hw/ppc.c

   1 /*
   2  * QEMU generic PowerPC hardware System Emulator
   3  *
   4  * Copyright (c) 2003-2007 Jocelyn Mayer
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "vl.h"
  25 #include "m48t59.h"
  26
  27 //#define PPC_DEBUG_IRQ
  28
  29 extern FILE *logfile;
  30 extern int loglevel;
  31
  32 void ppc_set_irq (CPUState *env, int n_IRQ, int level)
  33 {
  34     if (level) {
  35         env->pending_interrupts |= 1 << n_IRQ;
  36         cpu_interrupt(env, CPU_INTERRUPT_HARD);
  37     } else {
  38         env->pending_interrupts &= ~(1 << n_IRQ);
  39         if (env->pending_interrupts == 0)
  40             cpu_reset_interrupt(env, CPU_INTERRUPT_HARD);
  41     }
  42 #if defined(PPC_DEBUG_IRQ)
  43     if (loglevel & CPU_LOG_INT) {
  44         fprintf(logfile, "%s: %p n_IRQ %d level %d => pending %08x req %08x\n",
  45                 __func__, env, n_IRQ, level,
  46                 env->pending_interrupts, env->interrupt_request);
  47     }
  48 #endif
  49 }
  50
  51 /* PowerPC 6xx / 7xx internal IRQ controller */
  52 static void ppc6xx_set_irq (void *opaque, int pin, int level)
  53 {
  54     CPUState *env = opaque;
  55     int cur_level;
  56
  57 #if defined(PPC_DEBUG_IRQ)
  58     if (loglevel & CPU_LOG_INT) {
  59         fprintf(logfile, "%s: env %p pin %d level %d\n", __func__,
  60                 env, pin, level);
  61     }
  62 #endif
  63     cur_level = (env->irq_input_state >> pin) & 1;
  64     /* Don't generate spurious events */
  65     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
  66         switch (pin) {
  67         case PPC6xx_INPUT_INT:
  68             /* Level sensitive - active high */
  69 #if defined(PPC_DEBUG_IRQ)
  70             if (loglevel & CPU_LOG_INT) {
  71                 fprintf(logfile, "%s: set the external IRQ state to %d\n",
  72                         __func__, level);
  73             }
  74 #endif
  75             ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
  76             break;
  77         case PPC6xx_INPUT_SMI:
  78             /* Level sensitive - active high */
  79 #if defined(PPC_DEBUG_IRQ)
  80             if (loglevel & CPU_LOG_INT) {
  81                 fprintf(logfile, "%s: set the SMI IRQ state to %d\n",
  82                         __func__, level);
  83             }
  84 #endif
  85             ppc_set_irq(env, PPC_INTERRUPT_SMI, level);
  86             break;
  87         case PPC6xx_INPUT_MCP:
  88             /* Negative edge sensitive */
  89             /* XXX: TODO: actual reaction may depends on HID0 status
  90              *            603/604/740/750: check HID0[EMCP]
  91              */
  92             if (cur_level == 1 && level == 0) {
  93 #if defined(PPC_DEBUG_IRQ)
  94                 if (loglevel & CPU_LOG_INT) {
  95                     fprintf(logfile, "%s: raise machine check state\n",
  96                             __func__);
  97                 }
  98 #endif
  99                 ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);
 100             }
 101             break;
 102         case PPC6xx_INPUT_CKSTP_IN:
 103             /* Level sensitive - active low */
 104             /* XXX: TODO: relay the signal to CKSTP_OUT pin */
 105             if (level) {
 106 #if defined(PPC_DEBUG_IRQ)
 107                 if (loglevel & CPU_LOG_INT) {
 108                     fprintf(logfile, "%s: stop the CPU\n", __func__);
 109                 }
 110 #endif
 111                 env->halted = 1;
 112             } else {
 113 #if defined(PPC_DEBUG_IRQ)
 114                 if (loglevel & CPU_LOG_INT) {
 115                     fprintf(logfile, "%s: restart the CPU\n", __func__);
 116                 }
 117 #endif
 118                 env->halted = 0;
 119             }
 120             break;
 121         case PPC6xx_INPUT_HRESET:
 122             /* Level sensitive - active low */
 123             if (level) {
 124 #if 0 // XXX: TOFIX
 125 #if defined(PPC_DEBUG_IRQ)
 126                 if (loglevel & CPU_LOG_INT) {
 127                     fprintf(logfile, "%s: reset the CPU\n", __func__);
 128                 }
 129 #endif
 130                 cpu_reset(env);
 131 #endif
 132             }
 133             break;
 134         case PPC6xx_INPUT_SRESET:
 135 #if defined(PPC_DEBUG_IRQ)
 136             if (loglevel & CPU_LOG_INT) {
 137                 fprintf(logfile, "%s: set the RESET IRQ state to %d\n",
 138                         __func__, level);
 139             }
 140 #endif
 141             ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
 142             break;
 143         default:
 144             /* Unknown pin - do nothing */
 145 #if defined(PPC_DEBUG_IRQ)
 146             if (loglevel & CPU_LOG_INT) {
 147                 fprintf(logfile, "%s: unknown IRQ pin %d\n", __func__, pin);
 148             }
 149 #endif
 150             return;
 151         }
 152         if (level)
 153             env->irq_input_state |= 1 << pin;
 154         else
 155             env->irq_input_state &= ~(1 << pin);
 156     }
 157 }
 158
 159 void ppc6xx_irq_init (CPUState *env)
 160 {
 161     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc6xx_set_irq, env, 6);
 162 }
 163
 164 /* PowerPC 970 internal IRQ controller */
 165 static void ppc970_set_irq (void *opaque, int pin, int level)
 166 {
 167     CPUState *env = opaque;
 168     int cur_level;
 169
 170 #if defined(PPC_DEBUG_IRQ)
 171     if (loglevel & CPU_LOG_INT) {
 172         fprintf(logfile, "%s: env %p pin %d level %d\n", __func__,
 173                 env, pin, level);
 174     }
 175 #endif
 176     cur_level = (env->irq_input_state >> pin) & 1;
 177     /* Don't generate spurious events */
 178     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
 179         switch (pin) {
 180         case PPC970_INPUT_INT:
 181             /* Level sensitive - active high */
 182 #if defined(PPC_DEBUG_IRQ)
 183             if (loglevel & CPU_LOG_INT) {
 184                 fprintf(logfile, "%s: set the external IRQ state to %d\n",
 185                         __func__, level);
 186             }
 187 #endif
 188             ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
 189             break;
 190         case PPC970_INPUT_THINT:
 191             /* Level sensitive - active high */
 192 #if defined(PPC_DEBUG_IRQ)
 193             if (loglevel & CPU_LOG_INT) {
 194                 fprintf(logfile, "%s: set the SMI IRQ state to %d\n", __func__,
 195                         level);
 196             }
 197 #endif
 198             ppc_set_irq(env, PPC_INTERRUPT_THERM, level);
 199             break;
 200         case PPC970_INPUT_MCP:
 201             /* Negative edge sensitive */
 202             /* XXX: TODO: actual reaction may depends on HID0 status
 203              *            603/604/740/750: check HID0[EMCP]
 204              */
 205             if (cur_level == 1 && level == 0) {
 206 #if defined(PPC_DEBUG_IRQ)
 207                 if (loglevel & CPU_LOG_INT) {
 208                     fprintf(logfile, "%s: raise machine check state\n",
 209                             __func__);
 210                 }
 211 #endif
 212                 ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);
 213             }
 214             break;
 215         case PPC970_INPUT_CKSTP:
 216             /* Level sensitive - active low */
 217             /* XXX: TODO: relay the signal to CKSTP_OUT pin */
 218             if (level) {
 219 #if defined(PPC_DEBUG_IRQ)
 220                 if (loglevel & CPU_LOG_INT) {
 221                     fprintf(logfile, "%s: stop the CPU\n", __func__);
 222                 }
 223 #endif
 224                 env->halted = 1;
 225             } else {
 226 #if defined(PPC_DEBUG_IRQ)
 227                 if (loglevel & CPU_LOG_INT) {
 228                     fprintf(logfile, "%s: restart the CPU\n", __func__);
 229                 }
 230 #endif
 231                 env->halted = 0;
 232             }
 233             break;
 234         case PPC970_INPUT_HRESET:
 235             /* Level sensitive - active low */
 236             if (level) {
 237 #if 0 // XXX: TOFIX
 238 #if defined(PPC_DEBUG_IRQ)
 239                 if (loglevel & CPU_LOG_INT) {
 240                     fprintf(logfile, "%s: reset the CPU\n", __func__);
 241                 }
 242 #endif
 243                 cpu_reset(env);
 244 #endif
 245             }
 246             break;
 247         case PPC970_INPUT_SRESET:
 248 #if defined(PPC_DEBUG_IRQ)
 249             if (loglevel & CPU_LOG_INT) {
 250                 fprintf(logfile, "%s: set the RESET IRQ state to %d\n",
 251                         __func__, level);
 252             }
 253 #endif
 254             ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
 255             break;
 256         case PPC970_INPUT_TBEN:
 257 #if defined(PPC_DEBUG_IRQ)
 258             if (loglevel & CPU_LOG_INT) {
 259                 fprintf(logfile, "%s: set the TBEN state to %d\n", __func__,
 260                         level);
 261             }
 262 #endif
 263             /* XXX: TODO */
 264             break;
 265         default:
 266             /* Unknown pin - do nothing */
 267 #if defined(PPC_DEBUG_IRQ)
 268             if (loglevel & CPU_LOG_INT) {
 269                 fprintf(logfile, "%s: unknown IRQ pin %d\n", __func__, pin);
 270             }
 271 #endif
 272             return;
 273         }
 274         if (level)
 275             env->irq_input_state |= 1 << pin;
 276         else
 277             env->irq_input_state &= ~(1 << pin);
 278     }
 279 }
 280
 281 void ppc970_irq_init (CPUState *env)
 282 {
 283     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc970_set_irq, env, 7);
 284 }
 285
 286 /* PowerPC 405 internal IRQ controller */
 287 static void ppc405_set_irq (void *opaque, int pin, int level)
 288 {
 289     CPUState *env = opaque;
 290     int cur_level;
 291
 292 #if defined(PPC_DEBUG_IRQ)
 293     if (loglevel & CPU_LOG_INT) {
 294         fprintf(logfile, "%s: env %p pin %d level %d\n", __func__,
 295                 env, pin, level);
 296     }
 297 #endif
 298     cur_level = (env->irq_input_state >> pin) & 1;
 299     /* Don't generate spurious events */
 300     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
 301         switch (pin) {
 302         case PPC405_INPUT_RESET_SYS:
 303             if (level) {
 304 #if defined(PPC_DEBUG_IRQ)
 305                 if (loglevel & CPU_LOG_INT) {
 306                     fprintf(logfile, "%s: reset the PowerPC system\n",
 307                             __func__);
 308                 }
 309 #endif
 310                 ppc40x_system_reset(env);
 311             }
 312             break;
 313         case PPC405_INPUT_RESET_CHIP:
 314             if (level) {
 315 #if defined(PPC_DEBUG_IRQ)
 316                 if (loglevel & CPU_LOG_INT) {
 317                     fprintf(logfile, "%s: reset the PowerPC chip\n", __func__);
 318                 }
 319 #endif
 320                 ppc40x_chip_reset(env);
 321             }
 322             break;
 323             /* No break here */
 324         case PPC405_INPUT_RESET_CORE:
 325             /* XXX: TODO: update DBSR[MRR] */
 326             if (level) {
 327 #if defined(PPC_DEBUG_IRQ)
 328                 if (loglevel & CPU_LOG_INT) {
 329                     fprintf(logfile, "%s: reset the PowerPC core\n", __func__);
 330                 }
 331 #endif
 332                 ppc40x_core_reset(env);
 333             }
 334             break;
 335         case PPC405_INPUT_CINT:
 336             /* Level sensitive - active high */
 337 #if defined(PPC_DEBUG_IRQ)
 338             if (loglevel & CPU_LOG_INT) {
 339                 fprintf(logfile, "%s: set the critical IRQ state to %d\n",
 340                         __func__, level);
 341             }
 342 #endif
 343             /* XXX: TOFIX */
 344             ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
 345             break;
 346         case PPC405_INPUT_INT:
 347             /* Level sensitive - active high */
 348 #if defined(PPC_DEBUG_IRQ)
 349             if (loglevel & CPU_LOG_INT) {
 350                 fprintf(logfile, "%s: set the external IRQ state to %d\n",
 351                         __func__, level);
 352             }
 353 #endif
 354             ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
 355             break;
 356         case PPC405_INPUT_HALT:
 357             /* Level sensitive - active low */
 358             if (level) {
 359 #if defined(PPC_DEBUG_IRQ)
 360                 if (loglevel & CPU_LOG_INT) {
 361                     fprintf(logfile, "%s: stop the CPU\n", __func__);
 362                 }
 363 #endif
 364                 env->halted = 1;
 365             } else {
 366 #if defined(PPC_DEBUG_IRQ)
 367                 if (loglevel & CPU_LOG_INT) {
 368                     fprintf(logfile, "%s: restart the CPU\n", __func__);
 369                 }
 370 #endif
 371                 env->halted = 0;
 372             }
 373             break;
 374         case PPC405_INPUT_DEBUG:
 375             /* Level sensitive - active high */
 376 #if defined(PPC_DEBUG_IRQ)
 377             if (loglevel & CPU_LOG_INT) {
 378                 fprintf(logfile, "%s: set the external IRQ state to %d\n",
 379                         __func__, level);
 380             }
 381 #endif
 382             ppc_set_irq(env, EXCP_40x_DEBUG, level);
 383             break;
 384         default:
 385             /* Unknown pin - do nothing */
 386 #if defined(PPC_DEBUG_IRQ)
 387             if (loglevel & CPU_LOG_INT) {
 388                 fprintf(logfile, "%s: unknown IRQ pin %d\n", __func__, pin);
 389             }
 390 #endif
 391             return;
 392         }
 393         if (level)
 394             env->irq_input_state |= 1 << pin;
 395         else
 396             env->irq_input_state &= ~(1 << pin);
 397     }
 398 }
 399
 400 void ppc405_irq_init (CPUState *env)
 401 {
 402     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc405_set_irq, env, 7);
 403 }
 404
 405 /*****************************************************************************/
 406 /* PowerPC time base and decrementer emulation */
 407 //#define DEBUG_TB
 408
 409 struct ppc_tb_t {
 410     /* Time base management */
 411     int64_t  tb_offset;    /* Compensation               */
 412     uint32_t tb_freq;      /* TB frequency               */
 413     /* Decrementer management */
 414     uint64_t decr_next;    /* Tick for next decr interrupt  */
 415     struct QEMUTimer *decr_timer;
 416     void *opaque;
 417 };
 418
 419 static inline uint64_t cpu_ppc_get_tb (ppc_tb_t *tb_env)
 420 {
 421     /* TB time in tb periods */
 422     return muldiv64(qemu_get_clock(vm_clock) + tb_env->tb_offset,
 423                     tb_env->tb_freq, ticks_per_sec);
 424 }
 425
 426 uint32_t cpu_ppc_load_tbl (CPUState *env)
 427 {
 428     ppc_tb_t *tb_env = env->tb_env;
 429     uint64_t tb;
 430
 431     tb = cpu_ppc_get_tb(tb_env);
 432 #ifdef DEBUG_TB
 433     {
 434         static int last_time;
 435         int now;
 436         now = time(NULL);
 437         if (last_time != now) {
 438             last_time = now;
 439             if (loglevel) {
 440                 fprintf(logfile, "%s: tb=0x%016lx %d %08lx\n",
 441                         __func__, tb, now, tb_env->tb_offset);
 442             }
 443         }
 444     }
 445 #endif
 446
 447     return tb & 0xFFFFFFFF;
 448 }
 449
 450 uint32_t cpu_ppc_load_tbu (CPUState *env)
 451 {
 452     ppc_tb_t *tb_env = env->tb_env;
 453     uint64_t tb;
 454
 455     tb = cpu_ppc_get_tb(tb_env);
 456 #ifdef DEBUG_TB
 457     if (loglevel) {
 458         fprintf(logfile, "%s: tb=0x%016lx\n", __func__, tb);
 459     }
 460 #endif
 461
 462     return tb >> 32;
 463 }
 464
 465 static void cpu_ppc_store_tb (ppc_tb_t *tb_env, uint64_t value)
 466 {
 467     tb_env->tb_offset = muldiv64(value, ticks_per_sec, tb_env->tb_freq)
 468         - qemu_get_clock(vm_clock);
 469 #ifdef DEBUG_TB
 470     if (loglevel) {
 471         fprintf(logfile, "%s: tb=0x%016lx offset=%08x\n", __func__, value);
 472     }
 473 #endif
 474 }
 475
 476 void cpu_ppc_store_tbu (CPUState *env, uint32_t value)
 477 {
 478     ppc_tb_t *tb_env = env->tb_env;
 479
 480     cpu_ppc_store_tb(tb_env,
 481                      ((uint64_t)value << 32) | cpu_ppc_load_tbl(env));
 482 }
 483
 484 void cpu_ppc_store_tbl (CPUState *env, uint32_t value)
 485 {
 486     ppc_tb_t *tb_env = env->tb_env;
 487
 488     cpu_ppc_store_tb(tb_env,
 489                      ((uint64_t)cpu_ppc_load_tbu(env) << 32) | value);
 490 }
 491
 492 uint32_t cpu_ppc_load_decr (CPUState *env)
 493 {
 494     ppc_tb_t *tb_env = env->tb_env;
 495     uint32_t decr;
 496     int64_t diff;
 497
 498     diff = tb_env->decr_next - qemu_get_clock(vm_clock);
 499     if (diff >= 0)
 500         decr = muldiv64(diff, tb_env->tb_freq, ticks_per_sec);
 501     else
 502         decr = -muldiv64(-diff, tb_env->tb_freq, ticks_per_sec);
 503 #if defined(DEBUG_TB)
 504     if (loglevel) {
 505         fprintf(logfile, "%s: 0x%08x\n", __func__, decr);
 506     }
 507 #endif
 508
 509     return decr;
 510 }
 511
 512 /* When decrementer expires,
 513  * all we need to do is generate or queue a CPU exception
 514  */
 515 static inline void cpu_ppc_decr_excp (CPUState *env)
 516 {
 517     /* Raise it */
 518 #ifdef DEBUG_TB
 519     if (loglevel) {
 520         fprintf(logfile, "raise decrementer exception\n");
 521     }
 522 #endif
 523     ppc_set_irq(env, PPC_INTERRUPT_DECR, 1);
 524 }
 525
 526 static void _cpu_ppc_store_decr (CPUState *env, uint32_t decr,
 527                                  uint32_t value, int is_excp)
 528 {
 529     ppc_tb_t *tb_env = env->tb_env;
 530     uint64_t now, next;
 531
 532 #ifdef DEBUG_TB
 533     if (loglevel) {
 534         fprintf(logfile, "%s: 0x%08x => 0x%08x\n", __func__, decr, value);
 535     }
 536 #endif
 537     now = qemu_get_clock(vm_clock);
 538     next = now + muldiv64(value, ticks_per_sec, tb_env->tb_freq);
 539     if (is_excp)
 540         next += tb_env->decr_next - now;
 541     if (next == now)
 542         next++;
 543     tb_env->decr_next = next;
 544     /* Adjust timer */
 545     qemu_mod_timer(tb_env->decr_timer, next);
 546     /* If we set a negative value and the decrementer was positive,
 547      * raise an exception.
 548      */
 549     if ((value & 0x80000000) && !(decr & 0x80000000))
 550         cpu_ppc_decr_excp(env);
 551 }
 552
 553 void cpu_ppc_store_decr (CPUState *env, uint32_t value)
 554 {
 555     _cpu_ppc_store_decr(env, cpu_ppc_load_decr(env), value, 0);
 556 }
 557
 558 static void cpu_ppc_decr_cb (void *opaque)
 559 {
 560     _cpu_ppc_store_decr(opaque, 0x00000000, 0xFFFFFFFF, 1);
 561 }
 562
 563 static void cpu_ppc_set_tb_clk (void *opaque, uint32_t freq)
 564 {
 565     CPUState *env = opaque;
 566     ppc_tb_t *tb_env = env->tb_env;
 567
 568     tb_env->tb_freq = freq;
 569     /* There is a bug in Linux 2.4 kernels:
 570      * if a decrementer exception is pending when it enables msr_ee at startup,
 571      * it's not ready to handle it...
 572      */
 573     _cpu_ppc_store_decr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
 574 }
 575
 576 /* Set up (once) timebase frequency (in Hz) */
 577 clk_setup_cb cpu_ppc_tb_init (CPUState *env, uint32_t freq)
 578 {
 579     ppc_tb_t *tb_env;
 580
 581     tb_env = qemu_mallocz(sizeof(ppc_tb_t));
 582     if (tb_env == NULL)
 583         return NULL;
 584     env->tb_env = tb_env;
 585     /* Create new timer */
 586     tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_ppc_decr_cb, env);
 587     cpu_ppc_set_tb_clk(env, freq);
 588
 589     return &cpu_ppc_set_tb_clk;
 590 }
 591
 592 /* Specific helpers for POWER & PowerPC 601 RTC */
 593 clk_setup_cb cpu_ppc601_rtc_init (CPUState *env)
 594 {
 595     return cpu_ppc_tb_init(env, 7812500);
 596 }
 597
 598 void cpu_ppc601_store_rtcu (CPUState *env, uint32_t value)
 599 __attribute__ (( alias ("cpu_ppc_store_tbu") ));
 600
 601 uint32_t cpu_ppc601_load_rtcu (CPUState *env)
 602 __attribute__ (( alias ("cpu_ppc_load_tbu") ));
 603
 604 void cpu_ppc601_store_rtcl (CPUState *env, uint32_t value)
 605 {
 606     cpu_ppc_store_tbl(env, value & 0x3FFFFF80);
 607 }
 608
 609 uint32_t cpu_ppc601_load_rtcl (CPUState *env)
 610 {
 611     return cpu_ppc_load_tbl(env) & 0x3FFFFF80;
 612 }
 613
 614 /*****************************************************************************/
 615 /* Embedded PowerPC timers */
 616
 617 /* PIT, FIT & WDT */
 618 typedef struct ppcemb_timer_t ppcemb_timer_t;
 619 struct ppcemb_timer_t {
 620     uint64_t pit_reload;  /* PIT auto-reload value        */
 621     uint64_t fit_next;    /* Tick for next FIT interrupt  */
 622     struct QEMUTimer *fit_timer;
 623     uint64_t wdt_next;    /* Tick for next WDT interrupt  */
 624     struct QEMUTimer *wdt_timer;
 625 };
 626
 627 /* Fixed interval timer */
 628 static void cpu_4xx_fit_cb (void *opaque)
 629 {
 630     CPUState *env;
 631     ppc_tb_t *tb_env;
 632     ppcemb_timer_t *ppcemb_timer;
 633     uint64_t now, next;
 634
 635     env = opaque;
 636     tb_env = env->tb_env;
 637     ppcemb_timer = tb_env->opaque;
 638     now = qemu_get_clock(vm_clock);
 639     switch ((env->spr[SPR_40x_TCR] >> 24) & 0x3) {
 640     case 0:
 641         next = 1 << 9;
 642         break;
 643     case 1:
 644         next = 1 << 13;
 645         break;
 646     case 2:
 647         next = 1 << 17;
 648         break;
 649     case 3:
 650         next = 1 << 21;
 651         break;
 652     default:
 653         /* Cannot occur, but makes gcc happy */
 654         return;
 655     }
 656     next = now + muldiv64(next, ticks_per_sec, tb_env->tb_freq);
 657     if (next == now)
 658         next++;
 659     qemu_mod_timer(ppcemb_timer->fit_timer, next);
 660     tb_env->decr_next = next;
 661     env->spr[SPR_40x_TSR] |= 1 << 26;
 662     if ((env->spr[SPR_40x_TCR] >> 23) & 0x1)
 663         ppc_set_irq(env, PPC_INTERRUPT_FIT, 1);
 664     if (loglevel) {
 665         fprintf(logfile, "%s: ir %d TCR " ADDRX " TSR " ADDRX "\n", __func__,
 666                 (int)((env->spr[SPR_40x_TCR] >> 23) & 0x1),
 667                 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
 668     }
 669 }
 670
 671 /* Programmable interval timer */
 672 static void cpu_4xx_pit_cb (void *opaque)
 673 {
 674     CPUState *env;
 675     ppc_tb_t *tb_env;
 676     ppcemb_timer_t *ppcemb_timer;
 677     uint64_t now, next;
 678
 679     env = opaque;
 680     tb_env = env->tb_env;
 681     ppcemb_timer = tb_env->opaque;
 682     now = qemu_get_clock(vm_clock);
 683     if ((env->spr[SPR_40x_TCR] >> 22) & 0x1) {
 684         /* Auto reload */
 685         next = now + muldiv64(ppcemb_timer->pit_reload,
 686                               ticks_per_sec, tb_env->tb_freq);
 687         if (next == now)
 688             next++;
 689         qemu_mod_timer(tb_env->decr_timer, next);
 690         tb_env->decr_next = next;
 691     }
 692     env->spr[SPR_40x_TSR] |= 1 << 27;
 693     if ((env->spr[SPR_40x_TCR] >> 26) & 0x1)
 694         ppc_set_irq(env, PPC_INTERRUPT_PIT, 1);
 695     if (loglevel) {
 696         fprintf(logfile, "%s: ar %d ir %d TCR " ADDRX " TSR " ADDRX " "
 697                 "%016" PRIx64 "\n", __func__,
 698                 (int)((env->spr[SPR_40x_TCR] >> 22) & 0x1),
 699                 (int)((env->spr[SPR_40x_TCR] >> 26) & 0x1),
 700                 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR],
 701                 ppcemb_timer->pit_reload);
 702     }
 703 }
 704
 705 /* Watchdog timer */
 706 static void cpu_4xx_wdt_cb (void *opaque)
 707 {
 708     CPUState *env;
 709     ppc_tb_t *tb_env;
 710     ppcemb_timer_t *ppcemb_timer;
 711     uint64_t now, next;
 712
 713     env = opaque;
 714     tb_env = env->tb_env;
 715     ppcemb_timer = tb_env->opaque;
 716     now = qemu_get_clock(vm_clock);
 717     switch ((env->spr[SPR_40x_TCR] >> 30) & 0x3) {
 718     case 0:
 719         next = 1 << 17;
 720         break;
 721     case 1:
 722         next = 1 << 21;
 723         break;
 724     case 2:
 725         next = 1 << 25;
 726         break;
 727     case 3:
 728         next = 1 << 29;
 729         break;
 730     default:
 731         /* Cannot occur, but makes gcc happy */
 732         return;
 733     }
 734     next = now + muldiv64(next, ticks_per_sec, tb_env->tb_freq);
 735     if (next == now)
 736         next++;
 737     if (loglevel) {
 738         fprintf(logfile, "%s: TCR " ADDRX " TSR " ADDRX "\n", __func__,
 739                 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
 740     }
 741     switch ((env->spr[SPR_40x_TSR] >> 30) & 0x3) {
 742     case 0x0:
 743     case 0x1:
 744         qemu_mod_timer(ppcemb_timer->wdt_timer, next);
 745         ppcemb_timer->wdt_next = next;
 746         env->spr[SPR_40x_TSR] |= 1 << 31;
 747         break;
 748     case 0x2:
 749         qemu_mod_timer(ppcemb_timer->wdt_timer, next);
 750         ppcemb_timer->wdt_next = next;
 751         env->spr[SPR_40x_TSR] |= 1 << 30;
 752         if ((env->spr[SPR_40x_TCR] >> 27) & 0x1)
 753             ppc_set_irq(env, PPC_INTERRUPT_WDT, 1);
 754         break;
 755     case 0x3:
 756         env->spr[SPR_40x_TSR] &= ~0x30000000;
 757         env->spr[SPR_40x_TSR] |= env->spr[SPR_40x_TCR] & 0x30000000;
 758         switch ((env->spr[SPR_40x_TCR] >> 28) & 0x3) {
 759         case 0x0:
 760             /* No reset */
 761             break;
 762         case 0x1: /* Core reset */
 763             ppc40x_core_reset(env);
 764             break;
 765         case 0x2: /* Chip reset */
 766             ppc40x_chip_reset(env);
 767             break;
 768         case 0x3: /* System reset */
 769             ppc40x_system_reset(env);
 770             break;
 771         }
 772     }
 773 }
 774
 775 void store_40x_pit (CPUState *env, target_ulong val)
 776 {
 777     ppc_tb_t *tb_env;
 778     ppcemb_timer_t *ppcemb_timer;
 779     uint64_t now, next;
 780
 781     tb_env = env->tb_env;
 782     ppcemb_timer = tb_env->opaque;
 783     if (loglevel) {
 784         fprintf(logfile, "%s %p %p\n", __func__, tb_env, ppcemb_timer);
 785     }
 786     ppcemb_timer->pit_reload = val;
 787     if (val == 0) {
 788         /* Stop PIT */
 789         if (loglevel) {
 790             fprintf(logfile, "%s: stop PIT\n", __func__);
 791         }
 792         qemu_del_timer(tb_env->decr_timer);
 793     } else {
 794         if (loglevel) {
 795             fprintf(logfile, "%s: start PIT 0x" ADDRX "\n", __func__, val);
 796         }
 797         now = qemu_get_clock(vm_clock);
 798         next = now + muldiv64(val, ticks_per_sec, tb_env->tb_freq);
 799          if (next == now)
 800             next++;
 801         qemu_mod_timer(tb_env->decr_timer, next);
 802         tb_env->decr_next = next;
 803     }
 804 }
 805
 806 target_ulong load_40x_pit (CPUState *env)
 807 {
 808     return cpu_ppc_load_decr(env);
 809 }
 810
 811 void store_booke_tsr (CPUState *env, target_ulong val)
 812 {
 813     env->spr[SPR_40x_TSR] = val & 0xFC000000;
 814 }
 815
 816 void store_booke_tcr (CPUState *env, target_ulong val)
 817 {
 818     env->spr[SPR_40x_TCR] = val & 0xFF800000;
 819     cpu_4xx_wdt_cb(env);
 820 }
 821
 822 clk_setup_cb ppc_emb_timers_init (CPUState *env, uint32_t freq)
 823 {
 824     ppc_tb_t *tb_env;
 825     ppcemb_timer_t *ppcemb_timer;
 826
 827     tb_env = qemu_mallocz(sizeof(ppc_tb_t));
 828     if (tb_env == NULL)
 829         return NULL;
 830     env->tb_env = tb_env;
 831     ppcemb_timer = qemu_mallocz(sizeof(ppcemb_timer_t));
 832     tb_env->tb_freq = freq;
 833     tb_env->opaque = ppcemb_timer;
 834     if (loglevel) {
 835         fprintf(logfile, "%s %p %p\n", __func__, tb_env, ppcemb_timer);
 836     }
 837     if (ppcemb_timer != NULL) {
 838         /* We use decr timer for PIT */
 839         tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_4xx_pit_cb, env);
 840         ppcemb_timer->fit_timer =
 841             qemu_new_timer(vm_clock, &cpu_4xx_fit_cb, env);
 842         ppcemb_timer->wdt_timer =
 843             qemu_new_timer(vm_clock, &cpu_4xx_wdt_cb, env);
 844     }
 845
 846     /* XXX: TODO: add callback for clock frequency change */
 847     return NULL;
 848 }
 849
 850 /*****************************************************************************/
 851 /* Embedded PowerPC Device Control Registers */
 852 typedef struct ppc_dcrn_t ppc_dcrn_t;
 853 struct ppc_dcrn_t {
 854     dcr_read_cb dcr_read;
 855     dcr_write_cb dcr_write;
 856     void *opaque;
 857 };
 858
 859 #define DCRN_NB 1024
 860 struct ppc_dcr_t {
 861     ppc_dcrn_t dcrn[DCRN_NB];
 862     int (*read_error)(int dcrn);
 863     int (*write_error)(int dcrn);
 864 };
 865
 866 int ppc_dcr_read (ppc_dcr_t *dcr_env, int dcrn, target_ulong *valp)
 867 {
 868     ppc_dcrn_t *dcr;
 869
 870     if (dcrn < 0 || dcrn >= DCRN_NB)
 871         goto error;
 872     dcr = &dcr_env->dcrn[dcrn];
 873     if (dcr->dcr_read == NULL)
 874         goto error;
 875     *valp = (*dcr->dcr_read)(dcr->opaque, dcrn);
 876
 877     return 0;
 878
 879  error:
 880     if (dcr_env->read_error != NULL)
 881         return (*dcr_env->read_error)(dcrn);
 882
 883     return -1;
 884 }
 885
 886 int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, target_ulong val)
 887 {
 888     ppc_dcrn_t *dcr;
 889
 890     if (dcrn < 0 || dcrn >= DCRN_NB)
 891         goto error;
 892     dcr = &dcr_env->dcrn[dcrn];
 893     if (dcr->dcr_write == NULL)
 894         goto error;
 895     (*dcr->dcr_write)(dcr->opaque, dcrn, val);
 896
 897     return 0;
 898
 899  error:
 900     if (dcr_env->write_error != NULL)
 901         return (*dcr_env->write_error)(dcrn);
 902
 903     return -1;
 904 }
 905
 906 int ppc_dcr_register (CPUState *env, int dcrn, void *opaque,
 907                       dcr_read_cb dcr_read, dcr_write_cb dcr_write)
 908 {
 909     ppc_dcr_t *dcr_env;
 910     ppc_dcrn_t *dcr;
 911
 912     dcr_env = env->dcr_env;
 913     if (dcr_env == NULL)
 914         return -1;
 915     if (dcrn < 0 || dcrn >= DCRN_NB)
 916         return -1;
 917     dcr = &dcr_env->dcrn[dcrn];
 918     if (dcr->opaque != NULL ||
 919         dcr->dcr_read != NULL ||
 920         dcr->dcr_write != NULL)
 921         return -1;
 922     dcr->opaque = opaque;
 923     dcr->dcr_read = dcr_read;
 924     dcr->dcr_write = dcr_write;
 925
 926     return 0;
 927 }
 928
 929 int ppc_dcr_init (CPUState *env, int (*read_error)(int dcrn),
 930                   int (*write_error)(int dcrn))
 931 {
 932     ppc_dcr_t *dcr_env;
 933
 934     dcr_env = qemu_mallocz(sizeof(ppc_dcr_t));
 935     if (dcr_env == NULL)
 936         return -1;
 937     dcr_env->read_error = read_error;
 938     dcr_env->write_error = write_error;
 939     env->dcr_env = dcr_env;
 940
 941     return 0;
 942 }
 943
 944
 945 #if 0
 946 /*****************************************************************************/
 947 /* Handle system reset (for now, just stop emulation) */
 948 void cpu_ppc_reset (CPUState *env)
 949 {
 950     printf("Reset asked... Stop emulation\n");
 951     abort();
 952 }
 953 #endif
 954
 955 /*****************************************************************************/
 956 /* Debug port */
 957 void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
 958 {
 959     addr &= 0xF;
 960     switch (addr) {
 961     case 0:
 962         printf("%c", val);
 963         break;
 964     case 1:
 965         printf("\n");
 966         fflush(stdout);
 967         break;
 968     case 2:
 969         printf("Set loglevel to %04x\n", val);
 970         cpu_set_log(val | 0x100);
 971         break;
 972     }
 973 }
 974
 975 /*****************************************************************************/
 976 /* NVRAM helpers */
 977 void NVRAM_set_byte (m48t59_t *nvram, uint32_t addr, uint8_t value)
 978 {
 979     m48t59_write(nvram, addr, value);
 980 }
 981
 982 uint8_t NVRAM_get_byte (m48t59_t *nvram, uint32_t addr)
 983 {
 984     return m48t59_read(nvram, addr);
 985 }
 986
 987 void NVRAM_set_word (m48t59_t *nvram, uint32_t addr, uint16_t value)
 988 {
 989     m48t59_write(nvram, addr, value >> 8);
 990     m48t59_write(nvram, addr + 1, value & 0xFF);
 991 }
 992
 993 uint16_t NVRAM_get_word (m48t59_t *nvram, uint32_t addr)
 994 {
 995     uint16_t tmp;
 996
 997     tmp = m48t59_read(nvram, addr) << 8;
 998     tmp |= m48t59_read(nvram, addr + 1);
 999     return tmp;
1000 }
1001
1002 void NVRAM_set_lword (m48t59_t *nvram, uint32_t addr, uint32_t value)
1003 {
1004     m48t59_write(nvram, addr, value >> 24);
1005     m48t59_write(nvram, addr + 1, (value >> 16) & 0xFF);
1006     m48t59_write(nvram, addr + 2, (value >> 8) & 0xFF);
1007     m48t59_write(nvram, addr + 3, value & 0xFF);
1008 }
1009
1010 uint32_t NVRAM_get_lword (m48t59_t *nvram, uint32_t addr)
1011 {
1012     uint32_t tmp;
1013
1014     tmp = m48t59_read(nvram, addr) << 24;
1015     tmp |= m48t59_read(nvram, addr + 1) << 16;
1016     tmp |= m48t59_read(nvram, addr + 2) << 8;
1017     tmp |= m48t59_read(nvram, addr + 3);
1018
1019     return tmp;
1020 }
1021
1022 void NVRAM_set_string (m48t59_t *nvram, uint32_t addr,
1023                        const unsigned char *str, uint32_t max)
1024 {
1025     int i;
1026
1027     for (i = 0; i < max && str[i] != '\0'; i++) {
1028         m48t59_write(nvram, addr + i, str[i]);
1029     }
1030     m48t59_write(nvram, addr + max - 1, '\0');
1031 }
1032
1033 int NVRAM_get_string (m48t59_t *nvram, uint8_t *dst, uint16_t addr, int max)
1034 {
1035     int i;
1036
1037     memset(dst, 0, max);
1038     for (i = 0; i < max; i++) {
1039         dst[i] = NVRAM_get_byte(nvram, addr + i);
1040         if (dst[i] == '\0')
1041             break;
1042     }
1043
1044     return i;
1045 }
1046
1047 static uint16_t NVRAM_crc_update (uint16_t prev, uint16_t value)
1048 {
1049     uint16_t tmp;
1050     uint16_t pd, pd1, pd2;
1051
1052     tmp = prev >> 8;
1053     pd = prev ^ value;
1054     pd1 = pd & 0x000F;
1055     pd2 = ((pd >> 4) & 0x000F) ^ pd1;
1056     tmp ^= (pd1 << 3) | (pd1 << 8);
1057     tmp ^= pd2 | (pd2 << 7) | (pd2 << 12);
1058
1059     return tmp;
1060 }
1061
1062 uint16_t NVRAM_compute_crc (m48t59_t *nvram, uint32_t start, uint32_t count)
1063 {
1064     uint32_t i;
1065     uint16_t crc = 0xFFFF;
1066     int odd;
1067
1068     odd = count & 1;
1069     count &= ~1;
1070     for (i = 0; i != count; i++) {
1071         crc = NVRAM_crc_update(crc, NVRAM_get_word(nvram, start + i));
1072     }
1073     if (odd) {
1074         crc = NVRAM_crc_update(crc, NVRAM_get_byte(nvram, start + i) << 8);
1075     }
1076
1077     return crc;
1078 }
1079
1080 #define CMDLINE_ADDR 0x017ff000
1081
1082 int PPC_NVRAM_set_params (m48t59_t *nvram, uint16_t NVRAM_size,
1083                           const unsigned char *arch,
1084                           uint32_t RAM_size, int boot_device,
1085                           uint32_t kernel_image, uint32_t kernel_size,
1086                           const char *cmdline,
1087                           uint32_t initrd_image, uint32_t initrd_size,
1088                           uint32_t NVRAM_image,
1089                           int width, int height, int depth)
1090 {
1091     uint16_t crc;
1092
1093     /* Set parameters for Open Hack'Ware BIOS */
1094     NVRAM_set_string(nvram, 0x00, "QEMU_BIOS", 16);
1095     NVRAM_set_lword(nvram,  0x10, 0x00000002); /* structure v2 */
1096     NVRAM_set_word(nvram,   0x14, NVRAM_size);
1097     NVRAM_set_string(nvram, 0x20, arch, 16);
1098     NVRAM_set_lword(nvram,  0x30, RAM_size);
1099     NVRAM_set_byte(nvram,   0x34, boot_device);
1100     NVRAM_set_lword(nvram,  0x38, kernel_image);
1101     NVRAM_set_lword(nvram,  0x3C, kernel_size);
1102     if (cmdline) {
1103         /* XXX: put the cmdline in NVRAM too ? */
1104         strcpy(phys_ram_base + CMDLINE_ADDR, cmdline);
1105         NVRAM_set_lword(nvram,  0x40, CMDLINE_ADDR);
1106         NVRAM_set_lword(nvram,  0x44, strlen(cmdline));
1107     } else {
1108         NVRAM_set_lword(nvram,  0x40, 0);
1109         NVRAM_set_lword(nvram,  0x44, 0);
1110     }
1111     NVRAM_set_lword(nvram,  0x48, initrd_image);
1112     NVRAM_set_lword(nvram,  0x4C, initrd_size);
1113     NVRAM_set_lword(nvram,  0x50, NVRAM_image);
1114
1115     NVRAM_set_word(nvram,   0x54, width);
1116     NVRAM_set_word(nvram,   0x56, height);
1117     NVRAM_set_word(nvram,   0x58, depth);
1118     crc = NVRAM_compute_crc(nvram, 0x00, 0xF8);
1119     NVRAM_set_word(nvram,  0xFC, crc);
1120
1121     return 0;
1122 }