2 * QEMU generic PowerPC hardware System Emulator
4 * Copyright (c) 2003-2007 Jocelyn Mayer
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26 #include "qemu-timer.h"
34 //#define PPC_DEBUG_IRQ
35 //#define PPC_DEBUG_TB
38 # define LOG_IRQ(...) qemu_log_mask(CPU_LOG_INT, ## __VA_ARGS__)
40 # define LOG_IRQ(...) do { } while (0)
45 # define LOG_TB(...) qemu_log(__VA_ARGS__)
47 # define LOG_TB(...) do { } while (0)
50 static void cpu_ppc_tb_stop (CPUPPCState
*env
);
51 static void cpu_ppc_tb_start (CPUPPCState
*env
);
53 void ppc_set_irq(PowerPCCPU
*cpu
, int n_IRQ
, int level
)
55 CPUPPCState
*env
= &cpu
->env
;
56 unsigned int old_pending
= env
->pending_interrupts
;
59 env
->pending_interrupts
|= 1 << n_IRQ
;
60 cpu_interrupt(env
, CPU_INTERRUPT_HARD
);
62 env
->pending_interrupts
&= ~(1 << n_IRQ
);
63 if (env
->pending_interrupts
== 0)
64 cpu_reset_interrupt(env
, CPU_INTERRUPT_HARD
);
67 if (old_pending
!= env
->pending_interrupts
) {
69 kvmppc_set_interrupt(cpu
, n_IRQ
, level
);
73 LOG_IRQ("%s: %p n_IRQ %d level %d => pending %08" PRIx32
74 "req %08x\n", __func__
, env
, n_IRQ
, level
,
75 env
->pending_interrupts
, env
->interrupt_request
);
78 /* PowerPC 6xx / 7xx internal IRQ controller */
79 static void ppc6xx_set_irq(void *opaque
, int pin
, int level
)
81 PowerPCCPU
*cpu
= opaque
;
82 CPUPPCState
*env
= &cpu
->env
;
85 LOG_IRQ("%s: env %p pin %d level %d\n", __func__
,
87 cur_level
= (env
->irq_input_state
>> pin
) & 1;
88 /* Don't generate spurious events */
89 if ((cur_level
== 1 && level
== 0) || (cur_level
== 0 && level
!= 0)) {
91 case PPC6xx_INPUT_TBEN
:
92 /* Level sensitive - active high */
93 LOG_IRQ("%s: %s the time base\n",
94 __func__
, level
? "start" : "stop");
96 cpu_ppc_tb_start(env
);
100 case PPC6xx_INPUT_INT
:
101 /* Level sensitive - active high */
102 LOG_IRQ("%s: set the external IRQ state to %d\n",
104 ppc_set_irq(cpu
, PPC_INTERRUPT_EXT
, level
);
106 case PPC6xx_INPUT_SMI
:
107 /* Level sensitive - active high */
108 LOG_IRQ("%s: set the SMI IRQ state to %d\n",
110 ppc_set_irq(cpu
, PPC_INTERRUPT_SMI
, level
);
112 case PPC6xx_INPUT_MCP
:
113 /* Negative edge sensitive */
114 /* XXX: TODO: actual reaction may depends on HID0 status
115 * 603/604/740/750: check HID0[EMCP]
117 if (cur_level
== 1 && level
== 0) {
118 LOG_IRQ("%s: raise machine check state\n",
120 ppc_set_irq(cpu
, PPC_INTERRUPT_MCK
, 1);
123 case PPC6xx_INPUT_CKSTP_IN
:
124 /* Level sensitive - active low */
125 /* XXX: TODO: relay the signal to CKSTP_OUT pin */
126 /* XXX: Note that the only way to restart the CPU is to reset it */
128 LOG_IRQ("%s: stop the CPU\n", __func__
);
132 case PPC6xx_INPUT_HRESET
:
133 /* Level sensitive - active low */
135 LOG_IRQ("%s: reset the CPU\n", __func__
);
136 cpu_interrupt(env
, CPU_INTERRUPT_RESET
);
139 case PPC6xx_INPUT_SRESET
:
140 LOG_IRQ("%s: set the RESET IRQ state to %d\n",
142 ppc_set_irq(cpu
, PPC_INTERRUPT_RESET
, level
);
145 /* Unknown pin - do nothing */
146 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__
, pin
);
150 env
->irq_input_state
|= 1 << pin
;
152 env
->irq_input_state
&= ~(1 << pin
);
156 void ppc6xx_irq_init(CPUPPCState
*env
)
158 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
160 env
->irq_inputs
= (void **)qemu_allocate_irqs(&ppc6xx_set_irq
, cpu
,
164 #if defined(TARGET_PPC64)
165 /* PowerPC 970 internal IRQ controller */
166 static void ppc970_set_irq(void *opaque
, int pin
, int level
)
168 PowerPCCPU
*cpu
= opaque
;
169 CPUPPCState
*env
= &cpu
->env
;
172 LOG_IRQ("%s: env %p pin %d level %d\n", __func__
,
174 cur_level
= (env
->irq_input_state
>> pin
) & 1;
175 /* Don't generate spurious events */
176 if ((cur_level
== 1 && level
== 0) || (cur_level
== 0 && level
!= 0)) {
178 case PPC970_INPUT_INT
:
179 /* Level sensitive - active high */
180 LOG_IRQ("%s: set the external IRQ state to %d\n",
182 ppc_set_irq(cpu
, PPC_INTERRUPT_EXT
, level
);
184 case PPC970_INPUT_THINT
:
185 /* Level sensitive - active high */
186 LOG_IRQ("%s: set the SMI IRQ state to %d\n", __func__
,
188 ppc_set_irq(cpu
, PPC_INTERRUPT_THERM
, level
);
190 case PPC970_INPUT_MCP
:
191 /* Negative edge sensitive */
192 /* XXX: TODO: actual reaction may depends on HID0 status
193 * 603/604/740/750: check HID0[EMCP]
195 if (cur_level
== 1 && level
== 0) {
196 LOG_IRQ("%s: raise machine check state\n",
198 ppc_set_irq(cpu
, PPC_INTERRUPT_MCK
, 1);
201 case PPC970_INPUT_CKSTP
:
202 /* Level sensitive - active low */
203 /* XXX: TODO: relay the signal to CKSTP_OUT pin */
205 LOG_IRQ("%s: stop the CPU\n", __func__
);
208 LOG_IRQ("%s: restart the CPU\n", __func__
);
210 qemu_cpu_kick(CPU(cpu
));
213 case PPC970_INPUT_HRESET
:
214 /* Level sensitive - active low */
216 cpu_interrupt(env
, CPU_INTERRUPT_RESET
);
219 case PPC970_INPUT_SRESET
:
220 LOG_IRQ("%s: set the RESET IRQ state to %d\n",
222 ppc_set_irq(cpu
, PPC_INTERRUPT_RESET
, level
);
224 case PPC970_INPUT_TBEN
:
225 LOG_IRQ("%s: set the TBEN state to %d\n", __func__
,
230 /* Unknown pin - do nothing */
231 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__
, pin
);
235 env
->irq_input_state
|= 1 << pin
;
237 env
->irq_input_state
&= ~(1 << pin
);
241 void ppc970_irq_init(CPUPPCState
*env
)
243 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
245 env
->irq_inputs
= (void **)qemu_allocate_irqs(&ppc970_set_irq
, cpu
,
249 /* POWER7 internal IRQ controller */
250 static void power7_set_irq(void *opaque
, int pin
, int level
)
252 PowerPCCPU
*cpu
= opaque
;
253 CPUPPCState
*env
= &cpu
->env
;
255 LOG_IRQ("%s: env %p pin %d level %d\n", __func__
,
259 case POWER7_INPUT_INT
:
260 /* Level sensitive - active high */
261 LOG_IRQ("%s: set the external IRQ state to %d\n",
263 ppc_set_irq(cpu
, PPC_INTERRUPT_EXT
, level
);
266 /* Unknown pin - do nothing */
267 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__
, pin
);
271 env
->irq_input_state
|= 1 << pin
;
273 env
->irq_input_state
&= ~(1 << pin
);
277 void ppcPOWER7_irq_init(CPUPPCState
*env
)
279 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
281 env
->irq_inputs
= (void **)qemu_allocate_irqs(&power7_set_irq
, cpu
,
284 #endif /* defined(TARGET_PPC64) */
286 /* PowerPC 40x internal IRQ controller */
287 static void ppc40x_set_irq(void *opaque
, int pin
, int level
)
289 PowerPCCPU
*cpu
= opaque
;
290 CPUPPCState
*env
= &cpu
->env
;
293 LOG_IRQ("%s: env %p pin %d level %d\n", __func__
,
295 cur_level
= (env
->irq_input_state
>> pin
) & 1;
296 /* Don't generate spurious events */
297 if ((cur_level
== 1 && level
== 0) || (cur_level
== 0 && level
!= 0)) {
299 case PPC40x_INPUT_RESET_SYS
:
301 LOG_IRQ("%s: reset the PowerPC system\n",
303 ppc40x_system_reset(env
);
306 case PPC40x_INPUT_RESET_CHIP
:
308 LOG_IRQ("%s: reset the PowerPC chip\n", __func__
);
309 ppc40x_chip_reset(env
);
312 case PPC40x_INPUT_RESET_CORE
:
313 /* XXX: TODO: update DBSR[MRR] */
315 LOG_IRQ("%s: reset the PowerPC core\n", __func__
);
316 ppc40x_core_reset(env
);
319 case PPC40x_INPUT_CINT
:
320 /* Level sensitive - active high */
321 LOG_IRQ("%s: set the critical IRQ state to %d\n",
323 ppc_set_irq(cpu
, PPC_INTERRUPT_CEXT
, level
);
325 case PPC40x_INPUT_INT
:
326 /* Level sensitive - active high */
327 LOG_IRQ("%s: set the external IRQ state to %d\n",
329 ppc_set_irq(cpu
, PPC_INTERRUPT_EXT
, level
);
331 case PPC40x_INPUT_HALT
:
332 /* Level sensitive - active low */
334 LOG_IRQ("%s: stop the CPU\n", __func__
);
337 LOG_IRQ("%s: restart the CPU\n", __func__
);
339 qemu_cpu_kick(CPU(cpu
));
342 case PPC40x_INPUT_DEBUG
:
343 /* Level sensitive - active high */
344 LOG_IRQ("%s: set the debug pin state to %d\n",
346 ppc_set_irq(cpu
, PPC_INTERRUPT_DEBUG
, level
);
349 /* Unknown pin - do nothing */
350 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__
, pin
);
354 env
->irq_input_state
|= 1 << pin
;
356 env
->irq_input_state
&= ~(1 << pin
);
360 void ppc40x_irq_init(CPUPPCState
*env
)
362 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
364 env
->irq_inputs
= (void **)qemu_allocate_irqs(&ppc40x_set_irq
,
365 cpu
, PPC40x_INPUT_NB
);
368 /* PowerPC E500 internal IRQ controller */
369 static void ppce500_set_irq(void *opaque
, int pin
, int level
)
371 PowerPCCPU
*cpu
= opaque
;
372 CPUPPCState
*env
= &cpu
->env
;
375 LOG_IRQ("%s: env %p pin %d level %d\n", __func__
,
377 cur_level
= (env
->irq_input_state
>> pin
) & 1;
378 /* Don't generate spurious events */
379 if ((cur_level
== 1 && level
== 0) || (cur_level
== 0 && level
!= 0)) {
381 case PPCE500_INPUT_MCK
:
383 LOG_IRQ("%s: reset the PowerPC system\n",
385 qemu_system_reset_request();
388 case PPCE500_INPUT_RESET_CORE
:
390 LOG_IRQ("%s: reset the PowerPC core\n", __func__
);
391 ppc_set_irq(cpu
, PPC_INTERRUPT_MCK
, level
);
394 case PPCE500_INPUT_CINT
:
395 /* Level sensitive - active high */
396 LOG_IRQ("%s: set the critical IRQ state to %d\n",
398 ppc_set_irq(cpu
, PPC_INTERRUPT_CEXT
, level
);
400 case PPCE500_INPUT_INT
:
401 /* Level sensitive - active high */
402 LOG_IRQ("%s: set the core IRQ state to %d\n",
404 ppc_set_irq(cpu
, PPC_INTERRUPT_EXT
, level
);
406 case PPCE500_INPUT_DEBUG
:
407 /* Level sensitive - active high */
408 LOG_IRQ("%s: set the debug pin state to %d\n",
410 ppc_set_irq(cpu
, PPC_INTERRUPT_DEBUG
, level
);
413 /* Unknown pin - do nothing */
414 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__
, pin
);
418 env
->irq_input_state
|= 1 << pin
;
420 env
->irq_input_state
&= ~(1 << pin
);
424 void ppce500_irq_init(CPUPPCState
*env
)
426 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
428 env
->irq_inputs
= (void **)qemu_allocate_irqs(&ppce500_set_irq
,
429 cpu
, PPCE500_INPUT_NB
);
431 /*****************************************************************************/
432 /* PowerPC time base and decrementer emulation */
434 uint64_t cpu_ppc_get_tb(ppc_tb_t
*tb_env
, uint64_t vmclk
, int64_t tb_offset
)
436 /* TB time in tb periods */
437 return muldiv64(vmclk
, tb_env
->tb_freq
, get_ticks_per_sec()) + tb_offset
;
440 uint64_t cpu_ppc_load_tbl (CPUPPCState
*env
)
442 ppc_tb_t
*tb_env
= env
->tb_env
;
446 return env
->spr
[SPR_TBL
];
449 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->tb_offset
);
450 LOG_TB("%s: tb %016" PRIx64
"\n", __func__
, tb
);
455 static inline uint32_t _cpu_ppc_load_tbu(CPUPPCState
*env
)
457 ppc_tb_t
*tb_env
= env
->tb_env
;
460 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->tb_offset
);
461 LOG_TB("%s: tb %016" PRIx64
"\n", __func__
, tb
);
466 uint32_t cpu_ppc_load_tbu (CPUPPCState
*env
)
469 return env
->spr
[SPR_TBU
];
472 return _cpu_ppc_load_tbu(env
);
475 static inline void cpu_ppc_store_tb(ppc_tb_t
*tb_env
, uint64_t vmclk
,
476 int64_t *tb_offsetp
, uint64_t value
)
478 *tb_offsetp
= value
- muldiv64(vmclk
, tb_env
->tb_freq
, get_ticks_per_sec());
479 LOG_TB("%s: tb %016" PRIx64
" offset %08" PRIx64
"\n",
480 __func__
, value
, *tb_offsetp
);
483 void cpu_ppc_store_tbl (CPUPPCState
*env
, uint32_t value
)
485 ppc_tb_t
*tb_env
= env
->tb_env
;
488 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->tb_offset
);
489 tb
&= 0xFFFFFFFF00000000ULL
;
490 cpu_ppc_store_tb(tb_env
, qemu_get_clock_ns(vm_clock
),
491 &tb_env
->tb_offset
, tb
| (uint64_t)value
);
494 static inline void _cpu_ppc_store_tbu(CPUPPCState
*env
, uint32_t value
)
496 ppc_tb_t
*tb_env
= env
->tb_env
;
499 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->tb_offset
);
500 tb
&= 0x00000000FFFFFFFFULL
;
501 cpu_ppc_store_tb(tb_env
, qemu_get_clock_ns(vm_clock
),
502 &tb_env
->tb_offset
, ((uint64_t)value
<< 32) | tb
);
505 void cpu_ppc_store_tbu (CPUPPCState
*env
, uint32_t value
)
507 _cpu_ppc_store_tbu(env
, value
);
510 uint64_t cpu_ppc_load_atbl (CPUPPCState
*env
)
512 ppc_tb_t
*tb_env
= env
->tb_env
;
515 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->atb_offset
);
516 LOG_TB("%s: tb %016" PRIx64
"\n", __func__
, tb
);
521 uint32_t cpu_ppc_load_atbu (CPUPPCState
*env
)
523 ppc_tb_t
*tb_env
= env
->tb_env
;
526 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->atb_offset
);
527 LOG_TB("%s: tb %016" PRIx64
"\n", __func__
, tb
);
532 void cpu_ppc_store_atbl (CPUPPCState
*env
, uint32_t value
)
534 ppc_tb_t
*tb_env
= env
->tb_env
;
537 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->atb_offset
);
538 tb
&= 0xFFFFFFFF00000000ULL
;
539 cpu_ppc_store_tb(tb_env
, qemu_get_clock_ns(vm_clock
),
540 &tb_env
->atb_offset
, tb
| (uint64_t)value
);
543 void cpu_ppc_store_atbu (CPUPPCState
*env
, uint32_t value
)
545 ppc_tb_t
*tb_env
= env
->tb_env
;
548 tb
= cpu_ppc_get_tb(tb_env
, qemu_get_clock_ns(vm_clock
), tb_env
->atb_offset
);
549 tb
&= 0x00000000FFFFFFFFULL
;
550 cpu_ppc_store_tb(tb_env
, qemu_get_clock_ns(vm_clock
),
551 &tb_env
->atb_offset
, ((uint64_t)value
<< 32) | tb
);
554 static void cpu_ppc_tb_stop (CPUPPCState
*env
)
556 ppc_tb_t
*tb_env
= env
->tb_env
;
557 uint64_t tb
, atb
, vmclk
;
559 /* If the time base is already frozen, do nothing */
560 if (tb_env
->tb_freq
!= 0) {
561 vmclk
= qemu_get_clock_ns(vm_clock
);
562 /* Get the time base */
563 tb
= cpu_ppc_get_tb(tb_env
, vmclk
, tb_env
->tb_offset
);
564 /* Get the alternate time base */
565 atb
= cpu_ppc_get_tb(tb_env
, vmclk
, tb_env
->atb_offset
);
566 /* Store the time base value (ie compute the current offset) */
567 cpu_ppc_store_tb(tb_env
, vmclk
, &tb_env
->tb_offset
, tb
);
568 /* Store the alternate time base value (compute the current offset) */
569 cpu_ppc_store_tb(tb_env
, vmclk
, &tb_env
->atb_offset
, atb
);
570 /* Set the time base frequency to zero */
572 /* Now, the time bases are frozen to tb_offset / atb_offset value */
576 static void cpu_ppc_tb_start (CPUPPCState
*env
)
578 ppc_tb_t
*tb_env
= env
->tb_env
;
579 uint64_t tb
, atb
, vmclk
;
581 /* If the time base is not frozen, do nothing */
582 if (tb_env
->tb_freq
== 0) {
583 vmclk
= qemu_get_clock_ns(vm_clock
);
584 /* Get the time base from tb_offset */
585 tb
= tb_env
->tb_offset
;
586 /* Get the alternate time base from atb_offset */
587 atb
= tb_env
->atb_offset
;
588 /* Restore the tb frequency from the decrementer frequency */
589 tb_env
->tb_freq
= tb_env
->decr_freq
;
590 /* Store the time base value */
591 cpu_ppc_store_tb(tb_env
, vmclk
, &tb_env
->tb_offset
, tb
);
592 /* Store the alternate time base value */
593 cpu_ppc_store_tb(tb_env
, vmclk
, &tb_env
->atb_offset
, atb
);
597 static inline uint32_t _cpu_ppc_load_decr(CPUPPCState
*env
, uint64_t next
)
599 ppc_tb_t
*tb_env
= env
->tb_env
;
603 diff
= next
- qemu_get_clock_ns(vm_clock
);
605 decr
= muldiv64(diff
, tb_env
->decr_freq
, get_ticks_per_sec());
606 } else if (tb_env
->flags
& PPC_TIMER_BOOKE
) {
609 decr
= -muldiv64(-diff
, tb_env
->decr_freq
, get_ticks_per_sec());
611 LOG_TB("%s: %08" PRIx32
"\n", __func__
, decr
);
616 uint32_t cpu_ppc_load_decr (CPUPPCState
*env
)
618 ppc_tb_t
*tb_env
= env
->tb_env
;
621 return env
->spr
[SPR_DECR
];
624 return _cpu_ppc_load_decr(env
, tb_env
->decr_next
);
627 uint32_t cpu_ppc_load_hdecr (CPUPPCState
*env
)
629 ppc_tb_t
*tb_env
= env
->tb_env
;
631 return _cpu_ppc_load_decr(env
, tb_env
->hdecr_next
);
634 uint64_t cpu_ppc_load_purr (CPUPPCState
*env
)
636 ppc_tb_t
*tb_env
= env
->tb_env
;
639 diff
= qemu_get_clock_ns(vm_clock
) - tb_env
->purr_start
;
641 return tb_env
->purr_load
+ muldiv64(diff
, tb_env
->tb_freq
, get_ticks_per_sec());
644 /* When decrementer expires,
645 * all we need to do is generate or queue a CPU exception
647 static inline void cpu_ppc_decr_excp(PowerPCCPU
*cpu
)
650 LOG_TB("raise decrementer exception\n");
651 ppc_set_irq(cpu
, PPC_INTERRUPT_DECR
, 1);
654 static inline void cpu_ppc_hdecr_excp(PowerPCCPU
*cpu
)
657 LOG_TB("raise decrementer exception\n");
658 ppc_set_irq(cpu
, PPC_INTERRUPT_HDECR
, 1);
661 static void __cpu_ppc_store_decr(PowerPCCPU
*cpu
, uint64_t *nextp
,
662 struct QEMUTimer
*timer
,
663 void (*raise_excp
)(PowerPCCPU
*),
664 uint32_t decr
, uint32_t value
,
667 CPUPPCState
*env
= &cpu
->env
;
668 ppc_tb_t
*tb_env
= env
->tb_env
;
671 LOG_TB("%s: %08" PRIx32
" => %08" PRIx32
"\n", __func__
,
675 /* KVM handles decrementer exceptions, we don't need our own timer */
679 now
= qemu_get_clock_ns(vm_clock
);
680 next
= now
+ muldiv64(value
, get_ticks_per_sec(), tb_env
->decr_freq
);
682 next
+= *nextp
- now
;
689 qemu_mod_timer(timer
, next
);
691 /* If we set a negative value and the decrementer was positive, raise an
694 if ((tb_env
->flags
& PPC_DECR_UNDERFLOW_TRIGGERED
)
695 && (value
& 0x80000000)
696 && !(decr
& 0x80000000)) {
701 static inline void _cpu_ppc_store_decr(PowerPCCPU
*cpu
, uint32_t decr
,
702 uint32_t value
, int is_excp
)
704 ppc_tb_t
*tb_env
= cpu
->env
.tb_env
;
706 __cpu_ppc_store_decr(cpu
, &tb_env
->decr_next
, tb_env
->decr_timer
,
707 &cpu_ppc_decr_excp
, decr
, value
, is_excp
);
710 void cpu_ppc_store_decr (CPUPPCState
*env
, uint32_t value
)
712 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
714 _cpu_ppc_store_decr(cpu
, cpu_ppc_load_decr(env
), value
, 0);
717 static void cpu_ppc_decr_cb (void *opaque
)
719 CPUPPCState
*env
= opaque
;
721 _cpu_ppc_store_decr(ppc_env_get_cpu(env
), 0x00000000, 0xFFFFFFFF, 1);
724 static inline void _cpu_ppc_store_hdecr(PowerPCCPU
*cpu
, uint32_t hdecr
,
725 uint32_t value
, int is_excp
)
727 ppc_tb_t
*tb_env
= cpu
->env
.tb_env
;
729 if (tb_env
->hdecr_timer
!= NULL
) {
730 __cpu_ppc_store_decr(cpu
, &tb_env
->hdecr_next
, tb_env
->hdecr_timer
,
731 &cpu_ppc_hdecr_excp
, hdecr
, value
, is_excp
);
735 void cpu_ppc_store_hdecr (CPUPPCState
*env
, uint32_t value
)
737 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
739 _cpu_ppc_store_hdecr(cpu
, cpu_ppc_load_hdecr(env
), value
, 0);
742 static void cpu_ppc_hdecr_cb (void *opaque
)
744 CPUPPCState
*env
= opaque
;
746 _cpu_ppc_store_hdecr(ppc_env_get_cpu(env
), 0x00000000, 0xFFFFFFFF, 1);
749 static void cpu_ppc_store_purr(PowerPCCPU
*cpu
, uint64_t value
)
751 ppc_tb_t
*tb_env
= cpu
->env
.tb_env
;
753 tb_env
->purr_load
= value
;
754 tb_env
->purr_start
= qemu_get_clock_ns(vm_clock
);
757 static void cpu_ppc_set_tb_clk (void *opaque
, uint32_t freq
)
759 CPUPPCState
*env
= opaque
;
760 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
761 ppc_tb_t
*tb_env
= env
->tb_env
;
763 tb_env
->tb_freq
= freq
;
764 tb_env
->decr_freq
= freq
;
765 /* There is a bug in Linux 2.4 kernels:
766 * if a decrementer exception is pending when it enables msr_ee at startup,
767 * it's not ready to handle it...
769 _cpu_ppc_store_decr(cpu
, 0xFFFFFFFF, 0xFFFFFFFF, 0);
770 _cpu_ppc_store_hdecr(cpu
, 0xFFFFFFFF, 0xFFFFFFFF, 0);
771 cpu_ppc_store_purr(cpu
, 0x0000000000000000ULL
);
774 /* Set up (once) timebase frequency (in Hz) */
775 clk_setup_cb
cpu_ppc_tb_init (CPUPPCState
*env
, uint32_t freq
)
779 tb_env
= g_malloc0(sizeof(ppc_tb_t
));
780 env
->tb_env
= tb_env
;
781 tb_env
->flags
= PPC_DECR_UNDERFLOW_TRIGGERED
;
782 /* Create new timer */
783 tb_env
->decr_timer
= qemu_new_timer_ns(vm_clock
, &cpu_ppc_decr_cb
, env
);
785 /* XXX: find a suitable condition to enable the hypervisor decrementer
787 tb_env
->hdecr_timer
= qemu_new_timer_ns(vm_clock
, &cpu_ppc_hdecr_cb
, env
);
789 tb_env
->hdecr_timer
= NULL
;
791 cpu_ppc_set_tb_clk(env
, freq
);
793 return &cpu_ppc_set_tb_clk
;
796 /* Specific helpers for POWER & PowerPC 601 RTC */
798 static clk_setup_cb
cpu_ppc601_rtc_init (CPUPPCState
*env
)
800 return cpu_ppc_tb_init(env
, 7812500);
804 void cpu_ppc601_store_rtcu (CPUPPCState
*env
, uint32_t value
)
806 _cpu_ppc_store_tbu(env
, value
);
809 uint32_t cpu_ppc601_load_rtcu (CPUPPCState
*env
)
811 return _cpu_ppc_load_tbu(env
);
814 void cpu_ppc601_store_rtcl (CPUPPCState
*env
, uint32_t value
)
816 cpu_ppc_store_tbl(env
, value
& 0x3FFFFF80);
819 uint32_t cpu_ppc601_load_rtcl (CPUPPCState
*env
)
821 return cpu_ppc_load_tbl(env
) & 0x3FFFFF80;
824 /*****************************************************************************/
825 /* PowerPC 40x timers */
828 typedef struct ppc40x_timer_t ppc40x_timer_t
;
829 struct ppc40x_timer_t
{
830 uint64_t pit_reload
; /* PIT auto-reload value */
831 uint64_t fit_next
; /* Tick for next FIT interrupt */
832 struct QEMUTimer
*fit_timer
;
833 uint64_t wdt_next
; /* Tick for next WDT interrupt */
834 struct QEMUTimer
*wdt_timer
;
836 /* 405 have the PIT, 440 have a DECR. */
837 unsigned int decr_excp
;
840 /* Fixed interval timer */
841 static void cpu_4xx_fit_cb (void *opaque
)
846 ppc40x_timer_t
*ppc40x_timer
;
850 cpu
= ppc_env_get_cpu(env
);
851 tb_env
= env
->tb_env
;
852 ppc40x_timer
= tb_env
->opaque
;
853 now
= qemu_get_clock_ns(vm_clock
);
854 switch ((env
->spr
[SPR_40x_TCR
] >> 24) & 0x3) {
868 /* Cannot occur, but makes gcc happy */
871 next
= now
+ muldiv64(next
, get_ticks_per_sec(), tb_env
->tb_freq
);
874 qemu_mod_timer(ppc40x_timer
->fit_timer
, next
);
875 env
->spr
[SPR_40x_TSR
] |= 1 << 26;
876 if ((env
->spr
[SPR_40x_TCR
] >> 23) & 0x1) {
877 ppc_set_irq(cpu
, PPC_INTERRUPT_FIT
, 1);
879 LOG_TB("%s: ir %d TCR " TARGET_FMT_lx
" TSR " TARGET_FMT_lx
"\n", __func__
,
880 (int)((env
->spr
[SPR_40x_TCR
] >> 23) & 0x1),
881 env
->spr
[SPR_40x_TCR
], env
->spr
[SPR_40x_TSR
]);
884 /* Programmable interval timer */
885 static void start_stop_pit (CPUPPCState
*env
, ppc_tb_t
*tb_env
, int is_excp
)
887 ppc40x_timer_t
*ppc40x_timer
;
890 ppc40x_timer
= tb_env
->opaque
;
891 if (ppc40x_timer
->pit_reload
<= 1 ||
892 !((env
->spr
[SPR_40x_TCR
] >> 26) & 0x1) ||
893 (is_excp
&& !((env
->spr
[SPR_40x_TCR
] >> 22) & 0x1))) {
895 LOG_TB("%s: stop PIT\n", __func__
);
896 qemu_del_timer(tb_env
->decr_timer
);
898 LOG_TB("%s: start PIT %016" PRIx64
"\n",
899 __func__
, ppc40x_timer
->pit_reload
);
900 now
= qemu_get_clock_ns(vm_clock
);
901 next
= now
+ muldiv64(ppc40x_timer
->pit_reload
,
902 get_ticks_per_sec(), tb_env
->decr_freq
);
904 next
+= tb_env
->decr_next
- now
;
907 qemu_mod_timer(tb_env
->decr_timer
, next
);
908 tb_env
->decr_next
= next
;
912 static void cpu_4xx_pit_cb (void *opaque
)
917 ppc40x_timer_t
*ppc40x_timer
;
920 cpu
= ppc_env_get_cpu(env
);
921 tb_env
= env
->tb_env
;
922 ppc40x_timer
= tb_env
->opaque
;
923 env
->spr
[SPR_40x_TSR
] |= 1 << 27;
924 if ((env
->spr
[SPR_40x_TCR
] >> 26) & 0x1) {
925 ppc_set_irq(cpu
, ppc40x_timer
->decr_excp
, 1);
927 start_stop_pit(env
, tb_env
, 1);
928 LOG_TB("%s: ar %d ir %d TCR " TARGET_FMT_lx
" TSR " TARGET_FMT_lx
" "
929 "%016" PRIx64
"\n", __func__
,
930 (int)((env
->spr
[SPR_40x_TCR
] >> 22) & 0x1),
931 (int)((env
->spr
[SPR_40x_TCR
] >> 26) & 0x1),
932 env
->spr
[SPR_40x_TCR
], env
->spr
[SPR_40x_TSR
],
933 ppc40x_timer
->pit_reload
);
937 static void cpu_4xx_wdt_cb (void *opaque
)
942 ppc40x_timer_t
*ppc40x_timer
;
946 cpu
= ppc_env_get_cpu(env
);
947 tb_env
= env
->tb_env
;
948 ppc40x_timer
= tb_env
->opaque
;
949 now
= qemu_get_clock_ns(vm_clock
);
950 switch ((env
->spr
[SPR_40x_TCR
] >> 30) & 0x3) {
964 /* Cannot occur, but makes gcc happy */
967 next
= now
+ muldiv64(next
, get_ticks_per_sec(), tb_env
->decr_freq
);
970 LOG_TB("%s: TCR " TARGET_FMT_lx
" TSR " TARGET_FMT_lx
"\n", __func__
,
971 env
->spr
[SPR_40x_TCR
], env
->spr
[SPR_40x_TSR
]);
972 switch ((env
->spr
[SPR_40x_TSR
] >> 30) & 0x3) {
975 qemu_mod_timer(ppc40x_timer
->wdt_timer
, next
);
976 ppc40x_timer
->wdt_next
= next
;
977 env
->spr
[SPR_40x_TSR
] |= 1 << 31;
980 qemu_mod_timer(ppc40x_timer
->wdt_timer
, next
);
981 ppc40x_timer
->wdt_next
= next
;
982 env
->spr
[SPR_40x_TSR
] |= 1 << 30;
983 if ((env
->spr
[SPR_40x_TCR
] >> 27) & 0x1) {
984 ppc_set_irq(cpu
, PPC_INTERRUPT_WDT
, 1);
988 env
->spr
[SPR_40x_TSR
] &= ~0x30000000;
989 env
->spr
[SPR_40x_TSR
] |= env
->spr
[SPR_40x_TCR
] & 0x30000000;
990 switch ((env
->spr
[SPR_40x_TCR
] >> 28) & 0x3) {
994 case 0x1: /* Core reset */
995 ppc40x_core_reset(env
);
997 case 0x2: /* Chip reset */
998 ppc40x_chip_reset(env
);
1000 case 0x3: /* System reset */
1001 ppc40x_system_reset(env
);
1007 void store_40x_pit (CPUPPCState
*env
, target_ulong val
)
1010 ppc40x_timer_t
*ppc40x_timer
;
1012 tb_env
= env
->tb_env
;
1013 ppc40x_timer
= tb_env
->opaque
;
1014 LOG_TB("%s val" TARGET_FMT_lx
"\n", __func__
, val
);
1015 ppc40x_timer
->pit_reload
= val
;
1016 start_stop_pit(env
, tb_env
, 0);
1019 target_ulong
load_40x_pit (CPUPPCState
*env
)
1021 return cpu_ppc_load_decr(env
);
1024 static void ppc_40x_set_tb_clk (void *opaque
, uint32_t freq
)
1026 CPUPPCState
*env
= opaque
;
1027 ppc_tb_t
*tb_env
= env
->tb_env
;
1029 LOG_TB("%s set new frequency to %" PRIu32
"\n", __func__
,
1031 tb_env
->tb_freq
= freq
;
1032 tb_env
->decr_freq
= freq
;
1033 /* XXX: we should also update all timers */
1036 clk_setup_cb
ppc_40x_timers_init (CPUPPCState
*env
, uint32_t freq
,
1037 unsigned int decr_excp
)
1040 ppc40x_timer_t
*ppc40x_timer
;
1042 tb_env
= g_malloc0(sizeof(ppc_tb_t
));
1043 env
->tb_env
= tb_env
;
1044 tb_env
->flags
= PPC_DECR_UNDERFLOW_TRIGGERED
;
1045 ppc40x_timer
= g_malloc0(sizeof(ppc40x_timer_t
));
1046 tb_env
->tb_freq
= freq
;
1047 tb_env
->decr_freq
= freq
;
1048 tb_env
->opaque
= ppc40x_timer
;
1049 LOG_TB("%s freq %" PRIu32
"\n", __func__
, freq
);
1050 if (ppc40x_timer
!= NULL
) {
1051 /* We use decr timer for PIT */
1052 tb_env
->decr_timer
= qemu_new_timer_ns(vm_clock
, &cpu_4xx_pit_cb
, env
);
1053 ppc40x_timer
->fit_timer
=
1054 qemu_new_timer_ns(vm_clock
, &cpu_4xx_fit_cb
, env
);
1055 ppc40x_timer
->wdt_timer
=
1056 qemu_new_timer_ns(vm_clock
, &cpu_4xx_wdt_cb
, env
);
1057 ppc40x_timer
->decr_excp
= decr_excp
;
1060 return &ppc_40x_set_tb_clk
;
1063 /*****************************************************************************/
1064 /* Embedded PowerPC Device Control Registers */
1065 typedef struct ppc_dcrn_t ppc_dcrn_t
;
1067 dcr_read_cb dcr_read
;
1068 dcr_write_cb dcr_write
;
1072 /* XXX: on 460, DCR addresses are 32 bits wide,
1073 * using DCRIPR to get the 22 upper bits of the DCR address
1075 #define DCRN_NB 1024
1077 ppc_dcrn_t dcrn
[DCRN_NB
];
1078 int (*read_error
)(int dcrn
);
1079 int (*write_error
)(int dcrn
);
1082 int ppc_dcr_read (ppc_dcr_t
*dcr_env
, int dcrn
, uint32_t *valp
)
1086 if (dcrn
< 0 || dcrn
>= DCRN_NB
)
1088 dcr
= &dcr_env
->dcrn
[dcrn
];
1089 if (dcr
->dcr_read
== NULL
)
1091 *valp
= (*dcr
->dcr_read
)(dcr
->opaque
, dcrn
);
1096 if (dcr_env
->read_error
!= NULL
)
1097 return (*dcr_env
->read_error
)(dcrn
);
1102 int ppc_dcr_write (ppc_dcr_t
*dcr_env
, int dcrn
, uint32_t val
)
1106 if (dcrn
< 0 || dcrn
>= DCRN_NB
)
1108 dcr
= &dcr_env
->dcrn
[dcrn
];
1109 if (dcr
->dcr_write
== NULL
)
1111 (*dcr
->dcr_write
)(dcr
->opaque
, dcrn
, val
);
1116 if (dcr_env
->write_error
!= NULL
)
1117 return (*dcr_env
->write_error
)(dcrn
);
1122 int ppc_dcr_register (CPUPPCState
*env
, int dcrn
, void *opaque
,
1123 dcr_read_cb dcr_read
, dcr_write_cb dcr_write
)
1128 dcr_env
= env
->dcr_env
;
1129 if (dcr_env
== NULL
)
1131 if (dcrn
< 0 || dcrn
>= DCRN_NB
)
1133 dcr
= &dcr_env
->dcrn
[dcrn
];
1134 if (dcr
->opaque
!= NULL
||
1135 dcr
->dcr_read
!= NULL
||
1136 dcr
->dcr_write
!= NULL
)
1138 dcr
->opaque
= opaque
;
1139 dcr
->dcr_read
= dcr_read
;
1140 dcr
->dcr_write
= dcr_write
;
1145 int ppc_dcr_init (CPUPPCState
*env
, int (*read_error
)(int dcrn
),
1146 int (*write_error
)(int dcrn
))
1150 dcr_env
= g_malloc0(sizeof(ppc_dcr_t
));
1151 dcr_env
->read_error
= read_error
;
1152 dcr_env
->write_error
= write_error
;
1153 env
->dcr_env
= dcr_env
;
1158 /*****************************************************************************/
1160 void PPC_debug_write (void *opaque
, uint32_t addr
, uint32_t val
)
1172 printf("Set loglevel to %04" PRIx32
"\n", val
);
1173 cpu_set_log(val
| 0x100);
1178 /*****************************************************************************/
1180 static inline uint32_t nvram_read (nvram_t
*nvram
, uint32_t addr
)
1182 return (*nvram
->read_fn
)(nvram
->opaque
, addr
);
1185 static inline void nvram_write (nvram_t
*nvram
, uint32_t addr
, uint32_t val
)
1187 (*nvram
->write_fn
)(nvram
->opaque
, addr
, val
);
1190 static void NVRAM_set_byte(nvram_t
*nvram
, uint32_t addr
, uint8_t value
)
1192 nvram_write(nvram
, addr
, value
);
1195 static uint8_t NVRAM_get_byte(nvram_t
*nvram
, uint32_t addr
)
1197 return nvram_read(nvram
, addr
);
1200 static void NVRAM_set_word(nvram_t
*nvram
, uint32_t addr
, uint16_t value
)
1202 nvram_write(nvram
, addr
, value
>> 8);
1203 nvram_write(nvram
, addr
+ 1, value
& 0xFF);
1206 static uint16_t NVRAM_get_word(nvram_t
*nvram
, uint32_t addr
)
1210 tmp
= nvram_read(nvram
, addr
) << 8;
1211 tmp
|= nvram_read(nvram
, addr
+ 1);
1216 static void NVRAM_set_lword(nvram_t
*nvram
, uint32_t addr
, uint32_t value
)
1218 nvram_write(nvram
, addr
, value
>> 24);
1219 nvram_write(nvram
, addr
+ 1, (value
>> 16) & 0xFF);
1220 nvram_write(nvram
, addr
+ 2, (value
>> 8) & 0xFF);
1221 nvram_write(nvram
, addr
+ 3, value
& 0xFF);
1224 uint32_t NVRAM_get_lword (nvram_t
*nvram
, uint32_t addr
)
1228 tmp
= nvram_read(nvram
, addr
) << 24;
1229 tmp
|= nvram_read(nvram
, addr
+ 1) << 16;
1230 tmp
|= nvram_read(nvram
, addr
+ 2) << 8;
1231 tmp
|= nvram_read(nvram
, addr
+ 3);
1236 static void NVRAM_set_string(nvram_t
*nvram
, uint32_t addr
, const char *str
,
1241 for (i
= 0; i
< max
&& str
[i
] != '\0'; i
++) {
1242 nvram_write(nvram
, addr
+ i
, str
[i
]);
1244 nvram_write(nvram
, addr
+ i
, str
[i
]);
1245 nvram_write(nvram
, addr
+ max
- 1, '\0');
1248 int NVRAM_get_string (nvram_t
*nvram
, uint8_t *dst
, uint16_t addr
, int max
)
1252 memset(dst
, 0, max
);
1253 for (i
= 0; i
< max
; i
++) {
1254 dst
[i
] = NVRAM_get_byte(nvram
, addr
+ i
);
1262 static uint16_t NVRAM_crc_update (uint16_t prev
, uint16_t value
)
1265 uint16_t pd
, pd1
, pd2
;
1270 pd2
= ((pd
>> 4) & 0x000F) ^ pd1
;
1271 tmp
^= (pd1
<< 3) | (pd1
<< 8);
1272 tmp
^= pd2
| (pd2
<< 7) | (pd2
<< 12);
1277 static uint16_t NVRAM_compute_crc (nvram_t
*nvram
, uint32_t start
, uint32_t count
)
1280 uint16_t crc
= 0xFFFF;
1285 for (i
= 0; i
!= count
; i
++) {
1286 crc
= NVRAM_crc_update(crc
, NVRAM_get_word(nvram
, start
+ i
));
1289 crc
= NVRAM_crc_update(crc
, NVRAM_get_byte(nvram
, start
+ i
) << 8);
1295 #define CMDLINE_ADDR 0x017ff000
1297 int PPC_NVRAM_set_params (nvram_t
*nvram
, uint16_t NVRAM_size
,
1299 uint32_t RAM_size
, int boot_device
,
1300 uint32_t kernel_image
, uint32_t kernel_size
,
1301 const char *cmdline
,
1302 uint32_t initrd_image
, uint32_t initrd_size
,
1303 uint32_t NVRAM_image
,
1304 int width
, int height
, int depth
)
1308 /* Set parameters for Open Hack'Ware BIOS */
1309 NVRAM_set_string(nvram
, 0x00, "QEMU_BIOS", 16);
1310 NVRAM_set_lword(nvram
, 0x10, 0x00000002); /* structure v2 */
1311 NVRAM_set_word(nvram
, 0x14, NVRAM_size
);
1312 NVRAM_set_string(nvram
, 0x20, arch
, 16);
1313 NVRAM_set_lword(nvram
, 0x30, RAM_size
);
1314 NVRAM_set_byte(nvram
, 0x34, boot_device
);
1315 NVRAM_set_lword(nvram
, 0x38, kernel_image
);
1316 NVRAM_set_lword(nvram
, 0x3C, kernel_size
);
1318 /* XXX: put the cmdline in NVRAM too ? */
1319 pstrcpy_targphys("cmdline", CMDLINE_ADDR
, RAM_size
- CMDLINE_ADDR
, cmdline
);
1320 NVRAM_set_lword(nvram
, 0x40, CMDLINE_ADDR
);
1321 NVRAM_set_lword(nvram
, 0x44, strlen(cmdline
));
1323 NVRAM_set_lword(nvram
, 0x40, 0);
1324 NVRAM_set_lword(nvram
, 0x44, 0);
1326 NVRAM_set_lword(nvram
, 0x48, initrd_image
);
1327 NVRAM_set_lword(nvram
, 0x4C, initrd_size
);
1328 NVRAM_set_lword(nvram
, 0x50, NVRAM_image
);
1330 NVRAM_set_word(nvram
, 0x54, width
);
1331 NVRAM_set_word(nvram
, 0x56, height
);
1332 NVRAM_set_word(nvram
, 0x58, depth
);
1333 crc
= NVRAM_compute_crc(nvram
, 0x00, 0xF8);
1334 NVRAM_set_word(nvram
, 0xFC, crc
);