ppc.c 36.1 KB
Newer Older
1
/*
2
 * QEMU generic PowerPC hardware System Emulator
3
 *
4
 * Copyright (c) 2003-2007 Jocelyn Mayer
5
 *
6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
P
pbrook 已提交
24 25 26 27 28
#include "hw.h"
#include "ppc.h"
#include "qemu-timer.h"
#include "sysemu.h"
#include "nvram.h"
B
blueswir1 已提交
29
#include "qemu-log.h"
30

31
//#define PPC_DEBUG_IRQ
J
j_mayer 已提交
32
//#define PPC_DEBUG_TB
33

34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52
#ifdef PPC_DEBUG_IRQ
#  define LOG_IRQ(...) do {              \
     if (loglevel & CPU_LOG_INT)         \
       fprintf(logfile, ## __VA_ARGS__); \
   } while (0)
#else
#  define LOG_IRQ(...) do { } while (0)
#endif


#ifdef PPC_DEBUG_TB
#  define LOG_TB(...) do {               \
     if (loglevel)                       \
       fprintf(logfile, ## __VA_ARGS__); \
   } while (0)
#else
#  define LOG_TB(...) do { } while (0)
#endif

J
j_mayer 已提交
53 54 55
static void cpu_ppc_tb_stop (CPUState *env);
static void cpu_ppc_tb_start (CPUState *env);

J
j_mayer 已提交
56
static void ppc_set_irq (CPUState *env, int n_IRQ, int level)
57 58 59 60 61 62 63 64 65
{
    if (level) {
        env->pending_interrupts |= 1 << n_IRQ;
        cpu_interrupt(env, CPU_INTERRUPT_HARD);
    } else {
        env->pending_interrupts &= ~(1 << n_IRQ);
        if (env->pending_interrupts == 0)
            cpu_reset_interrupt(env, CPU_INTERRUPT_HARD);
    }
66
    LOG_IRQ("%s: %p n_IRQ %d level %d => pending %08" PRIx32
67
                "req %08x\n", __func__, env, n_IRQ, level,
68
                env->pending_interrupts, env->interrupt_request);
69 70
}

71 72
/* PowerPC 6xx / 7xx internal IRQ controller */
static void ppc6xx_set_irq (void *opaque, int pin, int level)
P
pbrook 已提交
73
{
74 75
    CPUState *env = opaque;
    int cur_level;
P
pbrook 已提交
76

77
    LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
78
                env, pin, level);
79 80
    cur_level = (env->irq_input_state >> pin) & 1;
    /* Don't generate spurious events */
81
    if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
82
        switch (pin) {
J
j_mayer 已提交
83 84
        case PPC6xx_INPUT_TBEN:
            /* Level sensitive - active high */
85
            LOG_IRQ("%s: %s the time base\n",
J
j_mayer 已提交
86 87 88 89 90 91
                        __func__, level ? "start" : "stop");
            if (level) {
                cpu_ppc_tb_start(env);
            } else {
                cpu_ppc_tb_stop(env);
            }
92 93
        case PPC6xx_INPUT_INT:
            /* Level sensitive - active high */
94
            LOG_IRQ("%s: set the external IRQ state to %d\n",
95
                        __func__, level);
96 97
            ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
            break;
98
        case PPC6xx_INPUT_SMI:
99
            /* Level sensitive - active high */
100
            LOG_IRQ("%s: set the SMI IRQ state to %d\n",
101
                        __func__, level);
102 103
            ppc_set_irq(env, PPC_INTERRUPT_SMI, level);
            break;
104
        case PPC6xx_INPUT_MCP:
105 106 107 108 109
            /* Negative edge sensitive */
            /* XXX: TODO: actual reaction may depends on HID0 status
             *            603/604/740/750: check HID0[EMCP]
             */
            if (cur_level == 1 && level == 0) {
110
                LOG_IRQ("%s: raise machine check state\n",
111
                            __func__);
112 113 114
                ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);
            }
            break;
115
        case PPC6xx_INPUT_CKSTP_IN:
116 117
            /* Level sensitive - active low */
            /* XXX: TODO: relay the signal to CKSTP_OUT pin */
118
            /* XXX: Note that the only way to restart the CPU is to reset it */
119
            if (level) {
120
                LOG_IRQ("%s: stop the CPU\n", __func__);
121 122 123
                env->halted = 1;
            }
            break;
124
        case PPC6xx_INPUT_HRESET:
125 126
            /* Level sensitive - active low */
            if (level) {
127
                LOG_IRQ("%s: reset the CPU\n", __func__);
128 129 130 131 132 133
                env->interrupt_request |= CPU_INTERRUPT_EXITTB;
                /* XXX: TOFIX */
#if 0
                cpu_ppc_reset(env);
#else
                qemu_system_reset_request();
134 135 136
#endif
            }
            break;
137
        case PPC6xx_INPUT_SRESET:
138
            LOG_IRQ("%s: set the RESET IRQ state to %d\n",
139
                        __func__, level);
140 141 142 143
            ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
            break;
        default:
            /* Unknown pin - do nothing */
144
            LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
145 146 147 148 149 150
            return;
        }
        if (level)
            env->irq_input_state |= 1 << pin;
        else
            env->irq_input_state &= ~(1 << pin);
P
pbrook 已提交
151 152 153
    }
}

154
void ppc6xx_irq_init (CPUState *env)
155
{
156 157
    env->irq_inputs = (void **)qemu_allocate_irqs(&ppc6xx_set_irq, env,
                                                  PPC6xx_INPUT_NB);
158 159
}

J
j_mayer 已提交
160
#if defined(TARGET_PPC64)
161 162 163 164 165 166
/* PowerPC 970 internal IRQ controller */
static void ppc970_set_irq (void *opaque, int pin, int level)
{
    CPUState *env = opaque;
    int cur_level;

167
    LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
168 169 170 171 172 173 174
                env, pin, level);
    cur_level = (env->irq_input_state >> pin) & 1;
    /* Don't generate spurious events */
    if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
        switch (pin) {
        case PPC970_INPUT_INT:
            /* Level sensitive - active high */
175
            LOG_IRQ("%s: set the external IRQ state to %d\n",
176 177 178 179 180
                        __func__, level);
            ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
            break;
        case PPC970_INPUT_THINT:
            /* Level sensitive - active high */
181
            LOG_IRQ("%s: set the SMI IRQ state to %d\n", __func__,
182 183 184 185 186 187 188 189 190
                        level);
            ppc_set_irq(env, PPC_INTERRUPT_THERM, level);
            break;
        case PPC970_INPUT_MCP:
            /* Negative edge sensitive */
            /* XXX: TODO: actual reaction may depends on HID0 status
             *            603/604/740/750: check HID0[EMCP]
             */
            if (cur_level == 1 && level == 0) {
191
                LOG_IRQ("%s: raise machine check state\n",
192 193 194 195 196 197 198 199
                            __func__);
                ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);
            }
            break;
        case PPC970_INPUT_CKSTP:
            /* Level sensitive - active low */
            /* XXX: TODO: relay the signal to CKSTP_OUT pin */
            if (level) {
200
                LOG_IRQ("%s: stop the CPU\n", __func__);
201 202
                env->halted = 1;
            } else {
203
                LOG_IRQ("%s: restart the CPU\n", __func__);
204 205 206 207 208 209 210
                env->halted = 0;
            }
            break;
        case PPC970_INPUT_HRESET:
            /* Level sensitive - active low */
            if (level) {
#if 0 // XXX: TOFIX
211
                LOG_IRQ("%s: reset the CPU\n", __func__);
212 213 214 215 216
                cpu_reset(env);
#endif
            }
            break;
        case PPC970_INPUT_SRESET:
217
            LOG_IRQ("%s: set the RESET IRQ state to %d\n",
218 219 220 221
                        __func__, level);
            ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
            break;
        case PPC970_INPUT_TBEN:
222
            LOG_IRQ("%s: set the TBEN state to %d\n", __func__,
223 224 225 226 227
                        level);
            /* XXX: TODO */
            break;
        default:
            /* Unknown pin - do nothing */
228
            LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
229 230 231 232 233 234 235 236 237 238 239
            return;
        }
        if (level)
            env->irq_input_state |= 1 << pin;
        else
            env->irq_input_state &= ~(1 << pin);
    }
}

void ppc970_irq_init (CPUState *env)
{
240 241
    env->irq_inputs = (void **)qemu_allocate_irqs(&ppc970_set_irq, env,
                                                  PPC970_INPUT_NB);
242
}
J
j_mayer 已提交
243
#endif /* defined(TARGET_PPC64) */
244

245 246
/* PowerPC 40x internal IRQ controller */
static void ppc40x_set_irq (void *opaque, int pin, int level)
247 248 249 250
{
    CPUState *env = opaque;
    int cur_level;

251
    LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
252
                env, pin, level);
253 254 255 256
    cur_level = (env->irq_input_state >> pin) & 1;
    /* Don't generate spurious events */
    if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
        switch (pin) {
257
        case PPC40x_INPUT_RESET_SYS:
258
            if (level) {
259
                LOG_IRQ("%s: reset the PowerPC system\n",
260 261 262 263
                            __func__);
                ppc40x_system_reset(env);
            }
            break;
264
        case PPC40x_INPUT_RESET_CHIP:
265
            if (level) {
266
                LOG_IRQ("%s: reset the PowerPC chip\n", __func__);
267 268 269
                ppc40x_chip_reset(env);
            }
            break;
270
        case PPC40x_INPUT_RESET_CORE:
271 272
            /* XXX: TODO: update DBSR[MRR] */
            if (level) {
273
                LOG_IRQ("%s: reset the PowerPC core\n", __func__);
274
                ppc40x_core_reset(env);
275 276
            }
            break;
277
        case PPC40x_INPUT_CINT:
278
            /* Level sensitive - active high */
279
            LOG_IRQ("%s: set the critical IRQ state to %d\n",
280
                        __func__, level);
281
            ppc_set_irq(env, PPC_INTERRUPT_CEXT, level);
282
            break;
283
        case PPC40x_INPUT_INT:
284
            /* Level sensitive - active high */
285
            LOG_IRQ("%s: set the external IRQ state to %d\n",
286
                        __func__, level);
287 288
            ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
            break;
289
        case PPC40x_INPUT_HALT:
290 291
            /* Level sensitive - active low */
            if (level) {
292
                LOG_IRQ("%s: stop the CPU\n", __func__);
293 294
                env->halted = 1;
            } else {
295
                LOG_IRQ("%s: restart the CPU\n", __func__);
296 297 298
                env->halted = 0;
            }
            break;
299
        case PPC40x_INPUT_DEBUG:
300
            /* Level sensitive - active high */
301
            LOG_IRQ("%s: set the debug pin state to %d\n",
302
                        __func__, level);
303
            ppc_set_irq(env, PPC_INTERRUPT_DEBUG, level);
304 305 306
            break;
        default:
            /* Unknown pin - do nothing */
307
            LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
308 309 310 311 312 313 314 315 316
            return;
        }
        if (level)
            env->irq_input_state |= 1 << pin;
        else
            env->irq_input_state &= ~(1 << pin);
    }
}

317
void ppc40x_irq_init (CPUState *env)
318
{
319 320
    env->irq_inputs = (void **)qemu_allocate_irqs(&ppc40x_set_irq,
                                                  env, PPC40x_INPUT_NB);
321 322
}

323
/*****************************************************************************/
324
/* PowerPC time base and decrementer emulation */
325 326
struct ppc_tb_t {
    /* Time base management */
J
j_mayer 已提交
327 328 329
    int64_t  tb_offset;    /* Compensation                    */
    int64_t  atb_offset;   /* Compensation                    */
    uint32_t tb_freq;      /* TB frequency                    */
330
    /* Decrementer management */
J
j_mayer 已提交
331 332
    uint64_t decr_next;    /* Tick for next decr interrupt    */
    uint32_t decr_freq;    /* decrementer frequency           */
333
    struct QEMUTimer *decr_timer;
334 335 336 337 338
    /* Hypervisor decrementer management */
    uint64_t hdecr_next;    /* Tick for next hdecr interrupt  */
    struct QEMUTimer *hdecr_timer;
    uint64_t purr_load;
    uint64_t purr_start;
339
    void *opaque;
340 341
};

J
j_mayer 已提交
342
static always_inline uint64_t cpu_ppc_get_tb (ppc_tb_t *tb_env, uint64_t vmclk,
343
                                              int64_t tb_offset)
344 345
{
    /* TB time in tb periods */
J
j_mayer 已提交
346
    return muldiv64(vmclk, tb_env->tb_freq, ticks_per_sec) + tb_offset;
347 348 349 350 351 352 353
}

uint32_t cpu_ppc_load_tbl (CPUState *env)
{
    ppc_tb_t *tb_env = env->tb_env;
    uint64_t tb;

J
j_mayer 已提交
354
    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
355
    LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
356 357 358 359

    return tb & 0xFFFFFFFF;
}

360
static always_inline uint32_t _cpu_ppc_load_tbu (CPUState *env)
361 362 363 364
{
    ppc_tb_t *tb_env = env->tb_env;
    uint64_t tb;

J
j_mayer 已提交
365
    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
366
    LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
367

368 369 370
    return tb >> 32;
}

371 372 373 374 375
uint32_t cpu_ppc_load_tbu (CPUState *env)
{
    return _cpu_ppc_load_tbu(env);
}

J
j_mayer 已提交
376
static always_inline void cpu_ppc_store_tb (ppc_tb_t *tb_env, uint64_t vmclk,
377 378
                                            int64_t *tb_offsetp,
                                            uint64_t value)
379
{
J
j_mayer 已提交
380
    *tb_offsetp = value - muldiv64(vmclk, tb_env->tb_freq, ticks_per_sec);
381
    LOG_TB("%s: tb %016" PRIx64 " offset %08" PRIx64 "\n",
382
                __func__, value, *tb_offsetp);
383 384
}

385 386 387 388 389
void cpu_ppc_store_tbl (CPUState *env, uint32_t value)
{
    ppc_tb_t *tb_env = env->tb_env;
    uint64_t tb;

J
j_mayer 已提交
390
    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
391
    tb &= 0xFFFFFFFF00000000ULL;
J
j_mayer 已提交
392 393
    cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
                     &tb_env->tb_offset, tb | (uint64_t)value);
394 395
}

396
static always_inline void _cpu_ppc_store_tbu (CPUState *env, uint32_t value)
397 398
{
    ppc_tb_t *tb_env = env->tb_env;
399
    uint64_t tb;
400

J
j_mayer 已提交
401
    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
402
    tb &= 0x00000000FFFFFFFFULL;
J
j_mayer 已提交
403 404
    cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
                     &tb_env->tb_offset, ((uint64_t)value << 32) | tb);
405 406
}

407 408 409 410 411
void cpu_ppc_store_tbu (CPUState *env, uint32_t value)
{
    _cpu_ppc_store_tbu(env, value);
}

412 413 414 415 416
uint32_t cpu_ppc_load_atbl (CPUState *env)
{
    ppc_tb_t *tb_env = env->tb_env;
    uint64_t tb;

J
j_mayer 已提交
417
    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
418
    LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
419 420 421 422 423 424 425 426 427

    return tb & 0xFFFFFFFF;
}

uint32_t cpu_ppc_load_atbu (CPUState *env)
{
    ppc_tb_t *tb_env = env->tb_env;
    uint64_t tb;

J
j_mayer 已提交
428
    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
429
    LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
430 431 432 433 434 435 436 437 438

    return tb >> 32;
}

void cpu_ppc_store_atbl (CPUState *env, uint32_t value)
{
    ppc_tb_t *tb_env = env->tb_env;
    uint64_t tb;

J
j_mayer 已提交
439
    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
440
    tb &= 0xFFFFFFFF00000000ULL;
J
j_mayer 已提交
441 442
    cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
                     &tb_env->atb_offset, tb | (uint64_t)value);
443 444 445
}

void cpu_ppc_store_atbu (CPUState *env, uint32_t value)
446 447
{
    ppc_tb_t *tb_env = env->tb_env;
448
    uint64_t tb;
449

J
j_mayer 已提交
450
    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
451
    tb &= 0x00000000FFFFFFFFULL;
J
j_mayer 已提交
452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481
    cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
                     &tb_env->atb_offset, ((uint64_t)value << 32) | tb);
}

static void cpu_ppc_tb_stop (CPUState *env)
{
    ppc_tb_t *tb_env = env->tb_env;
    uint64_t tb, atb, vmclk;

    /* If the time base is already frozen, do nothing */
    if (tb_env->tb_freq != 0) {
        vmclk = qemu_get_clock(vm_clock);
        /* Get the time base */
        tb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->tb_offset);
        /* Get the alternate time base */
        atb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->atb_offset);
        /* Store the time base value (ie compute the current offset) */
        cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
        /* Store the alternate time base value (compute the current offset) */
        cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
        /* Set the time base frequency to zero */
        tb_env->tb_freq = 0;
        /* Now, the time bases are frozen to tb_offset / atb_offset value */
    }
}

static void cpu_ppc_tb_start (CPUState *env)
{
    ppc_tb_t *tb_env = env->tb_env;
    uint64_t tb, atb, vmclk;
482

J
j_mayer 已提交
483 484 485 486 487 488 489 490 491 492 493 494 495 496
    /* If the time base is not frozen, do nothing */
    if (tb_env->tb_freq == 0) {
        vmclk = qemu_get_clock(vm_clock);
        /* Get the time base from tb_offset */
        tb = tb_env->tb_offset;
        /* Get the alternate time base from atb_offset */
        atb = tb_env->atb_offset;
        /* Restore the tb frequency from the decrementer frequency */
        tb_env->tb_freq = tb_env->decr_freq;
        /* Store the time base value */
        cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
        /* Store the alternate time base value */
        cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
    }
497 498
}

499 500
static always_inline uint32_t _cpu_ppc_load_decr (CPUState *env,
                                                  uint64_t *next)
501 502 503
{
    ppc_tb_t *tb_env = env->tb_env;
    uint32_t decr;
B
bellard 已提交
504
    int64_t diff;
505

B
bellard 已提交
506 507
    diff = tb_env->decr_next - qemu_get_clock(vm_clock);
    if (diff >= 0)
J
j_mayer 已提交
508
        decr = muldiv64(diff, tb_env->decr_freq, ticks_per_sec);
B
bellard 已提交
509
    else
J
j_mayer 已提交
510
        decr = -muldiv64(-diff, tb_env->decr_freq, ticks_per_sec);
511
    LOG_TB("%s: %08" PRIx32 "\n", __func__, decr);
512

513 514 515
    return decr;
}

516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535
uint32_t cpu_ppc_load_decr (CPUState *env)
{
    ppc_tb_t *tb_env = env->tb_env;

    return _cpu_ppc_load_decr(env, &tb_env->decr_next);
}

uint32_t cpu_ppc_load_hdecr (CPUState *env)
{
    ppc_tb_t *tb_env = env->tb_env;

    return _cpu_ppc_load_decr(env, &tb_env->hdecr_next);
}

uint64_t cpu_ppc_load_purr (CPUState *env)
{
    ppc_tb_t *tb_env = env->tb_env;
    uint64_t diff;

    diff = qemu_get_clock(vm_clock) - tb_env->purr_start;
J
j_mayer 已提交
536

537 538 539
    return tb_env->purr_load + muldiv64(diff, tb_env->tb_freq, ticks_per_sec);
}

540 541 542
/* When decrementer expires,
 * all we need to do is generate or queue a CPU exception
 */
543
static always_inline void cpu_ppc_decr_excp (CPUState *env)
544 545
{
    /* Raise it */
546
    LOG_TB("raise decrementer exception\n");
547
    ppc_set_irq(env, PPC_INTERRUPT_DECR, 1);
548 549
}

550
static always_inline void cpu_ppc_hdecr_excp (CPUState *env)
551 552
{
    /* Raise it */
553
    LOG_TB("raise decrementer exception\n");
554 555 556 557
    ppc_set_irq(env, PPC_INTERRUPT_HDECR, 1);
}

static void __cpu_ppc_store_decr (CPUState *env, uint64_t *nextp,
J
j_mayer 已提交
558 559 560 561
                                  struct QEMUTimer *timer,
                                  void (*raise_excp)(CPUState *),
                                  uint32_t decr, uint32_t value,
                                  int is_excp)
562 563 564 565
{
    ppc_tb_t *tb_env = env->tb_env;
    uint64_t now, next;

566
    LOG_TB("%s: %08" PRIx32 " => %08" PRIx32 "\n", __func__,
567
                decr, value);
568
    now = qemu_get_clock(vm_clock);
J
j_mayer 已提交
569
    next = now + muldiv64(value, ticks_per_sec, tb_env->decr_freq);
570
    if (is_excp)
571
        next += *nextp - now;
572
    if (next == now)
573
        next++;
574
    *nextp = next;
575
    /* Adjust timer */
576
    qemu_mod_timer(timer, next);
577 578 579 580
    /* If we set a negative value and the decrementer was positive,
     * raise an exception.
     */
    if ((value & 0x80000000) && !(decr & 0x80000000))
581 582 583
        (*raise_excp)(env);
}

584 585
static always_inline void _cpu_ppc_store_decr (CPUState *env, uint32_t decr,
                                               uint32_t value, int is_excp)
586 587 588 589 590
{
    ppc_tb_t *tb_env = env->tb_env;

    __cpu_ppc_store_decr(env, &tb_env->decr_next, tb_env->decr_timer,
                         &cpu_ppc_decr_excp, decr, value, is_excp);
591 592 593 594 595 596 597 598 599 600 601 602
}

void cpu_ppc_store_decr (CPUState *env, uint32_t value)
{
    _cpu_ppc_store_decr(env, cpu_ppc_load_decr(env), value, 0);
}

static void cpu_ppc_decr_cb (void *opaque)
{
    _cpu_ppc_store_decr(opaque, 0x00000000, 0xFFFFFFFF, 1);
}

603 604
static always_inline void _cpu_ppc_store_hdecr (CPUState *env, uint32_t hdecr,
                                                uint32_t value, int is_excp)
605 606 607
{
    ppc_tb_t *tb_env = env->tb_env;

608 609 610 611
    if (tb_env->hdecr_timer != NULL) {
        __cpu_ppc_store_decr(env, &tb_env->hdecr_next, tb_env->hdecr_timer,
                             &cpu_ppc_hdecr_excp, hdecr, value, is_excp);
    }
612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631
}

void cpu_ppc_store_hdecr (CPUState *env, uint32_t value)
{
    _cpu_ppc_store_hdecr(env, cpu_ppc_load_hdecr(env), value, 0);
}

static void cpu_ppc_hdecr_cb (void *opaque)
{
    _cpu_ppc_store_hdecr(opaque, 0x00000000, 0xFFFFFFFF, 1);
}

void cpu_ppc_store_purr (CPUState *env, uint64_t value)
{
    ppc_tb_t *tb_env = env->tb_env;

    tb_env->purr_load = value;
    tb_env->purr_start = qemu_get_clock(vm_clock);
}

632 633 634 635 636 637
static void cpu_ppc_set_tb_clk (void *opaque, uint32_t freq)
{
    CPUState *env = opaque;
    ppc_tb_t *tb_env = env->tb_env;

    tb_env->tb_freq = freq;
J
j_mayer 已提交
638
    tb_env->decr_freq = freq;
639 640 641 642 643
    /* There is a bug in Linux 2.4 kernels:
     * if a decrementer exception is pending when it enables msr_ee at startup,
     * it's not ready to handle it...
     */
    _cpu_ppc_store_decr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
644 645
    _cpu_ppc_store_hdecr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
    cpu_ppc_store_purr(env, 0x0000000000000000ULL);
646 647
}

648
/* Set up (once) timebase frequency (in Hz) */
649
clk_setup_cb cpu_ppc_tb_init (CPUState *env, uint32_t freq)
650 651 652 653 654 655 656
{
    ppc_tb_t *tb_env;

    tb_env = qemu_mallocz(sizeof(ppc_tb_t));
    if (tb_env == NULL)
        return NULL;
    env->tb_env = tb_env;
657 658
    /* Create new timer */
    tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_ppc_decr_cb, env);
659 660 661 662 663 664 665
    if (0) {
        /* XXX: find a suitable condition to enable the hypervisor decrementer
         */
        tb_env->hdecr_timer = qemu_new_timer(vm_clock, &cpu_ppc_hdecr_cb, env);
    } else {
        tb_env->hdecr_timer = NULL;
    }
666
    cpu_ppc_set_tb_clk(env, freq);
667

668
    return &cpu_ppc_set_tb_clk;
669 670
}

671
/* Specific helpers for POWER & PowerPC 601 RTC */
672 673
#if 0
static clk_setup_cb cpu_ppc601_rtc_init (CPUState *env)
674 675 676
{
    return cpu_ppc_tb_init(env, 7812500);
}
677
#endif
678 679

void cpu_ppc601_store_rtcu (CPUState *env, uint32_t value)
680 681 682
{
    _cpu_ppc_store_tbu(env, value);
}
683 684

uint32_t cpu_ppc601_load_rtcu (CPUState *env)
685 686 687
{
    return _cpu_ppc_load_tbu(env);
}
688 689 690 691 692 693 694 695 696 697 698

void cpu_ppc601_store_rtcl (CPUState *env, uint32_t value)
{
    cpu_ppc_store_tbl(env, value & 0x3FFFFF80);
}

uint32_t cpu_ppc601_load_rtcl (CPUState *env)
{
    return cpu_ppc_load_tbl(env) & 0x3FFFFF80;
}

J
j_mayer 已提交
699
/*****************************************************************************/
700
/* Embedded PowerPC timers */
J
j_mayer 已提交
701 702 703 704 705 706 707 708 709 710

/* PIT, FIT & WDT */
typedef struct ppcemb_timer_t ppcemb_timer_t;
struct ppcemb_timer_t {
    uint64_t pit_reload;  /* PIT auto-reload value        */
    uint64_t fit_next;    /* Tick for next FIT interrupt  */
    struct QEMUTimer *fit_timer;
    uint64_t wdt_next;    /* Tick for next WDT interrupt  */
    struct QEMUTimer *wdt_timer;
};
711

J
j_mayer 已提交
712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747
/* Fixed interval timer */
static void cpu_4xx_fit_cb (void *opaque)
{
    CPUState *env;
    ppc_tb_t *tb_env;
    ppcemb_timer_t *ppcemb_timer;
    uint64_t now, next;

    env = opaque;
    tb_env = env->tb_env;
    ppcemb_timer = tb_env->opaque;
    now = qemu_get_clock(vm_clock);
    switch ((env->spr[SPR_40x_TCR] >> 24) & 0x3) {
    case 0:
        next = 1 << 9;
        break;
    case 1:
        next = 1 << 13;
        break;
    case 2:
        next = 1 << 17;
        break;
    case 3:
        next = 1 << 21;
        break;
    default:
        /* Cannot occur, but makes gcc happy */
        return;
    }
    next = now + muldiv64(next, ticks_per_sec, tb_env->tb_freq);
    if (next == now)
        next++;
    qemu_mod_timer(ppcemb_timer->fit_timer, next);
    env->spr[SPR_40x_TSR] |= 1 << 26;
    if ((env->spr[SPR_40x_TCR] >> 23) & 0x1)
        ppc_set_irq(env, PPC_INTERRUPT_FIT, 1);
748
    LOG_TB("%s: ir %d TCR " ADDRX " TSR " ADDRX "\n", __func__,
749
                (int)((env->spr[SPR_40x_TCR] >> 23) & 0x1),
J
j_mayer 已提交
750 751 752 753
                env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
}

/* Programmable interval timer */
J
j_mayer 已提交
754
static void start_stop_pit (CPUState *env, ppc_tb_t *tb_env, int is_excp)
755
{
J
j_mayer 已提交
756 757 758 759
    ppcemb_timer_t *ppcemb_timer;
    uint64_t now, next;

    ppcemb_timer = tb_env->opaque;
J
j_mayer 已提交
760 761 762 763
    if (ppcemb_timer->pit_reload <= 1 ||
        !((env->spr[SPR_40x_TCR] >> 26) & 0x1) ||
        (is_excp && !((env->spr[SPR_40x_TCR] >> 22) & 0x1))) {
        /* Stop PIT */
764
        LOG_TB("%s: stop PIT\n", __func__);
J
j_mayer 已提交
765 766
        qemu_del_timer(tb_env->decr_timer);
    } else {
767
        LOG_TB("%s: start PIT %016" PRIx64 "\n",
J
j_mayer 已提交
768 769
                    __func__, ppcemb_timer->pit_reload);
        now = qemu_get_clock(vm_clock);
J
j_mayer 已提交
770
        next = now + muldiv64(ppcemb_timer->pit_reload,
J
j_mayer 已提交
771
                              ticks_per_sec, tb_env->decr_freq);
J
j_mayer 已提交
772 773
        if (is_excp)
            next += tb_env->decr_next - now;
J
j_mayer 已提交
774 775 776 777 778
        if (next == now)
            next++;
        qemu_mod_timer(tb_env->decr_timer, next);
        tb_env->decr_next = next;
    }
J
j_mayer 已提交
779 780 781 782 783 784 785 786 787 788 789
}

static void cpu_4xx_pit_cb (void *opaque)
{
    CPUState *env;
    ppc_tb_t *tb_env;
    ppcemb_timer_t *ppcemb_timer;

    env = opaque;
    tb_env = env->tb_env;
    ppcemb_timer = tb_env->opaque;
J
j_mayer 已提交
790 791 792
    env->spr[SPR_40x_TSR] |= 1 << 27;
    if ((env->spr[SPR_40x_TCR] >> 26) & 0x1)
        ppc_set_irq(env, PPC_INTERRUPT_PIT, 1);
J
j_mayer 已提交
793
    start_stop_pit(env, tb_env, 1);
794
    LOG_TB("%s: ar %d ir %d TCR " ADDRX " TSR " ADDRX " "
795 796 797
                "%016" PRIx64 "\n", __func__,
                (int)((env->spr[SPR_40x_TCR] >> 22) & 0x1),
                (int)((env->spr[SPR_40x_TCR] >> 26) & 0x1),
J
j_mayer 已提交
798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830
                env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR],
                ppcemb_timer->pit_reload);
}

/* Watchdog timer */
static void cpu_4xx_wdt_cb (void *opaque)
{
    CPUState *env;
    ppc_tb_t *tb_env;
    ppcemb_timer_t *ppcemb_timer;
    uint64_t now, next;

    env = opaque;
    tb_env = env->tb_env;
    ppcemb_timer = tb_env->opaque;
    now = qemu_get_clock(vm_clock);
    switch ((env->spr[SPR_40x_TCR] >> 30) & 0x3) {
    case 0:
        next = 1 << 17;
        break;
    case 1:
        next = 1 << 21;
        break;
    case 2:
        next = 1 << 25;
        break;
    case 3:
        next = 1 << 29;
        break;
    default:
        /* Cannot occur, but makes gcc happy */
        return;
    }
J
j_mayer 已提交
831
    next = now + muldiv64(next, ticks_per_sec, tb_env->decr_freq);
J
j_mayer 已提交
832 833
    if (next == now)
        next++;
834
    LOG_TB("%s: TCR " ADDRX " TSR " ADDRX "\n", __func__,
J
j_mayer 已提交
835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857
                env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
    switch ((env->spr[SPR_40x_TSR] >> 30) & 0x3) {
    case 0x0:
    case 0x1:
        qemu_mod_timer(ppcemb_timer->wdt_timer, next);
        ppcemb_timer->wdt_next = next;
        env->spr[SPR_40x_TSR] |= 1 << 31;
        break;
    case 0x2:
        qemu_mod_timer(ppcemb_timer->wdt_timer, next);
        ppcemb_timer->wdt_next = next;
        env->spr[SPR_40x_TSR] |= 1 << 30;
        if ((env->spr[SPR_40x_TCR] >> 27) & 0x1)
            ppc_set_irq(env, PPC_INTERRUPT_WDT, 1);
        break;
    case 0x3:
        env->spr[SPR_40x_TSR] &= ~0x30000000;
        env->spr[SPR_40x_TSR] |= env->spr[SPR_40x_TCR] & 0x30000000;
        switch ((env->spr[SPR_40x_TCR] >> 28) & 0x3) {
        case 0x0:
            /* No reset */
            break;
        case 0x1: /* Core reset */
858 859
            ppc40x_core_reset(env);
            break;
J
j_mayer 已提交
860
        case 0x2: /* Chip reset */
861 862
            ppc40x_chip_reset(env);
            break;
J
j_mayer 已提交
863
        case 0x3: /* System reset */
864 865
            ppc40x_system_reset(env);
            break;
J
j_mayer 已提交
866 867
        }
    }
868 869 870 871
}

void store_40x_pit (CPUState *env, target_ulong val)
{
J
j_mayer 已提交
872 873 874 875 876
    ppc_tb_t *tb_env;
    ppcemb_timer_t *ppcemb_timer;

    tb_env = env->tb_env;
    ppcemb_timer = tb_env->opaque;
877
    LOG_TB("%s val" ADDRX "\n", __func__, val);
J
j_mayer 已提交
878
    ppcemb_timer->pit_reload = val;
J
j_mayer 已提交
879
    start_stop_pit(env, tb_env, 0);
880 881
}

J
j_mayer 已提交
882
target_ulong load_40x_pit (CPUState *env)
883
{
J
j_mayer 已提交
884
    return cpu_ppc_load_decr(env);
885 886 887 888
}

void store_booke_tsr (CPUState *env, target_ulong val)
{
889
    LOG_TB("%s: val " ADDRX "\n", __func__, val);
J
j_mayer 已提交
890 891 892
    env->spr[SPR_40x_TSR] &= ~(val & 0xFC000000);
    if (val & 0x80000000)
        ppc_set_irq(env, PPC_INTERRUPT_PIT, 0);
J
j_mayer 已提交
893 894 895 896
}

void store_booke_tcr (CPUState *env, target_ulong val)
{
J
j_mayer 已提交
897 898 899
    ppc_tb_t *tb_env;

    tb_env = env->tb_env;
900
    LOG_TB("%s: val " ADDRX "\n", __func__, val);
J
j_mayer 已提交
901 902
    env->spr[SPR_40x_TCR] = val & 0xFFC00000;
    start_stop_pit(env, tb_env, 1);
903
    cpu_4xx_wdt_cb(env);
J
j_mayer 已提交
904 905
}

J
j_mayer 已提交
906 907 908 909 910
static void ppc_emb_set_tb_clk (void *opaque, uint32_t freq)
{
    CPUState *env = opaque;
    ppc_tb_t *tb_env = env->tb_env;

911
    LOG_TB("%s set new frequency to %" PRIu32 "\n", __func__,
912
                freq);
J
j_mayer 已提交
913
    tb_env->tb_freq = freq;
J
j_mayer 已提交
914
    tb_env->decr_freq = freq;
J
j_mayer 已提交
915 916 917
    /* XXX: we should also update all timers */
}

918
clk_setup_cb ppc_emb_timers_init (CPUState *env, uint32_t freq)
J
j_mayer 已提交
919 920 921 922
{
    ppc_tb_t *tb_env;
    ppcemb_timer_t *ppcemb_timer;

923
    tb_env = qemu_mallocz(sizeof(ppc_tb_t));
J
j_mayer 已提交
924
    if (tb_env == NULL) {
925
        return NULL;
J
j_mayer 已提交
926
    }
927
    env->tb_env = tb_env;
J
j_mayer 已提交
928
    ppcemb_timer = qemu_mallocz(sizeof(ppcemb_timer_t));
929
    tb_env->tb_freq = freq;
J
j_mayer 已提交
930
    tb_env->decr_freq = freq;
J
j_mayer 已提交
931
    tb_env->opaque = ppcemb_timer;
932
    LOG_TB("%s freq %" PRIu32 "\n", __func__, freq);
J
j_mayer 已提交
933 934 935 936 937 938 939 940
    if (ppcemb_timer != NULL) {
        /* We use decr timer for PIT */
        tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_4xx_pit_cb, env);
        ppcemb_timer->fit_timer =
            qemu_new_timer(vm_clock, &cpu_4xx_fit_cb, env);
        ppcemb_timer->wdt_timer =
            qemu_new_timer(vm_clock, &cpu_4xx_wdt_cb, env);
    }
941

J
j_mayer 已提交
942
    return &ppc_emb_set_tb_clk;
943 944
}

945 946 947 948 949 950 951 952 953
/*****************************************************************************/
/* Embedded PowerPC Device Control Registers */
typedef struct ppc_dcrn_t ppc_dcrn_t;
struct ppc_dcrn_t {
    dcr_read_cb dcr_read;
    dcr_write_cb dcr_write;
    void *opaque;
};

954 955 956
/* XXX: on 460, DCR addresses are 32 bits wide,
 *      using DCRIPR to get the 22 upper bits of the DCR address
 */
957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041
#define DCRN_NB 1024
struct ppc_dcr_t {
    ppc_dcrn_t dcrn[DCRN_NB];
    int (*read_error)(int dcrn);
    int (*write_error)(int dcrn);
};

int ppc_dcr_read (ppc_dcr_t *dcr_env, int dcrn, target_ulong *valp)
{
    ppc_dcrn_t *dcr;

    if (dcrn < 0 || dcrn >= DCRN_NB)
        goto error;
    dcr = &dcr_env->dcrn[dcrn];
    if (dcr->dcr_read == NULL)
        goto error;
    *valp = (*dcr->dcr_read)(dcr->opaque, dcrn);

    return 0;

 error:
    if (dcr_env->read_error != NULL)
        return (*dcr_env->read_error)(dcrn);

    return -1;
}

int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, target_ulong val)
{
    ppc_dcrn_t *dcr;

    if (dcrn < 0 || dcrn >= DCRN_NB)
        goto error;
    dcr = &dcr_env->dcrn[dcrn];
    if (dcr->dcr_write == NULL)
        goto error;
    (*dcr->dcr_write)(dcr->opaque, dcrn, val);

    return 0;

 error:
    if (dcr_env->write_error != NULL)
        return (*dcr_env->write_error)(dcrn);

    return -1;
}

int ppc_dcr_register (CPUState *env, int dcrn, void *opaque,
                      dcr_read_cb dcr_read, dcr_write_cb dcr_write)
{
    ppc_dcr_t *dcr_env;
    ppc_dcrn_t *dcr;

    dcr_env = env->dcr_env;
    if (dcr_env == NULL)
        return -1;
    if (dcrn < 0 || dcrn >= DCRN_NB)
        return -1;
    dcr = &dcr_env->dcrn[dcrn];
    if (dcr->opaque != NULL ||
        dcr->dcr_read != NULL ||
        dcr->dcr_write != NULL)
        return -1;
    dcr->opaque = opaque;
    dcr->dcr_read = dcr_read;
    dcr->dcr_write = dcr_write;

    return 0;
}

int ppc_dcr_init (CPUState *env, int (*read_error)(int dcrn),
                  int (*write_error)(int dcrn))
{
    ppc_dcr_t *dcr_env;

    dcr_env = qemu_mallocz(sizeof(ppc_dcr_t));
    if (dcr_env == NULL)
        return -1;
    dcr_env->read_error = read_error;
    dcr_env->write_error = write_error;
    env->dcr_env = dcr_env;

    return 0;
}

1042 1043 1044 1045 1046 1047 1048 1049 1050 1051
#if 0
/*****************************************************************************/
/* Handle system reset (for now, just stop emulation) */
void cpu_ppc_reset (CPUState *env)
{
    printf("Reset asked... Stop emulation\n");
    abort();
}
#endif

B
bellard 已提交
1052 1053
/*****************************************************************************/
/* Debug port */
B
bellard 已提交
1054
void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
B
bellard 已提交
1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065
{
    addr &= 0xF;
    switch (addr) {
    case 0:
        printf("%c", val);
        break;
    case 1:
        printf("\n");
        fflush(stdout);
        break;
    case 2:
1066
        printf("Set loglevel to %04" PRIx32 "\n", val);
B
bellard 已提交
1067
        cpu_set_log(val | 0x100);
B
bellard 已提交
1068 1069 1070 1071 1072 1073
        break;
    }
}

/*****************************************************************************/
/* NVRAM helpers */
J
j_mayer 已提交
1074
static inline uint32_t nvram_read (nvram_t *nvram, uint32_t addr)
B
bellard 已提交
1075
{
J
j_mayer 已提交
1076
    return (*nvram->read_fn)(nvram->opaque, addr);;
B
bellard 已提交
1077 1078
}

J
j_mayer 已提交
1079
static inline void nvram_write (nvram_t *nvram, uint32_t addr, uint32_t val)
B
bellard 已提交
1080
{
J
j_mayer 已提交
1081
    (*nvram->write_fn)(nvram->opaque, addr, val);
B
bellard 已提交
1082 1083
}

J
j_mayer 已提交
1084
void NVRAM_set_byte (nvram_t *nvram, uint32_t addr, uint8_t value)
B
bellard 已提交
1085
{
J
j_mayer 已提交
1086
    nvram_write(nvram, addr, value);
B
bellard 已提交
1087 1088
}

J
j_mayer 已提交
1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100
uint8_t NVRAM_get_byte (nvram_t *nvram, uint32_t addr)
{
    return nvram_read(nvram, addr);
}

void NVRAM_set_word (nvram_t *nvram, uint32_t addr, uint16_t value)
{
    nvram_write(nvram, addr, value >> 8);
    nvram_write(nvram, addr + 1, value & 0xFF);
}

uint16_t NVRAM_get_word (nvram_t *nvram, uint32_t addr)
B
bellard 已提交
1101 1102 1103
{
    uint16_t tmp;

J
j_mayer 已提交
1104 1105 1106
    tmp = nvram_read(nvram, addr) << 8;
    tmp |= nvram_read(nvram, addr + 1);

B
bellard 已提交
1107 1108 1109
    return tmp;
}

J
j_mayer 已提交
1110
void NVRAM_set_lword (nvram_t *nvram, uint32_t addr, uint32_t value)
B
bellard 已提交
1111
{
J
j_mayer 已提交
1112 1113 1114 1115
    nvram_write(nvram, addr, value >> 24);
    nvram_write(nvram, addr + 1, (value >> 16) & 0xFF);
    nvram_write(nvram, addr + 2, (value >> 8) & 0xFF);
    nvram_write(nvram, addr + 3, value & 0xFF);
B
bellard 已提交
1116 1117
}

J
j_mayer 已提交
1118
uint32_t NVRAM_get_lword (nvram_t *nvram, uint32_t addr)
B
bellard 已提交
1119 1120 1121
{
    uint32_t tmp;

J
j_mayer 已提交
1122 1123 1124 1125
    tmp = nvram_read(nvram, addr) << 24;
    tmp |= nvram_read(nvram, addr + 1) << 16;
    tmp |= nvram_read(nvram, addr + 2) << 8;
    tmp |= nvram_read(nvram, addr + 3);
1126

B
bellard 已提交
1127 1128 1129
    return tmp;
}

J
j_mayer 已提交
1130
void NVRAM_set_string (nvram_t *nvram, uint32_t addr,
1131
                       const char *str, uint32_t max)
B
bellard 已提交
1132 1133 1134 1135
{
    int i;

    for (i = 0; i < max && str[i] != '\0'; i++) {
J
j_mayer 已提交
1136
        nvram_write(nvram, addr + i, str[i]);
B
bellard 已提交
1137
    }
J
j_mayer 已提交
1138 1139
    nvram_write(nvram, addr + i, str[i]);
    nvram_write(nvram, addr + max - 1, '\0');
B
bellard 已提交
1140 1141
}

J
j_mayer 已提交
1142
int NVRAM_get_string (nvram_t *nvram, uint8_t *dst, uint16_t addr, int max)
B
bellard 已提交
1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170
{
    int i;

    memset(dst, 0, max);
    for (i = 0; i < max; i++) {
        dst[i] = NVRAM_get_byte(nvram, addr + i);
        if (dst[i] == '\0')
            break;
    }

    return i;
}

static uint16_t NVRAM_crc_update (uint16_t prev, uint16_t value)
{
    uint16_t tmp;
    uint16_t pd, pd1, pd2;

    tmp = prev >> 8;
    pd = prev ^ value;
    pd1 = pd & 0x000F;
    pd2 = ((pd >> 4) & 0x000F) ^ pd1;
    tmp ^= (pd1 << 3) | (pd1 << 8);
    tmp ^= pd2 | (pd2 << 7) | (pd2 << 12);

    return tmp;
}

1171
static uint16_t NVRAM_compute_crc (nvram_t *nvram, uint32_t start, uint32_t count)
B
bellard 已提交
1172 1173 1174 1175 1176 1177 1178 1179
{
    uint32_t i;
    uint16_t crc = 0xFFFF;
    int odd;

    odd = count & 1;
    count &= ~1;
    for (i = 0; i != count; i++) {
1180
        crc = NVRAM_crc_update(crc, NVRAM_get_word(nvram, start + i));
B
bellard 已提交
1181 1182
    }
    if (odd) {
1183
        crc = NVRAM_crc_update(crc, NVRAM_get_byte(nvram, start + i) << 8);
B
bellard 已提交
1184 1185 1186 1187 1188
    }

    return crc;
}

B
bellard 已提交
1189 1190
#define CMDLINE_ADDR 0x017ff000

J
j_mayer 已提交
1191
int PPC_NVRAM_set_params (nvram_t *nvram, uint16_t NVRAM_size,
1192
                          const char *arch,
B
bellard 已提交
1193 1194
                          uint32_t RAM_size, int boot_device,
                          uint32_t kernel_image, uint32_t kernel_size,
B
bellard 已提交
1195
                          const char *cmdline,
B
bellard 已提交
1196
                          uint32_t initrd_image, uint32_t initrd_size,
B
bellard 已提交
1197 1198
                          uint32_t NVRAM_image,
                          int width, int height, int depth)
B
bellard 已提交
1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210
{
    uint16_t crc;

    /* Set parameters for Open Hack'Ware BIOS */
    NVRAM_set_string(nvram, 0x00, "QEMU_BIOS", 16);
    NVRAM_set_lword(nvram,  0x10, 0x00000002); /* structure v2 */
    NVRAM_set_word(nvram,   0x14, NVRAM_size);
    NVRAM_set_string(nvram, 0x20, arch, 16);
    NVRAM_set_lword(nvram,  0x30, RAM_size);
    NVRAM_set_byte(nvram,   0x34, boot_device);
    NVRAM_set_lword(nvram,  0x38, kernel_image);
    NVRAM_set_lword(nvram,  0x3C, kernel_size);
B
bellard 已提交
1211 1212
    if (cmdline) {
        /* XXX: put the cmdline in NVRAM too ? */
1213
        strcpy((char *)(phys_ram_base + CMDLINE_ADDR), cmdline);
B
bellard 已提交
1214 1215 1216 1217 1218 1219
        NVRAM_set_lword(nvram,  0x40, CMDLINE_ADDR);
        NVRAM_set_lword(nvram,  0x44, strlen(cmdline));
    } else {
        NVRAM_set_lword(nvram,  0x40, 0);
        NVRAM_set_lword(nvram,  0x44, 0);
    }
B
bellard 已提交
1220 1221 1222
    NVRAM_set_lword(nvram,  0x48, initrd_image);
    NVRAM_set_lword(nvram,  0x4C, initrd_size);
    NVRAM_set_lword(nvram,  0x50, NVRAM_image);
B
bellard 已提交
1223 1224 1225 1226 1227

    NVRAM_set_word(nvram,   0x54, width);
    NVRAM_set_word(nvram,   0x56, height);
    NVRAM_set_word(nvram,   0x58, depth);
    crc = NVRAM_compute_crc(nvram, 0x00, 0xF8);
J
j_mayer 已提交
1228
    NVRAM_set_word(nvram,   0xFC, crc);
B
bellard 已提交
1229 1230

    return 0;
1231
}