?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix integer overflow in block migration bandwidth calculation
[qemu/cris-port.git] / hw / ppc.c
blobdabb816510c41ab22b64457471f197fb0c9b3d41
1 /*
2 * QEMU generic PowerPC hardware System Emulator
3 *
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24 #include "hw.h"
25 #include "ppc.h"
26 #include "qemu-timer.h"
27 #include "sysemu.h"
28 #include "nvram.h"
29 #include "qemu-log.h"
30 #include "loader.h"
31 #include "kvm.h"
32 #include "kvm_ppc.h"
33
34 //#define PPC_DEBUG_IRQ
35 //#define PPC_DEBUG_TB
36
37 #ifdef PPC_DEBUG_IRQ
38 # define LOG_IRQ(...) qemu_log_mask(CPU_LOG_INT, ## __VA_ARGS__)
39 #else
40 # define LOG_IRQ(...) do { } while (0)
41 #endif
42
43
44 #ifdef PPC_DEBUG_TB
45 # define LOG_TB(...) qemu_log(__VA_ARGS__)
46 #else
47 # define LOG_TB(...) do { } while (0)
48 #endif
49
50 static void cpu_ppc_tb_stop (CPUState *env);
51 static void cpu_ppc_tb_start (CPUState *env);
52
53 static void ppc_set_irq (CPUState *env, int n_IRQ, int level)
54 {
55 unsigned int old_pending = env->pending_interrupts;
56
57 if (level) {
58 env->pending_interrupts |= 1 << n_IRQ;
59 cpu_interrupt(env, CPU_INTERRUPT_HARD);
60 } else {
61 env->pending_interrupts &= ~(1 << n_IRQ);
62 if (env->pending_interrupts == 0)
63 cpu_reset_interrupt(env, CPU_INTERRUPT_HARD);
64 }
65
66 if (old_pending != env->pending_interrupts) {
67 #ifdef CONFIG_KVM
68 kvmppc_set_interrupt(env, n_IRQ, level);
69 #endif
70 }
71
72 LOG_IRQ("%s: %p n_IRQ %d level %d => pending %08" PRIx32
73 "req %08x\n", __func__, env, n_IRQ, level,
74 env->pending_interrupts, env->interrupt_request);
75 }
76
77 /* PowerPC 6xx / 7xx internal IRQ controller */
78 static void ppc6xx_set_irq (void *opaque, int pin, int level)
79 {
80 CPUState *env = opaque;
81 int cur_level;
82
83 LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
84 env, pin, level);
85 cur_level = (env->irq_input_state >> pin) & 1;
86 /* Don't generate spurious events */
87 if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
88 switch (pin) {
89 case PPC6xx_INPUT_TBEN:
90 /* Level sensitive - active high */
91 LOG_IRQ("%s: %s the time base\n",
92 __func__, level ? "start" : "stop");
93 if (level) {
94 cpu_ppc_tb_start(env);
95 } else {
96 cpu_ppc_tb_stop(env);
97 }
98 case PPC6xx_INPUT_INT:
99 /* Level sensitive - active high */
100 LOG_IRQ("%s: set the external IRQ state to %d\n",
101 __func__, level);
102 ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
103 break;
104 case PPC6xx_INPUT_SMI:
105 /* Level sensitive - active high */
106 LOG_IRQ("%s: set the SMI IRQ state to %d\n",
107 __func__, level);
108 ppc_set_irq(env, PPC_INTERRUPT_SMI, level);
109 break;
110 case PPC6xx_INPUT_MCP:
111 /* Negative edge sensitive */
112 /* XXX: TODO: actual reaction may depends on HID0 status
113 * 603/604/740/750: check HID0[EMCP]
114 */
115 if (cur_level == 1 && level == 0) {
116 LOG_IRQ("%s: raise machine check state\n",
117 __func__);
118 ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);
119 }
120 break;
121 case PPC6xx_INPUT_CKSTP_IN:
122 /* Level sensitive - active low */
123 /* XXX: TODO: relay the signal to CKSTP_OUT pin */
124 /* XXX: Note that the only way to restart the CPU is to reset it */
125 if (level) {
126 LOG_IRQ("%s: stop the CPU\n", __func__);
127 env->halted = 1;
128 }
129 break;
130 case PPC6xx_INPUT_HRESET:
131 /* Level sensitive - active low */
132 if (level) {
133 LOG_IRQ("%s: reset the CPU\n", __func__);
134 env->interrupt_request |= CPU_INTERRUPT_EXITTB;
135 /* XXX: TOFIX */
136 #if 0
137 cpu_reset(env);
138 #else
139 qemu_system_reset_request();
140 #endif
141 }
142 break;
143 case PPC6xx_INPUT_SRESET:
144 LOG_IRQ("%s: set the RESET IRQ state to %d\n",
145 __func__, level);
146 ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
147 break;
148 default:
149 /* Unknown pin - do nothing */
150 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
151 return;
152 }
153 if (level)
154 env->irq_input_state |= 1 << pin;
155 else
156 env->irq_input_state &= ~(1 << pin);
157 }
158 }
159
160 void ppc6xx_irq_init (CPUState *env)
161 {
162 env->irq_inputs = (void **)qemu_allocate_irqs(&ppc6xx_set_irq, env,
163 PPC6xx_INPUT_NB);
164 }
165
166 #if defined(TARGET_PPC64)
167 /* PowerPC 970 internal IRQ controller */
168 static void ppc970_set_irq (void *opaque, int pin, int level)
169 {
170 CPUState *env = opaque;
171 int cur_level;
172
173 LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
174 env, pin, level);
175 cur_level = (env->irq_input_state >> pin) & 1;
176 /* Don't generate spurious events */
177 if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
178 switch (pin) {
179 case PPC970_INPUT_INT:
180 /* Level sensitive - active high */
181 LOG_IRQ("%s: set the external IRQ state to %d\n",
182 __func__, level);
183 ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
184 break;
185 case PPC970_INPUT_THINT:
186 /* Level sensitive - active high */
187 LOG_IRQ("%s: set the SMI IRQ state to %d\n", __func__,
188 level);
189 ppc_set_irq(env, PPC_INTERRUPT_THERM, level);
190 break;
191 case PPC970_INPUT_MCP:
192 /* Negative edge sensitive */
193 /* XXX: TODO: actual reaction may depends on HID0 status
194 * 603/604/740/750: check HID0[EMCP]
195 */
196 if (cur_level == 1 && level == 0) {
197 LOG_IRQ("%s: raise machine check state\n",
198 __func__);
199 ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);
200 }
201 break;
202 case PPC970_INPUT_CKSTP:
203 /* Level sensitive - active low */
204 /* XXX: TODO: relay the signal to CKSTP_OUT pin */
205 if (level) {
206 LOG_IRQ("%s: stop the CPU\n", __func__);
207 env->halted = 1;
208 } else {
209 LOG_IRQ("%s: restart the CPU\n", __func__);
210 env->halted = 0;
211 qemu_cpu_kick(env);
212 }
213 break;
214 case PPC970_INPUT_HRESET:
215 /* Level sensitive - active low */
216 if (level) {
217 #if 0 // XXX: TOFIX
218 LOG_IRQ("%s: reset the CPU\n", __func__);
219 cpu_reset(env);
220 #endif
221 }
222 break;
223 case PPC970_INPUT_SRESET:
224 LOG_IRQ("%s: set the RESET IRQ state to %d\n",
225 __func__, level);
226 ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
227 break;
228 case PPC970_INPUT_TBEN:
229 LOG_IRQ("%s: set the TBEN state to %d\n", __func__,
230 level);
231 /* XXX: TODO */
232 break;
233 default:
234 /* Unknown pin - do nothing */
235 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
236 return;
237 }
238 if (level)
239 env->irq_input_state |= 1 << pin;
240 else
241 env->irq_input_state &= ~(1 << pin);
242 }
243 }
244
245 void ppc970_irq_init (CPUState *env)
246 {
247 env->irq_inputs = (void **)qemu_allocate_irqs(&ppc970_set_irq, env,
248 PPC970_INPUT_NB);
249 }
250
251 /* POWER7 internal IRQ controller */
252 static void power7_set_irq (void *opaque, int pin, int level)
253 {
254 CPUState *env = opaque;
255 int cur_level;
256
257 LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
258 env, pin, level);
259 cur_level = (env->irq_input_state >> pin) & 1;
260
261 switch (pin) {
262 case POWER7_INPUT_INT:
263 /* Level sensitive - active high */
264 LOG_IRQ("%s: set the external IRQ state to %d\n",
265 __func__, level);
266 ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
267 break;
268 default:
269 /* Unknown pin - do nothing */
270 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
271 return;
272 }
273 if (level) {
274 env->irq_input_state |= 1 << pin;
275 } else {
276 env->irq_input_state &= ~(1 << pin);
277 }
278 }
279
280 void ppcPOWER7_irq_init (CPUState *env)
281 {
282 env->irq_inputs = (void **)qemu_allocate_irqs(&power7_set_irq, env,
283 POWER7_INPUT_NB);
284 }
285 #endif /* defined(TARGET_PPC64) */
286
287 /* PowerPC 40x internal IRQ controller */
288 static void ppc40x_set_irq (void *opaque, int pin, int level)
289 {
290 CPUState *env = opaque;
291 int cur_level;
292
293 LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
294 env, pin, level);
295 cur_level = (env->irq_input_state >> pin) & 1;
296 /* Don't generate spurious events */
297 if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
298 switch (pin) {
299 case PPC40x_INPUT_RESET_SYS:
300 if (level) {
301 LOG_IRQ("%s: reset the PowerPC system\n",
302 __func__);
303 ppc40x_system_reset(env);
304 }
305 break;
306 case PPC40x_INPUT_RESET_CHIP:
307 if (level) {
308 LOG_IRQ("%s: reset the PowerPC chip\n", __func__);
309 ppc40x_chip_reset(env);
310 }
311 break;
312 case PPC40x_INPUT_RESET_CORE:
313 /* XXX: TODO: update DBSR[MRR] */
314 if (level) {
315 LOG_IRQ("%s: reset the PowerPC core\n", __func__);
316 ppc40x_core_reset(env);
317 }
318 break;
319 case PPC40x_INPUT_CINT:
320 /* Level sensitive - active high */
321 LOG_IRQ("%s: set the critical IRQ state to %d\n",
322 __func__, level);
323 ppc_set_irq(env, PPC_INTERRUPT_CEXT, level);
324 break;
325 case PPC40x_INPUT_INT:
326 /* Level sensitive - active high */
327 LOG_IRQ("%s: set the external IRQ state to %d\n",
328 __func__, level);
329 ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
330 break;
331 case PPC40x_INPUT_HALT:
332 /* Level sensitive - active low */
333 if (level) {
334 LOG_IRQ("%s: stop the CPU\n", __func__);
335 env->halted = 1;
336 } else {
337 LOG_IRQ("%s: restart the CPU\n", __func__);
338 env->halted = 0;
339 qemu_cpu_kick(env);
340 }
341 break;
342 case PPC40x_INPUT_DEBUG:
343 /* Level sensitive - active high */
344 LOG_IRQ("%s: set the debug pin state to %d\n",
345 __func__, level);
346 ppc_set_irq(env, PPC_INTERRUPT_DEBUG, level);
347 break;
348 default:
349 /* Unknown pin - do nothing */
350 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
351 return;
352 }
353 if (level)
354 env->irq_input_state |= 1 << pin;
355 else
356 env->irq_input_state &= ~(1 << pin);
357 }
358 }
359
360 void ppc40x_irq_init (CPUState *env)
361 {
362 env->irq_inputs = (void **)qemu_allocate_irqs(&ppc40x_set_irq,
363 env, PPC40x_INPUT_NB);
364 }
365
366 /* PowerPC E500 internal IRQ controller */
367 static void ppce500_set_irq (void *opaque, int pin, int level)
368 {
369 CPUState *env = opaque;
370 int cur_level;
371
372 LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
373 env, pin, level);
374 cur_level = (env->irq_input_state >> pin) & 1;
375 /* Don't generate spurious events */
376 if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
377 switch (pin) {
378 case PPCE500_INPUT_MCK:
379 if (level) {
380 LOG_IRQ("%s: reset the PowerPC system\n",
381 __func__);
382 qemu_system_reset_request();
383 }
384 break;
385 case PPCE500_INPUT_RESET_CORE:
386 if (level) {
387 LOG_IRQ("%s: reset the PowerPC core\n", __func__);
388 ppc_set_irq(env, PPC_INTERRUPT_MCK, level);
389 }
390 break;
391 case PPCE500_INPUT_CINT:
392 /* Level sensitive - active high */
393 LOG_IRQ("%s: set the critical IRQ state to %d\n",
394 __func__, level);
395 ppc_set_irq(env, PPC_INTERRUPT_CEXT, level);
396 break;
397 case PPCE500_INPUT_INT:
398 /* Level sensitive - active high */
399 LOG_IRQ("%s: set the core IRQ state to %d\n",
400 __func__, level);
401 ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
402 break;
403 case PPCE500_INPUT_DEBUG:
404 /* Level sensitive - active high */
405 LOG_IRQ("%s: set the debug pin state to %d\n",
406 __func__, level);
407 ppc_set_irq(env, PPC_INTERRUPT_DEBUG, level);
408 break;
409 default:
410 /* Unknown pin - do nothing */
411 LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
412 return;
413 }
414 if (level)
415 env->irq_input_state |= 1 << pin;
416 else
417 env->irq_input_state &= ~(1 << pin);
418 }
419 }
420
421 void ppce500_irq_init (CPUState *env)
422 {
423 env->irq_inputs = (void **)qemu_allocate_irqs(&ppce500_set_irq,
424 env, PPCE500_INPUT_NB);
425 }
426 /*****************************************************************************/
427 /* PowerPC time base and decrementer emulation */
428 struct ppc_tb_t {
429 /* Time base management */
430 int64_t tb_offset; /* Compensation */
431 int64_t atb_offset; /* Compensation */
432 uint32_t tb_freq; /* TB frequency */
433 /* Decrementer management */
434 uint64_t decr_next; /* Tick for next decr interrupt */
435 uint32_t decr_freq; /* decrementer frequency */
436 struct QEMUTimer *decr_timer;
437 /* Hypervisor decrementer management */
438 uint64_t hdecr_next; /* Tick for next hdecr interrupt */
439 struct QEMUTimer *hdecr_timer;
440 uint64_t purr_load;
441 uint64_t purr_start;
442 void *opaque;
443 };
444
445 static inline uint64_t cpu_ppc_get_tb(ppc_tb_t *tb_env, uint64_t vmclk,
446 int64_t tb_offset)
447 {
448 /* TB time in tb periods */
449 return muldiv64(vmclk, tb_env->tb_freq, get_ticks_per_sec()) + tb_offset;
450 }
451
452 uint64_t cpu_ppc_load_tbl (CPUState *env)
453 {
454 ppc_tb_t *tb_env = env->tb_env;
455 uint64_t tb;
456
457 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->tb_offset);
458 LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
459
460 return tb;
461 }
462
463 static inline uint32_t _cpu_ppc_load_tbu(CPUState *env)
464 {
465 ppc_tb_t *tb_env = env->tb_env;
466 uint64_t tb;
467
468 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->tb_offset);
469 LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
470
471 return tb >> 32;
472 }
473
474 uint32_t cpu_ppc_load_tbu (CPUState *env)
475 {
476 return _cpu_ppc_load_tbu(env);
477 }
478
479 static inline void cpu_ppc_store_tb(ppc_tb_t *tb_env, uint64_t vmclk,
480 int64_t *tb_offsetp, uint64_t value)
481 {
482 *tb_offsetp = value - muldiv64(vmclk, tb_env->tb_freq, get_ticks_per_sec());
483 LOG_TB("%s: tb %016" PRIx64 " offset %08" PRIx64 "\n",
484 __func__, value, *tb_offsetp);
485 }
486
487 void cpu_ppc_store_tbl (CPUState *env, uint32_t value)
488 {
489 ppc_tb_t *tb_env = env->tb_env;
490 uint64_t tb;
491
492 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->tb_offset);
493 tb &= 0xFFFFFFFF00000000ULL;
494 cpu_ppc_store_tb(tb_env, qemu_get_clock_ns(vm_clock),
495 &tb_env->tb_offset, tb | (uint64_t)value);
496 }
497
498 static inline void _cpu_ppc_store_tbu(CPUState *env, uint32_t value)
499 {
500 ppc_tb_t *tb_env = env->tb_env;
501 uint64_t tb;
502
503 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->tb_offset);
504 tb &= 0x00000000FFFFFFFFULL;
505 cpu_ppc_store_tb(tb_env, qemu_get_clock_ns(vm_clock),
506 &tb_env->tb_offset, ((uint64_t)value << 32) | tb);
507 }
508
509 void cpu_ppc_store_tbu (CPUState *env, uint32_t value)
510 {
511 _cpu_ppc_store_tbu(env, value);
512 }
513
514 uint64_t cpu_ppc_load_atbl (CPUState *env)
515 {
516 ppc_tb_t *tb_env = env->tb_env;
517 uint64_t tb;
518
519 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->atb_offset);
520 LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
521
522 return tb;
523 }
524
525 uint32_t cpu_ppc_load_atbu (CPUState *env)
526 {
527 ppc_tb_t *tb_env = env->tb_env;
528 uint64_t tb;
529
530 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->atb_offset);
531 LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
532
533 return tb >> 32;
534 }
535
536 void cpu_ppc_store_atbl (CPUState *env, uint32_t value)
537 {
538 ppc_tb_t *tb_env = env->tb_env;
539 uint64_t tb;
540
541 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->atb_offset);
542 tb &= 0xFFFFFFFF00000000ULL;
543 cpu_ppc_store_tb(tb_env, qemu_get_clock_ns(vm_clock),
544 &tb_env->atb_offset, tb | (uint64_t)value);
545 }
546
547 void cpu_ppc_store_atbu (CPUState *env, uint32_t value)
548 {
549 ppc_tb_t *tb_env = env->tb_env;
550 uint64_t tb;
551
552 tb = cpu_ppc_get_tb(tb_env, qemu_get_clock_ns(vm_clock), tb_env->atb_offset);
553 tb &= 0x00000000FFFFFFFFULL;
554 cpu_ppc_store_tb(tb_env, qemu_get_clock_ns(vm_clock),
555 &tb_env->atb_offset, ((uint64_t)value << 32) | tb);
556 }
557
558 static void cpu_ppc_tb_stop (CPUState *env)
559 {
560 ppc_tb_t *tb_env = env->tb_env;
561 uint64_t tb, atb, vmclk;
562
563 /* If the time base is already frozen, do nothing */
564 if (tb_env->tb_freq != 0) {
565 vmclk = qemu_get_clock_ns(vm_clock);
566 /* Get the time base */
567 tb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->tb_offset);
568 /* Get the alternate time base */
569 atb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->atb_offset);
570 /* Store the time base value (ie compute the current offset) */
571 cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
572 /* Store the alternate time base value (compute the current offset) */
573 cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
574 /* Set the time base frequency to zero */
575 tb_env->tb_freq = 0;
576 /* Now, the time bases are frozen to tb_offset / atb_offset value */
577 }
578 }
579
580 static void cpu_ppc_tb_start (CPUState *env)
581 {
582 ppc_tb_t *tb_env = env->tb_env;
583 uint64_t tb, atb, vmclk;
584
585 /* If the time base is not frozen, do nothing */
586 if (tb_env->tb_freq == 0) {
587 vmclk = qemu_get_clock_ns(vm_clock);
588 /* Get the time base from tb_offset */
589 tb = tb_env->tb_offset;
590 /* Get the alternate time base from atb_offset */
591 atb = tb_env->atb_offset;
592 /* Restore the tb frequency from the decrementer frequency */
593 tb_env->tb_freq = tb_env->decr_freq;
594 /* Store the time base value */
595 cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
596 /* Store the alternate time base value */
597 cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
598 }
599 }
600
601 static inline uint32_t _cpu_ppc_load_decr(CPUState *env, uint64_t next)
602 {
603 ppc_tb_t *tb_env = env->tb_env;
604 uint32_t decr;
605 int64_t diff;
606
607 diff = next - qemu_get_clock_ns(vm_clock);
608 if (diff >= 0)
609 decr = muldiv64(diff, tb_env->decr_freq, get_ticks_per_sec());
610 else
611 decr = -muldiv64(-diff, tb_env->decr_freq, get_ticks_per_sec());
612 LOG_TB("%s: %08" PRIx32 "\n", __func__, decr);
613
614 return decr;
615 }
616
617 uint32_t cpu_ppc_load_decr (CPUState *env)
618 {
619 ppc_tb_t *tb_env = env->tb_env;
620
621 return _cpu_ppc_load_decr(env, tb_env->decr_next);
622 }
623
624 uint32_t cpu_ppc_load_hdecr (CPUState *env)
625 {
626 ppc_tb_t *tb_env = env->tb_env;
627
628 return _cpu_ppc_load_decr(env, tb_env->hdecr_next);
629 }
630
631 uint64_t cpu_ppc_load_purr (CPUState *env)
632 {
633 ppc_tb_t *tb_env = env->tb_env;
634 uint64_t diff;
635
636 diff = qemu_get_clock_ns(vm_clock) - tb_env->purr_start;
637
638 return tb_env->purr_load + muldiv64(diff, tb_env->tb_freq, get_ticks_per_sec());
639 }
640
641 /* When decrementer expires,
642 * all we need to do is generate or queue a CPU exception
643 */
644 static inline void cpu_ppc_decr_excp(CPUState *env)
645 {
646 /* Raise it */
647 LOG_TB("raise decrementer exception\n");
648 ppc_set_irq(env, PPC_INTERRUPT_DECR, 1);
649 }
650
651 static inline void cpu_ppc_hdecr_excp(CPUState *env)
652 {
653 /* Raise it */
654 LOG_TB("raise decrementer exception\n");
655 ppc_set_irq(env, PPC_INTERRUPT_HDECR, 1);
656 }
657
658 static void __cpu_ppc_store_decr (CPUState *env, uint64_t *nextp,
659 struct QEMUTimer *timer,
660 void (*raise_excp)(CPUState *),
661 uint32_t decr, uint32_t value,
662 int is_excp)
663 {
664 ppc_tb_t *tb_env = env->tb_env;
665 uint64_t now, next;
666
667 LOG_TB("%s: %08" PRIx32 " => %08" PRIx32 "\n", __func__,
668 decr, value);
669 now = qemu_get_clock_ns(vm_clock);
670 next = now + muldiv64(value, get_ticks_per_sec(), tb_env->decr_freq);
671 if (is_excp)
672 next += *nextp - now;
673 if (next == now)
674 next++;
675 *nextp = next;
676 /* Adjust timer */
677 qemu_mod_timer(timer, next);
678 /* If we set a negative value and the decrementer was positive,
679 * raise an exception.
680 */
681 if ((value & 0x80000000) && !(decr & 0x80000000))
682 (*raise_excp)(env);
683 }
684
685 static inline void _cpu_ppc_store_decr(CPUState *env, uint32_t decr,
686 uint32_t value, int is_excp)
687 {
688 ppc_tb_t *tb_env = env->tb_env;
689
690 __cpu_ppc_store_decr(env, &tb_env->decr_next, tb_env->decr_timer,
691 &cpu_ppc_decr_excp, decr, value, is_excp);
692 }
693
694 void cpu_ppc_store_decr (CPUState *env, uint32_t value)
695 {
696 _cpu_ppc_store_decr(env, cpu_ppc_load_decr(env), value, 0);
697 }
698
699 static void cpu_ppc_decr_cb (void *opaque)
700 {
701 _cpu_ppc_store_decr(opaque, 0x00000000, 0xFFFFFFFF, 1);
702 }
703
704 static inline void _cpu_ppc_store_hdecr(CPUState *env, uint32_t hdecr,
705 uint32_t value, int is_excp)
706 {
707 ppc_tb_t *tb_env = env->tb_env;
708
709 if (tb_env->hdecr_timer != NULL) {
710 __cpu_ppc_store_decr(env, &tb_env->hdecr_next, tb_env->hdecr_timer,
711 &cpu_ppc_hdecr_excp, hdecr, value, is_excp);
712 }
713 }
714
715 void cpu_ppc_store_hdecr (CPUState *env, uint32_t value)
716 {
717 _cpu_ppc_store_hdecr(env, cpu_ppc_load_hdecr(env), value, 0);
718 }
719
720 static void cpu_ppc_hdecr_cb (void *opaque)
721 {
722 _cpu_ppc_store_hdecr(opaque, 0x00000000, 0xFFFFFFFF, 1);
723 }
724
725 void cpu_ppc_store_purr (CPUState *env, uint64_t value)
726 {
727 ppc_tb_t *tb_env = env->tb_env;
728
729 tb_env->purr_load = value;
730 tb_env->purr_start = qemu_get_clock_ns(vm_clock);
731 }
732
733 static void cpu_ppc_set_tb_clk (void *opaque, uint32_t freq)
734 {
735 CPUState *env = opaque;
736 ppc_tb_t *tb_env = env->tb_env;
737
738 tb_env->tb_freq = freq;
739 tb_env->decr_freq = freq;
740 /* There is a bug in Linux 2.4 kernels:
741 * if a decrementer exception is pending when it enables msr_ee at startup,
742 * it's not ready to handle it...
743 */
744 _cpu_ppc_store_decr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
745 _cpu_ppc_store_hdecr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
746 cpu_ppc_store_purr(env, 0x0000000000000000ULL);
747 }
748
749 /* Set up (once) timebase frequency (in Hz) */
750 clk_setup_cb cpu_ppc_tb_init (CPUState *env, uint32_t freq)
751 {
752 ppc_tb_t *tb_env;
753
754 tb_env = qemu_mallocz(sizeof(ppc_tb_t));
755 env->tb_env = tb_env;
756 /* Create new timer */
757 tb_env->decr_timer = qemu_new_timer_ns(vm_clock, &cpu_ppc_decr_cb, env);
758 if (0) {
759 /* XXX: find a suitable condition to enable the hypervisor decrementer
760 */
761 tb_env->hdecr_timer = qemu_new_timer_ns(vm_clock, &cpu_ppc_hdecr_cb, env);
762 } else {
763 tb_env->hdecr_timer = NULL;
764 }
765 cpu_ppc_set_tb_clk(env, freq);
766
767 return &cpu_ppc_set_tb_clk;
768 }
769
770 /* Specific helpers for POWER & PowerPC 601 RTC */
771 #if 0
772 static clk_setup_cb cpu_ppc601_rtc_init (CPUState *env)
773 {
774 return cpu_ppc_tb_init(env, 7812500);
775 }
776 #endif
777
778 void cpu_ppc601_store_rtcu (CPUState *env, uint32_t value)
779 {
780 _cpu_ppc_store_tbu(env, value);
781 }
782
783 uint32_t cpu_ppc601_load_rtcu (CPUState *env)
784 {
785 return _cpu_ppc_load_tbu(env);
786 }
787
788 void cpu_ppc601_store_rtcl (CPUState *env, uint32_t value)
789 {
790 cpu_ppc_store_tbl(env, value & 0x3FFFFF80);
791 }
792
793 uint32_t cpu_ppc601_load_rtcl (CPUState *env)
794 {
795 return cpu_ppc_load_tbl(env) & 0x3FFFFF80;
796 }
797
798 /*****************************************************************************/
799 /* Embedded PowerPC timers */
800
801 /* PIT, FIT & WDT */
802 typedef struct ppcemb_timer_t ppcemb_timer_t;
803 struct ppcemb_timer_t {
804 uint64_t pit_reload; /* PIT auto-reload value */
805 uint64_t fit_next; /* Tick for next FIT interrupt */
806 struct QEMUTimer *fit_timer;
807 uint64_t wdt_next; /* Tick for next WDT interrupt */
808 struct QEMUTimer *wdt_timer;
809
810 /* 405 have the PIT, 440 have a DECR. */
811 unsigned int decr_excp;
812 };
813
814 /* Fixed interval timer */
815 static void cpu_4xx_fit_cb (void *opaque)
816 {
817 CPUState *env;
818 ppc_tb_t *tb_env;
819 ppcemb_timer_t *ppcemb_timer;
820 uint64_t now, next;
821
822 env = opaque;
823 tb_env = env->tb_env;
824 ppcemb_timer = tb_env->opaque;
825 now = qemu_get_clock_ns(vm_clock);
826 switch ((env->spr[SPR_40x_TCR] >> 24) & 0x3) {
827 case 0:
828 next = 1 << 9;
829 break;
830 case 1:
831 next = 1 << 13;
832 break;
833 case 2:
834 next = 1 << 17;
835 break;
836 case 3:
837 next = 1 << 21;
838 break;
839 default:
840 /* Cannot occur, but makes gcc happy */
841 return;
842 }
843 next = now + muldiv64(next, get_ticks_per_sec(), tb_env->tb_freq);
844 if (next == now)
845 next++;
846 qemu_mod_timer(ppcemb_timer->fit_timer, next);
847 env->spr[SPR_40x_TSR] |= 1 << 26;
848 if ((env->spr[SPR_40x_TCR] >> 23) & 0x1)
849 ppc_set_irq(env, PPC_INTERRUPT_FIT, 1);
850 LOG_TB("%s: ir %d TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx "\n", __func__,
851 (int)((env->spr[SPR_40x_TCR] >> 23) & 0x1),
852 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
853 }
854
855 /* Programmable interval timer */
856 static void start_stop_pit (CPUState *env, ppc_tb_t *tb_env, int is_excp)
857 {
858 ppcemb_timer_t *ppcemb_timer;
859 uint64_t now, next;
860
861 ppcemb_timer = tb_env->opaque;
862 if (ppcemb_timer->pit_reload <= 1 ||
863 !((env->spr[SPR_40x_TCR] >> 26) & 0x1) ||
864 (is_excp && !((env->spr[SPR_40x_TCR] >> 22) & 0x1))) {
865 /* Stop PIT */
866 LOG_TB("%s: stop PIT\n", __func__);
867 qemu_del_timer(tb_env->decr_timer);
868 } else {
869 LOG_TB("%s: start PIT %016" PRIx64 "\n",
870 __func__, ppcemb_timer->pit_reload);
871 now = qemu_get_clock_ns(vm_clock);
872 next = now + muldiv64(ppcemb_timer->pit_reload,
873 get_ticks_per_sec(), tb_env->decr_freq);
874 if (is_excp)
875 next += tb_env->decr_next - now;
876 if (next == now)
877 next++;
878 qemu_mod_timer(tb_env->decr_timer, next);
879 tb_env->decr_next = next;
880 }
881 }
882
883 static void cpu_4xx_pit_cb (void *opaque)
884 {
885 CPUState *env;
886 ppc_tb_t *tb_env;
887 ppcemb_timer_t *ppcemb_timer;
888
889 env = opaque;
890 tb_env = env->tb_env;
891 ppcemb_timer = tb_env->opaque;
892 env->spr[SPR_40x_TSR] |= 1 << 27;
893 if ((env->spr[SPR_40x_TCR] >> 26) & 0x1)
894 ppc_set_irq(env, ppcemb_timer->decr_excp, 1);
895 start_stop_pit(env, tb_env, 1);
896 LOG_TB("%s: ar %d ir %d TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx " "
897 "%016" PRIx64 "\n", __func__,
898 (int)((env->spr[SPR_40x_TCR] >> 22) & 0x1),
899 (int)((env->spr[SPR_40x_TCR] >> 26) & 0x1),
900 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR],
901 ppcemb_timer->pit_reload);
902 }
903
904 /* Watchdog timer */
905 static void cpu_4xx_wdt_cb (void *opaque)
906 {
907 CPUState *env;
908 ppc_tb_t *tb_env;
909 ppcemb_timer_t *ppcemb_timer;
910 uint64_t now, next;
911
912 env = opaque;
913 tb_env = env->tb_env;
914 ppcemb_timer = tb_env->opaque;
915 now = qemu_get_clock_ns(vm_clock);
916 switch ((env->spr[SPR_40x_TCR] >> 30) & 0x3) {
917 case 0:
918 next = 1 << 17;
919 break;
920 case 1:
921 next = 1 << 21;
922 break;
923 case 2:
924 next = 1 << 25;
925 break;
926 case 3:
927 next = 1 << 29;
928 break;
929 default:
930 /* Cannot occur, but makes gcc happy */
931 return;
932 }
933 next = now + muldiv64(next, get_ticks_per_sec(), tb_env->decr_freq);
934 if (next == now)
935 next++;
936 LOG_TB("%s: TCR " TARGET_FMT_lx " TSR " TARGET_FMT_lx "\n", __func__,
937 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
938 switch ((env->spr[SPR_40x_TSR] >> 30) & 0x3) {
939 case 0x0:
940 case 0x1:
941 qemu_mod_timer(ppcemb_timer->wdt_timer, next);
942 ppcemb_timer->wdt_next = next;
943 env->spr[SPR_40x_TSR] |= 1 << 31;
944 break;
945 case 0x2:
946 qemu_mod_timer(ppcemb_timer->wdt_timer, next);
947 ppcemb_timer->wdt_next = next;
948 env->spr[SPR_40x_TSR] |= 1 << 30;
949 if ((env->spr[SPR_40x_TCR] >> 27) & 0x1)
950 ppc_set_irq(env, PPC_INTERRUPT_WDT, 1);
951 break;
952 case 0x3:
953 env->spr[SPR_40x_TSR] &= ~0x30000000;
954 env->spr[SPR_40x_TSR] |= env->spr[SPR_40x_TCR] & 0x30000000;
955 switch ((env->spr[SPR_40x_TCR] >> 28) & 0x3) {
956 case 0x0:
957 /* No reset */
958 break;
959 case 0x1: /* Core reset */
960 ppc40x_core_reset(env);
961 break;
962 case 0x2: /* Chip reset */
963 ppc40x_chip_reset(env);
964 break;
965 case 0x3: /* System reset */
966 ppc40x_system_reset(env);
967 break;
968 }
969 }
970 }
971
972 void store_40x_pit (CPUState *env, target_ulong val)
973 {
974 ppc_tb_t *tb_env;
975 ppcemb_timer_t *ppcemb_timer;
976
977 tb_env = env->tb_env;
978 ppcemb_timer = tb_env->opaque;
979 LOG_TB("%s val" TARGET_FMT_lx "\n", __func__, val);
980 ppcemb_timer->pit_reload = val;
981 start_stop_pit(env, tb_env, 0);
982 }
983
984 target_ulong load_40x_pit (CPUState *env)
985 {
986 return cpu_ppc_load_decr(env);
987 }
988
989 void store_booke_tsr (CPUState *env, target_ulong val)
990 {
991 ppc_tb_t *tb_env = env->tb_env;
992 ppcemb_timer_t *ppcemb_timer;
993
994 ppcemb_timer = tb_env->opaque;
995
996 LOG_TB("%s: val " TARGET_FMT_lx "\n", __func__, val);
997 env->spr[SPR_40x_TSR] &= ~(val & 0xFC000000);
998 if (val & 0x80000000)
999 ppc_set_irq(env, ppcemb_timer->decr_excp, 0);
1000 }
1001
1002 void store_booke_tcr (CPUState *env, target_ulong val)
1003 {
1004 ppc_tb_t *tb_env;
1005
1006 tb_env = env->tb_env;
1007 LOG_TB("%s: val " TARGET_FMT_lx "\n", __func__, val);
1008 env->spr[SPR_40x_TCR] = val & 0xFFC00000;
1009 start_stop_pit(env, tb_env, 1);
1010 cpu_4xx_wdt_cb(env);
1011 }
1012
1013 static void ppc_emb_set_tb_clk (void *opaque, uint32_t freq)
1014 {
1015 CPUState *env = opaque;
1016 ppc_tb_t *tb_env = env->tb_env;
1017
1018 LOG_TB("%s set new frequency to %" PRIu32 "\n", __func__,
1019 freq);
1020 tb_env->tb_freq = freq;
1021 tb_env->decr_freq = freq;
1022 /* XXX: we should also update all timers */
1023 }
1024
1025 clk_setup_cb ppc_emb_timers_init (CPUState *env, uint32_t freq,
1026 unsigned int decr_excp)
1027 {
1028 ppc_tb_t *tb_env;
1029 ppcemb_timer_t *ppcemb_timer;
1030
1031 tb_env = qemu_mallocz(sizeof(ppc_tb_t));
1032 env->tb_env = tb_env;
1033 ppcemb_timer = qemu_mallocz(sizeof(ppcemb_timer_t));
1034 tb_env->tb_freq = freq;
1035 tb_env->decr_freq = freq;
1036 tb_env->opaque = ppcemb_timer;
1037 LOG_TB("%s freq %" PRIu32 "\n", __func__, freq);
1038 if (ppcemb_timer != NULL) {
1039 /* We use decr timer for PIT */
1040 tb_env->decr_timer = qemu_new_timer_ns(vm_clock, &cpu_4xx_pit_cb, env);
1041 ppcemb_timer->fit_timer =
1042 qemu_new_timer_ns(vm_clock, &cpu_4xx_fit_cb, env);
1043 ppcemb_timer->wdt_timer =
1044 qemu_new_timer_ns(vm_clock, &cpu_4xx_wdt_cb, env);
1045 ppcemb_timer->decr_excp = decr_excp;
1046 }
1047
1048 return &ppc_emb_set_tb_clk;
1049 }
1050
1051 /*****************************************************************************/
1052 /* Embedded PowerPC Device Control Registers */
1053 typedef struct ppc_dcrn_t ppc_dcrn_t;
1054 struct ppc_dcrn_t {
1055 dcr_read_cb dcr_read;
1056 dcr_write_cb dcr_write;
1057 void *opaque;
1058 };
1059
1060 /* XXX: on 460, DCR addresses are 32 bits wide,
1061 * using DCRIPR to get the 22 upper bits of the DCR address
1062 */
1063 #define DCRN_NB 1024
1064 struct ppc_dcr_t {
1065 ppc_dcrn_t dcrn[DCRN_NB];
1066 int (*read_error)(int dcrn);
1067 int (*write_error)(int dcrn);
1068 };
1069
1070 int ppc_dcr_read (ppc_dcr_t *dcr_env, int dcrn, uint32_t *valp)
1071 {
1072 ppc_dcrn_t *dcr;
1073
1074 if (dcrn < 0 || dcrn >= DCRN_NB)
1075 goto error;
1076 dcr = &dcr_env->dcrn[dcrn];
1077 if (dcr->dcr_read == NULL)
1078 goto error;
1079 *valp = (*dcr->dcr_read)(dcr->opaque, dcrn);
1080
1081 return 0;
1082
1083 error:
1084 if (dcr_env->read_error != NULL)
1085 return (*dcr_env->read_error)(dcrn);
1086
1087 return -1;
1088 }
1089
1090 int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, uint32_t val)
1091 {
1092 ppc_dcrn_t *dcr;
1093
1094 if (dcrn < 0 || dcrn >= DCRN_NB)
1095 goto error;
1096 dcr = &dcr_env->dcrn[dcrn];
1097 if (dcr->dcr_write == NULL)
1098 goto error;
1099 (*dcr->dcr_write)(dcr->opaque, dcrn, val);
1100
1101 return 0;
1102
1103 error:
1104 if (dcr_env->write_error != NULL)
1105 return (*dcr_env->write_error)(dcrn);
1106
1107 return -1;
1108 }
1109
1110 int ppc_dcr_register (CPUState *env, int dcrn, void *opaque,
1111 dcr_read_cb dcr_read, dcr_write_cb dcr_write)
1112 {
1113 ppc_dcr_t *dcr_env;
1114 ppc_dcrn_t *dcr;
1115
1116 dcr_env = env->dcr_env;
1117 if (dcr_env == NULL)
1118 return -1;
1119 if (dcrn < 0 || dcrn >= DCRN_NB)
1120 return -1;
1121 dcr = &dcr_env->dcrn[dcrn];
1122 if (dcr->opaque != NULL ||
1123 dcr->dcr_read != NULL ||
1124 dcr->dcr_write != NULL)
1125 return -1;
1126 dcr->opaque = opaque;
1127 dcr->dcr_read = dcr_read;
1128 dcr->dcr_write = dcr_write;
1129
1130 return 0;
1131 }
1132
1133 int ppc_dcr_init (CPUState *env, int (*read_error)(int dcrn),
1134 int (*write_error)(int dcrn))
1135 {
1136 ppc_dcr_t *dcr_env;
1137
1138 dcr_env = qemu_mallocz(sizeof(ppc_dcr_t));
1139 dcr_env->read_error = read_error;
1140 dcr_env->write_error = write_error;
1141 env->dcr_env = dcr_env;
1142
1143 return 0;
1144 }
1145
1146 /*****************************************************************************/
1147 /* Debug port */
1148 void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
1149 {
1150 addr &= 0xF;
1151 switch (addr) {
1152 case 0:
1153 printf("%c", val);
1154 break;
1155 case 1:
1156 printf("\n");
1157 fflush(stdout);
1158 break;
1159 case 2:
1160 printf("Set loglevel to %04" PRIx32 "\n", val);
1161 cpu_set_log(val | 0x100);
1162 break;
1163 }
1164 }
1165
1166 /*****************************************************************************/
1167 /* NVRAM helpers */
1168 static inline uint32_t nvram_read (nvram_t *nvram, uint32_t addr)
1169 {
1170 return (*nvram->read_fn)(nvram->opaque, addr);;
1171 }
1172
1173 static inline void nvram_write (nvram_t *nvram, uint32_t addr, uint32_t val)
1174 {
1175 (*nvram->write_fn)(nvram->opaque, addr, val);
1176 }
1177
1178 void NVRAM_set_byte (nvram_t *nvram, uint32_t addr, uint8_t value)
1179 {
1180 nvram_write(nvram, addr, value);
1181 }
1182
1183 uint8_t NVRAM_get_byte (nvram_t *nvram, uint32_t addr)
1184 {
1185 return nvram_read(nvram, addr);
1186 }
1187
1188 void NVRAM_set_word (nvram_t *nvram, uint32_t addr, uint16_t value)
1189 {
1190 nvram_write(nvram, addr, value >> 8);
1191 nvram_write(nvram, addr + 1, value & 0xFF);
1192 }
1193
1194 uint16_t NVRAM_get_word (nvram_t *nvram, uint32_t addr)
1195 {
1196 uint16_t tmp;
1197
1198 tmp = nvram_read(nvram, addr) << 8;
1199 tmp |= nvram_read(nvram, addr + 1);
1200
1201 return tmp;
1202 }
1203
1204 void NVRAM_set_lword (nvram_t *nvram, uint32_t addr, uint32_t value)
1205 {
1206 nvram_write(nvram, addr, value >> 24);
1207 nvram_write(nvram, addr + 1, (value >> 16) & 0xFF);
1208 nvram_write(nvram, addr + 2, (value >> 8) & 0xFF);
1209 nvram_write(nvram, addr + 3, value & 0xFF);
1210 }
1211
1212 uint32_t NVRAM_get_lword (nvram_t *nvram, uint32_t addr)
1213 {
1214 uint32_t tmp;
1215
1216 tmp = nvram_read(nvram, addr) << 24;
1217 tmp |= nvram_read(nvram, addr + 1) << 16;
1218 tmp |= nvram_read(nvram, addr + 2) << 8;
1219 tmp |= nvram_read(nvram, addr + 3);
1220
1221 return tmp;
1222 }
1223
1224 void NVRAM_set_string (nvram_t *nvram, uint32_t addr,
1225 const char *str, uint32_t max)
1226 {
1227 int i;
1228
1229 for (i = 0; i < max && str[i] != '\0'; i++) {
1230 nvram_write(nvram, addr + i, str[i]);
1231 }
1232 nvram_write(nvram, addr + i, str[i]);
1233 nvram_write(nvram, addr + max - 1, '\0');
1234 }
1235
1236 int NVRAM_get_string (nvram_t *nvram, uint8_t *dst, uint16_t addr, int max)
1237 {
1238 int i;
1239
1240 memset(dst, 0, max);
1241 for (i = 0; i < max; i++) {
1242 dst[i] = NVRAM_get_byte(nvram, addr + i);
1243 if (dst[i] == '\0')
1244 break;
1245 }
1246
1247 return i;
1248 }
1249
1250 static uint16_t NVRAM_crc_update (uint16_t prev, uint16_t value)
1251 {
1252 uint16_t tmp;
1253 uint16_t pd, pd1, pd2;
1254
1255 tmp = prev >> 8;
1256 pd = prev ^ value;
1257 pd1 = pd & 0x000F;
1258 pd2 = ((pd >> 4) & 0x000F) ^ pd1;
1259 tmp ^= (pd1 << 3) | (pd1 << 8);
1260 tmp ^= pd2 | (pd2 << 7) | (pd2 << 12);
1261
1262 return tmp;
1263 }
1264
1265 static uint16_t NVRAM_compute_crc (nvram_t *nvram, uint32_t start, uint32_t count)
1266 {
1267 uint32_t i;
1268 uint16_t crc = 0xFFFF;
1269 int odd;
1270
1271 odd = count & 1;
1272 count &= ~1;
1273 for (i = 0; i != count; i++) {
1274 crc = NVRAM_crc_update(crc, NVRAM_get_word(nvram, start + i));
1275 }
1276 if (odd) {
1277 crc = NVRAM_crc_update(crc, NVRAM_get_byte(nvram, start + i) << 8);
1278 }
1279
1280 return crc;
1281 }
1282
1283 #define CMDLINE_ADDR 0x017ff000
1284
1285 int PPC_NVRAM_set_params (nvram_t *nvram, uint16_t NVRAM_size,
1286 const char *arch,
1287 uint32_t RAM_size, int boot_device,
1288 uint32_t kernel_image, uint32_t kernel_size,
1289 const char *cmdline,
1290 uint32_t initrd_image, uint32_t initrd_size,
1291 uint32_t NVRAM_image,
1292 int width, int height, int depth)
1293 {
1294 uint16_t crc;
1295
1296 /* Set parameters for Open Hack'Ware BIOS */
1297 NVRAM_set_string(nvram, 0x00, "QEMU_BIOS", 16);
1298 NVRAM_set_lword(nvram, 0x10, 0x00000002); /* structure v2 */
1299 NVRAM_set_word(nvram, 0x14, NVRAM_size);
1300 NVRAM_set_string(nvram, 0x20, arch, 16);
1301 NVRAM_set_lword(nvram, 0x30, RAM_size);
1302 NVRAM_set_byte(nvram, 0x34, boot_device);
1303 NVRAM_set_lword(nvram, 0x38, kernel_image);
1304 NVRAM_set_lword(nvram, 0x3C, kernel_size);
1305 if (cmdline) {
1306 /* XXX: put the cmdline in NVRAM too ? */
1307 pstrcpy_targphys("cmdline", CMDLINE_ADDR, RAM_size - CMDLINE_ADDR, cmdline);
1308 NVRAM_set_lword(nvram, 0x40, CMDLINE_ADDR);
1309 NVRAM_set_lword(nvram, 0x44, strlen(cmdline));
1310 } else {
1311 NVRAM_set_lword(nvram, 0x40, 0);
1312 NVRAM_set_lword(nvram, 0x44, 0);
1313 }
1314 NVRAM_set_lword(nvram, 0x48, initrd_image);
1315 NVRAM_set_lword(nvram, 0x4C, initrd_size);
1316 NVRAM_set_lword(nvram, 0x50, NVRAM_image);
1317
1318 NVRAM_set_word(nvram, 0x54, width);
1319 NVRAM_set_word(nvram, 0x56, height);
1320 NVRAM_set_word(nvram, 0x58, depth);
1321 crc = NVRAM_compute_crc(nvram, 0x00, 0xF8);
1322 NVRAM_set_word(nvram, 0xFC, crc);
1323
1324 return 0;
1325 }
CRIS target port of Qemu