2 * QEMU Malta board support
4 * Copyright (c) 2006 Aurelien Jarno
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 #include "qemu/osdep.h"
26 #include "qemu/units.h"
27 #include "qemu/bitops.h"
28 #include "qemu/datadir.h"
29 #include "qemu/guest-random.h"
31 #include "hw/southbridge/piix.h"
32 #include "hw/isa/superio.h"
33 #include "hw/char/serial.h"
35 #include "hw/boards.h"
36 #include "hw/i2c/smbus_eeprom.h"
37 #include "hw/block/flash.h"
38 #include "hw/mips/mips.h"
39 #include "hw/mips/bootloader.h"
40 #include "hw/pci/pci.h"
41 #include "hw/pci/pci_bus.h"
43 #include "hw/ide/pci.h"
45 #include "hw/loader.h"
47 #include "qom/object.h"
48 #include "hw/sysbus.h" /* SysBusDevice */
49 #include "qemu/host-utils.h"
50 #include "sysemu/qtest.h"
51 #include "sysemu/reset.h"
52 #include "sysemu/runstate.h"
53 #include "qapi/error.h"
54 #include "qemu/error-report.h"
55 #include "sysemu/kvm.h"
56 #include "semihosting/semihost.h"
57 #include "hw/mips/cps.h"
58 #include "hw/qdev-clock.h"
59 #include "target/mips/internal.h"
63 #define ENVP_PADDR 0x2000
64 #define ENVP_VADDR cpu_mips_phys_to_kseg0(NULL, ENVP_PADDR)
65 #define ENVP_NB_ENTRIES 16
66 #define ENVP_ENTRY_SIZE 256
68 /* Hardware addresses */
69 #define FLASH_ADDRESS 0x1e000000ULL
70 #define FPGA_ADDRESS 0x1f000000ULL
71 #define RESET_ADDRESS 0x1fc00000ULL
73 #define FLASH_SIZE 0x400000
74 #define BIOS_SIZE (4 * MiB)
76 #define PIIX4_PCI_DEVFN PCI_DEVFN(10, 0)
80 MemoryRegion iomem_lo
; /* 0 - 0x900 */
81 MemoryRegion iomem_hi
; /* 0xa00 - 0x100000 */
96 #define BIOS_FILENAME "mips_bios.bin"
98 #define BIOS_FILENAME "mipsel_bios.bin"
101 #define TYPE_MIPS_MALTA "mips-malta"
102 OBJECT_DECLARE_SIMPLE_TYPE(MaltaState
, MIPS_MALTA
)
105 SysBusDevice parent_obj
;
111 static struct _loaderparams
{
112 int ram_size
, ram_low_size
;
113 const char *kernel_filename
;
114 const char *kernel_cmdline
;
115 const char *initrd_filename
;
119 static void malta_fpga_update_display_leds(MaltaFPGAState
*s
)
124 for (i
= 7 ; i
>= 0 ; i
--) {
125 if (s
->leds
& (1 << i
)) {
133 trace_malta_fpga_leds(leds_text
);
134 qemu_chr_fe_printf(&s
->display
, "\e[H\n\n|\e[32m%-8.8s\e[00m|\r\n",
138 static void malta_fpga_update_display_ascii(MaltaFPGAState
*s
)
140 trace_malta_fpga_display(s
->display_text
);
141 qemu_chr_fe_printf(&s
->display
, "\n\n\n\n|\e[31m%-8.8s\e[00m|",
146 * EEPROM 24C01 / 24C02 emulation.
148 * Emulation for serial EEPROMs:
149 * 24C01 - 1024 bit (128 x 8)
150 * 24C02 - 2048 bit (256 x 8)
152 * Typical device names include Microchip 24C02SC or SGS Thomson ST24C02.
156 # define logout(fmt, ...) \
157 fprintf(stderr, "MALTA\t%-24s" fmt, __func__, ## __VA_ARGS__)
159 # define logout(fmt, ...) ((void)0)
162 struct _eeprom24c0x_t
{
171 uint8_t contents
[256];
174 typedef struct _eeprom24c0x_t eeprom24c0x_t
;
176 static eeprom24c0x_t spd_eeprom
= {
179 0x80, 0x08, 0xFF, 0x0D, 0x0A, 0xFF, 0x40, 0x00,
181 0x01, 0x75, 0x54, 0x00, 0x82, 0x08, 0x00, 0x01,
183 0x8F, 0x04, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00,
185 0x00, 0x00, 0x00, 0x14, 0x0F, 0x14, 0x2D, 0xFF,
187 0x15, 0x08, 0x15, 0x08, 0x00, 0x00, 0x00, 0x00,
189 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
191 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
193 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0xD0,
195 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
197 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
199 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
201 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
203 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
205 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
207 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
209 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x64, 0xF4,
213 static void generate_eeprom_spd(uint8_t *eeprom
, ram_addr_t ram_size
)
215 enum sdram_type type
;
216 uint8_t *spd
= spd_eeprom
.contents
;
218 uint16_t density
= 0;
221 /* work in terms of MB */
224 while ((ram_size
>= 4) && (nbanks
<= 2)) {
225 int sz_log2
= MIN(31 - clz32(ram_size
), 14);
227 density
|= 1 << (sz_log2
- 2);
228 ram_size
-= 1 << sz_log2
;
231 /* split to 2 banks if possible */
232 if ((nbanks
== 1) && (density
> 1)) {
237 if (density
& 0xff00) {
238 density
= (density
& 0xe0) | ((density
>> 8) & 0x1f);
240 } else if (!(density
& 0x1f)) {
247 warn_report("SPD cannot represent final " RAM_ADDR_FMT
"MB"
248 " of SDRAM", ram_size
);
251 /* fill in SPD memory information */
258 for (i
= 0; i
< 63; i
++) {
263 memcpy(eeprom
, spd
, sizeof(spd_eeprom
.contents
));
266 static void generate_eeprom_serial(uint8_t *eeprom
)
269 uint8_t mac
[6] = { 0x00 };
270 uint8_t sn
[5] = { 0x01, 0x23, 0x45, 0x67, 0x89 };
273 eeprom
[pos
++] = 0x01;
276 eeprom
[pos
++] = 0x02;
279 eeprom
[pos
++] = 0x01; /* MAC */
280 eeprom
[pos
++] = 0x06; /* length */
281 memcpy(&eeprom
[pos
], mac
, sizeof(mac
));
285 eeprom
[pos
++] = 0x02; /* serial */
286 eeprom
[pos
++] = 0x05; /* length */
287 memcpy(&eeprom
[pos
], sn
, sizeof(sn
));
292 for (i
= 0; i
< pos
; i
++) {
293 eeprom
[pos
] += eeprom
[i
];
297 static uint8_t eeprom24c0x_read(eeprom24c0x_t
*eeprom
)
299 logout("%u: scl = %u, sda = %u, data = 0x%02x\n",
300 eeprom
->tick
, eeprom
->scl
, eeprom
->sda
, eeprom
->data
);
304 static void eeprom24c0x_write(eeprom24c0x_t
*eeprom
, int scl
, int sda
)
306 if (eeprom
->scl
&& scl
&& (eeprom
->sda
!= sda
)) {
307 logout("%u: scl = %u->%u, sda = %u->%u i2c %s\n",
308 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
,
309 sda
? "stop" : "start");
314 } else if (eeprom
->tick
== 0 && !eeprom
->ack
) {
315 /* Waiting for start. */
316 logout("%u: scl = %u->%u, sda = %u->%u wait for i2c start\n",
317 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
);
318 } else if (!eeprom
->scl
&& scl
) {
319 logout("%u: scl = %u->%u, sda = %u->%u trigger bit\n",
320 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
);
322 logout("\ti2c ack bit = 0\n");
325 } else if (eeprom
->sda
== sda
) {
326 uint8_t bit
= (sda
!= 0);
327 logout("\ti2c bit = %d\n", bit
);
328 if (eeprom
->tick
< 9) {
329 eeprom
->command
<<= 1;
330 eeprom
->command
+= bit
;
332 if (eeprom
->tick
== 9) {
333 logout("\tcommand 0x%04x, %s\n", eeprom
->command
,
334 bit
? "read" : "write");
337 } else if (eeprom
->tick
< 17) {
338 if (eeprom
->command
& 1) {
339 sda
= ((eeprom
->data
& 0x80) != 0);
341 eeprom
->address
<<= 1;
342 eeprom
->address
+= bit
;
345 if (eeprom
->tick
== 17) {
346 eeprom
->data
= eeprom
->contents
[eeprom
->address
];
347 logout("\taddress 0x%04x, data 0x%02x\n",
348 eeprom
->address
, eeprom
->data
);
352 } else if (eeprom
->tick
>= 17) {
356 logout("\tsda changed with raising scl\n");
359 logout("%u: scl = %u->%u, sda = %u->%u\n", eeprom
->tick
, eeprom
->scl
,
360 scl
, eeprom
->sda
, sda
);
366 static uint64_t malta_fpga_read(void *opaque
, hwaddr addr
,
369 MaltaFPGAState
*s
= opaque
;
373 saddr
= (addr
& 0xfffff);
377 /* SWITCH Register */
382 /* STATUS Register */
384 #if TARGET_BIG_ENDIAN
396 /* LEDBAR Register */
401 /* BRKRES Register */
406 /* UART Registers are handled directly by the serial device */
413 /* XXX: implement a real I2C controller */
417 /* IN = OUT until a real I2C control is implemented */
425 /* I2CINP Register */
427 val
= ((s
->i2cin
& ~1) | eeprom24c0x_read(&spd_eeprom
));
435 /* I2COUT Register */
440 /* I2CSEL Register */
446 qemu_log_mask(LOG_GUEST_ERROR
,
447 "malta_fpga_read: Bad register addr 0x%"HWADDR_PRIX
"\n",
454 static void malta_fpga_write(void *opaque
, hwaddr addr
,
455 uint64_t val
, unsigned size
)
457 MaltaFPGAState
*s
= opaque
;
460 saddr
= (addr
& 0xfffff);
464 /* SWITCH Register */
472 /* LEDBAR Register */
474 s
->leds
= val
& 0xff;
475 malta_fpga_update_display_leds(s
);
478 /* ASCIIWORD Register */
480 snprintf(s
->display_text
, 9, "%08X", (uint32_t)val
);
481 malta_fpga_update_display_ascii(s
);
484 /* ASCIIPOS0 to ASCIIPOS7 Registers */
493 s
->display_text
[(saddr
- 0x00418) >> 3] = (char) val
;
494 malta_fpga_update_display_ascii(s
);
497 /* SOFTRES Register */
500 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET
);
504 /* BRKRES Register */
509 /* UART Registers are handled directly by the serial device */
513 s
->gpout
= val
& 0xff;
518 s
->i2coe
= val
& 0x03;
521 /* I2COUT Register */
523 eeprom24c0x_write(&spd_eeprom
, val
& 0x02, val
& 0x01);
527 /* I2CSEL Register */
529 s
->i2csel
= val
& 0x01;
533 qemu_log_mask(LOG_GUEST_ERROR
,
534 "malta_fpga_write: Bad register addr 0x%"HWADDR_PRIX
"\n",
540 static const MemoryRegionOps malta_fpga_ops
= {
541 .read
= malta_fpga_read
,
542 .write
= malta_fpga_write
,
543 .endianness
= DEVICE_NATIVE_ENDIAN
,
546 static void malta_fpga_reset(void *opaque
)
548 MaltaFPGAState
*s
= opaque
;
558 s
->display_text
[8] = '\0';
559 snprintf(s
->display_text
, 9, " ");
562 static void malta_fgpa_display_event(void *opaque
, QEMUChrEvent event
)
564 MaltaFPGAState
*s
= opaque
;
566 if (event
== CHR_EVENT_OPENED
&& !s
->display_inited
) {
567 qemu_chr_fe_printf(&s
->display
, "\e[HMalta LEDBAR\r\n");
568 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
569 qemu_chr_fe_printf(&s
->display
, "+ +\r\n");
570 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
571 qemu_chr_fe_printf(&s
->display
, "\n");
572 qemu_chr_fe_printf(&s
->display
, "Malta ASCII\r\n");
573 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
574 qemu_chr_fe_printf(&s
->display
, "+ +\r\n");
575 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
576 s
->display_inited
= true;
580 static MaltaFPGAState
*malta_fpga_init(MemoryRegion
*address_space
,
581 hwaddr base
, qemu_irq uart_irq
, Chardev
*uart_chr
)
586 s
= g_new0(MaltaFPGAState
, 1);
588 memory_region_init_io(&s
->iomem
, NULL
, &malta_fpga_ops
, s
,
589 "malta-fpga", 0x100000);
590 memory_region_init_alias(&s
->iomem_lo
, NULL
, "malta-fpga",
591 &s
->iomem
, 0, 0x900);
592 memory_region_init_alias(&s
->iomem_hi
, NULL
, "malta-fpga",
593 &s
->iomem
, 0xa00, 0x100000 - 0xa00);
595 memory_region_add_subregion(address_space
, base
, &s
->iomem_lo
);
596 memory_region_add_subregion(address_space
, base
+ 0xa00, &s
->iomem_hi
);
598 chr
= qemu_chr_new("fpga", "vc:320x200", NULL
);
599 qemu_chr_fe_init(&s
->display
, chr
, NULL
);
600 qemu_chr_fe_set_handlers(&s
->display
, NULL
, NULL
,
601 malta_fgpa_display_event
, NULL
, s
, NULL
, true);
603 s
->uart
= serial_mm_init(address_space
, base
+ 0x900, 3, uart_irq
,
604 230400, uart_chr
, DEVICE_NATIVE_ENDIAN
);
607 qemu_register_reset(malta_fpga_reset
, s
);
612 /* Network support */
613 static void network_init(PCIBus
*pci_bus
)
617 for (i
= 0; i
< nb_nics
; i
++) {
618 NICInfo
*nd
= &nd_table
[i
];
619 const char *default_devaddr
= NULL
;
621 if (i
== 0 && (!nd
->model
|| strcmp(nd
->model
, "pcnet") == 0))
622 /* The malta board has a PCNet card using PCI SLOT 11 */
623 default_devaddr
= "0b";
625 pci_nic_init_nofail(nd
, pci_bus
, "pcnet", default_devaddr
);
629 static void bl_setup_gt64120_jump_kernel(void **p
, uint64_t run_addr
,
630 uint64_t kernel_entry
)
632 static const char pci_pins_cfg
[PCI_NUM_PINS
] = {
633 10, 10, 11, 11 /* PIIX IRQRC[A:D] */
636 /* Bus endianness is always reversed */
637 #if TARGET_BIG_ENDIAN
638 #define cpu_to_gt32(x) (x)
640 #define cpu_to_gt32(x) bswap32(x)
643 /* setup MEM-to-PCI0 mapping as done by YAMON */
645 /* move GT64120 registers from 0x14000000 to 0x1be00000 */
646 bl_gen_write_u32(p
, /* GT_ISD */
647 cpu_mips_phys_to_kseg1(NULL
, 0x14000000 + 0x68),
648 cpu_to_gt32(0x1be00000 << 3));
650 /* setup PCI0 io window to 0x18000000-0x181fffff */
651 bl_gen_write_u32(p
, /* GT_PCI0IOLD */
652 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x48),
653 cpu_to_gt32(0x18000000 << 3));
654 bl_gen_write_u32(p
, /* GT_PCI0IOHD */
655 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x50),
656 cpu_to_gt32(0x08000000 << 3));
658 /* setup PCI0 mem windows */
659 bl_gen_write_u32(p
, /* GT_PCI0M0LD */
660 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x58),
661 cpu_to_gt32(0x10000000 << 3));
662 bl_gen_write_u32(p
, /* GT_PCI0M0HD */
663 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x60),
664 cpu_to_gt32(0x07e00000 << 3));
665 bl_gen_write_u32(p
, /* GT_PCI0M1LD */
666 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x80),
667 cpu_to_gt32(0x18200000 << 3));
668 bl_gen_write_u32(p
, /* GT_PCI0M1HD */
669 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x88),
670 cpu_to_gt32(0x0bc00000 << 3));
675 * The PIIX ISA bridge is on PCI bus 0 dev 10 func 0.
676 * Load the PIIX IRQC[A:D] routing config address, then
677 * write routing configuration to the config data register.
679 bl_gen_write_u32(p
, /* GT_PCI0_CFGADDR */
680 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0xcf8),
681 tswap32((1 << 31) /* ConfigEn */
682 | PCI_BUILD_BDF(0, PIIX4_PCI_DEVFN
) << 8
684 bl_gen_write_u32(p
, /* GT_PCI0_CFGDATA */
685 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0xcfc),
686 tswap32(ldl_be_p(pci_pins_cfg
)));
688 bl_gen_jump_kernel(p
,
689 true, ENVP_VADDR
- 64,
691 * If semihosting is used, arguments have already
692 * been passed, so we preserve $a0.
694 !semihosting_get_argc(), 2,
696 true, ENVP_VADDR
+ 8,
697 true, loaderparams
.ram_low_size
,
701 static void write_bootloader_nanomips(uint8_t *base
, uint64_t run_addr
,
702 uint64_t kernel_entry
)
706 /* Small bootloader */
707 p
= (uint16_t *)base
;
709 stw_p(p
++, 0x2800); stw_p(p
++, 0x001c);
711 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
713 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
715 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
717 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
719 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
721 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
723 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
728 bl_setup_gt64120_jump_kernel((void **)&p
, run_addr
, kernel_entry
);
732 * ROM and pseudo bootloader
734 * The following code implements a very very simple bootloader. It first
735 * loads the registers a0 to a3 to the values expected by the OS, and
736 * then jump at the kernel address.
738 * The bootloader should pass the locations of the kernel arguments and
739 * environment variables tables. Those tables contain the 32-bit address
740 * of NULL terminated strings. The environment variables table should be
741 * terminated by a NULL address.
743 * For a simpler implementation, the number of kernel arguments is fixed
744 * to two (the name of the kernel and the command line), and the two
745 * tables are actually the same one.
747 * The registers a0 to a3 should contain the following values:
748 * a0 - number of kernel arguments
749 * a1 - 32-bit address of the kernel arguments table
750 * a2 - 32-bit address of the environment variables table
751 * a3 - RAM size in bytes
753 static void write_bootloader(uint8_t *base
, uint64_t run_addr
,
754 uint64_t kernel_entry
)
758 /* Small bootloader */
759 p
= (uint32_t *)base
;
761 stl_p(p
++, 0x08000000 | /* j 0x1fc00580 */
762 ((run_addr
+ 0x580) & 0x0fffffff) >> 2);
763 stl_p(p
++, 0x00000000); /* nop */
765 /* YAMON service vector */
766 stl_p(base
+ 0x500, run_addr
+ 0x0580); /* start: */
767 stl_p(base
+ 0x504, run_addr
+ 0x083c); /* print_count: */
768 stl_p(base
+ 0x520, run_addr
+ 0x0580); /* start: */
769 stl_p(base
+ 0x52c, run_addr
+ 0x0800); /* flush_cache: */
770 stl_p(base
+ 0x534, run_addr
+ 0x0808); /* print: */
771 stl_p(base
+ 0x538, run_addr
+ 0x0800); /* reg_cpu_isr: */
772 stl_p(base
+ 0x53c, run_addr
+ 0x0800); /* unred_cpu_isr: */
773 stl_p(base
+ 0x540, run_addr
+ 0x0800); /* reg_ic_isr: */
774 stl_p(base
+ 0x544, run_addr
+ 0x0800); /* unred_ic_isr: */
775 stl_p(base
+ 0x548, run_addr
+ 0x0800); /* reg_esr: */
776 stl_p(base
+ 0x54c, run_addr
+ 0x0800); /* unreg_esr: */
777 stl_p(base
+ 0x550, run_addr
+ 0x0800); /* getchar: */
778 stl_p(base
+ 0x554, run_addr
+ 0x0800); /* syscon_read: */
781 /* Second part of the bootloader */
782 p
= (uint32_t *) (base
+ 0x580);
785 * Load BAR registers as done by YAMON:
787 * - set up PCI0 I/O BARs from 0x18000000 to 0x181fffff
788 * - set up PCI0 MEM0 at 0x10000000, size 0x7e00000
789 * - set up PCI0 MEM1 at 0x18200000, size 0xbc00000
793 bl_setup_gt64120_jump_kernel((void **)&p
, run_addr
, kernel_entry
);
795 /* YAMON subroutines */
796 p
= (uint32_t *) (base
+ 0x800);
797 stl_p(p
++, 0x03e00009); /* jalr ra */
798 stl_p(p
++, 0x24020000); /* li v0,0 */
799 /* 808 YAMON print */
800 stl_p(p
++, 0x03e06821); /* move t5,ra */
801 stl_p(p
++, 0x00805821); /* move t3,a0 */
802 stl_p(p
++, 0x00a05021); /* move t2,a1 */
803 stl_p(p
++, 0x91440000); /* lbu a0,0(t2) */
804 stl_p(p
++, 0x254a0001); /* addiu t2,t2,1 */
805 stl_p(p
++, 0x10800005); /* beqz a0,834 */
806 stl_p(p
++, 0x00000000); /* nop */
807 stl_p(p
++, 0x0ff0021c); /* jal 870 */
808 stl_p(p
++, 0x00000000); /* nop */
809 stl_p(p
++, 0x1000fff9); /* b 814 */
810 stl_p(p
++, 0x00000000); /* nop */
811 stl_p(p
++, 0x01a00009); /* jalr t5 */
812 stl_p(p
++, 0x01602021); /* move a0,t3 */
813 /* 0x83c YAMON print_count */
814 stl_p(p
++, 0x03e06821); /* move t5,ra */
815 stl_p(p
++, 0x00805821); /* move t3,a0 */
816 stl_p(p
++, 0x00a05021); /* move t2,a1 */
817 stl_p(p
++, 0x00c06021); /* move t4,a2 */
818 stl_p(p
++, 0x91440000); /* lbu a0,0(t2) */
819 stl_p(p
++, 0x0ff0021c); /* jal 870 */
820 stl_p(p
++, 0x00000000); /* nop */
821 stl_p(p
++, 0x254a0001); /* addiu t2,t2,1 */
822 stl_p(p
++, 0x258cffff); /* addiu t4,t4,-1 */
823 stl_p(p
++, 0x1580fffa); /* bnez t4,84c */
824 stl_p(p
++, 0x00000000); /* nop */
825 stl_p(p
++, 0x01a00009); /* jalr t5 */
826 stl_p(p
++, 0x01602021); /* move a0,t3 */
828 stl_p(p
++, 0x3c08b800); /* lui t0,0xb400 */
829 stl_p(p
++, 0x350803f8); /* ori t0,t0,0x3f8 */
830 stl_p(p
++, 0x91090005); /* lbu t1,5(t0) */
831 stl_p(p
++, 0x00000000); /* nop */
832 stl_p(p
++, 0x31290040); /* andi t1,t1,0x40 */
833 stl_p(p
++, 0x1120fffc); /* beqz t1,878 <outch+0x8> */
834 stl_p(p
++, 0x00000000); /* nop */
835 stl_p(p
++, 0x03e00009); /* jalr ra */
836 stl_p(p
++, 0xa1040000); /* sb a0,0(t0) */
839 static void G_GNUC_PRINTF(3, 4) prom_set(uint32_t *prom_buf
, int index
,
840 const char *string
, ...)
845 if (index
>= ENVP_NB_ENTRIES
) {
849 if (string
== NULL
) {
854 table_addr
= sizeof(uint32_t) * ENVP_NB_ENTRIES
+ index
* ENVP_ENTRY_SIZE
;
855 prom_buf
[index
] = tswap32(ENVP_VADDR
+ table_addr
);
857 va_start(ap
, string
);
858 vsnprintf((char *)prom_buf
+ table_addr
, ENVP_ENTRY_SIZE
, string
, ap
);
862 static void reinitialize_rng_seed(void *opaque
)
864 char *rng_seed_hex
= opaque
;
865 uint8_t rng_seed
[32];
867 qemu_guest_getrandom_nofail(rng_seed
, sizeof(rng_seed
));
868 for (size_t i
= 0; i
< sizeof(rng_seed
); ++i
) {
869 sprintf(rng_seed_hex
+ i
* 2, "%02x", rng_seed
[i
]);
874 static uint64_t load_kernel(void)
876 uint64_t kernel_entry
, kernel_high
, initrd_size
;
878 ram_addr_t initrd_offset
;
882 uint8_t rng_seed
[32];
883 char rng_seed_hex
[sizeof(rng_seed
) * 2 + 1];
884 size_t rng_seed_prom_offset
;
886 kernel_size
= load_elf(loaderparams
.kernel_filename
, NULL
,
887 cpu_mips_kseg0_to_phys
, NULL
,
889 &kernel_high
, NULL
, TARGET_BIG_ENDIAN
, EM_MIPS
,
891 if (kernel_size
< 0) {
892 error_report("could not load kernel '%s': %s",
893 loaderparams
.kernel_filename
,
894 load_elf_strerror(kernel_size
));
898 /* Check where the kernel has been linked */
899 if (kernel_entry
<= USEG_LIMIT
) {
900 error_report("Trap-and-Emul kernels (Linux CONFIG_KVM_GUEST)"
901 " are not supported");
908 if (loaderparams
.initrd_filename
) {
909 initrd_size
= get_image_size(loaderparams
.initrd_filename
);
910 if (initrd_size
> 0) {
912 * The kernel allocates the bootmap memory in the low memory after
913 * the initrd. It takes at most 128kiB for 2GB RAM and 4kiB
916 initrd_offset
= ROUND_UP(loaderparams
.ram_low_size
917 - (initrd_size
+ 128 * KiB
),
919 if (kernel_high
>= initrd_offset
) {
920 error_report("memory too small for initial ram disk '%s'",
921 loaderparams
.initrd_filename
);
924 initrd_size
= load_image_targphys(loaderparams
.initrd_filename
,
926 loaderparams
.ram_size
- initrd_offset
);
928 if (initrd_size
== (target_ulong
) -1) {
929 error_report("could not load initial ram disk '%s'",
930 loaderparams
.initrd_filename
);
935 /* Setup prom parameters. */
936 prom_size
= ENVP_NB_ENTRIES
* (sizeof(int32_t) + ENVP_ENTRY_SIZE
);
937 prom_buf
= g_malloc(prom_size
);
939 prom_set(prom_buf
, prom_index
++, "%s", loaderparams
.kernel_filename
);
940 if (initrd_size
> 0) {
941 prom_set(prom_buf
, prom_index
++,
942 "rd_start=0x%" PRIx64
" rd_size=%" PRId64
" %s",
943 cpu_mips_phys_to_kseg0(NULL
, initrd_offset
),
944 initrd_size
, loaderparams
.kernel_cmdline
);
946 prom_set(prom_buf
, prom_index
++, "%s", loaderparams
.kernel_cmdline
);
949 prom_set(prom_buf
, prom_index
++, "memsize");
950 prom_set(prom_buf
, prom_index
++, "%u", loaderparams
.ram_low_size
);
952 prom_set(prom_buf
, prom_index
++, "ememsize");
953 prom_set(prom_buf
, prom_index
++, "%u", loaderparams
.ram_size
);
955 prom_set(prom_buf
, prom_index
++, "modetty0");
956 prom_set(prom_buf
, prom_index
++, "38400n8r");
958 qemu_guest_getrandom_nofail(rng_seed
, sizeof(rng_seed
));
959 for (size_t i
= 0; i
< sizeof(rng_seed
); ++i
) {
960 sprintf(rng_seed_hex
+ i
* 2, "%02x", rng_seed
[i
]);
962 prom_set(prom_buf
, prom_index
++, "rngseed");
963 rng_seed_prom_offset
= prom_index
* ENVP_ENTRY_SIZE
+
964 sizeof(uint32_t) * ENVP_NB_ENTRIES
;
965 prom_set(prom_buf
, prom_index
++, "%s", rng_seed_hex
);
967 prom_set(prom_buf
, prom_index
++, NULL
);
969 rom_add_blob_fixed("prom", prom_buf
, prom_size
, ENVP_PADDR
);
970 qemu_register_reset_nosnapshotload(reinitialize_rng_seed
,
971 rom_ptr(ENVP_PADDR
, prom_size
) + rng_seed_prom_offset
);
977 static void malta_mips_config(MIPSCPU
*cpu
)
979 MachineState
*ms
= MACHINE(qdev_get_machine());
980 unsigned int smp_cpus
= ms
->smp
.cpus
;
981 CPUMIPSState
*env
= &cpu
->env
;
982 CPUState
*cs
= CPU(cpu
);
984 if (ase_mt_available(env
)) {
985 env
->mvp
->CP0_MVPConf0
= deposit32(env
->mvp
->CP0_MVPConf0
,
987 smp_cpus
* cs
->nr_threads
- 1);
988 env
->mvp
->CP0_MVPConf0
= deposit32(env
->mvp
->CP0_MVPConf0
,
989 CP0MVPC0_PVPE
, 4, smp_cpus
- 1);
993 static int malta_pci_slot_get_pirq(PCIDevice
*pci_dev
, int irq_num
)
997 slot
= PCI_SLOT(pci_dev
->devfn
);
1003 /* AMD 79C973 Ethernet */
1006 /* Crystal 4281 Sound */
1009 /* PCI slot 1 to 4 */
1011 return ((slot
- 18) + irq_num
) & 0x03;
1012 /* Unknown device, don't do any translation */
1018 static void main_cpu_reset(void *opaque
)
1020 MIPSCPU
*cpu
= opaque
;
1021 CPUMIPSState
*env
= &cpu
->env
;
1023 cpu_reset(CPU(cpu
));
1026 * The bootloader does not need to be rewritten as it is located in a
1027 * read only location. The kernel location and the arguments table
1028 * location does not change.
1030 if (loaderparams
.kernel_filename
) {
1031 env
->CP0_Status
&= ~(1 << CP0St_ERL
);
1034 malta_mips_config(cpu
);
1037 static void create_cpu_without_cps(MachineState
*ms
, MaltaState
*s
,
1038 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
1044 for (i
= 0; i
< ms
->smp
.cpus
; i
++) {
1045 cpu
= mips_cpu_create_with_clock(ms
->cpu_type
, s
->cpuclk
);
1047 /* Init internal devices */
1048 cpu_mips_irq_init_cpu(cpu
);
1049 cpu_mips_clock_init(cpu
);
1050 qemu_register_reset(main_cpu_reset
, cpu
);
1053 cpu
= MIPS_CPU(first_cpu
);
1055 *i8259_irq
= env
->irq
[2];
1056 *cbus_irq
= env
->irq
[4];
1059 static void create_cps(MachineState
*ms
, MaltaState
*s
,
1060 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
1062 object_initialize_child(OBJECT(s
), "cps", &s
->cps
, TYPE_MIPS_CPS
);
1063 object_property_set_str(OBJECT(&s
->cps
), "cpu-type", ms
->cpu_type
,
1065 object_property_set_uint(OBJECT(&s
->cps
), "num-vp", ms
->smp
.cpus
,
1067 qdev_connect_clock_in(DEVICE(&s
->cps
), "clk-in", s
->cpuclk
);
1068 sysbus_realize(SYS_BUS_DEVICE(&s
->cps
), &error_fatal
);
1070 sysbus_mmio_map_overlap(SYS_BUS_DEVICE(&s
->cps
), 0, 0, 1);
1072 *i8259_irq
= get_cps_irq(&s
->cps
, 3);
1076 static void mips_create_cpu(MachineState
*ms
, MaltaState
*s
,
1077 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
1079 if ((ms
->smp
.cpus
> 1) && cpu_type_supports_cps_smp(ms
->cpu_type
)) {
1080 create_cps(ms
, s
, cbus_irq
, i8259_irq
);
1082 create_cpu_without_cps(ms
, s
, cbus_irq
, i8259_irq
);
1087 void mips_malta_init(MachineState
*machine
)
1089 ram_addr_t ram_size
= machine
->ram_size
;
1090 ram_addr_t ram_low_size
;
1091 const char *kernel_filename
= machine
->kernel_filename
;
1092 const char *kernel_cmdline
= machine
->kernel_cmdline
;
1093 const char *initrd_filename
= machine
->initrd_filename
;
1096 MemoryRegion
*system_memory
= get_system_memory();
1097 MemoryRegion
*ram_low_preio
= g_new(MemoryRegion
, 1);
1098 MemoryRegion
*ram_low_postio
;
1099 MemoryRegion
*bios
, *bios_copy
= g_new(MemoryRegion
, 1);
1100 const size_t smbus_eeprom_size
= 8 * 256;
1101 uint8_t *smbus_eeprom_buf
= g_malloc0(smbus_eeprom_size
);
1102 uint64_t kernel_entry
, bootloader_run_addr
;
1105 qemu_irq cbus_irq
, i8259_irq
;
1113 s
= MIPS_MALTA(qdev_new(TYPE_MIPS_MALTA
));
1114 sysbus_realize_and_unref(SYS_BUS_DEVICE(s
), &error_fatal
);
1117 mips_create_cpu(machine
, s
, &cbus_irq
, &i8259_irq
);
1120 if (ram_size
> 2 * GiB
) {
1121 error_report("Too much memory for this machine: %" PRId64
"MB,"
1122 " maximum 2048MB", ram_size
/ MiB
);
1126 /* register RAM at high address where it is undisturbed by IO */
1127 memory_region_add_subregion(system_memory
, 0x80000000, machine
->ram
);
1129 /* alias for pre IO hole access */
1130 memory_region_init_alias(ram_low_preio
, NULL
, "mips_malta_low_preio.ram",
1131 machine
->ram
, 0, MIN(ram_size
, 256 * MiB
));
1132 memory_region_add_subregion(system_memory
, 0, ram_low_preio
);
1134 /* alias for post IO hole access, if there is enough RAM */
1135 if (ram_size
> 512 * MiB
) {
1136 ram_low_postio
= g_new(MemoryRegion
, 1);
1137 memory_region_init_alias(ram_low_postio
, NULL
,
1138 "mips_malta_low_postio.ram",
1139 machine
->ram
, 512 * MiB
,
1140 ram_size
- 512 * MiB
);
1141 memory_region_add_subregion(system_memory
, 512 * MiB
,
1147 /* The CBUS UART is attached to the MIPS CPU INT2 pin, ie interrupt 4 */
1148 malta_fpga_init(system_memory
, FPGA_ADDRESS
, cbus_irq
, serial_hd(2));
1150 /* Load firmware in flash / BIOS. */
1151 dinfo
= drive_get(IF_PFLASH
, 0, fl_idx
);
1152 fl
= pflash_cfi01_register(FLASH_ADDRESS
, "mips_malta.bios",
1154 dinfo
? blk_by_legacy_dinfo(dinfo
) : NULL
,
1156 4, 0x0000, 0x0000, 0x0000, 0x0000,
1158 bios
= pflash_cfi01_get_memory(fl
);
1160 if (kernel_filename
) {
1161 ram_low_size
= MIN(ram_size
, 256 * MiB
);
1162 bootloader_run_addr
= cpu_mips_phys_to_kseg0(NULL
, RESET_ADDRESS
);
1164 /* Write a small bootloader to the flash location. */
1165 loaderparams
.ram_size
= ram_size
;
1166 loaderparams
.ram_low_size
= ram_low_size
;
1167 loaderparams
.kernel_filename
= kernel_filename
;
1168 loaderparams
.kernel_cmdline
= kernel_cmdline
;
1169 loaderparams
.initrd_filename
= initrd_filename
;
1170 kernel_entry
= load_kernel();
1172 if (!cpu_type_supports_isa(machine
->cpu_type
, ISA_NANOMIPS32
)) {
1173 write_bootloader(memory_region_get_ram_ptr(bios
),
1174 bootloader_run_addr
, kernel_entry
);
1176 write_bootloader_nanomips(memory_region_get_ram_ptr(bios
),
1177 bootloader_run_addr
, kernel_entry
);
1180 target_long bios_size
= FLASH_SIZE
;
1181 /* Load firmware from flash. */
1183 /* Load a BIOS image. */
1184 filename
= qemu_find_file(QEMU_FILE_TYPE_BIOS
,
1185 machine
->firmware
?: BIOS_FILENAME
);
1187 bios_size
= load_image_targphys(filename
, FLASH_ADDRESS
,
1193 if ((bios_size
< 0 || bios_size
> BIOS_SIZE
) &&
1194 machine
->firmware
&& !qtest_enabled()) {
1195 error_report("Could not load MIPS bios '%s'", machine
->firmware
);
1200 * In little endian mode the 32bit words in the bios are swapped,
1201 * a neat trick which allows bi-endian firmware.
1203 #if !TARGET_BIG_ENDIAN
1205 uint32_t *end
, *addr
;
1206 const size_t swapsize
= MIN(bios_size
, 0x3e0000);
1207 addr
= rom_ptr(FLASH_ADDRESS
, swapsize
);
1209 addr
= memory_region_get_ram_ptr(bios
);
1211 end
= (void *)addr
+ swapsize
;
1212 while (addr
< end
) {
1221 * Map the BIOS at a 2nd physical location, as on the real board.
1222 * Copy it so that we can patch in the MIPS revision, which cannot be
1223 * handled by an overlapping region as the resulting ROM code subpage
1224 * regions are not executable.
1226 memory_region_init_ram(bios_copy
, NULL
, "bios.1fc", BIOS_SIZE
,
1228 if (!rom_copy(memory_region_get_ram_ptr(bios_copy
),
1229 FLASH_ADDRESS
, BIOS_SIZE
)) {
1230 memcpy(memory_region_get_ram_ptr(bios_copy
),
1231 memory_region_get_ram_ptr(bios
), BIOS_SIZE
);
1233 memory_region_set_readonly(bios_copy
, true);
1234 memory_region_add_subregion(system_memory
, RESET_ADDRESS
, bios_copy
);
1236 /* Board ID = 0x420 (Malta Board with CoreLV) */
1237 stl_p(memory_region_get_ram_ptr(bios_copy
) + 0x10, 0x00000420);
1240 dev
= qdev_new("gt64120");
1241 qdev_prop_set_bit(dev
, "cpu-little-endian", !TARGET_BIG_ENDIAN
);
1242 sysbus_realize_and_unref(SYS_BUS_DEVICE(dev
), &error_fatal
);
1243 pci_bus
= PCI_BUS(qdev_get_child_bus(dev
, "pci"));
1244 pci_bus_map_irqs(pci_bus
, malta_pci_slot_get_pirq
);
1247 piix4
= pci_new_multifunction(PIIX4_PCI_DEVFN
, TYPE_PIIX4_PCI_DEVICE
);
1248 qdev_prop_set_uint32(DEVICE(piix4
), "smb_io_base", 0x1100);
1249 pci_realize_and_unref(piix4
, pci_bus
, &error_fatal
);
1250 isa_bus
= ISA_BUS(qdev_get_child_bus(DEVICE(piix4
), "isa.0"));
1252 dev
= DEVICE(object_resolve_path_component(OBJECT(piix4
), "ide"));
1253 pci_ide_create_devs(PCI_DEVICE(dev
));
1255 /* Interrupt controller */
1256 qdev_connect_gpio_out_named(DEVICE(piix4
), "intr", 0, i8259_irq
);
1258 /* generate SPD EEPROM data */
1259 dev
= DEVICE(object_resolve_path_component(OBJECT(piix4
), "pm"));
1260 smbus
= I2C_BUS(qdev_get_child_bus(dev
, "i2c"));
1261 generate_eeprom_spd(&smbus_eeprom_buf
[0 * 256], ram_size
);
1262 generate_eeprom_serial(&smbus_eeprom_buf
[6 * 256]);
1263 smbus_eeprom_init(smbus
, 8, smbus_eeprom_buf
, smbus_eeprom_size
);
1264 g_free(smbus_eeprom_buf
);
1266 /* Super I/O: SMS FDC37M817 */
1267 isa_create_simple(isa_bus
, TYPE_FDC37M81X_SUPERIO
);
1270 network_init(pci_bus
);
1272 /* Optional PCI video card */
1273 pci_vga_init(pci_bus
);
1276 static void mips_malta_instance_init(Object
*obj
)
1278 MaltaState
*s
= MIPS_MALTA(obj
);
1280 s
->cpuclk
= qdev_init_clock_out(DEVICE(obj
), "cpu-refclk");
1281 clock_set_hz(s
->cpuclk
, 320000000); /* 320 MHz */
1284 static const TypeInfo mips_malta_device
= {
1285 .name
= TYPE_MIPS_MALTA
,
1286 .parent
= TYPE_SYS_BUS_DEVICE
,
1287 .instance_size
= sizeof(MaltaState
),
1288 .instance_init
= mips_malta_instance_init
,
1291 GlobalProperty malta_compat
[] = {
1292 { "PIIX4_PM", "memory-hotplug-support", "off" },
1293 { "PIIX4_PM", "acpi-pci-hotplug-with-bridge-support", "off" },
1294 { "PIIX4_PM", "acpi-root-pci-hotplug", "off" },
1295 { "PIIX4_PM", "x-not-migrate-acpi-index", "true" },
1297 const size_t malta_compat_len
= G_N_ELEMENTS(malta_compat
);
1299 static void mips_malta_machine_init(MachineClass
*mc
)
1301 mc
->desc
= "MIPS Malta Core LV";
1302 mc
->init
= mips_malta_init
;
1303 mc
->block_default_type
= IF_IDE
;
1305 mc
->is_default
= true;
1306 #ifdef TARGET_MIPS64
1307 mc
->default_cpu_type
= MIPS_CPU_TYPE_NAME("20Kc");
1309 mc
->default_cpu_type
= MIPS_CPU_TYPE_NAME("24Kf");
1311 mc
->default_ram_id
= "mips_malta.ram";
1312 compat_props_add(mc
->compat_props
, malta_compat
, malta_compat_len
);
1315 DEFINE_MACHINE("malta", mips_malta_machine_init
)
1317 static void mips_malta_register_types(void)
1319 type_register_static(&mips_malta_device
);
1322 type_init(mips_malta_register_types
)