2 * QEMU Malta board support
4 * Copyright (c) 2006 Aurelien Jarno
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 #include "qemu/osdep.h"
26 #include "qemu/units.h"
27 #include "qemu/bitops.h"
28 #include "qemu/datadir.h"
29 #include "qemu/guest-random.h"
31 #include "hw/southbridge/piix.h"
32 #include "hw/isa/superio.h"
33 #include "hw/char/serial.h"
35 #include "hw/boards.h"
36 #include "hw/i2c/smbus_eeprom.h"
37 #include "hw/block/flash.h"
38 #include "hw/mips/mips.h"
39 #include "hw/mips/bootloader.h"
40 #include "hw/pci/pci.h"
41 #include "hw/pci/pci_bus.h"
43 #include "hw/mips/bios.h"
44 #include "hw/ide/pci.h"
46 #include "hw/loader.h"
48 #include "qom/object.h"
49 #include "hw/sysbus.h" /* SysBusDevice */
50 #include "qemu/host-utils.h"
51 #include "sysemu/qtest.h"
52 #include "sysemu/reset.h"
53 #include "sysemu/runstate.h"
54 #include "qapi/error.h"
55 #include "qemu/error-report.h"
56 #include "sysemu/kvm.h"
57 #include "semihosting/semihost.h"
58 #include "hw/mips/cps.h"
59 #include "hw/qdev-clock.h"
60 #include "target/mips/internal.h"
63 #define ENVP_PADDR 0x2000
64 #define ENVP_VADDR cpu_mips_phys_to_kseg0(NULL, ENVP_PADDR)
65 #define ENVP_NB_ENTRIES 16
66 #define ENVP_ENTRY_SIZE 256
68 /* Hardware addresses */
69 #define FLASH_ADDRESS 0x1e000000ULL
70 #define FPGA_ADDRESS 0x1f000000ULL
71 #define RESET_ADDRESS 0x1fc00000ULL
73 #define FLASH_SIZE 0x400000
75 #define PIIX4_PCI_DEVFN PCI_DEVFN(10, 0)
79 MemoryRegion iomem_lo
; /* 0 - 0x900 */
80 MemoryRegion iomem_hi
; /* 0xa00 - 0x100000 */
94 #define TYPE_MIPS_MALTA "mips-malta"
95 OBJECT_DECLARE_SIMPLE_TYPE(MaltaState
, MIPS_MALTA
)
98 SysBusDevice parent_obj
;
104 static struct _loaderparams
{
105 int ram_size
, ram_low_size
;
106 const char *kernel_filename
;
107 const char *kernel_cmdline
;
108 const char *initrd_filename
;
112 static void malta_fpga_update_display_leds(MaltaFPGAState
*s
)
117 for (i
= 7 ; i
>= 0 ; i
--) {
118 if (s
->leds
& (1 << i
)) {
126 trace_malta_fpga_leds(leds_text
);
127 qemu_chr_fe_printf(&s
->display
, "\e[H\n\n|\e[32m%-8.8s\e[00m|\r\n",
131 static void malta_fpga_update_display_ascii(MaltaFPGAState
*s
)
133 trace_malta_fpga_display(s
->display_text
);
134 qemu_chr_fe_printf(&s
->display
, "\n\n\n\n|\e[31m%-8.8s\e[00m|",
139 * EEPROM 24C01 / 24C02 emulation.
141 * Emulation for serial EEPROMs:
142 * 24C01 - 1024 bit (128 x 8)
143 * 24C02 - 2048 bit (256 x 8)
145 * Typical device names include Microchip 24C02SC or SGS Thomson ST24C02.
149 # define logout(fmt, ...) \
150 fprintf(stderr, "MALTA\t%-24s" fmt, __func__, ## __VA_ARGS__)
152 # define logout(fmt, ...) ((void)0)
155 struct _eeprom24c0x_t
{
164 uint8_t contents
[256];
167 typedef struct _eeprom24c0x_t eeprom24c0x_t
;
169 static eeprom24c0x_t spd_eeprom
= {
172 0x80, 0x08, 0xFF, 0x0D, 0x0A, 0xFF, 0x40, 0x00,
174 0x01, 0x75, 0x54, 0x00, 0x82, 0x08, 0x00, 0x01,
176 0x8F, 0x04, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00,
178 0x00, 0x00, 0x00, 0x14, 0x0F, 0x14, 0x2D, 0xFF,
180 0x15, 0x08, 0x15, 0x08, 0x00, 0x00, 0x00, 0x00,
182 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
184 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
186 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0xD0,
188 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
190 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
192 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
194 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
196 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
198 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
200 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
202 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x64, 0xF4,
206 static void generate_eeprom_spd(uint8_t *eeprom
, ram_addr_t ram_size
)
208 enum sdram_type type
;
209 uint8_t *spd
= spd_eeprom
.contents
;
211 uint16_t density
= 0;
214 /* work in terms of MB */
217 while ((ram_size
>= 4) && (nbanks
<= 2)) {
218 int sz_log2
= MIN(31 - clz32(ram_size
), 14);
220 density
|= 1 << (sz_log2
- 2);
221 ram_size
-= 1 << sz_log2
;
224 /* split to 2 banks if possible */
225 if ((nbanks
== 1) && (density
> 1)) {
230 if (density
& 0xff00) {
231 density
= (density
& 0xe0) | ((density
>> 8) & 0x1f);
233 } else if (!(density
& 0x1f)) {
240 warn_report("SPD cannot represent final " RAM_ADDR_FMT
"MB"
241 " of SDRAM", ram_size
);
244 /* fill in SPD memory information */
251 for (i
= 0; i
< 63; i
++) {
256 memcpy(eeprom
, spd
, sizeof(spd_eeprom
.contents
));
259 static void generate_eeprom_serial(uint8_t *eeprom
)
262 uint8_t mac
[6] = { 0x00 };
263 uint8_t sn
[5] = { 0x01, 0x23, 0x45, 0x67, 0x89 };
266 eeprom
[pos
++] = 0x01;
269 eeprom
[pos
++] = 0x02;
272 eeprom
[pos
++] = 0x01; /* MAC */
273 eeprom
[pos
++] = 0x06; /* length */
274 memcpy(&eeprom
[pos
], mac
, sizeof(mac
));
278 eeprom
[pos
++] = 0x02; /* serial */
279 eeprom
[pos
++] = 0x05; /* length */
280 memcpy(&eeprom
[pos
], sn
, sizeof(sn
));
285 for (i
= 0; i
< pos
; i
++) {
286 eeprom
[pos
] += eeprom
[i
];
290 static uint8_t eeprom24c0x_read(eeprom24c0x_t
*eeprom
)
292 logout("%u: scl = %u, sda = %u, data = 0x%02x\n",
293 eeprom
->tick
, eeprom
->scl
, eeprom
->sda
, eeprom
->data
);
297 static void eeprom24c0x_write(eeprom24c0x_t
*eeprom
, int scl
, int sda
)
299 if (eeprom
->scl
&& scl
&& (eeprom
->sda
!= sda
)) {
300 logout("%u: scl = %u->%u, sda = %u->%u i2c %s\n",
301 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
,
302 sda
? "stop" : "start");
307 } else if (eeprom
->tick
== 0 && !eeprom
->ack
) {
308 /* Waiting for start. */
309 logout("%u: scl = %u->%u, sda = %u->%u wait for i2c start\n",
310 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
);
311 } else if (!eeprom
->scl
&& scl
) {
312 logout("%u: scl = %u->%u, sda = %u->%u trigger bit\n",
313 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
);
315 logout("\ti2c ack bit = 0\n");
318 } else if (eeprom
->sda
== sda
) {
319 uint8_t bit
= (sda
!= 0);
320 logout("\ti2c bit = %d\n", bit
);
321 if (eeprom
->tick
< 9) {
322 eeprom
->command
<<= 1;
323 eeprom
->command
+= bit
;
325 if (eeprom
->tick
== 9) {
326 logout("\tcommand 0x%04x, %s\n", eeprom
->command
,
327 bit
? "read" : "write");
330 } else if (eeprom
->tick
< 17) {
331 if (eeprom
->command
& 1) {
332 sda
= ((eeprom
->data
& 0x80) != 0);
334 eeprom
->address
<<= 1;
335 eeprom
->address
+= bit
;
338 if (eeprom
->tick
== 17) {
339 eeprom
->data
= eeprom
->contents
[eeprom
->address
];
340 logout("\taddress 0x%04x, data 0x%02x\n",
341 eeprom
->address
, eeprom
->data
);
345 } else if (eeprom
->tick
>= 17) {
349 logout("\tsda changed with raising scl\n");
352 logout("%u: scl = %u->%u, sda = %u->%u\n", eeprom
->tick
, eeprom
->scl
,
353 scl
, eeprom
->sda
, sda
);
359 static uint64_t malta_fpga_read(void *opaque
, hwaddr addr
,
362 MaltaFPGAState
*s
= opaque
;
366 saddr
= (addr
& 0xfffff);
370 /* SWITCH Register */
375 /* STATUS Register */
377 #if TARGET_BIG_ENDIAN
389 /* LEDBAR Register */
394 /* BRKRES Register */
399 /* UART Registers are handled directly by the serial device */
406 /* XXX: implement a real I2C controller */
410 /* IN = OUT until a real I2C control is implemented */
418 /* I2CINP Register */
420 val
= ((s
->i2cin
& ~1) | eeprom24c0x_read(&spd_eeprom
));
428 /* I2COUT Register */
433 /* I2CSEL Register */
439 qemu_log_mask(LOG_GUEST_ERROR
,
440 "malta_fpga_read: Bad register addr 0x%"HWADDR_PRIX
"\n",
447 static void malta_fpga_write(void *opaque
, hwaddr addr
,
448 uint64_t val
, unsigned size
)
450 MaltaFPGAState
*s
= opaque
;
453 saddr
= (addr
& 0xfffff);
457 /* SWITCH Register */
465 /* LEDBAR Register */
467 s
->leds
= val
& 0xff;
468 malta_fpga_update_display_leds(s
);
471 /* ASCIIWORD Register */
473 snprintf(s
->display_text
, 9, "%08X", (uint32_t)val
);
474 malta_fpga_update_display_ascii(s
);
477 /* ASCIIPOS0 to ASCIIPOS7 Registers */
486 s
->display_text
[(saddr
- 0x00418) >> 3] = (char) val
;
487 malta_fpga_update_display_ascii(s
);
490 /* SOFTRES Register */
493 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET
);
497 /* BRKRES Register */
502 /* UART Registers are handled directly by the serial device */
506 s
->gpout
= val
& 0xff;
511 s
->i2coe
= val
& 0x03;
514 /* I2COUT Register */
516 eeprom24c0x_write(&spd_eeprom
, val
& 0x02, val
& 0x01);
520 /* I2CSEL Register */
522 s
->i2csel
= val
& 0x01;
526 qemu_log_mask(LOG_GUEST_ERROR
,
527 "malta_fpga_write: Bad register addr 0x%"HWADDR_PRIX
"\n",
533 static const MemoryRegionOps malta_fpga_ops
= {
534 .read
= malta_fpga_read
,
535 .write
= malta_fpga_write
,
536 .endianness
= DEVICE_NATIVE_ENDIAN
,
539 static void malta_fpga_reset(void *opaque
)
541 MaltaFPGAState
*s
= opaque
;
551 s
->display_text
[8] = '\0';
552 snprintf(s
->display_text
, 9, " ");
555 static void malta_fgpa_display_event(void *opaque
, QEMUChrEvent event
)
557 MaltaFPGAState
*s
= opaque
;
559 if (event
== CHR_EVENT_OPENED
&& !s
->display_inited
) {
560 qemu_chr_fe_printf(&s
->display
, "\e[HMalta LEDBAR\r\n");
561 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
562 qemu_chr_fe_printf(&s
->display
, "+ +\r\n");
563 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
564 qemu_chr_fe_printf(&s
->display
, "\n");
565 qemu_chr_fe_printf(&s
->display
, "Malta ASCII\r\n");
566 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
567 qemu_chr_fe_printf(&s
->display
, "+ +\r\n");
568 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
569 s
->display_inited
= true;
573 static MaltaFPGAState
*malta_fpga_init(MemoryRegion
*address_space
,
574 hwaddr base
, qemu_irq uart_irq
, Chardev
*uart_chr
)
579 s
= g_new0(MaltaFPGAState
, 1);
581 memory_region_init_io(&s
->iomem
, NULL
, &malta_fpga_ops
, s
,
582 "malta-fpga", 0x100000);
583 memory_region_init_alias(&s
->iomem_lo
, NULL
, "malta-fpga",
584 &s
->iomem
, 0, 0x900);
585 memory_region_init_alias(&s
->iomem_hi
, NULL
, "malta-fpga",
586 &s
->iomem
, 0xa00, 0x100000 - 0xa00);
588 memory_region_add_subregion(address_space
, base
, &s
->iomem_lo
);
589 memory_region_add_subregion(address_space
, base
+ 0xa00, &s
->iomem_hi
);
591 chr
= qemu_chr_new("fpga", "vc:320x200", NULL
);
592 qemu_chr_fe_init(&s
->display
, chr
, NULL
);
593 qemu_chr_fe_set_handlers(&s
->display
, NULL
, NULL
,
594 malta_fgpa_display_event
, NULL
, s
, NULL
, true);
596 s
->uart
= serial_mm_init(address_space
, base
+ 0x900, 3, uart_irq
,
597 230400, uart_chr
, DEVICE_NATIVE_ENDIAN
);
600 qemu_register_reset(malta_fpga_reset
, s
);
605 /* Network support */
606 static void network_init(PCIBus
*pci_bus
)
610 for (i
= 0; i
< nb_nics
; i
++) {
611 NICInfo
*nd
= &nd_table
[i
];
612 const char *default_devaddr
= NULL
;
614 if (i
== 0 && (!nd
->model
|| strcmp(nd
->model
, "pcnet") == 0))
615 /* The malta board has a PCNet card using PCI SLOT 11 */
616 default_devaddr
= "0b";
618 pci_nic_init_nofail(nd
, pci_bus
, "pcnet", default_devaddr
);
622 static void bl_setup_gt64120_jump_kernel(void **p
, uint64_t run_addr
,
623 uint64_t kernel_entry
)
625 static const char pci_pins_cfg
[PCI_NUM_PINS
] = {
626 10, 10, 11, 11 /* PIIX IRQRC[A:D] */
629 /* Bus endianness is always reversed */
630 #if TARGET_BIG_ENDIAN
631 #define cpu_to_gt32(x) (x)
633 #define cpu_to_gt32(x) bswap32(x)
636 /* setup MEM-to-PCI0 mapping as done by YAMON */
638 /* move GT64120 registers from 0x14000000 to 0x1be00000 */
639 bl_gen_write_u32(p
, /* GT_ISD */
640 cpu_mips_phys_to_kseg1(NULL
, 0x14000000 + 0x68),
641 cpu_to_gt32(0x1be00000 << 3));
643 /* setup PCI0 io window to 0x18000000-0x181fffff */
644 bl_gen_write_u32(p
, /* GT_PCI0IOLD */
645 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x48),
646 cpu_to_gt32(0x18000000 << 3));
647 bl_gen_write_u32(p
, /* GT_PCI0IOHD */
648 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x50),
649 cpu_to_gt32(0x08000000 << 3));
651 /* setup PCI0 mem windows */
652 bl_gen_write_u32(p
, /* GT_PCI0M0LD */
653 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x58),
654 cpu_to_gt32(0x10000000 << 3));
655 bl_gen_write_u32(p
, /* GT_PCI0M0HD */
656 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x60),
657 cpu_to_gt32(0x07e00000 << 3));
658 bl_gen_write_u32(p
, /* GT_PCI0M1LD */
659 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x80),
660 cpu_to_gt32(0x18200000 << 3));
661 bl_gen_write_u32(p
, /* GT_PCI0M1HD */
662 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x88),
663 cpu_to_gt32(0x0bc00000 << 3));
668 * The PIIX ISA bridge is on PCI bus 0 dev 10 func 0.
669 * Load the PIIX IRQC[A:D] routing config address, then
670 * write routing configuration to the config data register.
672 bl_gen_write_u32(p
, /* GT_PCI0_CFGADDR */
673 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0xcf8),
674 tswap32((1 << 31) /* ConfigEn */
675 | PCI_BUILD_BDF(0, PIIX4_PCI_DEVFN
) << 8
677 bl_gen_write_u32(p
, /* GT_PCI0_CFGDATA */
678 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0xcfc),
679 tswap32(ldl_be_p(pci_pins_cfg
)));
681 bl_gen_jump_kernel(p
,
682 true, ENVP_VADDR
- 64,
684 * If semihosting is used, arguments have already
685 * been passed, so we preserve $a0.
687 !semihosting_get_argc(), 2,
689 true, ENVP_VADDR
+ 8,
690 true, loaderparams
.ram_low_size
,
694 static void write_bootloader_nanomips(uint8_t *base
, uint64_t run_addr
,
695 uint64_t kernel_entry
)
699 /* Small bootloader */
700 p
= (uint16_t *)base
;
702 stw_p(p
++, 0x2800); stw_p(p
++, 0x001c);
704 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
706 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
708 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
710 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
712 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
714 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
716 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
721 bl_setup_gt64120_jump_kernel((void **)&p
, run_addr
, kernel_entry
);
725 * ROM and pseudo bootloader
727 * The following code implements a very very simple bootloader. It first
728 * loads the registers a0 to a3 to the values expected by the OS, and
729 * then jump at the kernel address.
731 * The bootloader should pass the locations of the kernel arguments and
732 * environment variables tables. Those tables contain the 32-bit address
733 * of NULL terminated strings. The environment variables table should be
734 * terminated by a NULL address.
736 * For a simpler implementation, the number of kernel arguments is fixed
737 * to two (the name of the kernel and the command line), and the two
738 * tables are actually the same one.
740 * The registers a0 to a3 should contain the following values:
741 * a0 - number of kernel arguments
742 * a1 - 32-bit address of the kernel arguments table
743 * a2 - 32-bit address of the environment variables table
744 * a3 - RAM size in bytes
746 static void write_bootloader(uint8_t *base
, uint64_t run_addr
,
747 uint64_t kernel_entry
)
751 /* Small bootloader */
752 p
= (uint32_t *)base
;
754 stl_p(p
++, 0x08000000 | /* j 0x1fc00580 */
755 ((run_addr
+ 0x580) & 0x0fffffff) >> 2);
756 stl_p(p
++, 0x00000000); /* nop */
758 /* YAMON service vector */
759 stl_p(base
+ 0x500, run_addr
+ 0x0580); /* start: */
760 stl_p(base
+ 0x504, run_addr
+ 0x083c); /* print_count: */
761 stl_p(base
+ 0x520, run_addr
+ 0x0580); /* start: */
762 stl_p(base
+ 0x52c, run_addr
+ 0x0800); /* flush_cache: */
763 stl_p(base
+ 0x534, run_addr
+ 0x0808); /* print: */
764 stl_p(base
+ 0x538, run_addr
+ 0x0800); /* reg_cpu_isr: */
765 stl_p(base
+ 0x53c, run_addr
+ 0x0800); /* unred_cpu_isr: */
766 stl_p(base
+ 0x540, run_addr
+ 0x0800); /* reg_ic_isr: */
767 stl_p(base
+ 0x544, run_addr
+ 0x0800); /* unred_ic_isr: */
768 stl_p(base
+ 0x548, run_addr
+ 0x0800); /* reg_esr: */
769 stl_p(base
+ 0x54c, run_addr
+ 0x0800); /* unreg_esr: */
770 stl_p(base
+ 0x550, run_addr
+ 0x0800); /* getchar: */
771 stl_p(base
+ 0x554, run_addr
+ 0x0800); /* syscon_read: */
774 /* Second part of the bootloader */
775 p
= (uint32_t *) (base
+ 0x580);
778 * Load BAR registers as done by YAMON:
780 * - set up PCI0 I/O BARs from 0x18000000 to 0x181fffff
781 * - set up PCI0 MEM0 at 0x10000000, size 0x7e00000
782 * - set up PCI0 MEM1 at 0x18200000, size 0xbc00000
786 bl_setup_gt64120_jump_kernel((void **)&p
, run_addr
, kernel_entry
);
788 /* YAMON subroutines */
789 p
= (uint32_t *) (base
+ 0x800);
790 stl_p(p
++, 0x03e00009); /* jalr ra */
791 stl_p(p
++, 0x24020000); /* li v0,0 */
792 /* 808 YAMON print */
793 stl_p(p
++, 0x03e06821); /* move t5,ra */
794 stl_p(p
++, 0x00805821); /* move t3,a0 */
795 stl_p(p
++, 0x00a05021); /* move t2,a1 */
796 stl_p(p
++, 0x91440000); /* lbu a0,0(t2) */
797 stl_p(p
++, 0x254a0001); /* addiu t2,t2,1 */
798 stl_p(p
++, 0x10800005); /* beqz a0,834 */
799 stl_p(p
++, 0x00000000); /* nop */
800 stl_p(p
++, 0x0ff0021c); /* jal 870 */
801 stl_p(p
++, 0x00000000); /* nop */
802 stl_p(p
++, 0x1000fff9); /* b 814 */
803 stl_p(p
++, 0x00000000); /* nop */
804 stl_p(p
++, 0x01a00009); /* jalr t5 */
805 stl_p(p
++, 0x01602021); /* move a0,t3 */
806 /* 0x83c YAMON print_count */
807 stl_p(p
++, 0x03e06821); /* move t5,ra */
808 stl_p(p
++, 0x00805821); /* move t3,a0 */
809 stl_p(p
++, 0x00a05021); /* move t2,a1 */
810 stl_p(p
++, 0x00c06021); /* move t4,a2 */
811 stl_p(p
++, 0x91440000); /* lbu a0,0(t2) */
812 stl_p(p
++, 0x0ff0021c); /* jal 870 */
813 stl_p(p
++, 0x00000000); /* nop */
814 stl_p(p
++, 0x254a0001); /* addiu t2,t2,1 */
815 stl_p(p
++, 0x258cffff); /* addiu t4,t4,-1 */
816 stl_p(p
++, 0x1580fffa); /* bnez t4,84c */
817 stl_p(p
++, 0x00000000); /* nop */
818 stl_p(p
++, 0x01a00009); /* jalr t5 */
819 stl_p(p
++, 0x01602021); /* move a0,t3 */
821 stl_p(p
++, 0x3c08b800); /* lui t0,0xb400 */
822 stl_p(p
++, 0x350803f8); /* ori t0,t0,0x3f8 */
823 stl_p(p
++, 0x91090005); /* lbu t1,5(t0) */
824 stl_p(p
++, 0x00000000); /* nop */
825 stl_p(p
++, 0x31290040); /* andi t1,t1,0x40 */
826 stl_p(p
++, 0x1120fffc); /* beqz t1,878 <outch+0x8> */
827 stl_p(p
++, 0x00000000); /* nop */
828 stl_p(p
++, 0x03e00009); /* jalr ra */
829 stl_p(p
++, 0xa1040000); /* sb a0,0(t0) */
832 static void G_GNUC_PRINTF(3, 4) prom_set(uint32_t *prom_buf
, int index
,
833 const char *string
, ...)
838 if (index
>= ENVP_NB_ENTRIES
) {
842 if (string
== NULL
) {
847 table_addr
= sizeof(uint32_t) * ENVP_NB_ENTRIES
+ index
* ENVP_ENTRY_SIZE
;
848 prom_buf
[index
] = tswap32(ENVP_VADDR
+ table_addr
);
850 va_start(ap
, string
);
851 vsnprintf((char *)prom_buf
+ table_addr
, ENVP_ENTRY_SIZE
, string
, ap
);
855 static void reinitialize_rng_seed(void *opaque
)
857 char *rng_seed_hex
= opaque
;
858 uint8_t rng_seed
[32];
860 qemu_guest_getrandom_nofail(rng_seed
, sizeof(rng_seed
));
861 for (size_t i
= 0; i
< sizeof(rng_seed
); ++i
) {
862 sprintf(rng_seed_hex
+ i
* 2, "%02x", rng_seed
[i
]);
867 static uint64_t load_kernel(void)
869 uint64_t kernel_entry
, kernel_high
, initrd_size
;
871 ram_addr_t initrd_offset
;
875 uint8_t rng_seed
[32];
876 char rng_seed_hex
[sizeof(rng_seed
) * 2 + 1];
877 size_t rng_seed_prom_offset
;
879 kernel_size
= load_elf(loaderparams
.kernel_filename
, NULL
,
880 cpu_mips_kseg0_to_phys
, NULL
,
882 &kernel_high
, NULL
, TARGET_BIG_ENDIAN
, EM_MIPS
,
884 if (kernel_size
< 0) {
885 error_report("could not load kernel '%s': %s",
886 loaderparams
.kernel_filename
,
887 load_elf_strerror(kernel_size
));
891 /* Check where the kernel has been linked */
892 if (kernel_entry
<= USEG_LIMIT
) {
893 error_report("Trap-and-Emul kernels (Linux CONFIG_KVM_GUEST)"
894 " are not supported");
901 if (loaderparams
.initrd_filename
) {
902 initrd_size
= get_image_size(loaderparams
.initrd_filename
);
903 if (initrd_size
> 0) {
905 * The kernel allocates the bootmap memory in the low memory after
906 * the initrd. It takes at most 128kiB for 2GB RAM and 4kiB
909 initrd_offset
= ROUND_UP(loaderparams
.ram_low_size
910 - (initrd_size
+ 128 * KiB
),
912 if (kernel_high
>= initrd_offset
) {
913 error_report("memory too small for initial ram disk '%s'",
914 loaderparams
.initrd_filename
);
917 initrd_size
= load_image_targphys(loaderparams
.initrd_filename
,
919 loaderparams
.ram_size
- initrd_offset
);
921 if (initrd_size
== (target_ulong
) -1) {
922 error_report("could not load initial ram disk '%s'",
923 loaderparams
.initrd_filename
);
928 /* Setup prom parameters. */
929 prom_size
= ENVP_NB_ENTRIES
* (sizeof(int32_t) + ENVP_ENTRY_SIZE
);
930 prom_buf
= g_malloc(prom_size
);
932 prom_set(prom_buf
, prom_index
++, "%s", loaderparams
.kernel_filename
);
933 if (initrd_size
> 0) {
934 prom_set(prom_buf
, prom_index
++,
935 "rd_start=0x%" PRIx64
" rd_size=%" PRId64
" %s",
936 cpu_mips_phys_to_kseg0(NULL
, initrd_offset
),
937 initrd_size
, loaderparams
.kernel_cmdline
);
939 prom_set(prom_buf
, prom_index
++, "%s", loaderparams
.kernel_cmdline
);
942 prom_set(prom_buf
, prom_index
++, "memsize");
943 prom_set(prom_buf
, prom_index
++, "%u", loaderparams
.ram_low_size
);
945 prom_set(prom_buf
, prom_index
++, "ememsize");
946 prom_set(prom_buf
, prom_index
++, "%u", loaderparams
.ram_size
);
948 prom_set(prom_buf
, prom_index
++, "modetty0");
949 prom_set(prom_buf
, prom_index
++, "38400n8r");
951 qemu_guest_getrandom_nofail(rng_seed
, sizeof(rng_seed
));
952 for (size_t i
= 0; i
< sizeof(rng_seed
); ++i
) {
953 sprintf(rng_seed_hex
+ i
* 2, "%02x", rng_seed
[i
]);
955 prom_set(prom_buf
, prom_index
++, "rngseed");
956 rng_seed_prom_offset
= prom_index
* ENVP_ENTRY_SIZE
+
957 sizeof(uint32_t) * ENVP_NB_ENTRIES
;
958 prom_set(prom_buf
, prom_index
++, "%s", rng_seed_hex
);
960 prom_set(prom_buf
, prom_index
++, NULL
);
962 rom_add_blob_fixed("prom", prom_buf
, prom_size
, ENVP_PADDR
);
963 qemu_register_reset_nosnapshotload(reinitialize_rng_seed
,
964 rom_ptr(ENVP_PADDR
, prom_size
) + rng_seed_prom_offset
);
970 static void malta_mips_config(MIPSCPU
*cpu
)
972 MachineState
*ms
= MACHINE(qdev_get_machine());
973 unsigned int smp_cpus
= ms
->smp
.cpus
;
974 CPUMIPSState
*env
= &cpu
->env
;
975 CPUState
*cs
= CPU(cpu
);
977 if (ase_mt_available(env
)) {
978 env
->mvp
->CP0_MVPConf0
= deposit32(env
->mvp
->CP0_MVPConf0
,
980 smp_cpus
* cs
->nr_threads
- 1);
981 env
->mvp
->CP0_MVPConf0
= deposit32(env
->mvp
->CP0_MVPConf0
,
982 CP0MVPC0_PVPE
, 4, smp_cpus
- 1);
986 static int malta_pci_slot_get_pirq(PCIDevice
*pci_dev
, int irq_num
)
990 slot
= PCI_SLOT(pci_dev
->devfn
);
996 /* AMD 79C973 Ethernet */
999 /* Crystal 4281 Sound */
1002 /* PCI slot 1 to 4 */
1004 return ((slot
- 18) + irq_num
) & 0x03;
1005 /* Unknown device, don't do any translation */
1011 static void main_cpu_reset(void *opaque
)
1013 MIPSCPU
*cpu
= opaque
;
1014 CPUMIPSState
*env
= &cpu
->env
;
1016 cpu_reset(CPU(cpu
));
1019 * The bootloader does not need to be rewritten as it is located in a
1020 * read only location. The kernel location and the arguments table
1021 * location does not change.
1023 if (loaderparams
.kernel_filename
) {
1024 env
->CP0_Status
&= ~(1 << CP0St_ERL
);
1027 malta_mips_config(cpu
);
1030 static void create_cpu_without_cps(MachineState
*ms
, MaltaState
*s
,
1031 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
1037 for (i
= 0; i
< ms
->smp
.cpus
; i
++) {
1038 cpu
= mips_cpu_create_with_clock(ms
->cpu_type
, s
->cpuclk
);
1040 /* Init internal devices */
1041 cpu_mips_irq_init_cpu(cpu
);
1042 cpu_mips_clock_init(cpu
);
1043 qemu_register_reset(main_cpu_reset
, cpu
);
1046 cpu
= MIPS_CPU(first_cpu
);
1048 *i8259_irq
= env
->irq
[2];
1049 *cbus_irq
= env
->irq
[4];
1052 static void create_cps(MachineState
*ms
, MaltaState
*s
,
1053 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
1055 object_initialize_child(OBJECT(s
), "cps", &s
->cps
, TYPE_MIPS_CPS
);
1056 object_property_set_str(OBJECT(&s
->cps
), "cpu-type", ms
->cpu_type
,
1058 object_property_set_uint(OBJECT(&s
->cps
), "num-vp", ms
->smp
.cpus
,
1060 qdev_connect_clock_in(DEVICE(&s
->cps
), "clk-in", s
->cpuclk
);
1061 sysbus_realize(SYS_BUS_DEVICE(&s
->cps
), &error_fatal
);
1063 sysbus_mmio_map_overlap(SYS_BUS_DEVICE(&s
->cps
), 0, 0, 1);
1065 *i8259_irq
= get_cps_irq(&s
->cps
, 3);
1069 static void mips_create_cpu(MachineState
*ms
, MaltaState
*s
,
1070 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
1072 if ((ms
->smp
.cpus
> 1) && cpu_type_supports_cps_smp(ms
->cpu_type
)) {
1073 create_cps(ms
, s
, cbus_irq
, i8259_irq
);
1075 create_cpu_without_cps(ms
, s
, cbus_irq
, i8259_irq
);
1080 void mips_malta_init(MachineState
*machine
)
1082 ram_addr_t ram_size
= machine
->ram_size
;
1083 ram_addr_t ram_low_size
;
1084 const char *kernel_filename
= machine
->kernel_filename
;
1085 const char *kernel_cmdline
= machine
->kernel_cmdline
;
1086 const char *initrd_filename
= machine
->initrd_filename
;
1089 MemoryRegion
*system_memory
= get_system_memory();
1090 MemoryRegion
*ram_low_preio
= g_new(MemoryRegion
, 1);
1091 MemoryRegion
*ram_low_postio
;
1092 MemoryRegion
*bios
, *bios_copy
= g_new(MemoryRegion
, 1);
1093 const size_t smbus_eeprom_size
= 8 * 256;
1094 uint8_t *smbus_eeprom_buf
= g_malloc0(smbus_eeprom_size
);
1095 uint64_t kernel_entry
, bootloader_run_addr
;
1098 qemu_irq cbus_irq
, i8259_irq
;
1106 s
= MIPS_MALTA(qdev_new(TYPE_MIPS_MALTA
));
1107 sysbus_realize_and_unref(SYS_BUS_DEVICE(s
), &error_fatal
);
1110 mips_create_cpu(machine
, s
, &cbus_irq
, &i8259_irq
);
1113 if (ram_size
> 2 * GiB
) {
1114 error_report("Too much memory for this machine: %" PRId64
"MB,"
1115 " maximum 2048MB", ram_size
/ MiB
);
1119 /* register RAM at high address where it is undisturbed by IO */
1120 memory_region_add_subregion(system_memory
, 0x80000000, machine
->ram
);
1122 /* alias for pre IO hole access */
1123 memory_region_init_alias(ram_low_preio
, NULL
, "mips_malta_low_preio.ram",
1124 machine
->ram
, 0, MIN(ram_size
, 256 * MiB
));
1125 memory_region_add_subregion(system_memory
, 0, ram_low_preio
);
1127 /* alias for post IO hole access, if there is enough RAM */
1128 if (ram_size
> 512 * MiB
) {
1129 ram_low_postio
= g_new(MemoryRegion
, 1);
1130 memory_region_init_alias(ram_low_postio
, NULL
,
1131 "mips_malta_low_postio.ram",
1132 machine
->ram
, 512 * MiB
,
1133 ram_size
- 512 * MiB
);
1134 memory_region_add_subregion(system_memory
, 512 * MiB
,
1140 /* The CBUS UART is attached to the MIPS CPU INT2 pin, ie interrupt 4 */
1141 malta_fpga_init(system_memory
, FPGA_ADDRESS
, cbus_irq
, serial_hd(2));
1143 /* Load firmware in flash / BIOS. */
1144 dinfo
= drive_get(IF_PFLASH
, 0, fl_idx
);
1145 fl
= pflash_cfi01_register(FLASH_ADDRESS
, "mips_malta.bios",
1147 dinfo
? blk_by_legacy_dinfo(dinfo
) : NULL
,
1149 4, 0x0000, 0x0000, 0x0000, 0x0000,
1151 bios
= pflash_cfi01_get_memory(fl
);
1153 if (kernel_filename
) {
1154 ram_low_size
= MIN(ram_size
, 256 * MiB
);
1155 bootloader_run_addr
= cpu_mips_phys_to_kseg0(NULL
, RESET_ADDRESS
);
1157 /* Write a small bootloader to the flash location. */
1158 loaderparams
.ram_size
= ram_size
;
1159 loaderparams
.ram_low_size
= ram_low_size
;
1160 loaderparams
.kernel_filename
= kernel_filename
;
1161 loaderparams
.kernel_cmdline
= kernel_cmdline
;
1162 loaderparams
.initrd_filename
= initrd_filename
;
1163 kernel_entry
= load_kernel();
1165 if (!cpu_type_supports_isa(machine
->cpu_type
, ISA_NANOMIPS32
)) {
1166 write_bootloader(memory_region_get_ram_ptr(bios
),
1167 bootloader_run_addr
, kernel_entry
);
1169 write_bootloader_nanomips(memory_region_get_ram_ptr(bios
),
1170 bootloader_run_addr
, kernel_entry
);
1173 target_long bios_size
= FLASH_SIZE
;
1174 /* Load firmware from flash. */
1176 /* Load a BIOS image. */
1177 filename
= qemu_find_file(QEMU_FILE_TYPE_BIOS
,
1178 machine
->firmware
?: BIOS_FILENAME
);
1180 bios_size
= load_image_targphys(filename
, FLASH_ADDRESS
,
1186 if ((bios_size
< 0 || bios_size
> BIOS_SIZE
) &&
1187 machine
->firmware
&& !qtest_enabled()) {
1188 error_report("Could not load MIPS bios '%s'", machine
->firmware
);
1193 * In little endian mode the 32bit words in the bios are swapped,
1194 * a neat trick which allows bi-endian firmware.
1196 #if !TARGET_BIG_ENDIAN
1198 uint32_t *end
, *addr
;
1199 const size_t swapsize
= MIN(bios_size
, 0x3e0000);
1200 addr
= rom_ptr(FLASH_ADDRESS
, swapsize
);
1202 addr
= memory_region_get_ram_ptr(bios
);
1204 end
= (void *)addr
+ swapsize
;
1205 while (addr
< end
) {
1214 * Map the BIOS at a 2nd physical location, as on the real board.
1215 * Copy it so that we can patch in the MIPS revision, which cannot be
1216 * handled by an overlapping region as the resulting ROM code subpage
1217 * regions are not executable.
1219 memory_region_init_ram(bios_copy
, NULL
, "bios.1fc", BIOS_SIZE
,
1221 if (!rom_copy(memory_region_get_ram_ptr(bios_copy
),
1222 FLASH_ADDRESS
, BIOS_SIZE
)) {
1223 memcpy(memory_region_get_ram_ptr(bios_copy
),
1224 memory_region_get_ram_ptr(bios
), BIOS_SIZE
);
1226 memory_region_set_readonly(bios_copy
, true);
1227 memory_region_add_subregion(system_memory
, RESET_ADDRESS
, bios_copy
);
1229 /* Board ID = 0x420 (Malta Board with CoreLV) */
1230 stl_p(memory_region_get_ram_ptr(bios_copy
) + 0x10, 0x00000420);
1233 dev
= qdev_new("gt64120");
1234 qdev_prop_set_bit(dev
, "cpu-little-endian", !TARGET_BIG_ENDIAN
);
1235 sysbus_realize_and_unref(SYS_BUS_DEVICE(dev
), &error_fatal
);
1236 pci_bus
= PCI_BUS(qdev_get_child_bus(dev
, "pci"));
1237 pci_bus_map_irqs(pci_bus
, malta_pci_slot_get_pirq
);
1240 piix4
= pci_new_multifunction(PIIX4_PCI_DEVFN
, TYPE_PIIX4_PCI_DEVICE
);
1241 qdev_prop_set_uint32(DEVICE(piix4
), "smb_io_base", 0x1100);
1242 pci_realize_and_unref(piix4
, pci_bus
, &error_fatal
);
1243 isa_bus
= ISA_BUS(qdev_get_child_bus(DEVICE(piix4
), "isa.0"));
1245 dev
= DEVICE(object_resolve_path_component(OBJECT(piix4
), "ide"));
1246 pci_ide_create_devs(PCI_DEVICE(dev
));
1248 /* Interrupt controller */
1249 qdev_connect_gpio_out_named(DEVICE(piix4
), "intr", 0, i8259_irq
);
1251 /* generate SPD EEPROM data */
1252 dev
= DEVICE(object_resolve_path_component(OBJECT(piix4
), "pm"));
1253 smbus
= I2C_BUS(qdev_get_child_bus(dev
, "i2c"));
1254 generate_eeprom_spd(&smbus_eeprom_buf
[0 * 256], ram_size
);
1255 generate_eeprom_serial(&smbus_eeprom_buf
[6 * 256]);
1256 smbus_eeprom_init(smbus
, 8, smbus_eeprom_buf
, smbus_eeprom_size
);
1257 g_free(smbus_eeprom_buf
);
1259 /* Super I/O: SMS FDC37M817 */
1260 isa_create_simple(isa_bus
, TYPE_FDC37M81X_SUPERIO
);
1263 network_init(pci_bus
);
1265 /* Optional PCI video card */
1266 pci_vga_init(pci_bus
);
1269 static void mips_malta_instance_init(Object
*obj
)
1271 MaltaState
*s
= MIPS_MALTA(obj
);
1273 s
->cpuclk
= qdev_init_clock_out(DEVICE(obj
), "cpu-refclk");
1274 clock_set_hz(s
->cpuclk
, 320000000); /* 320 MHz */
1277 static const TypeInfo mips_malta_device
= {
1278 .name
= TYPE_MIPS_MALTA
,
1279 .parent
= TYPE_SYS_BUS_DEVICE
,
1280 .instance_size
= sizeof(MaltaState
),
1281 .instance_init
= mips_malta_instance_init
,
1284 GlobalProperty malta_compat
[] = {
1285 { "PIIX4_PM", "memory-hotplug-support", "off" },
1286 { "PIIX4_PM", "acpi-pci-hotplug-with-bridge-support", "off" },
1287 { "PIIX4_PM", "acpi-root-pci-hotplug", "off" },
1288 { "PIIX4_PM", "x-not-migrate-acpi-index", "true" },
1290 const size_t malta_compat_len
= G_N_ELEMENTS(malta_compat
);
1292 static void mips_malta_machine_init(MachineClass
*mc
)
1294 mc
->desc
= "MIPS Malta Core LV";
1295 mc
->init
= mips_malta_init
;
1296 mc
->block_default_type
= IF_IDE
;
1298 mc
->is_default
= true;
1299 #ifdef TARGET_MIPS64
1300 mc
->default_cpu_type
= MIPS_CPU_TYPE_NAME("20Kc");
1302 mc
->default_cpu_type
= MIPS_CPU_TYPE_NAME("24Kf");
1304 mc
->default_ram_id
= "mips_malta.ram";
1305 compat_props_add(mc
->compat_props
, malta_compat
, malta_compat_len
);
1308 DEFINE_MACHINE("malta", mips_malta_machine_init
)
1310 static void mips_malta_register_types(void)
1312 type_register_static(&mips_malta_device
);
1315 type_init(mips_malta_register_types
)