2 * QEMU generic PowerPC hardware System Emulator
4 * Copyright (c) 2003-2007 Jocelyn Mayer
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26 #include "qemu-timer.h"
34 //#define PPC_DEBUG_IRQ
35 //#define PPC_DEBUG_TB
38 # define LOG_IRQ(...) qemu_log_mask(CPU_LOG_INT, ## __VA_ARGS__)
40 # define LOG_IRQ(...) do { } while (0)
45 # define LOG_TB(...) qemu_log(__VA_ARGS__)
47 # define LOG_TB(...) do { } while (0)
50 static void cpu_ppc_tb_stop (CPUState
*env
);
51 static void cpu_ppc_tb_start (CPUState
*env
);
53 static void ppc_set_irq (CPUState
*env
, int n_IRQ
, int level
)
55 unsigned int old_pending
= env
->pending_interrupts
;
58 env
->pending_interrupts
|= 1 << n_IRQ
;
59 cpu_interrupt(env
, CPU_INTERRUPT_HARD
);
61 env
->pending_interrupts
&= ~(1 << n_IRQ
);
62 if (env
->pending_interrupts
== 0)
63 cpu_reset_interrupt(env
, CPU_INTERRUPT_HARD
);
66 if (old_pending
!= env
->pending_interrupts
) {
68 kvmppc_set_interrupt(env
, n_IRQ
, level
);
72 LOG_IRQ("%s: %p n_IRQ %d level %d => pending %08" PRIx32
73 "req %08x\n", __func__
, env
, n_IRQ
, level
,
74 env
->pending_interrupts
, env
->interrupt_request
);
77 /* PowerPC 6xx / 7xx internal IRQ controller */
78 static void ppc6xx_set_irq (void *opaque
, int pin
, int level
)
80 CPUState
*env
= opaque
;
83 LOG_IRQ("%s: env %p pin %d level %d\n", __func__
,
85 cur_level
= (env
->irq_input_state
>> pin
) & 1;
86 /* Don't generate spurious events */
87 if ((cur_level
== 1 && level
== 0) || (cur_level
== 0 && level
!= 0)) {
89 case PPC6xx_INPUT_TBEN
:
90 /* Level sensitive - active high */
91 LOG_IRQ("%s: %s the time base\n",
92 __func__
, level
? "start" : "stop");
94 cpu_ppc_tb_start(env
);
98 case PPC6xx_INPUT_INT
:
99 /* Level sensitive - active high */
100 LOG_IRQ("%s: set the external IRQ state to %d\n",
102 ppc_set_irq(env
, PPC_INTERRUPT_EXT
, level
);
104 case PPC6xx_INPUT_SMI
:
105 /* Level sensitive - active high */
106 LOG_IRQ("%s: set the SMI IRQ state to %d\n",
108 ppc_set_irq(env
, PPC_INTERRUPT_SMI
, level
);
110 case PPC6xx_INPUT_MCP
:
111 /* Negative edge sensitive */
112 /* XXX: TODO: actual reaction may depends on HID0 status
113 * 603/604/740/750: check HID0[EMCP]
115 if (cur_level
== 1 && level
== 0) {
116 LOG_IRQ("%s: raise machine check state\n",
118 ppc_set_irq(env
, PPC_INTERRUPT_MCK
, 1);
121 case PPC6xx_INPUT_CKSTP_IN
:
122 /* Level sensitive - active low */
123 /* XXX: TODO: relay the signal to CKSTP_OUT pin */
124 /* XXX: Note that the only way to restart the CPU is to reset it */
126 LOG_IRQ("%s: stop the CPU\n", __func__
);
130 case PPC6xx_INPUT_HRESET
:
131 /* Level sensitive - active low */
133 LOG_IRQ("%s: reset the CPU\n", __func__
);
134 env
->interrupt_request
|= CPU_INTERRUPT_EXITTB
;
139 qemu_system_reset_request();
143 case PPC6xx_INPUT_SRESET
:
144 LOG_IRQ("%s: set the RESET IRQ state to %d\n",
146 ppc_set_irq(env
, PPC_INTERRUPT_RESET
, level
);
149 /* Unknown pin - do nothing */
150 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__
, pin
);
154 env
->irq_input_state
|= 1 << pin
;
156 env
->irq_input_state
&= ~(1 << pin
);
160 void ppc6xx_irq_init (CPUState
*env
)
162 env
->irq_inputs
= (void **)qemu_allocate_irqs(&ppc6xx_set_irq
, env
,
166 #if defined(TARGET_PPC64)
167 /* PowerPC 970 internal IRQ controller */
168 static void ppc970_set_irq (void *opaque
, int pin
, int level
)
170 CPUState
*env
= opaque
;
173 LOG_IRQ("%s: env %p pin %d level %d\n", __func__
,
175 cur_level
= (env
->irq_input_state
>> pin
) & 1;
176 /* Don't generate spurious events */
177 if ((cur_level
== 1 && level
== 0) || (cur_level
== 0 && level
!= 0)) {
179 case PPC970_INPUT_INT
:
180 /* Level sensitive - active high */
181 LOG_IRQ("%s: set the external IRQ state to %d\n",
183 ppc_set_irq(env
, PPC_INTERRUPT_EXT
, level
);
185 case PPC970_INPUT_THINT
:
186 /* Level sensitive - active high */
187 LOG_IRQ("%s: set the SMI IRQ state to %d\n", __func__
,
189 ppc_set_irq(env
, PPC_INTERRUPT_THERM
, level
);
191 case PPC970_INPUT_MCP
:
192 /* Negative edge sensitive */
193 /* XXX: TODO: actual reaction may depends on HID0 status
194 * 603/604/740/750: check HID0[EMCP]
196 if (cur_level
== 1 && level
== 0) {
197 LOG_IRQ("%s: raise machine check state\n",
199 ppc_set_irq(env
, PPC_INTERRUPT_MCK
, 1);
202 case PPC970_INPUT_CKSTP
:
203 /* Level sensitive - active low */
204 /* XXX: TODO: relay the signal to CKSTP_OUT pin */
206 LOG_IRQ("%s: stop the CPU\n", __func__
);
209 LOG_IRQ("%s: restart the CPU\n", __func__
);
214 case PPC970_INPUT_HRESET
:
215 /* Level sensitive - active low */
218 LOG_IRQ("%s: reset the CPU\n", __func__
);
223 case PPC970_INPUT_SRESET
:
224 LOG_IRQ("%s: set the RESET IRQ state to %d\n",
226 ppc_set_irq(env
, PPC_INTERRUPT_RESET
, level
);
228 case PPC970_INPUT_TBEN
:
229 LOG_IRQ("%s: set the TBEN state to %d\n", __func__
,
234 /* Unknown pin - do nothing */
235 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__
, pin
);
239 env
->irq_input_state
|= 1 << pin
;
241 env
->irq_input_state
&= ~(1 << pin
);
245 void ppc970_irq_init (CPUState
*env
)
247 env
->irq_inputs
= (void **)qemu_allocate_irqs(&ppc970_set_irq
, env
,
250 #endif /* defined(TARGET_PPC64) */
252 /* PowerPC 40x internal IRQ controller */
253 static void ppc40x_set_irq (void *opaque
, int pin
, int level
)
255 CPUState
*env
= opaque
;
258 LOG_IRQ("%s: env %p pin %d level %d\n", __func__
,
260 cur_level
= (env
->irq_input_state
>> pin
) & 1;
261 /* Don't generate spurious events */
262 if ((cur_level
== 1 && level
== 0) || (cur_level
== 0 && level
!= 0)) {
264 case PPC40x_INPUT_RESET_SYS
:
266 LOG_IRQ("%s: reset the PowerPC system\n",
268 ppc40x_system_reset(env
);
271 case PPC40x_INPUT_RESET_CHIP
:
273 LOG_IRQ("%s: reset the PowerPC chip\n", __func__
);
274 ppc40x_chip_reset(env
);
277 case PPC40x_INPUT_RESET_CORE
:
278 /* XXX: TODO: update DBSR[MRR] */
280 LOG_IRQ("%s: reset the PowerPC core\n", __func__
);
281 ppc40x_core_reset(env
);
284 case PPC40x_INPUT_CINT
:
285 /* Level sensitive - active high */
286 LOG_IRQ("%s: set the critical IRQ state to %d\n",
288 ppc_set_irq(env
, PPC_INTERRUPT_CEXT
, level
);
290 case PPC40x_INPUT_INT
:
291 /* Level sensitive - active high */
292 LOG_IRQ("%s: set the external IRQ state to %d\n",
294 ppc_set_irq(env
, PPC_INTERRUPT_EXT
, level
);
296 case PPC40x_INPUT_HALT
:
297 /* Level sensitive - active low */
299 LOG_IRQ("%s: stop the CPU\n", __func__
);
302 LOG_IRQ("%s: restart the CPU\n", __func__
);
307 case PPC40x_INPUT_DEBUG
:
308 /* Level sensitive - active high */
309 LOG_IRQ("%s: set the debug pin state to %d\n",
311 ppc_set_irq(env
, PPC_INTERRUPT_DEBUG
, level
);
314 /* Unknown pin - do nothing */
315 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__
, pin
);
319 env
->irq_input_state
|= 1 << pin
;
321 env
->irq_input_state
&= ~(1 << pin
);
325 void ppc40x_irq_init (CPUState
*env
)
327 env
->irq_inputs
= (void **)qemu_allocate_irqs(&ppc40x_set_irq
,
328 env
, PPC40x_INPUT_NB
);
331 /* PowerPC E500 internal IRQ controller */
332 static void ppce500_set_irq (void *opaque
, int pin
, int level
)
334 CPUState
*env
= opaque
;
337 LOG_IRQ("%s: env %p pin %d level %d\n", __func__
,
339 cur_level
= (env
->irq_input_state
>> pin
) & 1;
340 /* Don't generate spurious events */
341 if ((cur_level
== 1 && level
== 0) || (cur_level
== 0 && level
!= 0)) {
343 case PPCE500_INPUT_MCK
:
345 LOG_IRQ("%s: reset the PowerPC system\n",
347 qemu_system_reset_request();
350 case PPCE500_INPUT_RESET_CORE
:
352 LOG_IRQ("%s: reset the PowerPC core\n", __func__
);
353 ppc_set_irq(env
, PPC_INTERRUPT_MCK
, level
);
356 case PPCE500_INPUT_CINT
:
357 /* Level sensitive - active high */
358 LOG_IRQ("%s: set the critical IRQ state to %d\n",
360 ppc_set_irq(env
, PPC_INTERRUPT_CEXT
, level
);
362 case PPCE500_INPUT_INT
:
363 /* Level sensitive - active high */
364 LOG_IRQ("%s: set the core IRQ state to %d\n",
366 ppc_set_irq(env
, PPC_INTERRUPT_EXT
, level
);
368 case PPCE500_INPUT_DEBUG
:
369 /* Level sensitive - active high */
370 LOG_IRQ("%s: set the debug pin state to %d\n",
372 ppc_set_irq(env
, PPC_INTERRUPT_DEBUG
, level
);
375 /* Unknown pin - do nothing */
376 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__
, pin
);
380 env
->irq_input_state
|= 1 << pin
;
382 env
->irq_input_state
&= ~(1 << pin
);
386 void ppce500_irq_init (CPUState
*env
)
388 env
->irq_inputs
= (void **)qemu_allocate_irqs(&ppce500_set_irq
,
389 env
, PPCE500_INPUT_NB
);
391 /*****************************************************************************/
392 /* PowerPC time base and decrementer emulation */
394 /* Time base management */
395 int64_t tb_offset
; /* Compensation */
396 int64_t atb_offset
; /* Compensation */
397 uint32_t tb_freq
; /* TB frequency */
398 /* Decrementer management */
399 uint64_t decr_next
; /* Tick for next decr interrupt */
400 uint32_t decr_freq
; /* decrementer frequency */
401 struct QEMUTimer
*decr_timer
;
402 /* Hypervisor decrementer management */
403 uint64_t hdecr_next
; /* Tick for next hdecr interrupt */
404 struct QEMUTimer
*hdecr_timer
;
410 static inline uint64_t cpu_ppc_get_tb(ppc_tb_t
*tb_env
, uint64_t vmclk
,
413 /* TB time in tb periods */
414 return muldiv64(vmclk
, tb_env
->tb_freq
, get_ticks_per_sec()) + tb_offset
;
417 uint64_t cpu_ppc_load_tbl (CPUState
*env
)
419 ppc_tb_t
*tb_env
= env
->tb_env
;
422 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->tb_offset
);
423 LOG_TB("%s: tb %016" PRIx64
"\n", __func__
, tb
);
428 static inline uint32_t _cpu_ppc_load_tbu(CPUState
*env
)
430 ppc_tb_t
*tb_env
= env
->tb_env
;
433 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->tb_offset
);
434 LOG_TB("%s: tb %016" PRIx64
"\n", __func__
, tb
);
439 uint32_t cpu_ppc_load_tbu (CPUState
*env
)
441 return _cpu_ppc_load_tbu(env
);
444 static inline void cpu_ppc_store_tb(ppc_tb_t
*tb_env
, uint64_t vmclk
,
445 int64_t *tb_offsetp
, uint64_t value
)
447 *tb_offsetp
= value
- muldiv64(vmclk
, tb_env
->tb_freq
, get_ticks_per_sec());
448 LOG_TB("%s: tb %016" PRIx64
" offset %08" PRIx64
"\n",
449 __func__
, value
, *tb_offsetp
);
452 void cpu_ppc_store_tbl (CPUState
*env
, uint32_t value
)
454 ppc_tb_t
*tb_env
= env
->tb_env
;
457 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->tb_offset
);
458 tb
&= 0xFFFFFFFF00000000ULL
;
459 cpu_ppc_store_tb(tb_env
, qemu_get_clock_ns(vm_clock
),
460 &tb_env
->tb_offset
, tb
| (uint64_t)value
);
463 static inline void _cpu_ppc_store_tbu(CPUState
*env
, uint32_t value
)
465 ppc_tb_t
*tb_env
= env
->tb_env
;
468 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->tb_offset
);
469 tb
&= 0x00000000FFFFFFFFULL
;
470 cpu_ppc_store_tb(tb_env
, qemu_get_clock_ns(vm_clock
),
471 &tb_env
->tb_offset
, ((uint64_t)value
<< 32) | tb
);
474 void cpu_ppc_store_tbu (CPUState
*env
, uint32_t value
)
476 _cpu_ppc_store_tbu(env
, value
);
479 uint64_t cpu_ppc_load_atbl (CPUState
*env
)
481 ppc_tb_t
*tb_env
= env
->tb_env
;
484 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->atb_offset
);
485 LOG_TB("%s: tb %016" PRIx64
"\n", __func__
, tb
);
490 uint32_t cpu_ppc_load_atbu (CPUState
*env
)
492 ppc_tb_t
*tb_env
= env
->tb_env
;
495 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->atb_offset
);
496 LOG_TB("%s: tb %016" PRIx64
"\n", __func__
, tb
);
501 void cpu_ppc_store_atbl (CPUState
*env
, uint32_t value
)
503 ppc_tb_t
*tb_env
= env
->tb_env
;
506 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->atb_offset
);
507 tb
&= 0xFFFFFFFF00000000ULL
;
508 cpu_ppc_store_tb(tb_env
, qemu_get_clock_ns(vm_clock
),
509 &tb_env
->atb_offset
, tb
| (uint64_t)value
);
512 void cpu_ppc_store_atbu (CPUState
*env
, uint32_t value
)
514 ppc_tb_t
*tb_env
= env
->tb_env
;
517 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->atb_offset
);
518 tb
&= 0x00000000FFFFFFFFULL
;
519 cpu_ppc_store_tb(tb_env
, qemu_get_clock_ns(vm_clock
),
520 &tb_env
->atb_offset
, ((uint64_t)value
<< 32) | tb
);
523 static void cpu_ppc_tb_stop (CPUState
*env
)
525 ppc_tb_t
*tb_env
= env
->tb_env
;
526 uint64_t tb
, atb
, vmclk
;
528 /* If the time base is already frozen, do nothing */
529 if (tb_env
->tb_freq
!= 0) {
530 vmclk
= qemu_get_clock_ns(vm_clock
);
531 /* Get the time base */
532 tb
= cpu_ppc_get_tb(tb_env
, vmclk
, tb_env
->tb_offset
);
533 /* Get the alternate time base */
534 atb
= cpu_ppc_get_tb(tb_env
, vmclk
, tb_env
->atb_offset
);
535 /* Store the time base value (ie compute the current offset) */
536 cpu_ppc_store_tb(tb_env
, vmclk
, &tb_env
->tb_offset
, tb
);
537 /* Store the alternate time base value (compute the current offset) */
538 cpu_ppc_store_tb(tb_env
, vmclk
, &tb_env
->atb_offset
, atb
);
539 /* Set the time base frequency to zero */
541 /* Now, the time bases are frozen to tb_offset / atb_offset value */
545 static void cpu_ppc_tb_start (CPUState
*env
)
547 ppc_tb_t
*tb_env
= env
->tb_env
;
548 uint64_t tb
, atb
, vmclk
;
550 /* If the time base is not frozen, do nothing */
551 if (tb_env
->tb_freq
== 0) {
552 vmclk
= qemu_get_clock_ns(vm_clock
);
553 /* Get the time base from tb_offset */
554 tb
= tb_env
->tb_offset
;
555 /* Get the alternate time base from atb_offset */
556 atb
= tb_env
->atb_offset
;
557 /* Restore the tb frequency from the decrementer frequency */
558 tb_env
->tb_freq
= tb_env
->decr_freq
;
559 /* Store the time base value */
560 cpu_ppc_store_tb(tb_env
, vmclk
, &tb_env
->tb_offset
, tb
);
561 /* Store the alternate time base value */
562 cpu_ppc_store_tb(tb_env
, vmclk
, &tb_env
->atb_offset
, atb
);
566 static inline uint32_t _cpu_ppc_load_decr(CPUState
*env
, uint64_t next
)
568 ppc_tb_t
*tb_env
= env
->tb_env
;
572 diff
= next
- qemu_get_clock_ns(vm_clock
);
574 decr
= muldiv64(diff
, tb_env
->decr_freq
, get_ticks_per_sec());
576 decr
= -muldiv64(-diff
, tb_env
->decr_freq
, get_ticks_per_sec());
577 LOG_TB("%s: %08" PRIx32
"\n", __func__
, decr
);
582 uint32_t cpu_ppc_load_decr (CPUState
*env
)
584 ppc_tb_t
*tb_env
= env
->tb_env
;
586 return _cpu_ppc_load_decr(env
, tb_env
->decr_next
);
589 uint32_t cpu_ppc_load_hdecr (CPUState
*env
)
591 ppc_tb_t
*tb_env
= env
->tb_env
;
593 return _cpu_ppc_load_decr(env
, tb_env
->hdecr_next
);
596 uint64_t cpu_ppc_load_purr (CPUState
*env
)
598 ppc_tb_t
*tb_env
= env
->tb_env
;
601 diff
= qemu_get_clock_ns(vm_clock
) - tb_env
->purr_start
;
603 return tb_env
->purr_load
+ muldiv64(diff
, tb_env
->tb_freq
, get_ticks_per_sec());
606 /* When decrementer expires,
607 * all we need to do is generate or queue a CPU exception
609 static inline void cpu_ppc_decr_excp(CPUState
*env
)
612 LOG_TB("raise decrementer exception\n");
613 ppc_set_irq(env
, PPC_INTERRUPT_DECR
, 1);
616 static inline void cpu_ppc_hdecr_excp(CPUState
*env
)
619 LOG_TB("raise decrementer exception\n");
620 ppc_set_irq(env
, PPC_INTERRUPT_HDECR
, 1);
623 static void __cpu_ppc_store_decr (CPUState
*env
, uint64_t *nextp
,
624 struct QEMUTimer
*timer
,
625 void (*raise_excp
)(CPUState
*),
626 uint32_t decr
, uint32_t value
,
629 ppc_tb_t
*tb_env
= env
->tb_env
;
632 LOG_TB("%s: %08" PRIx32
" => %08" PRIx32
"\n", __func__
,
634 now
= qemu_get_clock_ns(vm_clock
);
635 next
= now
+ muldiv64(value
, get_ticks_per_sec(), tb_env
->decr_freq
);
637 next
+= *nextp
- now
;
642 qemu_mod_timer(timer
, next
);
643 /* If we set a negative value and the decrementer was positive,
644 * raise an exception.
646 if ((value
& 0x80000000) && !(decr
& 0x80000000))
650 static inline void _cpu_ppc_store_decr(CPUState
*env
, uint32_t decr
,
651 uint32_t value
, int is_excp
)
653 ppc_tb_t
*tb_env
= env
->tb_env
;
655 __cpu_ppc_store_decr(env
, &tb_env
->decr_next
, tb_env
->decr_timer
,
656 &cpu_ppc_decr_excp
, decr
, value
, is_excp
);
659 void cpu_ppc_store_decr (CPUState
*env
, uint32_t value
)
661 _cpu_ppc_store_decr(env
, cpu_ppc_load_decr(env
), value
, 0);
664 static void cpu_ppc_decr_cb (void *opaque
)
666 _cpu_ppc_store_decr(opaque
, 0x00000000, 0xFFFFFFFF, 1);
669 static inline void _cpu_ppc_store_hdecr(CPUState
*env
, uint32_t hdecr
,
670 uint32_t value
, int is_excp
)
672 ppc_tb_t
*tb_env
= env
->tb_env
;
674 if (tb_env
->hdecr_timer
!= NULL
) {
675 __cpu_ppc_store_decr(env
, &tb_env
->hdecr_next
, tb_env
->hdecr_timer
,
676 &cpu_ppc_hdecr_excp
, hdecr
, value
, is_excp
);
680 void cpu_ppc_store_hdecr (CPUState
*env
, uint32_t value
)
682 _cpu_ppc_store_hdecr(env
, cpu_ppc_load_hdecr(env
), value
, 0);
685 static void cpu_ppc_hdecr_cb (void *opaque
)
687 _cpu_ppc_store_hdecr(opaque
, 0x00000000, 0xFFFFFFFF, 1);
690 void cpu_ppc_store_purr (CPUState
*env
, uint64_t value
)
692 ppc_tb_t
*tb_env
= env
->tb_env
;
694 tb_env
->purr_load
= value
;
695 tb_env
->purr_start
= qemu_get_clock_ns(vm_clock
);
698 static void cpu_ppc_set_tb_clk (void *opaque
, uint32_t freq
)
700 CPUState
*env
= opaque
;
701 ppc_tb_t
*tb_env
= env
->tb_env
;
703 tb_env
->tb_freq
= freq
;
704 tb_env
->decr_freq
= freq
;
705 /* There is a bug in Linux 2.4 kernels:
706 * if a decrementer exception is pending when it enables msr_ee at startup,
707 * it's not ready to handle it...
709 _cpu_ppc_store_decr(env
, 0xFFFFFFFF, 0xFFFFFFFF, 0);
710 _cpu_ppc_store_hdecr(env
, 0xFFFFFFFF, 0xFFFFFFFF, 0);
711 cpu_ppc_store_purr(env
, 0x0000000000000000ULL
);
714 /* Set up (once) timebase frequency (in Hz) */
715 clk_setup_cb
cpu_ppc_tb_init (CPUState
*env
, uint32_t freq
)
719 tb_env
= qemu_mallocz(sizeof(ppc_tb_t
));
720 env
->tb_env
= tb_env
;
721 /* Create new timer */
722 tb_env
->decr_timer
= qemu_new_timer_ns(vm_clock
, &cpu_ppc_decr_cb
, env
);
724 /* XXX: find a suitable condition to enable the hypervisor decrementer
726 tb_env
->hdecr_timer
= qemu_new_timer_ns(vm_clock
, &cpu_ppc_hdecr_cb
, env
);
728 tb_env
->hdecr_timer
= NULL
;
730 cpu_ppc_set_tb_clk(env
, freq
);
732 return &cpu_ppc_set_tb_clk
;
735 /* Specific helpers for POWER & PowerPC 601 RTC */
737 static clk_setup_cb
cpu_ppc601_rtc_init (CPUState
*env
)
739 return cpu_ppc_tb_init(env
, 7812500);
743 void cpu_ppc601_store_rtcu (CPUState
*env
, uint32_t value
)
745 _cpu_ppc_store_tbu(env
, value
);
748 uint32_t cpu_ppc601_load_rtcu (CPUState
*env
)
750 return _cpu_ppc_load_tbu(env
);
753 void cpu_ppc601_store_rtcl (CPUState
*env
, uint32_t value
)
755 cpu_ppc_store_tbl(env
, value
& 0x3FFFFF80);
758 uint32_t cpu_ppc601_load_rtcl (CPUState
*env
)
760 return cpu_ppc_load_tbl(env
) & 0x3FFFFF80;
763 /*****************************************************************************/
764 /* Embedded PowerPC timers */
767 typedef struct ppcemb_timer_t ppcemb_timer_t
;
768 struct ppcemb_timer_t
{
769 uint64_t pit_reload
; /* PIT auto-reload value */
770 uint64_t fit_next
; /* Tick for next FIT interrupt */
771 struct QEMUTimer
*fit_timer
;
772 uint64_t wdt_next
; /* Tick for next WDT interrupt */
773 struct QEMUTimer
*wdt_timer
;
775 /* 405 have the PIT, 440 have a DECR. */
776 unsigned int decr_excp
;
779 /* Fixed interval timer */
780 static void cpu_4xx_fit_cb (void *opaque
)
784 ppcemb_timer_t
*ppcemb_timer
;
788 tb_env
= env
->tb_env
;
789 ppcemb_timer
= tb_env
->opaque
;
790 now
= qemu_get_clock_ns(vm_clock
);
791 switch ((env
->spr
[SPR_40x_TCR
] >> 24) & 0x3) {
805 /* Cannot occur, but makes gcc happy */
808 next
= now
+ muldiv64(next
, get_ticks_per_sec(), tb_env
->tb_freq
);
811 qemu_mod_timer(ppcemb_timer
->fit_timer
, next
);
812 env
->spr
[SPR_40x_TSR
] |= 1 << 26;
813 if ((env
->spr
[SPR_40x_TCR
] >> 23) & 0x1)
814 ppc_set_irq(env
, PPC_INTERRUPT_FIT
, 1);
815 LOG_TB("%s: ir %d TCR " TARGET_FMT_lx
" TSR " TARGET_FMT_lx
"\n", __func__
,
816 (int)((env
->spr
[SPR_40x_TCR
] >> 23) & 0x1),
817 env
->spr
[SPR_40x_TCR
], env
->spr
[SPR_40x_TSR
]);
820 /* Programmable interval timer */
821 static void start_stop_pit (CPUState
*env
, ppc_tb_t
*tb_env
, int is_excp
)
823 ppcemb_timer_t
*ppcemb_timer
;
826 ppcemb_timer
= tb_env
->opaque
;
827 if (ppcemb_timer
->pit_reload
<= 1 ||
828 !((env
->spr
[SPR_40x_TCR
] >> 26) & 0x1) ||
829 (is_excp
&& !((env
->spr
[SPR_40x_TCR
] >> 22) & 0x1))) {
831 LOG_TB("%s: stop PIT\n", __func__
);
832 qemu_del_timer(tb_env
->decr_timer
);
834 LOG_TB("%s: start PIT %016" PRIx64
"\n",
835 __func__
, ppcemb_timer
->pit_reload
);
836 now
= qemu_get_clock_ns(vm_clock
);
837 next
= now
+ muldiv64(ppcemb_timer
->pit_reload
,
838 get_ticks_per_sec(), tb_env
->decr_freq
);
840 next
+= tb_env
->decr_next
- now
;
843 qemu_mod_timer(tb_env
->decr_timer
, next
);
844 tb_env
->decr_next
= next
;
848 static void cpu_4xx_pit_cb (void *opaque
)
852 ppcemb_timer_t
*ppcemb_timer
;
855 tb_env
= env
->tb_env
;
856 ppcemb_timer
= tb_env
->opaque
;
857 env
->spr
[SPR_40x_TSR
] |= 1 << 27;
858 if ((env
->spr
[SPR_40x_TCR
] >> 26) & 0x1)
859 ppc_set_irq(env
, ppcemb_timer
->decr_excp
, 1);
860 start_stop_pit(env
, tb_env
, 1);
861 LOG_TB("%s: ar %d ir %d TCR " TARGET_FMT_lx
" TSR " TARGET_FMT_lx
" "
862 "%016" PRIx64
"\n", __func__
,
863 (int)((env
->spr
[SPR_40x_TCR
] >> 22) & 0x1),
864 (int)((env
->spr
[SPR_40x_TCR
] >> 26) & 0x1),
865 env
->spr
[SPR_40x_TCR
], env
->spr
[SPR_40x_TSR
],
866 ppcemb_timer
->pit_reload
);
870 static void cpu_4xx_wdt_cb (void *opaque
)
874 ppcemb_timer_t
*ppcemb_timer
;
878 tb_env
= env
->tb_env
;
879 ppcemb_timer
= tb_env
->opaque
;
880 now
= qemu_get_clock_ns(vm_clock
);
881 switch ((env
->spr
[SPR_40x_TCR
] >> 30) & 0x3) {
895 /* Cannot occur, but makes gcc happy */
898 next
= now
+ muldiv64(next
, get_ticks_per_sec(), tb_env
->decr_freq
);
901 LOG_TB("%s: TCR " TARGET_FMT_lx
" TSR " TARGET_FMT_lx
"\n", __func__
,
902 env
->spr
[SPR_40x_TCR
], env
->spr
[SPR_40x_TSR
]);
903 switch ((env
->spr
[SPR_40x_TSR
] >> 30) & 0x3) {
906 qemu_mod_timer(ppcemb_timer
->wdt_timer
, next
);
907 ppcemb_timer
->wdt_next
= next
;
908 env
->spr
[SPR_40x_TSR
] |= 1 << 31;
911 qemu_mod_timer(ppcemb_timer
->wdt_timer
, next
);
912 ppcemb_timer
->wdt_next
= next
;
913 env
->spr
[SPR_40x_TSR
] |= 1 << 30;
914 if ((env
->spr
[SPR_40x_TCR
] >> 27) & 0x1)
915 ppc_set_irq(env
, PPC_INTERRUPT_WDT
, 1);
918 env
->spr
[SPR_40x_TSR
] &= ~0x30000000;
919 env
->spr
[SPR_40x_TSR
] |= env
->spr
[SPR_40x_TCR
] & 0x30000000;
920 switch ((env
->spr
[SPR_40x_TCR
] >> 28) & 0x3) {
924 case 0x1: /* Core reset */
925 ppc40x_core_reset(env
);
927 case 0x2: /* Chip reset */
928 ppc40x_chip_reset(env
);
930 case 0x3: /* System reset */
931 ppc40x_system_reset(env
);
937 void store_40x_pit (CPUState
*env
, target_ulong val
)
940 ppcemb_timer_t
*ppcemb_timer
;
942 tb_env
= env
->tb_env
;
943 ppcemb_timer
= tb_env
->opaque
;
944 LOG_TB("%s val" TARGET_FMT_lx
"\n", __func__
, val
);
945 ppcemb_timer
->pit_reload
= val
;
946 start_stop_pit(env
, tb_env
, 0);
949 target_ulong
load_40x_pit (CPUState
*env
)
951 return cpu_ppc_load_decr(env
);
954 void store_booke_tsr (CPUState
*env
, target_ulong val
)
956 ppc_tb_t
*tb_env
= env
->tb_env
;
957 ppcemb_timer_t
*ppcemb_timer
;
959 ppcemb_timer
= tb_env
->opaque
;
961 LOG_TB("%s: val " TARGET_FMT_lx
"\n", __func__
, val
);
962 env
->spr
[SPR_40x_TSR
] &= ~(val
& 0xFC000000);
963 if (val
& 0x80000000)
964 ppc_set_irq(env
, ppcemb_timer
->decr_excp
, 0);
967 void store_booke_tcr (CPUState
*env
, target_ulong val
)
971 tb_env
= env
->tb_env
;
972 LOG_TB("%s: val " TARGET_FMT_lx
"\n", __func__
, val
);
973 env
->spr
[SPR_40x_TCR
] = val
& 0xFFC00000;
974 start_stop_pit(env
, tb_env
, 1);
978 static void ppc_emb_set_tb_clk (void *opaque
, uint32_t freq
)
980 CPUState
*env
= opaque
;
981 ppc_tb_t
*tb_env
= env
->tb_env
;
983 LOG_TB("%s set new frequency to %" PRIu32
"\n", __func__
,
985 tb_env
->tb_freq
= freq
;
986 tb_env
->decr_freq
= freq
;
987 /* XXX: we should also update all timers */
990 clk_setup_cb
ppc_emb_timers_init (CPUState
*env
, uint32_t freq
,
991 unsigned int decr_excp
)
994 ppcemb_timer_t
*ppcemb_timer
;
996 tb_env
= qemu_mallocz(sizeof(ppc_tb_t
));
997 env
->tb_env
= tb_env
;
998 ppcemb_timer
= qemu_mallocz(sizeof(ppcemb_timer_t
));
999 tb_env
->tb_freq
= freq
;
1000 tb_env
->decr_freq
= freq
;
1001 tb_env
->opaque
= ppcemb_timer
;
1002 LOG_TB("%s freq %" PRIu32
"\n", __func__
, freq
);
1003 if (ppcemb_timer
!= NULL
) {
1004 /* We use decr timer for PIT */
1005 tb_env
->decr_timer
= qemu_new_timer_ns(vm_clock
, &cpu_4xx_pit_cb
, env
);
1006 ppcemb_timer
->fit_timer
=
1007 qemu_new_timer_ns(vm_clock
, &cpu_4xx_fit_cb
, env
);
1008 ppcemb_timer
->wdt_timer
=
1009 qemu_new_timer_ns(vm_clock
, &cpu_4xx_wdt_cb
, env
);
1010 ppcemb_timer
->decr_excp
= decr_excp
;
1013 return &ppc_emb_set_tb_clk
;
1016 /*****************************************************************************/
1017 /* Embedded PowerPC Device Control Registers */
1018 typedef struct ppc_dcrn_t ppc_dcrn_t
;
1020 dcr_read_cb dcr_read
;
1021 dcr_write_cb dcr_write
;
1025 /* XXX: on 460, DCR addresses are 32 bits wide,
1026 * using DCRIPR to get the 22 upper bits of the DCR address
1028 #define DCRN_NB 1024
1030 ppc_dcrn_t dcrn
[DCRN_NB
];
1031 int (*read_error
)(int dcrn
);
1032 int (*write_error
)(int dcrn
);
1035 int ppc_dcr_read (ppc_dcr_t
*dcr_env
, int dcrn
, uint32_t *valp
)
1039 if (dcrn
< 0 || dcrn
>= DCRN_NB
)
1041 dcr
= &dcr_env
->dcrn
[dcrn
];
1042 if (dcr
->dcr_read
== NULL
)
1044 *valp
= (*dcr
->dcr_read
)(dcr
->opaque
, dcrn
);
1049 if (dcr_env
->read_error
!= NULL
)
1050 return (*dcr_env
->read_error
)(dcrn
);
1055 int ppc_dcr_write (ppc_dcr_t
*dcr_env
, int dcrn
, uint32_t val
)
1059 if (dcrn
< 0 || dcrn
>= DCRN_NB
)
1061 dcr
= &dcr_env
->dcrn
[dcrn
];
1062 if (dcr
->dcr_write
== NULL
)
1064 (*dcr
->dcr_write
)(dcr
->opaque
, dcrn
, val
);
1069 if (dcr_env
->write_error
!= NULL
)
1070 return (*dcr_env
->write_error
)(dcrn
);
1075 int ppc_dcr_register (CPUState
*env
, int dcrn
, void *opaque
,
1076 dcr_read_cb dcr_read
, dcr_write_cb dcr_write
)
1081 dcr_env
= env
->dcr_env
;
1082 if (dcr_env
== NULL
)
1084 if (dcrn
< 0 || dcrn
>= DCRN_NB
)
1086 dcr
= &dcr_env
->dcrn
[dcrn
];
1087 if (dcr
->opaque
!= NULL
||
1088 dcr
->dcr_read
!= NULL
||
1089 dcr
->dcr_write
!= NULL
)
1091 dcr
->opaque
= opaque
;
1092 dcr
->dcr_read
= dcr_read
;
1093 dcr
->dcr_write
= dcr_write
;
1098 int ppc_dcr_init (CPUState
*env
, int (*read_error
)(int dcrn
),
1099 int (*write_error
)(int dcrn
))
1103 dcr_env
= qemu_mallocz(sizeof(ppc_dcr_t
));
1104 dcr_env
->read_error
= read_error
;
1105 dcr_env
->write_error
= write_error
;
1106 env
->dcr_env
= dcr_env
;
1111 /*****************************************************************************/
1113 void PPC_debug_write (void *opaque
, uint32_t addr
, uint32_t val
)
1125 printf("Set loglevel to %04" PRIx32
"\n", val
);
1126 cpu_set_log(val
| 0x100);
1131 /*****************************************************************************/
1133 static inline uint32_t nvram_read (nvram_t
*nvram
, uint32_t addr
)
1135 return (*nvram
->read_fn
)(nvram
->opaque
, addr
);;
1138 static inline void nvram_write (nvram_t
*nvram
, uint32_t addr
, uint32_t val
)
1140 (*nvram
->write_fn
)(nvram
->opaque
, addr
, val
);
1143 void NVRAM_set_byte (nvram_t
*nvram
, uint32_t addr
, uint8_t value
)
1145 nvram_write(nvram
, addr
, value
);
1148 uint8_t NVRAM_get_byte (nvram_t
*nvram
, uint32_t addr
)
1150 return nvram_read(nvram
, addr
);
1153 void NVRAM_set_word (nvram_t
*nvram
, uint32_t addr
, uint16_t value
)
1155 nvram_write(nvram
, addr
, value
>> 8);
1156 nvram_write(nvram
, addr
+ 1, value
& 0xFF);
1159 uint16_t NVRAM_get_word (nvram_t
*nvram
, uint32_t addr
)
1163 tmp
= nvram_read(nvram
, addr
) << 8;
1164 tmp
|= nvram_read(nvram
, addr
+ 1);
1169 void NVRAM_set_lword (nvram_t
*nvram
, uint32_t addr
, uint32_t value
)
1171 nvram_write(nvram
, addr
, value
>> 24);
1172 nvram_write(nvram
, addr
+ 1, (value
>> 16) & 0xFF);
1173 nvram_write(nvram
, addr
+ 2, (value
>> 8) & 0xFF);
1174 nvram_write(nvram
, addr
+ 3, value
& 0xFF);
1177 uint32_t NVRAM_get_lword (nvram_t
*nvram
, uint32_t addr
)
1181 tmp
= nvram_read(nvram
, addr
) << 24;
1182 tmp
|= nvram_read(nvram
, addr
+ 1) << 16;
1183 tmp
|= nvram_read(nvram
, addr
+ 2) << 8;
1184 tmp
|= nvram_read(nvram
, addr
+ 3);
1189 void NVRAM_set_string (nvram_t
*nvram
, uint32_t addr
,
1190 const char *str
, uint32_t max
)
1194 for (i
= 0; i
< max
&& str
[i
] != '\0'; i
++) {
1195 nvram_write(nvram
, addr
+ i
, str
[i
]);
1197 nvram_write(nvram
, addr
+ i
, str
[i
]);
1198 nvram_write(nvram
, addr
+ max
- 1, '\0');
1201 int NVRAM_get_string (nvram_t
*nvram
, uint8_t *dst
, uint16_t addr
, int max
)
1205 memset(dst
, 0, max
);
1206 for (i
= 0; i
< max
; i
++) {
1207 dst
[i
] = NVRAM_get_byte(nvram
, addr
+ i
);
1215 static uint16_t NVRAM_crc_update (uint16_t prev
, uint16_t value
)
1218 uint16_t pd
, pd1
, pd2
;
1223 pd2
= ((pd
>> 4) & 0x000F) ^ pd1
;
1224 tmp
^= (pd1
<< 3) | (pd1
<< 8);
1225 tmp
^= pd2
| (pd2
<< 7) | (pd2
<< 12);
1230 static uint16_t NVRAM_compute_crc (nvram_t
*nvram
, uint32_t start
, uint32_t count
)
1233 uint16_t crc
= 0xFFFF;
1238 for (i
= 0; i
!= count
; i
++) {
1239 crc
= NVRAM_crc_update(crc
, NVRAM_get_word(nvram
, start
+ i
));
1242 crc
= NVRAM_crc_update(crc
, NVRAM_get_byte(nvram
, start
+ i
) << 8);
1248 #define CMDLINE_ADDR 0x017ff000
1250 int PPC_NVRAM_set_params (nvram_t
*nvram
, uint16_t NVRAM_size
,
1252 uint32_t RAM_size
, int boot_device
,
1253 uint32_t kernel_image
, uint32_t kernel_size
,
1254 const char *cmdline
,
1255 uint32_t initrd_image
, uint32_t initrd_size
,
1256 uint32_t NVRAM_image
,
1257 int width
, int height
, int depth
)
1261 /* Set parameters for Open Hack'Ware BIOS */
1262 NVRAM_set_string(nvram
, 0x00, "QEMU_BIOS", 16);
1263 NVRAM_set_lword(nvram
, 0x10, 0x00000002); /* structure v2 */
1264 NVRAM_set_word(nvram
, 0x14, NVRAM_size
);
1265 NVRAM_set_string(nvram
, 0x20, arch
, 16);
1266 NVRAM_set_lword(nvram
, 0x30, RAM_size
);
1267 NVRAM_set_byte(nvram
, 0x34, boot_device
);
1268 NVRAM_set_lword(nvram
, 0x38, kernel_image
);
1269 NVRAM_set_lword(nvram
, 0x3C, kernel_size
);
1271 /* XXX: put the cmdline in NVRAM too ? */
1272 pstrcpy_targphys("cmdline", CMDLINE_ADDR
, RAM_size
- CMDLINE_ADDR
, cmdline
);
1273 NVRAM_set_lword(nvram
, 0x40, CMDLINE_ADDR
);
1274 NVRAM_set_lword(nvram
, 0x44, strlen(cmdline
));
1276 NVRAM_set_lword(nvram
, 0x40, 0);
1277 NVRAM_set_lword(nvram
, 0x44, 0);
1279 NVRAM_set_lword(nvram
, 0x48, initrd_image
);
1280 NVRAM_set_lword(nvram
, 0x4C, initrd_size
);
1281 NVRAM_set_lword(nvram
, 0x50, NVRAM_image
);
1283 NVRAM_set_word(nvram
, 0x54, width
);
1284 NVRAM_set_word(nvram
, 0x56, height
);
1285 NVRAM_set_word(nvram
, 0x58, depth
);
1286 crc
= NVRAM_compute_crc(nvram
, 0x00, 0xF8);
1287 NVRAM_set_word(nvram
, 0xFC, crc
);