ppc.c 31.5 KB
Newer Older
1
/*
2
 * QEMU generic PowerPC hardware System Emulator
3
 * 
4
 * Copyright (c) 2003-2007 Jocelyn Mayer
5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
 * 
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
#include "vl.h"
B
bellard 已提交
25
#include "m48t59.h"
26

27 28
//#define PPC_DEBUG_IRQ

29 30 31
extern FILE *logfile;
extern int loglevel;

32
void ppc_set_irq (CPUState *env, int n_IRQ, int level)
33 34 35 36 37 38 39 40 41
{
    if (level) {
        env->pending_interrupts |= 1 << n_IRQ;
        cpu_interrupt(env, CPU_INTERRUPT_HARD);
    } else {
        env->pending_interrupts &= ~(1 << n_IRQ);
        if (env->pending_interrupts == 0)
            cpu_reset_interrupt(env, CPU_INTERRUPT_HARD);
    }
42
#if defined(PPC_DEBUG_IRQ)
43 44 45 46 47
    if (loglevel & CPU_LOG_INT) {
        fprintf(logfile, "%s: %p n_IRQ %d level %d => pending %08x req %08x\n",
                __func__, env, n_IRQ, level,
                env->pending_interrupts, env->interrupt_request);
    }
48 49 50
#endif
}

51 52
/* PowerPC 6xx / 7xx internal IRQ controller */
static void ppc6xx_set_irq (void *opaque, int pin, int level)
P
pbrook 已提交
53
{
54 55
    CPUState *env = opaque;
    int cur_level;
P
pbrook 已提交
56

57
#if defined(PPC_DEBUG_IRQ)
58 59 60 61
    if (loglevel & CPU_LOG_INT) {
        fprintf(logfile, "%s: env %p pin %d level %d\n", __func__,
                env, pin, level);
    }
62 63 64
#endif
    cur_level = (env->irq_input_state >> pin) & 1;
    /* Don't generate spurious events */
65
    if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
66
        switch (pin) {
67 68
        case PPC6xx_INPUT_INT:
            /* Level sensitive - active high */
69
#if defined(PPC_DEBUG_IRQ)
70 71 72 73
            if (loglevel & CPU_LOG_INT) {
                fprintf(logfile, "%s: set the external IRQ state to %d\n",
                        __func__, level);
            }
74 75 76
#endif
            ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
            break;
77
        case PPC6xx_INPUT_SMI:
78 79
            /* Level sensitive - active high */
#if defined(PPC_DEBUG_IRQ)
80 81 82 83
            if (loglevel & CPU_LOG_INT) {
                fprintf(logfile, "%s: set the SMI IRQ state to %d\n",
                        __func__, level);
            }
84 85 86
#endif
            ppc_set_irq(env, PPC_INTERRUPT_SMI, level);
            break;
87
        case PPC6xx_INPUT_MCP:
88 89 90 91 92 93
            /* Negative edge sensitive */
            /* XXX: TODO: actual reaction may depends on HID0 status
             *            603/604/740/750: check HID0[EMCP]
             */
            if (cur_level == 1 && level == 0) {
#if defined(PPC_DEBUG_IRQ)
94 95 96 97
                if (loglevel & CPU_LOG_INT) {
                    fprintf(logfile, "%s: raise machine check state\n",
                            __func__);
                }
98 99 100 101
#endif
                ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);
            }
            break;
102
        case PPC6xx_INPUT_CKSTP_IN:
103 104 105 106
            /* Level sensitive - active low */
            /* XXX: TODO: relay the signal to CKSTP_OUT pin */
            if (level) {
#if defined(PPC_DEBUG_IRQ)
107 108 109
                if (loglevel & CPU_LOG_INT) {
                    fprintf(logfile, "%s: stop the CPU\n", __func__);
                }
110 111 112 113
#endif
                env->halted = 1;
            } else {
#if defined(PPC_DEBUG_IRQ)
114 115 116
                if (loglevel & CPU_LOG_INT) {
                    fprintf(logfile, "%s: restart the CPU\n", __func__);
                }
117 118 119 120
#endif
                env->halted = 0;
            }
            break;
121
        case PPC6xx_INPUT_HRESET:
122 123 124 125
            /* Level sensitive - active low */
            if (level) {
#if 0 // XXX: TOFIX
#if defined(PPC_DEBUG_IRQ)
126 127 128
                if (loglevel & CPU_LOG_INT) {
                    fprintf(logfile, "%s: reset the CPU\n", __func__);
                }
129 130 131 132 133
#endif
                cpu_reset(env);
#endif
            }
            break;
134
        case PPC6xx_INPUT_SRESET:
135
#if defined(PPC_DEBUG_IRQ)
136 137 138 139
            if (loglevel & CPU_LOG_INT) {
                fprintf(logfile, "%s: set the RESET IRQ state to %d\n",
                        __func__, level);
            }
140 141 142 143 144 145
#endif
            ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
            break;
        default:
            /* Unknown pin - do nothing */
#if defined(PPC_DEBUG_IRQ)
146 147 148
            if (loglevel & CPU_LOG_INT) {
                fprintf(logfile, "%s: unknown IRQ pin %d\n", __func__, pin);
            }
149 150 151 152 153 154 155
#endif
            return;
        }
        if (level)
            env->irq_input_state |= 1 << pin;
        else
            env->irq_input_state &= ~(1 << pin);
P
pbrook 已提交
156 157 158
    }
}

159
void ppc6xx_irq_init (CPUState *env)
160
{
161
    env->irq_inputs = (void **)qemu_allocate_irqs(&ppc6xx_set_irq, env, 6);
162 163
}

164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285
/* PowerPC 970 internal IRQ controller */
static void ppc970_set_irq (void *opaque, int pin, int level)
{
    CPUState *env = opaque;
    int cur_level;

#if defined(PPC_DEBUG_IRQ)
    if (loglevel & CPU_LOG_INT) {
        fprintf(logfile, "%s: env %p pin %d level %d\n", __func__,
                env, pin, level);
    }
#endif
    cur_level = (env->irq_input_state >> pin) & 1;
    /* Don't generate spurious events */
    if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
        switch (pin) {
        case PPC970_INPUT_INT:
            /* Level sensitive - active high */
#if defined(PPC_DEBUG_IRQ)
            if (loglevel & CPU_LOG_INT) {
                fprintf(logfile, "%s: set the external IRQ state to %d\n",
                        __func__, level);
            }
#endif
            ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
            break;
        case PPC970_INPUT_THINT:
            /* Level sensitive - active high */
#if defined(PPC_DEBUG_IRQ)
            if (loglevel & CPU_LOG_INT) {
                fprintf(logfile, "%s: set the SMI IRQ state to %d\n", __func__,
                        level);
            }
#endif
            ppc_set_irq(env, PPC_INTERRUPT_THERM, level);
            break;
        case PPC970_INPUT_MCP:
            /* Negative edge sensitive */
            /* XXX: TODO: actual reaction may depends on HID0 status
             *            603/604/740/750: check HID0[EMCP]
             */
            if (cur_level == 1 && level == 0) {
#if defined(PPC_DEBUG_IRQ)
                if (loglevel & CPU_LOG_INT) {
                    fprintf(logfile, "%s: raise machine check state\n",
                            __func__);
                }
#endif
                ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);
            }
            break;
        case PPC970_INPUT_CKSTP:
            /* Level sensitive - active low */
            /* XXX: TODO: relay the signal to CKSTP_OUT pin */
            if (level) {
#if defined(PPC_DEBUG_IRQ)
                if (loglevel & CPU_LOG_INT) {
                    fprintf(logfile, "%s: stop the CPU\n", __func__);
                }
#endif
                env->halted = 1;
            } else {
#if defined(PPC_DEBUG_IRQ)
                if (loglevel & CPU_LOG_INT) {
                    fprintf(logfile, "%s: restart the CPU\n", __func__);
                }
#endif
                env->halted = 0;
            }
            break;
        case PPC970_INPUT_HRESET:
            /* Level sensitive - active low */
            if (level) {
#if 0 // XXX: TOFIX
#if defined(PPC_DEBUG_IRQ)
                if (loglevel & CPU_LOG_INT) {
                    fprintf(logfile, "%s: reset the CPU\n", __func__);
                }
#endif
                cpu_reset(env);
#endif
            }
            break;
        case PPC970_INPUT_SRESET:
#if defined(PPC_DEBUG_IRQ)
            if (loglevel & CPU_LOG_INT) {
                fprintf(logfile, "%s: set the RESET IRQ state to %d\n",
                        __func__, level);
            }
#endif
            ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
            break;
        case PPC970_INPUT_TBEN:
#if defined(PPC_DEBUG_IRQ)
            if (loglevel & CPU_LOG_INT) {
                fprintf(logfile, "%s: set the TBEN state to %d\n", __func__,
                        level);
            }
#endif
            /* XXX: TODO */
            break;
        default:
            /* Unknown pin - do nothing */
#if defined(PPC_DEBUG_IRQ)
            if (loglevel & CPU_LOG_INT) {
                fprintf(logfile, "%s: unknown IRQ pin %d\n", __func__, pin);
            }
#endif
            return;
        }
        if (level)
            env->irq_input_state |= 1 << pin;
        else
            env->irq_input_state &= ~(1 << pin);
    }
}

void ppc970_irq_init (CPUState *env)
{
    env->irq_inputs = (void **)qemu_allocate_irqs(&ppc970_set_irq, env, 7);
}

286 287 288 289 290 291 292
/* PowerPC 405 internal IRQ controller */
static void ppc405_set_irq (void *opaque, int pin, int level)
{
    CPUState *env = opaque;
    int cur_level;

#if defined(PPC_DEBUG_IRQ)
293 294 295 296
    if (loglevel & CPU_LOG_INT) {
        fprintf(logfile, "%s: env %p pin %d level %d\n", __func__,
                env, pin, level);
    }
297 298 299 300 301 302
#endif
    cur_level = (env->irq_input_state >> pin) & 1;
    /* Don't generate spurious events */
    if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
        switch (pin) {
        case PPC405_INPUT_RESET_SYS:
303 304 305 306 307 308 309 310 311 312
            if (level) {
#if defined(PPC_DEBUG_IRQ)
                if (loglevel & CPU_LOG_INT) {
                    fprintf(logfile, "%s: reset the PowerPC system\n",
                            __func__);
                }
#endif
                ppc40x_system_reset(env);
            }
            break;
313
        case PPC405_INPUT_RESET_CHIP:
314 315 316 317 318 319 320 321 322
            if (level) {
#if defined(PPC_DEBUG_IRQ)
                if (loglevel & CPU_LOG_INT) {
                    fprintf(logfile, "%s: reset the PowerPC chip\n", __func__);
                }
#endif
                ppc40x_chip_reset(env);
            }
            break;
323 324 325 326 327
            /* No break here */
        case PPC405_INPUT_RESET_CORE:
            /* XXX: TODO: update DBSR[MRR] */
            if (level) {
#if defined(PPC_DEBUG_IRQ)
328 329 330
                if (loglevel & CPU_LOG_INT) {
                    fprintf(logfile, "%s: reset the PowerPC core\n", __func__);
                }
331
#endif
332
                ppc40x_core_reset(env);
333 334 335 336 337
            }
            break;
        case PPC405_INPUT_CINT:
            /* Level sensitive - active high */
#if defined(PPC_DEBUG_IRQ)
338 339 340 341
            if (loglevel & CPU_LOG_INT) {
                fprintf(logfile, "%s: set the critical IRQ state to %d\n",
                        __func__, level);
            }
342 343 344 345 346 347 348
#endif
            /* XXX: TOFIX */
            ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
            break;
        case PPC405_INPUT_INT:
            /* Level sensitive - active high */
#if defined(PPC_DEBUG_IRQ)
349 350 351 352
            if (loglevel & CPU_LOG_INT) {
                fprintf(logfile, "%s: set the external IRQ state to %d\n",
                        __func__, level);
            }
353 354 355 356 357 358 359
#endif
            ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
            break;
        case PPC405_INPUT_HALT:
            /* Level sensitive - active low */
            if (level) {
#if defined(PPC_DEBUG_IRQ)
360 361 362
                if (loglevel & CPU_LOG_INT) {
                    fprintf(logfile, "%s: stop the CPU\n", __func__);
                }
363 364 365 366
#endif
                env->halted = 1;
            } else {
#if defined(PPC_DEBUG_IRQ)
367 368 369
                if (loglevel & CPU_LOG_INT) {
                    fprintf(logfile, "%s: restart the CPU\n", __func__);
                }
370 371 372 373 374 375 376
#endif
                env->halted = 0;
            }
            break;
        case PPC405_INPUT_DEBUG:
            /* Level sensitive - active high */
#if defined(PPC_DEBUG_IRQ)
377 378 379 380
            if (loglevel & CPU_LOG_INT) {
                fprintf(logfile, "%s: set the external IRQ state to %d\n",
                        __func__, level);
            }
381 382 383 384 385 386
#endif
            ppc_set_irq(env, EXCP_40x_DEBUG, level);
            break;
        default:
            /* Unknown pin - do nothing */
#if defined(PPC_DEBUG_IRQ)
387 388 389
            if (loglevel & CPU_LOG_INT) {
                fprintf(logfile, "%s: unknown IRQ pin %d\n", __func__, pin);
            }
390 391 392 393 394 395 396 397 398 399 400 401 402 403 404
#endif
            return;
        }
        if (level)
            env->irq_input_state |= 1 << pin;
        else
            env->irq_input_state &= ~(1 << pin);
    }
}

void ppc405_irq_init (CPUState *env)
{
    env->irq_inputs = (void **)qemu_allocate_irqs(&ppc405_set_irq, env, 7);
}

405
/*****************************************************************************/
406
/* PowerPC time base and decrementer emulation */
407 408 409 410 411 412 413 414 415
//#define DEBUG_TB

struct ppc_tb_t {
    /* Time base management */
    int64_t  tb_offset;    /* Compensation               */
    uint32_t tb_freq;      /* TB frequency               */
    /* Decrementer management */
    uint64_t decr_next;    /* Tick for next decr interrupt  */
    struct QEMUTimer *decr_timer;
416
    void *opaque;
417 418 419 420 421 422
};

static inline uint64_t cpu_ppc_get_tb (ppc_tb_t *tb_env)
{
    /* TB time in tb periods */
    return muldiv64(qemu_get_clock(vm_clock) + tb_env->tb_offset,
423
                    tb_env->tb_freq, ticks_per_sec);
424 425 426 427 428 429 430 431 432 433
}

uint32_t cpu_ppc_load_tbl (CPUState *env)
{
    ppc_tb_t *tb_env = env->tb_env;
    uint64_t tb;

    tb = cpu_ppc_get_tb(tb_env);
#ifdef DEBUG_TB
    {
434 435 436 437 438
        static int last_time;
        int now;
        now = time(NULL);
        if (last_time != now) {
            last_time = now;
439 440 441 442
            if (loglevel) {
                fprintf(logfile, "%s: tb=0x%016lx %d %08lx\n",
                        __func__, tb, now, tb_env->tb_offset);
            }
443
        }
444 445 446 447 448 449 450 451 452 453 454 455 456
    }
#endif

    return tb & 0xFFFFFFFF;
}

uint32_t cpu_ppc_load_tbu (CPUState *env)
{
    ppc_tb_t *tb_env = env->tb_env;
    uint64_t tb;

    tb = cpu_ppc_get_tb(tb_env);
#ifdef DEBUG_TB
457 458 459
    if (loglevel) {
        fprintf(logfile, "%s: tb=0x%016lx\n", __func__, tb);
    }
460
#endif
461

462 463 464 465 466 467 468 469
    return tb >> 32;
}

static void cpu_ppc_store_tb (ppc_tb_t *tb_env, uint64_t value)
{
    tb_env->tb_offset = muldiv64(value, ticks_per_sec, tb_env->tb_freq)
        - qemu_get_clock(vm_clock);
#ifdef DEBUG_TB
470 471 472
    if (loglevel) {
        fprintf(logfile, "%s: tb=0x%016lx offset=%08x\n", __func__, value);
    }
473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495
#endif
}

void cpu_ppc_store_tbu (CPUState *env, uint32_t value)
{
    ppc_tb_t *tb_env = env->tb_env;

    cpu_ppc_store_tb(tb_env,
                     ((uint64_t)value << 32) | cpu_ppc_load_tbl(env));
}

void cpu_ppc_store_tbl (CPUState *env, uint32_t value)
{
    ppc_tb_t *tb_env = env->tb_env;

    cpu_ppc_store_tb(tb_env,
                     ((uint64_t)cpu_ppc_load_tbu(env) << 32) | value);
}

uint32_t cpu_ppc_load_decr (CPUState *env)
{
    ppc_tb_t *tb_env = env->tb_env;
    uint32_t decr;
B
bellard 已提交
496
    int64_t diff;
497

B
bellard 已提交
498 499 500 501 502
    diff = tb_env->decr_next - qemu_get_clock(vm_clock);
    if (diff >= 0)
        decr = muldiv64(diff, tb_env->tb_freq, ticks_per_sec);
    else
        decr = -muldiv64(-diff, tb_env->tb_freq, ticks_per_sec);
B
bellard 已提交
503
#if defined(DEBUG_TB)
504 505 506
    if (loglevel) {
        fprintf(logfile, "%s: 0x%08x\n", __func__, decr);
    }
507
#endif
508

509 510 511 512 513 514 515 516 517 518
    return decr;
}

/* When decrementer expires,
 * all we need to do is generate or queue a CPU exception
 */
static inline void cpu_ppc_decr_excp (CPUState *env)
{
    /* Raise it */
#ifdef DEBUG_TB
519 520 521
    if (loglevel) {
        fprintf(logfile, "raise decrementer exception\n");
    }
522
#endif
523
    ppc_set_irq(env, PPC_INTERRUPT_DECR, 1);
524 525 526 527 528 529 530 531 532
}

static void _cpu_ppc_store_decr (CPUState *env, uint32_t decr,
                                 uint32_t value, int is_excp)
{
    ppc_tb_t *tb_env = env->tb_env;
    uint64_t now, next;

#ifdef DEBUG_TB
533 534 535
    if (loglevel) {
        fprintf(logfile, "%s: 0x%08x => 0x%08x\n", __func__, decr, value);
    }
536 537 538 539 540 541
#endif
    now = qemu_get_clock(vm_clock);
    next = now + muldiv64(value, ticks_per_sec, tb_env->tb_freq);
    if (is_excp)
        next += tb_env->decr_next - now;
    if (next == now)
542
        next++;
543 544 545 546 547 548 549
    tb_env->decr_next = next;
    /* Adjust timer */
    qemu_mod_timer(tb_env->decr_timer, next);
    /* If we set a negative value and the decrementer was positive,
     * raise an exception.
     */
    if ((value & 0x80000000) && !(decr & 0x80000000))
550
        cpu_ppc_decr_excp(env);
551 552 553 554 555 556 557 558 559 560 561 562
}

void cpu_ppc_store_decr (CPUState *env, uint32_t value)
{
    _cpu_ppc_store_decr(env, cpu_ppc_load_decr(env), value, 0);
}

static void cpu_ppc_decr_cb (void *opaque)
{
    _cpu_ppc_store_decr(opaque, 0x00000000, 0xFFFFFFFF, 1);
}

563 564 565 566 567 568 569 570 571 572 573 574 575
static void cpu_ppc_set_tb_clk (void *opaque, uint32_t freq)
{
    CPUState *env = opaque;
    ppc_tb_t *tb_env = env->tb_env;

    tb_env->tb_freq = freq;
    /* There is a bug in Linux 2.4 kernels:
     * if a decrementer exception is pending when it enables msr_ee at startup,
     * it's not ready to handle it...
     */
    _cpu_ppc_store_decr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
}

576
/* Set up (once) timebase frequency (in Hz) */
577
clk_setup_cb cpu_ppc_tb_init (CPUState *env, uint32_t freq)
578 579 580 581 582 583 584
{
    ppc_tb_t *tb_env;

    tb_env = qemu_mallocz(sizeof(ppc_tb_t));
    if (tb_env == NULL)
        return NULL;
    env->tb_env = tb_env;
585 586 587
    /* Create new timer */
    tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_ppc_decr_cb, env);
    cpu_ppc_set_tb_clk(env, freq);
588

589
    return &cpu_ppc_set_tb_clk;
590 591
}

592
/* Specific helpers for POWER & PowerPC 601 RTC */
593
clk_setup_cb cpu_ppc601_rtc_init (CPUState *env)
594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613
{
    return cpu_ppc_tb_init(env, 7812500);
}

void cpu_ppc601_store_rtcu (CPUState *env, uint32_t value)
__attribute__ (( alias ("cpu_ppc_store_tbu") ));

uint32_t cpu_ppc601_load_rtcu (CPUState *env)
__attribute__ (( alias ("cpu_ppc_load_tbu") ));

void cpu_ppc601_store_rtcl (CPUState *env, uint32_t value)
{
    cpu_ppc_store_tbl(env, value & 0x3FFFFF80);
}

uint32_t cpu_ppc601_load_rtcl (CPUState *env)
{
    return cpu_ppc_load_tbl(env) & 0x3FFFFF80;
}

J
j_mayer 已提交
614
/*****************************************************************************/
615
/* Embedded PowerPC timers */
J
j_mayer 已提交
616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664

/* PIT, FIT & WDT */
typedef struct ppcemb_timer_t ppcemb_timer_t;
struct ppcemb_timer_t {
    uint64_t pit_reload;  /* PIT auto-reload value        */
    uint64_t fit_next;    /* Tick for next FIT interrupt  */
    struct QEMUTimer *fit_timer;
    uint64_t wdt_next;    /* Tick for next WDT interrupt  */
    struct QEMUTimer *wdt_timer;
};
   
/* Fixed interval timer */
static void cpu_4xx_fit_cb (void *opaque)
{
    CPUState *env;
    ppc_tb_t *tb_env;
    ppcemb_timer_t *ppcemb_timer;
    uint64_t now, next;

    env = opaque;
    tb_env = env->tb_env;
    ppcemb_timer = tb_env->opaque;
    now = qemu_get_clock(vm_clock);
    switch ((env->spr[SPR_40x_TCR] >> 24) & 0x3) {
    case 0:
        next = 1 << 9;
        break;
    case 1:
        next = 1 << 13;
        break;
    case 2:
        next = 1 << 17;
        break;
    case 3:
        next = 1 << 21;
        break;
    default:
        /* Cannot occur, but makes gcc happy */
        return;
    }
    next = now + muldiv64(next, ticks_per_sec, tb_env->tb_freq);
    if (next == now)
        next++;
    qemu_mod_timer(ppcemb_timer->fit_timer, next);
    tb_env->decr_next = next;
    env->spr[SPR_40x_TSR] |= 1 << 26;
    if ((env->spr[SPR_40x_TCR] >> 23) & 0x1)
        ppc_set_irq(env, PPC_INTERRUPT_FIT, 1);
    if (loglevel) {
665 666
        fprintf(logfile, "%s: ir %d TCR " ADDRX " TSR " ADDRX "\n", __func__,
                (int)((env->spr[SPR_40x_TCR] >> 23) & 0x1),
J
j_mayer 已提交
667 668 669 670 671 672
                env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
    }
}

/* Programmable interval timer */
static void cpu_4xx_pit_cb (void *opaque)
673
{
J
j_mayer 已提交
674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695
    CPUState *env;
    ppc_tb_t *tb_env;
    ppcemb_timer_t *ppcemb_timer;
    uint64_t now, next;

    env = opaque;
    tb_env = env->tb_env;
    ppcemb_timer = tb_env->opaque;
    now = qemu_get_clock(vm_clock);
    if ((env->spr[SPR_40x_TCR] >> 22) & 0x1) {
        /* Auto reload */
        next = now + muldiv64(ppcemb_timer->pit_reload,
                              ticks_per_sec, tb_env->tb_freq);
        if (next == now)
            next++;
        qemu_mod_timer(tb_env->decr_timer, next);
        tb_env->decr_next = next;
    }
    env->spr[SPR_40x_TSR] |= 1 << 27;
    if ((env->spr[SPR_40x_TCR] >> 26) & 0x1)
        ppc_set_irq(env, PPC_INTERRUPT_PIT, 1);
    if (loglevel) {
696 697 698 699
        fprintf(logfile, "%s: ar %d ir %d TCR " ADDRX " TSR " ADDRX " "
                "%016" PRIx64 "\n", __func__,
                (int)((env->spr[SPR_40x_TCR] >> 22) & 0x1),
                (int)((env->spr[SPR_40x_TCR] >> 26) & 0x1),
J
j_mayer 已提交
700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737
                env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR],
                ppcemb_timer->pit_reload);
    }
}

/* Watchdog timer */
static void cpu_4xx_wdt_cb (void *opaque)
{
    CPUState *env;
    ppc_tb_t *tb_env;
    ppcemb_timer_t *ppcemb_timer;
    uint64_t now, next;

    env = opaque;
    tb_env = env->tb_env;
    ppcemb_timer = tb_env->opaque;
    now = qemu_get_clock(vm_clock);
    switch ((env->spr[SPR_40x_TCR] >> 30) & 0x3) {
    case 0:
        next = 1 << 17;
        break;
    case 1:
        next = 1 << 21;
        break;
    case 2:
        next = 1 << 25;
        break;
    case 3:
        next = 1 << 29;
        break;
    default:
        /* Cannot occur, but makes gcc happy */
        return;
    }
    next = now + muldiv64(next, ticks_per_sec, tb_env->tb_freq);
    if (next == now)
        next++;
    if (loglevel) {
738
        fprintf(logfile, "%s: TCR " ADDRX " TSR " ADDRX "\n", __func__,
J
j_mayer 已提交
739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762
                env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
    }
    switch ((env->spr[SPR_40x_TSR] >> 30) & 0x3) {
    case 0x0:
    case 0x1:
        qemu_mod_timer(ppcemb_timer->wdt_timer, next);
        ppcemb_timer->wdt_next = next;
        env->spr[SPR_40x_TSR] |= 1 << 31;
        break;
    case 0x2:
        qemu_mod_timer(ppcemb_timer->wdt_timer, next);
        ppcemb_timer->wdt_next = next;
        env->spr[SPR_40x_TSR] |= 1 << 30;
        if ((env->spr[SPR_40x_TCR] >> 27) & 0x1)
            ppc_set_irq(env, PPC_INTERRUPT_WDT, 1);
        break;
    case 0x3:
        env->spr[SPR_40x_TSR] &= ~0x30000000;
        env->spr[SPR_40x_TSR] |= env->spr[SPR_40x_TCR] & 0x30000000;
        switch ((env->spr[SPR_40x_TCR] >> 28) & 0x3) {
        case 0x0:
            /* No reset */
            break;
        case 0x1: /* Core reset */
763 764
            ppc40x_core_reset(env);
            break;
J
j_mayer 已提交
765
        case 0x2: /* Chip reset */
766 767
            ppc40x_chip_reset(env);
            break;
J
j_mayer 已提交
768
        case 0x3: /* System reset */
769 770
            ppc40x_system_reset(env);
            break;
J
j_mayer 已提交
771 772
        }
    }
773 774 775 776
}

void store_40x_pit (CPUState *env, target_ulong val)
{
J
j_mayer 已提交
777 778 779 780 781 782
    ppc_tb_t *tb_env;
    ppcemb_timer_t *ppcemb_timer;
    uint64_t now, next;

    tb_env = env->tb_env;
    ppcemb_timer = tb_env->opaque;
783
    if (loglevel) {
J
j_mayer 已提交
784
        fprintf(logfile, "%s %p %p\n", __func__, tb_env, ppcemb_timer);
785
    }
J
j_mayer 已提交
786 787 788
    ppcemb_timer->pit_reload = val;
    if (val == 0) {
        /* Stop PIT */
789
        if (loglevel) {
J
j_mayer 已提交
790
            fprintf(logfile, "%s: stop PIT\n", __func__);
791
        }
J
j_mayer 已提交
792 793
        qemu_del_timer(tb_env->decr_timer);
    } else {
794
        if (loglevel) {
795
            fprintf(logfile, "%s: start PIT 0x" ADDRX "\n", __func__, val);
796
        }
J
j_mayer 已提交
797 798 799 800 801 802 803
        now = qemu_get_clock(vm_clock);
        next = now + muldiv64(val, ticks_per_sec, tb_env->tb_freq);
         if (next == now)
            next++;
        qemu_mod_timer(tb_env->decr_timer, next);
        tb_env->decr_next = next;
    }
804 805
}

J
j_mayer 已提交
806
target_ulong load_40x_pit (CPUState *env)
807
{
J
j_mayer 已提交
808
    return cpu_ppc_load_decr(env);
809 810 811 812
}

void store_booke_tsr (CPUState *env, target_ulong val)
{
J
j_mayer 已提交
813 814 815 816 817 818
    env->spr[SPR_40x_TSR] = val & 0xFC000000;
}

void store_booke_tcr (CPUState *env, target_ulong val)
{
    env->spr[SPR_40x_TCR] = val & 0xFF800000;
819
    cpu_4xx_wdt_cb(env);
J
j_mayer 已提交
820 821
}

822
clk_setup_cb ppc_emb_timers_init (CPUState *env, uint32_t freq)
J
j_mayer 已提交
823 824 825 826
{
    ppc_tb_t *tb_env;
    ppcemb_timer_t *ppcemb_timer;

827 828 829 830
    tb_env = qemu_mallocz(sizeof(ppc_tb_t));
    if (tb_env == NULL)
        return NULL;
    env->tb_env = tb_env;
J
j_mayer 已提交
831
    ppcemb_timer = qemu_mallocz(sizeof(ppcemb_timer_t));
832
    tb_env->tb_freq = freq;
J
j_mayer 已提交
833
    tb_env->opaque = ppcemb_timer;
834
    if (loglevel) {
J
j_mayer 已提交
835
        fprintf(logfile, "%s %p %p\n", __func__, tb_env, ppcemb_timer);
836
    }
J
j_mayer 已提交
837 838 839 840 841 842 843 844
    if (ppcemb_timer != NULL) {
        /* We use decr timer for PIT */
        tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_4xx_pit_cb, env);
        ppcemb_timer->fit_timer =
            qemu_new_timer(vm_clock, &cpu_4xx_fit_cb, env);
        ppcemb_timer->wdt_timer =
            qemu_new_timer(vm_clock, &cpu_4xx_wdt_cb, env);
    }
845 846 847

    /* XXX: TODO: add callback for clock frequency change */
    return NULL;
848 849
}

850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944
/*****************************************************************************/
/* Embedded PowerPC Device Control Registers */
typedef struct ppc_dcrn_t ppc_dcrn_t;
struct ppc_dcrn_t {
    dcr_read_cb dcr_read;
    dcr_write_cb dcr_write;
    void *opaque;
};

#define DCRN_NB 1024
struct ppc_dcr_t {
    ppc_dcrn_t dcrn[DCRN_NB];
    int (*read_error)(int dcrn);
    int (*write_error)(int dcrn);
};

int ppc_dcr_read (ppc_dcr_t *dcr_env, int dcrn, target_ulong *valp)
{
    ppc_dcrn_t *dcr;

    if (dcrn < 0 || dcrn >= DCRN_NB)
        goto error;
    dcr = &dcr_env->dcrn[dcrn];
    if (dcr->dcr_read == NULL)
        goto error;
    *valp = (*dcr->dcr_read)(dcr->opaque, dcrn);

    return 0;

 error:
    if (dcr_env->read_error != NULL)
        return (*dcr_env->read_error)(dcrn);

    return -1;
}

int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, target_ulong val)
{
    ppc_dcrn_t *dcr;

    if (dcrn < 0 || dcrn >= DCRN_NB)
        goto error;
    dcr = &dcr_env->dcrn[dcrn];
    if (dcr->dcr_write == NULL)
        goto error;
    (*dcr->dcr_write)(dcr->opaque, dcrn, val);

    return 0;

 error:
    if (dcr_env->write_error != NULL)
        return (*dcr_env->write_error)(dcrn);

    return -1;
}

int ppc_dcr_register (CPUState *env, int dcrn, void *opaque,
                      dcr_read_cb dcr_read, dcr_write_cb dcr_write)
{
    ppc_dcr_t *dcr_env;
    ppc_dcrn_t *dcr;

    dcr_env = env->dcr_env;
    if (dcr_env == NULL)
        return -1;
    if (dcrn < 0 || dcrn >= DCRN_NB)
        return -1;
    dcr = &dcr_env->dcrn[dcrn];
    if (dcr->opaque != NULL ||
        dcr->dcr_read != NULL ||
        dcr->dcr_write != NULL)
        return -1;
    dcr->opaque = opaque;
    dcr->dcr_read = dcr_read;
    dcr->dcr_write = dcr_write;

    return 0;
}

int ppc_dcr_init (CPUState *env, int (*read_error)(int dcrn),
                  int (*write_error)(int dcrn))
{
    ppc_dcr_t *dcr_env;

    dcr_env = qemu_mallocz(sizeof(ppc_dcr_t));
    if (dcr_env == NULL)
        return -1;
    dcr_env->read_error = read_error;
    dcr_env->write_error = write_error;
    env->dcr_env = dcr_env;

    return 0;
}


945 946 947 948 949 950 951 952 953 954
#if 0
/*****************************************************************************/
/* Handle system reset (for now, just stop emulation) */
void cpu_ppc_reset (CPUState *env)
{
    printf("Reset asked... Stop emulation\n");
    abort();
}
#endif

B
bellard 已提交
955 956
/*****************************************************************************/
/* Debug port */
B
bellard 已提交
957
void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
B
bellard 已提交
958 959 960 961 962 963 964 965 966 967 968 969
{
    addr &= 0xF;
    switch (addr) {
    case 0:
        printf("%c", val);
        break;
    case 1:
        printf("\n");
        fflush(stdout);
        break;
    case 2:
        printf("Set loglevel to %04x\n", val);
B
bellard 已提交
970
        cpu_set_log(val | 0x100);
B
bellard 已提交
971 972 973 974 975 976 977 978
        break;
    }
}

/*****************************************************************************/
/* NVRAM helpers */
void NVRAM_set_byte (m48t59_t *nvram, uint32_t addr, uint8_t value)
{
979
    m48t59_write(nvram, addr, value);
B
bellard 已提交
980 981 982 983
}

uint8_t NVRAM_get_byte (m48t59_t *nvram, uint32_t addr)
{
984
    return m48t59_read(nvram, addr);
B
bellard 已提交
985 986 987 988
}

void NVRAM_set_word (m48t59_t *nvram, uint32_t addr, uint16_t value)
{
989 990
    m48t59_write(nvram, addr, value >> 8);
    m48t59_write(nvram, addr + 1, value & 0xFF);
B
bellard 已提交
991 992 993 994 995 996
}

uint16_t NVRAM_get_word (m48t59_t *nvram, uint32_t addr)
{
    uint16_t tmp;

997 998
    tmp = m48t59_read(nvram, addr) << 8;
    tmp |= m48t59_read(nvram, addr + 1);
B
bellard 已提交
999 1000 1001 1002 1003
    return tmp;
}

void NVRAM_set_lword (m48t59_t *nvram, uint32_t addr, uint32_t value)
{
1004 1005 1006 1007
    m48t59_write(nvram, addr, value >> 24);
    m48t59_write(nvram, addr + 1, (value >> 16) & 0xFF);
    m48t59_write(nvram, addr + 2, (value >> 8) & 0xFF);
    m48t59_write(nvram, addr + 3, value & 0xFF);
B
bellard 已提交
1008 1009 1010 1011 1012 1013
}

uint32_t NVRAM_get_lword (m48t59_t *nvram, uint32_t addr)
{
    uint32_t tmp;

1014 1015 1016 1017
    tmp = m48t59_read(nvram, addr) << 24;
    tmp |= m48t59_read(nvram, addr + 1) << 16;
    tmp |= m48t59_read(nvram, addr + 2) << 8;
    tmp |= m48t59_read(nvram, addr + 3);
1018

B
bellard 已提交
1019 1020 1021 1022 1023 1024 1025 1026 1027
    return tmp;
}

void NVRAM_set_string (m48t59_t *nvram, uint32_t addr,
                       const unsigned char *str, uint32_t max)
{
    int i;

    for (i = 0; i < max && str[i] != '\0'; i++) {
1028
        m48t59_write(nvram, addr + i, str[i]);
B
bellard 已提交
1029
    }
1030
    m48t59_write(nvram, addr + max - 1, '\0');
B
bellard 已提交
1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070
}

int NVRAM_get_string (m48t59_t *nvram, uint8_t *dst, uint16_t addr, int max)
{
    int i;

    memset(dst, 0, max);
    for (i = 0; i < max; i++) {
        dst[i] = NVRAM_get_byte(nvram, addr + i);
        if (dst[i] == '\0')
            break;
    }

    return i;
}

static uint16_t NVRAM_crc_update (uint16_t prev, uint16_t value)
{
    uint16_t tmp;
    uint16_t pd, pd1, pd2;

    tmp = prev >> 8;
    pd = prev ^ value;
    pd1 = pd & 0x000F;
    pd2 = ((pd >> 4) & 0x000F) ^ pd1;
    tmp ^= (pd1 << 3) | (pd1 << 8);
    tmp ^= pd2 | (pd2 << 7) | (pd2 << 12);

    return tmp;
}

uint16_t NVRAM_compute_crc (m48t59_t *nvram, uint32_t start, uint32_t count)
{
    uint32_t i;
    uint16_t crc = 0xFFFF;
    int odd;

    odd = count & 1;
    count &= ~1;
    for (i = 0; i != count; i++) {
1071
        crc = NVRAM_crc_update(crc, NVRAM_get_word(nvram, start + i));
B
bellard 已提交
1072 1073
    }
    if (odd) {
1074
        crc = NVRAM_crc_update(crc, NVRAM_get_byte(nvram, start + i) << 8);
B
bellard 已提交
1075 1076 1077 1078 1079
    }

    return crc;
}

B
bellard 已提交
1080 1081
#define CMDLINE_ADDR 0x017ff000

B
bellard 已提交
1082 1083 1084 1085
int PPC_NVRAM_set_params (m48t59_t *nvram, uint16_t NVRAM_size,
                          const unsigned char *arch,
                          uint32_t RAM_size, int boot_device,
                          uint32_t kernel_image, uint32_t kernel_size,
B
bellard 已提交
1086
                          const char *cmdline,
B
bellard 已提交
1087
                          uint32_t initrd_image, uint32_t initrd_size,
B
bellard 已提交
1088 1089
                          uint32_t NVRAM_image,
                          int width, int height, int depth)
B
bellard 已提交
1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101
{
    uint16_t crc;

    /* Set parameters for Open Hack'Ware BIOS */
    NVRAM_set_string(nvram, 0x00, "QEMU_BIOS", 16);
    NVRAM_set_lword(nvram,  0x10, 0x00000002); /* structure v2 */
    NVRAM_set_word(nvram,   0x14, NVRAM_size);
    NVRAM_set_string(nvram, 0x20, arch, 16);
    NVRAM_set_lword(nvram,  0x30, RAM_size);
    NVRAM_set_byte(nvram,   0x34, boot_device);
    NVRAM_set_lword(nvram,  0x38, kernel_image);
    NVRAM_set_lword(nvram,  0x3C, kernel_size);
B
bellard 已提交
1102 1103 1104 1105 1106 1107 1108 1109 1110
    if (cmdline) {
        /* XXX: put the cmdline in NVRAM too ? */
        strcpy(phys_ram_base + CMDLINE_ADDR, cmdline);
        NVRAM_set_lword(nvram,  0x40, CMDLINE_ADDR);
        NVRAM_set_lword(nvram,  0x44, strlen(cmdline));
    } else {
        NVRAM_set_lword(nvram,  0x40, 0);
        NVRAM_set_lword(nvram,  0x44, 0);
    }
B
bellard 已提交
1111 1112 1113
    NVRAM_set_lword(nvram,  0x48, initrd_image);
    NVRAM_set_lword(nvram,  0x4C, initrd_size);
    NVRAM_set_lword(nvram,  0x50, NVRAM_image);
B
bellard 已提交
1114 1115 1116 1117 1118 1119

    NVRAM_set_word(nvram,   0x54, width);
    NVRAM_set_word(nvram,   0x56, height);
    NVRAM_set_word(nvram,   0x58, depth);
    crc = NVRAM_compute_crc(nvram, 0x00, 0xF8);
    NVRAM_set_word(nvram,  0xFC, crc);
B
bellard 已提交
1120 1121

    return 0;
1122
}