = -1;
 439         memset(&opp->dst[i].servicing, 0, sizeof(IRQ_queue_t));
 440         opp->dst[i].servicing.next = -1;
 441     }
 442     /* Initialise timers */
 443     for (i = 0; i < MAX_TMR; i++) {
 444         opp->timers[i].ticc = 0x00000000;
 445         opp->timers[i].tibc = 0x80000000;
 446     }
 447     /* Initialise doorbells */
 448 #if MAX_DBL > 0
 449     opp->dar = 0x00000000;
 450     for (i = 0; i < MAX_DBL; i++) {
 451         opp->doorbells[i].dmr  = 0x00000000;
 452     }
 453 #endif
 454     /* Initialise mailboxes */
 455 #if MAX_MBX > 0
 456     for (i = 0; i < MAX_MBX; i++) { /* ? */
 457         opp->mailboxes[i].mbr   = 0x00000000;
 458     }
 459 #endif
 460     /* Go out of RESET state */
 461     opp->glbc = 0x00000000;
 462 }
 463
 464 static inline uint32_t read_IRQreg (openpic_t *opp, int n_IRQ, uint32_t reg)
 465 {
 466     uint32_t retval;
 467
 468     switch (reg) {
 469     case IRQ_IPVP:
 470         retval = opp->src[n_IRQ].ipvp;
 471         break;
 472     case IRQ_IDE:
 473         retval = opp->src[n_IRQ].ide;
 474         break;
 475     }
 476
 477     return retval;
 478 }
 479
 480 static inline void write_IRQreg (openpic_t *opp, int n_IRQ,
 481                                  uint32_t reg, uint32_t val)
 482 {
 483     uint32_t tmp;
 484
 485     switch (reg) {
 486     case IRQ_IPVP:
 487         /* NOTE: not fully accurate for special IRQs, but simple and
 488            sufficient */
 489         /* ACTIVITY bit is read-only */
 490         opp->src[n_IRQ].ipvp =
 491             (opp->src[n_IRQ].ipvp & 0x40000000) |
 492             (val & 0x800F00FF);
 493         openpic_update_irq(opp, n_IRQ);
 494         DPRINTF("Set IPVP %d to 0x%08x -> 0x%08x\n",
 495                 n_IRQ, val, opp->src[n_IRQ].ipvp);
 496         break;
 497     case IRQ_IDE:
 498         tmp = val & 0xC0000000;
 499         tmp |= val & ((1 << MAX_CPU) - 1);
 500         opp->src[n_IRQ].ide = tmp;
 501         DPRINTF("Set IDE %d to 0x%08x\n", n_IRQ, opp->src[n_IRQ].ide);
 502         break;
 503     }
 504 }
 505
 506 #if 0 // Code provision for Intel model
 507 #if MAX_DBL > 0
 508 static uint32_t read_doorbell_register (openpic_t *opp,
 509                                         int n_dbl, uint32_t offset)
 510 {
 511     uint32_t retval;
 512
 513     switch (offset) {
 514     case DBL_IPVP_OFFSET:
 515         retval = read_IRQreg(opp, IRQ_DBL0 + n_dbl, IRQ_IPVP);
 516         break;
 517     case DBL_IDE_OFFSET:
 518         retval = read_IRQreg(opp, IRQ_DBL0 + n_dbl, IRQ_IDE);
 519         break;
 520     case DBL_DMR_OFFSET:
 521         retval = opp->doorbells[n_dbl].dmr;
 522         break;
 523     }
 524
 525     return retval;
 526 }
 527
 528 static void write_doorbell_register (penpic_t *opp, int n_dbl,
 529                                      uint32_t offset, uint32_t value)
 530 {
 531     switch (offset) {
 532     case DBL_IVPR_OFFSET:
 533         write_IRQreg(opp, IRQ_DBL0 + n_dbl, IRQ_IPVP, value);
 534         break;
 535     case DBL_IDE_OFFSET:
 536         write_IRQreg(opp, IRQ_DBL0 + n_dbl, IRQ_IDE, value);
 537         break;
 538     case DBL_DMR_OFFSET:
 539         opp->doorbells[n_dbl].dmr = value;
 540         break;
 541     }
 542 }
 543 #endif
 544
 545 #if MAX_MBX > 0
 546 static uint32_t read_mailbox_register (openpic_t *opp,
 547                                        int n_mbx, uint32_t offset)
 548 {
 549     uint32_t retval;
 550
 551     switch (offset) {
 552     case MBX_MBR_OFFSET:
 553         retval = opp->mailboxes[n_mbx].mbr;
 554         break;
 555     case MBX_IVPR_OFFSET:
 556         retval = read_IRQreg(opp, IRQ_MBX0 + n_mbx, IRQ_IPVP);
 557         break;
 558     case MBX_DMR_OFFSET:
 559         retval = read_IRQreg(opp, IRQ_MBX0 + n_mbx, IRQ_IDE);
 560         break;
 561     }
 562
 563     return retval;
 564 }
 565
 566 static void write_mailbox_register (openpic_t *opp, int n_mbx,
 567                                     uint32_t address, uint32_t value)
 568 {
 569     switch (offset) {
 570     case MBX_MBR_OFFSET:
 571         opp->mailboxes[n_mbx].mbr = value;
 572         break;
 573     case MBX_IVPR_OFFSET:
 574         write_IRQreg(opp, IRQ_MBX0 + n_mbx, IRQ_IPVP, value);
 575         break;
 576     case MBX_DMR_OFFSET:
 577         write_IRQreg(opp, IRQ_MBX0 + n_mbx, IRQ_IDE, value);
 578         break;
 579     }
 580 }
 581 #endif
 582 #endif /* 0 : Code provision for Intel model */
 583
 584 static void openpic_gbl_write (void *opaque, target_phys_addr_t addr, uint32_t val)
 585 {
 586     openpic_t *opp = opaque;
 587     IRQ_dst_t *dst;
 588     int idx;
 589
 590     DPRINTF("%s: addr " TARGET_FMT_plx " <= %08x\n", __func__, addr, val);
 591     if (addr & 0xF)
 592         return;
 593     addr &= 0xFF;
 594     switch (addr) {
 595     case 0x00: /* FREP */
 596         break;
 597     case 0x20: /* GLBC */
 598         if (val & 0x80000000 && opp->reset)
 599             opp->reset(opp);
 600         opp->glbc = val & ~0x80000000;
 601         break;
 602     case 0x80: /* VENI */
 603         break;
 604     case 0x90: /* PINT */
 605         for (idx = 0; idx < opp->nb_cpus; idx++) {
 606             if ((val & (1 << idx)) && !(opp->pint & (1 << idx))) {
 607                 DPRINTF("Raise OpenPIC RESET output for CPU %d\n", idx);
 608                 dst = &opp->dst[idx];
 609                 qemu_irq_raise(dst->irqs[OPENPIC_OUTPUT_RESET]);
 610             } else if (!(val & (1 << idx)) && (opp->pint & (1 << idx))) {
 611                 DPRINTF("Lower OpenPIC RESET output for CPU %d\n", idx);
 612                 dst = &opp->dst[idx];
 613                 qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_RESET]);
 614             }
 615         }
 616         opp->pint = val;
 617         break;
 618 #if MAX_IPI > 0
 619     case 0xA0: /* IPI_IPVP */
 620     case 0xB0:
 621     case 0xC0:
 622     case 0xD0:
 623         {
 624             int idx;
 625             idx = (addr - 0xA0) >> 4;
 626             write_IRQreg(opp, opp->irq_ipi0 + idx, IRQ_IPVP, val);
 627         }
 628         break;
 629 #endif
 630     case 0xE0: /* SPVE */
 631         opp->spve = val & 0x000000FF;
 632         break;
 633     case 0xF0: /* TIFR */
 634         opp->tifr = val;
 635         break;
 636     default:
 637         break;
 638     }
 639 }
 640
 641 static uint32_t openpic_gbl_read (void *opaque, target_phys_addr_t addr)
 642 {
 643     openpic_t *opp = opaque;
 644     uint32_t retval;
 645
 646     DPRINTF("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
 647     retval = 0xFFFFFFFF;
 648     if (addr & 0xF)
 649         return retval;
 650     addr &= 0xFF;
 651     switch (addr) {
 652     case 0x00: /* FREP */
 653         retval = opp->frep;
 654         break;
 655     case 0x20: /* GLBC */
 656         retval = opp->glbc;
 657         break;
 658     case 0x80: /* VENI */
 659         retval = opp->veni;
 660         break;
 661     case 0x90: /* PINT */
 662         retval = 0x00000000;
 663         break;
 664 #if MAX_IPI > 0
 665     case 0xA0: /* IPI_IPVP */
 666     case 0xB0:
 667     case 0xC0:
 668     case 0xD0:
 669         {
 670             int idx;
 671             idx = (addr - 0xA0) >> 4;
 672             retval = read_IRQreg(opp, opp->irq_ipi0 + idx, IRQ_IPVP);
 673         }
 674         break;
 675 #endif
 676     case 0xE0: /* SPVE */
 677         retval = opp->spve;
 678         break;
 679     case 0xF0: /* TIFR */
 680         retval = opp->tifr;
 681         break;
 682     default:
 683         break;
 684     }
 685     DPRINTF("%s: => %08x\n", __func__, retval);
 686
 687     return retval;
 688 }
 689
 690 static void openpic_timer_write (void *opaque, uint32_t addr, uint32_t val)
 691 {
 692     openpic_t *opp = opaque;
 693     int idx;
 694
 695     DPRINTF("%s: addr %08x <= %08x\n", __func__, addr, val);
 696     if (addr & 0xF)
 697         return;
 698     addr -= 0x1100;
 699     addr &= 0xFFFF;
 700     idx = (addr & 0xFFF0) >> 6;
 701     addr = addr & 0x30;
 702     switch (addr) {
 703     case 0x00: /* TICC */
 704         break;
 705     case 0x10: /* TIBC */
 706         if ((opp->timers[idx].ticc & 0x80000000) != 0 &&
 707             (val & 0x80000000) == 0 &&
 708             (opp->timers[idx].tibc & 0x80000000) != 0)
 709             opp->timers[idx].ticc &= ~0x80000000;
 710         opp->timers[idx].tibc = val;
 711         break;
 712     case 0x20: /* TIVP */
 713         write_IRQreg(opp, opp->irq_tim0 + idx, IRQ_IPVP, val);
 714         break;
 715     case 0x30: /* TIDE */
 716         write_IRQreg(opp, opp->irq_tim0 + idx, IRQ_IDE, val);
 717         break;
 718     }
 719 }
 720
 721 static uint32_t openpic_timer_read (void *opaque, uint32_t addr)
 722 {
 723     openpic_t *opp = opaque;
 724     uint32_t retval;
 725     int idx;
 726
 727     DPRINTF("%s: addr %08x\n", __func__, addr);
 728     retval = 0xFFFFFFFF;
 729     if (addr & 0xF)
 730         return retval;
 731     addr -= 0x1100;
 732     addr &= 0xFFFF;
 733     idx = (addr & 0xFFF0) >> 6;
 734     addr = addr & 0x30;
 735     switch (addr) {
 736     case 0x00: /* TICC */
 737         retval = opp->timers[idx].ticc;
 738         break;
 739     case 0x10: /* TIBC */
 740         retval = opp->timers[idx].tibc;
 741         break;
 742     case 0x20: /* TIPV */
 743         retval = read_IRQreg(opp, opp->irq_tim0 + idx, IRQ_IPVP);
 744         break;
 745     case 0x30: /* TIDE */
 746         retval = read_IRQreg(opp, opp->irq_tim0 + idx, IRQ_IDE);
 747         break;
 748     }
 749     DPRINTF("%s: => %08x\n", __func__, retval);
 750
 751     return retval;
 752 }
 753
 754 static void openpic_src_write (void *opaque, uint32_t addr, uint32_t val)
 755 {
 756     openpic_t *opp = opaque;
 757     int idx;
 758
 759     DPRINTF("%s: addr %08x <= %08x\n", __func__, addr, val);
 760     if (addr & 0xF)
 761         return;
 762     addr = addr & 0xFFF0;
 763     idx = addr >> 5;
 764     if (addr & 0x10) {
 765         /* EXDE / IFEDE / IEEDE */
 766         write_IRQreg(opp, idx, IRQ_IDE, val);
 767     } else {
 768         /* EXVP / IFEVP / IEEVP */
 769         write_IRQreg(opp, idx, IRQ_IPVP, val);
 770     }
 771 }
 772
 773 static uint32_t openpic_src_read (void *opaque, uint32_t addr)
 774 {
 775     openpic_t *opp = opaque;
 776     uint32_t retval;
 777     int idx;
 778
 779     DPRINTF("%s: addr %08x\n", __func__, addr);
 780     retval = 0xFFFFFFFF;
 781     if (addr & 0xF)
 782         return retval;
 783     addr = addr & 0xFFF0;
 784     idx = addr >> 5;
 785     if (addr & 0x10) {
 786         /* EXDE / IFEDE / IEEDE */
 787         retval = read_IRQreg(opp, idx, IRQ_IDE);
 788     } else {
 789         /* EXVP / IFEVP / IEEVP */
 790         retval = read_IRQreg(opp, idx, IRQ_IPVP);
 791     }
 792     DPRINTF("%s: => %08x\n", __func__, retval);
 793
 794     return retval;
 795 }
 796
 797 static void openpic_cpu_write (void *opaque, target_phys_addr_t addr, uint32_t val)
 798 {
 799     openpic_t *opp = opaque;
 800     IRQ_src_t *src;
 801     IRQ_dst_t *dst;
 802     int idx, s_IRQ, n_IRQ;
 803
 804     DPRINTF("%s: addr " TARGET_FMT_plx " <= %08x\n", __func__, addr, val);
 805     if (addr & 0xF)
 806         return;
 807     addr &= 0x1FFF0;
 808     idx = addr / 0x1000;
 809     dst = &opp->dst[idx];
 810     addr &= 0xFF0;
 811     switch (addr) {
 812 #if MAX_IPI > 0
 813     case 0x40: /* PIPD */
 814     case 0x50:
 815     case 0x60:
 816     case 0x70:
 817         idx = (addr - 0x40) >> 4;
 818         write_IRQreg(opp, opp->irq_ipi0 + idx, IRQ_IDE, val);
 819         openpic_set_irq(opp, opp->irq_ipi0 + idx, 1);
 820         openpic_set_irq(opp, opp->irq_ipi0 + idx, 0);
 821         break;
 822 #endif
 823     case 0x80: /* PCTP */
 824         dst->pctp = val & 0x0000000F;
 825         break;
 826     case 0x90: /* WHOAMI */
 827         /* Read-only register */
 828         break;
 829     case 0xA0: /* PIAC */
 830         /* Read-only register */
 831         break;
 832     case 0xB0: /* PEOI */
 833         DPRINTF("PEOI\n");
 834         s_IRQ = IRQ_get_next(opp, &dst->servicing);
 835         IRQ_resetbit(&dst->servicing, s_IRQ);
 836         dst->servicing.next = -1;
 837         /* Set up next servicing IRQ */
 838         s_IRQ = IRQ_get_next(opp, &dst->servicing);
 839         /* Check queued interrupts. */
 840         n_IRQ = IRQ_get_next(opp, &dst->raised);
 841         src = &opp->src[n_IRQ];
 842         if (n_IRQ != -1 &&
 843             (s_IRQ == -1 ||
 844              IPVP_PRIORITY(src->ipvp) > dst->servicing.priority)) {
 845             DPRINTF("Raise OpenPIC INT output cpu %d irq %d\n",
 846                     idx, n_IRQ);
 847             opp->irq_raise(opp, idx, src);
 848         }
 849         break;
 850     default:
 851         break;
 852     }
 853 }
 854
 855 static uint32_t openpic_cpu_read (void *opaque, target_phys_addr_t addr)
 856 {
 857     openpic_t *opp = opaque;
 858     IRQ_src_t *src;
 859     IRQ_dst_t *dst;
 860     uint32_t retval;
 861     int idx, n_IRQ;
 862
 863     DPRINTF("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
 864     retval = 0xFFFFFFFF;
 865     if (addr & 0xF)
 866         return retval;
 867     addr &= 0x1FFF0;
 868     idx = addr / 0x1000;
 869     dst = &opp->dst[idx];
 870     addr &= 0xFF0;
 871     switch (addr) {
 872     case 0x80: /* PCTP */
 873         retval = dst->pctp;
 874         break;
 875     case 0x90: /* WHOAMI */
 876         retval = idx;
 877         break;
 878     case 0xA0: /* PIAC */
 879         DPRINTF("Lower OpenPIC INT output\n");
 880         qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_INT]);
 881         n_IRQ = IRQ_get_next(opp, &dst->raised);
 882         DPRINTF("PIAC: irq=%d\n", n_IRQ);
 883         if (n_IRQ == -1) {
 884             /* No more interrupt pending */
 885             retval = IPVP_VECTOR(opp->spve);
 886         } else {
 887             src = &opp->src[n_IRQ];
 888             if (!test_bit(&src->ipvp, IPVP_ACTIVITY) ||
 889                 !(IPVP_PRIORITY(src->ipvp) > dst->pctp)) {
 890                 /* - Spurious level-sensitive IRQ
 891                  * - Priorities has been changed
 892                  *   and the pending IRQ isn't allowed anymore
 893                  */
 894                 reset_bit(&src->ipvp, IPVP_ACTIVITY);
 895                 retval = IPVP_VECTOR(opp->spve);
 896             } else {
 897                 /* IRQ enter servicing state */
 898                 IRQ_setbit(&dst->servicing, n_IRQ);
 899                 retval = IPVP_VECTOR(src->ipvp);
 900             }
 901             IRQ_resetbit(&dst->raised, n_IRQ);
 902             dst->raised.next = -1;
 903             if (!test_bit(&src->ipvp, IPVP_SENSE)) {
 904                 /* edge-sensitive IRQ */
 905                 reset_bit(&src->ipvp, IPVP_ACTIVITY);
 906                 src->pending = 0;
 907             }
 908         }
 909         break;
 910     case 0xB0: /* PEOI */
 911         retval = 0;
 912         break;
 913 #if MAX_IPI > 0
 914     case 0x40: /* IDE */
 915     case 0x50:
 916         idx = (addr - 0x40) >> 4;
 917         retval = read_IRQreg(opp, opp->irq_ipi0 + idx, IRQ_IDE);
 918         break;
 919 #endif
 920     default:
 921         break;
 922     }
 923     DPRINTF("%s: => %08x\n", __func__, retval);
 924
 925     return retval;
 926 }
 927
 928 static void openpic_buggy_write (void *opaque,
 929                                  target_phys_addr_t addr, uint32_t val)
 930 {
 931     printf("Invalid OPENPIC write access !\n");
 932 }
 933
 934 static uint32_t openpic_buggy_read (void *opaque, target_phys_addr_t addr)
 935 {
 936     printf("Invalid OPENPIC read access !\n");
 937
 938     return -1;
 939 }
 940
 941 static void openpic_writel (void *opaque,
 942                             target_phys_addr_t addr, uint32_t val)
 943 {
 944     openpic_t *opp = opaque;
 945
 946     addr &= 0x3FFFF;
 947     DPRINTF("%s: offset %08x val: %08x\n", __func__, (int)addr, val);
 948     if (addr < 0x1100) {
 949         /* Global registers */
 950         openpic_gbl_write(opp, addr, val);
 951     } else if (addr < 0x10000) {
 952         /* Timers registers */
 953         openpic_timer_write(opp, addr, val);
 954     } else if (addr < 0x20000) {
 955         /* Source registers */
 956         openpic_src_write(opp, addr, val);
 957     } else {
 958         /* CPU registers */
 959         openpic_cpu_write(opp, addr, val);
 960     }
 961 }
 962
 963 static uint32_t openpic_readl (void *opaque,target_phys_addr_t addr)
 964 {
 965     openpic_t *opp = opaque;
 966     uint32_t retval;
 967
 968     addr &= 0x3FFFF;
 969     DPRINTF("%s: offset %08x\n", __func__, (int)addr);
 970     if (addr < 0x1100) {
 971         /* Global registers */
 972         retval = openpic_gbl_read(opp, addr);
 973     } else if (addr < 0x10000) {
 974         /* Timers registers */
 975         retval = openpic_timer_read(opp, addr);
 976     } else if (addr < 0x20000) {
 977         /* Source registers */
 978         retval = openpic_src_read(opp, addr);
 979     } else {
 980         /* CPU registers */
 981         retval = openpic_cpu_read(opp, addr);
 982     }
 983
 984     return retval;
 985 }
 986
 987 static uint64_t openpic_read(void *opaque, target_phys_addr_t addr,
 988                              unsigned size)
 989 {
 990     openpic_t *opp = opaque;
 991
 992     switch (size) {
 993     case 4: return openpic_readl(opp, addr);
 994     default: return openpic_buggy_read(opp, addr);
 995     }
 996 }
 997
 998 static void openpic_write(void *opaque, target_phys_addr_t addr,
 999                           uint64_t data, unsigned size)
1000 {
1001     openpic_t *opp = opaque;
1002
1003     switch (size) {
1004     case 4: return openpic_writel(opp, addr, data);
1005     default: return openpic_buggy_write(opp, addr, data);
1006     }
1007 }
1008
1009 static const MemoryRegionOps openpic_ops = {
1010     .read = openpic_read,
1011     .write = openpic_write,
1012     .endianness = DEVICE_LITTLE_ENDIAN,
1013 };
1014
1015 static void openpic_save_IRQ_queue(QEMUFile* f, IRQ_queue_t *q)
1016 {
1017     unsigned int i;
1018
1019     for (i = 0; i < BF_WIDTH(MAX_IRQ); i++)
1020         qemu_put_be32s(f, &q->queue[i]);
1021
1022     qemu_put_sbe32s(f, &q->next);
1023     qemu_put_sbe32s(f, &q->priority);
1024 }
1025
1026 static void openpic_save(QEMUFile* f, void *opaque)
1027 {
1028     openpic_t *opp = (openpic_t *)opaque;
1029     unsigned int i;
1030
1031     qemu_put_be32s(f, &opp->frep);
1032     qemu_put_be32s(f, &opp->glbc);
1033     qemu_put_be32s(f, &opp->micr);
1034     qemu_put_be32s(f, &opp->veni);
1035     qemu_put_be32s(f, &opp->pint);
1036     qemu_put_be32s(f, &opp->spve);
1037     qemu_put_be32s(f, &opp->tifr);
1038
1039     for (i = 0; i < opp->max_irq; i++) {
1040         qemu_put_be32s(f, &opp->src[i].ipvp);
1041         qemu_put_be32s(f, &opp->src[i].ide);
1042         qemu_put_sbe32s(f, &opp->src[i].type);
1043         qemu_put_sbe32s(f, &opp->src[i].last_cpu);
1044         qemu_put_sbe32s(f, &opp->src[i].pending);
1045     }
1046
1047     qemu_put_sbe32s(f, &opp->nb_cpus);
1048
1049     for (i = 0; i < opp->nb_cpus; i++) {
1050         qemu_put_be32s(f, &opp->dst[i].tfrr);
1051         qemu_put_be32s(f, &opp->dst[i].pctp);
1052         qemu_put_be32s(f, &opp->dst[i].pcsr);
1053         openpic_save_IRQ_queue(f, &opp->dst[i].raised);
1054         openpic_save_IRQ_queue(f, &opp->dst[i].servicing);
1055     }
1056
1057     for (i = 0; i < MAX_TMR; i++) {
1058         qemu_put_be32s(f, &opp->timers[i].ticc);
1059         qemu_put_be32s(f, &opp->timers[i].tibc);
1060     }
1061
1062 #if MAX_DBL > 0
1063     qemu_put_be32s(f, &opp->dar);
1064
1065     for (i = 0; i < MAX_DBL; i++) {
1066         qemu_put_be32s(f, &opp->doorbells[i].dmr);
1067     }
1068 #endif
1069
1070 #if MAX_MBX > 0
1071     for (i = 0; i < MAX_MAILBOXES; i++) {
1072         qemu_put_be32s(f, &opp->mailboxes[i].mbr);
1073     }
1074 #endif
1075
1076     pci_device_save(&opp->pci_dev, f);
1077 }
1078
1079 static void openpic_load_IRQ_queue(QEMUFile* f, IRQ_queue_t *q)
1080 {
1081     unsigned int i;
1082
1083     for (i = 0; i < BF_WIDTH(MAX_IRQ); i++)
1084         qemu_get_be32s(f, &q->queue[i]);
1085
1086     qemu_get_sbe32s(f, &q->next);
1087     qemu_get_sbe32s(f, &q->priority);
1088 }
1089
1090 static int openpic_load(QEMUFile* f, void *opaque, int version_id)
1091 {
1092     openpic_t *opp = (openpic_t *)opaque;
1093     unsigned int i;
1094
1095     if (version_id != 1)
1096         return -EINVAL;
1097
1098     qemu_get_be32s(f, &opp->frep);
1099     qemu_get_be32s(f, &opp->glbc);
1100     qemu_get_be32s(f, &opp->micr);
1101     qemu_get_be32s(f, &opp->veni);
1102     qemu_get_be32s(f, &opp->pint);
1103     qemu_get_be32s(f, &opp->spve);
1104     qemu_get_be32s(f, &opp->tifr);
1105
1106     for (i = 0; i < opp->max_irq; i++) {
1107         qemu_get_be32s(f, &opp->src[i].ipvp);
1108         qemu_get_be32s(f, &opp->src[i].ide);
1109         qemu_get_sbe32s(f, &opp->src[i].type);
1110         qemu_get_sbe32s(f, &opp->src[i].last_cpu);
1111         qemu_get_sbe32s(f, &opp->src[i].pending);
1112     }
1113
1114     qemu_get_sbe32s(f, &opp->nb_cpus);
1115
1116     for (i = 0; i < opp->nb_cpus; i++) {
1117         qemu_get_be32s(f, &opp->dst[i].tfrr);
1118         qemu_get_be32s(f, &opp->dst[i].pctp);
1119         qemu_get_be32s(f, &opp->dst[i].pcsr);
1120         openpic_load_IRQ_queue(f, &opp->dst[i].raised);
1121         openpic_load_IRQ_queue(f, &opp->dst[i].servicing);
1122     }
1123
1124     for (i = 0; i < MAX_TMR; i++) {
1125         qemu_get_be32s(f, &opp->timers[i].ticc);
1126         qemu_get_be32s(f, &opp->timers[i].tibc);
1127     }
1128
1129 #if MAX_DBL > 0
1130     qemu_get_be32s(f, &opp->dar);
1131
1132     for (i = 0; i < MAX_DBL; i++) {
1133         qemu_get_be32s(f, &opp->doorbells[i].dmr);
1134     }
1135 #endif
1136
1137 #if MAX_MBX > 0
1138     for (i = 0; i < MAX_MAILBOXES; i++) {
1139         qemu_get_be32s(f, &opp->mailboxes[i].mbr);
1140     }
1141 #endif
1142
1143     return pci_device_load(&opp->pci_dev, f);
1144 }
1145
1146 static void openpic_irq_raise(openpic_t *opp, int n_CPU, IRQ_src_t *src)
1147 {
1148     qemu_irq_raise(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);
1149 }
1150
1151 qemu_irq *openpic_init (PCIBus *bus, MemoryRegion **pmem, int nb_cpus,
1152                         qemu_irq **irqs, qemu_irq irq_out)
1153 {
1154     openpic_t *opp;
1155     uint8_t *pci_conf;
1156     int i, m;
1157
1158     /* XXX: for now, only one CPU is supported */
1159     if (nb_cpus != 1)
1160         return NULL;
1161     if (bus) {
1162         opp = (openpic_t *)pci_register_device(bus, "OpenPIC", sizeof(openpic_t),
1163                                                -1, NULL, NULL);
1164         pci_conf = opp->pci_dev.config;
1165         pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_IBM);
1166         pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_IBM_OPENPIC2);
1167         pci_config_set_class(pci_conf, PCI_CLASS_SYSTEM_OTHER); // FIXME?
1168         pci_conf[0x3d] = 0x00; // no interrupt pin
1169
1170         memory_region_init_io(&opp->mem, &openpic_ops, opp, "openpic", 0x40000);
1171 #if 0 // Don't implement ISU for now
1172         opp_io_memory = cpu_register_io_memory(openpic_src_read,
1173                                                openpic_src_write, NULL
1174                                                DEVICE_NATIVE_ENDIAN);
1175         cpu_register_physical_memory(isu_base, 0x20 * (EXT_IRQ + 2),
1176                                      opp_io_memory);
1177 #endif
1178
1179         /* Register I/O spaces */
1180         pci_register_bar(&opp->pci_dev, 0,
1181                          PCI_BASE_ADDRESS_SPACE_MEMORY, &opp->mem);
1182     } else {
1183         opp = g_malloc0(sizeof(openpic_t));
1184         memory_region_init_io(&opp->mem, &openpic_ops, opp, "openpic", 0x40000);
1185     }
1186
1187     //    isu_base &= 0xFFFC0000;
1188     opp->nb_cpus = nb_cpus;
1189     opp->max_irq = OPENPIC_MAX_IRQ;
1190     opp->irq_ipi0 = OPENPIC_IRQ_IPI0;
1191     opp->irq_tim0 = OPENPIC_IRQ_TIM0;
1192     /* Set IRQ types */
1193     for (i = 0; i < OPENPIC_EXT_IRQ; i++) {
1194         opp->src[i].type = IRQ_EXTERNAL;
1195     }
1196     for (; i < OPENPIC_IRQ_TIM0; i++) {
1197         opp->src[i].type = IRQ_SPECIAL;
1198     }
1199 #if MAX_IPI > 0
1200     m = OPENPIC_IRQ_IPI0;
1201 #else
1202     m = OPENPIC_IRQ_DBL0;
1203 #endif
1204     for (; i < m; i++) {
1205         opp->src[i].type = IRQ_TIMER;
1206     }
1207     for (; i < OPENPIC_MAX_IRQ; i++) {
1208         opp->src[i].type = IRQ_INTERNAL;
1209     }
1210     for (i = 0; i < nb_cpus; i++)
1211         opp->dst[i].irqs = irqs[i];
1212     opp->irq_out = irq_out;
1213
1214     register_savevm(&opp->pci_dev.qdev, "openpic", 0, 2,
1215                     openpic_save, openpic_load, opp);
1216     qemu_register_reset(openpic_reset, opp);
1217
1218     opp->irq_raise = openpic_irq_raise;
1219     opp->reset = openpic_reset;
1220
1221     if (pmem)
1222         *pmem = &opp->mem;
1223
1224     return qemu_allocate_irqs(openpic_set_irq, opp, opp->max_irq);
1225 }
1226
1227 static void mpic_irq_raise(openpic_t *mpp, int n_CPU, IRQ_src_t *src)
1228 {
1229     int n_ci = IDR_CI0 - n_CPU;
1230
1231     if(test_bit(&src->ide, n_ci)) {
1232         qemu_irq_raise(mpp->dst[n_CPU].irqs[OPENPIC_OUTPUT_CINT]);
1233     }
1234     else {
1235         qemu_irq_raise(mpp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);
1236     }
1237 }
1238
1239 static void mpic_reset (void *opaque)
1240 {
1241     openpic_t *mpp = (openpic_t *)opaque;
1242     int i;
1243
1244     mpp->glbc = 0x80000000;
1245     /* Initialise controller registers */
1246     mpp->frep = 0x004f0002;
1247     mpp->veni = VENI;
1248     mpp->pint = 0x00000000;
1249     mpp->spve = 0x0000FFFF;
1250     /* Initialise IRQ sources */
1251     for (i = 0; i < mpp->max_irq; i++) {
1252         mpp->src[i].ipvp = 0x80800000;
1253         mpp->src[i].ide  = 0x00000001;
1254     }
1255     /* Initialise IRQ destinations */
1256     for (i = 0; i < MAX_CPU; i++) {
1257         mpp->dst[i].pctp      = 0x0000000F;
1258         mpp->dst[i].tfrr      = 0x00000000;
1259         memset(&mpp->dst[i].raised, 0, sizeof(IRQ_queue_t));
1260         mpp->dst[i].raised.next = -1;
1261         memset(&mpp->dst[i].servicing, 0, sizeof(IRQ_queue_t));
1262         mpp->dst[i].servicing.next = -1;
1263     }
1264     /* Initialise timers */
1265     for (i = 0; i < MAX_TMR; i++) {
1266         mpp->timers[i].ticc = 0x00000000;
1267         mpp->timers[i].tibc = 0x80000000;
1268     }
1269     /* Go out of RESET state */
1270     mpp->glbc = 0x00000000;
1271 }
1272
1273 static void mpic_timer_write (void *opaque, target_phys_addr_t addr, uint32_t val)
1274 {
1275     openpic_t *mpp = opaque;
1276     int idx, cpu;
1277
1278     DPRINTF("%s: addr " TARGET_FMT_plx " <= %08x\n", __func__, addr, val);
1279     if (addr & 0xF)
1280         return;
1281     addr &= 0xFFFF;
1282     cpu = addr >> 12;
1283     idx = (addr >> 6) & 0x3;
1284     switch (addr & 0x30) {
1285     case 0x00: /* gtccr */
1286         break;
1287     case 0x10: /* gtbcr */
1288         if ((mpp->timers[idx].ticc & 0x80000000) != 0 &&
1289             (val & 0x80000000) == 0 &&
1290             (mpp->timers[idx].tibc & 0x80000000) != 0)
1291             mpp->timers[idx].ticc &= ~0x80000000;
1292         mpp->timers[idx].tibc = val;
1293         break;
1294     case 0x20: /* GTIVPR */
1295         write_IRQreg(mpp, MPIC_TMR_IRQ + idx, IRQ_IPVP, val);
1296         break;
1297     case 0x30: /* GTIDR & TFRR */
1298         if ((addr & 0xF0) == 0xF0)
1299             mpp->dst[cpu].tfrr = val;
1300         else
1301             write_IRQreg(mpp, MPIC_TMR_IRQ + idx, IRQ_IDE, val);
1302         break;
1303     }
1304 }
1305
1306 static uint32_t mpic_timer_read (void *opaque, target_phys_addr_t addr)
1307 {
1308     openpic_t *mpp = opaque;
1309     uint32_t retval;
1310     int idx, cpu;
1311
1312     DPRINTF("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
1313     retval = 0xFFFFFFFF;
1314     if (addr & 0xF)
1315         return retval;
1316     addr &= 0xFFFF;
1317     cpu = addr >> 12;
1318     idx = (addr >> 6) & 0x3;
1319     switch (addr & 0x30) {
1320     case 0x00: /* gtccr */
1321         retval = mpp->timers[idx].ticc;
1322         break;
1323     case 0x10: /* gtbcr */
1324         retval = mpp->timers[idx].tibc;
1325         break;
1326     case 0x20: /* TIPV */
1327         retval = read_IRQreg(mpp, MPIC_TMR_IRQ + idx, IRQ_IPVP);
1328         break;
1329     case 0x30: /* TIDR */
1330         if ((addr &0xF0) == 0XF0)
1331             retval = mpp->dst[cpu].tfrr;
1332         else
1333             retval = read_IRQreg(mpp, MPIC_TMR_IRQ + idx, IRQ_IDE);
1334         break;
1335     }
1336     DPRINTF("%s: => %08x\n", __func__, retval);
1337
1338     return retval;
1339 }
1340
1341 static void mpic_src_ext_write (void *opaque, target_phys_addr_t addr,
1342                                 uint32_t val)
1343 {
1344     openpic_t *mpp = opaque;
1345     int idx = MPIC_EXT_IRQ;
1346
1347     DPRINTF("%s: addr " TARGET_FMT_plx " <= %08x\n", __func__, addr, val);
1348     if (addr & 0xF)
1349         return;
1350
1351     addr -= MPIC_EXT_REG_START & (OPENPIC_PAGE_SIZE - 1);
1352     if (addr < MPIC_EXT_REG_SIZE) {
1353         idx += (addr & 0xFFF0) >> 5;
1354         if (addr & 0x10) {
1355             /* EXDE / IFEDE / IEEDE */
1356             write_IRQreg(mpp, idx, IRQ_IDE, val);
1357         } else {
1358             /* EXVP / IFEVP / IEEVP */
1359             write_IRQreg(mpp, idx, IRQ_IPVP, val);
1360         }
1361     }
1362 }
1363
1364 static uint32_t mpic_src_ext_read (void *opaque, target_phys_addr_t addr)
1365 {
1366     openpic_t *mpp = opaque;
1367     uint32_t retval;
1368     int idx = MPIC_EXT_IRQ;
1369
1370     DPRINTF("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
1371     retval = 0xFFFFFFFF;
1372     if (addr & 0xF)
1373         return retval;
1374
1375     addr -= MPIC_EXT_REG_START & (OPENPIC_PAGE_SIZE - 1);
1376     if (addr < MPIC_EXT_REG_SIZE) {
1377         idx += (addr & 0xFFF0) >> 5;
1378         if (addr & 0x10) {
1379             /* EXDE / IFEDE / IEEDE */
1380             retval = read_IRQreg(mpp, idx, IRQ_IDE);
1381         } else {
1382             /* EXVP / IFEVP / IEEVP */
1383             retval = read_IRQreg(mpp, idx, IRQ_IPVP);
1384         }
1385         DPRINTF("%s: => %08x\n", __func__, retval);
1386     }
1387
1388     return retval;
1389 }
1390
1391 static void mpic_src_int_write (void *opaque, target_phys_addr_t addr,
1392                                 uint32_t val)
1393 {
1394     openpic_t *mpp = opaque;
1395     int idx = MPIC_INT_IRQ;
1396
1397     DPRINTF("%s: addr " TARGET_FMT_plx " <= %08x\n", __func__, addr, val);
1398     if (addr & 0xF)
1399         return;
1400
1401     addr -= MPIC_INT_REG_START & (OPENPIC_PAGE_SIZE - 1);
1402     if (addr < MPIC_INT_REG_SIZE) {
1403         idx += (addr & 0xFFF0) >> 5;
1404         if (addr & 0x10) {
1405             /* EXDE / IFEDE / IEEDE */
1406             write_IRQreg(mpp, idx, IRQ_IDE, val);
1407         } else {
1408             /* EXVP / IFEVP / IEEVP */
1409             write_IRQreg(mpp, idx, IRQ_IPVP, val);
1410         }
1411     }
1412 }
1413
1414 static uint32_t mpic_src_int_read (void *opaque, target_phys_addr_t addr)
1415 {
1416     openpic_t *mpp = opaque;
1417     uint32_t retval;
1418     int idx = MPIC_INT_IRQ;
1419
1420     DPRINTF("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
1421     retval = 0xFFFFFFFF;
1422     if (addr & 0xF)
1423         return retval;
1424
1425     addr -= MPIC_INT_REG_START & (OPENPIC_PAGE_SIZE - 1);
1426     if (addr < MPIC_INT_REG_SIZE) {
1427         idx += (addr & 0xFFF0) >> 5;
1428         if (addr & 0x10) {
1429             /* EXDE / IFEDE / IEEDE */
1430             retval = read_IRQreg(mpp, idx, IRQ_IDE);
1431         } else {
1432             /* EXVP / IFEVP / IEEVP */
1433             retval = read_IRQreg(mpp, idx, IRQ_IPVP);
1434         }
1435         DPRINTF("%s: => %08x\n", __func__, retval);
1436     }
1437
1438     return retval;
1439 }
1440
1441 static void mpic_src_msg_write (void *opaque, target_phys_addr_t addr,
1442                                 uint32_t val)
1443 {
1444     openpic_t *mpp = opaque;
1445     int idx = MPIC_MSG_IRQ;
1446
1447     DPRINTF("%s: addr " TARGET_FMT_plx " <= %08x\n", __func__, addr, val);
1448     if (addr & 0xF)
1449         return;
1450
1451     addr -= MPIC_MSG_REG_START & (OPENPIC_PAGE_SIZE - 1);
1452     if (addr < MPIC_MSG_REG_SIZE) {
1453         idx += (addr & 0xFFF0) >> 5;
1454         if (addr & 0x10) {
1455             /* EXDE / IFEDE / IEEDE */
1456             write_IRQreg(mpp, idx, IRQ_IDE, val);
1457         } else {
1458             /* EXVP / IFEVP / IEEVP */
1459             write_IRQreg(mpp, idx, IRQ_IPVP, val);
1460         }
1461     }
1462 }
1463
1464 static uint32_t mpic_src_msg_read (void *opaque, target_phys_addr_t addr)
1465 {
1466     openpic_t *mpp = opaque;
1467     uint32_t retval;
1468     int idx = MPIC_MSG_IRQ;
1469
1470     DPRINTF("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
1471     retval = 0xFFFFFFFF;
1472     if (addr & 0xF)
1473         return retval;
1474
1475     addr -= MPIC_MSG_REG_START & (OPENPIC_PAGE_SIZE - 1);
1476     if (addr < MPIC_MSG_REG_SIZE) {
1477         idx += (addr & 0xFFF0) >> 5;
1478         if (addr & 0x10) {
1479             /* EXDE / IFEDE / IEEDE */
1480             retval = read_IRQreg(mpp, idx, IRQ_IDE);
1481         } else {
1482             /* EXVP / IFEVP / IEEVP */
1483             retval = read_IRQreg(mpp, idx, IRQ_IPVP);
1484         }
1485         DPRINTF("%s: => %08x\n", __func__, retval);
1486     }
1487
1488     return retval;
1489 }
1490
1491 static void mpic_src_msi_write (void *opaque, target_phys_addr_t addr,
1492                                 uint32_t val)
1493 {
1494     openpic_t *mpp = opaque;
1495     int idx = MPIC_MSI_IRQ;
1496
1497     DPRINTF("%s: addr " TARGET_FMT_plx " <= %08x\n", __func__, addr, val);
1498     if (addr & 0xF)
1499         return;
1500
1501     addr -= MPIC_MSI_REG_START & (OPENPIC_PAGE_SIZE - 1);
1502     if (addr < MPIC_MSI_REG_SIZE) {
1503         idx += (addr & 0xFFF0) >> 5;
1504         if (addr & 0x10) {
1505             /* EXDE / IFEDE / IEEDE */
1506             write_IRQreg(mpp, idx, IRQ_IDE, val);
1507         } else {
1508             /* EXVP / IFEVP / IEEVP */
1509             write_IRQreg(mpp, idx, IRQ_IPVP, val);
1510         }
1511     }
1512 }
1513 static uint32_t mpic_src_msi_read (void *opaque, target_phys_addr_t addr)
1514 {
1515     openpic_t *mpp = opaque;
1516     uint32_t retval;
1517     int idx = MPIC_MSI_IRQ;
1518
1519     DPRINTF("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
1520     retval = 0xFFFFFFFF;
1521     if (addr & 0xF)
1522         return retval;
1523
1524     addr -= MPIC_MSI_REG_START & (OPENPIC_PAGE_SIZE - 1);
1525     if (addr < MPIC_MSI_REG_SIZE) {
1526         idx += (addr & 0xFFF0) >> 5;
1527         if (addr & 0x10) {
1528             /* EXDE / IFEDE / IEEDE */
1529             retval = read_IRQreg(mpp, idx, IRQ_IDE);
1530         } else {
1531             /* EXVP / IFEVP / IEEVP */
1532             retval = read_IRQreg(mpp, idx, IRQ_IPVP);
1533         }
1534         DPRINTF("%s: => %08x\n", __func__, retval);
1535     }
1536
1537     return retval;
1538 }
1539
1540 static CPUWriteMemoryFunc * const mpic_glb_write[] = {
1541     &openpic_buggy_write,
1542     &openpic_buggy_write,
1543     &openpic_gbl_write,
1544 };
1545
1546 static CPUReadMemoryFunc * const mpic_glb_read[] = {
1547     &openpic_buggy_read,
1548     &openpic_buggy_read,
1549     &openpic_gbl_read,
1550 };
1551
1552 static CPUWriteMemoryFunc * const mpic_tmr_write[] = {
1553     &openpic_buggy_write,
1554     &openpic_buggy_write,
1555     &mpic_timer_write,
1556 };
1557
1558 static CPUReadMemoryFunc * const mpic_tmr_read[] = {
1559     &openpic_buggy_read,
1560     &openpic_buggy_read,
1561     &mpic_timer_read,
1562 };
1563
1564 static CPUWriteMemoryFunc * const mpic_cpu_write[] = {
1565     &openpic_buggy_write,
1566     &openpic_buggy_write,
1567     &openpic_cpu_write,
1568 };
1569
1570 static CPUReadMemoryFunc * const mpic_cpu_read[] = {
1571     &openpic_buggy_read,
1572     &openpic_buggy_read,
1573     &openpic_cpu_read,
1574 };
1575
1576 static CPUWriteMemoryFunc * const mpic_ext_write[] = {
1577     &openpic_buggy_write,
1578     &openpic_buggy_write,
1579     &mpic_src_ext_write,
1580 };
1581
1582 static CPUReadMemoryFunc * const mpic_ext_read[] = {
1583     &openpic_buggy_read,
1584     &openpic_buggy_read,
1585     &mpic_src_ext_read,
1586 };
1587
1588 static CPUWriteMemoryFunc * const mpic_int_write[] = {
1589     &openpic_buggy_write,
1590     &openpic_buggy_write,
1591     &mpic_src_int_write,
1592 };
1593
1594 static CPUReadMemoryFunc * const mpic_int_read[] = {
1595     &openpic_buggy_read,
1596     &openpic_buggy_read,
1597     &mpic_src_int_read,
1598 };
1599
1600 static CPUWriteMemoryFunc * const mpic_msg_write[] = {
1601     &openpic_buggy_write,
1602     &openpic_buggy_write,
1603     &mpic_src_msg_write,
1604 };
1605
1606 static CPUReadMemoryFunc * const mpic_msg_read[] = {
1607     &openpic_buggy_read,
1608     &openpic_buggy_read,
1609     &mpic_src_msg_read,
1610 };
1611 static CPUWriteMemoryFunc * const mpic_msi_write[] = {
1612     &openpic_buggy_write,
1613     &openpic_buggy_write,
1614     &mpic_src_msi_write,
1615 };
1616
1617 static CPUReadMemoryFunc * const mpic_msi_read[] = {
1618     &openpic_buggy_read,
1619     &openpic_buggy_read,
1620     &mpic_src_msi_read,
1621 };
1622
1623 qemu_irq *mpic_init (target_phys_addr_t base, int nb_cpus,
1624                         qemu_irq **irqs, qemu_irq irq_out)
1625 {
1626     openpic_t *mpp;
1627     int i;
1628     struct {
1629         CPUReadMemoryFunc * const *read;
1630         CPUWriteMemoryFunc * const *write;
1631         target_phys_addr_t start_addr;
1632         ram_addr_t size;
1633     } const list[] = {
1634         {mpic_glb_read, mpic_glb_write, MPIC_GLB_REG_START, MPIC_GLB_REG_SIZE},
1635         {mpic_tmr_read, mpic_tmr_write, MPIC_TMR_REG_START, MPIC_TMR_REG_SIZE},
1636         {mpic_ext_read, mpic_ext_write, MPIC_EXT_REG_START, MPIC_EXT_REG_SIZE},
1637         {mpic_int_read, mpic_int_write, MPIC_INT_REG_START, MPIC_INT_REG_SIZE},
1638         {mpic_msg_read, mpic_msg_write, MPIC_MSG_REG_START, MPIC_MSG_REG_SIZE},
1639         {mpic_msi_read, mpic_msi_write, MPIC_MSI_REG_START, MPIC_MSI_REG_SIZE},
1640         {mpic_cpu_read, mpic_cpu_write, MPIC_CPU_REG_START, MPIC_CPU_REG_SIZE},
1641     };
1642
1643     /* XXX: for now, only one CPU is supported */
1644     if (nb_cpus != 1)
1645         return NULL;
1646
1647     mpp = g_malloc0(sizeof(openpic_t));
1648
1649     for (i = 0; i < sizeof(list)/sizeof(list[0]); i++) {
1650         int mem_index;
1651
1652         mem_index = cpu_register_io_memory(list[i].read, list[i].write, mpp,
1653                                            DEVICE_BIG_ENDIAN);
1654         if (mem_index < 0) {
1655             goto free;
1656         }
1657         cpu_register_physical_memory(base + list[i].start_addr,
1658                                      list[i].size, mem_index);
1659     }
1660
1661     mpp->nb_cpus = nb_cpus;
1662     mpp->max_irq = MPIC_MAX_IRQ;
1663     mpp->irq_ipi0 = MPIC_IPI_IRQ;
1664     mpp->irq_tim0 = MPIC_TMR_IRQ;
1665
1666     for (i = 0; i < nb_cpus; i++)
1667         mpp->dst[i].irqs = irqs[i];
1668     mpp->irq_out = irq_out;
1669
1670     mpp->irq_raise = mpic_irq_raise;
1671     mpp->reset = mpic_reset;
1672
1673     register_savevm(NULL, "mpic", 0, 2, openpic_save, openpic_load, mpp);
1674     qemu_register_reset(mpic_reset, mpp);
1675
1676     return qemu_allocate_irqs(openpic_set_irq, mpp, mpp->max_irq);
1677
1678 free:
1679     g_free(mpp);
1680     return NULL;
1681 }