2 * QEMU Malta board support
4 * Copyright (c) 2006 Aurelien Jarno
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26 #include "hw/i386/pc.h"
27 #include "hw/char/serial.h"
28 #include "hw/block/fdc.h"
30 #include "hw/boards.h"
31 #include "hw/i2c/smbus.h"
32 #include "block/block.h"
33 #include "hw/block/flash.h"
34 #include "hw/mips/mips.h"
35 #include "hw/mips/cpudevs.h"
36 #include "hw/pci/pci.h"
37 #include "sysemu/char.h"
38 #include "sysemu/sysemu.h"
39 #include "sysemu/arch_init.h"
41 #include "hw/mips/bios.h"
43 #include "hw/loader.h"
45 #include "hw/timer/mc146818rtc.h"
46 #include "hw/timer/i8254.h"
47 #include "sysemu/blockdev.h"
48 #include "exec/address-spaces.h"
49 #include "hw/sysbus.h" /* SysBusDevice */
50 #include "qemu/host-utils.h"
51 #include "sysemu/qtest.h"
52 #include "qemu/error-report.h"
53 #include "hw/empty_slot.h"
54 #include "sysemu/kvm.h"
56 //#define DEBUG_BOARD_INIT
58 #define ENVP_ADDR 0x80002000l
59 #define ENVP_NB_ENTRIES 16
60 #define ENVP_ENTRY_SIZE 256
62 /* Hardware addresses */
63 #define FLASH_ADDRESS 0x1e000000ULL
64 #define FPGA_ADDRESS 0x1f000000ULL
65 #define RESET_ADDRESS 0x1fc00000ULL
67 #define FLASH_SIZE 0x400000
73 MemoryRegion iomem_lo
; /* 0 - 0x900 */
74 MemoryRegion iomem_hi
; /* 0xa00 - 0x100000 */
82 CharDriverState
*display
;
87 #define TYPE_MIPS_MALTA "mips-malta"
88 #define MIPS_MALTA(obj) OBJECT_CHECK(MaltaState, (obj), TYPE_MIPS_MALTA)
91 SysBusDevice parent_obj
;
96 static ISADevice
*pit
;
98 static struct _loaderparams
{
100 const char *kernel_filename
;
101 const char *kernel_cmdline
;
102 const char *initrd_filename
;
106 static void malta_fpga_update_display(void *opaque
)
110 MaltaFPGAState
*s
= opaque
;
112 for (i
= 7 ; i
>= 0 ; i
--) {
113 if (s
->leds
& (1 << i
))
120 qemu_chr_fe_printf(s
->display
, "\e[H\n\n|\e[32m%-8.8s\e[00m|\r\n", leds_text
);
121 qemu_chr_fe_printf(s
->display
, "\n\n\n\n|\e[31m%-8.8s\e[00m|", s
->display_text
);
125 * EEPROM 24C01 / 24C02 emulation.
127 * Emulation for serial EEPROMs:
128 * 24C01 - 1024 bit (128 x 8)
129 * 24C02 - 2048 bit (256 x 8)
131 * Typical device names include Microchip 24C02SC or SGS Thomson ST24C02.
137 # define logout(fmt, ...) fprintf(stderr, "MALTA\t%-24s" fmt, __func__, ## __VA_ARGS__)
139 # define logout(fmt, ...) ((void)0)
142 struct _eeprom24c0x_t
{
151 uint8_t contents
[256];
154 typedef struct _eeprom24c0x_t eeprom24c0x_t
;
156 static eeprom24c0x_t spd_eeprom
= {
158 /* 00000000: */ 0x80,0x08,0xFF,0x0D,0x0A,0xFF,0x40,0x00,
159 /* 00000008: */ 0x01,0x75,0x54,0x00,0x82,0x08,0x00,0x01,
160 /* 00000010: */ 0x8F,0x04,0x02,0x01,0x01,0x00,0x00,0x00,
161 /* 00000018: */ 0x00,0x00,0x00,0x14,0x0F,0x14,0x2D,0xFF,
162 /* 00000020: */ 0x15,0x08,0x15,0x08,0x00,0x00,0x00,0x00,
163 /* 00000028: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
164 /* 00000030: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
165 /* 00000038: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x12,0xD0,
166 /* 00000040: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
167 /* 00000048: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
168 /* 00000050: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
169 /* 00000058: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
170 /* 00000060: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
171 /* 00000068: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
172 /* 00000070: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
173 /* 00000078: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x64,0xF4,
177 static void generate_eeprom_spd(uint8_t *eeprom
, ram_addr_t ram_size
)
179 enum { SDR
= 0x4, DDR2
= 0x8 } type
;
180 uint8_t *spd
= spd_eeprom
.contents
;
182 uint16_t density
= 0;
185 /* work in terms of MB */
188 while ((ram_size
>= 4) && (nbanks
<= 2)) {
189 int sz_log2
= MIN(31 - clz32(ram_size
), 14);
191 density
|= 1 << (sz_log2
- 2);
192 ram_size
-= 1 << sz_log2
;
195 /* split to 2 banks if possible */
196 if ((nbanks
== 1) && (density
> 1)) {
201 if (density
& 0xff00) {
202 density
= (density
& 0xe0) | ((density
>> 8) & 0x1f);
204 } else if (!(density
& 0x1f)) {
211 fprintf(stderr
, "Warning: SPD cannot represent final %dMB"
212 " of SDRAM\n", (int)ram_size
);
215 /* fill in SPD memory information */
222 for (i
= 0; i
< 63; i
++) {
227 memcpy(eeprom
, spd
, sizeof(spd_eeprom
.contents
));
230 static void generate_eeprom_serial(uint8_t *eeprom
)
233 uint8_t mac
[6] = { 0x00 };
234 uint8_t sn
[5] = { 0x01, 0x23, 0x45, 0x67, 0x89 };
237 eeprom
[pos
++] = 0x01;
240 eeprom
[pos
++] = 0x02;
243 eeprom
[pos
++] = 0x01; /* MAC */
244 eeprom
[pos
++] = 0x06; /* length */
245 memcpy(&eeprom
[pos
], mac
, sizeof(mac
));
249 eeprom
[pos
++] = 0x02; /* serial */
250 eeprom
[pos
++] = 0x05; /* length */
251 memcpy(&eeprom
[pos
], sn
, sizeof(sn
));
256 for (i
= 0; i
< pos
; i
++) {
257 eeprom
[pos
] += eeprom
[i
];
261 static uint8_t eeprom24c0x_read(eeprom24c0x_t
*eeprom
)
263 logout("%u: scl = %u, sda = %u, data = 0x%02x\n",
264 eeprom
->tick
, eeprom
->scl
, eeprom
->sda
, eeprom
->data
);
268 static void eeprom24c0x_write(eeprom24c0x_t
*eeprom
, int scl
, int sda
)
270 if (eeprom
->scl
&& scl
&& (eeprom
->sda
!= sda
)) {
271 logout("%u: scl = %u->%u, sda = %u->%u i2c %s\n",
272 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
,
273 sda
? "stop" : "start");
278 } else if (eeprom
->tick
== 0 && !eeprom
->ack
) {
279 /* Waiting for start. */
280 logout("%u: scl = %u->%u, sda = %u->%u wait for i2c start\n",
281 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
);
282 } else if (!eeprom
->scl
&& scl
) {
283 logout("%u: scl = %u->%u, sda = %u->%u trigger bit\n",
284 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
);
286 logout("\ti2c ack bit = 0\n");
289 } else if (eeprom
->sda
== sda
) {
290 uint8_t bit
= (sda
!= 0);
291 logout("\ti2c bit = %d\n", bit
);
292 if (eeprom
->tick
< 9) {
293 eeprom
->command
<<= 1;
294 eeprom
->command
+= bit
;
296 if (eeprom
->tick
== 9) {
297 logout("\tcommand 0x%04x, %s\n", eeprom
->command
,
298 bit
? "read" : "write");
301 } else if (eeprom
->tick
< 17) {
302 if (eeprom
->command
& 1) {
303 sda
= ((eeprom
->data
& 0x80) != 0);
305 eeprom
->address
<<= 1;
306 eeprom
->address
+= bit
;
309 if (eeprom
->tick
== 17) {
310 eeprom
->data
= eeprom
->contents
[eeprom
->address
];
311 logout("\taddress 0x%04x, data 0x%02x\n",
312 eeprom
->address
, eeprom
->data
);
316 } else if (eeprom
->tick
>= 17) {
320 logout("\tsda changed with raising scl\n");
323 logout("%u: scl = %u->%u, sda = %u->%u\n", eeprom
->tick
, eeprom
->scl
,
324 scl
, eeprom
->sda
, sda
);
330 static uint64_t malta_fpga_read(void *opaque
, hwaddr addr
,
333 MaltaFPGAState
*s
= opaque
;
337 saddr
= (addr
& 0xfffff);
341 /* SWITCH Register */
343 val
= 0x00000000; /* All switches closed */
346 /* STATUS Register */
348 #ifdef TARGET_WORDS_BIGENDIAN
360 /* LEDBAR Register */
365 /* BRKRES Register */
370 /* UART Registers are handled directly by the serial device */
377 /* XXX: implement a real I2C controller */
381 /* IN = OUT until a real I2C control is implemented */
388 /* I2CINP Register */
390 val
= ((s
->i2cin
& ~1) | eeprom24c0x_read(&spd_eeprom
));
398 /* I2COUT Register */
403 /* I2CSEL Register */
410 printf ("malta_fpga_read: Bad register offset 0x" TARGET_FMT_lx
"\n",
418 static void malta_fpga_write(void *opaque
, hwaddr addr
,
419 uint64_t val
, unsigned size
)
421 MaltaFPGAState
*s
= opaque
;
424 saddr
= (addr
& 0xfffff);
428 /* SWITCH Register */
436 /* LEDBAR Register */
438 s
->leds
= val
& 0xff;
439 malta_fpga_update_display(s
);
442 /* ASCIIWORD Register */
444 snprintf(s
->display_text
, 9, "%08X", (uint32_t)val
);
445 malta_fpga_update_display(s
);
448 /* ASCIIPOS0 to ASCIIPOS7 Registers */
457 s
->display_text
[(saddr
- 0x00418) >> 3] = (char) val
;
458 malta_fpga_update_display(s
);
461 /* SOFTRES Register */
464 qemu_system_reset_request ();
467 /* BRKRES Register */
472 /* UART Registers are handled directly by the serial device */
476 s
->gpout
= val
& 0xff;
481 s
->i2coe
= val
& 0x03;
484 /* I2COUT Register */
486 eeprom24c0x_write(&spd_eeprom
, val
& 0x02, val
& 0x01);
490 /* I2CSEL Register */
492 s
->i2csel
= val
& 0x01;
497 printf ("malta_fpga_write: Bad register offset 0x" TARGET_FMT_lx
"\n",
504 static const MemoryRegionOps malta_fpga_ops
= {
505 .read
= malta_fpga_read
,
506 .write
= malta_fpga_write
,
507 .endianness
= DEVICE_NATIVE_ENDIAN
,
510 static void malta_fpga_reset(void *opaque
)
512 MaltaFPGAState
*s
= opaque
;
522 s
->display_text
[8] = '\0';
523 snprintf(s
->display_text
, 9, " ");
526 static void malta_fpga_led_init(CharDriverState
*chr
)
528 qemu_chr_fe_printf(chr
, "\e[HMalta LEDBAR\r\n");
529 qemu_chr_fe_printf(chr
, "+--------+\r\n");
530 qemu_chr_fe_printf(chr
, "+ +\r\n");
531 qemu_chr_fe_printf(chr
, "+--------+\r\n");
532 qemu_chr_fe_printf(chr
, "\n");
533 qemu_chr_fe_printf(chr
, "Malta ASCII\r\n");
534 qemu_chr_fe_printf(chr
, "+--------+\r\n");
535 qemu_chr_fe_printf(chr
, "+ +\r\n");
536 qemu_chr_fe_printf(chr
, "+--------+\r\n");
539 static MaltaFPGAState
*malta_fpga_init(MemoryRegion
*address_space
,
540 hwaddr base
, qemu_irq uart_irq
, CharDriverState
*uart_chr
)
544 s
= (MaltaFPGAState
*)g_malloc0(sizeof(MaltaFPGAState
));
546 memory_region_init_io(&s
->iomem
, NULL
, &malta_fpga_ops
, s
,
547 "malta-fpga", 0x100000);
548 memory_region_init_alias(&s
->iomem_lo
, NULL
, "malta-fpga",
549 &s
->iomem
, 0, 0x900);
550 memory_region_init_alias(&s
->iomem_hi
, NULL
, "malta-fpga",
551 &s
->iomem
, 0xa00, 0x10000-0xa00);
553 memory_region_add_subregion(address_space
, base
, &s
->iomem_lo
);
554 memory_region_add_subregion(address_space
, base
+ 0xa00, &s
->iomem_hi
);
556 s
->display
= qemu_chr_new("fpga", "vc:320x200", malta_fpga_led_init
);
558 s
->uart
= serial_mm_init(address_space
, base
+ 0x900, 3, uart_irq
,
559 230400, uart_chr
, DEVICE_NATIVE_ENDIAN
);
562 qemu_register_reset(malta_fpga_reset
, s
);
567 /* Network support */
568 static void network_init(PCIBus
*pci_bus
)
572 for(i
= 0; i
< nb_nics
; i
++) {
573 NICInfo
*nd
= &nd_table
[i
];
574 const char *default_devaddr
= NULL
;
576 if (i
== 0 && (!nd
->model
|| strcmp(nd
->model
, "pcnet") == 0))
577 /* The malta board has a PCNet card using PCI SLOT 11 */
578 default_devaddr
= "0b";
580 pci_nic_init_nofail(nd
, pci_bus
, "pcnet", default_devaddr
);
584 /* ROM and pseudo bootloader
586 The following code implements a very very simple bootloader. It first
587 loads the registers a0 to a3 to the values expected by the OS, and
588 then jump at the kernel address.
590 The bootloader should pass the locations of the kernel arguments and
591 environment variables tables. Those tables contain the 32-bit address
592 of NULL terminated strings. The environment variables table should be
593 terminated by a NULL address.
595 For a simpler implementation, the number of kernel arguments is fixed
596 to two (the name of the kernel and the command line), and the two
597 tables are actually the same one.
599 The registers a0 to a3 should contain the following values:
600 a0 - number of kernel arguments
601 a1 - 32-bit address of the kernel arguments table
602 a2 - 32-bit address of the environment variables table
603 a3 - RAM size in bytes
606 static void write_bootloader (CPUMIPSState
*env
, uint8_t *base
,
607 int64_t run_addr
, int64_t kernel_entry
)
611 /* Small bootloader */
612 p
= (uint32_t *)base
;
614 stl_p(p
++, 0x08000000 | /* j 0x1fc00580 */
615 ((run_addr
+ 0x580) & 0x0fffffff) >> 2);
616 stl_p(p
++, 0x00000000); /* nop */
618 /* YAMON service vector */
619 stl_p(base
+ 0x500, run_addr
+ 0x0580); /* start: */
620 stl_p(base
+ 0x504, run_addr
+ 0x083c); /* print_count: */
621 stl_p(base
+ 0x520, run_addr
+ 0x0580); /* start: */
622 stl_p(base
+ 0x52c, run_addr
+ 0x0800); /* flush_cache: */
623 stl_p(base
+ 0x534, run_addr
+ 0x0808); /* print: */
624 stl_p(base
+ 0x538, run_addr
+ 0x0800); /* reg_cpu_isr: */
625 stl_p(base
+ 0x53c, run_addr
+ 0x0800); /* unred_cpu_isr: */
626 stl_p(base
+ 0x540, run_addr
+ 0x0800); /* reg_ic_isr: */
627 stl_p(base
+ 0x544, run_addr
+ 0x0800); /* unred_ic_isr: */
628 stl_p(base
+ 0x548, run_addr
+ 0x0800); /* reg_esr: */
629 stl_p(base
+ 0x54c, run_addr
+ 0x0800); /* unreg_esr: */
630 stl_p(base
+ 0x550, run_addr
+ 0x0800); /* getchar: */
631 stl_p(base
+ 0x554, run_addr
+ 0x0800); /* syscon_read: */
634 /* Second part of the bootloader */
635 p
= (uint32_t *) (base
+ 0x580);
636 stl_p(p
++, 0x24040002); /* addiu a0, zero, 2 */
637 stl_p(p
++, 0x3c1d0000 | (((ENVP_ADDR
- 64) >> 16) & 0xffff)); /* lui sp, high(ENVP_ADDR) */
638 stl_p(p
++, 0x37bd0000 | ((ENVP_ADDR
- 64) & 0xffff)); /* ori sp, sp, low(ENVP_ADDR) */
639 stl_p(p
++, 0x3c050000 | ((ENVP_ADDR
>> 16) & 0xffff)); /* lui a1, high(ENVP_ADDR) */
640 stl_p(p
++, 0x34a50000 | (ENVP_ADDR
& 0xffff)); /* ori a1, a1, low(ENVP_ADDR) */
641 stl_p(p
++, 0x3c060000 | (((ENVP_ADDR
+ 8) >> 16) & 0xffff)); /* lui a2, high(ENVP_ADDR + 8) */
642 stl_p(p
++, 0x34c60000 | ((ENVP_ADDR
+ 8) & 0xffff)); /* ori a2, a2, low(ENVP_ADDR + 8) */
643 stl_p(p
++, 0x3c070000 | (loaderparams
.ram_size
>> 16)); /* lui a3, high(ram_size) */
644 stl_p(p
++, 0x34e70000 | (loaderparams
.ram_size
& 0xffff)); /* ori a3, a3, low(ram_size) */
646 /* Load BAR registers as done by YAMON */
647 stl_p(p
++, 0x3c09b400); /* lui t1, 0xb400 */
649 #ifdef TARGET_WORDS_BIGENDIAN
650 stl_p(p
++, 0x3c08df00); /* lui t0, 0xdf00 */
652 stl_p(p
++, 0x340800df); /* ori t0, r0, 0x00df */
654 stl_p(p
++, 0xad280068); /* sw t0, 0x0068(t1) */
656 stl_p(p
++, 0x3c09bbe0); /* lui t1, 0xbbe0 */
658 #ifdef TARGET_WORDS_BIGENDIAN
659 stl_p(p
++, 0x3c08c000); /* lui t0, 0xc000 */
661 stl_p(p
++, 0x340800c0); /* ori t0, r0, 0x00c0 */
663 stl_p(p
++, 0xad280048); /* sw t0, 0x0048(t1) */
664 #ifdef TARGET_WORDS_BIGENDIAN
665 stl_p(p
++, 0x3c084000); /* lui t0, 0x4000 */
667 stl_p(p
++, 0x34080040); /* ori t0, r0, 0x0040 */
669 stl_p(p
++, 0xad280050); /* sw t0, 0x0050(t1) */
671 #ifdef TARGET_WORDS_BIGENDIAN
672 stl_p(p
++, 0x3c088000); /* lui t0, 0x8000 */
674 stl_p(p
++, 0x34080080); /* ori t0, r0, 0x0080 */
676 stl_p(p
++, 0xad280058); /* sw t0, 0x0058(t1) */
677 #ifdef TARGET_WORDS_BIGENDIAN
678 stl_p(p
++, 0x3c083f00); /* lui t0, 0x3f00 */
680 stl_p(p
++, 0x3408003f); /* ori t0, r0, 0x003f */
682 stl_p(p
++, 0xad280060); /* sw t0, 0x0060(t1) */
684 #ifdef TARGET_WORDS_BIGENDIAN
685 stl_p(p
++, 0x3c08c100); /* lui t0, 0xc100 */
687 stl_p(p
++, 0x340800c1); /* ori t0, r0, 0x00c1 */
689 stl_p(p
++, 0xad280080); /* sw t0, 0x0080(t1) */
690 #ifdef TARGET_WORDS_BIGENDIAN
691 stl_p(p
++, 0x3c085e00); /* lui t0, 0x5e00 */
693 stl_p(p
++, 0x3408005e); /* ori t0, r0, 0x005e */
695 stl_p(p
++, 0xad280088); /* sw t0, 0x0088(t1) */
697 /* Jump to kernel code */
698 stl_p(p
++, 0x3c1f0000 | ((kernel_entry
>> 16) & 0xffff)); /* lui ra, high(kernel_entry) */
699 stl_p(p
++, 0x37ff0000 | (kernel_entry
& 0xffff)); /* ori ra, ra, low(kernel_entry) */
700 stl_p(p
++, 0x03e00008); /* jr ra */
701 stl_p(p
++, 0x00000000); /* nop */
703 /* YAMON subroutines */
704 p
= (uint32_t *) (base
+ 0x800);
705 stl_p(p
++, 0x03e00008); /* jr ra */
706 stl_p(p
++, 0x24020000); /* li v0,0 */
707 /* 808 YAMON print */
708 stl_p(p
++, 0x03e06821); /* move t5,ra */
709 stl_p(p
++, 0x00805821); /* move t3,a0 */
710 stl_p(p
++, 0x00a05021); /* move t2,a1 */
711 stl_p(p
++, 0x91440000); /* lbu a0,0(t2) */
712 stl_p(p
++, 0x254a0001); /* addiu t2,t2,1 */
713 stl_p(p
++, 0x10800005); /* beqz a0,834 */
714 stl_p(p
++, 0x00000000); /* nop */
715 stl_p(p
++, 0x0ff0021c); /* jal 870 */
716 stl_p(p
++, 0x00000000); /* nop */
717 stl_p(p
++, 0x08000205); /* j 814 */
718 stl_p(p
++, 0x00000000); /* nop */
719 stl_p(p
++, 0x01a00008); /* jr t5 */
720 stl_p(p
++, 0x01602021); /* move a0,t3 */
721 /* 0x83c YAMON print_count */
722 stl_p(p
++, 0x03e06821); /* move t5,ra */
723 stl_p(p
++, 0x00805821); /* move t3,a0 */
724 stl_p(p
++, 0x00a05021); /* move t2,a1 */
725 stl_p(p
++, 0x00c06021); /* move t4,a2 */
726 stl_p(p
++, 0x91440000); /* lbu a0,0(t2) */
727 stl_p(p
++, 0x0ff0021c); /* jal 870 */
728 stl_p(p
++, 0x00000000); /* nop */
729 stl_p(p
++, 0x254a0001); /* addiu t2,t2,1 */
730 stl_p(p
++, 0x258cffff); /* addiu t4,t4,-1 */
731 stl_p(p
++, 0x1580fffa); /* bnez t4,84c */
732 stl_p(p
++, 0x00000000); /* nop */
733 stl_p(p
++, 0x01a00008); /* jr t5 */
734 stl_p(p
++, 0x01602021); /* move a0,t3 */
736 stl_p(p
++, 0x3c08b800); /* lui t0,0xb400 */
737 stl_p(p
++, 0x350803f8); /* ori t0,t0,0x3f8 */
738 stl_p(p
++, 0x91090005); /* lbu t1,5(t0) */
739 stl_p(p
++, 0x00000000); /* nop */
740 stl_p(p
++, 0x31290040); /* andi t1,t1,0x40 */
741 stl_p(p
++, 0x1120fffc); /* beqz t1,878 <outch+0x8> */
742 stl_p(p
++, 0x00000000); /* nop */
743 stl_p(p
++, 0x03e00008); /* jr ra */
744 stl_p(p
++, 0xa1040000); /* sb a0,0(t0) */
748 static void GCC_FMT_ATTR(3, 4) prom_set(uint32_t* prom_buf
, int index
,
749 const char *string
, ...)
754 if (index
>= ENVP_NB_ENTRIES
)
757 if (string
== NULL
) {
762 table_addr
= sizeof(int32_t) * ENVP_NB_ENTRIES
+ index
* ENVP_ENTRY_SIZE
;
763 prom_buf
[index
] = tswap32(ENVP_ADDR
+ table_addr
);
765 va_start(ap
, string
);
766 vsnprintf((char *)prom_buf
+ table_addr
, ENVP_ENTRY_SIZE
, string
, ap
);
771 static int64_t load_kernel (void)
773 int64_t kernel_entry
, kernel_high
;
775 ram_addr_t initrd_offset
;
780 uint64_t (*xlate_to_kseg0
) (void *opaque
, uint64_t addr
);
782 #ifdef TARGET_WORDS_BIGENDIAN
788 if (load_elf(loaderparams
.kernel_filename
, cpu_mips_kseg0_to_phys
, NULL
,
789 (uint64_t *)&kernel_entry
, NULL
, (uint64_t *)&kernel_high
,
790 big_endian
, ELF_MACHINE
, 1) < 0) {
791 fprintf(stderr
, "qemu: could not load kernel '%s'\n",
792 loaderparams
.kernel_filename
);
796 xlate_to_kseg0
= cpu_mips_kvm_um_phys_to_kseg0
;
798 xlate_to_kseg0
= cpu_mips_phys_to_kseg0
;
804 if (loaderparams
.initrd_filename
) {
805 initrd_size
= get_image_size (loaderparams
.initrd_filename
);
806 if (initrd_size
> 0) {
807 initrd_offset
= (kernel_high
+ ~INITRD_PAGE_MASK
) & INITRD_PAGE_MASK
;
808 if (initrd_offset
+ initrd_size
> ram_size
) {
810 "qemu: memory too small for initial ram disk '%s'\n",
811 loaderparams
.initrd_filename
);
814 initrd_size
= load_image_targphys(loaderparams
.initrd_filename
,
816 ram_size
- initrd_offset
);
818 if (initrd_size
== (target_ulong
) -1) {
819 fprintf(stderr
, "qemu: could not load initial ram disk '%s'\n",
820 loaderparams
.initrd_filename
);
825 /* Setup prom parameters. */
826 prom_size
= ENVP_NB_ENTRIES
* (sizeof(int32_t) + ENVP_ENTRY_SIZE
);
827 prom_buf
= g_malloc(prom_size
);
829 prom_set(prom_buf
, prom_index
++, "%s", loaderparams
.kernel_filename
);
830 if (initrd_size
> 0) {
831 prom_set(prom_buf
, prom_index
++, "rd_start=0x%" PRIx64
" rd_size=%li %s",
832 xlate_to_kseg0(NULL
, initrd_offset
), initrd_size
,
833 loaderparams
.kernel_cmdline
);
835 prom_set(prom_buf
, prom_index
++, "%s", loaderparams
.kernel_cmdline
);
838 prom_set(prom_buf
, prom_index
++, "memsize");
839 prom_set(prom_buf
, prom_index
++, "%i",
840 MIN(loaderparams
.ram_size
, 256 << 20));
842 prom_set(prom_buf
, prom_index
++, "modetty0");
843 prom_set(prom_buf
, prom_index
++, "38400n8r");
844 prom_set(prom_buf
, prom_index
++, NULL
);
846 rom_add_blob_fixed("prom", prom_buf
, prom_size
,
847 cpu_mips_kseg0_to_phys(NULL
, ENVP_ADDR
));
852 static void malta_mips_config(MIPSCPU
*cpu
)
854 CPUMIPSState
*env
= &cpu
->env
;
855 CPUState
*cs
= CPU(cpu
);
857 env
->mvp
->CP0_MVPConf0
|= ((smp_cpus
- 1) << CP0MVPC0_PVPE
) |
858 ((smp_cpus
* cs
->nr_threads
- 1) << CP0MVPC0_PTC
);
861 static void main_cpu_reset(void *opaque
)
863 MIPSCPU
*cpu
= opaque
;
864 CPUMIPSState
*env
= &cpu
->env
;
868 /* The bootloader does not need to be rewritten as it is located in a
869 read only location. The kernel location and the arguments table
870 location does not change. */
871 if (loaderparams
.kernel_filename
) {
872 env
->CP0_Status
&= ~((1 << CP0St_BEV
) | (1 << CP0St_ERL
));
875 malta_mips_config(cpu
);
878 /* Start running from the bootloader we wrote to end of RAM */
879 env
->active_tc
.PC
= 0x40000000 + loaderparams
.ram_size
;
883 static void cpu_request_exit(void *opaque
, int irq
, int level
)
885 CPUState
*cpu
= current_cpu
;
893 void mips_malta_init(MachineState
*machine
)
895 ram_addr_t ram_size
= machine
->ram_size
;
896 ram_addr_t ram_low_size
;
897 const char *cpu_model
= machine
->cpu_model
;
898 const char *kernel_filename
= machine
->kernel_filename
;
899 const char *kernel_cmdline
= machine
->kernel_cmdline
;
900 const char *initrd_filename
= machine
->initrd_filename
;
903 MemoryRegion
*system_memory
= get_system_memory();
904 MemoryRegion
*ram_high
= g_new(MemoryRegion
, 1);
905 MemoryRegion
*ram_low_preio
= g_new(MemoryRegion
, 1);
906 MemoryRegion
*ram_low_postio
;
907 MemoryRegion
*bios
, *bios_copy
= g_new(MemoryRegion
, 1);
908 target_long bios_size
= FLASH_SIZE
;
909 const size_t smbus_eeprom_size
= 8 * 256;
910 uint8_t *smbus_eeprom_buf
= g_malloc0(smbus_eeprom_size
);
911 int64_t kernel_entry
, bootloader_run_addr
;
917 qemu_irq
*cpu_exit_irq
;
922 DriveInfo
*hd
[MAX_IDE_BUS
* MAX_IDE_DEVS
];
923 DriveInfo
*fd
[MAX_FD
];
925 int fl_sectors
= bios_size
>> 16;
928 DeviceState
*dev
= qdev_create(NULL
, TYPE_MIPS_MALTA
);
929 MaltaState
*s
= MIPS_MALTA(dev
);
931 /* The whole address space decoded by the GT-64120A doesn't generate
932 exception when accessing invalid memory. Create an empty slot to
933 emulate this feature. */
934 empty_slot_init(0, 0x20000000);
936 qdev_init_nofail(dev
);
938 /* Make sure the first 3 serial ports are associated with a device. */
939 for(i
= 0; i
< 3; i
++) {
940 if (!serial_hds
[i
]) {
942 snprintf(label
, sizeof(label
), "serial%d", i
);
943 serial_hds
[i
] = qemu_chr_new(label
, "null", NULL
);
948 if (cpu_model
== NULL
) {
956 for (i
= 0; i
< smp_cpus
; i
++) {
957 cpu
= cpu_mips_init(cpu_model
);
959 fprintf(stderr
, "Unable to find CPU definition\n");
964 /* Init internal devices */
965 cpu_mips_irq_init_cpu(env
);
966 cpu_mips_clock_init(env
);
967 qemu_register_reset(main_cpu_reset
, cpu
);
969 cpu
= MIPS_CPU(first_cpu
);
973 if (ram_size
> (2048u << 20)) {
975 "qemu: Too much memory for this machine: %d MB, maximum 2048 MB\n",
976 ((unsigned int)ram_size
/ (1 << 20)));
980 /* register RAM at high address where it is undisturbed by IO */
981 memory_region_init_ram(ram_high
, NULL
, "mips_malta.ram", ram_size
);
982 vmstate_register_ram_global(ram_high
);
983 memory_region_add_subregion(system_memory
, 0x80000000, ram_high
);
985 /* alias for pre IO hole access */
986 memory_region_init_alias(ram_low_preio
, NULL
, "mips_malta_low_preio.ram",
987 ram_high
, 0, MIN(ram_size
, (256 << 20)));
988 memory_region_add_subregion(system_memory
, 0, ram_low_preio
);
990 /* alias for post IO hole access, if there is enough RAM */
991 if (ram_size
> (512 << 20)) {
992 ram_low_postio
= g_new(MemoryRegion
, 1);
993 memory_region_init_alias(ram_low_postio
, NULL
,
994 "mips_malta_low_postio.ram",
996 ram_size
- (512 << 20));
997 memory_region_add_subregion(system_memory
, 512 << 20, ram_low_postio
);
1000 /* generate SPD EEPROM data */
1001 generate_eeprom_spd(&smbus_eeprom_buf
[0 * 256], ram_size
);
1002 generate_eeprom_serial(&smbus_eeprom_buf
[6 * 256]);
1004 #ifdef TARGET_WORDS_BIGENDIAN
1010 /* The CBUS UART is attached to the MIPS CPU INT2 pin, ie interrupt 4 */
1011 malta_fpga_init(system_memory
, FPGA_ADDRESS
, env
->irq
[4], serial_hds
[2]);
1013 /* Load firmware in flash / BIOS. */
1014 dinfo
= drive_get(IF_PFLASH
, 0, fl_idx
);
1015 #ifdef DEBUG_BOARD_INIT
1017 printf("Register parallel flash %d size " TARGET_FMT_lx
" at "
1018 "addr %08llx '%s' %x\n",
1019 fl_idx
, bios_size
, FLASH_ADDRESS
,
1020 bdrv_get_device_name(dinfo
->bdrv
), fl_sectors
);
1023 fl
= pflash_cfi01_register(FLASH_ADDRESS
, NULL
, "mips_malta.bios",
1024 BIOS_SIZE
, dinfo
? dinfo
->bdrv
: NULL
,
1026 4, 0x0000, 0x0000, 0x0000, 0x0000, be
);
1027 bios
= pflash_cfi01_get_memory(fl
);
1029 if (kernel_filename
) {
1030 ram_low_size
= MIN(ram_size
, 256 << 20);
1031 /* For KVM T&E we reserve 1MB of RAM for running bootloader */
1032 if (kvm_enabled()) {
1033 ram_low_size
-= 0x100000;
1034 bootloader_run_addr
= 0x40000000 + ram_low_size
;
1036 bootloader_run_addr
= 0xbfc00000;
1039 /* Write a small bootloader to the flash location. */
1040 loaderparams
.ram_size
= ram_low_size
;
1041 loaderparams
.kernel_filename
= kernel_filename
;
1042 loaderparams
.kernel_cmdline
= kernel_cmdline
;
1043 loaderparams
.initrd_filename
= initrd_filename
;
1044 kernel_entry
= load_kernel();
1046 write_bootloader(env
, memory_region_get_ram_ptr(bios
),
1047 bootloader_run_addr
, kernel_entry
);
1048 if (kvm_enabled()) {
1049 /* Write the bootloader code @ the end of RAM, 1MB reserved */
1050 write_bootloader(env
, memory_region_get_ram_ptr(ram_low_preio
) +
1052 bootloader_run_addr
, kernel_entry
);
1055 /* The flash region isn't executable from a KVM T&E guest */
1056 if (kvm_enabled()) {
1057 error_report("KVM enabled but no -kernel argument was specified. "
1058 "Booting from flash is not supported with KVM T&E.");
1061 /* Load firmware from flash. */
1063 /* Load a BIOS image. */
1064 if (bios_name
== NULL
) {
1065 bios_name
= BIOS_FILENAME
;
1067 filename
= qemu_find_file(QEMU_FILE_TYPE_BIOS
, bios_name
);
1069 bios_size
= load_image_targphys(filename
, FLASH_ADDRESS
,
1075 if ((bios_size
< 0 || bios_size
> BIOS_SIZE
) &&
1076 !kernel_filename
&& !qtest_enabled()) {
1077 error_report("Could not load MIPS bios '%s', and no "
1078 "-kernel argument was specified", bios_name
);
1082 /* In little endian mode the 32bit words in the bios are swapped,
1083 a neat trick which allows bi-endian firmware. */
1084 #ifndef TARGET_WORDS_BIGENDIAN
1086 uint32_t *end
, *addr
= rom_ptr(FLASH_ADDRESS
);
1088 addr
= memory_region_get_ram_ptr(bios
);
1090 end
= (void *)addr
+ MIN(bios_size
, 0x3e0000);
1091 while (addr
< end
) {
1100 * Map the BIOS at a 2nd physical location, as on the real board.
1101 * Copy it so that we can patch in the MIPS revision, which cannot be
1102 * handled by an overlapping region as the resulting ROM code subpage
1103 * regions are not executable.
1105 memory_region_init_ram(bios_copy
, NULL
, "bios.1fc", BIOS_SIZE
);
1106 if (!rom_copy(memory_region_get_ram_ptr(bios_copy
),
1107 FLASH_ADDRESS
, BIOS_SIZE
)) {
1108 memcpy(memory_region_get_ram_ptr(bios_copy
),
1109 memory_region_get_ram_ptr(bios
), BIOS_SIZE
);
1111 memory_region_set_readonly(bios_copy
, true);
1112 memory_region_add_subregion(system_memory
, RESET_ADDRESS
, bios_copy
);
1114 /* Board ID = 0x420 (Malta Board with CoreLV) */
1115 stl_p(memory_region_get_ram_ptr(bios_copy
) + 0x10, 0x00000420);
1117 /* Init internal devices */
1118 cpu_mips_irq_init_cpu(env
);
1119 cpu_mips_clock_init(env
);
1122 * We have a circular dependency problem: pci_bus depends on isa_irq,
1123 * isa_irq is provided by i8259, i8259 depends on ISA, ISA depends
1124 * on piix4, and piix4 depends on pci_bus. To stop the cycle we have
1125 * qemu_irq_proxy() adds an extra bit of indirection, allowing us
1126 * to resolve the isa_irq -> i8259 dependency after i8259 is initialized.
1128 isa_irq
= qemu_irq_proxy(&s
->i8259
, 16);
1131 pci_bus
= gt64120_register(isa_irq
);
1134 ide_drive_get(hd
, MAX_IDE_BUS
);
1136 piix4_devfn
= piix4_init(pci_bus
, &isa_bus
, 80);
1138 /* Interrupt controller */
1139 /* The 8259 is attached to the MIPS CPU INT0 pin, ie interrupt 2 */
1140 s
->i8259
= i8259_init(isa_bus
, env
->irq
[2]);
1142 isa_bus_irqs(isa_bus
, s
->i8259
);
1143 pci_piix4_ide_init(pci_bus
, hd
, piix4_devfn
+ 1);
1144 pci_create_simple(pci_bus
, piix4_devfn
+ 2, "piix4-usb-uhci");
1145 smbus
= piix4_pm_init(pci_bus
, piix4_devfn
+ 3, 0x1100,
1146 isa_get_irq(NULL
, 9), NULL
, 0, NULL
, NULL
);
1147 smbus_eeprom_init(smbus
, 8, smbus_eeprom_buf
, smbus_eeprom_size
);
1148 g_free(smbus_eeprom_buf
);
1149 pit
= pit_init(isa_bus
, 0x40, 0, NULL
);
1150 cpu_exit_irq
= qemu_allocate_irqs(cpu_request_exit
, NULL
, 1);
1151 DMA_init(0, cpu_exit_irq
);
1154 isa_create_simple(isa_bus
, "i8042");
1156 rtc_init(isa_bus
, 2000, NULL
);
1157 serial_isa_init(isa_bus
, 0, serial_hds
[0]);
1158 serial_isa_init(isa_bus
, 1, serial_hds
[1]);
1159 if (parallel_hds
[0])
1160 parallel_init(isa_bus
, 0, parallel_hds
[0]);
1161 for(i
= 0; i
< MAX_FD
; i
++) {
1162 fd
[i
] = drive_get(IF_FLOPPY
, 0, i
);
1164 fdctrl_init_isa(isa_bus
, fd
);
1167 network_init(pci_bus
);
1169 /* Optional PCI video card */
1170 pci_vga_init(pci_bus
);
1173 static int mips_malta_sysbus_device_init(SysBusDevice
*sysbusdev
)
1178 static void mips_malta_class_init(ObjectClass
*klass
, void *data
)
1180 SysBusDeviceClass
*k
= SYS_BUS_DEVICE_CLASS(klass
);
1182 k
->init
= mips_malta_sysbus_device_init
;
1185 static const TypeInfo mips_malta_device
= {
1186 .name
= TYPE_MIPS_MALTA
,
1187 .parent
= TYPE_SYS_BUS_DEVICE
,
1188 .instance_size
= sizeof(MaltaState
),
1189 .class_init
= mips_malta_class_init
,
1192 static QEMUMachine mips_malta_machine
= {
1194 .desc
= "MIPS Malta Core LV",
1195 .init
= mips_malta_init
,
1200 static void mips_malta_register_types(void)
1202 type_register_static(&mips_malta_device
);
1205 static void mips_malta_machine_init(void)
1207 qemu_register_machine(&mips_malta_machine
);
1210 type_init(mips_malta_register_types
)
1211 machine_init(mips_malta_machine_init
);