hw/ppc.c

   1 /*
   2  * QEMU generic PowerPC hardware System Emulator
   3  *
   4  * Copyright (c) 2003-2007 Jocelyn Mayer
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "hw.h"
  25 #include "ppc.h"
  26 #include "qemu-timer.h"
  27 #include "sysemu.h"
  28 #include "nvram.h"
  29 #include "qemu-log.h"
  30
  31 //#define PPC_DEBUG_IRQ
  32 //#define PPC_DEBUG_TB
  33
  34 #ifdef PPC_DEBUG_IRQ
  35 #  define LOG_IRQ(...) qemu_log_mask(CPU_LOG_INT, ## __VA_ARGS__)
  36 #else
  37 #  define LOG_IRQ(...) do { } while (0)
  38 #endif
  39
  40
  41 #ifdef PPC_DEBUG_TB
  42 #  define LOG_TB(...) qemu_log(__VA_ARGS__)
  43 #else
  44 #  define LOG_TB(...) do { } while (0)
  45 #endif
  46
  47 static void cpu_ppc_tb_stop (CPUState *env);
  48 static void cpu_ppc_tb_start (CPUState *env);
  49
  50 static void ppc_set_irq (CPUState *env, int n_IRQ, int level)
  51 {
  52     if (level) {
  53         env->pending_interrupts |= 1 << n_IRQ;
  54         cpu_interrupt(env, CPU_INTERRUPT_HARD);
  55     } else {
  56         env->pending_interrupts &= ~(1 << n_IRQ);
  57         if (env->pending_interrupts == 0)
  58             cpu_reset_interrupt(env, CPU_INTERRUPT_HARD);
  59     }
  60     LOG_IRQ("%s: %p n_IRQ %d level %d => pending %08" PRIx32
  61                 "req %08x\n", __func__, env, n_IRQ, level,
  62                 env->pending_interrupts, env->interrupt_request);
  63 }
  64
  65 /* PowerPC 6xx / 7xx internal IRQ controller */
  66 static void ppc6xx_set_irq (void *opaque, int pin, int level)
  67 {
  68     CPUState *env = opaque;
  69     int cur_level;
  70
  71     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
  72                 env, pin, level);
  73     cur_level = (env->irq_input_state >> pin) & 1;
  74     /* Don't generate spurious events */
  75     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
  76         switch (pin) {
  77         case PPC6xx_INPUT_TBEN:
  78             /* Level sensitive - active high */
  79             LOG_IRQ("%s: %s the time base\n",
  80                         __func__, level ? "start" : "stop");
  81             if (level) {
  82                 cpu_ppc_tb_start(env);
  83             } else {
  84                 cpu_ppc_tb_stop(env);
  85             }
  86         case PPC6xx_INPUT_INT:
  87             /* Level sensitive - active high */
  88             LOG_IRQ("%s: set the external IRQ state to %d\n",
  89                         __func__, level);
  90             ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
  91             break;
  92         case PPC6xx_INPUT_SMI:
  93             /* Level sensitive - active high */
  94             LOG_IRQ("%s: set the SMI IRQ state to %d\n",
  95                         __func__, level);
  96             ppc_set_irq(env, PPC_INTERRUPT_SMI, level);
  97             break;
  98         case PPC6xx_INPUT_MCP:
  99             /* Negative edge sensitive */
 100             /* XXX: TODO: actual reaction may depends on HID0 status
 101              *            603/604/740/750: check HID0[EMCP]
 102              */
 103             if (cur_level == 1 && level == 0) {
 104                 LOG_IRQ("%s: raise machine check state\n",
 105                             __func__);
 106                 ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);
 107             }
 108             break;
 109         case PPC6xx_INPUT_CKSTP_IN:
 110             /* Level sensitive - active low */
 111             /* XXX: TODO: relay the signal to CKSTP_OUT pin */
 112             /* XXX: Note that the only way to restart the CPU is to reset it */
 113             if (level) {
 114                 LOG_IRQ("%s: stop the CPU\n", __func__);
 115                 env->halted = 1;
 116             }
 117             break;
 118         case PPC6xx_INPUT_HRESET:
 119             /* Level sensitive - active low */
 120             if (level) {
 121                 LOG_IRQ("%s: reset the CPU\n", __func__);
 122                 env->interrupt_request |= CPU_INTERRUPT_EXITTB;
 123                 /* XXX: TOFIX */
 124 #if 0
 125                 cpu_ppc_reset(env);
 126 #else
 127                 qemu_system_reset_request();
 128 #endif
 129             }
 130             break;
 131         case PPC6xx_INPUT_SRESET:
 132             LOG_IRQ("%s: set the RESET IRQ state to %d\n",
 133                         __func__, level);
 134             ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
 135             break;
 136         default:
 137             /* Unknown pin - do nothing */
 138             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 139             return;
 140         }
 141         if (level)
 142             env->irq_input_state |= 1 << pin;
 143         else
 144             env->irq_input_state &= ~(1 << pin);
 145     }
 146 }
 147
 148 void ppc6xx_irq_init (CPUState *env)
 149 {
 150     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc6xx_set_irq, env,
 151                                                   PPC6xx_INPUT_NB);
 152 }
 153
 154 #if defined(TARGET_PPC64)
 155 /* PowerPC 970 internal IRQ controller */
 156 static void ppc970_set_irq (void *opaque, int pin, int level)
 157 {
 158     CPUState *env = opaque;
 159     int cur_level;
 160
 161     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
 162                 env, pin, level);
 163     cur_level = (env->irq_input_state >> pin) & 1;
 164     /* Don't generate spurious events */
 165     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
 166         switch (pin) {
 167         case PPC970_INPUT_INT:
 168             /* Level sensitive - active high */
 169             LOG_IRQ("%s: set the external IRQ state to %d\n",
 170                         __func__, level);
 171             ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
 172             break;
 173         case PPC970_INPUT_THINT:
 174             /* Level sensitive - active high */
 175             LOG_IRQ("%s: set the SMI IRQ state to %d\n", __func__,
 176                         level);
 177             ppc_set_irq(env, PPC_INTERRUPT_THERM, level);
 178             break;
 179         case PPC970_INPUT_MCP:
 180             /* Negative edge sensitive */
 181             /* XXX: TODO: actual reaction may depends on HID0 status
 182              *            603/604/740/750: check HID0[EMCP]
 183              */
 184             if (cur_level == 1 && level == 0) {
 185                 LOG_IRQ("%s: raise machine check state\n",
 186                             __func__);
 187                 ppc_set_irq(env, PPC_INTERRUPT_MCK, 1);
 188             }
 189             break;
 190         case PPC970_INPUT_CKSTP:
 191             /* Level sensitive - active low */
 192             /* XXX: TODO: relay the signal to CKSTP_OUT pin */
 193             if (level) {
 194                 LOG_IRQ("%s: stop the CPU\n", __func__);
 195                 env->halted = 1;
 196             } else {
 197                 LOG_IRQ("%s: restart the CPU\n", __func__);
 198                 env->halted = 0;
 199             }
 200             break;
 201         case PPC970_INPUT_HRESET:
 202             /* Level sensitive - active low */
 203             if (level) {
 204 #if 0 // XXX: TOFIX
 205                 LOG_IRQ("%s: reset the CPU\n", __func__);
 206                 cpu_reset(env);
 207 #endif
 208             }
 209             break;
 210         case PPC970_INPUT_SRESET:
 211             LOG_IRQ("%s: set the RESET IRQ state to %d\n",
 212                         __func__, level);
 213             ppc_set_irq(env, PPC_INTERRUPT_RESET, level);
 214             break;
 215         case PPC970_INPUT_TBEN:
 216             LOG_IRQ("%s: set the TBEN state to %d\n", __func__,
 217                         level);
 218             /* XXX: TODO */
 219             break;
 220         default:
 221             /* Unknown pin - do nothing */
 222             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 223             return;
 224         }
 225         if (level)
 226             env->irq_input_state |= 1 << pin;
 227         else
 228             env->irq_input_state &= ~(1 << pin);
 229     }
 230 }
 231
 232 void ppc970_irq_init (CPUState *env)
 233 {
 234     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc970_set_irq, env,
 235                                                   PPC970_INPUT_NB);
 236 }
 237 #endif /* defined(TARGET_PPC64) */
 238
 239 /* PowerPC 40x internal IRQ controller */
 240 static void ppc40x_set_irq (void *opaque, int pin, int level)
 241 {
 242     CPUState *env = opaque;
 243     int cur_level;
 244
 245     LOG_IRQ("%s: env %p pin %d level %d\n", __func__,
 246                 env, pin, level);
 247     cur_level = (env->irq_input_state >> pin) & 1;
 248     /* Don't generate spurious events */
 249     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
 250         switch (pin) {
 251         case PPC40x_INPUT_RESET_SYS:
 252             if (level) {
 253                 LOG_IRQ("%s: reset the PowerPC system\n",
 254                             __func__);
 255                 ppc40x_system_reset(env);
 256             }
 257             break;
 258         case PPC40x_INPUT_RESET_CHIP:
 259             if (level) {
 260                 LOG_IRQ("%s: reset the PowerPC chip\n", __func__);
 261                 ppc40x_chip_reset(env);
 262             }
 263             break;
 264         case PPC40x_INPUT_RESET_CORE:
 265             /* XXX: TODO: update DBSR[MRR] */
 266             if (level) {
 267                 LOG_IRQ("%s: reset the PowerPC core\n", __func__);
 268                 ppc40x_core_reset(env);
 269             }
 270             break;
 271         case PPC40x_INPUT_CINT:
 272             /* Level sensitive - active high */
 273             LOG_IRQ("%s: set the critical IRQ state to %d\n",
 274                         __func__, level);
 275             ppc_set_irq(env, PPC_INTERRUPT_CEXT, level);
 276             break;
 277         case PPC40x_INPUT_INT:
 278             /* Level sensitive - active high */
 279             LOG_IRQ("%s: set the external IRQ state to %d\n",
 280                         __func__, level);
 281             ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
 282             break;
 283         case PPC40x_INPUT_HALT:
 284             /* Level sensitive - active low */
 285             if (level) {
 286                 LOG_IRQ("%s: stop the CPU\n", __func__);
 287                 env->halted = 1;
 288             } else {
 289                 LOG_IRQ("%s: restart the CPU\n", __func__);
 290                 env->halted = 0;
 291             }
 292             break;
 293         case PPC40x_INPUT_DEBUG:
 294             /* Level sensitive - active high */
 295             LOG_IRQ("%s: set the debug pin state to %d\n",
 296                         __func__, level);
 297             ppc_set_irq(env, PPC_INTERRUPT_DEBUG, level);
 298             break;
 299         default:
 300             /* Unknown pin - do nothing */
 301             LOG_IRQ("%s: unknown IRQ pin %d\n", __func__, pin);
 302             return;
 303         }
 304         if (level)
 305             env->irq_input_state |= 1 << pin;
 306         else
 307             env->irq_input_state &= ~(1 << pin);
 308     }
 309 }
 310
 311 void ppc40x_irq_init (CPUState *env)
 312 {
 313     env->irq_inputs = (void **)qemu_allocate_irqs(&ppc40x_set_irq,
 314                                                   env, PPC40x_INPUT_NB);
 315 }
 316
 317 /*****************************************************************************/
 318 /* PowerPC time base and decrementer emulation */
 319 struct ppc_tb_t {
 320     /* Time base management */
 321     int64_t  tb_offset;    /* Compensation                    */
 322     int64_t  atb_offset;   /* Compensation                    */
 323     uint32_t tb_freq;      /* TB frequency                    */
 324     /* Decrementer management */
 325     uint64_t decr_next;    /* Tick for next decr interrupt    */
 326     uint32_t decr_freq;    /* decrementer frequency           */
 327     struct QEMUTimer *decr_timer;
 328     /* Hypervisor decrementer management */
 329     uint64_t hdecr_next;    /* Tick for next hdecr interrupt  */
 330     struct QEMUTimer *hdecr_timer;
 331     uint64_t purr_load;
 332     uint64_t purr_start;
 333     void *opaque;
 334 };
 335
 336 static always_inline uint64_t cpu_ppc_get_tb (ppc_tb_t *tb_env, uint64_t vmclk,
 337                                               int64_t tb_offset)
 338 {
 339     /* TB time in tb periods */
 340     return muldiv64(vmclk, tb_env->tb_freq, ticks_per_sec) + tb_offset;
 341 }
 342
 343 uint32_t cpu_ppc_load_tbl (CPUState *env)
 344 {
 345     ppc_tb_t *tb_env = env->tb_env;
 346     uint64_t tb;
 347
 348     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
 349     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 350
 351     return tb & 0xFFFFFFFF;
 352 }
 353
 354 static always_inline uint32_t _cpu_ppc_load_tbu (CPUState *env)
 355 {
 356     ppc_tb_t *tb_env = env->tb_env;
 357     uint64_t tb;
 358
 359     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
 360     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 361
 362     return tb >> 32;
 363 }
 364
 365 uint32_t cpu_ppc_load_tbu (CPUState *env)
 366 {
 367     return _cpu_ppc_load_tbu(env);
 368 }
 369
 370 static always_inline void cpu_ppc_store_tb (ppc_tb_t *tb_env, uint64_t vmclk,
 371                                             int64_t *tb_offsetp,
 372                                             uint64_t value)
 373 {
 374     *tb_offsetp = value - muldiv64(vmclk, tb_env->tb_freq, ticks_per_sec);
 375     LOG_TB("%s: tb %016" PRIx64 " offset %08" PRIx64 "\n",
 376                 __func__, value, *tb_offsetp);
 377 }
 378
 379 void cpu_ppc_store_tbl (CPUState *env, uint32_t value)
 380 {
 381     ppc_tb_t *tb_env = env->tb_env;
 382     uint64_t tb;
 383
 384     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
 385     tb &= 0xFFFFFFFF00000000ULL;
 386     cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
 387                      &tb_env->tb_offset, tb | (uint64_t)value);
 388 }
 389
 390 static always_inline void _cpu_ppc_store_tbu (CPUState *env, uint32_t value)
 391 {
 392     ppc_tb_t *tb_env = env->tb_env;
 393     uint64_t tb;
 394
 395     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
 396     tb &= 0x00000000FFFFFFFFULL;
 397     cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
 398                      &tb_env->tb_offset, ((uint64_t)value << 32) | tb);
 399 }
 400
 401 void cpu_ppc_store_tbu (CPUState *env, uint32_t value)
 402 {
 403     _cpu_ppc_store_tbu(env, value);
 404 }
 405
 406 uint32_t cpu_ppc_load_atbl (CPUState *env)
 407 {
 408     ppc_tb_t *tb_env = env->tb_env;
 409     uint64_t tb;
 410
 411     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
 412     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 413
 414     return tb & 0xFFFFFFFF;
 415 }
 416
 417 uint32_t cpu_ppc_load_atbu (CPUState *env)
 418 {
 419     ppc_tb_t *tb_env = env->tb_env;
 420     uint64_t tb;
 421
 422     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
 423     LOG_TB("%s: tb %016" PRIx64 "\n", __func__, tb);
 424
 425     return tb >> 32;
 426 }
 427
 428 void cpu_ppc_store_atbl (CPUState *env, uint32_t value)
 429 {
 430     ppc_tb_t *tb_env = env->tb_env;
 431     uint64_t tb;
 432
 433     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
 434     tb &= 0xFFFFFFFF00000000ULL;
 435     cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
 436                      &tb_env->atb_offset, tb | (uint64_t)value);
 437 }
 438
 439 void cpu_ppc_store_atbu (CPUState *env, uint32_t value)
 440 {
 441     ppc_tb_t *tb_env = env->tb_env;
 442     uint64_t tb;
 443
 444     tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
 445     tb &= 0x00000000FFFFFFFFULL;
 446     cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
 447                      &tb_env->atb_offset, ((uint64_t)value << 32) | tb);
 448 }
 449
 450 static void cpu_ppc_tb_stop (CPUState *env)
 451 {
 452     ppc_tb_t *tb_env = env->tb_env;
 453     uint64_t tb, atb, vmclk;
 454
 455     /* If the time base is already frozen, do nothing */
 456     if (tb_env->tb_freq != 0) {
 457         vmclk = qemu_get_clock(vm_clock);
 458         /* Get the time base */
 459         tb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->tb_offset);
 460         /* Get the alternate time base */
 461         atb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->atb_offset);
 462         /* Store the time base value (ie compute the current offset) */
 463         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
 464         /* Store the alternate time base value (compute the current offset) */
 465         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
 466         /* Set the time base frequency to zero */
 467         tb_env->tb_freq = 0;
 468         /* Now, the time bases are frozen to tb_offset / atb_offset value */
 469     }
 470 }
 471
 472 static void cpu_ppc_tb_start (CPUState *env)
 473 {
 474     ppc_tb_t *tb_env = env->tb_env;
 475     uint64_t tb, atb, vmclk;
 476
 477     /* If the time base is not frozen, do nothing */
 478     if (tb_env->tb_freq == 0) {
 479         vmclk = qemu_get_clock(vm_clock);
 480         /* Get the time base from tb_offset */
 481         tb = tb_env->tb_offset;
 482         /* Get the alternate time base from atb_offset */
 483         atb = tb_env->atb_offset;
 484         /* Restore the tb frequency from the decrementer frequency */
 485         tb_env->tb_freq = tb_env->decr_freq;
 486         /* Store the time base value */
 487         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
 488         /* Store the alternate time base value */
 489         cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
 490     }
 491 }
 492
 493 static always_inline uint32_t _cpu_ppc_load_decr (CPUState *env,
 494                                                   uint64_t *next)
 495 {
 496     ppc_tb_t *tb_env = env->tb_env;
 497     uint32_t decr;
 498     int64_t diff;
 499
 500     diff = tb_env->decr_next - qemu_get_clock(vm_clock);
 501     if (diff >= 0)
 502         decr = muldiv64(diff, tb_env->decr_freq, ticks_per_sec);
 503     else
 504         decr = -muldiv64(-diff, tb_env->decr_freq, ticks_per_sec);
 505     LOG_TB("%s: %08" PRIx32 "\n", __func__, decr);
 506
 507     return decr;
 508 }
 509
 510 uint32_t cpu_ppc_load_decr (CPUState *env)
 511 {
 512     ppc_tb_t *tb_env = env->tb_env;
 513
 514     return _cpu_ppc_load_decr(env, &tb_env->decr_next);
 515 }
 516
 517 uint32_t cpu_ppc_load_hdecr (CPUState *env)
 518 {
 519     ppc_tb_t *tb_env = env->tb_env;
 520
 521     return _cpu_ppc_load_decr(env, &tb_env->hdecr_next);
 522 }
 523
 524 uint64_t cpu_ppc_load_purr (CPUState *env)
 525 {
 526     ppc_tb_t *tb_env = env->tb_env;
 527     uint64_t diff;
 528
 529     diff = qemu_get_clock(vm_clock) - tb_env->purr_start;
 530
 531     return tb_env->purr_load + muldiv64(diff, tb_env->tb_freq, ticks_per_sec);
 532 }
 533
 534 /* When decrementer expires,
 535  * all we need to do is generate or queue a CPU exception
 536  */
 537 static always_inline void cpu_ppc_decr_excp (CPUState *env)
 538 {
 539     /* Raise it */
 540     LOG_TB("raise decrementer exception\n");
 541     ppc_set_irq(env, PPC_INTERRUPT_DECR, 1);
 542 }
 543
 544 static always_inline void cpu_ppc_hdecr_excp (CPUState *env)
 545 {
 546     /* Raise it */
 547     LOG_TB("raise decrementer exception\n");
 548     ppc_set_irq(env, PPC_INTERRUPT_HDECR, 1);
 549 }
 550
 551 static void __cpu_ppc_store_decr (CPUState *env, uint64_t *nextp,
 552                                   struct QEMUTimer *timer,
 553                                   void (*raise_excp)(CPUState *),
 554                                   uint32_t decr, uint32_t value,
 555                                   int is_excp)
 556 {
 557     ppc_tb_t *tb_env = env->tb_env;
 558     uint64_t now, next;
 559
 560     LOG_TB("%s: %08" PRIx32 " => %08" PRIx32 "\n", __func__,
 561                 decr, value);
 562     now = qemu_get_clock(vm_clock);
 563     next = now + muldiv64(value, ticks_per_sec, tb_env->decr_freq);
 564     if (is_excp)
 565         next += *nextp - now;
 566     if (next == now)
 567         next++;
 568     *nextp = next;
 569     /* Adjust timer */
 570     qemu_mod_timer(timer, next);
 571     /* If we set a negative value and the decrementer was positive,
 572      * raise an exception.
 573      */
 574     if ((value & 0x80000000) && !(decr & 0x80000000))
 575         (*raise_excp)(env);
 576 }
 577
 578 static always_inline void _cpu_ppc_store_decr (CPUState *env, uint32_t decr,
 579                                                uint32_t value, int is_excp)
 580 {
 581     ppc_tb_t *tb_env = env->tb_env;
 582
 583     __cpu_ppc_store_decr(env, &tb_env->decr_next, tb_env->decr_timer,
 584                          &cpu_ppc_decr_excp, decr, value, is_excp);
 585 }
 586
 587 void cpu_ppc_store_decr (CPUState *env, uint32_t value)
 588 {
 589     _cpu_ppc_store_decr(env, cpu_ppc_load_decr(env), value, 0);
 590 }
 591
 592 static void cpu_ppc_decr_cb (void *opaque)
 593 {
 594     _cpu_ppc_store_decr(opaque, 0x00000000, 0xFFFFFFFF, 1);
 595 }
 596
 597 static always_inline void _cpu_ppc_store_hdecr (CPUState *env, uint32_t hdecr,
 598                                                 uint32_t value, int is_excp)
 599 {
 600     ppc_tb_t *tb_env = env->tb_env;
 601
 602     if (tb_env->hdecr_timer != NULL) {
 603         __cpu_ppc_store_decr(env, &tb_env->hdecr_next, tb_env->hdecr_timer,
 604                              &cpu_ppc_hdecr_excp, hdecr, value, is_excp);
 605     }
 606 }
 607
 608 void cpu_ppc_store_hdecr (CPUState *env, uint32_t value)
 609 {
 610     _cpu_ppc_store_hdecr(env, cpu_ppc_load_hdecr(env), value, 0);
 611 }
 612
 613 static void cpu_ppc_hdecr_cb (void *opaque)
 614 {
 615     _cpu_ppc_store_hdecr(opaque, 0x00000000, 0xFFFFFFFF, 1);
 616 }
 617
 618 void cpu_ppc_store_purr (CPUState *env, uint64_t value)
 619 {
 620     ppc_tb_t *tb_env = env->tb_env;
 621
 622     tb_env->purr_load = value;
 623     tb_env->purr_start = qemu_get_clock(vm_clock);
 624 }
 625
 626 static void cpu_ppc_set_tb_clk (void *opaque, uint32_t freq)
 627 {
 628     CPUState *env = opaque;
 629     ppc_tb_t *tb_env = env->tb_env;
 630
 631     tb_env->tb_freq = freq;
 632     tb_env->decr_freq = freq;
 633     /* There is a bug in Linux 2.4 kernels:
 634      * if a decrementer exception is pending when it enables msr_ee at startup,
 635      * it's not ready to handle it...
 636      */
 637     _cpu_ppc_store_decr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
 638     _cpu_ppc_store_hdecr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
 639     cpu_ppc_store_purr(env, 0x0000000000000000ULL);
 640 }
 641
 642 /* Set up (once) timebase frequency (in Hz) */
 643 clk_setup_cb cpu_ppc_tb_init (CPUState *env, uint32_t freq)
 644 {
 645     ppc_tb_t *tb_env;
 646
 647     tb_env = qemu_mallocz(sizeof(ppc_tb_t));
 648     env->tb_env = tb_env;
 649     /* Create new timer */
 650     tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_ppc_decr_cb, env);
 651     if (0) {
 652         /* XXX: find a suitable condition to enable the hypervisor decrementer
 653          */
 654         tb_env->hdecr_timer = qemu_new_timer(vm_clock, &cpu_ppc_hdecr_cb, env);
 655     } else {
 656         tb_env->hdecr_timer = NULL;
 657     }
 658     cpu_ppc_set_tb_clk(env, freq);
 659
 660     return &cpu_ppc_set_tb_clk;
 661 }
 662
 663 /* Specific helpers for POWER & PowerPC 601 RTC */
 664 #if 0
 665 static clk_setup_cb cpu_ppc601_rtc_init (CPUState *env)
 666 {
 667     return cpu_ppc_tb_init(env, 7812500);
 668 }
 669 #endif
 670
 671 void cpu_ppc601_store_rtcu (CPUState *env, uint32_t value)
 672 {
 673     _cpu_ppc_store_tbu(env, value);
 674 }
 675
 676 uint32_t cpu_ppc601_load_rtcu (CPUState *env)
 677 {
 678     return _cpu_ppc_load_tbu(env);
 679 }
 680
 681 void cpu_ppc601_store_rtcl (CPUState *env, uint32_t value)
 682 {
 683     cpu_ppc_store_tbl(env, value & 0x3FFFFF80);
 684 }
 685
 686 uint32_t cpu_ppc601_load_rtcl (CPUState *env)
 687 {
 688     return cpu_ppc_load_tbl(env) & 0x3FFFFF80;
 689 }
 690
 691 /*****************************************************************************/
 692 /* Embedded PowerPC timers */
 693
 694 /* PIT, FIT & WDT */
 695 typedef struct ppcemb_timer_t ppcemb_timer_t;
 696 struct ppcemb_timer_t {
 697     uint64_t pit_reload;  /* PIT auto-reload value        */
 698     uint64_t fit_next;    /* Tick for next FIT interrupt  */
 699     struct QEMUTimer *fit_timer;
 700     uint64_t wdt_next;    /* Tick for next WDT interrupt  */
 701     struct QEMUTimer *wdt_timer;
 702 };
 703
 704 /* Fixed interval timer */
 705 static void cpu_4xx_fit_cb (void *opaque)
 706 {
 707     CPUState *env;
 708     ppc_tb_t *tb_env;
 709     ppcemb_timer_t *ppcemb_timer;
 710     uint64_t now, next;
 711
 712     env = opaque;
 713     tb_env = env->tb_env;
 714     ppcemb_timer = tb_env->opaque;
 715     now = qemu_get_clock(vm_clock);
 716     switch ((env->spr[SPR_40x_TCR] >> 24) & 0x3) {
 717     case 0:
 718         next = 1 << 9;
 719         break;
 720     case 1:
 721         next = 1 << 13;
 722         break;
 723     case 2:
 724         next = 1 << 17;
 725         break;
 726     case 3:
 727         next = 1 << 21;
 728         break;
 729     default:
 730         /* Cannot occur, but makes gcc happy */
 731         return;
 732     }
 733     next = now + muldiv64(next, ticks_per_sec, tb_env->tb_freq);
 734     if (next == now)
 735         next++;
 736     qemu_mod_timer(ppcemb_timer->fit_timer, next);
 737     env->spr[SPR_40x_TSR] |= 1 << 26;
 738     if ((env->spr[SPR_40x_TCR] >> 23) & 0x1)
 739         ppc_set_irq(env, PPC_INTERRUPT_FIT, 1);
 740     LOG_TB("%s: ir %d TCR " ADDRX " TSR " ADDRX "\n", __func__,
 741                 (int)((env->spr[SPR_40x_TCR] >> 23) & 0x1),
 742                 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
 743 }
 744
 745 /* Programmable interval timer */
 746 static void start_stop_pit (CPUState *env, ppc_tb_t *tb_env, int is_excp)
 747 {
 748     ppcemb_timer_t *ppcemb_timer;
 749     uint64_t now, next;
 750
 751     ppcemb_timer = tb_env->opaque;
 752     if (ppcemb_timer->pit_reload <= 1 ||
 753         !((env->spr[SPR_40x_TCR] >> 26) & 0x1) ||
 754         (is_excp && !((env->spr[SPR_40x_TCR] >> 22) & 0x1))) {
 755         /* Stop PIT */
 756         LOG_TB("%s: stop PIT\n", __func__);
 757         qemu_del_timer(tb_env->decr_timer);
 758     } else {
 759         LOG_TB("%s: start PIT %016" PRIx64 "\n",
 760                     __func__, ppcemb_timer->pit_reload);
 761         now = qemu_get_clock(vm_clock);
 762         next = now + muldiv64(ppcemb_timer->pit_reload,
 763                               ticks_per_sec, tb_env->decr_freq);
 764         if (is_excp)
 765             next += tb_env->decr_next - now;
 766         if (next == now)
 767             next++;
 768         qemu_mod_timer(tb_env->decr_timer, next);
 769         tb_env->decr_next = next;
 770     }
 771 }
 772
 773 static void cpu_4xx_pit_cb (void *opaque)
 774 {
 775     CPUState *env;
 776     ppc_tb_t *tb_env;
 777     ppcemb_timer_t *ppcemb_timer;
 778
 779     env = opaque;
 780     tb_env = env->tb_env;
 781     ppcemb_timer = tb_env->opaque;
 782     env->spr[SPR_40x_TSR] |= 1 << 27;
 783     if ((env->spr[SPR_40x_TCR] >> 26) & 0x1)
 784         ppc_set_irq(env, PPC_INTERRUPT_PIT, 1);
 785     start_stop_pit(env, tb_env, 1);
 786     LOG_TB("%s: ar %d ir %d TCR " ADDRX " TSR " ADDRX " "
 787                 "%016" PRIx64 "\n", __func__,
 788                 (int)((env->spr[SPR_40x_TCR] >> 22) & 0x1),
 789                 (int)((env->spr[SPR_40x_TCR] >> 26) & 0x1),
 790                 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR],
 791                 ppcemb_timer->pit_reload);
 792 }
 793
 794 /* Watchdog timer */
 795 static void cpu_4xx_wdt_cb (void *opaque)
 796 {
 797     CPUState *env;
 798     ppc_tb_t *tb_env;
 799     ppcemb_timer_t *ppcemb_timer;
 800     uint64_t now, next;
 801
 802     env = opaque;
 803     tb_env = env->tb_env;
 804     ppcemb_timer = tb_env->opaque;
 805     now = qemu_get_clock(vm_clock);
 806     switch ((env->spr[SPR_40x_TCR] >> 30) & 0x3) {
 807     case 0:
 808         next = 1 << 17;
 809         break;
 810     case 1:
 811         next = 1 << 21;
 812         break;
 813     case 2:
 814         next = 1 << 25;
 815         break;
 816     case 3:
 817         next = 1 << 29;
 818         break;
 819     default:
 820         /* Cannot occur, but makes gcc happy */
 821         return;
 822     }
 823     next = now + muldiv64(next, ticks_per_sec, tb_env->decr_freq);
 824     if (next == now)
 825         next++;
 826     LOG_TB("%s: TCR " ADDRX " TSR " ADDRX "\n", __func__,
 827                 env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR]);
 828     switch ((env->spr[SPR_40x_TSR] >> 30) & 0x3) {
 829     case 0x0:
 830     case 0x1:
 831         qemu_mod_timer(ppcemb_timer->wdt_timer, next);
 832         ppcemb_timer->wdt_next = next;
 833         env->spr[SPR_40x_TSR] |= 1 << 31;
 834         break;
 835     case 0x2:
 836         qemu_mod_timer(ppcemb_timer->wdt_timer, next);
 837         ppcemb_timer->wdt_next = next;
 838         env->spr[SPR_40x_TSR] |= 1 << 30;
 839         if ((env->spr[SPR_40x_TCR] >> 27) & 0x1)
 840             ppc_set_irq(env, PPC_INTERRUPT_WDT, 1);
 841         break;
 842     case 0x3:
 843         env->spr[SPR_40x_TSR] &= ~0x30000000;
 844         env->spr[SPR_40x_TSR] |= env->spr[SPR_40x_TCR] & 0x30000000;
 845         switch ((env->spr[SPR_40x_TCR] >> 28) & 0x3) {
 846         case 0x0:
 847             /* No reset */
 848             break;
 849         case 0x1: /* Core reset */
 850             ppc40x_core_reset(env);
 851             break;
 852         case 0x2: /* Chip reset */
 853             ppc40x_chip_reset(env);
 854             break;
 855         case 0x3: /* System reset */
 856             ppc40x_system_reset(env);
 857             break;
 858         }
 859     }
 860 }
 861
 862 void store_40x_pit (CPUState *env, target_ulong val)
 863 {
 864     ppc_tb_t *tb_env;
 865     ppcemb_timer_t *ppcemb_timer;
 866
 867     tb_env = env->tb_env;
 868     ppcemb_timer = tb_env->opaque;
 869     LOG_TB("%s val" ADDRX "\n", __func__, val);
 870     ppcemb_timer->pit_reload = val;
 871     start_stop_pit(env, tb_env, 0);
 872 }
 873
 874 target_ulong load_40x_pit (CPUState *env)
 875 {
 876     return cpu_ppc_load_decr(env);
 877 }
 878
 879 void store_booke_tsr (CPUState *env, target_ulong val)
 880 {
 881     LOG_TB("%s: val " ADDRX "\n", __func__, val);
 882     env->spr[SPR_40x_TSR] &= ~(val & 0xFC000000);
 883     if (val & 0x80000000)
 884         ppc_set_irq(env, PPC_INTERRUPT_PIT, 0);
 885 }
 886
 887 void store_booke_tcr (CPUState *env, target_ulong val)
 888 {
 889     ppc_tb_t *tb_env;
 890
 891     tb_env = env->tb_env;
 892     LOG_TB("%s: val " ADDRX "\n", __func__, val);
 893     env->spr[SPR_40x_TCR] = val & 0xFFC00000;
 894     start_stop_pit(env, tb_env, 1);
 895     cpu_4xx_wdt_cb(env);
 896 }
 897
 898 static void ppc_emb_set_tb_clk (void *opaque, uint32_t freq)
 899 {
 900     CPUState *env = opaque;
 901     ppc_tb_t *tb_env = env->tb_env;
 902
 903     LOG_TB("%s set new frequency to %" PRIu32 "\n", __func__,
 904                 freq);
 905     tb_env->tb_freq = freq;
 906     tb_env->decr_freq = freq;
 907     /* XXX: we should also update all timers */
 908 }
 909
 910 clk_setup_cb ppc_emb_timers_init (CPUState *env, uint32_t freq)
 911 {
 912     ppc_tb_t *tb_env;
 913     ppcemb_timer_t *ppcemb_timer;
 914
 915     tb_env = qemu_mallocz(sizeof(ppc_tb_t));
 916     env->tb_env = tb_env;
 917     ppcemb_timer = qemu_mallocz(sizeof(ppcemb_timer_t));
 918     tb_env->tb_freq = freq;
 919     tb_env->decr_freq = freq;
 920     tb_env->opaque = ppcemb_timer;
 921     LOG_TB("%s freq %" PRIu32 "\n", __func__, freq);
 922     if (ppcemb_timer != NULL) {
 923         /* We use decr timer for PIT */
 924         tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_4xx_pit_cb, env);
 925         ppcemb_timer->fit_timer =
 926             qemu_new_timer(vm_clock, &cpu_4xx_fit_cb, env);
 927         ppcemb_timer->wdt_timer =
 928             qemu_new_timer(vm_clock, &cpu_4xx_wdt_cb, env);
 929     }
 930
 931     return &ppc_emb_set_tb_clk;
 932 }
 933
 934 /*****************************************************************************/
 935 /* Embedded PowerPC Device Control Registers */
 936 typedef struct ppc_dcrn_t ppc_dcrn_t;
 937 struct ppc_dcrn_t {
 938     dcr_read_cb dcr_read;
 939     dcr_write_cb dcr_write;
 940     void *opaque;
 941 };
 942
 943 /* XXX: on 460, DCR addresses are 32 bits wide,
 944  *      using DCRIPR to get the 22 upper bits of the DCR address
 945  */
 946 #define DCRN_NB 1024
 947 struct ppc_dcr_t {
 948     ppc_dcrn_t dcrn[DCRN_NB];
 949     int (*read_error)(int dcrn);
 950     int (*write_error)(int dcrn);
 951 };
 952
 953 int ppc_dcr_read (ppc_dcr_t *dcr_env, int dcrn, target_ulong *valp)
 954 {
 955     ppc_dcrn_t *dcr;
 956
 957     if (dcrn < 0 || dcrn >= DCRN_NB)
 958         goto error;
 959     dcr = &dcr_env->dcrn[dcrn];
 960     if (dcr->dcr_read == NULL)
 961         goto error;
 962     *valp = (*dcr->dcr_read)(dcr->opaque, dcrn);
 963
 964     return 0;
 965
 966  error:
 967     if (dcr_env->read_error != NULL)
 968         return (*dcr_env->read_error)(dcrn);
 969
 970     return -1;
 971 }
 972
 973 int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, target_ulong val)
 974 {
 975     ppc_dcrn_t *dcr;
 976
 977     if (dcrn < 0 || dcrn >= DCRN_NB)
 978         goto error;
 979     dcr = &dcr_env->dcrn[dcrn];
 980     if (dcr->dcr_write == NULL)
 981         goto error;
 982     (*dcr->dcr_write)(dcr->opaque, dcrn, val);
 983
 984     return 0;
 985
 986  error:
 987     if (dcr_env->write_error != NULL)
 988         return (*dcr_env->write_error)(dcrn);
 989
 990     return -1;
 991 }
 992
 993 int ppc_dcr_register (CPUState *env, int dcrn, void *opaque,
 994                       dcr_read_cb dcr_read, dcr_write_cb dcr_write)
 995 {
 996     ppc_dcr_t *dcr_env;
 997     ppc_dcrn_t *dcr;
 998
 999     dcr_env = env->dcr_env;
1000     if (dcr_env == NULL)
1001         return -1;
1002     if (dcrn < 0 || dcrn >= DCRN_NB)
1003         return -1;
1004     dcr = &dcr_env->dcrn[dcrn];
1005     if (dcr->opaque != NULL ||
1006         dcr->dcr_read != NULL ||
1007         dcr->dcr_write != NULL)
1008         return -1;
1009     dcr->opaque = opaque;
1010     dcr->dcr_read = dcr_read;
1011     dcr->dcr_write = dcr_write;
1012
1013     return 0;
1014 }
1015
1016 int ppc_dcr_init (CPUState *env, int (*read_error)(int dcrn),
1017                   int (*write_error)(int dcrn))
1018 {
1019     ppc_dcr_t *dcr_env;
1020
1021     dcr_env = qemu_mallocz(sizeof(ppc_dcr_t));
1022     dcr_env->read_error = read_error;
1023     dcr_env->write_error = write_error;
1024     env->dcr_env = dcr_env;
1025
1026     return 0;
1027 }
1028
1029 #if 0
1030 /*****************************************************************************/
1031 /* Handle system reset (for now, just stop emulation) */
1032 void cpu_ppc_reset (CPUState *env)
1033 {
1034     printf("Reset asked... Stop emulation\n");
1035     abort();
1036 }
1037 #endif
1038
1039 /*****************************************************************************/
1040 /* Debug port */
1041 void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
1042 {
1043     addr &= 0xF;
1044     switch (addr) {
1045     case 0:
1046         printf("%c", val);
1047         break;
1048     case 1:
1049         printf("\n");
1050         fflush(stdout);
1051         break;
1052     case 2:
1053         printf("Set loglevel to %04" PRIx32 "\n", val);
1054         cpu_set_log(val | 0x100);
1055         break;
1056     }
1057 }
1058
1059 /*****************************************************************************/
1060 /* NVRAM helpers */
1061 static inline uint32_t nvram_read (nvram_t *nvram, uint32_t addr)
1062 {
1063     return (*nvram->read_fn)(nvram->opaque, addr);;
1064 }
1065
1066 static inline void nvram_write (nvram_t *nvram, uint32_t addr, uint32_t val)
1067 {
1068     (*nvram->write_fn)(nvram->opaque, addr, val);
1069 }
1070
1071 void NVRAM_set_byte (nvram_t *nvram, uint32_t addr, uint8_t value)
1072 {
1073     nvram_write(nvram, addr, value);
1074 }
1075
1076 uint8_t NVRAM_get_byte (nvram_t *nvram, uint32_t addr)
1077 {
1078     return nvram_read(nvram, addr);
1079 }
1080
1081 void NVRAM_set_word (nvram_t *nvram, uint32_t addr, uint16_t value)
1082 {
1083     nvram_write(nvram, addr, value >> 8);
1084     nvram_write(nvram, addr + 1, value & 0xFF);
1085 }
1086
1087 uint16_t NVRAM_get_word (nvram_t *nvram, uint32_t addr)
1088 {
1089     uint16_t tmp;
1090
1091     tmp = nvram_read(nvram, addr) << 8;
1092     tmp |= nvram_read(nvram, addr + 1);
1093
1094     return tmp;
1095 }
1096
1097 void NVRAM_set_lword (nvram_t *nvram, uint32_t addr, uint32_t value)
1098 {
1099     nvram_write(nvram, addr, value >> 24);
1100     nvram_write(nvram, addr + 1, (value >> 16) & 0xFF);
1101     nvram_write(nvram, addr + 2, (value >> 8) & 0xFF);
1102     nvram_write(nvram, addr + 3, value & 0xFF);
1103 }
1104
1105 uint32_t NVRAM_get_lword (nvram_t *nvram, uint32_t addr)
1106 {
1107     uint32_t tmp;
1108
1109     tmp = nvram_read(nvram, addr) << 24;
1110     tmp |= nvram_read(nvram, addr + 1) << 16;
1111     tmp |= nvram_read(nvram, addr + 2) << 8;
1112     tmp |= nvram_read(nvram, addr + 3);
1113
1114     return tmp;
1115 }
1116
1117 void NVRAM_set_string (nvram_t *nvram, uint32_t addr,
1118                        const char *str, uint32_t max)
1119 {
1120     int i;
1121
1122     for (i = 0; i < max && str[i] != '\0'; i++) {
1123         nvram_write(nvram, addr + i, str[i]);
1124     }
1125     nvram_write(nvram, addr + i, str[i]);
1126     nvram_write(nvram, addr + max - 1, '\0');
1127 }
1128
1129 int NVRAM_get_string (nvram_t *nvram, uint8_t *dst, uint16_t addr, int max)
1130 {
1131     int i;
1132
1133     memset(dst, 0, max);
1134     for (i = 0; i < max; i++) {
1135         dst[i] = NVRAM_get_byte(nvram, addr + i);
1136         if (dst[i] == '\0')
1137             break;
1138     }
1139
1140     return i;
1141 }
1142
1143 static uint16_t NVRAM_crc_update (uint16_t prev, uint16_t value)
1144 {
1145     uint16_t tmp;
1146     uint16_t pd, pd1, pd2;
1147
1148     tmp = prev >> 8;
1149     pd = prev ^ value;
1150     pd1 = pd & 0x000F;
1151     pd2 = ((pd >> 4) & 0x000F) ^ pd1;
1152     tmp ^= (pd1 << 3) | (pd1 << 8);
1153     tmp ^= pd2 | (pd2 << 7) | (pd2 << 12);
1154
1155     return tmp;
1156 }
1157
1158 static uint16_t NVRAM_compute_crc (nvram_t *nvram, uint32_t start, uint32_t count)
1159 {
1160     uint32_t i;
1161     uint16_t crc = 0xFFFF;
1162     int odd;
1163
1164     odd = count & 1;
1165     count &= ~1;
1166     for (i = 0; i != count; i++) {
1167         crc = NVRAM_crc_update(crc, NVRAM_get_word(nvram, start + i));
1168     }
1169     if (odd) {
1170         crc = NVRAM_crc_update(crc, NVRAM_get_byte(nvram, start + i) << 8);
1171     }
1172
1173     return crc;
1174 }
1175
1176 #define CMDLINE_ADDR 0x017ff000
1177
1178 int PPC_NVRAM_set_params (nvram_t *nvram, uint16_t NVRAM_size,
1179                           const char *arch,
1180                           uint32_t RAM_size, int boot_device,
1181                           uint32_t kernel_image, uint32_t kernel_size,
1182                           const char *cmdline,
1183                           uint32_t initrd_image, uint32_t initrd_size,
1184                           uint32_t NVRAM_image,
1185                           int width, int height, int depth)
1186 {
1187     uint16_t crc;
1188
1189     /* Set parameters for Open Hack'Ware BIOS */
1190     NVRAM_set_string(nvram, 0x00, "QEMU_BIOS", 16);
1191     NVRAM_set_lword(nvram,  0x10, 0x00000002); /* structure v2 */
1192     NVRAM_set_word(nvram,   0x14, NVRAM_size);
1193     NVRAM_set_string(nvram, 0x20, arch, 16);
1194     NVRAM_set_lword(nvram,  0x30, RAM_size);
1195     NVRAM_set_byte(nvram,   0x34, boot_device);
1196     NVRAM_set_lword(nvram,  0x38, kernel_image);
1197     NVRAM_set_lword(nvram,  0x3C, kernel_size);
1198     if (cmdline) {
1199         /* XXX: put the cmdline in NVRAM too ? */
1200         strcpy((char *)(phys_ram_base + CMDLINE_ADDR), cmdline);
1201         NVRAM_set_lword(nvram,  0x40, CMDLINE_ADDR);
1202         NVRAM_set_lword(nvram,  0x44, strlen(cmdline));
1203     } else {
1204         NVRAM_set_lword(nvram,  0x40, 0);
1205         NVRAM_set_lword(nvram,  0x44, 0);
1206     }
1207     NVRAM_set_lword(nvram,  0x48, initrd_image);
1208     NVRAM_set_lword(nvram,  0x4C, initrd_size);
1209     NVRAM_set_lword(nvram,  0x50, NVRAM_image);
1210
1211     NVRAM_set_word(nvram,   0x54, width);
1212     NVRAM_set_word(nvram,   0x56, height);
1213     NVRAM_set_word(nvram,   0x58, depth);
1214     crc = NVRAM_compute_crc(nvram, 0x00, 0xF8);
1215     NVRAM_set_word(nvram,   0xFC, crc);
1216
1217     return 0;
1218 }