hw/ppc/ppc.c

   1 /*
   2  * QEMU generic PowerPC hardware System Emulator
   3  *
   4  * Copyright (c) 2003-2007 Jocelyn Mayer
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "qemu/osdep.h"
  25 #include "qemu-common.h"
  26 #include "cpu.h"
  27 #include "hw/hw.h"
  28 #include "hw/ppc/ppc.h"
  29 #include "hw/ppc/ppc_e500.h"
  30 #include "qemu/timer.h"
  31 #include "sysemu/sysemu.h"
  32 #include "sysemu/cpus.h"
  33 #include "hw/timer/m48t59.h"
  34 #include "qemu/log.h"
  35 #include "qemu/error-report.h"
  36 #include "qapi/error.h"
  37 #include "hw/loader.h"
  38 #include "sysemu/kvm.h"
  39 #include "kvm_ppc.h"
  40 #include "trace.h"
  41
  42 //#define PPC_DEBUG_IRQ
  43 //#define PPC_DEBUG_TB
  44
  45 #ifdef PPC_DEBUG_IRQ
  46 #  define LOG_IRQ(...) qemu_log_mask(CPU_LOG_INT, ## __VA_ARGS__)
  47 #else
  48 #  define LOG_IRQ(...) do { } while (0)
  49 #endif
  50
  51
  52 #ifdef PPC_DEBUG_TB
  53 #  define LOG_TB(...) qemu_log(__VA_ARGS__)
  54 #else
  55 #  define LOG_TB(...) do { } while (0)
  56 #endif
  57
  58 static void cpu_ppc_tb_stop (CPUPPCState *env);
  59 static void cpu_ppc_tb_start (CPUPPCState *env);
  60
  61 void ppc_set_irq(PowerPCCPU *cpu, int n_IRQ, int level)
  62 {
  63     CPUState *cs = CPU(cpu);
  64     CPUPPCState *env = &cpu->env;
  65     unsigned int old_pending = env->pending_interrupts;
  66
  67     if (level) {
  68         env->pending_interrupts |= 1 << n_IRQ;
  69         cpu_interrupt(cs, CPU_INTERRUPT_HARD);
  70     } else {
  71         env->pending_interrupts &= ~(1 << n_IRQ);
  72         if (env->pending_interrupts == 0) {
  73             cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
  74         }
  75     }
  76
  77     if (old_pending != env->pending_interrupts) {
  78 #ifdef CONFIG_KVM
  79         kvmppc_set_interrupt(cpu, n_IRQ, level);
  80 #endif
  81     }
  82
  83     LOG_IRQ("%s: %p n_IRQ %d level %d => pending %08" PRIx32
  84                 "req %08x\n", __func__, env, n_IRQ, level,
  85                 env->pending_interrupts, CPU(cpu)->interrupt_request);
  86 }
  87
  88 /* PowerPC 6xx / 7xx internal IRQ controller */
  89 static void ppc6xx_set_irq(void *opaque, int pin, int level)
  90 {
  91     PowerPCCPU *cpu = opaque;
  92     CPUPPCState *env = &cpu->env;
  93     int cur_level;
  94
  95     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
  96                 env, pin, level);
  97     cur_level = (env->irq_input_state >> pin) & 1;
  98     /* Don't generate spurious events */
  99     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
 100         CPUState *cs = CPU(cpu);
 101
 102         switch (pin) {
 103         case PPC6xx_INPUT_TBEN:
 104             /* Level sensitive - active high */
 105             LOG_IRQ("%s: %s the time base\n",
 106                         __func__, level ? "start" : "stop");
 107             if (level) {
 108                 cpu_ppc_tb_start(env);
 109             } else {
 110                 cpu_ppc_tb_stop(env);
 111             }
 112         case PPC6xx_INPUT_INT:
 113             /* Level sensitive - active high */
 114             LOG_IRQ("%s: set the external IRQ state to %d\n",
 115                         __func__, level);
 116             ppc_set_irq(cpu, PPC_INTERRUPT_EXT, level);
 117             break;
 118         case PPC6xx_INPUT_SMI:
 119             /* Level sensitive - active high */
 120             LOG_IRQ("%s: set the SMI IRQ state to %d\n",
 121                         __func__, level);
 122             ppc_set_irq(cpu, PPC_INTERRUPT_SMI, level);
 123             break;
 124         case PPC6xx_INPUT_MCP:
 125             /* Negative edge sensitive */
 126             /* XXX: TODO: actual reaction may depends on HID0 status
 127              *            603/604/740/750: check HID0[EMCP]
 128              */
 129             if (cur_level == 1 && level == 0) {
 130                 LOG_IRQ("%s: raise machine check state\n",
 131                             __func__);
 132                 ppc_set_irq(cpu, PPC_INTERRUPT_MCK, 1);
 133             }
 134             break;
 135         case PPC6xx_INPUT_CKSTP_IN:
 136             /* Level sensitive - active low */
 137             /* XXX: TODO: relay the signal to CKSTP_OUT pin */
 138             /* XXX: Note that the only way to restart the CPU is to reset it */
 139             if (level) {
 140                 LOG_IRQ("%s: stop the CPU\n", __func__);
 141                 cs->halted = 1;
 142             }
 143             break;
 144         case PPC6xx_INPUT_HRESET:
 145             /* Level sensitive - active low */
 146             if (level) {
 147                 LOG_IRQ("%s: reset the CPU\n", __func__);
 148                 cpu_interrupt(cs, CPU_INTERRUPT_RESET);
 149             }
 150             break;
 151         case PPC6xx_INPUT_SRESET:
 152             LOG_IRQ("%s: set the RESET IRQ state to %d\n",
 153                         __func__, level);
 154             ppc_set_irq(cpu, PPC_INTERRUPT_RESET, level);
 155             break;
 156         default:
 157             /* Unknown pin - do nothing */
 158             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 159             return;
 160         }
 161         if (level)
 162             env->irq_input_state |= 1 << pin;
 163         else
 164             env->irq_input_state &= ~(1 << pin);
 165     }
 166 }
 167
 168 void ppc6xx_irq_init(PowerPCCPU *cpu)
 169 {
 170     CPUPPCState *env = &cpu->env;
 171
 172     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc6xx_set_irq, cpu,
 173                                                   PPC6xx_INPUT_NB);
 174 }
 175
 176 #if defined(TARGET_PPC64)
 177 /* PowerPC 970 internal IRQ controller */
 178 static void ppc970_set_irq(void *opaque, int pin, int level)
 179 {
 180     PowerPCCPU *cpu = opaque;
 181     CPUPPCState *env = &cpu->env;
 182     int cur_level;
 183
 184     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
 185                 env, pin, level);
 186     cur_level = (env->irq_input_state >> pin) & 1;
 187     /* Don't generate spurious events */
 188     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
 189         CPUState *cs = CPU(cpu);
 190
 191         switch (pin) {
 192         case PPC970_INPUT_INT:
 193             /* Level sensitive - active high */
 194             LOG_IRQ("%s: set the external IRQ state to %d\n",
 195                         __func__, level);
 196             ppc_set_irq(cpu, PPC_INTERRUPT_EXT, level);
 197             break;
 198         case PPC970_INPUT_THINT:
 199             /* Level sensitive - active high */
 200             LOG_IRQ("%s: set the SMI IRQ state to %d\n", __func__,
 201                         level);
 202             ppc_set_irq(cpu, PPC_INTERRUPT_THERM, level);
 203             break;
 204         case PPC970_INPUT_MCP:
 205             /* Negative edge sensitive */
 206             /* XXX: TODO: actual reaction may depends on HID0 status
 207              *            603/604/740/750: check HID0[EMCP]
 208              */
 209             if (cur_level == 1 && level == 0) {
 210                 LOG_IRQ("%s: raise machine check state\n",
 211                             __func__);
 212                 ppc_set_irq(cpu, PPC_INTERRUPT_MCK, 1);
 213             }
 214             break;
 215         case PPC970_INPUT_CKSTP:
 216             /* Level sensitive - active low */
 217             /* XXX: TODO: relay the signal to CKSTP_OUT pin */
 218             if (level) {
 219                 LOG_IRQ("%s: stop the CPU\n", __func__);
 220                 cs->halted = 1;
 221             } else {
 222                 LOG_IRQ("%s: restart the CPU\n", __func__);
 223                 cs->halted = 0;
 224                 qemu_cpu_kick(cs);
 225             }
 226             break;
 227         case PPC970_INPUT_HRESET:
 228             /* Level sensitive - active low */
 229             if (level) {
 230                 cpu_interrupt(cs, CPU_INTERRUPT_RESET);
 231             }
 232             break;
 233         case PPC970_INPUT_SRESET:
 234             LOG_IRQ("%s: set the RESET IRQ state to %d\n",
 235                         __func__, level);
 236             ppc_set_irq(cpu, PPC_INTERRUPT_RESET, level);
 237             break;
 238         case PPC970_INPUT_TBEN:
 239             LOG_IRQ("%s: set the TBEN state to %d\n", __func__,
 240                         level);
 241             /* XXX: TODO */
 242             break;
 243         default:
 244             /* Unknown pin - do nothing */
 245             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 246             return;
 247         }
 248         if (level)
 249             env->irq_input_state |= 1 << pin;
 250         else
 251             env->irq_input_state &= ~(1 << pin);
 252     }
 253 }
 254
 255 void ppc970_irq_init(PowerPCCPU *cpu)
 256 {
 257     CPUPPCState *env = &cpu->env;
 258
 259     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc970_set_irq, cpu,
 260                                                   PPC970_INPUT_NB);
 261 }
 262
 263 /* POWER7 internal IRQ controller */
 264 static void power7_set_irq(void *opaque, int pin, int level)
 265 {
 266     PowerPCCPU *cpu = opaque;
 267     CPUPPCState *env = &cpu->env;
 268
 269     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
 270                 env, pin, level);
 271
 272     switch (pin) {
 273     case POWER7_INPUT_INT:
 274         /* Level sensitive - active high */
 275         LOG_IRQ("%s: set the external IRQ state to %d\n",
 276                 __func__, level);
 277         ppc_set_irq(cpu, PPC_INTERRUPT_EXT, level);
 278         break;
 279     default:
 280         /* Unknown pin - do nothing */
 281         LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 282         return;
 283     }
 284     if (level) {
 285         env->irq_input_state |= 1 << pin;
 286     } else {
 287         env->irq_input_state &= ~(1 << pin);
 288     }
 289 }
 290
 291 void ppcPOWER7_irq_init(PowerPCCPU *cpu)
 292 {
 293     CPUPPCState *env = &cpu->env;
 294
 295     env->irq_inputs = (void **)qemu_allocate_irqs(&power7_set_irq, cpu,
 296                                                   POWER7_INPUT_NB);
 297 }
 298 #endif /* defined(TARGET_PPC64) */
 299
 300 /* PowerPC 40x internal IRQ controller */
 301 static void ppc40x_set_irq(void *opaque, int pin, int level)
 302 {
 303     PowerPCCPU *cpu = opaque;
 304     CPUPPCState *env = &cpu->env;
 305     int cur_level;
 306
 307     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
 308                 env, pin, level);
 309     cur_level = (env->irq_input_state >> pin) & 1;
 310     /* Don't generate spurious events */
 311     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
 312         CPUState *cs = CPU(cpu);
 313
 314         switch (pin) {
 315         case PPC40x_INPUT_RESET_SYS:
 316             if (level) {
 317                 LOG_IRQ("%s: reset the PowerPC system\n",
 318                             __func__);
 319                 ppc40x_system_reset(cpu);
 320             }
 321             break;
 322         case PPC40x_INPUT_RESET_CHIP:
 323             if (level) {
 324                 LOG_IRQ("%s: reset the PowerPC chip\n", __func__);
 325                 ppc40x_chip_reset(cpu);
 326             }
 327             break;
 328         case PPC40x_INPUT_RESET_CORE:
 329             /* XXX: TODO: update DBSR[MRR] */
 330             if (level) {
 331                 LOG_IRQ("%s: reset the PowerPC core\n", __func__);
 332                 ppc40x_core_reset(cpu);
 333             }
 334             break;
 335         case PPC40x_INPUT_CINT:
 336             /* Level sensitive - active high */
 337             LOG_IRQ("%s: set the critical IRQ state to %d\n",
 338                         __func__, level);
 339             ppc_set_irq(cpu, PPC_INTERRUPT_CEXT, level);
 340             break;
 341         case PPC40x_INPUT_INT:
 342             /* Level sensitive - active high */
 343             LOG_IRQ("%s: set the external IRQ state to %d\n",
 344                         __func__, level);
 345             ppc_set_irq(cpu, PPC_INTERRUPT_EXT, level);
 346             break;
 347         case PPC40x_INPUT_HALT:
 348             /* Level sensitive - active low */
 349             if (level) {
 350                 LOG_IRQ("%s: stop the CPU\n", __func__);
 351                 cs->halted = 1;
 352             } else {
 353                 LOG_IRQ("%s: restart the CPU\n", __func__);
 354                 cs->halted = 0;
 355                 qemu_cpu_kick(cs);
 356             }
 357             break;
 358         case PPC40x_INPUT_DEBUG:
 359             /* Level sensitive - active high */
 360             LOG_IRQ("%s: set the debug pin state to %d\n",
 361                         __func__, level);
 362             ppc_set_irq(cpu, PPC_INTERRUPT_DEBUG, level);
 363             break;
 364         default:
 365             /* Unknown pin - do nothing */
 366             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 367             return;
 368         }
 369         if (level)
 370             env->irq_input_state |= 1 << pin;
 371         else
 372             env->irq_input_state &= ~(1 << pin);
 373     }
 374 }
 375
 376 void ppc40x_irq_init(PowerPCCPU *cpu)
 377 {
 378     CPUPPCState *env = &cpu->env;
 379
 380     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc40x_set_irq,
 381                                                   cpu, PPC40x_INPUT_NB);
 382 }
 383
 384 /* PowerPC E500 internal IRQ controller */
 385 static void ppce500_set_irq(void *opaque, int pin, int level)
 386 {
 387     PowerPCCPU *cpu = opaque;
 388     CPUPPCState *env = &cpu->env;
 389     int cur_level;
 390
 391     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
 392                 env, pin, level);
 393     cur_level = (env->irq_input_state >> pin) & 1;
 394     /* Don't generate spurious events */
 395     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
 396         switch (pin) {
 397         case PPCE500_INPUT_MCK:
 398             if (level) {
 399                 LOG_IRQ("%s: reset the PowerPC system\n",
 400                             __func__);
 401                 qemu_system_reset_request();
 402             }
 403             break;
 404         case PPCE500_INPUT_RESET_CORE:
 405             if (level) {
 406                 LOG_IRQ("%s: reset the PowerPC core\n", __func__);
 407                 ppc_set_irq(cpu, PPC_INTERRUPT_MCK, level);
 408             }
 409             break;
 410         case PPCE500_INPUT_CINT:
 411             /* Level sensitive - active high */
 412             LOG_IRQ("%s: set the critical IRQ state to %d\n",
 413                         __func__, level);
 414             ppc_set_irq(cpu, PPC_INTERRUPT_CEXT, level);
 415             break;
 416         case PPCE500_INPUT_INT:
 417             /* Level sensitive - active high */
 418             LOG_IRQ("%s: set the core IRQ state to %d\n",
 419                         __func__, level);
 420             ppc_set_irq(cpu, PPC_INTERRUPT_EXT, level);
 421             break;
 422         case PPCE500_INPUT_DEBUG:
 423             /* Level sensitive - active high */
 424             LOG_IRQ("%s: set the debug pin state to %d\n",
 425                         __func__, level);
 426             ppc_set_irq(cpu, PPC_INTERRUPT_DEBUG, level);
 427             break;
 428         default:
 429             /* Unknown pin - do nothing */
 430             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 431             return;
 432         }
 433         if (level)
 434             env->irq_input_state |= 1 << pin;
 435         else
 436             env->irq_input_state &= ~(1 << pin);
 437     }
 438 }
 439
 440 void ppce500_irq_init(PowerPCCPU *cpu)
 441 {
 442     CPUPPCState *env = &cpu->env;
 443
 444     env->irq_inputs = (void **)qemu_allocate_irqs(&ppce500_set_irq,
 445                                                   cpu, PPCE500_INPUT_NB);
 446 }
 447
 448 /* Enable or Disable the E500 EPR capability */
 449 void ppce500_set_mpic_proxy(bool enabled)
 450 {
 451     CPUState *cs;
 452
 453     CPU_FOREACH(cs) {
 454         PowerPCCPU *cpu = POWERPC_CPU(cs);
 455
 456         cpu->env.mpic_proxy = enabled;
 457         if (kvm_enabled()) {
 458             kvmppc_set_mpic_proxy(cpu, enabled);
 459         }
 460     }
 461 }
 462
 463 /*****************************************************************************/
 464 /* PowerPC time base and decrementer emulation */
 465
 466 uint64_t cpu_ppc_get_tb(ppc_tb_t *tb_env, uint64_t vmclk, int64_t tb_offset)
 467 {
 468     /* TB time in tb periods */
 469     return muldiv64(vmclk, tb_env->tb_freq, NANOSECONDS_PER_SECOND) + tb_offset;
 470 }
 471
 472 uint64_t cpu_ppc_load_tbl (CPUPPCState *env)
 473 {
 474     ppc_tb_t *tb_env = env->tb_env;
 475     uint64_t tb;
 476
 477     if (kvm_enabled()) {
 478         return env->spr[SPR_TBL];
 479     }
 480
 481     tb = cpu_ppc_get_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), tb_env->tb_offset);
 482     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 483
 484     return tb;
 485 }
 486
 487 static inline uint32_t _cpu_ppc_load_tbu(CPUPPCState *env)
 488 {
 489     ppc_tb_t *tb_env = env->tb_env;
 490     uint64_t tb;
 491
 492     tb = cpu_ppc_get_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), tb_env->tb_offset);
 493     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 494
 495     return tb >> 32;
 496 }
 497
 498 uint32_t cpu_ppc_load_tbu (CPUPPCState *env)
 499 {
 500     if (kvm_enabled()) {
 501         return env->spr[SPR_TBU];
 502     }
 503
 504     return _cpu_ppc_load_tbu(env);
 505 }
 506
 507 static inline void cpu_ppc_store_tb(ppc_tb_t *tb_env, uint64_t vmclk,
 508                                     int64_t *tb_offsetp, uint64_t value)
 509 {
 510     *tb_offsetp = value -
 511         muldiv64(vmclk, tb_env->tb_freq, NANOSECONDS_PER_SECOND);
 512
 513     LOG_TB("%s: tb %016" PRIx64 " offset %08" PRIx64 "\n",
 514                 __func__, value, *tb_offsetp);
 515 }
 516
 517 void cpu_ppc_store_tbl (CPUPPCState *env, uint32_t value)
 518 {
 519     ppc_tb_t *tb_env = env->tb_env;
 520     uint64_t tb;
 521
 522     tb = cpu_ppc_get_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), tb_env->tb_offset);
 523     tb &= 0xFFFFFFFF00000000ULL;
 524     cpu_ppc_store_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
 525                      &tb_env->tb_offset, tb | (uint64_t)value);
 526 }
 527
 528 static inline void _cpu_ppc_store_tbu(CPUPPCState *env, uint32_t value)
 529 {
 530     ppc_tb_t *tb_env = env->tb_env;
 531     uint64_t tb;
 532
 533     tb = cpu_ppc_get_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), tb_env->tb_offset);
 534     tb &= 0x00000000FFFFFFFFULL;
 535     cpu_ppc_store_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
 536                      &tb_env->tb_offset, ((uint64_t)value << 32) | tb);
 537 }
 538
 539 void cpu_ppc_store_tbu (CPUPPCState *env, uint32_t value)
 540 {
 541     _cpu_ppc_store_tbu(env, value);
 542 }
 543
 544 uint64_t cpu_ppc_load_atbl (CPUPPCState *env)
 545 {
 546     ppc_tb_t *tb_env = env->tb_env;
 547     uint64_t tb;
 548
 549     tb = cpu_ppc_get_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), tb_env->atb_offset);
 550     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 551
 552     return tb;
 553 }
 554
 555 uint32_t cpu_ppc_load_atbu (CPUPPCState *env)
 556 {
 557     ppc_tb_t *tb_env = env->tb_env;
 558     uint64_t tb;
 559
 560     tb = cpu_ppc_get_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), tb_env->atb_offset);
 561     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 562
 563     return tb >> 32;
 564 }
 565
 566 void cpu_ppc_store_atbl (CPUPPCState *env, uint32_t value)
 567 {
 568     ppc_tb_t *tb_env = env->tb_env;
 569     uint64_t tb;
 570
 571     tb = cpu_ppc_get_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), tb_env->atb_offset);
 572     tb &= 0xFFFFFFFF00000000ULL;
 573     cpu_ppc_store_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
 574                      &tb_env->atb_offset, tb | (uint64_t)value);
 575 }
 576
 577 void cpu_ppc_store_atbu (CPUPPCState *env, uint32_t value)
 578 {
 579     ppc_tb_t *tb_env = env->tb_env;
 580     uint64_t tb;
 581
 582     tb = cpu_ppc_get_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), tb_env->atb_offset);
 583     tb &= 0x00000000FFFFFFFFULL;
 584     cpu_ppc_store_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
 585                      &tb_env->atb_offset, ((uint64_t)value << 32) | tb);
 586 }
 587
 588 static void cpu_ppc_tb_stop (CPUPPCState *env)
 589 {
 590     ppc_tb_t *tb_env = env->tb_env;
 591     uint64_t tb, atb, vmclk;
 592
 593     /* If the time base is already frozen, do nothing */
 594     if (tb_env->tb_freq != 0) {
 595         vmclk = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 596         /* Get the time base */
 597         tb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->tb_offset);
 598         /* Get the alternate time base */
 599         atb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->atb_offset);
 600         /* Store the time base value (ie compute the current offset) */
 601         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
 602         /* Store the alternate time base value (compute the current offset) */
 603         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
 604         /* Set the time base frequency to zero */
 605         tb_env->tb_freq = 0;
 606         /* Now, the time bases are frozen to tb_offset / atb_offset value */
 607     }
 608 }
 609
 610 static void cpu_ppc_tb_start (CPUPPCState *env)
 611 {
 612     ppc_tb_t *tb_env = env->tb_env;
 613     uint64_t tb, atb, vmclk;
 614
 615     /* If the time base is not frozen, do nothing */
 616     if (tb_env->tb_freq == 0) {
 617         vmclk = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 618         /* Get the time base from tb_offset */
 619         tb = tb_env->tb_offset;
 620         /* Get the alternate time base from atb_offset */
 621         atb = tb_env->atb_offset;
 622         /* Restore the tb frequency from the decrementer frequency */
 623         tb_env->tb_freq = tb_env->decr_freq;
 624         /* Store the time base value */
 625         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
 626         /* Store the alternate time base value */
 627         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
 628     }
 629 }
 630
 631 bool ppc_decr_clear_on_delivery(CPUPPCState *env)
 632 {
 633     ppc_tb_t *tb_env = env->tb_env;
 634     int flags = PPC_DECR_UNDERFLOW_TRIGGERED | PPC_DECR_UNDERFLOW_LEVEL;
 635     return ((tb_env->flags & flags) == PPC_DECR_UNDERFLOW_TRIGGERED);
 636 }
 637
 638 static inline uint32_t _cpu_ppc_load_decr(CPUPPCState *env, uint64_t next)
 639 {
 640     ppc_tb_t *tb_env = env->tb_env;
 641     uint32_t decr;
 642     int64_t diff;
 643
 644     diff = next - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 645     if (diff >= 0) {
 646         decr = muldiv64(diff, tb_env->decr_freq, NANOSECONDS_PER_SECOND);
 647     } else if (tb_env->flags & PPC_TIMER_BOOKE) {
 648         decr = 0;
 649     }  else {
 650         decr = -muldiv64(-diff, tb_env->decr_freq, NANOSECONDS_PER_SECOND);
 651     }
 652     LOG_TB("%s: %08" PRIx32 "\n", __func__, decr);
 653
 654     return decr;
 655 }
 656
 657 uint32_t cpu_ppc_load_decr (CPUPPCState *env)
 658 {
 659     ppc_tb_t *tb_env = env->tb_env;
 660
 661     if (kvm_enabled()) {
 662         return env->spr[SPR_DECR];
 663     }
 664
 665     return _cpu_ppc_load_decr(env, tb_env->decr_next);
 666 }
 667
 668 uint32_t cpu_ppc_load_hdecr (CPUPPCState *env)
 669 {
 670     ppc_tb_t *tb_env = env->tb_env;
 671
 672     return _cpu_ppc_load_decr(env, tb_env->hdecr_next);
 673 }
 674
 675 uint64_t cpu_ppc_load_purr (CPUPPCState *env)
 676 {
 677     ppc_tb_t *tb_env = env->tb_env;
 678     uint64_t diff;
 679
 680     diff = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) - tb_env->purr_start;
 681
 682     return tb_env->purr_load +
 683         muldiv64(diff, tb_env->tb_freq, NANOSECONDS_PER_SECOND);
 684 }
 685
 686 /* When decrementer expires,
 687  * all we need to do is generate or queue a CPU exception
 688  */
 689 static inline void cpu_ppc_decr_excp(PowerPCCPU *cpu)
 690 {
 691     /* Raise it */
 692     LOG_TB("raise decrementer exception\n");
 693     ppc_set_irq(cpu, PPC_INTERRUPT_DECR, 1);
 694 }
 695
 696 static inline void cpu_ppc_decr_lower(PowerPCCPU *cpu)
 697 {
 698     ppc_set_irq(cpu, PPC_INTERRUPT_DECR, 0);
 699 }
 700
 701 static inline void cpu_ppc_hdecr_excp(PowerPCCPU *cpu)
 702 {
 703     CPUPPCState *env = &cpu->env;
 704
 705     /* Raise it */
 706     LOG_TB("raise hv decrementer exception\n");
 707
 708     /* The architecture specifies that we don't deliver HDEC
 709      * interrupts in a PM state. Not only they don't cause a
 710      * wakeup but they also get effectively discarded.
 711      */
 712     if (!env->in_pm_state) {
 713         ppc_set_irq(cpu, PPC_INTERRUPT_HDECR, 1);
 714     }
 715 }
 716
 717 static inline void cpu_ppc_hdecr_lower(PowerPCCPU *cpu)
 718 {
 719     ppc_set_irq(cpu, PPC_INTERRUPT_HDECR, 0);
 720 }
 721
 722 static void __cpu_ppc_store_decr(PowerPCCPU *cpu, uint64_t *nextp,
 723                                  QEMUTimer *timer,
 724                                  void (*raise_excp)(void *),
 725                                  void (*lower_excp)(PowerPCCPU *),
 726                                  uint32_t decr, uint32_t value)
 727 {
 728     CPUPPCState *env = &cpu->env;
 729     ppc_tb_t *tb_env = env->tb_env;
 730     uint64_t now, next;
 731
 732     LOG_TB("%s: %08" PRIx32 " => %08" PRIx32 "\n", __func__,
 733                 decr, value);
 734
 735     if (kvm_enabled()) {
 736         /* KVM handles decrementer exceptions, we don't need our own timer */
 737         return;
 738     }
 739
 740     /*
 741      * Going from 2 -> 1, 1 -> 0 or 0 -> -1 is the event to generate a DEC
 742      * interrupt.
 743      *
 744      * If we get a really small DEC value, we can assume that by the time we
 745      * handled it we should inject an interrupt already.
 746      *
 747      * On MSB level based DEC implementations the MSB always means the interrupt
 748      * is pending, so raise it on those.
 749      *
 750      * On MSB edge based DEC implementations the MSB going from 0 -> 1 triggers
 751      * an edge interrupt, so raise it here too.
 752      */
 753     if ((value < 3) ||
 754         ((tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL) && (value & 0x80000000)) ||
 755         ((tb_env->flags & PPC_DECR_UNDERFLOW_TRIGGERED) && (value & 0x80000000)
 756           && !(decr & 0x80000000))) {
 757         (*raise_excp)(cpu);
 758         return;
 759     }
 760
 761     /* On MSB level based systems a 0 for the MSB stops interrupt delivery */
 762     if (!(value & 0x80000000) && (tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL)) {
 763         (*lower_excp)(cpu);
 764     }
 765
 766     /* Calculate the next timer event */
 767     now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 768     next = now + muldiv64(value, NANOSECONDS_PER_SECOND, tb_env->decr_freq);
 769     *nextp = next;
 770
 771     /* Adjust timer */
 772     timer_mod(timer, next);
 773 }
 774
 775 static inline void _cpu_ppc_store_decr(PowerPCCPU *cpu, uint32_t decr,
 776                                        uint32_t value)
 777 {
 778     ppc_tb_t *tb_env = cpu->env.tb_env;
 779
 780     __cpu_ppc_store_decr(cpu, &tb_env->decr_next, tb_env->decr_timer,
 781                          tb_env->decr_timer->cb, &cpu_ppc_decr_lower, decr,
 782                          value);
 783 }
 784
 785 void cpu_ppc_store_decr (CPUPPCState *env, uint32_t value)
 786 {
 787     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 788
 789     _cpu_ppc_store_decr(cpu, cpu_ppc_load_decr(env), value);
 790 }
 791
 792 static void cpu_ppc_decr_cb(void *opaque)
 793 {
 794     PowerPCCPU *cpu = opaque;
 795
 796     cpu_ppc_decr_excp(cpu);
 797 }
 798
 799 static inline void _cpu_ppc_store_hdecr(PowerPCCPU *cpu, uint32_t hdecr,
 800                                         uint32_t value)
 801 {
 802     ppc_tb_t *tb_env = cpu->env.tb_env;
 803
 804     if (tb_env->hdecr_timer != NULL) {
 805         __cpu_ppc_store_decr(cpu, &tb_env->hdecr_next, tb_env->hdecr_timer,
 806                              tb_env->hdecr_timer->cb, &cpu_ppc_hdecr_lower,
 807                              hdecr, value);
 808     }
 809 }
 810
 811 void cpu_ppc_store_hdecr (CPUPPCState *env, uint32_t value)
 812 {
 813     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 814
 815     _cpu_ppc_store_hdecr(cpu, cpu_ppc_load_hdecr(env), value);
 816 }
 817
 818 static void cpu_ppc_hdecr_cb(void *opaque)
 819 {
 820     PowerPCCPU *cpu = opaque;
 821
 822     cpu_ppc_hdecr_excp(cpu);
 823 }
 824
 825 static void cpu_ppc_store_purr(PowerPCCPU *cpu, uint64_t value)
 826 {
 827     ppc_tb_t *tb_env = cpu->env.tb_env;
 828
 829     tb_env->purr_load = value;
 830     tb_env->purr_start = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 831 }
 832
 833 static void cpu_ppc_set_tb_clk (void *opaque, uint32_t freq)
 834 {
 835     CPUPPCState *env = opaque;
 836     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 837     ppc_tb_t *tb_env = env->tb_env;
 838
 839     tb_env->tb_freq = freq;
 840     tb_env->decr_freq = freq;
 841     /* There is a bug in Linux 2.4 kernels:
 842      * if a decrementer exception is pending when it enables msr_ee at startup,
 843      * it's not ready to handle it...
 844      */
 845     _cpu_ppc_store_decr(cpu, 0xFFFFFFFF, 0xFFFFFFFF);
 846     _cpu_ppc_store_hdecr(cpu, 0xFFFFFFFF, 0xFFFFFFFF);
 847     cpu_ppc_store_purr(cpu, 0x0000000000000000ULL);
 848 }
 849
 850 static void timebase_save(PPCTimebase *tb)
 851 {
 852     uint64_t ticks = cpu_get_host_ticks();
 853     PowerPCCPU *first_ppc_cpu = POWERPC_CPU(first_cpu);
 854
 855     if (!first_ppc_cpu->env.tb_env) {
 856         error_report("No timebase object");
 857         return;
 858     }
 859
 860     /* not used anymore, we keep it for compatibility */
 861     tb->time_of_the_day_ns = qemu_clock_get_ns(QEMU_CLOCK_HOST);
 862     /*
 863      * tb_offset is only expected to be changed by QEMU so
 864      * there is no need to update it from KVM here
 865      */
 866     tb->guest_timebase = ticks + first_ppc_cpu->env.tb_env->tb_offset;
 867 }
 868
 869 static void timebase_load(PPCTimebase *tb)
 870 {
 871     CPUState *cpu;
 872     PowerPCCPU *first_ppc_cpu = POWERPC_CPU(first_cpu);
 873     int64_t tb_off_adj, tb_off;
 874     unsigned long freq;
 875
 876     if (!first_ppc_cpu->env.tb_env) {
 877         error_report("No timebase object");
 878         return;
 879     }
 880
 881     freq = first_ppc_cpu->env.tb_env->tb_freq;
 882
 883     tb_off_adj = tb->guest_timebase - cpu_get_host_ticks();
 884
 885     tb_off = first_ppc_cpu->env.tb_env->tb_offset;
 886     trace_ppc_tb_adjust(tb_off, tb_off_adj, tb_off_adj - tb_off,
 887                         (tb_off_adj - tb_off) / freq);
 888
 889     /* Set new offset to all CPUs */
 890     CPU_FOREACH(cpu) {
 891         PowerPCCPU *pcpu = POWERPC_CPU(cpu);
 892         pcpu->env.tb_env->tb_offset = tb_off_adj;
 893 #if defined(CONFIG_KVM)
 894         kvm_set_one_reg(cpu, KVM_REG_PPC_TB_OFFSET,
 895                         &pcpu->env.tb_env->tb_offset);
 896 #endif
 897     }
 898 }
 899
 900 void cpu_ppc_clock_vm_state_change(void *opaque, int running,
 901                                    RunState state)
 902 {
 903     PPCTimebase *tb = opaque;
 904
 905     if (running) {
 906         timebase_load(tb);
 907     } else {
 908         timebase_save(tb);
 909     }
 910 }
 911
 912 /*
 913  * When migrating, read the clock just before migration,
 914  * so that the guest clock counts during the events
 915  * between:
 916  *
 917  *  * vm_stop()
 918  *  *
 919  *  * pre_save()
 920  *
 921  *  This reduces clock difference on migration from 5s
 922  *  to 0.1s (when max_downtime == 5s), because sending the
 923  *  final pages of memory (which happens between vm_stop()
 924  *  and pre_save()) takes max_downtime.
 925  */
 926 static void timebase_pre_save(void *opaque)
 927 {
 928     PPCTimebase *tb = opaque;
 929
 930     timebase_save(tb);
 931 }
 932
 933 const VMStateDescription vmstate_ppc_timebase = {
 934     .name = "timebase",
 935     .version_id = 1,
 936     .minimum_version_id = 1,
 937     .minimum_version_id_old = 1,
 938     .pre_save = timebase_pre_save,
 939     .fields      = (VMStateField []) {
 940         VMSTATE_UINT64(guest_timebase, PPCTimebase),
 941         VMSTATE_INT64(time_of_the_day_ns, PPCTimebase),
 942         VMSTATE_END_OF_LIST()
 943     },
 944 };
 945
 946 /* Set up (once) timebase frequency (in Hz) */
 947 clk_setup_cb cpu_ppc_tb_init (CPUPPCState *env, uint32_t freq)
 948 {
 949     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 950     ppc_tb_t *tb_env;
 951
 952     tb_env = g_malloc0(sizeof(ppc_tb_t));
 953     env->tb_env = tb_env;
 954     tb_env->flags = PPC_DECR_UNDERFLOW_TRIGGERED;
 955     if (env->insns_flags & PPC_SEGMENT_64B) {
 956         /* All Book3S 64bit CPUs implement level based DEC logic */
 957         tb_env->flags |= PPC_DECR_UNDERFLOW_LEVEL;
 958     }
 959     /* Create new timer */
 960     tb_env->decr_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, &cpu_ppc_decr_cb, cpu);
 961     if (env->has_hv_mode) {
 962         tb_env->hdecr_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, &cpu_ppc_hdecr_cb,
 963                                                 cpu);
 964     } else {
 965         tb_env->hdecr_timer = NULL;
 966     }
 967     cpu_ppc_set_tb_clk(env, freq);
 968
 969     return &cpu_ppc_set_tb_clk;
 970 }
 971
 972 /* Specific helpers for POWER & PowerPC 601 RTC */
 973 void cpu_ppc601_store_rtcu (CPUPPCState *env, uint32_t value)
 974 {
 975     _cpu_ppc_store_tbu(env, value);
 976 }
 977
 978 uint32_t cpu_ppc601_load_rtcu (CPUPPCState *env)
 979 {
 980     return _cpu_ppc_load_tbu(env);
 981 }
 982
 983 void cpu_ppc601_store_rtcl (CPUPPCState *env, uint32_t value)
 984 {
 985     cpu_ppc_store_tbl(env, value & 0x3FFFFF80);
 986 }
 987
 988 uint32_t cpu_ppc601_load_rtcl (CPUPPCState *env)
 989 {
 990     return cpu_ppc_load_tbl(env) & 0x3FFFFF80;
 991 }
 992
 993 /*****************************************************************************/
 994 /* PowerPC 40x timers */
 995
 996 /* PIT, FIT & WDT */
 997 typedef struct ppc40x_timer_t ppc40x_timer_t;
 998 struct ppc40x_timer_t {
 999     uint64_t pit_reload;  /* PIT auto-reload value        */
1000     uint64_t fit_next;    /* Tick for next FIT interrupt  */
1001     QEMUTimer *fit_timer;
1002     uint64_t wdt_next;    /* Tick for next WDT interrupt  */
1003     QEMUTimer *wdt_timer;
1004
1005     /* 405 have the PIT, 440 have a DECR.  */
1006     unsigned int decr_excp;
1007 };
1008
1009 /* Fixed interval timer */
1010 static void cpu_4xx_fit_cb (void *opaque)
1011 {
1012     PowerPCCPU *cpu;
1013     CPUPPCState *env;
1014     ppc_tb_t *tb_env;
1015     ppc40x_timer_t *ppc40x_timer;
1016     uint64_t now, next;
1017
1018     env = opaque;
1019     cpu = ppc_env_get_cpu(env);
1020     tb_env = env->tb_env;
1021     ppc40x_timer = tb_env->opaque;
1022     now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
1023     switch ((env->spr[SPR_40x_TCR] >> 24) & 0x3) {
1024     case 0:
1025         next = 1 << 9;
1026         break;
1027     case 1:
1028         next = 1 << 13;
1029         break;
1030     case 2:
1031         next = 1 << 17;
1032         break;
1033     case 3:
1034         next = 1 << 21;
1035         break;
1036     default:
1037         /* Cannot occur, but makes gcc happy */
1038         return;
1039     }
1040     next = now + muldiv64(next, NANOSECONDS_PER_SECOND, tb_env->tb_freq);
1041     if (next == now)
1042         next++;
1043     timer_mod(ppc40x_timer->fit_timer, next);
1044     env->spr[SPR_40x_TSR] |= 1 << 26;
1045     if ((env->spr[SPR_40x_TCR] >> 23) & 0x1) {
1046         ppc_set_irq(cpu, PPC_INTERRUPT_FIT, 1);
1047     }
1048     LOG_TB("%s: ir %d TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx "\n", __func__,
1049            (int)((env->spr[SPR_40x_TCR] >> 23) & 0x1),
1050            env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
1051 }
1052
1053 /* Programmable interval timer */
1054 static void start_stop_pit (CPUPPCState *env, ppc_tb_t *tb_env, int is_excp)
1055 {
1056     ppc40x_timer_t *ppc40x_timer;
1057     uint64_t now, next;
1058
1059     ppc40x_timer = tb_env->opaque;
1060     if (ppc40x_timer->pit_reload <= 1 ||
1061         !((env->spr[SPR_40x_TCR] >> 26) & 0x1) ||
1062         (is_excp && !((env->spr[SPR_40x_TCR] >> 22) & 0x1))) {
1063         /* Stop PIT */
1064         LOG_TB("%s: stop PIT\n", __func__);
1065         timer_del(tb_env->decr_timer);
1066     } else {
1067         LOG_TB("%s: start PIT %016" PRIx64 "\n",
1068                     __func__, ppc40x_timer->pit_reload);
1069         now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
1070         next = now + muldiv64(ppc40x_timer->pit_reload,
1071                               NANOSECONDS_PER_SECOND, tb_env->decr_freq);
1072         if (is_excp)
1073             next += tb_env->decr_next - now;
1074         if (next == now)
1075             next++;
1076         timer_mod(tb_env->decr_timer, next);
1077         tb_env->decr_next = next;
1078     }
1079 }
1080
1081 static void cpu_4xx_pit_cb (void *opaque)
1082 {
1083     PowerPCCPU *cpu;
1084     CPUPPCState *env;
1085     ppc_tb_t *tb_env;
1086     ppc40x_timer_t *ppc40x_timer;
1087
1088     env = opaque;
1089     cpu = ppc_env_get_cpu(env);
1090     tb_env = env->tb_env;
1091     ppc40x_timer = tb_env->opaque;
1092     env->spr[SPR_40x_TSR] |= 1 << 27;
1093     if ((env->spr[SPR_40x_TCR] >> 26) & 0x1) {
1094         ppc_set_irq(cpu, ppc40x_timer->decr_excp, 1);
1095     }
1096     start_stop_pit(env, tb_env, 1);
1097     LOG_TB("%s: ar %d ir %d TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx " "
1098            "%016" PRIx64 "\n", __func__,
1099            (int)((env->spr[SPR_40x_TCR] >> 22) & 0x1),
1100            (int)((env->spr[SPR_40x_TCR] >> 26) & 0x1),
1101            env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR],
1102            ppc40x_timer->pit_reload);
1103 }
1104
1105 /* Watchdog timer */
1106 static void cpu_4xx_wdt_cb (void *opaque)
1107 {
1108     PowerPCCPU *cpu;
1109     CPUPPCState *env;
1110     ppc_tb_t *tb_env;
1111     ppc40x_timer_t *ppc40x_timer;
1112     uint64_t now, next;
1113
1114     env = opaque;
1115     cpu = ppc_env_get_cpu(env);
1116     tb_env = env->tb_env;
1117     ppc40x_timer = tb_env->opaque;
1118     now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
1119     switch ((env->spr[SPR_40x_TCR] >> 30) & 0x3) {
1120     case 0:
1121         next = 1 << 17;
1122         break;
1123     case 1:
1124         next = 1 << 21;
1125         break;
1126     case 2:
1127         next = 1 << 25;
1128         break;
1129     case 3:
1130         next = 1 << 29;
1131         break;
1132     default:
1133         /* Cannot occur, but makes gcc happy */
1134         return;
1135     }
1136     next = now + muldiv64(next, NANOSECONDS_PER_SECOND, tb_env->decr_freq);
1137     if (next == now)
1138         next++;
1139     LOG_TB("%s: TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx "\n", __func__,
1140            env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
1141     switch ((env->spr[SPR_40x_TSR] >> 30) & 0x3) {
1142     case 0x0:
1143     case 0x1:
1144         timer_mod(ppc40x_timer->wdt_timer, next);
1145         ppc40x_timer->wdt_next = next;
1146         env->spr[SPR_40x_TSR] |= 1U << 31;
1147         break;
1148     case 0x2:
1149         timer_mod(ppc40x_timer->wdt_timer, next);
1150         ppc40x_timer->wdt_next = next;
1151         env->spr[SPR_40x_TSR] |= 1 << 30;
1152         if ((env->spr[SPR_40x_TCR] >> 27) & 0x1) {
1153             ppc_set_irq(cpu, PPC_INTERRUPT_WDT, 1);
1154         }
1155         break;
1156     case 0x3:
1157         env->spr[SPR_40x_TSR] &= ~0x30000000;
1158         env->spr[SPR_40x_TSR] |= env->spr[SPR_40x_TCR] & 0x30000000;
1159         switch ((env->spr[SPR_40x_TCR] >> 28) & 0x3) {
1160         case 0x0:
1161             /* No reset */
1162             break;
1163         case 0x1: /* Core reset */
1164             ppc40x_core_reset(cpu);
1165             break;
1166         case 0x2: /* Chip reset */
1167             ppc40x_chip_reset(cpu);
1168             break;
1169         case 0x3: /* System reset */
1170             ppc40x_system_reset(cpu);
1171             break;
1172         }
1173     }
1174 }
1175
1176 void store_40x_pit (CPUPPCState *env, target_ulong val)
1177 {
1178     ppc_tb_t *tb_env;
1179     ppc40x_timer_t *ppc40x_timer;
1180
1181     tb_env = env->tb_env;
1182     ppc40x_timer = tb_env->opaque;
1183     LOG_TB("%s val" TARGET_FMT_lx "\n", __func__, val);
1184     ppc40x_timer->pit_reload = val;
1185     start_stop_pit(env, tb_env, 0);
1186 }
1187
1188 target_ulong load_40x_pit (CPUPPCState *env)
1189 {
1190     return cpu_ppc_load_decr(env);
1191 }
1192
1193 static void ppc_40x_set_tb_clk (void *opaque, uint32_t freq)
1194 {
1195     CPUPPCState *env = opaque;
1196     ppc_tb_t *tb_env = env->tb_env;
1197
1198     LOG_TB("%s set new frequency to %" PRIu32 "\n", __func__,
1199                 freq);
1200     tb_env->tb_freq = freq;
1201     tb_env->decr_freq = freq;
1202     /* XXX: we should also update all timers */
1203 }
1204
1205 clk_setup_cb ppc_40x_timers_init (CPUPPCState *env, uint32_t freq,
1206                                   unsigned int decr_excp)
1207 {
1208     ppc_tb_t *tb_env;
1209     ppc40x_timer_t *ppc40x_timer;
1210
1211     tb_env = g_malloc0(sizeof(ppc_tb_t));
1212     env->tb_env = tb_env;
1213     tb_env->flags = PPC_DECR_UNDERFLOW_TRIGGERED;
1214     ppc40x_timer = g_malloc0(sizeof(ppc40x_timer_t));
1215     tb_env->tb_freq = freq;
1216     tb_env->decr_freq = freq;
1217     tb_env->opaque = ppc40x_timer;
1218     LOG_TB("%s freq %" PRIu32 "\n", __func__, freq);
1219     if (ppc40x_timer != NULL) {
1220         /* We use decr timer for PIT */
1221         tb_env->decr_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, &cpu_4xx_pit_cb, env);
1222         ppc40x_timer->fit_timer =
1223             timer_new_ns(QEMU_CLOCK_VIRTUAL, &cpu_4xx_fit_cb, env);
1224         ppc40x_timer->wdt_timer =
1225             timer_new_ns(QEMU_CLOCK_VIRTUAL, &cpu_4xx_wdt_cb, env);
1226         ppc40x_timer->decr_excp = decr_excp;
1227     }
1228
1229     return &ppc_40x_set_tb_clk;
1230 }
1231
1232 /*****************************************************************************/
1233 /* Embedded PowerPC Device Control Registers */
1234 typedef struct ppc_dcrn_t ppc_dcrn_t;
1235 struct ppc_dcrn_t {
1236     dcr_read_cb dcr_read;
1237     dcr_write_cb dcr_write;
1238     void *opaque;
1239 };
1240
1241 /* XXX: on 460, DCR addresses are 32 bits wide,
1242  *      using DCRIPR to get the 22 upper bits of the DCR address
1243  */
1244 #define DCRN_NB 1024
1245 struct ppc_dcr_t {
1246     ppc_dcrn_t dcrn[DCRN_NB];
1247     int (*read_error)(int dcrn);
1248     int (*write_error)(int dcrn);
1249 };
1250
1251 int ppc_dcr_read (ppc_dcr_t *dcr_env, int dcrn, uint32_t *valp)
1252 {
1253     ppc_dcrn_t *dcr;
1254
1255     if (dcrn < 0 || dcrn >= DCRN_NB)
1256         goto error;
1257     dcr = &dcr_env->dcrn[dcrn];
1258     if (dcr->dcr_read == NULL)
1259         goto error;
1260     *valp = (*dcr->dcr_read)(dcr->opaque, dcrn);
1261
1262     return 0;
1263
1264  error:
1265     if (dcr_env->read_error != NULL)
1266         return (*dcr_env->read_error)(dcrn);
1267
1268     return -1;
1269 }
1270
1271 int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, uint32_t val)
1272 {
1273     ppc_dcrn_t *dcr;
1274
1275     if (dcrn < 0 || dcrn >= DCRN_NB)
1276         goto error;
1277     dcr = &dcr_env->dcrn[dcrn];
1278     if (dcr->dcr_write == NULL)
1279         goto error;
1280     (*dcr->dcr_write)(dcr->opaque, dcrn, val);
1281
1282     return 0;
1283
1284  error:
1285     if (dcr_env->write_error != NULL)
1286         return (*dcr_env->write_error)(dcrn);
1287
1288     return -1;
1289 }
1290
1291 int ppc_dcr_register (CPUPPCState *env, int dcrn, void *opaque,
1292                       dcr_read_cb dcr_read, dcr_write_cb dcr_write)
1293 {
1294     ppc_dcr_t *dcr_env;
1295     ppc_dcrn_t *dcr;
1296
1297     dcr_env = env->dcr_env;
1298     if (dcr_env == NULL)
1299         return -1;
1300     if (dcrn < 0 || dcrn >= DCRN_NB)
1301         return -1;
1302     dcr = &dcr_env->dcrn[dcrn];
1303     if (dcr->opaque != NULL ||
1304         dcr->dcr_read != NULL ||
1305         dcr->dcr_write != NULL)
1306         return -1;
1307     dcr->opaque = opaque;
1308     dcr->dcr_read = dcr_read;
1309     dcr->dcr_write = dcr_write;
1310
1311     return 0;
1312 }
1313
1314 int ppc_dcr_init (CPUPPCState *env, int (*read_error)(int dcrn),
1315                   int (*write_error)(int dcrn))
1316 {
1317     ppc_dcr_t *dcr_env;
1318
1319     dcr_env = g_malloc0(sizeof(ppc_dcr_t));
1320     dcr_env->read_error = read_error;
1321     dcr_env->write_error = write_error;
1322     env->dcr_env = dcr_env;
1323
1324     return 0;
1325 }
1326
1327 /*****************************************************************************/
1328 /* Debug port */
1329 void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
1330 {
1331     addr &= 0xF;
1332     switch (addr) {
1333     case 0:
1334         printf("%c", val);
1335         break;
1336     case 1:
1337         printf("\n");
1338         fflush(stdout);
1339         break;
1340     case 2:
1341         printf("Set loglevel to %04" PRIx32 "\n", val);
1342         qemu_set_log(val | 0x100);
1343         break;
1344     }
1345 }
1346
1347 /* CPU device-tree ID helpers */
1348 int ppc_get_vcpu_dt_id(PowerPCCPU *cpu)
1349 {
1350     return cpu->cpu_dt_id;
1351 }
1352
1353 PowerPCCPU *ppc_get_vcpu_by_dt_id(int cpu_dt_id)
1354 {
1355     CPUState *cs;
1356
1357     CPU_FOREACH(cs) {
1358         PowerPCCPU *cpu = POWERPC_CPU(cs);
1359
1360         if (cpu->cpu_dt_id == cpu_dt_id) {
1361             return cpu;
1362         }
1363     }
1364
1365     return NULL;
1366 }
1367
1368 void ppc_cpu_parse_features(const char *cpu_model)
1369 {
1370     CPUClass *cc;
1371     ObjectClass *oc;
1372     const char *typename;
1373     gchar **model_pieces;
1374
1375     model_pieces = g_strsplit(cpu_model, ",", 2);
1376     if (!model_pieces[0]) {
1377         error_report("Invalid/empty CPU model name");
1378         exit(1);
1379     }
1380
1381     oc = cpu_class_by_name(TYPE_POWERPC_CPU, model_pieces[0]);
1382     if (oc == NULL) {
1383         error_report("Unable to find CPU definition: %s", model_pieces[0]);
1384         exit(1);
1385     }
1386
1387     typename = object_class_get_name(oc);
1388     cc = CPU_CLASS(oc);
1389     cc->parse_features(typename, model_pieces[1], &error_fatal);
1390     g_strfreev(model_pieces);
1391 }