hw/ppc/ppc.c

   1 /*
   2  * QEMU generic PowerPC hardware System Emulator
   3  *
   4  * Copyright (c) 2003-2007 Jocelyn Mayer
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "hw/hw.h"
  25 #include "hw/ppc/ppc.h"
  26 #include "qemu/timer.h"
  27 #include "sysemu/sysemu.h"
  28 #include "hw/timer/m48t59.h"
  29 #include "qemu/log.h"
  30 #include "hw/loader.h"
  31 #include "sysemu/kvm.h"
  32 #include "kvm_ppc.h"
  33
  34 //#define PPC_DEBUG_IRQ
  35 //#define PPC_DEBUG_TB
  36
  37 #ifdef PPC_DEBUG_IRQ
  38 #  define LOG_IRQ(...) qemu_log_mask(CPU_LOG_INT, ## __VA_ARGS__)
  39 #else
  40 #  define LOG_IRQ(...) do { } while (0)
  41 #endif
  42
  43
  44 #ifdef PPC_DEBUG_TB
  45 #  define LOG_TB(...) qemu_log(__VA_ARGS__)
  46 #else
  47 #  define LOG_TB(...) do { } while (0)
  48 #endif
  49
  50 static void cpu_ppc_tb_stop (CPUPPCState *env);
  51 static void cpu_ppc_tb_start (CPUPPCState *env);
  52
  53 void ppc_set_irq(PowerPCCPU *cpu, int n_IRQ, int level)
  54 {
  55     CPUState *cs = CPU(cpu);
  56     CPUPPCState *env = &cpu->env;
  57     unsigned int old_pending = env->pending_interrupts;
  58
  59     if (level) {
  60         env->pending_interrupts |= 1 << n_IRQ;
  61         cpu_interrupt(cs, CPU_INTERRUPT_HARD);
  62     } else {
  63         env->pending_interrupts &= ~(1 << n_IRQ);
  64         if (env->pending_interrupts == 0) {
  65             cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
  66         }
  67     }
  68
  69     if (old_pending != env->pending_interrupts) {
  70 #ifdef CONFIG_KVM
  71         kvmppc_set_interrupt(cpu, n_IRQ, level);
  72 #endif
  73     }
  74
  75     LOG_IRQ("%s: %p n_IRQ %d level %d => pending %08" PRIx32
  76                 "req %08x\n", __func__, env, n_IRQ, level,
  77                 env->pending_interrupts, CPU(cpu)->interrupt_request);
  78 }
  79
  80 /* PowerPC 6xx / 7xx internal IRQ controller */
  81 static void ppc6xx_set_irq(void *opaque, int pin, int level)
  82 {
  83     PowerPCCPU *cpu = opaque;
  84     CPUPPCState *env = &cpu->env;
  85     int cur_level;
  86
  87     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
  88                 env, pin, level);
  89     cur_level = (env->irq_input_state >> pin) & 1;
  90     /* Don't generate spurious events */
  91     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
  92         CPUState *cs = CPU(cpu);
  93
  94         switch (pin) {
  95         case PPC6xx_INPUT_TBEN:
  96             /* Level sensitive - active high */
  97             LOG_IRQ("%s: %s the time base\n",
  98                         __func__, level ? "start" : "stop");
  99             if (level) {
 100                 cpu_ppc_tb_start(env);
 101             } else {
 102                 cpu_ppc_tb_stop(env);
 103             }
 104         case PPC6xx_INPUT_INT:
 105             /* Level sensitive - active high */
 106             LOG_IRQ("%s: set the external IRQ state to %d\n",
 107                         __func__, level);
 108             ppc_set_irq(cpu, PPC_INTERRUPT_EXT, level);
 109             break;
 110         case PPC6xx_INPUT_SMI:
 111             /* Level sensitive - active high */
 112             LOG_IRQ("%s: set the SMI IRQ state to %d\n",
 113                         __func__, level);
 114             ppc_set_irq(cpu, PPC_INTERRUPT_SMI, level);
 115             break;
 116         case PPC6xx_INPUT_MCP:
 117             /* Negative edge sensitive */
 118             /* XXX: TODO: actual reaction may depends on HID0 status
 119              *            603/604/740/750: check HID0[EMCP]
 120              */
 121             if (cur_level == 1 && level == 0) {
 122                 LOG_IRQ("%s: raise machine check state\n",
 123                             __func__);
 124                 ppc_set_irq(cpu, PPC_INTERRUPT_MCK, 1);
 125             }
 126             break;
 127         case PPC6xx_INPUT_CKSTP_IN:
 128             /* Level sensitive - active low */
 129             /* XXX: TODO: relay the signal to CKSTP_OUT pin */
 130             /* XXX: Note that the only way to restart the CPU is to reset it */
 131             if (level) {
 132                 LOG_IRQ("%s: stop the CPU\n", __func__);
 133                 cs->halted = 1;
 134             }
 135             break;
 136         case PPC6xx_INPUT_HRESET:
 137             /* Level sensitive - active low */
 138             if (level) {
 139                 LOG_IRQ("%s: reset the CPU\n", __func__);
 140                 cpu_interrupt(cs, CPU_INTERRUPT_RESET);
 141             }
 142             break;
 143         case PPC6xx_INPUT_SRESET:
 144             LOG_IRQ("%s: set the RESET IRQ state to %d\n",
 145                         __func__, level);
 146             ppc_set_irq(cpu, PPC_INTERRUPT_RESET, level);
 147             break;
 148         default:
 149             /* Unknown pin - do nothing */
 150             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 151             return;
 152         }
 153         if (level)
 154             env->irq_input_state |= 1 << pin;
 155         else
 156             env->irq_input_state &= ~(1 << pin);
 157     }
 158 }
 159
 160 void ppc6xx_irq_init(CPUPPCState *env)
 161 {
 162     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 163
 164     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc6xx_set_irq, cpu,
 165                                                   PPC6xx_INPUT_NB);
 166 }
 167
 168 #if defined(TARGET_PPC64)
 169 /* PowerPC 970 internal IRQ controller */
 170 static void ppc970_set_irq(void *opaque, int pin, int level)
 171 {
 172     PowerPCCPU *cpu = opaque;
 173     CPUPPCState *env = &cpu->env;
 174     int cur_level;
 175
 176     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
 177                 env, pin, level);
 178     cur_level = (env->irq_input_state >> pin) & 1;
 179     /* Don't generate spurious events */
 180     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
 181         CPUState *cs = CPU(cpu);
 182
 183         switch (pin) {
 184         case PPC970_INPUT_INT:
 185             /* Level sensitive - active high */
 186             LOG_IRQ("%s: set the external IRQ state to %d\n",
 187                         __func__, level);
 188             ppc_set_irq(cpu, PPC_INTERRUPT_EXT, level);
 189             break;
 190         case PPC970_INPUT_THINT:
 191             /* Level sensitive - active high */
 192             LOG_IRQ("%s: set the SMI IRQ state to %d\n", __func__,
 193                         level);
 194             ppc_set_irq(cpu, PPC_INTERRUPT_THERM, level);
 195             break;
 196         case PPC970_INPUT_MCP:
 197             /* Negative edge sensitive */
 198             /* XXX: TODO: actual reaction may depends on HID0 status
 199              *            603/604/740/750: check HID0[EMCP]
 200              */
 201             if (cur_level == 1 && level == 0) {
 202                 LOG_IRQ("%s: raise machine check state\n",
 203                             __func__);
 204                 ppc_set_irq(cpu, PPC_INTERRUPT_MCK, 1);
 205             }
 206             break;
 207         case PPC970_INPUT_CKSTP:
 208             /* Level sensitive - active low */
 209             /* XXX: TODO: relay the signal to CKSTP_OUT pin */
 210             if (level) {
 211                 LOG_IRQ("%s: stop the CPU\n", __func__);
 212                 cs->halted = 1;
 213             } else {
 214                 LOG_IRQ("%s: restart the CPU\n", __func__);
 215                 cs->halted = 0;
 216                 qemu_cpu_kick(cs);
 217             }
 218             break;
 219         case PPC970_INPUT_HRESET:
 220             /* Level sensitive - active low */
 221             if (level) {
 222                 cpu_interrupt(cs, CPU_INTERRUPT_RESET);
 223             }
 224             break;
 225         case PPC970_INPUT_SRESET:
 226             LOG_IRQ("%s: set the RESET IRQ state to %d\n",
 227                         __func__, level);
 228             ppc_set_irq(cpu, PPC_INTERRUPT_RESET, level);
 229             break;
 230         case PPC970_INPUT_TBEN:
 231             LOG_IRQ("%s: set the TBEN state to %d\n", __func__,
 232                         level);
 233             /* XXX: TODO */
 234             break;
 235         default:
 236             /* Unknown pin - do nothing */
 237             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 238             return;
 239         }
 240         if (level)
 241             env->irq_input_state |= 1 << pin;
 242         else
 243             env->irq_input_state &= ~(1 << pin);
 244     }
 245 }
 246
 247 void ppc970_irq_init(CPUPPCState *env)
 248 {
 249     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 250
 251     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc970_set_irq, cpu,
 252                                                   PPC970_INPUT_NB);
 253 }
 254
 255 /* POWER7 internal IRQ controller */
 256 static void power7_set_irq(void *opaque, int pin, int level)
 257 {
 258     PowerPCCPU *cpu = opaque;
 259     CPUPPCState *env = &cpu->env;
 260
 261     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
 262                 env, pin, level);
 263
 264     switch (pin) {
 265     case POWER7_INPUT_INT:
 266         /* Level sensitive - active high */
 267         LOG_IRQ("%s: set the external IRQ state to %d\n",
 268                 __func__, level);
 269         ppc_set_irq(cpu, PPC_INTERRUPT_EXT, level);
 270         break;
 271     default:
 272         /* Unknown pin - do nothing */
 273         LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 274         return;
 275     }
 276     if (level) {
 277         env->irq_input_state |= 1 << pin;
 278     } else {
 279         env->irq_input_state &= ~(1 << pin);
 280     }
 281 }
 282
 283 void ppcPOWER7_irq_init(CPUPPCState *env)
 284 {
 285     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 286
 287     env->irq_inputs = (void **)qemu_allocate_irqs(&power7_set_irq, cpu,
 288                                                   POWER7_INPUT_NB);
 289 }
 290 #endif /* defined(TARGET_PPC64) */
 291
 292 /* PowerPC 40x internal IRQ controller */
 293 static void ppc40x_set_irq(void *opaque, int pin, int level)
 294 {
 295     PowerPCCPU *cpu = opaque;
 296     CPUPPCState *env = &cpu->env;
 297     int cur_level;
 298
 299     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
 300                 env, pin, level);
 301     cur_level = (env->irq_input_state >> pin) & 1;
 302     /* Don't generate spurious events */
 303     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
 304         CPUState *cs = CPU(cpu);
 305
 306         switch (pin) {
 307         case PPC40x_INPUT_RESET_SYS:
 308             if (level) {
 309                 LOG_IRQ("%s: reset the PowerPC system\n",
 310                             __func__);
 311                 ppc40x_system_reset(cpu);
 312             }
 313             break;
 314         case PPC40x_INPUT_RESET_CHIP:
 315             if (level) {
 316                 LOG_IRQ("%s: reset the PowerPC chip\n", __func__);
 317                 ppc40x_chip_reset(cpu);
 318             }
 319             break;
 320         case PPC40x_INPUT_RESET_CORE:
 321             /* XXX: TODO: update DBSR[MRR] */
 322             if (level) {
 323                 LOG_IRQ("%s: reset the PowerPC core\n", __func__);
 324                 ppc40x_core_reset(cpu);
 325             }
 326             break;
 327         case PPC40x_INPUT_CINT:
 328             /* Level sensitive - active high */
 329             LOG_IRQ("%s: set the critical IRQ state to %d\n",
 330                         __func__, level);
 331             ppc_set_irq(cpu, PPC_INTERRUPT_CEXT, level);
 332             break;
 333         case PPC40x_INPUT_INT:
 334             /* Level sensitive - active high */
 335             LOG_IRQ("%s: set the external IRQ state to %d\n",
 336                         __func__, level);
 337             ppc_set_irq(cpu, PPC_INTERRUPT_EXT, level);
 338             break;
 339         case PPC40x_INPUT_HALT:
 340             /* Level sensitive - active low */
 341             if (level) {
 342                 LOG_IRQ("%s: stop the CPU\n", __func__);
 343                 cs->halted = 1;
 344             } else {
 345                 LOG_IRQ("%s: restart the CPU\n", __func__);
 346                 cs->halted = 0;
 347                 qemu_cpu_kick(cs);
 348             }
 349             break;
 350         case PPC40x_INPUT_DEBUG:
 351             /* Level sensitive - active high */
 352             LOG_IRQ("%s: set the debug pin state to %d\n",
 353                         __func__, level);
 354             ppc_set_irq(cpu, PPC_INTERRUPT_DEBUG, level);
 355             break;
 356         default:
 357             /* Unknown pin - do nothing */
 358             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 359             return;
 360         }
 361         if (level)
 362             env->irq_input_state |= 1 << pin;
 363         else
 364             env->irq_input_state &= ~(1 << pin);
 365     }
 366 }
 367
 368 void ppc40x_irq_init(CPUPPCState *env)
 369 {
 370     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 371
 372     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc40x_set_irq,
 373                                                   cpu, PPC40x_INPUT_NB);
 374 }
 375
 376 /* PowerPC E500 internal IRQ controller */
 377 static void ppce500_set_irq(void *opaque, int pin, int level)
 378 {
 379     PowerPCCPU *cpu = opaque;
 380     CPUPPCState *env = &cpu->env;
 381     int cur_level;
 382
 383     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
 384                 env, pin, level);
 385     cur_level = (env->irq_input_state >> pin) & 1;
 386     /* Don't generate spurious events */
 387     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
 388         switch (pin) {
 389         case PPCE500_INPUT_MCK:
 390             if (level) {
 391                 LOG_IRQ("%s: reset the PowerPC system\n",
 392                             __func__);
 393                 qemu_system_reset_request();
 394             }
 395             break;
 396         case PPCE500_INPUT_RESET_CORE:
 397             if (level) {
 398                 LOG_IRQ("%s: reset the PowerPC core\n", __func__);
 399                 ppc_set_irq(cpu, PPC_INTERRUPT_MCK, level);
 400             }
 401             break;
 402         case PPCE500_INPUT_CINT:
 403             /* Level sensitive - active high */
 404             LOG_IRQ("%s: set the critical IRQ state to %d\n",
 405                         __func__, level);
 406             ppc_set_irq(cpu, PPC_INTERRUPT_CEXT, level);
 407             break;
 408         case PPCE500_INPUT_INT:
 409             /* Level sensitive - active high */
 410             LOG_IRQ("%s: set the core IRQ state to %d\n",
 411                         __func__, level);
 412             ppc_set_irq(cpu, PPC_INTERRUPT_EXT, level);
 413             break;
 414         case PPCE500_INPUT_DEBUG:
 415             /* Level sensitive - active high */
 416             LOG_IRQ("%s: set the debug pin state to %d\n",
 417                         __func__, level);
 418             ppc_set_irq(cpu, PPC_INTERRUPT_DEBUG, level);
 419             break;
 420         default:
 421             /* Unknown pin - do nothing */
 422             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 423             return;
 424         }
 425         if (level)
 426             env->irq_input_state |= 1 << pin;
 427         else
 428             env->irq_input_state &= ~(1 << pin);
 429     }
 430 }
 431
 432 void ppce500_irq_init(CPUPPCState *env)
 433 {
 434     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 435
 436     env->irq_inputs = (void **)qemu_allocate_irqs(&ppce500_set_irq,
 437                                                   cpu, PPCE500_INPUT_NB);
 438 }
 439
 440 /* Enable or Disable the E500 EPR capability */
 441 void ppce500_set_mpic_proxy(bool enabled)
 442 {
 443     CPUState *cs;
 444
 445     for (cs = first_cpu; cs != NULL; cs = cs->next_cpu) {
 446         PowerPCCPU *cpu = POWERPC_CPU(cs);
 447
 448         cpu->env.mpic_proxy = enabled;
 449         if (kvm_enabled()) {
 450             kvmppc_set_mpic_proxy(cpu, enabled);
 451         }
 452     }
 453 }
 454
 455 /*****************************************************************************/
 456 /* PowerPC time base and decrementer emulation */
 457
 458 uint64_t cpu_ppc_get_tb(ppc_tb_t *tb_env, uint64_t vmclk, int64_t tb_offset)
 459 {
 460     /* TB time in tb periods */
 461     return muldiv64(vmclk, tb_env->tb_freq, get_ticks_per_sec()) + tb_offset;
 462 }
 463
 464 uint64_t cpu_ppc_load_tbl (CPUPPCState *env)
 465 {
 466     ppc_tb_t *tb_env = env->tb_env;
 467     uint64_t tb;
 468
 469     if (kvm_enabled()) {
 470         return env->spr[SPR_TBL];
 471     }
 472
 473     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->tb_offset);
 474     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 475
 476     return tb;
 477 }
 478
 479 static inline uint32_t _cpu_ppc_load_tbu(CPUPPCState *env)
 480 {
 481     ppc_tb_t *tb_env = env->tb_env;
 482     uint64_t tb;
 483
 484     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->tb_offset);
 485     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 486
 487     return tb >> 32;
 488 }
 489
 490 uint32_t cpu_ppc_load_tbu (CPUPPCState *env)
 491 {
 492     if (kvm_enabled()) {
 493         return env->spr[SPR_TBU];
 494     }
 495
 496     return _cpu_ppc_load_tbu(env);
 497 }
 498
 499 static inline void cpu_ppc_store_tb(ppc_tb_t *tb_env, uint64_t vmclk,
 500                                     int64_t *tb_offsetp, uint64_t value)
 501 {
 502     *tb_offsetp = value - muldiv64(vmclk, tb_env->tb_freq, get_ticks_per_sec());
 503     LOG_TB("%s: tb %016" PRIx64 " offset %08" PRIx64 "\n",
 504                 __func__, value, *tb_offsetp);
 505 }
 506
 507 void cpu_ppc_store_tbl (CPUPPCState *env, uint32_t value)
 508 {
 509     ppc_tb_t *tb_env = env->tb_env;
 510     uint64_t tb;
 511
 512     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->tb_offset);
 513     tb &= 0xFFFFFFFF00000000ULL;
 514     cpu_ppc_store_tb(tb_env, qemu_get_clock_ns(vm_clock),
 515                      &tb_env->tb_offset, tb | (uint64_t)value);
 516 }
 517
 518 static inline void _cpu_ppc_store_tbu(CPUPPCState *env, uint32_t value)
 519 {
 520     ppc_tb_t *tb_env = env->tb_env;
 521     uint64_t tb;
 522
 523     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->tb_offset);
 524     tb &= 0x00000000FFFFFFFFULL;
 525     cpu_ppc_store_tb(tb_env, qemu_get_clock_ns(vm_clock),
 526                      &tb_env->tb_offset, ((uint64_t)value << 32) | tb);
 527 }
 528
 529 void cpu_ppc_store_tbu (CPUPPCState *env, uint32_t value)
 530 {
 531     _cpu_ppc_store_tbu(env, value);
 532 }
 533
 534 uint64_t cpu_ppc_load_atbl (CPUPPCState *env)
 535 {
 536     ppc_tb_t *tb_env = env->tb_env;
 537     uint64_t tb;
 538
 539     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->atb_offset);
 540     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 541
 542     return tb;
 543 }
 544
 545 uint32_t cpu_ppc_load_atbu (CPUPPCState *env)
 546 {
 547     ppc_tb_t *tb_env = env->tb_env;
 548     uint64_t tb;
 549
 550     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->atb_offset);
 551     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 552
 553     return tb >> 32;
 554 }
 555
 556 void cpu_ppc_store_atbl (CPUPPCState *env, uint32_t value)
 557 {
 558     ppc_tb_t *tb_env = env->tb_env;
 559     uint64_t tb;
 560
 561     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->atb_offset);
 562     tb &= 0xFFFFFFFF00000000ULL;
 563     cpu_ppc_store_tb(tb_env, qemu_get_clock_ns(vm_clock),
 564                      &tb_env->atb_offset, tb | (uint64_t)value);
 565 }
 566
 567 void cpu_ppc_store_atbu (CPUPPCState *env, uint32_t value)
 568 {
 569     ppc_tb_t *tb_env = env->tb_env;
 570     uint64_t tb;
 571
 572     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->atb_offset);
 573     tb &= 0x00000000FFFFFFFFULL;
 574     cpu_ppc_store_tb(tb_env, qemu_get_clock_ns(vm_clock),
 575                      &tb_env->atb_offset, ((uint64_t)value << 32) | tb);
 576 }
 577
 578 static void cpu_ppc_tb_stop (CPUPPCState *env)
 579 {
 580     ppc_tb_t *tb_env = env->tb_env;
 581     uint64_t tb, atb, vmclk;
 582
 583     /* If the time base is already frozen, do nothing */
 584     if (tb_env->tb_freq != 0) {
 585         vmclk = qemu_get_clock_ns(vm_clock);
 586         /* Get the time base */
 587         tb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->tb_offset);
 588         /* Get the alternate time base */
 589         atb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->atb_offset);
 590         /* Store the time base value (ie compute the current offset) */
 591         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
 592         /* Store the alternate time base value (compute the current offset) */
 593         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
 594         /* Set the time base frequency to zero */
 595         tb_env->tb_freq = 0;
 596         /* Now, the time bases are frozen to tb_offset / atb_offset value */
 597     }
 598 }
 599
 600 static void cpu_ppc_tb_start (CPUPPCState *env)
 601 {
 602     ppc_tb_t *tb_env = env->tb_env;
 603     uint64_t tb, atb, vmclk;
 604
 605     /* If the time base is not frozen, do nothing */
 606     if (tb_env->tb_freq == 0) {
 607         vmclk = qemu_get_clock_ns(vm_clock);
 608         /* Get the time base from tb_offset */
 609         tb = tb_env->tb_offset;
 610         /* Get the alternate time base from atb_offset */
 611         atb = tb_env->atb_offset;
 612         /* Restore the tb frequency from the decrementer frequency */
 613         tb_env->tb_freq = tb_env->decr_freq;
 614         /* Store the time base value */
 615         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
 616         /* Store the alternate time base value */
 617         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
 618     }
 619 }
 620
 621 static inline uint32_t _cpu_ppc_load_decr(CPUPPCState *env, uint64_t next)
 622 {
 623     ppc_tb_t *tb_env = env->tb_env;
 624     uint32_t decr;
 625     int64_t diff;
 626
 627     diff = next - qemu_get_clock_ns(vm_clock);
 628     if (diff >= 0) {
 629         decr = muldiv64(diff, tb_env->decr_freq, get_ticks_per_sec());
 630     } else if (tb_env->flags & PPC_TIMER_BOOKE) {
 631         decr = 0;
 632     }  else {
 633         decr = -muldiv64(-diff, tb_env->decr_freq, get_ticks_per_sec());
 634     }
 635     LOG_TB("%s: %08" PRIx32 "\n", __func__, decr);
 636
 637     return decr;
 638 }
 639
 640 uint32_t cpu_ppc_load_decr (CPUPPCState *env)
 641 {
 642     ppc_tb_t *tb_env = env->tb_env;
 643
 644     if (kvm_enabled()) {
 645         return env->spr[SPR_DECR];
 646     }
 647
 648     return _cpu_ppc_load_decr(env, tb_env->decr_next);
 649 }
 650
 651 uint32_t cpu_ppc_load_hdecr (CPUPPCState *env)
 652 {
 653     ppc_tb_t *tb_env = env->tb_env;
 654
 655     return _cpu_ppc_load_decr(env, tb_env->hdecr_next);
 656 }
 657
 658 uint64_t cpu_ppc_load_purr (CPUPPCState *env)
 659 {
 660     ppc_tb_t *tb_env = env->tb_env;
 661     uint64_t diff;
 662
 663     diff = qemu_get_clock_ns(vm_clock) - tb_env->purr_start;
 664
 665     return tb_env->purr_load + muldiv64(diff, tb_env->tb_freq, get_ticks_per_sec());
 666 }
 667
 668 /* When decrementer expires,
 669  * all we need to do is generate or queue a CPU exception
 670  */
 671 static inline void cpu_ppc_decr_excp(PowerPCCPU *cpu)
 672 {
 673     /* Raise it */
 674     LOG_TB("raise decrementer exception\n");
 675     ppc_set_irq(cpu, PPC_INTERRUPT_DECR, 1);
 676 }
 677
 678 static inline void cpu_ppc_hdecr_excp(PowerPCCPU *cpu)
 679 {
 680     /* Raise it */
 681     LOG_TB("raise decrementer exception\n");
 682     ppc_set_irq(cpu, PPC_INTERRUPT_HDECR, 1);
 683 }
 684
 685 static void __cpu_ppc_store_decr(PowerPCCPU *cpu, uint64_t *nextp,
 686                                  struct QEMUTimer *timer,
 687                                  void (*raise_excp)(PowerPCCPU *),
 688                                  uint32_t decr, uint32_t value,
 689                                  int is_excp)
 690 {
 691     CPUPPCState *env = &cpu->env;
 692     ppc_tb_t *tb_env = env->tb_env;
 693     uint64_t now, next;
 694
 695     LOG_TB("%s: %08" PRIx32 " => %08" PRIx32 "\n", __func__,
 696                 decr, value);
 697
 698     if (kvm_enabled()) {
 699         /* KVM handles decrementer exceptions, we don't need our own timer */
 700         return;
 701     }
 702
 703     now = qemu_get_clock_ns(vm_clock);
 704     next = now + muldiv64(value, get_ticks_per_sec(), tb_env->decr_freq);
 705     if (is_excp) {
 706         next += *nextp - now;
 707     }
 708     if (next == now) {
 709         next++;
 710     }
 711     *nextp = next;
 712     /* Adjust timer */
 713     qemu_mod_timer(timer, next);
 714
 715     /* If we set a negative value and the decrementer was positive, raise an
 716      * exception.
 717      */
 718     if ((tb_env->flags & PPC_DECR_UNDERFLOW_TRIGGERED)
 719         && (value & 0x80000000)
 720         && !(decr & 0x80000000)) {
 721         (*raise_excp)(cpu);
 722     }
 723 }
 724
 725 static inline void _cpu_ppc_store_decr(PowerPCCPU *cpu, uint32_t decr,
 726                                        uint32_t value, int is_excp)
 727 {
 728     ppc_tb_t *tb_env = cpu->env.tb_env;
 729
 730     __cpu_ppc_store_decr(cpu, &tb_env->decr_next, tb_env->decr_timer,
 731                          &cpu_ppc_decr_excp, decr, value, is_excp);
 732 }
 733
 734 void cpu_ppc_store_decr (CPUPPCState *env, uint32_t value)
 735 {
 736     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 737
 738     _cpu_ppc_store_decr(cpu, cpu_ppc_load_decr(env), value, 0);
 739 }
 740
 741 static void cpu_ppc_decr_cb(void *opaque)
 742 {
 743     PowerPCCPU *cpu = opaque;
 744
 745     _cpu_ppc_store_decr(cpu, 0x00000000, 0xFFFFFFFF, 1);
 746 }
 747
 748 static inline void _cpu_ppc_store_hdecr(PowerPCCPU *cpu, uint32_t hdecr,
 749                                         uint32_t value, int is_excp)
 750 {
 751     ppc_tb_t *tb_env = cpu->env.tb_env;
 752
 753     if (tb_env->hdecr_timer != NULL) {
 754         __cpu_ppc_store_decr(cpu, &tb_env->hdecr_next, tb_env->hdecr_timer,
 755                              &cpu_ppc_hdecr_excp, hdecr, value, is_excp);
 756     }
 757 }
 758
 759 void cpu_ppc_store_hdecr (CPUPPCState *env, uint32_t value)
 760 {
 761     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 762
 763     _cpu_ppc_store_hdecr(cpu, cpu_ppc_load_hdecr(env), value, 0);
 764 }
 765
 766 static void cpu_ppc_hdecr_cb(void *opaque)
 767 {
 768     PowerPCCPU *cpu = opaque;
 769
 770     _cpu_ppc_store_hdecr(cpu, 0x00000000, 0xFFFFFFFF, 1);
 771 }
 772
 773 static void cpu_ppc_store_purr(PowerPCCPU *cpu, uint64_t value)
 774 {
 775     ppc_tb_t *tb_env = cpu->env.tb_env;
 776
 777     tb_env->purr_load = value;
 778     tb_env->purr_start = qemu_get_clock_ns(vm_clock);
 779 }
 780
 781 static void cpu_ppc_set_tb_clk (void *opaque, uint32_t freq)
 782 {
 783     CPUPPCState *env = opaque;
 784     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 785     ppc_tb_t *tb_env = env->tb_env;
 786
 787     tb_env->tb_freq = freq;
 788     tb_env->decr_freq = freq;
 789     /* There is a bug in Linux 2.4 kernels:
 790      * if a decrementer exception is pending when it enables msr_ee at startup,
 791      * it's not ready to handle it...
 792      */
 793     _cpu_ppc_store_decr(cpu, 0xFFFFFFFF, 0xFFFFFFFF, 0);
 794     _cpu_ppc_store_hdecr(cpu, 0xFFFFFFFF, 0xFFFFFFFF, 0);
 795     cpu_ppc_store_purr(cpu, 0x0000000000000000ULL);
 796 }
 797
 798 /* Set up (once) timebase frequency (in Hz) */
 799 clk_setup_cb cpu_ppc_tb_init (CPUPPCState *env, uint32_t freq)
 800 {
 801     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 802     ppc_tb_t *tb_env;
 803
 804     tb_env = g_malloc0(sizeof(ppc_tb_t));
 805     env->tb_env = tb_env;
 806     tb_env->flags = PPC_DECR_UNDERFLOW_TRIGGERED;
 807     /* Create new timer */
 808     tb_env->decr_timer = qemu_new_timer_ns(vm_clock, &cpu_ppc_decr_cb, cpu);
 809     if (0) {
 810         /* XXX: find a suitable condition to enable the hypervisor decrementer
 811          */
 812         tb_env->hdecr_timer = qemu_new_timer_ns(vm_clock, &cpu_ppc_hdecr_cb,
 813                                                 cpu);
 814     } else {
 815         tb_env->hdecr_timer = NULL;
 816     }
 817     cpu_ppc_set_tb_clk(env, freq);
 818
 819     return &cpu_ppc_set_tb_clk;
 820 }
 821
 822 /* Specific helpers for POWER & PowerPC 601 RTC */
 823 #if 0
 824 static clk_setup_cb cpu_ppc601_rtc_init (CPUPPCState *env)
 825 {
 826     return cpu_ppc_tb_init(env, 7812500);
 827 }
 828 #endif
 829
 830 void cpu_ppc601_store_rtcu (CPUPPCState *env, uint32_t value)
 831 {
 832     _cpu_ppc_store_tbu(env, value);
 833 }
 834
 835 uint32_t cpu_ppc601_load_rtcu (CPUPPCState *env)
 836 {
 837     return _cpu_ppc_load_tbu(env);
 838 }
 839
 840 void cpu_ppc601_store_rtcl (CPUPPCState *env, uint32_t value)
 841 {
 842     cpu_ppc_store_tbl(env, value & 0x3FFFFF80);
 843 }
 844
 845 uint32_t cpu_ppc601_load_rtcl (CPUPPCState *env)
 846 {
 847     return cpu_ppc_load_tbl(env) & 0x3FFFFF80;
 848 }
 849
 850 /*****************************************************************************/
 851 /* PowerPC 40x timers */
 852
 853 /* PIT, FIT & WDT */
 854 typedef struct ppc40x_timer_t ppc40x_timer_t;
 855 struct ppc40x_timer_t {
 856     uint64_t pit_reload;  /* PIT auto-reload value        */
 857     uint64_t fit_next;    /* Tick for next FIT interrupt  */
 858     struct QEMUTimer *fit_timer;
 859     uint64_t wdt_next;    /* Tick for next WDT interrupt  */
 860     struct QEMUTimer *wdt_timer;
 861
 862     /* 405 have the PIT, 440 have a DECR.  */
 863     unsigned int decr_excp;
 864 };
 865
 866 /* Fixed interval timer */
 867 static void cpu_4xx_fit_cb (void *opaque)
 868 {
 869     PowerPCCPU *cpu;
 870     CPUPPCState *env;
 871     ppc_tb_t *tb_env;
 872     ppc40x_timer_t *ppc40x_timer;
 873     uint64_t now, next;
 874
 875     env = opaque;
 876     cpu = ppc_env_get_cpu(env);
 877     tb_env = env->tb_env;
 878     ppc40x_timer = tb_env->opaque;
 879     now = qemu_get_clock_ns(vm_clock);
 880     switch ((env->spr[SPR_40x_TCR] >> 24) & 0x3) {
 881     case 0:
 882         next = 1 << 9;
 883         break;
 884     case 1:
 885         next = 1 << 13;
 886         break;
 887     case 2:
 888         next = 1 << 17;
 889         break;
 890     case 3:
 891         next = 1 << 21;
 892         break;
 893     default:
 894         /* Cannot occur, but makes gcc happy */
 895         return;
 896     }
 897     next = now + muldiv64(next, get_ticks_per_sec(), tb_env->tb_freq);
 898     if (next == now)
 899         next++;
 900     qemu_mod_timer(ppc40x_timer->fit_timer, next);
 901     env->spr[SPR_40x_TSR] |= 1 << 26;
 902     if ((env->spr[SPR_40x_TCR] >> 23) & 0x1) {
 903         ppc_set_irq(cpu, PPC_INTERRUPT_FIT, 1);
 904     }
 905     LOG_TB("%s: ir %d TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx "\n", __func__,
 906            (int)((env->spr[SPR_40x_TCR] >> 23) & 0x1),
 907            env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
 908 }
 909
 910 /* Programmable interval timer */
 911 static void start_stop_pit (CPUPPCState *env, ppc_tb_t *tb_env, int is_excp)
 912 {
 913     ppc40x_timer_t *ppc40x_timer;
 914     uint64_t now, next;
 915
 916     ppc40x_timer = tb_env->opaque;
 917     if (ppc40x_timer->pit_reload <= 1 ||
 918         !((env->spr[SPR_40x_TCR] >> 26) & 0x1) ||
 919         (is_excp && !((env->spr[SPR_40x_TCR] >> 22) & 0x1))) {
 920         /* Stop PIT */
 921         LOG_TB("%s: stop PIT\n", __func__);
 922         qemu_del_timer(tb_env->decr_timer);
 923     } else {
 924         LOG_TB("%s: start PIT %016" PRIx64 "\n",
 925                     __func__, ppc40x_timer->pit_reload);
 926         now = qemu_get_clock_ns(vm_clock);
 927         next = now + muldiv64(ppc40x_timer->pit_reload,
 928                               get_ticks_per_sec(), tb_env->decr_freq);
 929         if (is_excp)
 930             next += tb_env->decr_next - now;
 931         if (next == now)
 932             next++;
 933         qemu_mod_timer(tb_env->decr_timer, next);
 934         tb_env->decr_next = next;
 935     }
 936 }
 937
 938 static void cpu_4xx_pit_cb (void *opaque)
 939 {
 940     PowerPCCPU *cpu;
 941     CPUPPCState *env;
 942     ppc_tb_t *tb_env;
 943     ppc40x_timer_t *ppc40x_timer;
 944
 945     env = opaque;
 946     cpu = ppc_env_get_cpu(env);
 947     tb_env = env->tb_env;
 948     ppc40x_timer = tb_env->opaque;
 949     env->spr[SPR_40x_TSR] |= 1 << 27;
 950     if ((env->spr[SPR_40x_TCR] >> 26) & 0x1) {
 951         ppc_set_irq(cpu, ppc40x_timer->decr_excp, 1);
 952     }
 953     start_stop_pit(env, tb_env, 1);
 954     LOG_TB("%s: ar %d ir %d TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx " "
 955            "%016" PRIx64 "\n", __func__,
 956            (int)((env->spr[SPR_40x_TCR] >> 22) & 0x1),
 957            (int)((env->spr[SPR_40x_TCR] >> 26) & 0x1),
 958            env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR],
 959            ppc40x_timer->pit_reload);
 960 }
 961
 962 /* Watchdog timer */
 963 static void cpu_4xx_wdt_cb (void *opaque)
 964 {
 965     PowerPCCPU *cpu;
 966     CPUPPCState *env;
 967     ppc_tb_t *tb_env;
 968     ppc40x_timer_t *ppc40x_timer;
 969     uint64_t now, next;
 970
 971     env = opaque;
 972     cpu = ppc_env_get_cpu(env);
 973     tb_env = env->tb_env;
 974     ppc40x_timer = tb_env->opaque;
 975     now = qemu_get_clock_ns(vm_clock);
 976     switch ((env->spr[SPR_40x_TCR] >> 30) & 0x3) {
 977     case 0:
 978         next = 1 << 17;
 979         break;
 980     case 1:
 981         next = 1 << 21;
 982         break;
 983     case 2:
 984         next = 1 << 25;
 985         break;
 986     case 3:
 987         next = 1 << 29;
 988         break;
 989     default:
 990         /* Cannot occur, but makes gcc happy */
 991         return;
 992     }
 993     next = now + muldiv64(next, get_ticks_per_sec(), tb_env->decr_freq);
 994     if (next == now)
 995         next++;
 996     LOG_TB("%s: TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx "\n", __func__,
 997            env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
 998     switch ((env->spr[SPR_40x_TSR] >> 30) & 0x3) {
 999     case 0x0:
1000     case 0x1:
1001         qemu_mod_timer(ppc40x_timer->wdt_timer, next);
1002         ppc40x_timer->wdt_next = next;
1003         env->spr[SPR_40x_TSR] |= 1 << 31;
1004         break;
1005     case 0x2:
1006         qemu_mod_timer(ppc40x_timer->wdt_timer, next);
1007         ppc40x_timer->wdt_next = next;
1008         env->spr[SPR_40x_TSR] |= 1 << 30;
1009         if ((env->spr[SPR_40x_TCR] >> 27) & 0x1) {
1010             ppc_set_irq(cpu, PPC_INTERRUPT_WDT, 1);
1011         }
1012         break;
1013     case 0x3:
1014         env->spr[SPR_40x_TSR] &= ~0x30000000;
1015         env->spr[SPR_40x_TSR] |= env->spr[SPR_40x_TCR] & 0x30000000;
1016         switch ((env->spr[SPR_40x_TCR] >> 28) & 0x3) {
1017         case 0x0:
1018             /* No reset */
1019             break;
1020         case 0x1: /* Core reset */
1021             ppc40x_core_reset(cpu);
1022             break;
1023         case 0x2: /* Chip reset */
1024             ppc40x_chip_reset(cpu);
1025             break;
1026         case 0x3: /* System reset */
1027             ppc40x_system_reset(cpu);
1028             break;
1029         }
1030     }
1031 }
1032
1033 void store_40x_pit (CPUPPCState *env, target_ulong val)
1034 {
1035     ppc_tb_t *tb_env;
1036     ppc40x_timer_t *ppc40x_timer;
1037
1038     tb_env = env->tb_env;
1039     ppc40x_timer = tb_env->opaque;
1040     LOG_TB("%s val" TARGET_FMT_lx "\n", __func__, val);
1041     ppc40x_timer->pit_reload = val;
1042     start_stop_pit(env, tb_env, 0);
1043 }
1044
1045 target_ulong load_40x_pit (CPUPPCState *env)
1046 {
1047     return cpu_ppc_load_decr(env);
1048 }
1049
1050 static void ppc_40x_set_tb_clk (void *opaque, uint32_t freq)
1051 {
1052     CPUPPCState *env = opaque;
1053     ppc_tb_t *tb_env = env->tb_env;
1054
1055     LOG_TB("%s set new frequency to %" PRIu32 "\n", __func__,
1056                 freq);
1057     tb_env->tb_freq = freq;
1058     tb_env->decr_freq = freq;
1059     /* XXX: we should also update all timers */
1060 }
1061
1062 clk_setup_cb ppc_40x_timers_init (CPUPPCState *env, uint32_t freq,
1063                                   unsigned int decr_excp)
1064 {
1065     ppc_tb_t *tb_env;
1066     ppc40x_timer_t *ppc40x_timer;
1067
1068     tb_env = g_malloc0(sizeof(ppc_tb_t));
1069     env->tb_env = tb_env;
1070     tb_env->flags = PPC_DECR_UNDERFLOW_TRIGGERED;
1071     ppc40x_timer = g_malloc0(sizeof(ppc40x_timer_t));
1072     tb_env->tb_freq = freq;
1073     tb_env->decr_freq = freq;
1074     tb_env->opaque = ppc40x_timer;
1075     LOG_TB("%s freq %" PRIu32 "\n", __func__, freq);
1076     if (ppc40x_timer != NULL) {
1077         /* We use decr timer for PIT */
1078         tb_env->decr_timer = qemu_new_timer_ns(vm_clock, &cpu_4xx_pit_cb, env);
1079         ppc40x_timer->fit_timer =
1080             qemu_new_timer_ns(vm_clock, &cpu_4xx_fit_cb, env);
1081         ppc40x_timer->wdt_timer =
1082             qemu_new_timer_ns(vm_clock, &cpu_4xx_wdt_cb, env);
1083         ppc40x_timer->decr_excp = decr_excp;
1084     }
1085
1086     return &ppc_40x_set_tb_clk;
1087 }
1088
1089 /*****************************************************************************/
1090 /* Embedded PowerPC Device Control Registers */
1091 typedef struct ppc_dcrn_t ppc_dcrn_t;
1092 struct ppc_dcrn_t {
1093     dcr_read_cb dcr_read;
1094     dcr_write_cb dcr_write;
1095     void *opaque;
1096 };
1097
1098 /* XXX: on 460, DCR addresses are 32 bits wide,
1099  *      using DCRIPR to get the 22 upper bits of the DCR address
1100  */
1101 #define DCRN_NB 1024
1102 struct ppc_dcr_t {
1103     ppc_dcrn_t dcrn[DCRN_NB];
1104     int (*read_error)(int dcrn);
1105     int (*write_error)(int dcrn);
1106 };
1107
1108 int ppc_dcr_read (ppc_dcr_t *dcr_env, int dcrn, uint32_t *valp)
1109 {
1110     ppc_dcrn_t *dcr;
1111
1112     if (dcrn < 0 || dcrn >= DCRN_NB)
1113         goto error;
1114     dcr = &dcr_env->dcrn[dcrn];
1115     if (dcr->dcr_read == NULL)
1116         goto error;
1117     *valp = (*dcr->dcr_read)(dcr->opaque, dcrn);
1118
1119     return 0;
1120
1121  error:
1122     if (dcr_env->read_error != NULL)
1123         return (*dcr_env->read_error)(dcrn);
1124
1125     return -1;
1126 }
1127
1128 int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, uint32_t val)
1129 {
1130     ppc_dcrn_t *dcr;
1131
1132     if (dcrn < 0 || dcrn >= DCRN_NB)
1133         goto error;
1134     dcr = &dcr_env->dcrn[dcrn];
1135     if (dcr->dcr_write == NULL)
1136         goto error;
1137     (*dcr->dcr_write)(dcr->opaque, dcrn, val);
1138
1139     return 0;
1140
1141  error:
1142     if (dcr_env->write_error != NULL)
1143         return (*dcr_env->write_error)(dcrn);
1144
1145     return -1;
1146 }
1147
1148 int ppc_dcr_register (CPUPPCState *env, int dcrn, void *opaque,
1149                       dcr_read_cb dcr_read, dcr_write_cb dcr_write)
1150 {
1151     ppc_dcr_t *dcr_env;
1152     ppc_dcrn_t *dcr;
1153
1154     dcr_env = env->dcr_env;
1155     if (dcr_env == NULL)
1156         return -1;
1157     if (dcrn < 0 || dcrn >= DCRN_NB)
1158         return -1;
1159     dcr = &dcr_env->dcrn[dcrn];
1160     if (dcr->opaque != NULL ||
1161         dcr->dcr_read != NULL ||
1162         dcr->dcr_write != NULL)
1163         return -1;
1164     dcr->opaque = opaque;
1165     dcr->dcr_read = dcr_read;
1166     dcr->dcr_write = dcr_write;
1167
1168     return 0;
1169 }
1170
1171 int ppc_dcr_init (CPUPPCState *env, int (*read_error)(int dcrn),
1172                   int (*write_error)(int dcrn))
1173 {
1174     ppc_dcr_t *dcr_env;
1175
1176     dcr_env = g_malloc0(sizeof(ppc_dcr_t));
1177     dcr_env->read_error = read_error;
1178     dcr_env->write_error = write_error;
1179     env->dcr_env = dcr_env;
1180
1181     return 0;
1182 }
1183
1184 /*****************************************************************************/
1185 /* Debug port */
1186 void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
1187 {
1188     addr &= 0xF;
1189     switch (addr) {
1190     case 0:
1191         printf("%c", val);
1192         break;
1193     case 1:
1194         printf("\n");
1195         fflush(stdout);
1196         break;
1197     case 2:
1198         printf("Set loglevel to %04" PRIx32 "\n", val);
1199         qemu_set_log(val | 0x100);
1200         break;
1201     }
1202 }
1203
1204 /*****************************************************************************/
1205 /* NVRAM helpers */
1206 static inline uint32_t nvram_read (nvram_t *nvram, uint32_t addr)
1207 {
1208     return (*nvram->read_fn)(nvram->opaque, addr);
1209 }
1210
1211 static inline void nvram_write (nvram_t *nvram, uint32_t addr, uint32_t val)
1212 {
1213     (*nvram->write_fn)(nvram->opaque, addr, val);
1214 }
1215
1216 static void NVRAM_set_byte(nvram_t *nvram, uint32_t addr, uint8_t value)
1217 {
1218     nvram_write(nvram, addr, value);
1219 }
1220
1221 static uint8_t NVRAM_get_byte(nvram_t *nvram, uint32_t addr)
1222 {
1223     return nvram_read(nvram, addr);
1224 }
1225
1226 static void NVRAM_set_word(nvram_t *nvram, uint32_t addr, uint16_t value)
1227 {
1228     nvram_write(nvram, addr, value >> 8);
1229     nvram_write(nvram, addr + 1, value & 0xFF);
1230 }
1231
1232 static uint16_t NVRAM_get_word(nvram_t *nvram, uint32_t addr)
1233 {
1234     uint16_t tmp;
1235
1236     tmp = nvram_read(nvram, addr) << 8;
1237     tmp |= nvram_read(nvram, addr + 1);
1238
1239     return tmp;
1240 }
1241
1242 static void NVRAM_set_lword(nvram_t *nvram, uint32_t addr, uint32_t value)
1243 {
1244     nvram_write(nvram, addr, value >> 24);
1245     nvram_write(nvram, addr + 1, (value >> 16) & 0xFF);
1246     nvram_write(nvram, addr + 2, (value >> 8) & 0xFF);
1247     nvram_write(nvram, addr + 3, value & 0xFF);
1248 }
1249
1250 uint32_t NVRAM_get_lword (nvram_t *nvram, uint32_t addr)
1251 {
1252     uint32_t tmp;
1253
1254     tmp = nvram_read(nvram, addr) << 24;
1255     tmp |= nvram_read(nvram, addr + 1) << 16;
1256     tmp |= nvram_read(nvram, addr + 2) << 8;
1257     tmp |= nvram_read(nvram, addr + 3);
1258
1259     return tmp;
1260 }
1261
1262 static void NVRAM_set_string(nvram_t *nvram, uint32_t addr, const char *str,
1263                              uint32_t max)
1264 {
1265     int i;
1266
1267     for (i = 0; i < max && str[i] != '\0'; i++) {
1268         nvram_write(nvram, addr + i, str[i]);
1269     }
1270     nvram_write(nvram, addr + i, str[i]);
1271     nvram_write(nvram, addr + max - 1, '\0');
1272 }
1273
1274 int NVRAM_get_string (nvram_t *nvram, uint8_t *dst, uint16_t addr, int max)
1275 {
1276     int i;
1277
1278     memset(dst, 0, max);
1279     for (i = 0; i < max; i++) {
1280         dst[i] = NVRAM_get_byte(nvram, addr + i);
1281         if (dst[i] == '\0')
1282             break;
1283     }
1284
1285     return i;
1286 }
1287
1288 static uint16_t NVRAM_crc_update (uint16_t prev, uint16_t value)
1289 {
1290     uint16_t tmp;
1291     uint16_t pd, pd1, pd2;
1292
1293     tmp = prev >> 8;
1294     pd = prev ^ value;
1295     pd1 = pd & 0x000F;
1296     pd2 = ((pd >> 4) & 0x000F) ^ pd1;
1297     tmp ^= (pd1 << 3) | (pd1 << 8);
1298     tmp ^= pd2 | (pd2 << 7) | (pd2 << 12);
1299
1300     return tmp;
1301 }
1302
1303 static uint16_t NVRAM_compute_crc (nvram_t *nvram, uint32_t start, uint32_t count)
1304 {
1305     uint32_t i;
1306     uint16_t crc = 0xFFFF;
1307     int odd;
1308
1309     odd = count & 1;
1310     count &= ~1;
1311     for (i = 0; i != count; i++) {
1312         crc = NVRAM_crc_update(crc, NVRAM_get_word(nvram, start + i));
1313     }
1314     if (odd) {
1315         crc = NVRAM_crc_update(crc, NVRAM_get_byte(nvram, start + i) << 8);
1316     }
1317
1318     return crc;
1319 }
1320
1321 #define CMDLINE_ADDR 0x017ff000
1322
1323 int PPC_NVRAM_set_params (nvram_t *nvram, uint16_t NVRAM_size,
1324                           const char *arch,
1325                           uint32_t RAM_size, int boot_device,
1326                           uint32_t kernel_image, uint32_t kernel_size,
1327                           const char *cmdline,
1328                           uint32_t initrd_image, uint32_t initrd_size,
1329                           uint32_t NVRAM_image,
1330                           int width, int height, int depth)
1331 {
1332     uint16_t crc;
1333
1334     /* Set parameters for Open Hack'Ware BIOS */
1335     NVRAM_set_string(nvram, 0x00, "QEMU_BIOS", 16);
1336     NVRAM_set_lword(nvram,  0x10, 0x00000002); /* structure v2 */
1337     NVRAM_set_word(nvram,   0x14, NVRAM_size);
1338     NVRAM_set_string(nvram, 0x20, arch, 16);
1339     NVRAM_set_lword(nvram,  0x30, RAM_size);
1340     NVRAM_set_byte(nvram,   0x34, boot_device);
1341     NVRAM_set_lword(nvram,  0x38, kernel_image);
1342     NVRAM_set_lword(nvram,  0x3C, kernel_size);
1343     if (cmdline) {
1344         /* XXX: put the cmdline in NVRAM too ? */
1345         pstrcpy_targphys("cmdline", CMDLINE_ADDR, RAM_size - CMDLINE_ADDR, cmdline);
1346         NVRAM_set_lword(nvram,  0x40, CMDLINE_ADDR);
1347         NVRAM_set_lword(nvram,  0x44, strlen(cmdline));
1348     } else {
1349         NVRAM_set_lword(nvram,  0x40, 0);
1350         NVRAM_set_lword(nvram,  0x44, 0);
1351     }
1352     NVRAM_set_lword(nvram,  0x48, initrd_image);
1353     NVRAM_set_lword(nvram,  0x4C, initrd_size);
1354     NVRAM_set_lword(nvram,  0x50, NVRAM_image);
1355
1356     NVRAM_set_word(nvram,   0x54, width);
1357     NVRAM_set_word(nvram,   0x56, height);
1358     NVRAM_set_word(nvram,   0x58, depth);
1359     crc = NVRAM_compute_crc(nvram, 0x00, 0xF8);
1360     NVRAM_set_word(nvram,   0xFC, crc);
1361
1362     return 0;
1363 }