1 /*

     2  * QEMU generic PowerPC hardware System Emulator

     3  *

     4  * Copyright (c) 2003-2007 Jocelyn Mayer

     5  *

     6  * Permission is hereby granted, free of charge, to any person obtaining a copy

     7  * of this software and associated documentation files (the "Software"), to deal

     8  * in the Software without restriction, including without limitation the rights

     9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

    10  * copies of the Software, and to permit persons to whom the Software is

    11  * furnished to do so, subject to the following conditions:

    12  *

    13  * The above copyright notice and this permission notice shall be included in

    14  * all copies or substantial portions of the Software.

    15  *

    16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

    17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

    18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL

    19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

    20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

    21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

    22  * THE SOFTWARE.

    23  */

    24 #include "hw.h"

    25 #include "ppc.h"

    26 #include "qemu-timer.h"

    27 #include "sysemu.h"

    28 #include "nvram.h"

    29 #include "qemu-log.h"

    30 

    31 //#define PPC_DEBUG_IRQ

    32 //#define PPC_DEBUG_TB

    33 

    34 static void cpu_ppc_tb_stop (CPUState *env);

    35 static void cpu_ppc_tb_start (CPUState *env);

    36 

    37 static void ppc_set_irq (CPUState *env, int n_IRQ, int level)

    38 {

    39     if (level) {

    40         env->pending_interrupts |= 1 << n_IRQ;

    41         cpu_interrupt(env, CPU_INTERRUPT_HARD);

    42     } else {

    43         env->pending_interrupts &= ~(1 << n_IRQ);

    44         if (env->pending_interrupts == 0)

    45             cpu_reset_interrupt(env, CPU_INTERRUPT_HARD);

    46     }

    47 #if defined(PPC_DEBUG_IRQ)

    48     if (loglevel & CPU_LOG_INT) {

    49         fprintf(logfile, "%s: %p n_IRQ %d level %d => pending %08" PRIx32

    50                 "req %08x\n", __func__, env, n_IRQ, level,

    51                 env->pending_interrupts, env->interrupt_request);

    52     }

    53 #endif

    54 }

    55 

    56 /* PowerPC 6xx / 7xx internal IRQ controller */

    57 static void ppc6xx_set_irq (void *opaque, int pin, int level)

    58 {

    59     CPUState *env = opaque;

    60     int cur_level;

    61 

    62 #if defined(PPC_DEBUG_IRQ)

    63     if (loglevel & CPU_LOG_INT) {

    64         fprintf(logfile, "%s: env %p pin %d level %d\n", __func__,

    65                 env, pin, level);

    66     }

    67 #endif

    68     cur_level = (env->irq_input_state >> pin) & 1;

    69     /* Don't generate spurious events */

    70     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {

    71         switch (pin) {

    72         case PPC6xx_INPUT_TBEN:

    73             /* Level sensitive - active high */

    74 #if defined(PPC_DEBUG_IRQ)

    75             if (loglevel & CPU_LOG_INT) {

    76                 fprintf(logfile, "%s: %s the time base\n",

    77                         __func__, level ? "start" : "stop");

    78             }

    79 #endif

    80             if (level) {

    81                 cpu_ppc_tb_start(env);

    82             } else {

    83                 cpu_ppc_tb_stop(env);

    84             }

    85         case PPC6xx_INPUT_INT:

    86             /* Level sensitive - active high */

    87 #if defined(PPC_DEBUG_IRQ)

    88             if (loglevel & CPU_LOG_INT) {

    89                 fprintf(logfile, "%s: set the external IRQ state to %d\n",

    90                         __func__, level);

    91             }

    92 #endif

    93             ppc_set_irq(env, PPC_INTERRUPT_EXT, level);

    94             break;

    95         case PPC6xx_INPUT_SMI:

    96             /* Level sensitive - active high */

    97 #if defined(PPC_DEBUG_IRQ)

    98             if (loglevel & CPU_LOG_INT) {

    99                 fprintf(logfile, "%s: set the SMI IRQ state to %d\n",

   100                         __func__, level);

   101             }

   102 #endif

   103             ppc_set_irq(env, PPC_INTERRUPT_SMI, level);

   104             break;

   105         case PPC6xx_INPUT_MCP:

   106             /* Negative edge sensitive */

   107             /* XXX: TODO: actual reaction may depends on HID0 status

   108              *            603/604/740/750: check HID0[EMCP]

   109              */

   110             if (cur_level == 1 && level == 0) {

   111 #if defined(PPC_DEBUG_IRQ)

   112                 if (loglevel & CPU_LOG_INT) {

   113                     fprintf(logfile, "%s: raise machine check state\n",

   114                             __func__);

   115                 }

   116 #endif

   117                 ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);

   118             }

   119             break;

   120         case PPC6xx_INPUT_CKSTP_IN:

   121             /* Level sensitive - active low */

   122             /* XXX: TODO: relay the signal to CKSTP_OUT pin */

   123             /* XXX: Note that the only way to restart the CPU is to reset it */

   124             if (level) {

   125 #if defined(PPC_DEBUG_IRQ)

   126                 if (loglevel & CPU_LOG_INT) {

   127                     fprintf(logfile, "%s: stop the CPU\n", __func__);

   128                 }

   129 #endif

   130                 env->halted = 1;

   131             }

   132             break;

   133         case PPC6xx_INPUT_HRESET:

   134             /* Level sensitive - active low */

   135             if (level) {

   136 #if defined(PPC_DEBUG_IRQ)

   137                 if (loglevel & CPU_LOG_INT) {

   138                     fprintf(logfile, "%s: reset the CPU\n", __func__);

   139                 }

   140 #endif

   141                 env->interrupt_request |= CPU_INTERRUPT_EXITTB;

   142                 /* XXX: TOFIX */

   143 #if 0

   144                 cpu_ppc_reset(env);

   145 #else

   146                 qemu_system_reset_request();

   147 #endif

   148             }

   149             break;

   150         case PPC6xx_INPUT_SRESET:

   151 #if defined(PPC_DEBUG_IRQ)

   152             if (loglevel & CPU_LOG_INT) {

   153                 fprintf(logfile, "%s: set the RESET IRQ state to %d\n",

   154                         __func__, level);

   155             }

   156 #endif

   157             ppc_set_irq(env, PPC_INTERRUPT_RESET, level);

   158             break;

   159         default:

   160             /* Unknown pin - do nothing */

   161 #if defined(PPC_DEBUG_IRQ)

   162             if (loglevel & CPU_LOG_INT) {

   163                 fprintf(logfile, "%s: unknown IRQ pin %d\n", __func__, pin);

   164             }

   165 #endif

   166             return;

   167         }

   168         if (level)

   169             env->irq_input_state |= 1 << pin;

   170         else

   171             env->irq_input_state &= ~(1 << pin);

   172     }

   173 }

   174 

   175 void ppc6xx_irq_init (CPUState *env)

   176 {

   177     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc6xx_set_irq, env,

   178                                                   PPC6xx_INPUT_NB);

   179 }

   180 

   181 #if defined(TARGET_PPC64)

   182 /* PowerPC 970 internal IRQ controller */

   183 static void ppc970_set_irq (void *opaque, int pin, int level)

   184 {

   185     CPUState *env = opaque;

   186     int cur_level;

   187 

   188 #if defined(PPC_DEBUG_IRQ)

   189     if (loglevel & CPU_LOG_INT) {

   190         fprintf(logfile, "%s: env %p pin %d level %d\n", __func__,

   191                 env, pin, level);

   192     }

   193 #endif

   194     cur_level = (env->irq_input_state >> pin) & 1;

   195     /* Don't generate spurious events */

   196     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {

   197         switch (pin) {

   198         case PPC970_INPUT_INT:

   199             /* Level sensitive - active high */

   200 #if defined(PPC_DEBUG_IRQ)

   201             if (loglevel & CPU_LOG_INT) {

   202                 fprintf(logfile, "%s: set the external IRQ state to %d\n",

   203                         __func__, level);

   204             }

   205 #endif

   206             ppc_set_irq(env, PPC_INTERRUPT_EXT, level);

   207             break;

   208         case PPC970_INPUT_THINT:

   209             /* Level sensitive - active high */

   210 #if defined(PPC_DEBUG_IRQ)

   211             if (loglevel & CPU_LOG_INT) {

   212                 fprintf(logfile, "%s: set the SMI IRQ state to %d\n", __func__,

   213                         level);

   214             }

   215 #endif

   216             ppc_set_irq(env, PPC_INTERRUPT_THERM, level);

   217             break;

   218         case PPC970_INPUT_MCP:

   219             /* Negative edge sensitive */

   220             /* XXX: TODO: actual reaction may depends on HID0 status

   221              *            603/604/740/750: check HID0[EMCP]

   222              */

   223             if (cur_level == 1 && level == 0) {

   224 #if defined(PPC_DEBUG_IRQ)

   225                 if (loglevel & CPU_LOG_INT) {

   226                     fprintf(logfile, "%s: raise machine check state\n",

   227                             __func__);

   228                 }

   229 #endif

   230                 ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);

   231             }

   232             break;

   233         case PPC970_INPUT_CKSTP:

   234             /* Level sensitive - active low */

   235             /* XXX: TODO: relay the signal to CKSTP_OUT pin */

   236             if (level) {

   237 #if defined(PPC_DEBUG_IRQ)

   238                 if (loglevel & CPU_LOG_INT) {

   239                     fprintf(logfile, "%s: stop the CPU\n", __func__);

   240                 }

   241 #endif

   242                 env->halted = 1;

   243             } else {

   244 #if defined(PPC_DEBUG_IRQ)

   245                 if (loglevel & CPU_LOG_INT) {

   246                     fprintf(logfile, "%s: restart the CPU\n", __func__);

   247                 }

   248 #endif

   249                 env->halted = 0;

   250             }

   251             break;

   252         case PPC970_INPUT_HRESET:

   253             /* Level sensitive - active low */

   254             if (level) {

   255 #if 0 // XXX: TOFIX

   256 #if defined(PPC_DEBUG_IRQ)

   257                 if (loglevel & CPU_LOG_INT) {

   258                     fprintf(logfile, "%s: reset the CPU\n", __func__);

   259                 }

   260 #endif

   261                 cpu_reset(env);

   262 #endif

   263             }

   264             break;

   265         case PPC970_INPUT_SRESET:

   266 #if defined(PPC_DEBUG_IRQ)

   267             if (loglevel & CPU_LOG_INT) {

   268                 fprintf(logfile, "%s: set the RESET IRQ state to %d\n",

   269                         __func__, level);

   270             }

   271 #endif

   272             ppc_set_irq(env, PPC_INTERRUPT_RESET, level);

   273             break;

   274         case PPC970_INPUT_TBEN:

   275 #if defined(PPC_DEBUG_IRQ)

   276             if (loglevel & CPU_LOG_INT) {

   277                 fprintf(logfile, "%s: set the TBEN state to %d\n", __func__,

   278                         level);

   279             }

   280 #endif

   281             /* XXX: TODO */

   282             break;

   283         default:

   284             /* Unknown pin - do nothing */

   285 #if defined(PPC_DEBUG_IRQ)

   286             if (loglevel & CPU_LOG_INT) {

   287                 fprintf(logfile, "%s: unknown IRQ pin %d\n", __func__, pin);

   288             }

   289 #endif

   290             return;

   291         }

   292         if (level)

   293             env->irq_input_state |= 1 << pin;

   294         else

   295             env->irq_input_state &= ~(1 << pin);

   296     }

   297 }

   298 

   299 void ppc970_irq_init (CPUState *env)

   300 {

   301     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc970_set_irq, env,

   302                                                   PPC970_INPUT_NB);

   303 }

   304 #endif /* defined(TARGET_PPC64) */

   305 

   306 /* PowerPC 40x internal IRQ controller */

   307 static void ppc40x_set_irq (void *opaque, int pin, int level)

   308 {

   309     CPUState *env = opaque;

   310     int cur_level;

   311 

   312 #if defined(PPC_DEBUG_IRQ)

   313     if (loglevel & CPU_LOG_INT) {

   314         fprintf(logfile, "%s: env %p pin %d level %d\n", __func__,

   315                 env, pin, level);

   316     }

   317 #endif

   318     cur_level = (env->irq_input_state >> pin) & 1;

   319     /* Don't generate spurious events */

   320     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {

   321         switch (pin) {

   322         case PPC40x_INPUT_RESET_SYS:

   323             if (level) {

   324 #if defined(PPC_DEBUG_IRQ)

   325                 if (loglevel & CPU_LOG_INT) {

   326                     fprintf(logfile, "%s: reset the PowerPC system\n",

   327                             __func__);

   328                 }

   329 #endif

   330                 ppc40x_system_reset(env);

   331             }

   332             break;

   333         case PPC40x_INPUT_RESET_CHIP:

   334             if (level) {

   335 #if defined(PPC_DEBUG_IRQ)

   336                 if (loglevel & CPU_LOG_INT) {

   337                     fprintf(logfile, "%s: reset the PowerPC chip\n", __func__);

   338                 }

   339 #endif

   340                 ppc40x_chip_reset(env);

   341             }

   342             break;

   343         case PPC40x_INPUT_RESET_CORE:

   344             /* XXX: TODO: update DBSR[MRR] */

   345             if (level) {

   346 #if defined(PPC_DEBUG_IRQ)

   347                 if (loglevel & CPU_LOG_INT) {

   348                     fprintf(logfile, "%s: reset the PowerPC core\n", __func__);

   349                 }

   350 #endif

   351                 ppc40x_core_reset(env);

   352             }

   353             break;

   354         case PPC40x_INPUT_CINT:

   355             /* Level sensitive - active high */

   356 #if defined(PPC_DEBUG_IRQ)

   357             if (loglevel & CPU_LOG_INT) {

   358                 fprintf(logfile, "%s: set the critical IRQ state to %d\n",

   359                         __func__, level);

   360             }

   361 #endif

   362             ppc_set_irq(env, PPC_INTERRUPT_CEXT, level);

   363             break;

   364         case PPC40x_INPUT_INT:

   365             /* Level sensitive - active high */

   366 #if defined(PPC_DEBUG_IRQ)

   367             if (loglevel & CPU_LOG_INT) {

   368                 fprintf(logfile, "%s: set the external IRQ state to %d\n",

   369                         __func__, level);

   370             }

   371 #endif

   372             ppc_set_irq(env, PPC_INTERRUPT_EXT, level);

   373             break;

   374         case PPC40x_INPUT_HALT:

   375             /* Level sensitive - active low */

   376             if (level) {

   377 #if defined(PPC_DEBUG_IRQ)

   378                 if (loglevel & CPU_LOG_INT) {

   379                     fprintf(logfile, "%s: stop the CPU\n", __func__);

   380                 }

   381 #endif

   382                 env->halted = 1;

   383             } else {

   384 #if defined(PPC_DEBUG_IRQ)

   385                 if (loglevel & CPU_LOG_INT) {

   386                     fprintf(logfile, "%s: restart the CPU\n", __func__);

   387                 }

   388 #endif

   389                 env->halted = 0;

   390             }

   391             break;

   392         case PPC40x_INPUT_DEBUG:

   393             /* Level sensitive - active high */

   394 #if defined(PPC_DEBUG_IRQ)

   395             if (loglevel & CPU_LOG_INT) {

   396                 fprintf(logfile, "%s: set the debug pin state to %d\n",

   397                         __func__, level);

   398             }

   399 #endif

   400             ppc_set_irq(env, PPC_INTERRUPT_DEBUG, level);

   401             break;

   402         default:

   403             /* Unknown pin - do nothing */

   404 #if defined(PPC_DEBUG_IRQ)

   405             if (loglevel & CPU_LOG_INT) {

   406                 fprintf(logfile, "%s: unknown IRQ pin %d\n", __func__, pin);

   407             }

   408 #endif

   409             return;

   410         }

   411         if (level)

   412             env->irq_input_state |= 1 << pin;

   413         else

   414             env->irq_input_state &= ~(1 << pin);

   415     }

   416 }

   417 

   418 void ppc40x_irq_init (CPUState *env)

   419 {

   420     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc40x_set_irq,

   421                                                   env, PPC40x_INPUT_NB);

   422 }

   423 

   424 /*****************************************************************************/

   425 /* PowerPC time base and decrementer emulation */

   426 struct ppc_tb_t {

   427     /* Time base management */

   428     int64_t  tb_offset;    /* Compensation                    */

   429     int64_t  atb_offset;   /* Compensation                    */

   430     uint32_t tb_freq;      /* TB frequency                    */

   431     /* Decrementer management */

   432     uint64_t decr_next;    /* Tick for next decr interrupt    */

   433     uint32_t decr_freq;    /* decrementer frequency           */

   434     struct QEMUTimer *decr_timer;

   435     /* Hypervisor decrementer management */

   436     uint64_t hdecr_next;    /* Tick for next hdecr interrupt  */

   437     struct QEMUTimer *hdecr_timer;

   438     uint64_t purr_load;

   439     uint64_t purr_start;

   440     void *opaque;

   441 };

   442 

   443 static always_inline uint64_t cpu_ppc_get_tb (ppc_tb_t *tb_env, uint64_t vmclk,

   444                                               int64_t tb_offset)

   445 {

   446     /* TB time in tb periods */

   447     return muldiv64(vmclk, tb_env->tb_freq, ticks_per_sec) + tb_offset;

   448 }

   449 

   450 uint32_t cpu_ppc_load_tbl (CPUState *env)

   451 {

   452     ppc_tb_t *tb_env = env->tb_env;

   453     uint64_t tb;

   454 

   455     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);

   456 #if defined(PPC_DEBUG_TB)

   457     if (loglevel != 0) {

   458         fprintf(logfile, "%s: tb %016" PRIx64 "\n", __func__, tb);

   459     }

   460 #endif

   461 

   462     return tb & 0xFFFFFFFF;

   463 }

   464 

   465 static always_inline uint32_t _cpu_ppc_load_tbu (CPUState *env)

   466 {

   467     ppc_tb_t *tb_env = env->tb_env;

   468     uint64_t tb;

   469 

   470     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);

   471 #if defined(PPC_DEBUG_TB)

   472     if (loglevel != 0) {

   473         fprintf(logfile, "%s: tb %016" PRIx64 "\n", __func__, tb);

   474     }

   475 #endif

   476 

   477     return tb >> 32;

   478 }

   479 

   480 uint32_t cpu_ppc_load_tbu (CPUState *env)

   481 {

   482     return _cpu_ppc_load_tbu(env);

   483 }

   484 

   485 static always_inline void cpu_ppc_store_tb (ppc_tb_t *tb_env, uint64_t vmclk,

   486                                             int64_t *tb_offsetp,

   487                                             uint64_t value)

   488 {

   489     *tb_offsetp = value - muldiv64(vmclk, tb_env->tb_freq, ticks_per_sec);

   490 #ifdef PPC_DEBUG_TB

   491     if (loglevel != 0) {

   492         fprintf(logfile, "%s: tb %016" PRIx64 " offset %08" PRIx64 "\n",

   493                 __func__, value, *tb_offsetp);

   494     }

   495 #endif

   496 }

   497 

   498 void cpu_ppc_store_tbl (CPUState *env, uint32_t value)

   499 {

   500     ppc_tb_t *tb_env = env->tb_env;

   501     uint64_t tb;

   502 

   503     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);

   504     tb &= 0xFFFFFFFF00000000ULL;

   505     cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),

   506                      &tb_env->tb_offset, tb | (uint64_t)value);

   507 }

   508 

   509 static always_inline void _cpu_ppc_store_tbu (CPUState *env, uint32_t value)

   510 {

   511     ppc_tb_t *tb_env = env->tb_env;

   512     uint64_t tb;

   513 

   514     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);

   515     tb &= 0x00000000FFFFFFFFULL;

   516     cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),

   517                      &tb_env->tb_offset, ((uint64_t)value << 32) | tb);

   518 }

   519 

   520 void cpu_ppc_store_tbu (CPUState *env, uint32_t value)

   521 {

   522     _cpu_ppc_store_tbu(env, value);

   523 }

   524 

   525 uint32_t cpu_ppc_load_atbl (CPUState *env)

   526 {

   527     ppc_tb_t *tb_env = env->tb_env;

   528     uint64_t tb;

   529 

   530     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);

   531 #if defined(PPC_DEBUG_TB)

   532     if (loglevel != 0) {

   533         fprintf(logfile, "%s: tb %016" PRIx64 "\n", __func__, tb);

   534     }

   535 #endif

   536 

   537     return tb & 0xFFFFFFFF;

   538 }

   539 

   540 uint32_t cpu_ppc_load_atbu (CPUState *env)

   541 {

   542     ppc_tb_t *tb_env = env->tb_env;

   543     uint64_t tb;

   544 

   545     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);

   546 #if defined(PPC_DEBUG_TB)

   547     if (loglevel != 0) {

   548         fprintf(logfile, "%s: tb %016" PRIx64 "\n", __func__, tb);

   549     }

   550 #endif

   551 

   552     return tb >> 32;

   553 }

   554 

   555 void cpu_ppc_store_atbl (CPUState *env, uint32_t value)

   556 {

   557     ppc_tb_t *tb_env = env->tb_env;

   558     uint64_t tb;

   559 

   560     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);

   561     tb &= 0xFFFFFFFF00000000ULL;

   562     cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),

   563                      &tb_env->atb_offset, tb | (uint64_t)value);

   564 }

   565 

   566 void cpu_ppc_store_atbu (CPUState *env, uint32_t value)

   567 {

   568     ppc_tb_t *tb_env = env->tb_env;

   569     uint64_t tb;

   570 

   571     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);

   572     tb &= 0x00000000FFFFFFFFULL;

   573     cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),

   574                      &tb_env->atb_offset, ((uint64_t)value << 32) | tb);

   575 }

   576 

   577 static void cpu_ppc_tb_stop (CPUState *env)

   578 {

   579     ppc_tb_t *tb_env = env->tb_env;

   580     uint64_t tb, atb, vmclk;

   581 

   582     /* If the time base is already frozen, do nothing */

   583     if (tb_env->tb_freq != 0) {

   584         vmclk = qemu_get_clock(vm_clock);

   585         /* Get the time base */

   586         tb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->tb_offset);

   587         /* Get the alternate time base */

   588         atb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->atb_offset);

   589         /* Store the time base value (ie compute the current offset) */

   590         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);

   591         /* Store the alternate time base value (compute the current offset) */

   592         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);

   593         /* Set the time base frequency to zero */

   594         tb_env->tb_freq = 0;

   595         /* Now, the time bases are frozen to tb_offset / atb_offset value */

   596     }

   597 }

   598 

   599 static void cpu_ppc_tb_start (CPUState *env)

   600 {

   601     ppc_tb_t *tb_env = env->tb_env;

   602     uint64_t tb, atb, vmclk;

   603 

   604     /* If the time base is not frozen, do nothing */

   605     if (tb_env->tb_freq == 0) {

   606         vmclk = qemu_get_clock(vm_clock);

   607         /* Get the time base from tb_offset */

   608         tb = tb_env->tb_offset;

   609         /* Get the alternate time base from atb_offset */

   610         atb = tb_env->atb_offset;

   611         /* Restore the tb frequency from the decrementer frequency */

   612         tb_env->tb_freq = tb_env->decr_freq;

   613         /* Store the time base value */

   614         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);

   615         /* Store the alternate time base value */

   616         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);

   617     }

   618 }

   619 

   620 static always_inline uint32_t _cpu_ppc_load_decr (CPUState *env,

   621                                                   uint64_t *next)

   622 {

   623     ppc_tb_t *tb_env = env->tb_env;

   624     uint32_t decr;

   625     int64_t diff;

   626 

   627     diff = tb_env->decr_next - qemu_get_clock(vm_clock);

   628     if (diff >= 0)

   629         decr = muldiv64(diff, tb_env->decr_freq, ticks_per_sec);

   630     else

   631         decr = -muldiv64(-diff, tb_env->decr_freq, ticks_per_sec);

   632 #if defined(PPC_DEBUG_TB)

   633     if (loglevel != 0) {

   634         fprintf(logfile, "%s: %08" PRIx32 "\n", __func__, decr);

   635     }

   636 #endif

   637 

   638     return decr;

   639 }

   640 

   641 uint32_t cpu_ppc_load_decr (CPUState *env)

   642 {

   643     ppc_tb_t *tb_env = env->tb_env;

   644 

   645     return _cpu_ppc_load_decr(env, &tb_env->decr_next);

   646 }

   647 

   648 uint32_t cpu_ppc_load_hdecr (CPUState *env)

   649 {

   650     ppc_tb_t *tb_env = env->tb_env;

   651 

   652     return _cpu_ppc_load_decr(env, &tb_env->hdecr_next);

   653 }

   654 

   655 uint64_t cpu_ppc_load_purr (CPUState *env)

   656 {

   657     ppc_tb_t *tb_env = env->tb_env;

   658     uint64_t diff;

   659 

   660     diff = qemu_get_clock(vm_clock) - tb_env->purr_start;

   661 

   662     return tb_env->purr_load + muldiv64(diff, tb_env->tb_freq, ticks_per_sec);

   663 }

   664 

   665 /* When decrementer expires,

   666  * all we need to do is generate or queue a CPU exception

   667  */

   668 static always_inline void cpu_ppc_decr_excp (CPUState *env)

   669 {

   670     /* Raise it */

   671 #ifdef PPC_DEBUG_TB

   672     if (loglevel != 0) {

   673         fprintf(logfile, "raise decrementer exception\n");

   674     }

   675 #endif

   676     ppc_set_irq(env, PPC_INTERRUPT_DECR, 1);

   677 }

   678 

   679 static always_inline void cpu_ppc_hdecr_excp (CPUState *env)

   680 {

   681     /* Raise it */

   682 #ifdef PPC_DEBUG_TB

   683     if (loglevel != 0) {

   684         fprintf(logfile, "raise decrementer exception\n");

   685     }

   686 #endif

   687     ppc_set_irq(env, PPC_INTERRUPT_HDECR, 1);

   688 }

   689 

   690 static void __cpu_ppc_store_decr (CPUState *env, uint64_t *nextp,

   691                                   struct QEMUTimer *timer,

   692                                   void (*raise_excp)(CPUState *),

   693                                   uint32_t decr, uint32_t value,

   694                                   int is_excp)

   695 {

   696     ppc_tb_t *tb_env = env->tb_env;

   697     uint64_t now, next;

   698 

   699 #ifdef PPC_DEBUG_TB

   700     if (loglevel != 0) {

   701         fprintf(logfile, "%s: %08" PRIx32 " => %08" PRIx32 "\n", __func__,

   702                 decr, value);

   703     }

   704 #endif

   705     now = qemu_get_clock(vm_clock);

   706     next = now + muldiv64(value, ticks_per_sec, tb_env->decr_freq);

   707     if (is_excp)

   708         next += *nextp - now;

   709     if (next == now)

   710         next++;

   711     *nextp = next;

   712     /* Adjust timer */

   713     qemu_mod_timer(timer, next);

   714     /* If we set a negative value and the decrementer was positive,

   715      * raise an exception.

   716      */

   717     if ((value & 0x80000000) && !(decr & 0x80000000))

   718         (*raise_excp)(env);

   719 }

   720 

   721 static always_inline void _cpu_ppc_store_decr (CPUState *env, uint32_t decr,

   722                                                uint32_t value, int is_excp)

   723 {

   724     ppc_tb_t *tb_env = env->tb_env;

   725 

   726     __cpu_ppc_store_decr(env, &tb_env->decr_next, tb_env->decr_timer,

   727                          &cpu_ppc_decr_excp, decr, value, is_excp);

   728 }

   729 

   730 void cpu_ppc_store_decr (CPUState *env, uint32_t value)

   731 {

   732     _cpu_ppc_store_decr(env, cpu_ppc_load_decr(env), value, 0);

   733 }

   734 

   735 static void cpu_ppc_decr_cb (void *opaque)

   736 {

   737     _cpu_ppc_store_decr(opaque, 0x00000000, 0xFFFFFFFF, 1);

   738 }

   739 

   740 static always_inline void _cpu_ppc_store_hdecr (CPUState *env, uint32_t hdecr,

   741                                                 uint32_t value, int is_excp)

   742 {

   743     ppc_tb_t *tb_env = env->tb_env;

   744 

   745     if (tb_env->hdecr_timer != NULL) {

   746         __cpu_ppc_store_decr(env, &tb_env->hdecr_next, tb_env->hdecr_timer,

   747                              &cpu_ppc_hdecr_excp, hdecr, value, is_excp);

   748     }

   749 }

   750 

   751 void cpu_ppc_store_hdecr (CPUState *env, uint32_t value)

   752 {

   753     _cpu_ppc_store_hdecr(env, cpu_ppc_load_hdecr(env), value, 0);

   754 }

   755 

   756 static void cpu_ppc_hdecr_cb (void *opaque)

   757 {

   758     _cpu_ppc_store_hdecr(opaque, 0x00000000, 0xFFFFFFFF, 1);

   759 }

   760 

   761 void cpu_ppc_store_purr (CPUState *env, uint64_t value)

   762 {

   763     ppc_tb_t *tb_env = env->tb_env;

   764 

   765     tb_env->purr_load = value;

   766     tb_env->purr_start = qemu_get_clock(vm_clock);

   767 }

   768 

   769 static void cpu_ppc_set_tb_clk (void *opaque, uint32_t freq)

   770 {

   771     CPUState *env = opaque;

   772     ppc_tb_t *tb_env = env->tb_env;

   773 

   774     tb_env->tb_freq = freq;

   775     tb_env->decr_freq = freq;

   776     /* There is a bug in Linux 2.4 kernels:

   777      * if a decrementer exception is pending when it enables msr_ee at startup,

   778      * it's not ready to handle it...

   779      */

   780     _cpu_ppc_store_decr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);

   781     _cpu_ppc_store_hdecr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);

   782     cpu_ppc_store_purr(env, 0x0000000000000000ULL);

   783 }

   784 

   785 /* Set up (once) timebase frequency (in Hz) */

   786 clk_setup_cb cpu_ppc_tb_init (CPUState *env, uint32_t freq)

   787 {

   788     ppc_tb_t *tb_env;

   789 

   790     tb_env = qemu_mallocz(sizeof(ppc_tb_t));

   791     if (tb_env == NULL)

   792         return NULL;

   793     env->tb_env = tb_env;

   794     /* Create new timer */

   795     tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_ppc_decr_cb, env);

   796     if (0) {

   797         /* XXX: find a suitable condition to enable the hypervisor decrementer

   798          */

   799         tb_env->hdecr_timer = qemu_new_timer(vm_clock, &cpu_ppc_hdecr_cb, env);

   800     } else {

   801         tb_env->hdecr_timer = NULL;

   802     }

   803     cpu_ppc_set_tb_clk(env, freq);

   804 

   805     return &cpu_ppc_set_tb_clk;

   806 }

   807 

   808 /* Specific helpers for POWER & PowerPC 601 RTC */

   809 #if 0

   810 static clk_setup_cb cpu_ppc601_rtc_init (CPUState *env)

   811 {

   812     return cpu_ppc_tb_init(env, 7812500);

   813 }

   814 #endif

   815 

   816 void cpu_ppc601_store_rtcu (CPUState *env, uint32_t value)

   817 {

   818     _cpu_ppc_store_tbu(env, value);

   819 }

   820 

   821 uint32_t cpu_ppc601_load_rtcu (CPUState *env)

   822 {

   823     return _cpu_ppc_load_tbu(env);

   824 }

   825 

   826 void cpu_ppc601_store_rtcl (CPUState *env, uint32_t value)

   827 {

   828     cpu_ppc_store_tbl(env, value & 0x3FFFFF80);

   829 }

   830 

   831 uint32_t cpu_ppc601_load_rtcl (CPUState *env)

   832 {

   833     return cpu_ppc_load_tbl(env) & 0x3FFFFF80;

   834 }

   835 

   836 /*****************************************************************************/

   837 /* Embedded PowerPC timers */

   838 

   839 /* PIT, FIT & WDT */

   840 typedef struct ppcemb_timer_t ppcemb_timer_t;

   841 struct ppcemb_timer_t {

   842     uint64_t pit_reload;  /* PIT auto-reload value        */

   843     uint64_t fit_next;    /* Tick for next FIT interrupt  */

   844     struct QEMUTimer *fit_timer;

   845     uint64_t wdt_next;    /* Tick for next WDT interrupt  */

   846     struct QEMUTimer *wdt_timer;

   847 };

   848 

   849 /* Fixed interval timer */

   850 static void cpu_4xx_fit_cb (void *opaque)

   851 {

   852     CPUState *env;

   853     ppc_tb_t *tb_env;

   854     ppcemb_timer_t *ppcemb_timer;

   855     uint64_t now, next;

   856 

   857     env = opaque;

   858     tb_env = env->tb_env;

   859     ppcemb_timer = tb_env->opaque;

   860     now = qemu_get_clock(vm_clock);

   861     switch ((env->spr[SPR_40x_TCR] >> 24) & 0x3) {

   862     case 0:

   863         next = 1 << 9;

   864         break;

   865     case 1:

   866         next = 1 << 13;

   867         break;

   868     case 2:

   869         next = 1 << 17;

   870         break;

   871     case 3:

   872         next = 1 << 21;

   873         break;

   874     default:

   875         /* Cannot occur, but makes gcc happy */

   876         return;

   877     }

   878     next = now + muldiv64(next, ticks_per_sec, tb_env->tb_freq);

   879     if (next == now)

   880         next++;

   881     qemu_mod_timer(ppcemb_timer->fit_timer, next);

   882     env->spr[SPR_40x_TSR] |= 1 << 26;

   883     if ((env->spr[SPR_40x_TCR] >> 23) & 0x1)

   884         ppc_set_irq(env, PPC_INTERRUPT_FIT, 1);

   885 #ifdef PPC_DEBUG_TB

   886     if (loglevel != 0) {

   887         fprintf(logfile, "%s: ir %d TCR " ADDRX " TSR " ADDRX "\n", __func__,

   888                 (int)((env->spr[SPR_40x_TCR] >> 23) & 0x1),

   889                 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);

   890     }

   891 #endif

   892 }

   893 

   894 /* Programmable interval timer */

   895 static void start_stop_pit (CPUState *env, ppc_tb_t *tb_env, int is_excp)

   896 {

   897     ppcemb_timer_t *ppcemb_timer;

   898     uint64_t now, next;

   899 

   900     ppcemb_timer = tb_env->opaque;

   901     if (ppcemb_timer->pit_reload <= 1 ||

   902         !((env->spr[SPR_40x_TCR] >> 26) & 0x1) ||

   903         (is_excp && !((env->spr[SPR_40x_TCR] >> 22) & 0x1))) {

   904         /* Stop PIT */

   905 #ifdef PPC_DEBUG_TB

   906         if (loglevel != 0) {

   907             fprintf(logfile, "%s: stop PIT\n", __func__);

   908         }

   909 #endif

   910         qemu_del_timer(tb_env->decr_timer);

   911     } else {

   912 #ifdef PPC_DEBUG_TB

   913         if (loglevel != 0) {

   914             fprintf(logfile, "%s: start PIT %016" PRIx64 "\n",

   915                     __func__, ppcemb_timer->pit_reload);

   916         }

   917 #endif

   918         now = qemu_get_clock(vm_clock);

   919         next = now + muldiv64(ppcemb_timer->pit_reload,

   920                               ticks_per_sec, tb_env->decr_freq);

   921         if (is_excp)

   922             next += tb_env->decr_next - now;

   923         if (next == now)

   924             next++;

   925         qemu_mod_timer(tb_env->decr_timer, next);

   926         tb_env->decr_next = next;

   927     }

   928 }

   929 

   930 static void cpu_4xx_pit_cb (void *opaque)

   931 {

   932     CPUState *env;

   933     ppc_tb_t *tb_env;

   934     ppcemb_timer_t *ppcemb_timer;

   935 

   936     env = opaque;

   937     tb_env = env->tb_env;

   938     ppcemb_timer = tb_env->opaque;

   939     env->spr[SPR_40x_TSR] |= 1 << 27;

   940     if ((env->spr[SPR_40x_TCR] >> 26) & 0x1)

   941         ppc_set_irq(env, PPC_INTERRUPT_PIT, 1);

   942     start_stop_pit(env, tb_env, 1);

   943 #ifdef PPC_DEBUG_TB

   944     if (loglevel != 0) {

   945         fprintf(logfile, "%s: ar %d ir %d TCR " ADDRX " TSR " ADDRX " "

   946                 "%016" PRIx64 "\n", __func__,

   947                 (int)((env->spr[SPR_40x_TCR] >> 22) & 0x1),

   948                 (int)((env->spr[SPR_40x_TCR] >> 26) & 0x1),

   949                 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR],

   950                 ppcemb_timer->pit_reload);

   951     }

   952 #endif

   953 }

   954 

   955 /* Watchdog timer */

   956 static void cpu_4xx_wdt_cb (void *opaque)

   957 {

   958     CPUState *env;

   959     ppc_tb_t *tb_env;

   960     ppcemb_timer_t *ppcemb_timer;

   961     uint64_t now, next;

   962 

   963     env = opaque;

   964     tb_env = env->tb_env;

   965     ppcemb_timer = tb_env->opaque;

   966     now = qemu_get_clock(vm_clock);

   967     switch ((env->spr[SPR_40x_TCR] >> 30) & 0x3) {

   968     case 0:

   969         next = 1 << 17;

   970         break;

   971     case 1:

   972         next = 1 << 21;

   973         break;

   974     case 2:

   975         next = 1 << 25;

   976         break;

   977     case 3:

   978         next = 1 << 29;

   979         break;

   980     default:

   981         /* Cannot occur, but makes gcc happy */

   982         return;

   983     }

   984     next = now + muldiv64(next, ticks_per_sec, tb_env->decr_freq);

   985     if (next == now)

   986         next++;

   987 #ifdef PPC_DEBUG_TB

   988     if (loglevel != 0) {

   989         fprintf(logfile, "%s: TCR " ADDRX " TSR " ADDRX "\n", __func__,

   990                 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);

   991     }

   992 #endif

   993     switch ((env->spr[SPR_40x_TSR] >> 30) & 0x3) {

   994     case 0x0:

   995     case 0x1:

   996         qemu_mod_timer(ppcemb_timer->wdt_timer, next);

   997         ppcemb_timer->wdt_next = next;

   998         env->spr[SPR_40x_TSR] |= 1 << 31;

   999         break;

  1000     case 0x2:

  1001         qemu_mod_timer(ppcemb_timer->wdt_timer, next);

  1002         ppcemb_timer->wdt_next = next;

  1003         env->spr[SPR_40x_TSR] |= 1 << 30;

  1004         if ((env->spr[SPR_40x_TCR] >> 27) & 0x1)

  1005             ppc_set_irq(env, PPC_INTERRUPT_WDT, 1);

  1006         break;

  1007     case 0x3:

  1008         env->spr[SPR_40x_TSR] &= ~0x30000000;

  1009         env->spr[SPR_40x_TSR] |= env->spr[SPR_40x_TCR] & 0x30000000;

  1010         switch ((env->spr[SPR_40x_TCR] >> 28) & 0x3) {

  1011         case 0x0:

  1012             /* No reset */

  1013             break;

  1014         case 0x1: /* Core reset */

  1015             ppc40x_core_reset(env);

  1016             break;

  1017         case 0x2: /* Chip reset */

  1018             ppc40x_chip_reset(env);

  1019             break;

  1020         case 0x3: /* System reset */

  1021             ppc40x_system_reset(env);

  1022             break;

  1023         }

  1024     }

  1025 }

  1026 

  1027 void store_40x_pit (CPUState *env, target_ulong val)

  1028 {

  1029     ppc_tb_t *tb_env;

  1030     ppcemb_timer_t *ppcemb_timer;

  1031 

  1032     tb_env = env->tb_env;

  1033     ppcemb_timer = tb_env->opaque;

  1034 #ifdef PPC_DEBUG_TB

  1035     if (loglevel != 0) {

  1036         fprintf(logfile, "%s val" ADDRX "\n", __func__, val);

  1037     }

  1038 #endif

  1039     ppcemb_timer->pit_reload = val;

  1040     start_stop_pit(env, tb_env, 0);

  1041 }

  1042 

  1043 target_ulong load_40x_pit (CPUState *env)

  1044 {

  1045     return cpu_ppc_load_decr(env);

  1046 }

  1047 

  1048 void store_booke_tsr (CPUState *env, target_ulong val)

  1049 {

  1050 #ifdef PPC_DEBUG_TB

  1051     if (loglevel != 0) {

  1052         fprintf(logfile, "%s: val " ADDRX "\n", __func__, val);

  1053     }

  1054 #endif

  1055     env->spr[SPR_40x_TSR] &= ~(val & 0xFC000000);

  1056     if (val & 0x80000000)

  1057         ppc_set_irq(env, PPC_INTERRUPT_PIT, 0);

  1058 }

  1059 

  1060 void store_booke_tcr (CPUState *env, target_ulong val)

  1061 {

  1062     ppc_tb_t *tb_env;

  1063 

  1064     tb_env = env->tb_env;

  1065 #ifdef PPC_DEBUG_TB

  1066     if (loglevel != 0) {

  1067         fprintf(logfile, "%s: val " ADDRX "\n", __func__, val);

  1068     }

  1069 #endif

  1070     env->spr[SPR_40x_TCR] = val & 0xFFC00000;

  1071     start_stop_pit(env, tb_env, 1);

  1072     cpu_4xx_wdt_cb(env);

  1073 }

  1074 

  1075 static void ppc_emb_set_tb_clk (void *opaque, uint32_t freq)

  1076 {

  1077     CPUState *env = opaque;

  1078     ppc_tb_t *tb_env = env->tb_env;

  1079 

  1080 #ifdef PPC_DEBUG_TB

  1081     if (loglevel != 0) {

  1082         fprintf(logfile, "%s set new frequency to %" PRIu32 "\n", __func__,

  1083                 freq);

  1084     }

  1085 #endif

  1086     tb_env->tb_freq = freq;

  1087     tb_env->decr_freq = freq;

  1088     /* XXX: we should also update all timers */

  1089 }

  1090 

  1091 clk_setup_cb ppc_emb_timers_init (CPUState *env, uint32_t freq)

  1092 {

  1093     ppc_tb_t *tb_env;

  1094     ppcemb_timer_t *ppcemb_timer;

  1095 

  1096     tb_env = qemu_mallocz(sizeof(ppc_tb_t));

  1097     if (tb_env == NULL) {

  1098         return NULL;

  1099     }

  1100     env->tb_env = tb_env;

  1101     ppcemb_timer = qemu_mallocz(sizeof(ppcemb_timer_t));

  1102     tb_env->tb_freq = freq;

  1103     tb_env->decr_freq = freq;

  1104     tb_env->opaque = ppcemb_timer;

  1105 #ifdef PPC_DEBUG_TB

  1106     if (loglevel != 0) {

  1107         fprintf(logfile, "%s freq %" PRIu32 "\n", __func__, freq);

  1108     }

  1109 #endif

  1110     if (ppcemb_timer != NULL) {

  1111         /* We use decr timer for PIT */

  1112         tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_4xx_pit_cb, env);

  1113         ppcemb_timer->fit_timer =

  1114             qemu_new_timer(vm_clock, &cpu_4xx_fit_cb, env);

  1115         ppcemb_timer->wdt_timer =

  1116             qemu_new_timer(vm_clock, &cpu_4xx_wdt_cb, env);

  1117     }

  1118 

  1119     return &ppc_emb_set_tb_clk;

  1120 }

  1121 

  1122 /*****************************************************************************/

  1123 /* Embedded PowerPC Device Control Registers */

  1124 typedef struct ppc_dcrn_t ppc_dcrn_t;

  1125 struct ppc_dcrn_t {

  1126     dcr_read_cb dcr_read;

  1127     dcr_write_cb dcr_write;

  1128     void *opaque;

  1129 };

  1130 

  1131 /* XXX: on 460, DCR addresses are 32 bits wide,

  1132  *      using DCRIPR to get the 22 upper bits of the DCR address

  1133  */

  1134 #define DCRN_NB 1024

  1135 struct ppc_dcr_t {