?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge remote branch 'mst/for_anthony' into staging
[qemu.git] / hw / ppc.c
blob968aec1b16cdc039f81f1450762b4946b2364447
1 /*
2 * QEMU generic PowerPC hardware System Emulator
3 *
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24 #include "hw.h"
25 #include "ppc.h"
26 #include "qemu-timer.h"
27 #include "sysemu.h"
28 #include "nvram.h"
29 #include "qemu-log.h"
30 #include "loader.h"
31 #include "kvm.h"
32 #include "kvm_ppc.h"
33
34 //#define PPC_DEBUG_IRQ
35 //#define PPC_DEBUG_TB
36
37 #ifdef PPC_DEBUG_IRQ
38 # define LOG_IRQ(...) qemu_log_mask(CPU_LOG_INT, ## __VA_ARGS__)
39 #else
40 # define LOG_IRQ(...) do { } while (0)
41 #endif
42
43
44 #ifdef PPC_DEBUG_TB
45 # define LOG_TB(...) qemu_log(__VA_ARGS__)
46 #else
47 # define LOG_TB(...) do { } while (0)
48 #endif
49
50 static void cpu_ppc_tb_stop (CPUState *env);
51 static void cpu_ppc_tb_start (CPUState *env);
52
53 static void ppc_set_irq (CPUState *env, int n_IRQ, int level)
54 {
55 unsigned int old_pending = env->pending_interrupts;
56
57 if (level) {
58 env->pending_interrupts |= 1 << n_IRQ;
59 cpu_interrupt(env, CPU_INTERRUPT_HARD);
60 } else {
61 env->pending_interrupts &= ~(1 << n_IRQ);
62 if (env->pending_interrupts == 0)
63 cpu_reset_interrupt(env, CPU_INTERRUPT_HARD);
64 }
65
66 if (old_pending != env->pending_interrupts) {
67 #ifdef CONFIG_KVM
68 kvmppc_set_interrupt(env, n_IRQ, level);
69 #endif
70 }
71
72 LOG_IRQ("%s: %p n_IRQ %d level %d => pending %08" PRIx32
73 "req %08x\n", __func__, env, n_IRQ, level,
74 env->pending_interrupts, env->interrupt_request);
75 }
76
77 /* PowerPC 6xx / 7xx internal IRQ controller */
78 static void ppc6xx_set_irq (void *opaque, int pin, int level)
79 {
80 CPUState *env = opaque;
81 int cur_level;
82
83 LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
84 env, pin, level);
85 cur_level = (env->irq_input_state >> pin) & 1;
86 /* Don't generate spurious events */
87 if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
88 switch (pin) {
89 case PPC6xx_INPUT_TBEN:
90 /* Level sensitive - active high */
91 LOG_IRQ("%s: %s the time base\n",
92 __func__, level ? "start" : "stop");
93 if (level) {
94 cpu_ppc_tb_start(env);
95 } else {
96 cpu_ppc_tb_stop(env);
97 }
98 case PPC6xx_INPUT_INT:
99 /* Level sensitive - active high */
100 LOG_IRQ("%s: set the external IRQ state to %d\n",
101 __func__, level);
102 ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
103 break;
104 case PPC6xx_INPUT_SMI:
105 /* Level sensitive - active high */
106 LOG_IRQ("%s: set the SMI IRQ state to %d\n",
107 __func__, level);
108 ppc_set_irq(env, PPC_INTERRUPT_SMI, level);
109 break;
110 case PPC6xx_INPUT_MCP:
111 /* Negative edge sensitive */
112 /* XXX: TODO: actual reaction may depends on HID0 status
113 * 603/604/740/750: check HID0[EMCP]
114 */
115 if (cur_level == 1 && level == 0) {
116 LOG_IRQ("%s: raise machine check state\n",
117 __func__);
118 ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);
119 }
120 break;
121 case PPC6xx_INPUT_CKSTP_IN:
122 /* Level sensitive - active low */
123 /* XXX: TODO: relay the signal to CKSTP_OUT pin */
124 /* XXX: Note that the only way to restart the CPU is to reset it */
125 if (level) {
126 LOG_IRQ("%s: stop the CPU\n", __func__);
127 env->halted = 1;
128 }
129 break;
130 case PPC6xx_INPUT_HRESET:
131 /* Level sensitive - active low */
132 if (level) {
133 LOG_IRQ("%s: reset the CPU\n", __func__);
134 env->interrupt_request |= CPU_INTERRUPT_EXITTB;
135 /* XXX: TOFIX */
136 #if 0
137 cpu_reset(env);
138 #else
139 qemu_system_reset_request();
140 #endif
141 }
142 break;
143 case PPC6xx_INPUT_SRESET:
144 LOG_IRQ("%s: set the RESET IRQ state to %d\n",
145 __func__, level);
146 ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
147 break;
148 default:
149 /* Unknown pin - do nothing */
150 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
151 return;
152 }
153 if (level)
154 env->irq_input_state |= 1 << pin;
155 else
156 env->irq_input_state &= ~(1 << pin);
157 }
158 }
159
160 void ppc6xx_irq_init (CPUState *env)
161 {
162 env->irq_inputs = (void **)qemu_allocate_irqs(&ppc6xx_set_irq, env,
163 PPC6xx_INPUT_NB);
164 }
165
166 #if defined(TARGET_PPC64)
167 /* PowerPC 970 internal IRQ controller */
168 static void ppc970_set_irq (void *opaque, int pin, int level)
169 {
170 CPUState *env = opaque;
171 int cur_level;
172
173 LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
174 env, pin, level);
175 cur_level = (env->irq_input_state >> pin) & 1;
176 /* Don't generate spurious events */
177 if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
178 switch (pin) {
179 case PPC970_INPUT_INT:
180 /* Level sensitive - active high */
181 LOG_IRQ("%s: set the external IRQ state to %d\n",
182 __func__, level);
183 ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
184 break;
185 case PPC970_INPUT_THINT:
186 /* Level sensitive - active high */
187 LOG_IRQ("%s: set the SMI IRQ state to %d\n", __func__,
188 level);
189 ppc_set_irq(env, PPC_INTERRUPT_THERM, level);
190 break;
191 case PPC970_INPUT_MCP:
192 /* Negative edge sensitive */
193 /* XXX: TODO: actual reaction may depends on HID0 status
194 * 603/604/740/750: check HID0[EMCP]
195 */
196 if (cur_level == 1 && level == 0) {
197 LOG_IRQ("%s: raise machine check state\n",
198 __func__);
199 ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);
200 }
201 break;
202 case PPC970_INPUT_CKSTP:
203 /* Level sensitive - active low */
204 /* XXX: TODO: relay the signal to CKSTP_OUT pin */
205 if (level) {
206 LOG_IRQ("%s: stop the CPU\n", __func__);
207 env->halted = 1;
208 } else {
209 LOG_IRQ("%s: restart the CPU\n", __func__);
210 env->halted = 0;
211 }
212 break;
213 case PPC970_INPUT_HRESET:
214 /* Level sensitive - active low */
215 if (level) {
216 #if 0 // XXX: TOFIX
217 LOG_IRQ("%s: reset the CPU\n", __func__);
218 cpu_reset(env);
219 #endif
220 }
221 break;
222 case PPC970_INPUT_SRESET:
223 LOG_IRQ("%s: set the RESET IRQ state to %d\n",
224 __func__, level);
225 ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
226 break;
227 case PPC970_INPUT_TBEN:
228 LOG_IRQ("%s: set the TBEN state to %d\n", __func__,
229 level);
230 /* XXX: TODO */
231 break;
232 default:
233 /* Unknown pin - do nothing */
234 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
235 return;
236 }
237 if (level)
238 env->irq_input_state |= 1 << pin;
239 else
240 env->irq_input_state &= ~(1 << pin);
241 }
242 }
243
244 void ppc970_irq_init (CPUState *env)
245 {
246 env->irq_inputs = (void **)qemu_allocate_irqs(&ppc970_set_irq, env,
247 PPC970_INPUT_NB);
248 }
249 #endif /* defined(TARGET_PPC64) */
250
251 /* PowerPC 40x internal IRQ controller */
252 static void ppc40x_set_irq (void *opaque, int pin, int level)
253 {
254 CPUState *env = opaque;
255 int cur_level;
256
257 LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
258 env, pin, level);
259 cur_level = (env->irq_input_state >> pin) & 1;
260 /* Don't generate spurious events */
261 if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
262 switch (pin) {
263 case PPC40x_INPUT_RESET_SYS:
264 if (level) {
265 LOG_IRQ("%s: reset the PowerPC system\n",
266 __func__);
267 ppc40x_system_reset(env);
268 }
269 break;
270 case PPC40x_INPUT_RESET_CHIP:
271 if (level) {
272 LOG_IRQ("%s: reset the PowerPC chip\n", __func__);
273 ppc40x_chip_reset(env);
274 }
275 break;
276 case PPC40x_INPUT_RESET_CORE:
277 /* XXX: TODO: update DBSR[MRR] */
278 if (level) {
279 LOG_IRQ("%s: reset the PowerPC core\n", __func__);
280 ppc40x_core_reset(env);
281 }
282 break;
283 case PPC40x_INPUT_CINT:
284 /* Level sensitive - active high */
285 LOG_IRQ("%s: set the critical IRQ state to %d\n",
286 __func__, level);
287 ppc_set_irq(env, PPC_INTERRUPT_CEXT, level);
288 break;
289 case PPC40x_INPUT_INT:
290 /* Level sensitive - active high */
291 LOG_IRQ("%s: set the external IRQ state to %d\n",
292 __func__, level);
293 ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
294 break;
295 case PPC40x_INPUT_HALT:
296 /* Level sensitive - active low */
297 if (level) {
298 LOG_IRQ("%s: stop the CPU\n", __func__);
299 env->halted = 1;
300 } else {
301 LOG_IRQ("%s: restart the CPU\n", __func__);
302 env->halted = 0;
303 }
304 break;
305 case PPC40x_INPUT_DEBUG:
306 /* Level sensitive - active high */
307 LOG_IRQ("%s: set the debug pin state to %d\n",
308 __func__, level);
309 ppc_set_irq(env, PPC_INTERRUPT_DEBUG, level);
310 break;
311 default:
312 /* Unknown pin - do nothing */
313 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
314 return;
315 }
316 if (level)
317 env->irq_input_state |= 1 << pin;
318 else
319 env->irq_input_state &= ~(1 << pin);
320 }
321 }
322
323 void ppc40x_irq_init (CPUState *env)
324 {
325 env->irq_inputs = (void **)qemu_allocate_irqs(&ppc40x_set_irq,
326 env, PPC40x_INPUT_NB);
327 }
328
329 /* PowerPC E500 internal IRQ controller */
330 static void ppce500_set_irq (void *opaque, int pin, int level)
331 {
332 CPUState *env = opaque;
333 int cur_level;
334
335 LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
336 env, pin, level);
337 cur_level = (env->irq_input_state >> pin) & 1;
338 /* Don't generate spurious events */
339 if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
340 switch (pin) {
341 case PPCE500_INPUT_MCK:
342 if (level) {
343 LOG_IRQ("%s: reset the PowerPC system\n",
344 __func__);
345 qemu_system_reset_request();
346 }
347 break;
348 case PPCE500_INPUT_RESET_CORE:
349 if (level) {
350 LOG_IRQ("%s: reset the PowerPC core\n", __func__);
351 ppc_set_irq(env, PPC_INTERRUPT_MCK, level);
352 }
353 break;
354 case PPCE500_INPUT_CINT:
355 /* Level sensitive - active high */
356 LOG_IRQ("%s: set the critical IRQ state to %d\n",
357 __func__, level);
358 ppc_set_irq(env, PPC_INTERRUPT_CEXT, level);
359 break;
360 case PPCE500_INPUT_INT:
361 /* Level sensitive - active high */
362 LOG_IRQ("%s: set the core IRQ state to %d\n",
363 __func__, level);
364 ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
365 break;
366 case PPCE500_INPUT_DEBUG:
367 /* Level sensitive - active high */
368 LOG_IRQ("%s: set the debug pin state to %d\n",
369 __func__, level);
370 ppc_set_irq(env, PPC_INTERRUPT_DEBUG, level);
371 break;
372 default:
373 /* Unknown pin - do nothing */
374 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
375 return;
376 }
377 if (level)
378 env->irq_input_state |= 1 << pin;
379 else
380 env->irq_input_state &= ~(1 << pin);
381 }
382 }
383
384 void ppce500_irq_init (CPUState *env)
385 {
386 env->irq_inputs = (void **)qemu_allocate_irqs(&ppce500_set_irq,
387 env, PPCE500_INPUT_NB);
388 }
389 /*****************************************************************************/
390 /* PowerPC time base and decrementer emulation */
391 struct ppc_tb_t {
392 /* Time base management */
393 int64_t tb_offset; /* Compensation */
394 int64_t atb_offset; /* Compensation */
395 uint32_t tb_freq; /* TB frequency */
396 /* Decrementer management */
397 uint64_t decr_next; /* Tick for next decr interrupt */
398 uint32_t decr_freq; /* decrementer frequency */
399 struct QEMUTimer *decr_timer;
400 /* Hypervisor decrementer management */
401 uint64_t hdecr_next; /* Tick for next hdecr interrupt */
402 struct QEMUTimer *hdecr_timer;
403 uint64_t purr_load;
404 uint64_t purr_start;
405 void *opaque;
406 };
407
408 static inline uint64_t cpu_ppc_get_tb(ppc_tb_t *tb_env, uint64_t vmclk,
409 int64_t tb_offset)
410 {
411 /* TB time in tb periods */
412 return muldiv64(vmclk, tb_env->tb_freq, get_ticks_per_sec()) + tb_offset;
413 }
414
415 uint64_t cpu_ppc_load_tbl (CPUState *env)
416 {
417 ppc_tb_t *tb_env = env->tb_env;
418 uint64_t tb;
419
420 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
421 LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
422
423 return tb;
424 }
425
426 static inline uint32_t _cpu_ppc_load_tbu(CPUState *env)
427 {
428 ppc_tb_t *tb_env = env->tb_env;
429 uint64_t tb;
430
431 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
432 LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
433
434 return tb >> 32;
435 }
436
437 uint32_t cpu_ppc_load_tbu (CPUState *env)
438 {
439 return _cpu_ppc_load_tbu(env);
440 }
441
442 static inline void cpu_ppc_store_tb(ppc_tb_t *tb_env, uint64_t vmclk,
443 int64_t *tb_offsetp, uint64_t value)
444 {
445 *tb_offsetp = value - muldiv64(vmclk, tb_env->tb_freq, get_ticks_per_sec());
446 LOG_TB("%s: tb %016" PRIx64 " offset %08" PRIx64 "\n",
447 __func__, value, *tb_offsetp);
448 }
449
450 void cpu_ppc_store_tbl (CPUState *env, uint32_t value)
451 {
452 ppc_tb_t *tb_env = env->tb_env;
453 uint64_t tb;
454
455 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
456 tb &= 0xFFFFFFFF00000000ULL;
457 cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
458 &tb_env->tb_offset, tb | (uint64_t)value);
459 }
460
461 static inline void _cpu_ppc_store_tbu(CPUState *env, uint32_t value)
462 {
463 ppc_tb_t *tb_env = env->tb_env;
464 uint64_t tb;
465
466 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
467 tb &= 0x00000000FFFFFFFFULL;
468 cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
469 &tb_env->tb_offset, ((uint64_t)value << 32) | tb);
470 }
471
472 void cpu_ppc_store_tbu (CPUState *env, uint32_t value)
473 {
474 _cpu_ppc_store_tbu(env, value);
475 }
476
477 uint64_t cpu_ppc_load_atbl (CPUState *env)
478 {
479 ppc_tb_t *tb_env = env->tb_env;
480 uint64_t tb;
481
482 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
483 LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
484
485 return tb;
486 }
487
488 uint32_t cpu_ppc_load_atbu (CPUState *env)
489 {
490 ppc_tb_t *tb_env = env->tb_env;
491 uint64_t tb;
492
493 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
494 LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
495
496 return tb >> 32;
497 }
498
499 void cpu_ppc_store_atbl (CPUState *env, uint32_t value)
500 {
501 ppc_tb_t *tb_env = env->tb_env;
502 uint64_t tb;
503
504 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
505 tb &= 0xFFFFFFFF00000000ULL;
506 cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
507 &tb_env->atb_offset, tb | (uint64_t)value);
508 }
509
510 void cpu_ppc_store_atbu (CPUState *env, uint32_t value)
511 {
512 ppc_tb_t *tb_env = env->tb_env;
513 uint64_t tb;
514
515 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
516 tb &= 0x00000000FFFFFFFFULL;
517 cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
518 &tb_env->atb_offset, ((uint64_t)value << 32) | tb);
519 }
520
521 static void cpu_ppc_tb_stop (CPUState *env)
522 {
523 ppc_tb_t *tb_env = env->tb_env;
524 uint64_t tb, atb, vmclk;
525
526 /* If the time base is already frozen, do nothing */
527 if (tb_env->tb_freq != 0) {
528 vmclk = qemu_get_clock(vm_clock);
529 /* Get the time base */
530 tb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->tb_offset);
531 /* Get the alternate time base */
532 atb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->atb_offset);
533 /* Store the time base value (ie compute the current offset) */
534 cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
535 /* Store the alternate time base value (compute the current offset) */
536 cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
537 /* Set the time base frequency to zero */
538 tb_env->tb_freq = 0;
539 /* Now, the time bases are frozen to tb_offset / atb_offset value */
540 }
541 }
542
543 static void cpu_ppc_tb_start (CPUState *env)
544 {
545 ppc_tb_t *tb_env = env->tb_env;
546 uint64_t tb, atb, vmclk;
547
548 /* If the time base is not frozen, do nothing */
549 if (tb_env->tb_freq == 0) {
550 vmclk = qemu_get_clock(vm_clock);
551 /* Get the time base from tb_offset */
552 tb = tb_env->tb_offset;
553 /* Get the alternate time base from atb_offset */
554 atb = tb_env->atb_offset;
555 /* Restore the tb frequency from the decrementer frequency */
556 tb_env->tb_freq = tb_env->decr_freq;
557 /* Store the time base value */
558 cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
559 /* Store the alternate time base value */
560 cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
561 }
562 }
563
564 static inline uint32_t _cpu_ppc_load_decr(CPUState *env, uint64_t next)
565 {
566 ppc_tb_t *tb_env = env->tb_env;
567 uint32_t decr;
568 int64_t diff;
569
570 diff = next - qemu_get_clock(vm_clock);
571 if (diff >= 0)
572 decr = muldiv64(diff, tb_env->decr_freq, get_ticks_per_sec());
573 else
574 decr = -muldiv64(-diff, tb_env->decr_freq, get_ticks_per_sec());
575 LOG_TB("%s: %08" PRIx32 "\n", __func__, decr);
576
577 return decr;
578 }
579
580 uint32_t cpu_ppc_load_decr (CPUState *env)
581 {
582 ppc_tb_t *tb_env = env->tb_env;
583
584 return _cpu_ppc_load_decr(env, tb_env->decr_next);
585 }
586
587 uint32_t cpu_ppc_load_hdecr (CPUState *env)
588 {
589 ppc_tb_t *tb_env = env->tb_env;
590
591 return _cpu_ppc_load_decr(env, tb_env->hdecr_next);
592 }
593
594 uint64_t cpu_ppc_load_purr (CPUState *env)
595 {
596 ppc_tb_t *tb_env = env->tb_env;
597 uint64_t diff;
598
599 diff = qemu_get_clock(vm_clock) - tb_env->purr_start;
600
601 return tb_env->purr_load + muldiv64(diff, tb_env->tb_freq, get_ticks_per_sec());
602 }
603
604 /* When decrementer expires,
605 * all we need to do is generate or queue a CPU exception
606 */
607 static inline void cpu_ppc_decr_excp(CPUState *env)
608 {
609 /* Raise it */
610 LOG_TB("raise decrementer exception\n");
611 ppc_set_irq(env, PPC_INTERRUPT_DECR, 1);
612 }
613
614 static inline void cpu_ppc_hdecr_excp(CPUState *env)
615 {
616 /* Raise it */
617 LOG_TB("raise decrementer exception\n");
618 ppc_set_irq(env, PPC_INTERRUPT_HDECR, 1);
619 }
620
621 static void __cpu_ppc_store_decr (CPUState *env, uint64_t *nextp,
622 struct QEMUTimer *timer,
623 void (*raise_excp)(CPUState *),
624 uint32_t decr, uint32_t value,
625 int is_excp)
626 {
627 ppc_tb_t *tb_env = env->tb_env;
628 uint64_t now, next;
629
630 LOG_TB("%s: %08" PRIx32 " => %08" PRIx32 "\n", __func__,
631 decr, value);
632 now = qemu_get_clock(vm_clock);
633 next = now + muldiv64(value, get_ticks_per_sec(), tb_env->decr_freq);
634 if (is_excp)
635 next += *nextp - now;
636 if (next == now)
637 next++;
638 *nextp = next;
639 /* Adjust timer */
640 qemu_mod_timer(timer, next);
641 /* If we set a negative value and the decrementer was positive,
642 * raise an exception.
643 */
644 if ((value & 0x80000000) && !(decr & 0x80000000))
645 (*raise_excp)(env);
646 }
647
648 static inline void _cpu_ppc_store_decr(CPUState *env, uint32_t decr,
649 uint32_t value, int is_excp)
650 {
651 ppc_tb_t *tb_env = env->tb_env;
652
653 __cpu_ppc_store_decr(env, &tb_env->decr_next, tb_env->decr_timer,
654 &cpu_ppc_decr_excp, decr, value, is_excp);
655 }
656
657 void cpu_ppc_store_decr (CPUState *env, uint32_t value)
658 {
659 _cpu_ppc_store_decr(env, cpu_ppc_load_decr(env), value, 0);
660 }
661
662 static void cpu_ppc_decr_cb (void *opaque)
663 {
664 _cpu_ppc_store_decr(opaque, 0x00000000, 0xFFFFFFFF, 1);
665 }
666
667 static inline void _cpu_ppc_store_hdecr(CPUState *env, uint32_t hdecr,
668 uint32_t value, int is_excp)
669 {
670 ppc_tb_t *tb_env = env->tb_env;
671
672 if (tb_env->hdecr_timer != NULL) {
673 __cpu_ppc_store_decr(env, &tb_env->hdecr_next, tb_env->hdecr_timer,
674 &cpu_ppc_hdecr_excp, hdecr, value, is_excp);
675 }
676 }
677
678 void cpu_ppc_store_hdecr (CPUState *env, uint32_t value)
679 {
680 _cpu_ppc_store_hdecr(env, cpu_ppc_load_hdecr(env), value, 0);
681 }
682
683 static void cpu_ppc_hdecr_cb (void *opaque)
684 {
685 _cpu_ppc_store_hdecr(opaque, 0x00000000, 0xFFFFFFFF, 1);
686 }
687
688 void cpu_ppc_store_purr (CPUState *env, uint64_t value)
689 {
690 ppc_tb_t *tb_env = env->tb_env;
691
692 tb_env->purr_load = value;
693 tb_env->purr_start = qemu_get_clock(vm_clock);
694 }
695
696 static void cpu_ppc_set_tb_clk (void *opaque, uint32_t freq)
697 {
698 CPUState *env = opaque;
699 ppc_tb_t *tb_env = env->tb_env;
700
701 tb_env->tb_freq = freq;
702 tb_env->decr_freq = freq;
703 /* There is a bug in Linux 2.4 kernels:
704 * if a decrementer exception is pending when it enables msr_ee at startup,
705 * it's not ready to handle it...
706 */
707 _cpu_ppc_store_decr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
708 _cpu_ppc_store_hdecr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
709 cpu_ppc_store_purr(env, 0x0000000000000000ULL);
710 }
711
712 /* Set up (once) timebase frequency (in Hz) */
713 clk_setup_cb cpu_ppc_tb_init (CPUState *env, uint32_t freq)
714 {
715 ppc_tb_t *tb_env;
716
717 tb_env = qemu_mallocz(sizeof(ppc_tb_t));
718 env->tb_env = tb_env;
719 /* Create new timer */
720 tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_ppc_decr_cb, env);
721 if (0) {
722 /* XXX: find a suitable condition to enable the hypervisor decrementer
723 */
724 tb_env->hdecr_timer = qemu_new_timer(vm_clock, &cpu_ppc_hdecr_cb, env);
725 } else {
726 tb_env->hdecr_timer = NULL;
727 }
728 cpu_ppc_set_tb_clk(env, freq);
729
730 return &cpu_ppc_set_tb_clk;
731 }
732
733 /* Specific helpers for POWER & PowerPC 601 RTC */
734 #if 0
735 static clk_setup_cb cpu_ppc601_rtc_init (CPUState *env)
736 {
737 return cpu_ppc_tb_init(env, 7812500);
738 }
739 #endif
740
741 void cpu_ppc601_store_rtcu (CPUState *env, uint32_t value)
742 {
743 _cpu_ppc_store_tbu(env, value);
744 }
745
746 uint32_t cpu_ppc601_load_rtcu (CPUState *env)
747 {
748 return _cpu_ppc_load_tbu(env);
749 }
750
751 void cpu_ppc601_store_rtcl (CPUState *env, uint32_t value)
752 {
753 cpu_ppc_store_tbl(env, value & 0x3FFFFF80);
754 }
755
756 uint32_t cpu_ppc601_load_rtcl (CPUState *env)
757 {
758 return cpu_ppc_load_tbl(env) & 0x3FFFFF80;
759 }
760
761 /*****************************************************************************/
762 /* Embedded PowerPC timers */
763
764 /* PIT, FIT & WDT */
765 typedef struct ppcemb_timer_t ppcemb_timer_t;
766 struct ppcemb_timer_t {
767 uint64_t pit_reload; /* PIT auto-reload value */
768 uint64_t fit_next; /* Tick for next FIT interrupt */
769 struct QEMUTimer *fit_timer;
770 uint64_t wdt_next; /* Tick for next WDT interrupt */
771 struct QEMUTimer *wdt_timer;
772
773 /* 405 have the PIT, 440 have a DECR. */
774 unsigned int decr_excp;
775 };
776
777 /* Fixed interval timer */
778 static void cpu_4xx_fit_cb (void *opaque)
779 {
780 CPUState *env;
781 ppc_tb_t *tb_env;
782 ppcemb_timer_t *ppcemb_timer;
783 uint64_t now, next;
784
785 env = opaque;
786 tb_env = env->tb_env;
787 ppcemb_timer = tb_env->opaque;
788 now = qemu_get_clock(vm_clock);
789 switch ((env->spr[SPR_40x_TCR] >> 24) & 0x3) {
790 case 0:
791 next = 1 << 9;
792 break;
793 case 1:
794 next = 1 << 13;
795 break;
796 case 2:
797 next = 1 << 17;
798 break;
799 case 3:
800 next = 1 << 21;
801 break;
802 default:
803 /* Cannot occur, but makes gcc happy */
804 return;
805 }
806 next = now + muldiv64(next, get_ticks_per_sec(), tb_env->tb_freq);
807 if (next == now)
808 next++;
809 qemu_mod_timer(ppcemb_timer->fit_timer, next);
810 env->spr[SPR_40x_TSR] |= 1 << 26;
811 if ((env->spr[SPR_40x_TCR] >> 23) & 0x1)
812 ppc_set_irq(env, PPC_INTERRUPT_FIT, 1);
813 LOG_TB("%s: ir %d TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx "\n", __func__,
814 (int)((env->spr[SPR_40x_TCR] >> 23) & 0x1),
815 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
816 }
817
818 /* Programmable interval timer */
819 static void start_stop_pit (CPUState *env, ppc_tb_t *tb_env, int is_excp)
820 {
821 ppcemb_timer_t *ppcemb_timer;
822 uint64_t now, next;
823
824 ppcemb_timer = tb_env->opaque;
825 if (ppcemb_timer->pit_reload <= 1 ||
826 !((env->spr[SPR_40x_TCR] >> 26) & 0x1) ||
827 (is_excp && !((env->spr[SPR_40x_TCR] >> 22) & 0x1))) {
828 /* Stop PIT */
829 LOG_TB("%s: stop PIT\n", __func__);
830 qemu_del_timer(tb_env->decr_timer);
831 } else {
832 LOG_TB("%s: start PIT %016" PRIx64 "\n",
833 __func__, ppcemb_timer->pit_reload);
834 now = qemu_get_clock(vm_clock);
835 next = now + muldiv64(ppcemb_timer->pit_reload,
836 get_ticks_per_sec(), tb_env->decr_freq);
837 if (is_excp)
838 next += tb_env->decr_next - now;
839 if (next == now)
840 next++;
841 qemu_mod_timer(tb_env->decr_timer, next);
842 tb_env->decr_next = next;
843 }
844 }
845
846 static void cpu_4xx_pit_cb (void *opaque)
847 {
848 CPUState *env;
849 ppc_tb_t *tb_env;
850 ppcemb_timer_t *ppcemb_timer;
851
852 env = opaque;
853 tb_env = env->tb_env;
854 ppcemb_timer = tb_env->opaque;
855 env->spr[SPR_40x_TSR] |= 1 << 27;
856 if ((env->spr[SPR_40x_TCR] >> 26) & 0x1)
857 ppc_set_irq(env, ppcemb_timer->decr_excp, 1);
858 start_stop_pit(env, tb_env, 1);
859 LOG_TB("%s: ar %d ir %d TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx " "
860 "%016" PRIx64 "\n", __func__,
861 (int)((env->spr[SPR_40x_TCR] >> 22) & 0x1),
862 (int)((env->spr[SPR_40x_TCR] >> 26) & 0x1),
863 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR],
864 ppcemb_timer->pit_reload);
865 }
866
867 /* Watchdog timer */
868 static void cpu_4xx_wdt_cb (void *opaque)
869 {
870 CPUState *env;
871 ppc_tb_t *tb_env;
872 ppcemb_timer_t *ppcemb_timer;
873 uint64_t now, next;
874
875 env = opaque;
876 tb_env = env->tb_env;
877 ppcemb_timer = tb_env->opaque;
878 now = qemu_get_clock(vm_clock);
879 switch ((env->spr[SPR_40x_TCR] >> 30) & 0x3) {
880 case 0:
881 next = 1 << 17;
882 break;
883 case 1:
884 next = 1 << 21;
885 break;
886 case 2:
887 next = 1 << 25;
888 break;
889 case 3:
890 next = 1 << 29;
891 break;
892 default:
893 /* Cannot occur, but makes gcc happy */
894 return;
895 }
896 next = now + muldiv64(next, get_ticks_per_sec(), tb_env->decr_freq);
897 if (next == now)
898 next++;
899 LOG_TB("%s: TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx "\n", __func__,
900 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
901 switch ((env->spr[SPR_40x_TSR] >> 30) & 0x3) {
902 case 0x0:
903 case 0x1:
904 qemu_mod_timer(ppcemb_timer->wdt_timer, next);
905 ppcemb_timer->wdt_next = next;
906 env->spr[SPR_40x_TSR] |= 1 << 31;
907 break;
908 case 0x2:
909 qemu_mod_timer(ppcemb_timer->wdt_timer, next);
910 ppcemb_timer->wdt_next = next;
911 env->spr[SPR_40x_TSR] |= 1 << 30;
912 if ((env->spr[SPR_40x_TCR] >> 27) & 0x1)
913 ppc_set_irq(env, PPC_INTERRUPT_WDT, 1);
914 break;
915 case 0x3:
916 env->spr[SPR_40x_TSR] &= ~0x30000000;
917 env->spr[SPR_40x_TSR] |= env->spr[SPR_40x_TCR] & 0x30000000;
918 switch ((env->spr[SPR_40x_TCR] >> 28) & 0x3) {
919 case 0x0:
920 /* No reset */
921 break;
922 case 0x1: /* Core reset */
923 ppc40x_core_reset(env);
924 break;
925 case 0x2: /* Chip reset */
926 ppc40x_chip_reset(env);
927 break;
928 case 0x3: /* System reset */
929 ppc40x_system_reset(env);
930 break;
931 }
932 }
933 }
934
935 void store_40x_pit (CPUState *env, target_ulong val)
936 {
937 ppc_tb_t *tb_env;
938 ppcemb_timer_t *ppcemb_timer;
939
940 tb_env = env->tb_env;
941 ppcemb_timer = tb_env->opaque;
942 LOG_TB("%s val" TARGET_FMT_lx "\n", __func__, val);
943 ppcemb_timer->pit_reload = val;
944 start_stop_pit(env, tb_env, 0);
945 }
946
947 target_ulong load_40x_pit (CPUState *env)
948 {
949 return cpu_ppc_load_decr(env);
950 }
951
952 void store_booke_tsr (CPUState *env, target_ulong val)
953 {
954 ppc_tb_t *tb_env = env->tb_env;
955 ppcemb_timer_t *ppcemb_timer;
956
957 ppcemb_timer = tb_env->opaque;
958
959 LOG_TB("%s: val " TARGET_FMT_lx "\n", __func__, val);
960 env->spr[SPR_40x_TSR] &= ~(val & 0xFC000000);
961 if (val & 0x80000000)
962 ppc_set_irq(env, ppcemb_timer->decr_excp, 0);
963 }
964
965 void store_booke_tcr (CPUState *env, target_ulong val)
966 {
967 ppc_tb_t *tb_env;
968
969 tb_env = env->tb_env;
970 LOG_TB("%s: val " TARGET_FMT_lx "\n", __func__, val);
971 env->spr[SPR_40x_TCR] = val & 0xFFC00000;
972 start_stop_pit(env, tb_env, 1);
973 cpu_4xx_wdt_cb(env);
974 }
975
976 static void ppc_emb_set_tb_clk (void *opaque, uint32_t freq)
977 {
978 CPUState *env = opaque;
979 ppc_tb_t *tb_env = env->tb_env;
980
981 LOG_TB("%s set new frequency to %" PRIu32 "\n", __func__,
982 freq);
983 tb_env->tb_freq = freq;
984 tb_env->decr_freq = freq;
985 /* XXX: we should also update all timers */
986 }
987
988 clk_setup_cb ppc_emb_timers_init (CPUState *env, uint32_t freq,
989 unsigned int decr_excp)
990 {
991 ppc_tb_t *tb_env;
992 ppcemb_timer_t *ppcemb_timer;
993
994 tb_env = qemu_mallocz(sizeof(ppc_tb_t));
995 env->tb_env = tb_env;
996 ppcemb_timer = qemu_mallocz(sizeof(ppcemb_timer_t));
997 tb_env->tb_freq = freq;
998 tb_env->decr_freq = freq;
999 tb_env->opaque = ppcemb_timer;
1000 LOG_TB("%s freq %" PRIu32 "\n", __func__, freq);
1001 if (ppcemb_timer != NULL) {
1002 /* We use decr timer for PIT */
1003 tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_4xx_pit_cb, env);
1004 ppcemb_timer->fit_timer =
1005 qemu_new_timer(vm_clock, &cpu_4xx_fit_cb, env);
1006 ppcemb_timer->wdt_timer =
1007 qemu_new_timer(vm_clock, &cpu_4xx_wdt_cb, env);
1008 ppcemb_timer->decr_excp = decr_excp;
1009 }
1010
1011 return &ppc_emb_set_tb_clk;
1012 }
1013
1014 /*****************************************************************************/
1015 /* Embedded PowerPC Device Control Registers */
1016 typedef struct ppc_dcrn_t ppc_dcrn_t;
1017 struct ppc_dcrn_t {
1018 dcr_read_cb dcr_read;
1019 dcr_write_cb dcr_write;
1020 void *opaque;
1021 };
1022
1023 /* XXX: on 460, DCR addresses are 32 bits wide,
1024 * using DCRIPR to get the 22 upper bits of the DCR address
1025 */
1026 #define DCRN_NB 1024
1027 struct ppc_dcr_t {
1028 ppc_dcrn_t dcrn[DCRN_NB];
1029 int (*read_error)(int dcrn);
1030 int (*write_error)(int dcrn);
1031 };
1032
1033 int ppc_dcr_read (ppc_dcr_t *dcr_env, int dcrn, uint32_t *valp)
1034 {
1035 ppc_dcrn_t *dcr;
1036
1037 if (dcrn < 0 || dcrn >= DCRN_NB)
1038 goto error;
1039 dcr = &dcr_env->dcrn[dcrn];
1040 if (dcr->dcr_read == NULL)
1041 goto error;
1042 *valp = (*dcr->dcr_read)(dcr->opaque, dcrn);
1043
1044 return 0;
1045
1046 error:
1047 if (dcr_env->read_error != NULL)
1048 return (*dcr_env->read_error)(dcrn);
1049
1050 return -1;
1051 }
1052
1053 int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, uint32_t val)
1054 {
1055 ppc_dcrn_t *dcr;
1056
1057 if (dcrn < 0 || dcrn >= DCRN_NB)
1058 goto error;
1059 dcr = &dcr_env->dcrn[dcrn];
1060 if (dcr->dcr_write == NULL)
1061 goto error;
1062 (*dcr->dcr_write)(dcr->opaque, dcrn, val);
1063
1064 return 0;
1065
1066 error:
1067 if (dcr_env->write_error != NULL)
1068 return (*dcr_env->write_error)(dcrn);
1069
1070 return -1;
1071 }
1072
1073 int ppc_dcr_register (CPUState *env, int dcrn, void *opaque,
1074 dcr_read_cb dcr_read, dcr_write_cb dcr_write)
1075 {
1076 ppc_dcr_t *dcr_env;
1077 ppc_dcrn_t *dcr;
1078
1079 dcr_env = env->dcr_env;
1080 if (dcr_env == NULL)
1081 return -1;
1082 if (dcrn < 0 || dcrn >= DCRN_NB)
1083 return -1;
1084 dcr = &dcr_env->dcrn[dcrn];
1085 if (dcr->opaque != NULL ||
1086 dcr->dcr_read != NULL ||
1087 dcr->dcr_write != NULL)
1088 return -1;
1089 dcr->opaque = opaque;
1090 dcr->dcr_read = dcr_read;
1091 dcr->dcr_write = dcr_write;
1092
1093 return 0;
1094 }
1095
1096 int ppc_dcr_init (CPUState *env, int (*read_error)(int dcrn),
1097 int (*write_error)(int dcrn))
1098 {
1099 ppc_dcr_t *dcr_env;
1100
1101 dcr_env = qemu_mallocz(sizeof(ppc_dcr_t));
1102 dcr_env->read_error = read_error;
1103 dcr_env->write_error = write_error;
1104 env->dcr_env = dcr_env;
1105
1106 return 0;
1107 }
1108
1109 /*****************************************************************************/
1110 /* Debug port */
1111 void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
1112 {
1113 addr &= 0xF;
1114 switch (addr) {
1115 case 0:
1116 printf("%c", val);
1117 break;
1118 case 1:
1119 printf("\n");
1120 fflush(stdout);
1121 break;
1122 case 2:
1123 printf("Set loglevel to %04" PRIx32 "\n", val);
1124 cpu_set_log(val | 0x100);
1125 break;
1126 }
1127 }
1128
1129 /*****************************************************************************/
1130 /* NVRAM helpers */
1131 static inline uint32_t nvram_read (nvram_t *nvram, uint32_t addr)
1132 {
1133 return (*nvram->read_fn)(nvram->opaque, addr);;
1134 }
1135
1136 static inline void nvram_write (nvram_t *nvram, uint32_t addr, uint32_t val)
1137 {
1138 (*nvram->write_fn)(nvram->opaque, addr, val);
1139 }
1140
1141 void NVRAM_set_byte (nvram_t *nvram, uint32_t addr, uint8_t value)
1142 {
1143 nvram_write(nvram, addr, value);
1144 }
1145
1146 uint8_t NVRAM_get_byte (nvram_t *nvram, uint32_t addr)
1147 {
1148 return nvram_read(nvram, addr);
1149 }
1150
1151 void NVRAM_set_word (nvram_t *nvram, uint32_t addr, uint16_t value)
1152 {
1153 nvram_write(nvram, addr, value >> 8);
1154 nvram_write(nvram, addr + 1, value & 0xFF);
1155 }
1156
1157 uint16_t NVRAM_get_word (nvram_t *nvram, uint32_t addr)
1158 {
1159 uint16_t tmp;
1160
1161 tmp = nvram_read(nvram, addr) << 8;
1162 tmp |= nvram_read(nvram, addr + 1);
1163
1164 return tmp;
1165 }
1166
1167 void NVRAM_set_lword (nvram_t *nvram, uint32_t addr, uint32_t value)
1168 {
1169 nvram_write(nvram, addr, value >> 24);
1170 nvram_write(nvram, addr + 1, (value >> 16) & 0xFF);
1171 nvram_write(nvram, addr + 2, (value >> 8) & 0xFF);
1172 nvram_write(nvram, addr + 3, value & 0xFF);
1173 }
1174
1175 uint32_t NVRAM_get_lword (nvram_t *nvram, uint32_t addr)
1176 {
1177 uint32_t tmp;
1178
1179 tmp = nvram_read(nvram, addr) << 24;
1180 tmp |= nvram_read(nvram, addr + 1) << 16;
1181 tmp |= nvram_read(nvram, addr + 2) << 8;
1182 tmp |= nvram_read(nvram, addr + 3);
1183
1184 return tmp;
1185 }
1186
1187 void NVRAM_set_string (nvram_t *nvram, uint32_t addr,
1188 const char *str, uint32_t max)
1189 {
1190 int i;
1191
1192 for (i = 0; i < max && str[i] != '\0'; i++) {
1193 nvram_write(nvram, addr + i, str[i]);
1194 }
1195 nvram_write(nvram, addr + i, str[i]);
1196 nvram_write(nvram, addr + max - 1, '\0');
1197 }
1198
1199 int NVRAM_get_string (nvram_t *nvram, uint8_t *dst, uint16_t addr, int max)
1200 {
1201 int i;
1202
1203 memset(dst, 0, max);
1204 for (i = 0; i < max; i++) {
1205 dst[i] = NVRAM_get_byte(nvram, addr + i);
1206 if (dst[i] == '\0')
1207 break;
1208 }
1209
1210 return i;
1211 }
1212
1213 static uint16_t NVRAM_crc_update (uint16_t prev, uint16_t value)
1214 {
1215 uint16_t tmp;
1216 uint16_t pd, pd1, pd2;
1217
1218 tmp = prev >> 8;
1219 pd = prev ^ value;
1220 pd1 = pd & 0x000F;
1221 pd2 = ((pd >> 4) & 0x000F) ^ pd1;
1222 tmp ^= (pd1 << 3) | (pd1 << 8);
1223 tmp ^= pd2 | (pd2 << 7) | (pd2 << 12);
1224
1225 return tmp;
1226 }
1227
1228 static uint16_t NVRAM_compute_crc (nvram_t *nvram, uint32_t start, uint32_t count)
1229 {
1230 uint32_t i;
1231 uint16_t crc = 0xFFFF;
1232 int odd;
1233
1234 odd = count & 1;
1235 count &= ~1;
1236 for (i = 0; i != count; i++) {
1237 crc = NVRAM_crc_update(crc, NVRAM_get_word(nvram, start + i));
1238 }
1239 if (odd) {
1240 crc = NVRAM_crc_update(crc, NVRAM_get_byte(nvram, start + i) << 8);
1241 }
1242
1243 return crc;
1244 }
1245
1246 #define CMDLINE_ADDR 0x017ff000
1247
1248 int PPC_NVRAM_set_params (nvram_t *nvram, uint16_t NVRAM_size,
1249 const char *arch,
1250 uint32_t RAM_size, int boot_device,
1251 uint32_t kernel_image, uint32_t kernel_size,
1252 const char *cmdline,
1253 uint32_t initrd_image, uint32_t initrd_size,
1254 uint32_t NVRAM_image,
1255 int width, int height, int depth)
1256 {
1257 uint16_t crc;
1258
1259 /* Set parameters for Open Hack'Ware BIOS */
1260 NVRAM_set_string(nvram, 0x00, "QEMU_BIOS", 16);
1261 NVRAM_set_lword(nvram, 0x10, 0x00000002); /* structure v2 */
1262 NVRAM_set_word(nvram, 0x14, NVRAM_size);
1263 NVRAM_set_string(nvram, 0x20, arch, 16);
1264 NVRAM_set_lword(nvram, 0x30, RAM_size);
1265 NVRAM_set_byte(nvram, 0x34, boot_device);
1266 NVRAM_set_lword(nvram, 0x38, kernel_image);
1267 NVRAM_set_lword(nvram, 0x3C, kernel_size);
1268 if (cmdline) {
1269 /* XXX: put the cmdline in NVRAM too ? */
1270 pstrcpy_targphys("cmdline", CMDLINE_ADDR, RAM_size - CMDLINE_ADDR, cmdline);
1271 NVRAM_set_lword(nvram, 0x40, CMDLINE_ADDR);
1272 NVRAM_set_lword(nvram, 0x44, strlen(cmdline));
1273 } else {
1274 NVRAM_set_lword(nvram, 0x40, 0);
1275 NVRAM_set_lword(nvram, 0x44, 0);
1276 }
1277 NVRAM_set_lword(nvram, 0x48, initrd_image);
1278 NVRAM_set_lword(nvram, 0x4C, initrd_size);
1279 NVRAM_set_lword(nvram, 0x50, NVRAM_image);
1280
1281 NVRAM_set_word(nvram, 0x54, width);
1282 NVRAM_set_word(nvram, 0x56, height);
1283 NVRAM_set_word(nvram, 0x58, depth);
1284 crc = NVRAM_compute_crc(nvram, 0x00, 0xF8);
1285 NVRAM_set_word(nvram, 0xFC, crc);
1286
1287 return 0;
1288 }
QEmu