hw/ppc.c

   1 /*
   2  * QEMU generic PPC hardware System Emulator
   3  *
   4  * Copyright (c) 2003-2007 Jocelyn Mayer
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "vl.h"
  25 #include "m48t59.h"
  26
  27 extern FILE *logfile;
  28 extern int loglevel;
  29
  30 /*****************************************************************************/
  31 /* PowerPC internal fake IRQ controller
  32  * used to manage multiple sources hardware events
  33  */
  34 static void ppc_set_irq (void *opaque, int n_IRQ, int level)
  35 {
  36     CPUState *env;
  37
  38     env = opaque;
  39     if (level) {
  40         env->pending_interrupts |= 1 << n_IRQ;
  41         cpu_interrupt(env, CPU_INTERRUPT_HARD);
  42     } else {
  43         env->pending_interrupts &= ~(1 << n_IRQ);
  44         if (env->pending_interrupts == 0)
  45             cpu_reset_interrupt(env, CPU_INTERRUPT_HARD);
  46     }
  47 #if 0
  48     printf("%s: %p n_IRQ %d level %d => pending %08x req %08x\n", __func__,
  49            env, n_IRQ, level, env->pending_interrupts, env->interrupt_request);
  50 #endif
  51 }
  52
  53 void cpu_ppc_irq_init_cpu(CPUState *env)
  54 {
  55     qemu_irq *qi;
  56     int i;
  57
  58     qi = qemu_allocate_irqs(ppc_set_irq, env, 32);
  59     for (i = 0; i < 32; i++) {
  60         env->irq[i] = qi[i];
  61     }
  62 }
  63
  64 /* External IRQ callback from OpenPIC IRQ controller */
  65 void ppc_openpic_irq (void *opaque, int n_IRQ, int level)
  66 {
  67     switch (n_IRQ) {
  68     case OPENPIC_EVT_INT:
  69         n_IRQ = PPC_INTERRUPT_EXT;
  70         break;
  71     case OPENPIC_EVT_CINT:
  72         /* On PowerPC BookE, critical input use vector 0 */
  73         n_IRQ = PPC_INTERRUPT_RESET;
  74         break;
  75     case OPENPIC_EVT_MCK:
  76         n_IRQ = PPC_INTERRUPT_MCK;
  77         break;
  78     case OPENPIC_EVT_DEBUG:
  79         n_IRQ = PPC_INTERRUPT_DEBUG;
  80         break;
  81     case OPENPIC_EVT_RESET:
  82         qemu_system_reset_request();
  83         return;
  84     }
  85     ppc_set_irq(opaque, n_IRQ, level);
  86 }
  87
  88 /*****************************************************************************/
  89 /* PPC time base and decrementer emulation */
  90 //#define DEBUG_TB
  91
  92 struct ppc_tb_t {
  93     /* Time base management */
  94     int64_t  tb_offset;    /* Compensation               */
  95     uint32_t tb_freq;      /* TB frequency               */
  96     /* Decrementer management */
  97     uint64_t decr_next;    /* Tick for next decr interrupt  */
  98     struct QEMUTimer *decr_timer;
  99     void *opaque;
 100 };
 101
 102 static inline uint64_t cpu_ppc_get_tb (ppc_tb_t *tb_env)
 103 {
 104     /* TB time in tb periods */
 105     return muldiv64(qemu_get_clock(vm_clock) + tb_env->tb_offset,
 106                     tb_env->tb_freq, ticks_per_sec);
 107 }
 108
 109 uint32_t cpu_ppc_load_tbl (CPUState *env)
 110 {
 111     ppc_tb_t *tb_env = env->tb_env;
 112     uint64_t tb;
 113
 114     tb = cpu_ppc_get_tb(tb_env);
 115 #ifdef DEBUG_TB
 116     {
 117         static int last_time;
 118         int now;
 119         now = time(NULL);
 120         if (last_time != now) {
 121             last_time = now;
 122             printf("%s: tb=0x%016lx %d %08lx\n",
 123                    __func__, tb, now, tb_env->tb_offset);
 124         }
 125     }
 126 #endif
 127
 128     return tb & 0xFFFFFFFF;
 129 }
 130
 131 uint32_t cpu_ppc_load_tbu (CPUState *env)
 132 {
 133     ppc_tb_t *tb_env = env->tb_env;
 134     uint64_t tb;
 135
 136     tb = cpu_ppc_get_tb(tb_env);
 137 #ifdef DEBUG_TB
 138     printf("%s: tb=0x%016lx\n", __func__, tb);
 139 #endif
 140
 141     return tb >> 32;
 142 }
 143
 144 static void cpu_ppc_store_tb (ppc_tb_t *tb_env, uint64_t value)
 145 {
 146     tb_env->tb_offset = muldiv64(value, ticks_per_sec, tb_env->tb_freq)
 147         - qemu_get_clock(vm_clock);
 148 #ifdef DEBUG_TB
 149     printf("%s: tb=0x%016lx offset=%08x\n", __func__, value);
 150 #endif
 151 }
 152
 153 void cpu_ppc_store_tbu (CPUState *env, uint32_t value)
 154 {
 155     ppc_tb_t *tb_env = env->tb_env;
 156
 157     cpu_ppc_store_tb(tb_env,
 158                      ((uint64_t)value << 32) | cpu_ppc_load_tbl(env));
 159 }
 160
 161 void cpu_ppc_store_tbl (CPUState *env, uint32_t value)
 162 {
 163     ppc_tb_t *tb_env = env->tb_env;
 164
 165     cpu_ppc_store_tb(tb_env,
 166                      ((uint64_t)cpu_ppc_load_tbu(env) << 32) | value);
 167 }
 168
 169 uint32_t cpu_ppc_load_decr (CPUState *env)
 170 {
 171     ppc_tb_t *tb_env = env->tb_env;
 172     uint32_t decr;
 173     int64_t diff;
 174
 175     diff = tb_env->decr_next - qemu_get_clock(vm_clock);
 176     if (diff >= 0)
 177         decr = muldiv64(diff, tb_env->tb_freq, ticks_per_sec);
 178     else
 179         decr = -muldiv64(-diff, tb_env->tb_freq, ticks_per_sec);
 180 #if defined(DEBUG_TB)
 181     printf("%s: 0x%08x\n", __func__, decr);
 182 #endif
 183
 184     return decr;
 185 }
 186
 187 /* When decrementer expires,
 188  * all we need to do is generate or queue a CPU exception
 189  */
 190 static inline void cpu_ppc_decr_excp (CPUState *env)
 191 {
 192     /* Raise it */
 193 #ifdef DEBUG_TB
 194     printf("raise decrementer exception\n");
 195 #endif
 196     ppc_set_irq(env, PPC_INTERRUPT_DECR, 1);
 197 }
 198
 199 static void _cpu_ppc_store_decr (CPUState *env, uint32_t decr,
 200                                  uint32_t value, int is_excp)
 201 {
 202     ppc_tb_t *tb_env = env->tb_env;
 203     uint64_t now, next;
 204
 205 #ifdef DEBUG_TB
 206     printf("%s: 0x%08x => 0x%08x\n", __func__, decr, value);
 207 #endif
 208     now = qemu_get_clock(vm_clock);
 209     next = now + muldiv64(value, ticks_per_sec, tb_env->tb_freq);
 210     if (is_excp)
 211         next += tb_env->decr_next - now;
 212     if (next == now)
 213         next++;
 214     tb_env->decr_next = next;
 215     /* Adjust timer */
 216     qemu_mod_timer(tb_env->decr_timer, next);
 217     /* If we set a negative value and the decrementer was positive,
 218      * raise an exception.
 219      */
 220     if ((value & 0x80000000) && !(decr & 0x80000000))
 221         cpu_ppc_decr_excp(env);
 222 }
 223
 224 void cpu_ppc_store_decr (CPUState *env, uint32_t value)
 225 {
 226     _cpu_ppc_store_decr(env, cpu_ppc_load_decr(env), value, 0);
 227 }
 228
 229 static void cpu_ppc_decr_cb (void *opaque)
 230 {
 231     _cpu_ppc_store_decr(opaque, 0x00000000, 0xFFFFFFFF, 1);
 232 }
 233
 234 /* Set up (once) timebase frequency (in Hz) */
 235 ppc_tb_t *cpu_ppc_tb_init (CPUState *env, uint32_t freq)
 236 {
 237     ppc_tb_t *tb_env;
 238
 239     tb_env = qemu_mallocz(sizeof(ppc_tb_t));
 240     if (tb_env == NULL)
 241         return NULL;
 242     env->tb_env = tb_env;
 243     if (tb_env->tb_freq == 0 || 1) {
 244         tb_env->tb_freq = freq;
 245         /* Create new timer */
 246         tb_env->decr_timer =
 247             qemu_new_timer(vm_clock, &cpu_ppc_decr_cb, env);
 248         /* There is a bug in Linux 2.4 kernels:
 249          * if a decrementer exception is pending when it enables msr_ee,
 250          * it's not ready to handle it...
 251          */
 252         _cpu_ppc_store_decr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
 253     }
 254
 255     return tb_env;
 256 }
 257
 258 /* Specific helpers for POWER & PowerPC 601 RTC */
 259 ppc_tb_t *cpu_ppc601_rtc_init (CPUState *env)
 260 {
 261     return cpu_ppc_tb_init(env, 7812500);
 262 }
 263
 264 void cpu_ppc601_store_rtcu (CPUState *env, uint32_t value)
 265 __attribute__ (( alias ("cpu_ppc_store_tbu") ));
 266
 267 uint32_t cpu_ppc601_load_rtcu (CPUState *env)
 268 __attribute__ (( alias ("cpu_ppc_load_tbu") ));
 269
 270 void cpu_ppc601_store_rtcl (CPUState *env, uint32_t value)
 271 {
 272     cpu_ppc_store_tbl(env, value & 0x3FFFFF80);
 273 }
 274
 275 uint32_t cpu_ppc601_load_rtcl (CPUState *env)
 276 {
 277     return cpu_ppc_load_tbl(env) & 0x3FFFFF80;
 278 }
 279
 280 /*****************************************************************************/
 281 /* Embedded PowerPC timers */
 282
 283 /* PIT, FIT & WDT */
 284 typedef struct ppcemb_timer_t ppcemb_timer_t;
 285 struct ppcemb_timer_t {
 286     uint64_t pit_reload;  /* PIT auto-reload value        */
 287     uint64_t fit_next;    /* Tick for next FIT interrupt  */
 288     struct QEMUTimer *fit_timer;
 289     uint64_t wdt_next;    /* Tick for next WDT interrupt  */
 290     struct QEMUTimer *wdt_timer;
 291 };
 292
 293 /* Fixed interval timer */
 294 static void cpu_4xx_fit_cb (void *opaque)
 295 {
 296     CPUState *env;
 297     ppc_tb_t *tb_env;
 298     ppcemb_timer_t *ppcemb_timer;
 299     uint64_t now, next;
 300
 301     env = opaque;
 302     tb_env = env->tb_env;
 303     ppcemb_timer = tb_env->opaque;
 304     now = qemu_get_clock(vm_clock);
 305     switch ((env->spr[SPR_40x_TCR] >> 24) & 0x3) {
 306     case 0:
 307         next = 1 << 9;
 308         break;
 309     case 1:
 310         next = 1 << 13;
 311         break;
 312     case 2:
 313         next = 1 << 17;
 314         break;
 315     case 3:
 316         next = 1 << 21;
 317         break;
 318     default:
 319         /* Cannot occur, but makes gcc happy */
 320         return;
 321     }
 322     next = now + muldiv64(next, ticks_per_sec, tb_env->tb_freq);
 323     if (next == now)
 324         next++;
 325     qemu_mod_timer(ppcemb_timer->fit_timer, next);
 326     tb_env->decr_next = next;
 327     env->spr[SPR_40x_TSR] |= 1 << 26;
 328     if ((env->spr[SPR_40x_TCR] >> 23) & 0x1)
 329         ppc_set_irq(env, PPC_INTERRUPT_FIT, 1);
 330     if (loglevel) {
 331         fprintf(logfile, "%s: ir %d TCR %08x TSR %08x\n", __func__,
 332                 (env->spr[SPR_40x_TCR] >> 23) & 0x1,
 333                 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
 334     }
 335 }
 336
 337 /* Programmable interval timer */
 338 static void cpu_4xx_pit_cb (void *opaque)
 339 {
 340     CPUState *env;
 341     ppc_tb_t *tb_env;
 342     ppcemb_timer_t *ppcemb_timer;
 343     uint64_t now, next;
 344
 345     env = opaque;
 346     tb_env = env->tb_env;
 347     ppcemb_timer = tb_env->opaque;
 348     now = qemu_get_clock(vm_clock);
 349     if ((env->spr[SPR_40x_TCR] >> 22) & 0x1) {
 350         /* Auto reload */
 351         next = now + muldiv64(ppcemb_timer->pit_reload,
 352                               ticks_per_sec, tb_env->tb_freq);
 353         if (next == now)
 354             next++;
 355         qemu_mod_timer(tb_env->decr_timer, next);
 356         tb_env->decr_next = next;
 357     }
 358     env->spr[SPR_40x_TSR] |= 1 << 27;
 359     if ((env->spr[SPR_40x_TCR] >> 26) & 0x1)
 360         ppc_set_irq(env, PPC_INTERRUPT_PIT, 1);
 361     if (loglevel) {
 362         fprintf(logfile, "%s: ar %d ir %d TCR %08x TSR %08x %08lx\n", __func__,
 363                 (env->spr[SPR_40x_TCR] >> 22) & 0x1,
 364                 (env->spr[SPR_40x_TCR] >> 26) & 0x1,
 365                 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR],
 366                 ppcemb_timer->pit_reload);
 367     }
 368 }
 369
 370 /* Watchdog timer */
 371 static void cpu_4xx_wdt_cb (void *opaque)
 372 {
 373     CPUState *env;
 374     ppc_tb_t *tb_env;
 375     ppcemb_timer_t *ppcemb_timer;
 376     uint64_t now, next;
 377
 378     env = opaque;
 379     tb_env = env->tb_env;
 380     ppcemb_timer = tb_env->opaque;
 381     now = qemu_get_clock(vm_clock);
 382     switch ((env->spr[SPR_40x_TCR] >> 30) & 0x3) {
 383     case 0:
 384         next = 1 << 17;
 385         break;
 386     case 1:
 387         next = 1 << 21;
 388         break;
 389     case 2:
 390         next = 1 << 25;
 391         break;
 392     case 3:
 393         next = 1 << 29;
 394         break;
 395     default:
 396         /* Cannot occur, but makes gcc happy */
 397         return;
 398     }
 399     next = now + muldiv64(next, ticks_per_sec, tb_env->tb_freq);
 400     if (next == now)
 401         next++;
 402     if (loglevel) {
 403         fprintf(logfile, "%s: TCR %08x TSR %08x\n", __func__,
 404                 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
 405     }
 406     switch ((env->spr[SPR_40x_TSR] >> 30) & 0x3) {
 407     case 0x0:
 408     case 0x1:
 409         qemu_mod_timer(ppcemb_timer->wdt_timer, next);
 410         ppcemb_timer->wdt_next = next;
 411         env->spr[SPR_40x_TSR] |= 1 << 31;
 412         break;
 413     case 0x2:
 414         qemu_mod_timer(ppcemb_timer->wdt_timer, next);
 415         ppcemb_timer->wdt_next = next;
 416         env->spr[SPR_40x_TSR] |= 1 << 30;
 417         if ((env->spr[SPR_40x_TCR] >> 27) & 0x1)
 418             ppc_set_irq(env, PPC_INTERRUPT_WDT, 1);
 419         break;
 420     case 0x3:
 421         env->spr[SPR_40x_TSR] &= ~0x30000000;
 422         env->spr[SPR_40x_TSR] |= env->spr[SPR_40x_TCR] & 0x30000000;
 423         switch ((env->spr[SPR_40x_TCR] >> 28) & 0x3) {
 424         case 0x0:
 425             /* No reset */
 426             break;
 427         case 0x1: /* Core reset */
 428         case 0x2: /* Chip reset */
 429         case 0x3: /* System reset */
 430             qemu_system_reset_request();
 431             return;
 432         }
 433     }
 434 }
 435
 436 void store_40x_pit (CPUState *env, target_ulong val)
 437 {
 438     ppc_tb_t *tb_env;
 439     ppcemb_timer_t *ppcemb_timer;
 440     uint64_t now, next;
 441
 442     tb_env = env->tb_env;
 443     ppcemb_timer = tb_env->opaque;
 444     if (loglevel)
 445         fprintf(logfile, "%s %p %p\n", __func__, tb_env, ppcemb_timer);
 446     ppcemb_timer->pit_reload = val;
 447     if (val == 0) {
 448         /* Stop PIT */
 449         if (loglevel)
 450             fprintf(logfile, "%s: stop PIT\n", __func__);
 451         qemu_del_timer(tb_env->decr_timer);
 452     } else {
 453         if (loglevel)
 454             fprintf(logfile, "%s: start PIT 0x%08x\n", __func__, val);
 455         now = qemu_get_clock(vm_clock);
 456         next = now + muldiv64(val, ticks_per_sec, tb_env->tb_freq);
 457          if (next == now)
 458             next++;
 459         qemu_mod_timer(tb_env->decr_timer, next);
 460         tb_env->decr_next = next;
 461     }
 462 }
 463
 464 target_ulong load_40x_pit (CPUState *env)
 465 {
 466     return cpu_ppc_load_decr(env);
 467 }
 468
 469 void store_booke_tsr (CPUState *env, target_ulong val)
 470 {
 471     env->spr[SPR_40x_TSR] = val & 0xFC000000;
 472 }
 473
 474 void store_booke_tcr (CPUState *env, target_ulong val)
 475 {
 476     /* We don't update timers now. Maybe we should... */
 477     env->spr[SPR_40x_TCR] = val & 0xFF800000;
 478 }
 479
 480 void ppc_emb_timers_init (CPUState *env)
 481 {
 482     ppc_tb_t *tb_env;
 483     ppcemb_timer_t *ppcemb_timer;
 484
 485     tb_env = env->tb_env;
 486     ppcemb_timer = qemu_mallocz(sizeof(ppcemb_timer_t));
 487     tb_env->opaque = ppcemb_timer;
 488     if (loglevel)
 489         fprintf(logfile, "%s %p %p\n", __func__, tb_env, ppcemb_timer);
 490     if (ppcemb_timer != NULL) {
 491         /* We use decr timer for PIT */
 492         tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_4xx_pit_cb, env);
 493         ppcemb_timer->fit_timer =
 494             qemu_new_timer(vm_clock, &cpu_4xx_fit_cb, env);
 495         ppcemb_timer->wdt_timer =
 496             qemu_new_timer(vm_clock, &cpu_4xx_wdt_cb, env);
 497     }
 498 }
 499
 500 #if 0
 501 /*****************************************************************************/
 502 /* Handle system reset (for now, just stop emulation) */
 503 void cpu_ppc_reset (CPUState *env)
 504 {
 505     printf("Reset asked... Stop emulation\n");
 506     abort();
 507 }
 508 #endif
 509
 510 /*****************************************************************************/
 511 /* Debug port */
 512 void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
 513 {
 514     addr &= 0xF;
 515     switch (addr) {
 516     case 0:
 517         printf("%c", val);
 518         break;
 519     case 1:
 520         printf("\n");
 521         fflush(stdout);
 522         break;
 523     case 2:
 524         printf("Set loglevel to %04x\n", val);
 525         cpu_set_log(val | 0x100);
 526         break;
 527     }
 528 }
 529
 530 /*****************************************************************************/
 531 /* NVRAM helpers */
 532 void NVRAM_set_byte (m48t59_t *nvram, uint32_t addr, uint8_t value)
 533 {
 534     m48t59_write(nvram, addr, value);
 535 }
 536
 537 uint8_t NVRAM_get_byte (m48t59_t *nvram, uint32_t addr)
 538 {
 539     return m48t59_read(nvram, addr);
 540 }
 541
 542 void NVRAM_set_word (m48t59_t *nvram, uint32_t addr, uint16_t value)
 543 {
 544     m48t59_write(nvram, addr, value >> 8);
 545     m48t59_write(nvram, addr + 1, value & 0xFF);
 546 }
 547
 548 uint16_t NVRAM_get_word (m48t59_t *nvram, uint32_t addr)
 549 {
 550     uint16_t tmp;
 551
 552     tmp = m48t59_read(nvram, addr) << 8;
 553     tmp |= m48t59_read(nvram, addr + 1);
 554     return tmp;
 555 }
 556
 557 void NVRAM_set_lword (m48t59_t *nvram, uint32_t addr, uint32_t value)
 558 {
 559     m48t59_write(nvram, addr, value >> 24);
 560     m48t59_write(nvram, addr + 1, (value >> 16) & 0xFF);
 561     m48t59_write(nvram, addr + 2, (value >> 8) & 0xFF);
 562     m48t59_write(nvram, addr + 3, value & 0xFF);
 563 }
 564
 565 uint32_t NVRAM_get_lword (m48t59_t *nvram, uint32_t addr)
 566 {
 567     uint32_t tmp;
 568
 569     tmp = m48t59_read(nvram, addr) << 24;
 570     tmp |= m48t59_read(nvram, addr + 1) << 16;
 571     tmp |= m48t59_read(nvram, addr + 2) << 8;
 572     tmp |= m48t59_read(nvram, addr + 3);
 573
 574     return tmp;
 575 }
 576
 577 void NVRAM_set_string (m48t59_t *nvram, uint32_t addr,
 578                        const unsigned char *str, uint32_t max)
 579 {
 580     int i;
 581
 582     for (i = 0; i < max && str[i] != '\0'; i++) {
 583         m48t59_write(nvram, addr + i, str[i]);
 584     }
 585     m48t59_write(nvram, addr + max - 1, '\0');
 586 }
 587
 588 int NVRAM_get_string (m48t59_t *nvram, uint8_t *dst, uint16_t addr, int max)
 589 {
 590     int i;
 591
 592     memset(dst, 0, max);
 593     for (i = 0; i < max; i++) {
 594         dst[i] = NVRAM_get_byte(nvram, addr + i);
 595         if (dst[i] == '\0')
 596             break;
 597     }
 598
 599     return i;
 600 }
 601
 602 static uint16_t NVRAM_crc_update (uint16_t prev, uint16_t value)
 603 {
 604     uint16_t tmp;
 605     uint16_t pd, pd1, pd2;
 606
 607     tmp = prev >> 8;
 608     pd = prev ^ value;
 609     pd1 = pd & 0x000F;
 610     pd2 = ((pd >> 4) & 0x000F) ^ pd1;
 611     tmp ^= (pd1 << 3) | (pd1 << 8);
 612     tmp ^= pd2 | (pd2 << 7) | (pd2 << 12);
 613
 614     return tmp;
 615 }
 616
 617 uint16_t NVRAM_compute_crc (m48t59_t *nvram, uint32_t start, uint32_t count)
 618 {
 619     uint32_t i;
 620     uint16_t crc = 0xFFFF;
 621     int odd;
 622
 623     odd = count & 1;
 624     count &= ~1;
 625     for (i = 0; i != count; i++) {
 626         crc = NVRAM_crc_update(crc, NVRAM_get_word(nvram, start + i));
 627     }
 628     if (odd) {
 629         crc = NVRAM_crc_update(crc, NVRAM_get_byte(nvram, start + i) << 8);
 630     }
 631
 632     return crc;
 633 }
 634
 635 #define CMDLINE_ADDR 0x017ff000
 636
 637 int PPC_NVRAM_set_params (m48t59_t *nvram, uint16_t NVRAM_size,
 638                           const unsigned char *arch,
 639                           uint32_t RAM_size, int boot_device,
 640                           uint32_t kernel_image, uint32_t kernel_size,
 641                           const char *cmdline,
 642                           uint32_t initrd_image, uint32_t initrd_size,
 643                           uint32_t NVRAM_image,
 644                           int width, int height, int depth)
 645 {
 646     uint16_t crc;
 647
 648     /* Set parameters for Open Hack'Ware BIOS */
 649     NVRAM_set_string(nvram, 0x00, "QEMU_BIOS", 16);
 650     NVRAM_set_lword(nvram,  0x10, 0x00000002); /* structure v2 */
 651     NVRAM_set_word(nvram,   0x14, NVRAM_size);
 652     NVRAM_set_string(nvram, 0x20, arch, 16);
 653     NVRAM_set_lword(nvram,  0x30, RAM_size);
 654     NVRAM_set_byte(nvram,   0x34, boot_device);
 655     NVRAM_set_lword(nvram,  0x38, kernel_image);
 656     NVRAM_set_lword(nvram,  0x3C, kernel_size);
 657     if (cmdline) {
 658         /* XXX: put the cmdline in NVRAM too ? */
 659         strcpy(phys_ram_base + CMDLINE_ADDR, cmdline);
 660         NVRAM_set_lword(nvram,  0x40, CMDLINE_ADDR);
 661         NVRAM_set_lword(nvram,  0x44, strlen(cmdline));
 662     } else {
 663         NVRAM_set_lword(nvram,  0x40, 0);
 664         NVRAM_set_lword(nvram,  0x44, 0);
 665     }
 666     NVRAM_set_lword(nvram,  0x48, initrd_image);
 667     NVRAM_set_lword(nvram,  0x4C, initrd_size);
 668     NVRAM_set_lword(nvram,  0x50, NVRAM_image);
 669
 670     NVRAM_set_word(nvram,   0x54, width);
 671     NVRAM_set_word(nvram,   0x56, height);
 672     NVRAM_set_word(nvram,   0x58, depth);
 673     crc = NVRAM_compute_crc(nvram, 0x00, 0xF8);
 674     NVRAM_set_word(nvram,  0xFC, crc);
 675
 676     return 0;
 677 }