2 * QEMU generic PowerPC hardware System Emulator
4 * Copyright (c) 2003-2007 Jocelyn Mayer
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 #include "hw/ppc/ppc.h"
26 #include "qemu/timer.h"
27 #include "sysemu/sysemu.h"
28 #include "hw/timer/m48t59.h"
30 #include "hw/loader.h"
31 #include "sysemu/kvm.h"
34 //#define PPC_DEBUG_IRQ
35 //#define PPC_DEBUG_TB
38 # define LOG_IRQ(...) qemu_log_mask(CPU_LOG_INT, ## __VA_ARGS__)
40 # define LOG_IRQ(...) do { } while (0)
45 # define LOG_TB(...) qemu_log(__VA_ARGS__)
47 # define LOG_TB(...) do { } while (0)
50 static void cpu_ppc_tb_stop (CPUPPCState
*env
);
51 static void cpu_ppc_tb_start (CPUPPCState
*env
);
53 void ppc_set_irq(PowerPCCPU
*cpu
, int n_IRQ
, int level
)
55 CPUState
*cs
= CPU(cpu
);
56 CPUPPCState
*env
= &cpu
->env
;
57 unsigned int old_pending
= env
->pending_interrupts
;
60 env
->pending_interrupts
|= 1 << n_IRQ
;
61 cpu_interrupt(cs
, CPU_INTERRUPT_HARD
);
63 env
->pending_interrupts
&= ~(1 << n_IRQ
);
64 if (env
->pending_interrupts
== 0) {
65 cpu_reset_interrupt(cs
, CPU_INTERRUPT_HARD
);
69 if (old_pending
!= env
->pending_interrupts
) {
71 kvmppc_set_interrupt(cpu
, n_IRQ
, level
);
75 LOG_IRQ("%s: %p n_IRQ %d level %d => pending %08" PRIx32
76 "req %08x\n", __func__
, env
, n_IRQ
, level
,
77 env
->pending_interrupts
, CPU(cpu
)->interrupt_request
);
80 /* PowerPC 6xx / 7xx internal IRQ controller */
81 static void ppc6xx_set_irq(void *opaque
, int pin
, int level
)
83 PowerPCCPU
*cpu
= opaque
;
84 CPUPPCState
*env
= &cpu
->env
;
87 LOG_IRQ("%s: env %p pin %d level %d\n", __func__
,
89 cur_level
= (env
->irq_input_state
>> pin
) & 1;
90 /* Don't generate spurious events */
91 if ((cur_level
== 1 && level
== 0) || (cur_level
== 0 && level
!= 0)) {
92 CPUState
*cs
= CPU(cpu
);
95 case PPC6xx_INPUT_TBEN
:
96 /* Level sensitive - active high */
97 LOG_IRQ("%s: %s the time base\n",
98 __func__
, level
? "start" : "stop");
100 cpu_ppc_tb_start(env
);
102 cpu_ppc_tb_stop(env
);
104 case PPC6xx_INPUT_INT
:
105 /* Level sensitive - active high */
106 LOG_IRQ("%s: set the external IRQ state to %d\n",
108 ppc_set_irq(cpu
, PPC_INTERRUPT_EXT
, level
);
110 case PPC6xx_INPUT_SMI
:
111 /* Level sensitive - active high */
112 LOG_IRQ("%s: set the SMI IRQ state to %d\n",
114 ppc_set_irq(cpu
, PPC_INTERRUPT_SMI
, level
);
116 case PPC6xx_INPUT_MCP
:
117 /* Negative edge sensitive */
118 /* XXX: TODO: actual reaction may depends on HID0 status
119 * 603/604/740/750: check HID0[EMCP]
121 if (cur_level
== 1 && level
== 0) {
122 LOG_IRQ("%s: raise machine check state\n",
124 ppc_set_irq(cpu
, PPC_INTERRUPT_MCK
, 1);
127 case PPC6xx_INPUT_CKSTP_IN
:
128 /* Level sensitive - active low */
129 /* XXX: TODO: relay the signal to CKSTP_OUT pin */
130 /* XXX: Note that the only way to restart the CPU is to reset it */
132 LOG_IRQ("%s: stop the CPU\n", __func__
);
136 case PPC6xx_INPUT_HRESET
:
137 /* Level sensitive - active low */
139 LOG_IRQ("%s: reset the CPU\n", __func__
);
140 cpu_interrupt(cs
, CPU_INTERRUPT_RESET
);
143 case PPC6xx_INPUT_SRESET
:
144 LOG_IRQ("%s: set the RESET IRQ state to %d\n",
146 ppc_set_irq(cpu
, PPC_INTERRUPT_RESET
, level
);
149 /* Unknown pin - do nothing */
150 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__
, pin
);
154 env
->irq_input_state
|= 1 << pin
;
156 env
->irq_input_state
&= ~(1 << pin
);
160 void ppc6xx_irq_init(CPUPPCState
*env
)
162 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
164 env
->irq_inputs
= (void **)qemu_allocate_irqs(&ppc6xx_set_irq
, cpu
,
168 #if defined(TARGET_PPC64)
169 /* PowerPC 970 internal IRQ controller */
170 static void ppc970_set_irq(void *opaque
, int pin
, int level
)
172 PowerPCCPU
*cpu
= opaque
;
173 CPUPPCState
*env
= &cpu
->env
;
176 LOG_IRQ("%s: env %p pin %d level %d\n", __func__
,
178 cur_level
= (env
->irq_input_state
>> pin
) & 1;
179 /* Don't generate spurious events */
180 if ((cur_level
== 1 && level
== 0) || (cur_level
== 0 && level
!= 0)) {
181 CPUState
*cs
= CPU(cpu
);
184 case PPC970_INPUT_INT
:
185 /* Level sensitive - active high */
186 LOG_IRQ("%s: set the external IRQ state to %d\n",
188 ppc_set_irq(cpu
, PPC_INTERRUPT_EXT
, level
);
190 case PPC970_INPUT_THINT
:
191 /* Level sensitive - active high */
192 LOG_IRQ("%s: set the SMI IRQ state to %d\n", __func__
,
194 ppc_set_irq(cpu
, PPC_INTERRUPT_THERM
, level
);
196 case PPC970_INPUT_MCP
:
197 /* Negative edge sensitive */
198 /* XXX: TODO: actual reaction may depends on HID0 status
199 * 603/604/740/750: check HID0[EMCP]
201 if (cur_level
== 1 && level
== 0) {
202 LOG_IRQ("%s: raise machine check state\n",
204 ppc_set_irq(cpu
, PPC_INTERRUPT_MCK
, 1);
207 case PPC970_INPUT_CKSTP
:
208 /* Level sensitive - active low */
209 /* XXX: TODO: relay the signal to CKSTP_OUT pin */
211 LOG_IRQ("%s: stop the CPU\n", __func__
);
214 LOG_IRQ("%s: restart the CPU\n", __func__
);
219 case PPC970_INPUT_HRESET
:
220 /* Level sensitive - active low */
222 cpu_interrupt(cs
, CPU_INTERRUPT_RESET
);
225 case PPC970_INPUT_SRESET
:
226 LOG_IRQ("%s: set the RESET IRQ state to %d\n",
228 ppc_set_irq(cpu
, PPC_INTERRUPT_RESET
, level
);
230 case PPC970_INPUT_TBEN
:
231 LOG_IRQ("%s: set the TBEN state to %d\n", __func__
,
236 /* Unknown pin - do nothing */
237 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__
, pin
);
241 env
->irq_input_state
|= 1 << pin
;
243 env
->irq_input_state
&= ~(1 << pin
);
247 void ppc970_irq_init(CPUPPCState
*env
)
249 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
251 env
->irq_inputs
= (void **)qemu_allocate_irqs(&ppc970_set_irq
, cpu
,
255 /* POWER7 internal IRQ controller */
256 static void power7_set_irq(void *opaque
, int pin
, int level
)
258 PowerPCCPU
*cpu
= opaque
;
259 CPUPPCState
*env
= &cpu
->env
;
261 LOG_IRQ("%s: env %p pin %d level %d\n", __func__
,
265 case POWER7_INPUT_INT
:
266 /* Level sensitive - active high */
267 LOG_IRQ("%s: set the external IRQ state to %d\n",
269 ppc_set_irq(cpu
, PPC_INTERRUPT_EXT
, level
);
272 /* Unknown pin - do nothing */
273 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__
, pin
);
277 env
->irq_input_state
|= 1 << pin
;
279 env
->irq_input_state
&= ~(1 << pin
);
283 void ppcPOWER7_irq_init(CPUPPCState
*env
)
285 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
287 env
->irq_inputs
= (void **)qemu_allocate_irqs(&power7_set_irq
, cpu
,
290 #endif /* defined(TARGET_PPC64) */
292 /* PowerPC 40x internal IRQ controller */
293 static void ppc40x_set_irq(void *opaque
, int pin
, int level
)
295 PowerPCCPU
*cpu
= opaque
;
296 CPUPPCState
*env
= &cpu
->env
;
299 LOG_IRQ("%s: env %p pin %d level %d\n", __func__
,
301 cur_level
= (env
->irq_input_state
>> pin
) & 1;
302 /* Don't generate spurious events */
303 if ((cur_level
== 1 && level
== 0) || (cur_level
== 0 && level
!= 0)) {
304 CPUState
*cs
= CPU(cpu
);
307 case PPC40x_INPUT_RESET_SYS
:
309 LOG_IRQ("%s: reset the PowerPC system\n",
311 ppc40x_system_reset(cpu
);
314 case PPC40x_INPUT_RESET_CHIP
:
316 LOG_IRQ("%s: reset the PowerPC chip\n", __func__
);
317 ppc40x_chip_reset(cpu
);
320 case PPC40x_INPUT_RESET_CORE
:
321 /* XXX: TODO: update DBSR[MRR] */
323 LOG_IRQ("%s: reset the PowerPC core\n", __func__
);
324 ppc40x_core_reset(cpu
);
327 case PPC40x_INPUT_CINT
:
328 /* Level sensitive - active high */
329 LOG_IRQ("%s: set the critical IRQ state to %d\n",
331 ppc_set_irq(cpu
, PPC_INTERRUPT_CEXT
, level
);
333 case PPC40x_INPUT_INT
:
334 /* Level sensitive - active high */
335 LOG_IRQ("%s: set the external IRQ state to %d\n",
337 ppc_set_irq(cpu
, PPC_INTERRUPT_EXT
, level
);
339 case PPC40x_INPUT_HALT
:
340 /* Level sensitive - active low */
342 LOG_IRQ("%s: stop the CPU\n", __func__
);
345 LOG_IRQ("%s: restart the CPU\n", __func__
);
350 case PPC40x_INPUT_DEBUG
:
351 /* Level sensitive - active high */
352 LOG_IRQ("%s: set the debug pin state to %d\n",
354 ppc_set_irq(cpu
, PPC_INTERRUPT_DEBUG
, level
);
357 /* Unknown pin - do nothing */
358 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__
, pin
);
362 env
->irq_input_state
|= 1 << pin
;
364 env
->irq_input_state
&= ~(1 << pin
);
368 void ppc40x_irq_init(CPUPPCState
*env
)
370 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
372 env
->irq_inputs
= (void **)qemu_allocate_irqs(&ppc40x_set_irq
,
373 cpu
, PPC40x_INPUT_NB
);
376 /* PowerPC E500 internal IRQ controller */
377 static void ppce500_set_irq(void *opaque
, int pin
, int level
)
379 PowerPCCPU
*cpu
= opaque
;
380 CPUPPCState
*env
= &cpu
->env
;
383 LOG_IRQ("%s: env %p pin %d level %d\n", __func__
,
385 cur_level
= (env
->irq_input_state
>> pin
) & 1;
386 /* Don't generate spurious events */
387 if ((cur_level
== 1 && level
== 0) || (cur_level
== 0 && level
!= 0)) {
389 case PPCE500_INPUT_MCK
:
391 LOG_IRQ("%s: reset the PowerPC system\n",
393 qemu_system_reset_request();
396 case PPCE500_INPUT_RESET_CORE
:
398 LOG_IRQ("%s: reset the PowerPC core\n", __func__
);
399 ppc_set_irq(cpu
, PPC_INTERRUPT_MCK
, level
);
402 case PPCE500_INPUT_CINT
:
403 /* Level sensitive - active high */
404 LOG_IRQ("%s: set the critical IRQ state to %d\n",
406 ppc_set_irq(cpu
, PPC_INTERRUPT_CEXT
, level
);
408 case PPCE500_INPUT_INT
:
409 /* Level sensitive - active high */
410 LOG_IRQ("%s: set the core IRQ state to %d\n",
412 ppc_set_irq(cpu
, PPC_INTERRUPT_EXT
, level
);
414 case PPCE500_INPUT_DEBUG
:
415 /* Level sensitive - active high */
416 LOG_IRQ("%s: set the debug pin state to %d\n",
418 ppc_set_irq(cpu
, PPC_INTERRUPT_DEBUG
, level
);
421 /* Unknown pin - do nothing */
422 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__
, pin
);
426 env
->irq_input_state
|= 1 << pin
;
428 env
->irq_input_state
&= ~(1 << pin
);
432 void ppce500_irq_init(CPUPPCState
*env
)
434 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
436 env
->irq_inputs
= (void **)qemu_allocate_irqs(&ppce500_set_irq
,
437 cpu
, PPCE500_INPUT_NB
);
440 /* Enable or Disable the E500 EPR capability */
441 void ppce500_set_mpic_proxy(bool enabled
)
445 for (cs
= first_cpu
; cs
!= NULL
; cs
= cs
->next_cpu
) {
446 PowerPCCPU
*cpu
= POWERPC_CPU(cs
);
448 cpu
->env
.mpic_proxy
= enabled
;
450 kvmppc_set_mpic_proxy(cpu
, enabled
);
455 /*****************************************************************************/
456 /* PowerPC time base and decrementer emulation */
458 uint64_t cpu_ppc_get_tb(ppc_tb_t
*tb_env
, uint64_t vmclk
, int64_t tb_offset
)
460 /* TB time in tb periods */
461 return muldiv64(vmclk
, tb_env
->tb_freq
, get_ticks_per_sec()) + tb_offset
;
464 uint64_t cpu_ppc_load_tbl (CPUPPCState
*env
)
466 ppc_tb_t
*tb_env
= env
->tb_env
;
470 return env
->spr
[SPR_TBL
];
473 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->tb_offset
);
474 LOG_TB("%s: tb %016" PRIx64
"\n", __func__
, tb
);
479 static inline uint32_t _cpu_ppc_load_tbu(CPUPPCState
*env
)
481 ppc_tb_t
*tb_env
= env
->tb_env
;
484 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->tb_offset
);
485 LOG_TB("%s: tb %016" PRIx64
"\n", __func__
, tb
);
490 uint32_t cpu_ppc_load_tbu (CPUPPCState
*env
)
493 return env
->spr
[SPR_TBU
];
496 return _cpu_ppc_load_tbu(env
);
499 static inline void cpu_ppc_store_tb(ppc_tb_t
*tb_env
, uint64_t vmclk
,
500 int64_t *tb_offsetp
, uint64_t value
)
502 *tb_offsetp
= value
- muldiv64(vmclk
, tb_env
->tb_freq
, get_ticks_per_sec());
503 LOG_TB("%s: tb %016" PRIx64
" offset %08" PRIx64
"\n",
504 __func__
, value
, *tb_offsetp
);
507 void cpu_ppc_store_tbl (CPUPPCState
*env
, uint32_t value
)
509 ppc_tb_t
*tb_env
= env
->tb_env
;
512 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->tb_offset
);
513 tb
&= 0xFFFFFFFF00000000ULL
;
514 cpu_ppc_store_tb(tb_env
, qemu_get_clock_ns(vm_clock
),
515 &tb_env
->tb_offset
, tb
| (uint64_t)value
);
518 static inline void _cpu_ppc_store_tbu(CPUPPCState
*env
, uint32_t value
)
520 ppc_tb_t
*tb_env
= env
->tb_env
;
523 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->tb_offset
);
524 tb
&= 0x00000000FFFFFFFFULL
;
525 cpu_ppc_store_tb(tb_env
, qemu_get_clock_ns(vm_clock
),
526 &tb_env
->tb_offset
, ((uint64_t)value
<< 32) | tb
);
529 void cpu_ppc_store_tbu (CPUPPCState
*env
, uint32_t value
)
531 _cpu_ppc_store_tbu(env
, value
);
534 uint64_t cpu_ppc_load_atbl (CPUPPCState
*env
)
536 ppc_tb_t
*tb_env
= env
->tb_env
;
539 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->atb_offset
);
540 LOG_TB("%s: tb %016" PRIx64
"\n", __func__
, tb
);
545 uint32_t cpu_ppc_load_atbu (CPUPPCState
*env
)
547 ppc_tb_t
*tb_env
= env
->tb_env
;
550 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->atb_offset
);
551 LOG_TB("%s: tb %016" PRIx64
"\n", __func__
, tb
);
556 void cpu_ppc_store_atbl (CPUPPCState
*env
, uint32_t value
)
558 ppc_tb_t
*tb_env
= env
->tb_env
;
561 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->atb_offset
);
562 tb
&= 0xFFFFFFFF00000000ULL
;
563 cpu_ppc_store_tb(tb_env
, qemu_get_clock_ns(vm_clock
),
564 &tb_env
->atb_offset
, tb
| (uint64_t)value
);
567 void cpu_ppc_store_atbu (CPUPPCState
*env
, uint32_t value
)
569 ppc_tb_t
*tb_env
= env
->tb_env
;
572 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->atb_offset
);
573 tb
&= 0x00000000FFFFFFFFULL
;
574 cpu_ppc_store_tb(tb_env
, qemu_get_clock_ns(vm_clock
),
575 &tb_env
->atb_offset
, ((uint64_t)value
<< 32) | tb
);
578 static void cpu_ppc_tb_stop (CPUPPCState
*env
)
580 ppc_tb_t
*tb_env
= env
->tb_env
;
581 uint64_t tb
, atb
, vmclk
;
583 /* If the time base is already frozen, do nothing */
584 if (tb_env
->tb_freq
!= 0) {
585 vmclk
= qemu_get_clock_ns(vm_clock
);
586 /* Get the time base */
587 tb
= cpu_ppc_get_tb(tb_env
, vmclk
, tb_env
->tb_offset
);
588 /* Get the alternate time base */
589 atb
= cpu_ppc_get_tb(tb_env
, vmclk
, tb_env
->atb_offset
);
590 /* Store the time base value (ie compute the current offset) */
591 cpu_ppc_store_tb(tb_env
, vmclk
, &tb_env
->tb_offset
, tb
);
592 /* Store the alternate time base value (compute the current offset) */
593 cpu_ppc_store_tb(tb_env
, vmclk
, &tb_env
->atb_offset
, atb
);
594 /* Set the time base frequency to zero */
596 /* Now, the time bases are frozen to tb_offset / atb_offset value */
600 static void cpu_ppc_tb_start (CPUPPCState
*env
)
602 ppc_tb_t
*tb_env
= env
->tb_env
;
603 uint64_t tb
, atb
, vmclk
;
605 /* If the time base is not frozen, do nothing */
606 if (tb_env
->tb_freq
== 0) {
607 vmclk
= qemu_get_clock_ns(vm_clock
);
608 /* Get the time base from tb_offset */
609 tb
= tb_env
->tb_offset
;
610 /* Get the alternate time base from atb_offset */
611 atb
= tb_env
->atb_offset
;
612 /* Restore the tb frequency from the decrementer frequency */
613 tb_env
->tb_freq
= tb_env
->decr_freq
;
614 /* Store the time base value */
615 cpu_ppc_store_tb(tb_env
, vmclk
, &tb_env
->tb_offset
, tb
);
616 /* Store the alternate time base value */
617 cpu_ppc_store_tb(tb_env
, vmclk
, &tb_env
->atb_offset
, atb
);
621 static inline uint32_t _cpu_ppc_load_decr(CPUPPCState
*env
, uint64_t next
)
623 ppc_tb_t
*tb_env
= env
->tb_env
;
627 diff
= next
- qemu_get_clock_ns(vm_clock
);
629 decr
= muldiv64(diff
, tb_env
->decr_freq
, get_ticks_per_sec());
630 } else if (tb_env
->flags
& PPC_TIMER_BOOKE
) {
633 decr
= -muldiv64(-diff
, tb_env
->decr_freq
, get_ticks_per_sec());
635 LOG_TB("%s: %08" PRIx32
"\n", __func__
, decr
);
640 uint32_t cpu_ppc_load_decr (CPUPPCState
*env
)
642 ppc_tb_t
*tb_env
= env
->tb_env
;
645 return env
->spr
[SPR_DECR
];
648 return _cpu_ppc_load_decr(env
, tb_env
->decr_next
);
651 uint32_t cpu_ppc_load_hdecr (CPUPPCState
*env
)
653 ppc_tb_t
*tb_env
= env
->tb_env
;
655 return _cpu_ppc_load_decr(env
, tb_env
->hdecr_next
);
658 uint64_t cpu_ppc_load_purr (CPUPPCState
*env
)
660 ppc_tb_t
*tb_env
= env
->tb_env
;
663 diff
= qemu_get_clock_ns(vm_clock
) - tb_env
->purr_start
;
665 return tb_env
->purr_load
+ muldiv64(diff
, tb_env
->tb_freq
, get_ticks_per_sec());
668 /* When decrementer expires,
669 * all we need to do is generate or queue a CPU exception
671 static inline void cpu_ppc_decr_excp(PowerPCCPU
*cpu
)
674 LOG_TB("raise decrementer exception\n");
675 ppc_set_irq(cpu
, PPC_INTERRUPT_DECR
, 1);
678 static inline void cpu_ppc_hdecr_excp(PowerPCCPU
*cpu
)
681 LOG_TB("raise decrementer exception\n");
682 ppc_set_irq(cpu
, PPC_INTERRUPT_HDECR
, 1);
685 static void __cpu_ppc_store_decr(PowerPCCPU
*cpu
, uint64_t *nextp
,
686 struct QEMUTimer
*timer
,
687 void (*raise_excp
)(PowerPCCPU
*),
688 uint32_t decr
, uint32_t value
,
691 CPUPPCState
*env
= &cpu
->env
;
692 ppc_tb_t
*tb_env
= env
->tb_env
;
695 LOG_TB("%s: %08" PRIx32
" => %08" PRIx32
"\n", __func__
,
699 /* KVM handles decrementer exceptions, we don't need our own timer */
703 now
= qemu_get_clock_ns(vm_clock
);
704 next
= now
+ muldiv64(value
, get_ticks_per_sec(), tb_env
->decr_freq
);
706 next
+= *nextp
- now
;
713 qemu_mod_timer(timer
, next
);
715 /* If we set a negative value and the decrementer was positive, raise an
718 if ((tb_env
->flags
& PPC_DECR_UNDERFLOW_TRIGGERED
)
719 && (value
& 0x80000000)
720 && !(decr
& 0x80000000)) {
725 static inline void _cpu_ppc_store_decr(PowerPCCPU
*cpu
, uint32_t decr
,
726 uint32_t value
, int is_excp
)
728 ppc_tb_t
*tb_env
= cpu
->env
.tb_env
;
730 __cpu_ppc_store_decr(cpu
, &tb_env
->decr_next
, tb_env
->decr_timer
,
731 &cpu_ppc_decr_excp
, decr
, value
, is_excp
);
734 void cpu_ppc_store_decr (CPUPPCState
*env
, uint32_t value
)
736 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
738 _cpu_ppc_store_decr(cpu
, cpu_ppc_load_decr(env
), value
, 0);
741 static void cpu_ppc_decr_cb(void *opaque
)
743 PowerPCCPU
*cpu
= opaque
;
745 _cpu_ppc_store_decr(cpu
, 0x00000000, 0xFFFFFFFF, 1);
748 static inline void _cpu_ppc_store_hdecr(PowerPCCPU
*cpu
, uint32_t hdecr
,
749 uint32_t value
, int is_excp
)
751 ppc_tb_t
*tb_env
= cpu
->env
.tb_env
;
753 if (tb_env
->hdecr_timer
!= NULL
) {
754 __cpu_ppc_store_decr(cpu
, &tb_env
->hdecr_next
, tb_env
->hdecr_timer
,
755 &cpu_ppc_hdecr_excp
, hdecr
, value
, is_excp
);
759 void cpu_ppc_store_hdecr (CPUPPCState
*env
, uint32_t value
)
761 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
763 _cpu_ppc_store_hdecr(cpu
, cpu_ppc_load_hdecr(env
), value
, 0);
766 static void cpu_ppc_hdecr_cb(void *opaque
)
768 PowerPCCPU
*cpu
= opaque
;
770 _cpu_ppc_store_hdecr(cpu
, 0x00000000, 0xFFFFFFFF, 1);
773 static void cpu_ppc_store_purr(PowerPCCPU
*cpu
, uint64_t value
)
775 ppc_tb_t
*tb_env
= cpu
->env
.tb_env
;
777 tb_env
->purr_load
= value
;
778 tb_env
->purr_start
= qemu_get_clock_ns(vm_clock
);
781 static void cpu_ppc_set_tb_clk (void *opaque
, uint32_t freq
)
783 CPUPPCState
*env
= opaque
;
784 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
785 ppc_tb_t
*tb_env
= env
->tb_env
;
787 tb_env
->tb_freq
= freq
;
788 tb_env
->decr_freq
= freq
;
789 /* There is a bug in Linux 2.4 kernels:
790 * if a decrementer exception is pending when it enables msr_ee at startup,
791 * it's not ready to handle it...
793 _cpu_ppc_store_decr(cpu
, 0xFFFFFFFF, 0xFFFFFFFF, 0);
794 _cpu_ppc_store_hdecr(cpu
, 0xFFFFFFFF, 0xFFFFFFFF, 0);
795 cpu_ppc_store_purr(cpu
, 0x0000000000000000ULL
);
798 /* Set up (once) timebase frequency (in Hz) */
799 clk_setup_cb
cpu_ppc_tb_init (CPUPPCState
*env
, uint32_t freq
)
801 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
804 tb_env
= g_malloc0(sizeof(ppc_tb_t
));
805 env
->tb_env
= tb_env
;
806 tb_env
->flags
= PPC_DECR_UNDERFLOW_TRIGGERED
;
807 /* Create new timer */
808 tb_env
->decr_timer
= qemu_new_timer_ns(vm_clock
, &cpu_ppc_decr_cb
, cpu
);
810 /* XXX: find a suitable condition to enable the hypervisor decrementer
812 tb_env
->hdecr_timer
= qemu_new_timer_ns(vm_clock
, &cpu_ppc_hdecr_cb
,
815 tb_env
->hdecr_timer
= NULL
;
817 cpu_ppc_set_tb_clk(env
, freq
);
819 return &cpu_ppc_set_tb_clk
;
822 /* Specific helpers for POWER & PowerPC 601 RTC */
824 static clk_setup_cb
cpu_ppc601_rtc_init (CPUPPCState
*env
)
826 return cpu_ppc_tb_init(env
, 7812500);
830 void cpu_ppc601_store_rtcu (CPUPPCState
*env
, uint32_t value
)
832 _cpu_ppc_store_tbu(env
, value
);
835 uint32_t cpu_ppc601_load_rtcu (CPUPPCState
*env
)
837 return _cpu_ppc_load_tbu(env
);
840 void cpu_ppc601_store_rtcl (CPUPPCState
*env
, uint32_t value
)
842 cpu_ppc_store_tbl(env
, value
& 0x3FFFFF80);
845 uint32_t cpu_ppc601_load_rtcl (CPUPPCState
*env
)
847 return cpu_ppc_load_tbl(env
) & 0x3FFFFF80;
850 /*****************************************************************************/
851 /* PowerPC 40x timers */
854 typedef struct ppc40x_timer_t ppc40x_timer_t
;
855 struct ppc40x_timer_t
{
856 uint64_t pit_reload
; /* PIT auto-reload value */
857 uint64_t fit_next
; /* Tick for next FIT interrupt */
858 struct QEMUTimer
*fit_timer
;
859 uint64_t wdt_next
; /* Tick for next WDT interrupt */
860 struct QEMUTimer
*wdt_timer
;
862 /* 405 have the PIT, 440 have a DECR. */
863 unsigned int decr_excp
;
866 /* Fixed interval timer */
867 static void cpu_4xx_fit_cb (void *opaque
)
872 ppc40x_timer_t
*ppc40x_timer
;
876 cpu
= ppc_env_get_cpu(env
);
877 tb_env
= env
->tb_env
;
878 ppc40x_timer
= tb_env
->opaque
;
879 now
= qemu_get_clock_ns(vm_clock
);
880 switch ((env
->spr
[SPR_40x_TCR
] >> 24) & 0x3) {
894 /* Cannot occur, but makes gcc happy */
897 next
= now
+ muldiv64(next
, get_ticks_per_sec(), tb_env
->tb_freq
);
900 qemu_mod_timer(ppc40x_timer
->fit_timer
, next
);
901 env
->spr
[SPR_40x_TSR
] |= 1 << 26;
902 if ((env
->spr
[SPR_40x_TCR
] >> 23) & 0x1) {
903 ppc_set_irq(cpu
, PPC_INTERRUPT_FIT
, 1);
905 LOG_TB("%s: ir %d TCR " TARGET_FMT_lx
" TSR " TARGET_FMT_lx
"\n", __func__
,
906 (int)((env
->spr
[SPR_40x_TCR
] >> 23) & 0x1),
907 env
->spr
[SPR_40x_TCR
], env
->spr
[SPR_40x_TSR
]);
910 /* Programmable interval timer */
911 static void start_stop_pit (CPUPPCState
*env
, ppc_tb_t
*tb_env
, int is_excp
)
913 ppc40x_timer_t
*ppc40x_timer
;
916 ppc40x_timer
= tb_env
->opaque
;
917 if (ppc40x_timer
->pit_reload
<= 1 ||
918 !((env
->spr
[SPR_40x_TCR
] >> 26) & 0x1) ||
919 (is_excp
&& !((env
->spr
[SPR_40x_TCR
] >> 22) & 0x1))) {
921 LOG_TB("%s: stop PIT\n", __func__
);
922 qemu_del_timer(tb_env
->decr_timer
);
924 LOG_TB("%s: start PIT %016" PRIx64
"\n",
925 __func__
, ppc40x_timer
->pit_reload
);
926 now
= qemu_get_clock_ns(vm_clock
);
927 next
= now
+ muldiv64(ppc40x_timer
->pit_reload
,
928 get_ticks_per_sec(), tb_env
->decr_freq
);
930 next
+= tb_env
->decr_next
- now
;
933 qemu_mod_timer(tb_env
->decr_timer
, next
);
934 tb_env
->decr_next
= next
;
938 static void cpu_4xx_pit_cb (void *opaque
)
943 ppc40x_timer_t
*ppc40x_timer
;
946 cpu
= ppc_env_get_cpu(env
);
947 tb_env
= env
->tb_env
;
948 ppc40x_timer
= tb_env
->opaque
;
949 env
->spr
[SPR_40x_TSR
] |= 1 << 27;
950 if ((env
->spr
[SPR_40x_TCR
] >> 26) & 0x1) {
951 ppc_set_irq(cpu
, ppc40x_timer
->decr_excp
, 1);
953 start_stop_pit(env
, tb_env
, 1);
954 LOG_TB("%s: ar %d ir %d TCR " TARGET_FMT_lx
" TSR " TARGET_FMT_lx
" "
955 "%016" PRIx64
"\n", __func__
,
956 (int)((env
->spr
[SPR_40x_TCR
] >> 22) & 0x1),
957 (int)((env
->spr
[SPR_40x_TCR
] >> 26) & 0x1),
958 env
->spr
[SPR_40x_TCR
], env
->spr
[SPR_40x_TSR
],
959 ppc40x_timer
->pit_reload
);
963 static void cpu_4xx_wdt_cb (void *opaque
)
968 ppc40x_timer_t
*ppc40x_timer
;
972 cpu
= ppc_env_get_cpu(env
);
973 tb_env
= env
->tb_env
;
974 ppc40x_timer
= tb_env
->opaque
;
975 now
= qemu_get_clock_ns(vm_clock
);
976 switch ((env
->spr
[SPR_40x_TCR
] >> 30) & 0x3) {
990 /* Cannot occur, but makes gcc happy */
993 next
= now
+ muldiv64(next
, get_ticks_per_sec(), tb_env
->decr_freq
);
996 LOG_TB("%s: TCR " TARGET_FMT_lx
" TSR " TARGET_FMT_lx
"\n", __func__
,
997 env
->spr
[SPR_40x_TCR
], env
->spr
[SPR_40x_TSR
]);
998 switch ((env
->spr
[SPR_40x_TSR
] >> 30) & 0x3) {
1001 qemu_mod_timer(ppc40x_timer
->wdt_timer
, next
);
1002 ppc40x_timer
->wdt_next
= next
;
1003 env
->spr
[SPR_40x_TSR
] |= 1 << 31;
1006 qemu_mod_timer(ppc40x_timer
->wdt_timer
, next
);
1007 ppc40x_timer
->wdt_next
= next
;
1008 env
->spr
[SPR_40x_TSR
] |= 1 << 30;
1009 if ((env
->spr
[SPR_40x_TCR
] >> 27) & 0x1) {
1010 ppc_set_irq(cpu
, PPC_INTERRUPT_WDT
, 1);
1014 env
->spr
[SPR_40x_TSR
] &= ~0x30000000;
1015 env
->spr
[SPR_40x_TSR
] |= env
->spr
[SPR_40x_TCR
] & 0x30000000;
1016 switch ((env
->spr
[SPR_40x_TCR
] >> 28) & 0x3) {
1020 case 0x1: /* Core reset */
1021 ppc40x_core_reset(cpu
);
1023 case 0x2: /* Chip reset */
1024 ppc40x_chip_reset(cpu
);
1026 case 0x3: /* System reset */
1027 ppc40x_system_reset(cpu
);
1033 void store_40x_pit (CPUPPCState
*env
, target_ulong val
)
1036 ppc40x_timer_t
*ppc40x_timer
;
1038 tb_env
= env
->tb_env
;
1039 ppc40x_timer
= tb_env
->opaque
;
1040 LOG_TB("%s val" TARGET_FMT_lx
"\n", __func__
, val
);
1041 ppc40x_timer
->pit_reload
= val
;
1042 start_stop_pit(env
, tb_env
, 0);
1045 target_ulong
load_40x_pit (CPUPPCState
*env
)
1047 return cpu_ppc_load_decr(env
);
1050 static void ppc_40x_set_tb_clk (void *opaque
, uint32_t freq
)
1052 CPUPPCState
*env
= opaque
;
1053 ppc_tb_t
*tb_env
= env
->tb_env
;
1055 LOG_TB("%s set new frequency to %" PRIu32
"\n", __func__
,
1057 tb_env
->tb_freq
= freq
;
1058 tb_env
->decr_freq
= freq
;
1059 /* XXX: we should also update all timers */
1062 clk_setup_cb
ppc_40x_timers_init (CPUPPCState
*env
, uint32_t freq
,
1063 unsigned int decr_excp
)
1066 ppc40x_timer_t
*ppc40x_timer
;
1068 tb_env
= g_malloc0(sizeof(ppc_tb_t
));
1069 env
->tb_env
= tb_env
;
1070 tb_env
->flags
= PPC_DECR_UNDERFLOW_TRIGGERED
;
1071 ppc40x_timer
= g_malloc0(sizeof(ppc40x_timer_t
));
1072 tb_env
->tb_freq
= freq
;
1073 tb_env
->decr_freq
= freq
;
1074 tb_env
->opaque
= ppc40x_timer
;
1075 LOG_TB("%s freq %" PRIu32
"\n", __func__
, freq
);
1076 if (ppc40x_timer
!= NULL
) {
1077 /* We use decr timer for PIT */
1078 tb_env
->decr_timer
= qemu_new_timer_ns(vm_clock
, &cpu_4xx_pit_cb
, env
);
1079 ppc40x_timer
->fit_timer
=
1080 qemu_new_timer_ns(vm_clock
, &cpu_4xx_fit_cb
, env
);
1081 ppc40x_timer
->wdt_timer
=
1082 qemu_new_timer_ns(vm_clock
, &cpu_4xx_wdt_cb
, env
);
1083 ppc40x_timer
->decr_excp
= decr_excp
;
1086 return &ppc_40x_set_tb_clk
;
1089 /*****************************************************************************/
1090 /* Embedded PowerPC Device Control Registers */
1091 typedef struct ppc_dcrn_t ppc_dcrn_t
;
1093 dcr_read_cb dcr_read
;
1094 dcr_write_cb dcr_write
;
1098 /* XXX: on 460, DCR addresses are 32 bits wide,
1099 * using DCRIPR to get the 22 upper bits of the DCR address
1101 #define DCRN_NB 1024
1103 ppc_dcrn_t dcrn
[DCRN_NB
];
1104 int (*read_error
)(int dcrn
);
1105 int (*write_error
)(int dcrn
);
1108 int ppc_dcr_read (ppc_dcr_t
*dcr_env
, int dcrn
, uint32_t *valp
)
1112 if (dcrn
< 0 || dcrn
>= DCRN_NB
)
1114 dcr
= &dcr_env
->dcrn
[dcrn
];
1115 if (dcr
->dcr_read
== NULL
)
1117 *valp
= (*dcr
->dcr_read
)(dcr
->opaque
, dcrn
);
1122 if (dcr_env
->read_error
!= NULL
)
1123 return (*dcr_env
->read_error
)(dcrn
);
1128 int ppc_dcr_write (ppc_dcr_t
*dcr_env
, int dcrn
, uint32_t val
)
1132 if (dcrn
< 0 || dcrn
>= DCRN_NB
)
1134 dcr
= &dcr_env
->dcrn
[dcrn
];
1135 if (dcr
->dcr_write
== NULL
)
1137 (*dcr
->dcr_write
)(dcr
->opaque
, dcrn
, val
);
1142 if (dcr_env
->write_error
!= NULL
)
1143 return (*dcr_env
->write_error
)(dcrn
);
1148 int ppc_dcr_register (CPUPPCState
*env
, int dcrn
, void *opaque
,
1149 dcr_read_cb dcr_read
, dcr_write_cb dcr_write
)
1154 dcr_env
= env
->dcr_env
;
1155 if (dcr_env
== NULL
)
1157 if (dcrn
< 0 || dcrn
>= DCRN_NB
)
1159 dcr
= &dcr_env
->dcrn
[dcrn
];
1160 if (dcr
->opaque
!= NULL
||
1161 dcr
->dcr_read
!= NULL
||
1162 dcr
->dcr_write
!= NULL
)
1164 dcr
->opaque
= opaque
;
1165 dcr
->dcr_read
= dcr_read
;
1166 dcr
->dcr_write
= dcr_write
;
1171 int ppc_dcr_init (CPUPPCState
*env
, int (*read_error
)(int dcrn
),
1172 int (*write_error
)(int dcrn
))
1176 dcr_env
= g_malloc0(sizeof(ppc_dcr_t
));
1177 dcr_env
->read_error
= read_error
;
1178 dcr_env
->write_error
= write_error
;
1179 env
->dcr_env
= dcr_env
;
1184 /*****************************************************************************/
1186 void PPC_debug_write (void *opaque
, uint32_t addr
, uint32_t val
)
1198 printf("Set loglevel to %04" PRIx32
"\n", val
);
1199 qemu_set_log(val
| 0x100);
1204 /*****************************************************************************/
1206 static inline uint32_t nvram_read (nvram_t
*nvram
, uint32_t addr
)
1208 return (*nvram
->read_fn
)(nvram
->opaque
, addr
);
1211 static inline void nvram_write (nvram_t
*nvram
, uint32_t addr
, uint32_t val
)
1213 (*nvram
->write_fn
)(nvram
->opaque
, addr
, val
);
1216 static void NVRAM_set_byte(nvram_t
*nvram
, uint32_t addr
, uint8_t value
)
1218 nvram_write(nvram
, addr
, value
);
1221 static uint8_t NVRAM_get_byte(nvram_t
*nvram
, uint32_t addr
)
1223 return nvram_read(nvram
, addr
);
1226 static void NVRAM_set_word(nvram_t
*nvram
, uint32_t addr
, uint16_t value
)
1228 nvram_write(nvram
, addr
, value
>> 8);
1229 nvram_write(nvram
, addr
+ 1, value
& 0xFF);
1232 static uint16_t NVRAM_get_word(nvram_t
*nvram
, uint32_t addr
)
1236 tmp
= nvram_read(nvram
, addr
) << 8;
1237 tmp
|= nvram_read(nvram
, addr
+ 1);
1242 static void NVRAM_set_lword(nvram_t
*nvram
, uint32_t addr
, uint32_t value
)
1244 nvram_write(nvram
, addr
, value
>> 24);
1245 nvram_write(nvram
, addr
+ 1, (value
>> 16) & 0xFF);
1246 nvram_write(nvram
, addr
+ 2, (value
>> 8) & 0xFF);
1247 nvram_write(nvram
, addr
+ 3, value
& 0xFF);
1250 uint32_t NVRAM_get_lword (nvram_t
*nvram
, uint32_t addr
)
1254 tmp
= nvram_read(nvram
, addr
) << 24;
1255 tmp
|= nvram_read(nvram
, addr
+ 1) << 16;
1256 tmp
|= nvram_read(nvram
, addr
+ 2) << 8;
1257 tmp
|= nvram_read(nvram
, addr
+ 3);
1262 static void NVRAM_set_string(nvram_t
*nvram
, uint32_t addr
, const char *str
,
1267 for (i
= 0; i
< max
&& str
[i
] != '\0'; i
++) {
1268 nvram_write(nvram
, addr
+ i
, str
[i
]);
1270 nvram_write(nvram
, addr
+ i
, str
[i
]);
1271 nvram_write(nvram
, addr
+ max
- 1, '\0');
1274 int NVRAM_get_string (nvram_t
*nvram
, uint8_t *dst
, uint16_t addr
, int max
)
1278 memset(dst
, 0, max
);
1279 for (i
= 0; i
< max
; i
++) {
1280 dst
[i
] = NVRAM_get_byte(nvram
, addr
+ i
);
1288 static uint16_t NVRAM_crc_update (uint16_t prev
, uint16_t value
)
1291 uint16_t pd
, pd1
, pd2
;
1296 pd2
= ((pd
>> 4) & 0x000F) ^ pd1
;
1297 tmp
^= (pd1
<< 3) | (pd1
<< 8);
1298 tmp
^= pd2
| (pd2
<< 7) | (pd2
<< 12);
1303 static uint16_t NVRAM_compute_crc (nvram_t
*nvram
, uint32_t start
, uint32_t count
)
1306 uint16_t crc
= 0xFFFF;
1311 for (i
= 0; i
!= count
; i
++) {
1312 crc
= NVRAM_crc_update(crc
, NVRAM_get_word(nvram
, start
+ i
));
1315 crc
= NVRAM_crc_update(crc
, NVRAM_get_byte(nvram
, start
+ i
) << 8);
1321 #define CMDLINE_ADDR 0x017ff000
1323 int PPC_NVRAM_set_params (nvram_t
*nvram
, uint16_t NVRAM_size
,
1325 uint32_t RAM_size
, int boot_device
,
1326 uint32_t kernel_image
, uint32_t kernel_size
,
1327 const char *cmdline
,
1328 uint32_t initrd_image
, uint32_t initrd_size
,
1329 uint32_t NVRAM_image
,
1330 int width
, int height
, int depth
)
1334 /* Set parameters for Open Hack'Ware BIOS */
1335 NVRAM_set_string(nvram
, 0x00, "QEMU_BIOS", 16);
1336 NVRAM_set_lword(nvram
, 0x10, 0x00000002); /* structure v2 */
1337 NVRAM_set_word(nvram
, 0x14, NVRAM_size
);
1338 NVRAM_set_string(nvram
, 0x20, arch
, 16);
1339 NVRAM_set_lword(nvram
, 0x30, RAM_size
);
1340 NVRAM_set_byte(nvram
, 0x34, boot_device
);
1341 NVRAM_set_lword(nvram
, 0x38, kernel_image
);
1342 NVRAM_set_lword(nvram
, 0x3C, kernel_size
);
1344 /* XXX: put the cmdline in NVRAM too ? */
1345 pstrcpy_targphys("cmdline", CMDLINE_ADDR
, RAM_size
- CMDLINE_ADDR
, cmdline
);
1346 NVRAM_set_lword(nvram
, 0x40, CMDLINE_ADDR
);
1347 NVRAM_set_lword(nvram
, 0x44, strlen(cmdline
));
1349 NVRAM_set_lword(nvram
, 0x40, 0);
1350 NVRAM_set_lword(nvram
, 0x44, 0);
1352 NVRAM_set_lword(nvram
, 0x48, initrd_image
);
1353 NVRAM_set_lword(nvram
, 0x4C, initrd_size
);
1354 NVRAM_set_lword(nvram
, 0x50, NVRAM_image
);
1356 NVRAM_set_word(nvram
, 0x54, width
);
1357 NVRAM_set_word(nvram
, 0x56, height
);
1358 NVRAM_set_word(nvram
, 0x58, depth
);
1359 crc
= NVRAM_compute_crc(nvram
, 0x00, 0xF8);
1360 NVRAM_set_word(nvram
, 0xFC, crc
);