hw/ppc.c

   1 /*
   2  * QEMU generic PowerPC hardware System Emulator
   3  *
   4  * Copyright (c) 2003-2007 Jocelyn Mayer
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "hw.h"
  25 #include "ppc.h"
  26 #include "qemu-timer.h"
  27 #include "sysemu.h"
  28 #include "nvram.h"
  29 #include "qemu-log.h"
  30 #include "loader.h"
  31 #include "kvm.h"
  32 #include "kvm_ppc.h"
  33
  34 //#define PPC_DEBUG_IRQ
  35 //#define PPC_DEBUG_TB
  36
  37 #ifdef PPC_DEBUG_IRQ
  38 #  define LOG_IRQ(...) qemu_log_mask(CPU_LOG_INT, ## __VA_ARGS__)
  39 #else
  40 #  define LOG_IRQ(...) do { } while (0)
  41 #endif
  42
  43
  44 #ifdef PPC_DEBUG_TB
  45 #  define LOG_TB(...) qemu_log(__VA_ARGS__)
  46 #else
  47 #  define LOG_TB(...) do { } while (0)
  48 #endif
  49
  50 static void cpu_ppc_tb_stop (CPUPPCState *env);
  51 static void cpu_ppc_tb_start (CPUPPCState *env);
  52
  53 void ppc_set_irq(CPUPPCState *env, int n_IRQ, int level)
  54 {
  55     unsigned int old_pending = env->pending_interrupts;
  56
  57     if (level) {
  58         env->pending_interrupts |= 1 << n_IRQ;
  59         cpu_interrupt(env, CPU_INTERRUPT_HARD);
  60     } else {
  61         env->pending_interrupts &= ~(1 << n_IRQ);
  62         if (env->pending_interrupts == 0)
  63             cpu_reset_interrupt(env, CPU_INTERRUPT_HARD);
  64     }
  65
  66     if (old_pending != env->pending_interrupts) {
  67 #ifdef CONFIG_KVM
  68         kvmppc_set_interrupt(env, n_IRQ, level);
  69 #endif
  70     }
  71
  72     LOG_IRQ("%s: %p n_IRQ %d level %d => pending %08" PRIx32
  73                 "req %08x\n", __func__, env, n_IRQ, level,
  74                 env->pending_interrupts, env->interrupt_request);
  75 }
  76
  77 /* PowerPC 6xx / 7xx internal IRQ controller */
  78 static void ppc6xx_set_irq(void *opaque, int pin, int level)
  79 {
  80     PowerPCCPU *cpu = opaque;
  81     CPUPPCState *env = &cpu->env;
  82     int cur_level;
  83
  84     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
  85                 env, pin, level);
  86     cur_level = (env->irq_input_state >> pin) & 1;
  87     /* Don't generate spurious events */
  88     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
  89         switch (pin) {
  90         case PPC6xx_INPUT_TBEN:
  91             /* Level sensitive - active high */
  92             LOG_IRQ("%s: %s the time base\n",
  93                         __func__, level ? "start" : "stop");
  94             if (level) {
  95                 cpu_ppc_tb_start(env);
  96             } else {
  97                 cpu_ppc_tb_stop(env);
  98             }
  99         case PPC6xx_INPUT_INT:
 100             /* Level sensitive - active high */
 101             LOG_IRQ("%s: set the external IRQ state to %d\n",
 102                         __func__, level);
 103             ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
 104             break;
 105         case PPC6xx_INPUT_SMI:
 106             /* Level sensitive - active high */
 107             LOG_IRQ("%s: set the SMI IRQ state to %d\n",
 108                         __func__, level);
 109             ppc_set_irq(env, PPC_INTERRUPT_SMI, level);
 110             break;
 111         case PPC6xx_INPUT_MCP:
 112             /* Negative edge sensitive */
 113             /* XXX: TODO: actual reaction may depends on HID0 status
 114              *            603/604/740/750: check HID0[EMCP]
 115              */
 116             if (cur_level == 1 && level == 0) {
 117                 LOG_IRQ("%s: raise machine check state\n",
 118                             __func__);
 119                 ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);
 120             }
 121             break;
 122         case PPC6xx_INPUT_CKSTP_IN:
 123             /* Level sensitive - active low */
 124             /* XXX: TODO: relay the signal to CKSTP_OUT pin */
 125             /* XXX: Note that the only way to restart the CPU is to reset it */
 126             if (level) {
 127                 LOG_IRQ("%s: stop the CPU\n", __func__);
 128                 env->halted = 1;
 129             }
 130             break;
 131         case PPC6xx_INPUT_HRESET:
 132             /* Level sensitive - active low */
 133             if (level) {
 134                 LOG_IRQ("%s: reset the CPU\n", __func__);
 135                 cpu_interrupt(env, CPU_INTERRUPT_RESET);
 136             }
 137             break;
 138         case PPC6xx_INPUT_SRESET:
 139             LOG_IRQ("%s: set the RESET IRQ state to %d\n",
 140                         __func__, level);
 141             ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
 142             break;
 143         default:
 144             /* Unknown pin - do nothing */
 145             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 146             return;
 147         }
 148         if (level)
 149             env->irq_input_state |= 1 << pin;
 150         else
 151             env->irq_input_state &= ~(1 << pin);
 152     }
 153 }
 154
 155 void ppc6xx_irq_init(CPUPPCState *env)
 156 {
 157     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 158
 159     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc6xx_set_irq, cpu,
 160                                                   PPC6xx_INPUT_NB);
 161 }
 162
 163 #if defined(TARGET_PPC64)
 164 /* PowerPC 970 internal IRQ controller */
 165 static void ppc970_set_irq(void *opaque, int pin, int level)
 166 {
 167     PowerPCCPU *cpu = opaque;
 168     CPUPPCState *env = &cpu->env;
 169     int cur_level;
 170
 171     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
 172                 env, pin, level);
 173     cur_level = (env->irq_input_state >> pin) & 1;
 174     /* Don't generate spurious events */
 175     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
 176         switch (pin) {
 177         case PPC970_INPUT_INT:
 178             /* Level sensitive - active high */
 179             LOG_IRQ("%s: set the external IRQ state to %d\n",
 180                         __func__, level);
 181             ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
 182             break;
 183         case PPC970_INPUT_THINT:
 184             /* Level sensitive - active high */
 185             LOG_IRQ("%s: set the SMI IRQ state to %d\n", __func__,
 186                         level);
 187             ppc_set_irq(env, PPC_INTERRUPT_THERM, level);
 188             break;
 189         case PPC970_INPUT_MCP:
 190             /* Negative edge sensitive */
 191             /* XXX: TODO: actual reaction may depends on HID0 status
 192              *            603/604/740/750: check HID0[EMCP]
 193              */
 194             if (cur_level == 1 && level == 0) {
 195                 LOG_IRQ("%s: raise machine check state\n",
 196                             __func__);
 197                 ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);
 198             }
 199             break;
 200         case PPC970_INPUT_CKSTP:
 201             /* Level sensitive - active low */
 202             /* XXX: TODO: relay the signal to CKSTP_OUT pin */
 203             if (level) {
 204                 LOG_IRQ("%s: stop the CPU\n", __func__);
 205                 env->halted = 1;
 206             } else {
 207                 LOG_IRQ("%s: restart the CPU\n", __func__);
 208                 env->halted = 0;
 209                 qemu_cpu_kick(CPU(cpu));
 210             }
 211             break;
 212         case PPC970_INPUT_HRESET:
 213             /* Level sensitive - active low */
 214             if (level) {
 215                 cpu_interrupt(env, CPU_INTERRUPT_RESET);
 216             }
 217             break;
 218         case PPC970_INPUT_SRESET:
 219             LOG_IRQ("%s: set the RESET IRQ state to %d\n",
 220                         __func__, level);
 221             ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
 222             break;
 223         case PPC970_INPUT_TBEN:
 224             LOG_IRQ("%s: set the TBEN state to %d\n", __func__,
 225                         level);
 226             /* XXX: TODO */
 227             break;
 228         default:
 229             /* Unknown pin - do nothing */
 230             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 231             return;
 232         }
 233         if (level)
 234             env->irq_input_state |= 1 << pin;
 235         else
 236             env->irq_input_state &= ~(1 << pin);
 237     }
 238 }
 239
 240 void ppc970_irq_init(CPUPPCState *env)
 241 {
 242     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 243
 244     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc970_set_irq, cpu,
 245                                                   PPC970_INPUT_NB);
 246 }
 247
 248 /* POWER7 internal IRQ controller */
 249 static void power7_set_irq(void *opaque, int pin, int level)
 250 {
 251     PowerPCCPU *cpu = opaque;
 252     CPUPPCState *env = &cpu->env;
 253
 254     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
 255                 env, pin, level);
 256
 257     switch (pin) {
 258     case POWER7_INPUT_INT:
 259         /* Level sensitive - active high */
 260         LOG_IRQ("%s: set the external IRQ state to %d\n",
 261                 __func__, level);
 262         ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
 263         break;
 264     default:
 265         /* Unknown pin - do nothing */
 266         LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 267         return;
 268     }
 269     if (level) {
 270         env->irq_input_state |= 1 << pin;
 271     } else {
 272         env->irq_input_state &= ~(1 << pin);
 273     }
 274 }
 275
 276 void ppcPOWER7_irq_init(CPUPPCState *env)
 277 {
 278     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 279
 280     env->irq_inputs = (void **)qemu_allocate_irqs(&power7_set_irq, cpu,
 281                                                   POWER7_INPUT_NB);
 282 }
 283 #endif /* defined(TARGET_PPC64) */
 284
 285 /* PowerPC 40x internal IRQ controller */
 286 static void ppc40x_set_irq(void *opaque, int pin, int level)
 287 {
 288     PowerPCCPU *cpu = opaque;
 289     CPUPPCState *env = &cpu->env;
 290     int cur_level;
 291
 292     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
 293                 env, pin, level);
 294     cur_level = (env->irq_input_state >> pin) & 1;
 295     /* Don't generate spurious events */
 296     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
 297         switch (pin) {
 298         case PPC40x_INPUT_RESET_SYS:
 299             if (level) {
 300                 LOG_IRQ("%s: reset the PowerPC system\n",
 301                             __func__);
 302                 ppc40x_system_reset(env);
 303             }
 304             break;
 305         case PPC40x_INPUT_RESET_CHIP:
 306             if (level) {
 307                 LOG_IRQ("%s: reset the PowerPC chip\n", __func__);
 308                 ppc40x_chip_reset(env);
 309             }
 310             break;
 311         case PPC40x_INPUT_RESET_CORE:
 312             /* XXX: TODO: update DBSR[MRR] */
 313             if (level) {
 314                 LOG_IRQ("%s: reset the PowerPC core\n", __func__);
 315                 ppc40x_core_reset(env);
 316             }
 317             break;
 318         case PPC40x_INPUT_CINT:
 319             /* Level sensitive - active high */
 320             LOG_IRQ("%s: set the critical IRQ state to %d\n",
 321                         __func__, level);
 322             ppc_set_irq(env, PPC_INTERRUPT_CEXT, level);
 323             break;
 324         case PPC40x_INPUT_INT:
 325             /* Level sensitive - active high */
 326             LOG_IRQ("%s: set the external IRQ state to %d\n",
 327                         __func__, level);
 328             ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
 329             break;
 330         case PPC40x_INPUT_HALT:
 331             /* Level sensitive - active low */
 332             if (level) {
 333                 LOG_IRQ("%s: stop the CPU\n", __func__);
 334                 env->halted = 1;
 335             } else {
 336                 LOG_IRQ("%s: restart the CPU\n", __func__);
 337                 env->halted = 0;
 338                 qemu_cpu_kick(CPU(cpu));
 339             }
 340             break;
 341         case PPC40x_INPUT_DEBUG:
 342             /* Level sensitive - active high */
 343             LOG_IRQ("%s: set the debug pin state to %d\n",
 344                         __func__, level);
 345             ppc_set_irq(env, PPC_INTERRUPT_DEBUG, level);
 346             break;
 347         default:
 348             /* Unknown pin - do nothing */
 349             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 350             return;
 351         }
 352         if (level)
 353             env->irq_input_state |= 1 << pin;
 354         else
 355             env->irq_input_state &= ~(1 << pin);
 356     }
 357 }
 358
 359 void ppc40x_irq_init(CPUPPCState *env)
 360 {
 361     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 362
 363     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc40x_set_irq,
 364                                                   cpu, PPC40x_INPUT_NB);
 365 }
 366
 367 /* PowerPC E500 internal IRQ controller */
 368 static void ppce500_set_irq(void *opaque, int pin, int level)
 369 {
 370     PowerPCCPU *cpu = opaque;
 371     CPUPPCState *env = &cpu->env;
 372     int cur_level;
 373
 374     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
 375                 env, pin, level);
 376     cur_level = (env->irq_input_state >> pin) & 1;
 377     /* Don't generate spurious events */
 378     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
 379         switch (pin) {
 380         case PPCE500_INPUT_MCK:
 381             if (level) {
 382                 LOG_IRQ("%s: reset the PowerPC system\n",
 383                             __func__);
 384                 qemu_system_reset_request();
 385             }
 386             break;
 387         case PPCE500_INPUT_RESET_CORE:
 388             if (level) {
 389                 LOG_IRQ("%s: reset the PowerPC core\n", __func__);
 390                 ppc_set_irq(env, PPC_INTERRUPT_MCK, level);
 391             }
 392             break;
 393         case PPCE500_INPUT_CINT:
 394             /* Level sensitive - active high */
 395             LOG_IRQ("%s: set the critical IRQ state to %d\n",
 396                         __func__, level);
 397             ppc_set_irq(env, PPC_INTERRUPT_CEXT, level);
 398             break;
 399         case PPCE500_INPUT_INT:
 400             /* Level sensitive - active high */
 401             LOG_IRQ("%s: set the core IRQ state to %d\n",
 402                         __func__, level);
 403             ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
 404             break;
 405         case PPCE500_INPUT_DEBUG:
 406             /* Level sensitive - active high */
 407             LOG_IRQ("%s: set the debug pin state to %d\n",
 408                         __func__, level);
 409             ppc_set_irq(env, PPC_INTERRUPT_DEBUG, level);
 410             break;
 411         default:
 412             /* Unknown pin - do nothing */
 413             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 414             return;
 415         }
 416         if (level)
 417             env->irq_input_state |= 1 << pin;
 418         else
 419             env->irq_input_state &= ~(1 << pin);
 420     }
 421 }
 422
 423 void ppce500_irq_init(CPUPPCState *env)
 424 {
 425     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 426
 427     env->irq_inputs = (void **)qemu_allocate_irqs(&ppce500_set_irq,
 428                                                   cpu, PPCE500_INPUT_NB);
 429 }
 430 /*****************************************************************************/
 431 /* PowerPC time base and decrementer emulation */
 432
 433 uint64_t cpu_ppc_get_tb(ppc_tb_t *tb_env, uint64_t vmclk, int64_t tb_offset)
 434 {
 435     /* TB time in tb periods */
 436     return muldiv64(vmclk, tb_env->tb_freq, get_ticks_per_sec()) + tb_offset;
 437 }
 438
 439 uint64_t cpu_ppc_load_tbl (CPUPPCState *env)
 440 {
 441     ppc_tb_t *tb_env = env->tb_env;
 442     uint64_t tb;
 443
 444     if (kvm_enabled()) {
 445         return env->spr[SPR_TBL];
 446     }
 447
 448     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->tb_offset);
 449     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 450
 451     return tb;
 452 }
 453
 454 static inline uint32_t _cpu_ppc_load_tbu(CPUPPCState *env)
 455 {
 456     ppc_tb_t *tb_env = env->tb_env;
 457     uint64_t tb;
 458
 459     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->tb_offset);
 460     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 461
 462     return tb >> 32;
 463 }
 464
 465 uint32_t cpu_ppc_load_tbu (CPUPPCState *env)
 466 {
 467     if (kvm_enabled()) {
 468         return env->spr[SPR_TBU];
 469     }
 470
 471     return _cpu_ppc_load_tbu(env);
 472 }
 473
 474 static inline void cpu_ppc_store_tb(ppc_tb_t *tb_env, uint64_t vmclk,
 475                                     int64_t *tb_offsetp, uint64_t value)
 476 {
 477     *tb_offsetp = value - muldiv64(vmclk, tb_env->tb_freq, get_ticks_per_sec());
 478     LOG_TB("%s: tb %016" PRIx64 " offset %08" PRIx64 "\n",
 479                 __func__, value, *tb_offsetp);
 480 }
 481
 482 void cpu_ppc_store_tbl (CPUPPCState *env, uint32_t value)
 483 {
 484     ppc_tb_t *tb_env = env->tb_env;
 485     uint64_t tb;
 486
 487     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->tb_offset);
 488     tb &= 0xFFFFFFFF00000000ULL;
 489     cpu_ppc_store_tb(tb_env, qemu_get_clock_ns(vm_clock),
 490                      &tb_env->tb_offset, tb | (uint64_t)value);
 491 }
 492
 493 static inline void _cpu_ppc_store_tbu(CPUPPCState *env, uint32_t value)
 494 {
 495     ppc_tb_t *tb_env = env->tb_env;
 496     uint64_t tb;
 497
 498     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->tb_offset);
 499     tb &= 0x00000000FFFFFFFFULL;
 500     cpu_ppc_store_tb(tb_env, qemu_get_clock_ns(vm_clock),
 501                      &tb_env->tb_offset, ((uint64_t)value << 32) | tb);
 502 }
 503
 504 void cpu_ppc_store_tbu (CPUPPCState *env, uint32_t value)
 505 {
 506     _cpu_ppc_store_tbu(env, value);
 507 }
 508
 509 uint64_t cpu_ppc_load_atbl (CPUPPCState *env)
 510 {
 511     ppc_tb_t *tb_env = env->tb_env;
 512     uint64_t tb;
 513
 514     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->atb_offset);
 515     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 516
 517     return tb;
 518 }
 519
 520 uint32_t cpu_ppc_load_atbu (CPUPPCState *env)
 521 {
 522     ppc_tb_t *tb_env = env->tb_env;
 523     uint64_t tb;
 524
 525     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->atb_offset);
 526     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 527
 528     return tb >> 32;
 529 }
 530
 531 void cpu_ppc_store_atbl (CPUPPCState *env, uint32_t value)
 532 {
 533     ppc_tb_t *tb_env = env->tb_env;
 534     uint64_t tb;
 535
 536     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->atb_offset);
 537     tb &= 0xFFFFFFFF00000000ULL;
 538     cpu_ppc_store_tb(tb_env, qemu_get_clock_ns(vm_clock),
 539                      &tb_env->atb_offset, tb | (uint64_t)value);
 540 }
 541
 542 void cpu_ppc_store_atbu (CPUPPCState *env, uint32_t value)
 543 {
 544     ppc_tb_t *tb_env = env->tb_env;
 545     uint64_t tb;
 546
 547     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->atb_offset);
 548     tb &= 0x00000000FFFFFFFFULL;
 549     cpu_ppc_store_tb(tb_env, qemu_get_clock_ns(vm_clock),
 550                      &tb_env->atb_offset, ((uint64_t)value << 32) | tb);
 551 }
 552
 553 static void cpu_ppc_tb_stop (CPUPPCState *env)
 554 {
 555     ppc_tb_t *tb_env = env->tb_env;
 556     uint64_t tb, atb, vmclk;
 557
 558     /* If the time base is already frozen, do nothing */
 559     if (tb_env->tb_freq != 0) {
 560         vmclk = qemu_get_clock_ns(vm_clock);
 561         /* Get the time base */
 562         tb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->tb_offset);
 563         /* Get the alternate time base */
 564         atb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->atb_offset);
 565         /* Store the time base value (ie compute the current offset) */
 566         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
 567         /* Store the alternate time base value (compute the current offset) */
 568         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
 569         /* Set the time base frequency to zero */
 570         tb_env->tb_freq = 0;
 571         /* Now, the time bases are frozen to tb_offset / atb_offset value */
 572     }
 573 }
 574
 575 static void cpu_ppc_tb_start (CPUPPCState *env)
 576 {
 577     ppc_tb_t *tb_env = env->tb_env;
 578     uint64_t tb, atb, vmclk;
 579
 580     /* If the time base is not frozen, do nothing */
 581     if (tb_env->tb_freq == 0) {
 582         vmclk = qemu_get_clock_ns(vm_clock);
 583         /* Get the time base from tb_offset */
 584         tb = tb_env->tb_offset;
 585         /* Get the alternate time base from atb_offset */
 586         atb = tb_env->atb_offset;
 587         /* Restore the tb frequency from the decrementer frequency */
 588         tb_env->tb_freq = tb_env->decr_freq;
 589         /* Store the time base value */
 590         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
 591         /* Store the alternate time base value */
 592         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
 593     }
 594 }
 595
 596 static inline uint32_t _cpu_ppc_load_decr(CPUPPCState *env, uint64_t next)
 597 {
 598     ppc_tb_t *tb_env = env->tb_env;
 599     uint32_t decr;
 600     int64_t diff;
 601
 602     diff = next - qemu_get_clock_ns(vm_clock);
 603     if (diff >= 0) {
 604         decr = muldiv64(diff, tb_env->decr_freq, get_ticks_per_sec());
 605     } else if (tb_env->flags & PPC_TIMER_BOOKE) {
 606         decr = 0;
 607     }  else {
 608         decr = -muldiv64(-diff, tb_env->decr_freq, get_ticks_per_sec());
 609     }
 610     LOG_TB("%s: %08" PRIx32 "\n", __func__, decr);
 611
 612     return decr;
 613 }
 614
 615 uint32_t cpu_ppc_load_decr (CPUPPCState *env)
 616 {
 617     ppc_tb_t *tb_env = env->tb_env;
 618
 619     if (kvm_enabled()) {
 620         return env->spr[SPR_DECR];
 621     }
 622
 623     return _cpu_ppc_load_decr(env, tb_env->decr_next);
 624 }
 625
 626 uint32_t cpu_ppc_load_hdecr (CPUPPCState *env)
 627 {
 628     ppc_tb_t *tb_env = env->tb_env;
 629
 630     return _cpu_ppc_load_decr(env, tb_env->hdecr_next);
 631 }
 632
 633 uint64_t cpu_ppc_load_purr (CPUPPCState *env)
 634 {
 635     ppc_tb_t *tb_env = env->tb_env;
 636     uint64_t diff;
 637
 638     diff = qemu_get_clock_ns(vm_clock) - tb_env->purr_start;
 639
 640     return tb_env->purr_load + muldiv64(diff, tb_env->tb_freq, get_ticks_per_sec());
 641 }
 642
 643 /* When decrementer expires,
 644  * all we need to do is generate or queue a CPU exception
 645  */
 646 static inline void cpu_ppc_decr_excp(CPUPPCState *env)
 647 {
 648     /* Raise it */
 649     LOG_TB("raise decrementer exception\n");
 650     ppc_set_irq(env, PPC_INTERRUPT_DECR, 1);
 651 }
 652
 653 static inline void cpu_ppc_hdecr_excp(CPUPPCState *env)
 654 {
 655     /* Raise it */
 656     LOG_TB("raise decrementer exception\n");
 657     ppc_set_irq(env, PPC_INTERRUPT_HDECR, 1);
 658 }
 659
 660 static void __cpu_ppc_store_decr (CPUPPCState *env, uint64_t *nextp,
 661                                   struct QEMUTimer *timer,
 662                                   void (*raise_excp)(CPUPPCState *),
 663                                   uint32_t decr, uint32_t value,
 664                                   int is_excp)
 665 {
 666     ppc_tb_t *tb_env = env->tb_env;
 667     uint64_t now, next;
 668
 669     LOG_TB("%s: %08" PRIx32 " => %08" PRIx32 "\n", __func__,
 670                 decr, value);
 671
 672     if (kvm_enabled()) {
 673         /* KVM handles decrementer exceptions, we don't need our own timer */
 674         return;
 675     }
 676
 677     now = qemu_get_clock_ns(vm_clock);
 678     next = now + muldiv64(value, get_ticks_per_sec(), tb_env->decr_freq);
 679     if (is_excp) {
 680         next += *nextp - now;
 681     }
 682     if (next == now) {
 683         next++;
 684     }
 685     *nextp = next;
 686     /* Adjust timer */
 687     qemu_mod_timer(timer, next);
 688
 689     /* If we set a negative value and the decrementer was positive, raise an
 690      * exception.
 691      */
 692     if ((tb_env->flags & PPC_DECR_UNDERFLOW_TRIGGERED)
 693         && (value & 0x80000000)
 694         && !(decr & 0x80000000)) {
 695         (*raise_excp)(env);
 696     }
 697 }
 698
 699 static inline void _cpu_ppc_store_decr(CPUPPCState *env, uint32_t decr,
 700                                        uint32_t value, int is_excp)
 701 {
 702     ppc_tb_t *tb_env = env->tb_env;
 703
 704     __cpu_ppc_store_decr(env, &tb_env->decr_next, tb_env->decr_timer,
 705                          &cpu_ppc_decr_excp, decr, value, is_excp);
 706 }
 707
 708 void cpu_ppc_store_decr (CPUPPCState *env, uint32_t value)
 709 {
 710     _cpu_ppc_store_decr(env, cpu_ppc_load_decr(env), value, 0);
 711 }
 712
 713 static void cpu_ppc_decr_cb (void *opaque)
 714 {
 715     _cpu_ppc_store_decr(opaque, 0x00000000, 0xFFFFFFFF, 1);
 716 }
 717
 718 static inline void _cpu_ppc_store_hdecr(CPUPPCState *env, uint32_t hdecr,
 719                                         uint32_t value, int is_excp)
 720 {
 721     ppc_tb_t *tb_env = env->tb_env;
 722
 723     if (tb_env->hdecr_timer != NULL) {
 724         __cpu_ppc_store_decr(env, &tb_env->hdecr_next, tb_env->hdecr_timer,
 725                              &cpu_ppc_hdecr_excp, hdecr, value, is_excp);
 726     }
 727 }
 728
 729 void cpu_ppc_store_hdecr (CPUPPCState *env, uint32_t value)
 730 {
 731     _cpu_ppc_store_hdecr(env, cpu_ppc_load_hdecr(env), value, 0);
 732 }
 733
 734 static void cpu_ppc_hdecr_cb (void *opaque)
 735 {
 736     _cpu_ppc_store_hdecr(opaque, 0x00000000, 0xFFFFFFFF, 1);
 737 }
 738
 739 static void cpu_ppc_store_purr(CPUPPCState *env, uint64_t value)
 740 {
 741     ppc_tb_t *tb_env = env->tb_env;
 742
 743     tb_env->purr_load = value;
 744     tb_env->purr_start = qemu_get_clock_ns(vm_clock);
 745 }
 746
 747 static void cpu_ppc_set_tb_clk (void *opaque, uint32_t freq)
 748 {
 749     CPUPPCState *env = opaque;
 750     ppc_tb_t *tb_env = env->tb_env;
 751
 752     tb_env->tb_freq = freq;
 753     tb_env->decr_freq = freq;
 754     /* There is a bug in Linux 2.4 kernels:
 755      * if a decrementer exception is pending when it enables msr_ee at startup,
 756      * it's not ready to handle it...
 757      */
 758     _cpu_ppc_store_decr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
 759     _cpu_ppc_store_hdecr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
 760     cpu_ppc_store_purr(env, 0x0000000000000000ULL);
 761 }
 762
 763 /* Set up (once) timebase frequency (in Hz) */
 764 clk_setup_cb cpu_ppc_tb_init (CPUPPCState *env, uint32_t freq)
 765 {
 766     ppc_tb_t *tb_env;
 767
 768     tb_env = g_malloc0(sizeof(ppc_tb_t));
 769     env->tb_env = tb_env;
 770     tb_env->flags = PPC_DECR_UNDERFLOW_TRIGGERED;
 771     /* Create new timer */
 772     tb_env->decr_timer = qemu_new_timer_ns(vm_clock, &cpu_ppc_decr_cb, env);
 773     if (0) {
 774         /* XXX: find a suitable condition to enable the hypervisor decrementer
 775          */
 776         tb_env->hdecr_timer = qemu_new_timer_ns(vm_clock, &cpu_ppc_hdecr_cb, env);
 777     } else {
 778         tb_env->hdecr_timer = NULL;
 779     }
 780     cpu_ppc_set_tb_clk(env, freq);
 781
 782     return &cpu_ppc_set_tb_clk;
 783 }
 784
 785 /* Specific helpers for POWER & PowerPC 601 RTC */
 786 #if 0
 787 static clk_setup_cb cpu_ppc601_rtc_init (CPUPPCState *env)
 788 {
 789     return cpu_ppc_tb_init(env, 7812500);
 790 }
 791 #endif
 792
 793 void cpu_ppc601_store_rtcu (CPUPPCState *env, uint32_t value)
 794 {
 795     _cpu_ppc_store_tbu(env, value);
 796 }
 797
 798 uint32_t cpu_ppc601_load_rtcu (CPUPPCState *env)
 799 {
 800     return _cpu_ppc_load_tbu(env);
 801 }
 802
 803 void cpu_ppc601_store_rtcl (CPUPPCState *env, uint32_t value)
 804 {
 805     cpu_ppc_store_tbl(env, value & 0x3FFFFF80);
 806 }
 807
 808 uint32_t cpu_ppc601_load_rtcl (CPUPPCState *env)
 809 {
 810     return cpu_ppc_load_tbl(env) & 0x3FFFFF80;
 811 }
 812
 813 /*****************************************************************************/
 814 /* PowerPC 40x timers */
 815
 816 /* PIT, FIT & WDT */
 817 typedef struct ppc40x_timer_t ppc40x_timer_t;
 818 struct ppc40x_timer_t {
 819     uint64_t pit_reload;  /* PIT auto-reload value        */
 820     uint64_t fit_next;    /* Tick for next FIT interrupt  */
 821     struct QEMUTimer *fit_timer;
 822     uint64_t wdt_next;    /* Tick for next WDT interrupt  */
 823     struct QEMUTimer *wdt_timer;
 824
 825     /* 405 have the PIT, 440 have a DECR.  */
 826     unsigned int decr_excp;
 827 };
 828
 829 /* Fixed interval timer */
 830 static void cpu_4xx_fit_cb (void *opaque)
 831 {
 832     CPUPPCState *env;
 833     ppc_tb_t *tb_env;
 834     ppc40x_timer_t *ppc40x_timer;
 835     uint64_t now, next;
 836
 837     env = opaque;
 838     tb_env = env->tb_env;
 839     ppc40x_timer = tb_env->opaque;
 840     now = qemu_get_clock_ns(vm_clock);
 841     switch ((env->spr[SPR_40x_TCR] >> 24) & 0x3) {
 842     case 0:
 843         next = 1 << 9;
 844         break;
 845     case 1:
 846         next = 1 << 13;
 847         break;
 848     case 2:
 849         next = 1 << 17;
 850         break;
 851     case 3:
 852         next = 1 << 21;
 853         break;
 854     default:
 855         /* Cannot occur, but makes gcc happy */
 856         return;
 857     }
 858     next = now + muldiv64(next, get_ticks_per_sec(), tb_env->tb_freq);
 859     if (next == now)
 860         next++;
 861     qemu_mod_timer(ppc40x_timer->fit_timer, next);
 862     env->spr[SPR_40x_TSR] |= 1 << 26;
 863     if ((env->spr[SPR_40x_TCR] >> 23) & 0x1)
 864         ppc_set_irq(env, PPC_INTERRUPT_FIT, 1);
 865     LOG_TB("%s: ir %d TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx "\n", __func__,
 866            (int)((env->spr[SPR_40x_TCR] >> 23) & 0x1),
 867            env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
 868 }
 869
 870 /* Programmable interval timer */
 871 static void start_stop_pit (CPUPPCState *env, ppc_tb_t *tb_env, int is_excp)
 872 {
 873     ppc40x_timer_t *ppc40x_timer;
 874     uint64_t now, next;
 875
 876     ppc40x_timer = tb_env->opaque;
 877     if (ppc40x_timer->pit_reload <= 1 ||
 878         !((env->spr[SPR_40x_TCR] >> 26) & 0x1) ||
 879         (is_excp && !((env->spr[SPR_40x_TCR] >> 22) & 0x1))) {
 880         /* Stop PIT */
 881         LOG_TB("%s: stop PIT\n", __func__);
 882         qemu_del_timer(tb_env->decr_timer);
 883     } else {
 884         LOG_TB("%s: start PIT %016" PRIx64 "\n",
 885                     __func__, ppc40x_timer->pit_reload);
 886         now = qemu_get_clock_ns(vm_clock);
 887         next = now + muldiv64(ppc40x_timer->pit_reload,
 888                               get_ticks_per_sec(), tb_env->decr_freq);
 889         if (is_excp)
 890             next += tb_env->decr_next - now;
 891         if (next == now)
 892             next++;
 893         qemu_mod_timer(tb_env->decr_timer, next);
 894         tb_env->decr_next = next;
 895     }
 896 }
 897
 898 static void cpu_4xx_pit_cb (void *opaque)
 899 {
 900     CPUPPCState *env;
 901     ppc_tb_t *tb_env;
 902     ppc40x_timer_t *ppc40x_timer;
 903
 904     env = opaque;
 905     tb_env = env->tb_env;
 906     ppc40x_timer = tb_env->opaque;
 907     env->spr[SPR_40x_TSR] |= 1 << 27;
 908     if ((env->spr[SPR_40x_TCR] >> 26) & 0x1)
 909         ppc_set_irq(env, ppc40x_timer->decr_excp, 1);
 910     start_stop_pit(env, tb_env, 1);
 911     LOG_TB("%s: ar %d ir %d TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx " "
 912            "%016" PRIx64 "\n", __func__,
 913            (int)((env->spr[SPR_40x_TCR] >> 22) & 0x1),
 914            (int)((env->spr[SPR_40x_TCR] >> 26) & 0x1),
 915            env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR],
 916            ppc40x_timer->pit_reload);
 917 }
 918
 919 /* Watchdog timer */
 920 static void cpu_4xx_wdt_cb (void *opaque)
 921 {
 922     CPUPPCState *env;
 923     ppc_tb_t *tb_env;
 924     ppc40x_timer_t *ppc40x_timer;
 925     uint64_t now, next;
 926
 927     env = opaque;
 928     tb_env = env->tb_env;
 929     ppc40x_timer = tb_env->opaque;
 930     now = qemu_get_clock_ns(vm_clock);
 931     switch ((env->spr[SPR_40x_TCR] >> 30) & 0x3) {
 932     case 0:
 933         next = 1 << 17;
 934         break;
 935     case 1:
 936         next = 1 << 21;
 937         break;
 938     case 2:
 939         next = 1 << 25;
 940         break;
 941     case 3:
 942         next = 1 << 29;
 943         break;
 944     default:
 945         /* Cannot occur, but makes gcc happy */
 946         return;
 947     }
 948     next = now + muldiv64(next, get_ticks_per_sec(), tb_env->decr_freq);
 949     if (next == now)
 950         next++;
 951     LOG_TB("%s: TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx "\n", __func__,
 952            env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
 953     switch ((env->spr[SPR_40x_TSR] >> 30) & 0x3) {
 954     case 0x0:
 955     case 0x1:
 956         qemu_mod_timer(ppc40x_timer->wdt_timer, next);
 957         ppc40x_timer->wdt_next = next;
 958         env->spr[SPR_40x_TSR] |= 1 << 31;
 959         break;
 960     case 0x2:
 961         qemu_mod_timer(ppc40x_timer->wdt_timer, next);
 962         ppc40x_timer->wdt_next = next;
 963         env->spr[SPR_40x_TSR] |= 1 << 30;
 964         if ((env->spr[SPR_40x_TCR] >> 27) & 0x1)
 965             ppc_set_irq(env, PPC_INTERRUPT_WDT, 1);
 966         break;
 967     case 0x3:
 968         env->spr[SPR_40x_TSR] &= ~0x30000000;
 969         env->spr[SPR_40x_TSR] |= env->spr[SPR_40x_TCR] & 0x30000000;
 970         switch ((env->spr[SPR_40x_TCR] >> 28) & 0x3) {
 971         case 0x0:
 972             /* No reset */
 973             break;
 974         case 0x1: /* Core reset */
 975             ppc40x_core_reset(env);
 976             break;
 977         case 0x2: /* Chip reset */
 978             ppc40x_chip_reset(env);
 979             break;
 980         case 0x3: /* System reset */
 981             ppc40x_system_reset(env);
 982             break;
 983         }
 984     }
 985 }
 986
 987 void store_40x_pit (CPUPPCState *env, target_ulong val)
 988 {
 989     ppc_tb_t *tb_env;
 990     ppc40x_timer_t *ppc40x_timer;
 991
 992     tb_env = env->tb_env;
 993     ppc40x_timer = tb_env->opaque;
 994     LOG_TB("%s val" TARGET_FMT_lx "\n", __func__, val);
 995     ppc40x_timer->pit_reload = val;
 996     start_stop_pit(env, tb_env, 0);
 997 }
 998
 999 target_ulong load_40x_pit (CPUPPCState *env)
1000 {
1001     return cpu_ppc_load_decr(env);
1002 }
1003
1004 static void ppc_40x_set_tb_clk (void *opaque, uint32_t freq)
1005 {
1006     CPUPPCState *env = opaque;
1007     ppc_tb_t *tb_env = env->tb_env;
1008
1009     LOG_TB("%s set new frequency to %" PRIu32 "\n", __func__,
1010                 freq);
1011     tb_env->tb_freq = freq;
1012     tb_env->decr_freq = freq;
1013     /* XXX: we should also update all timers */
1014 }
1015
1016 clk_setup_cb ppc_40x_timers_init (CPUPPCState *env, uint32_t freq,
1017                                   unsigned int decr_excp)
1018 {
1019     ppc_tb_t *tb_env;
1020     ppc40x_timer_t *ppc40x_timer;
1021
1022     tb_env = g_malloc0(sizeof(ppc_tb_t));
1023     env->tb_env = tb_env;
1024     tb_env->flags = PPC_DECR_UNDERFLOW_TRIGGERED;
1025     ppc40x_timer = g_malloc0(sizeof(ppc40x_timer_t));
1026     tb_env->tb_freq = freq;
1027     tb_env->decr_freq = freq;
1028     tb_env->opaque = ppc40x_timer;
1029     LOG_TB("%s freq %" PRIu32 "\n", __func__, freq);
1030     if (ppc40x_timer != NULL) {
1031         /* We use decr timer for PIT */
1032         tb_env->decr_timer = qemu_new_timer_ns(vm_clock, &cpu_4xx_pit_cb, env);
1033         ppc40x_timer->fit_timer =
1034             qemu_new_timer_ns(vm_clock, &cpu_4xx_fit_cb, env);
1035         ppc40x_timer->wdt_timer =
1036             qemu_new_timer_ns(vm_clock, &cpu_4xx_wdt_cb, env);
1037         ppc40x_timer->decr_excp = decr_excp;
1038     }
1039
1040     return &ppc_40x_set_tb_clk;
1041 }
1042
1043 /*****************************************************************************/
1044 /* Embedded PowerPC Device Control Registers */
1045 typedef struct ppc_dcrn_t ppc_dcrn_t;
1046 struct ppc_dcrn_t {
1047     dcr_read_cb dcr_read;
1048     dcr_write_cb dcr_write;
1049     void *opaque;
1050 };
1051
1052 /* XXX: on 460, DCR addresses are 32 bits wide,
1053  *      using DCRIPR to get the 22 upper bits of the DCR address
1054  */
1055 #define DCRN_NB 1024
1056 struct ppc_dcr_t {
1057     ppc_dcrn_t dcrn[DCRN_NB];
1058     int (*read_error)(int dcrn);
1059     int (*write_error)(int dcrn);
1060 };
1061
1062 int ppc_dcr_read (ppc_dcr_t *dcr_env, int dcrn, uint32_t *valp)
1063 {
1064     ppc_dcrn_t *dcr;
1065
1066     if (dcrn < 0 || dcrn >= DCRN_NB)
1067         goto error;
1068     dcr = &dcr_env->dcrn[dcrn];
1069     if (dcr->dcr_read == NULL)
1070         goto error;
1071     *valp = (*dcr->dcr_read)(dcr->opaque, dcrn);
1072
1073     return 0;
1074
1075  error:
1076     if (dcr_env->read_error != NULL)
1077         return (*dcr_env->read_error)(dcrn);
1078
1079     return -1;
1080 }
1081
1082 int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, uint32_t val)
1083 {
1084     ppc_dcrn_t *dcr;
1085
1086     if (dcrn < 0 || dcrn >= DCRN_NB)
1087         goto error;
1088     dcr = &dcr_env->dcrn[dcrn];
1089     if (dcr->dcr_write == NULL)
1090         goto error;
1091     (*dcr->dcr_write)(dcr->opaque, dcrn, val);
1092
1093     return 0;
1094
1095  error:
1096     if (dcr_env->write_error != NULL)
1097         return (*dcr_env->write_error)(dcrn);
1098
1099     return -1;
1100 }
1101
1102 int ppc_dcr_register (CPUPPCState *env, int dcrn, void *opaque,
1103                       dcr_read_cb dcr_read, dcr_write_cb dcr_write)
1104 {
1105     ppc_dcr_t *dcr_env;
1106     ppc_dcrn_t *dcr;
1107
1108     dcr_env = env->dcr_env;
1109     if (dcr_env == NULL)
1110         return -1;
1111     if (dcrn < 0 || dcrn >= DCRN_NB)
1112         return -1;
1113     dcr = &dcr_env->dcrn[dcrn];
1114     if (dcr->opaque != NULL ||
1115         dcr->dcr_read != NULL ||
1116         dcr->dcr_write != NULL)
1117         return -1;
1118     dcr->opaque = opaque;
1119     dcr->dcr_read = dcr_read;
1120     dcr->dcr_write = dcr_write;
1121
1122     return 0;
1123 }
1124
1125 int ppc_dcr_init (CPUPPCState *env, int (*read_error)(int dcrn),
1126                   int (*write_error)(int dcrn))
1127 {
1128     ppc_dcr_t *dcr_env;
1129
1130     dcr_env = g_malloc0(sizeof(ppc_dcr_t));
1131     dcr_env->read_error = read_error;
1132     dcr_env->write_error = write_error;
1133     env->dcr_env = dcr_env;
1134
1135     return 0;
1136 }
1137
1138 /*****************************************************************************/
1139 /* Debug port */
1140 void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
1141 {
1142     addr &= 0xF;
1143     switch (addr) {
1144     case 0:
1145         printf("%c", val);
1146         break;
1147     case 1:
1148         printf("\n");
1149         fflush(stdout);
1150         break;
1151     case 2:
1152         printf("Set loglevel to %04" PRIx32 "\n", val);
1153         cpu_set_log(val | 0x100);
1154         break;
1155     }
1156 }
1157
1158 /*****************************************************************************/
1159 /* NVRAM helpers */
1160 static inline uint32_t nvram_read (nvram_t *nvram, uint32_t addr)
1161 {
1162     return (*nvram->read_fn)(nvram->opaque, addr);
1163 }
1164
1165 static inline void nvram_write (nvram_t *nvram, uint32_t addr, uint32_t val)
1166 {
1167     (*nvram->write_fn)(nvram->opaque, addr, val);
1168 }
1169
1170 static void NVRAM_set_byte(nvram_t *nvram, uint32_t addr, uint8_t value)
1171 {
1172     nvram_write(nvram, addr, value);
1173 }
1174
1175 static uint8_t NVRAM_get_byte(nvram_t *nvram, uint32_t addr)
1176 {
1177     return nvram_read(nvram, addr);
1178 }
1179
1180 static void NVRAM_set_word(nvram_t *nvram, uint32_t addr, uint16_t value)
1181 {
1182     nvram_write(nvram, addr, value >> 8);
1183     nvram_write(nvram, addr + 1, value & 0xFF);
1184 }
1185
1186 static uint16_t NVRAM_get_word(nvram_t *nvram, uint32_t addr)
1187 {
1188     uint16_t tmp;
1189
1190     tmp = nvram_read(nvram, addr) << 8;
1191     tmp |= nvram_read(nvram, addr + 1);
1192
1193     return tmp;
1194 }
1195
1196 static void NVRAM_set_lword(nvram_t *nvram, uint32_t addr, uint32_t value)
1197 {
1198     nvram_write(nvram, addr, value >> 24);
1199     nvram_write(nvram, addr + 1, (value >> 16) & 0xFF);
1200     nvram_write(nvram, addr + 2, (value >> 8) & 0xFF);
1201     nvram_write(nvram, addr + 3, value & 0xFF);
1202 }
1203
1204 uint32_t NVRAM_get_lword (nvram_t *nvram, uint32_t addr)
1205 {
1206     uint32_t tmp;
1207
1208     tmp = nvram_read(nvram, addr) << 24;
1209     tmp |= nvram_read(nvram, addr + 1) << 16;
1210     tmp |= nvram_read(nvram, addr + 2) << 8;
1211     tmp |= nvram_read(nvram, addr + 3);
1212
1213     return tmp;
1214 }
1215
1216 static void NVRAM_set_string(nvram_t *nvram, uint32_t addr, const char *str,
1217                              uint32_t max)
1218 {
1219     int i;
1220
1221     for (i = 0; i < max && str[i] != '\0'; i++) {
1222         nvram_write(nvram, addr + i, str[i]);
1223     }
1224     nvram_write(nvram, addr + i, str[i]);
1225     nvram_write(nvram, addr + max - 1, '\0');
1226 }
1227
1228 int NVRAM_get_string (nvram_t *nvram, uint8_t *dst, uint16_t addr, int max)
1229 {
1230     int i;
1231
1232     memset(dst, 0, max);
1233     for (i = 0; i < max; i++) {
1234         dst[i] = NVRAM_get_byte(nvram, addr + i);
1235         if (dst[i] == '\0')
1236             break;
1237     }
1238
1239     return i;
1240 }
1241
1242 static uint16_t NVRAM_crc_update (uint16_t prev, uint16_t value)
1243 {
1244     uint16_t tmp;
1245     uint16_t pd, pd1, pd2;
1246
1247     tmp = prev >> 8;
1248     pd = prev ^ value;
1249     pd1 = pd & 0x000F;
1250     pd2 = ((pd >> 4) & 0x000F) ^ pd1;
1251     tmp ^= (pd1 << 3) | (pd1 << 8);
1252     tmp ^= pd2 | (pd2 << 7) | (pd2 << 12);
1253
1254     return tmp;
1255 }
1256
1257 static uint16_t NVRAM_compute_crc (nvram_t *nvram, uint32_t start, uint32_t count)
1258 {
1259     uint32_t i;
1260     uint16_t crc = 0xFFFF;
1261     int odd;
1262
1263     odd = count & 1;
1264     count &= ~1;
1265     for (i = 0; i != count; i++) {
1266         crc = NVRAM_crc_update(crc, NVRAM_get_word(nvram, start + i));
1267     }
1268     if (odd) {
1269         crc = NVRAM_crc_update(crc, NVRAM_get_byte(nvram, start + i) << 8);
1270     }
1271
1272     return crc;
1273 }
1274
1275 #define CMDLINE_ADDR 0x017ff000
1276
1277 int PPC_NVRAM_set_params (nvram_t *nvram, uint16_t NVRAM_size,
1278                           const char *arch,
1279                           uint32_t RAM_size, int boot_device,
1280                           uint32_t kernel_image, uint32_t kernel_size,
1281                           const char *cmdline,
1282                           uint32_t initrd_image, uint32_t initrd_size,
1283                           uint32_t NVRAM_image,
1284                           int width, int height, int depth)
1285 {
1286     uint16_t crc;
1287
1288     /* Set parameters for Open Hack'Ware BIOS */
1289     NVRAM_set_string(nvram, 0x00, "QEMU_BIOS", 16);
1290     NVRAM_set_lword(nvram,  0x10, 0x00000002); /* structure v2 */
1291     NVRAM_set_word(nvram,   0x14, NVRAM_size);
1292     NVRAM_set_string(nvram, 0x20, arch, 16);
1293     NVRAM_set_lword(nvram,  0x30, RAM_size);
1294     NVRAM_set_byte(nvram,   0x34, boot_device);
1295     NVRAM_set_lword(nvram,  0x38, kernel_image);
1296     NVRAM_set_lword(nvram,  0x3C, kernel_size);
1297     if (cmdline) {
1298         /* XXX: put the cmdline in NVRAM too ? */
1299         pstrcpy_targphys("cmdline", CMDLINE_ADDR, RAM_size - CMDLINE_ADDR, cmdline);
1300         NVRAM_set_lword(nvram,  0x40, CMDLINE_ADDR);
1301         NVRAM_set_lword(nvram,  0x44, strlen(cmdline));
1302     } else {
1303         NVRAM_set_lword(nvram,  0x40, 0);
1304         NVRAM_set_lword(nvram,  0x44, 0);
1305     }
1306     NVRAM_set_lword(nvram,  0x48, initrd_image);
1307     NVRAM_set_lword(nvram,  0x4C, initrd_size);
1308     NVRAM_set_lword(nvram,  0x50, NVRAM_image);
1309
1310     NVRAM_set_word(nvram,   0x54, width);
1311     NVRAM_set_word(nvram,   0x56, height);
1312     NVRAM_set_word(nvram,   0x58, depth);
1313     crc = NVRAM_compute_crc(nvram, 0x00, 0xF8);
1314     NVRAM_set_word(nvram,   0xFC, crc);
1315
1316     return 0;
1317 }