2 * QEMU Malta board support
4 * Copyright (c) 2006 Aurelien Jarno
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 #include "qemu/osdep.h"
26 #include "qemu-common.h"
29 #include "hw/i386/pc.h"
30 #include "hw/dma/i8257.h"
31 #include "hw/char/serial.h"
32 #include "hw/char/parallel.h"
33 #include "hw/block/fdc.h"
35 #include "hw/boards.h"
36 #include "hw/i2c/smbus.h"
37 #include "sysemu/block-backend.h"
38 #include "hw/block/flash.h"
39 #include "hw/mips/mips.h"
40 #include "hw/mips/cpudevs.h"
41 #include "hw/pci/pci.h"
42 #include "sysemu/sysemu.h"
43 #include "sysemu/arch_init.h"
45 #include "hw/mips/bios.h"
47 #include "hw/loader.h"
49 #include "hw/timer/mc146818rtc.h"
50 #include "hw/timer/i8254.h"
51 #include "sysemu/blockdev.h"
52 #include "exec/address-spaces.h"
53 #include "hw/sysbus.h" /* SysBusDevice */
54 #include "qemu/host-utils.h"
55 #include "sysemu/qtest.h"
56 #include "qapi/error.h"
57 #include "qemu/error-report.h"
58 #include "hw/empty_slot.h"
59 #include "sysemu/kvm.h"
60 #include "exec/semihost.h"
61 #include "hw/mips/cps.h"
63 //#define DEBUG_BOARD_INIT
65 #define ENVP_ADDR 0x80002000l
66 #define ENVP_NB_ENTRIES 16
67 #define ENVP_ENTRY_SIZE 256
69 /* Hardware addresses */
70 #define FLASH_ADDRESS 0x1e000000ULL
71 #define FPGA_ADDRESS 0x1f000000ULL
72 #define RESET_ADDRESS 0x1fc00000ULL
74 #define FLASH_SIZE 0x400000
80 MemoryRegion iomem_lo
; /* 0 - 0x900 */
81 MemoryRegion iomem_hi
; /* 0xa00 - 0x100000 */
95 #define TYPE_MIPS_MALTA "mips-malta"
96 #define MIPS_MALTA(obj) OBJECT_CHECK(MaltaState, (obj), TYPE_MIPS_MALTA)
99 SysBusDevice parent_obj
;
105 static ISADevice
*pit
;
107 static struct _loaderparams
{
108 int ram_size
, ram_low_size
;
109 const char *kernel_filename
;
110 const char *kernel_cmdline
;
111 const char *initrd_filename
;
115 static void malta_fpga_update_display(void *opaque
)
119 MaltaFPGAState
*s
= opaque
;
121 for (i
= 7 ; i
>= 0 ; i
--) {
122 if (s
->leds
& (1 << i
))
129 qemu_chr_fe_printf(&s
->display
, "\e[H\n\n|\e[32m%-8.8s\e[00m|\r\n",
131 qemu_chr_fe_printf(&s
->display
, "\n\n\n\n|\e[31m%-8.8s\e[00m|",
136 * EEPROM 24C01 / 24C02 emulation.
138 * Emulation for serial EEPROMs:
139 * 24C01 - 1024 bit (128 x 8)
140 * 24C02 - 2048 bit (256 x 8)
142 * Typical device names include Microchip 24C02SC or SGS Thomson ST24C02.
148 # define logout(fmt, ...) fprintf(stderr, "MALTA\t%-24s" fmt, __func__, ## __VA_ARGS__)
150 # define logout(fmt, ...) ((void)0)
153 struct _eeprom24c0x_t
{
162 uint8_t contents
[256];
165 typedef struct _eeprom24c0x_t eeprom24c0x_t
;
167 static eeprom24c0x_t spd_eeprom
= {
169 /* 00000000: */ 0x80,0x08,0xFF,0x0D,0x0A,0xFF,0x40,0x00,
170 /* 00000008: */ 0x01,0x75,0x54,0x00,0x82,0x08,0x00,0x01,
171 /* 00000010: */ 0x8F,0x04,0x02,0x01,0x01,0x00,0x00,0x00,
172 /* 00000018: */ 0x00,0x00,0x00,0x14,0x0F,0x14,0x2D,0xFF,
173 /* 00000020: */ 0x15,0x08,0x15,0x08,0x00,0x00,0x00,0x00,
174 /* 00000028: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
175 /* 00000030: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
176 /* 00000038: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x12,0xD0,
177 /* 00000040: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
178 /* 00000048: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
179 /* 00000050: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
180 /* 00000058: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
181 /* 00000060: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
182 /* 00000068: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
183 /* 00000070: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
184 /* 00000078: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x64,0xF4,
188 static void generate_eeprom_spd(uint8_t *eeprom
, ram_addr_t ram_size
)
190 enum { SDR
= 0x4, DDR2
= 0x8 } type
;
191 uint8_t *spd
= spd_eeprom
.contents
;
193 uint16_t density
= 0;
196 /* work in terms of MB */
199 while ((ram_size
>= 4) && (nbanks
<= 2)) {
200 int sz_log2
= MIN(31 - clz32(ram_size
), 14);
202 density
|= 1 << (sz_log2
- 2);
203 ram_size
-= 1 << sz_log2
;
206 /* split to 2 banks if possible */
207 if ((nbanks
== 1) && (density
> 1)) {
212 if (density
& 0xff00) {
213 density
= (density
& 0xe0) | ((density
>> 8) & 0x1f);
215 } else if (!(density
& 0x1f)) {
222 warn_report("SPD cannot represent final " RAM_ADDR_FMT
"MB"
223 " of SDRAM", ram_size
);
226 /* fill in SPD memory information */
233 for (i
= 0; i
< 63; i
++) {
238 memcpy(eeprom
, spd
, sizeof(spd_eeprom
.contents
));
241 static void generate_eeprom_serial(uint8_t *eeprom
)
244 uint8_t mac
[6] = { 0x00 };
245 uint8_t sn
[5] = { 0x01, 0x23, 0x45, 0x67, 0x89 };
248 eeprom
[pos
++] = 0x01;
251 eeprom
[pos
++] = 0x02;
254 eeprom
[pos
++] = 0x01; /* MAC */
255 eeprom
[pos
++] = 0x06; /* length */
256 memcpy(&eeprom
[pos
], mac
, sizeof(mac
));
260 eeprom
[pos
++] = 0x02; /* serial */
261 eeprom
[pos
++] = 0x05; /* length */
262 memcpy(&eeprom
[pos
], sn
, sizeof(sn
));
267 for (i
= 0; i
< pos
; i
++) {
268 eeprom
[pos
] += eeprom
[i
];
272 static uint8_t eeprom24c0x_read(eeprom24c0x_t
*eeprom
)
274 logout("%u: scl = %u, sda = %u, data = 0x%02x\n",
275 eeprom
->tick
, eeprom
->scl
, eeprom
->sda
, eeprom
->data
);
279 static void eeprom24c0x_write(eeprom24c0x_t
*eeprom
, int scl
, int sda
)
281 if (eeprom
->scl
&& scl
&& (eeprom
->sda
!= sda
)) {
282 logout("%u: scl = %u->%u, sda = %u->%u i2c %s\n",
283 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
,
284 sda
? "stop" : "start");
289 } else if (eeprom
->tick
== 0 && !eeprom
->ack
) {
290 /* Waiting for start. */
291 logout("%u: scl = %u->%u, sda = %u->%u wait for i2c start\n",
292 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
);
293 } else if (!eeprom
->scl
&& scl
) {
294 logout("%u: scl = %u->%u, sda = %u->%u trigger bit\n",
295 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
);
297 logout("\ti2c ack bit = 0\n");
300 } else if (eeprom
->sda
== sda
) {
301 uint8_t bit
= (sda
!= 0);
302 logout("\ti2c bit = %d\n", bit
);
303 if (eeprom
->tick
< 9) {
304 eeprom
->command
<<= 1;
305 eeprom
->command
+= bit
;
307 if (eeprom
->tick
== 9) {
308 logout("\tcommand 0x%04x, %s\n", eeprom
->command
,
309 bit
? "read" : "write");
312 } else if (eeprom
->tick
< 17) {
313 if (eeprom
->command
& 1) {
314 sda
= ((eeprom
->data
& 0x80) != 0);
316 eeprom
->address
<<= 1;
317 eeprom
->address
+= bit
;
320 if (eeprom
->tick
== 17) {
321 eeprom
->data
= eeprom
->contents
[eeprom
->address
];
322 logout("\taddress 0x%04x, data 0x%02x\n",
323 eeprom
->address
, eeprom
->data
);
327 } else if (eeprom
->tick
>= 17) {
331 logout("\tsda changed with raising scl\n");
334 logout("%u: scl = %u->%u, sda = %u->%u\n", eeprom
->tick
, eeprom
->scl
,
335 scl
, eeprom
->sda
, sda
);
341 static uint64_t malta_fpga_read(void *opaque
, hwaddr addr
,
344 MaltaFPGAState
*s
= opaque
;
348 saddr
= (addr
& 0xfffff);
352 /* SWITCH Register */
354 val
= 0x00000000; /* All switches closed */
357 /* STATUS Register */
359 #ifdef TARGET_WORDS_BIGENDIAN
371 /* LEDBAR Register */
376 /* BRKRES Register */
381 /* UART Registers are handled directly by the serial device */
388 /* XXX: implement a real I2C controller */
392 /* IN = OUT until a real I2C control is implemented */
399 /* I2CINP Register */
401 val
= ((s
->i2cin
& ~1) | eeprom24c0x_read(&spd_eeprom
));
409 /* I2COUT Register */
414 /* I2CSEL Register */
421 printf ("malta_fpga_read: Bad register offset 0x" TARGET_FMT_lx
"\n",
429 static void malta_fpga_write(void *opaque
, hwaddr addr
,
430 uint64_t val
, unsigned size
)
432 MaltaFPGAState
*s
= opaque
;
435 saddr
= (addr
& 0xfffff);
439 /* SWITCH Register */
447 /* LEDBAR Register */
449 s
->leds
= val
& 0xff;
450 malta_fpga_update_display(s
);
453 /* ASCIIWORD Register */
455 snprintf(s
->display_text
, 9, "%08X", (uint32_t)val
);
456 malta_fpga_update_display(s
);
459 /* ASCIIPOS0 to ASCIIPOS7 Registers */
468 s
->display_text
[(saddr
- 0x00418) >> 3] = (char) val
;
469 malta_fpga_update_display(s
);
472 /* SOFTRES Register */
475 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET
);
478 /* BRKRES Register */
483 /* UART Registers are handled directly by the serial device */
487 s
->gpout
= val
& 0xff;
492 s
->i2coe
= val
& 0x03;
495 /* I2COUT Register */
497 eeprom24c0x_write(&spd_eeprom
, val
& 0x02, val
& 0x01);
501 /* I2CSEL Register */
503 s
->i2csel
= val
& 0x01;
508 printf ("malta_fpga_write: Bad register offset 0x" TARGET_FMT_lx
"\n",
515 static const MemoryRegionOps malta_fpga_ops
= {
516 .read
= malta_fpga_read
,
517 .write
= malta_fpga_write
,
518 .endianness
= DEVICE_NATIVE_ENDIAN
,
521 static void malta_fpga_reset(void *opaque
)
523 MaltaFPGAState
*s
= opaque
;
533 s
->display_text
[8] = '\0';
534 snprintf(s
->display_text
, 9, " ");
537 static void malta_fgpa_display_event(void *opaque
, int event
)
539 MaltaFPGAState
*s
= opaque
;
541 if (event
== CHR_EVENT_OPENED
&& !s
->display_inited
) {
542 qemu_chr_fe_printf(&s
->display
, "\e[HMalta LEDBAR\r\n");
543 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
544 qemu_chr_fe_printf(&s
->display
, "+ +\r\n");
545 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
546 qemu_chr_fe_printf(&s
->display
, "\n");
547 qemu_chr_fe_printf(&s
->display
, "Malta ASCII\r\n");
548 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
549 qemu_chr_fe_printf(&s
->display
, "+ +\r\n");
550 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
551 s
->display_inited
= true;
555 static MaltaFPGAState
*malta_fpga_init(MemoryRegion
*address_space
,
556 hwaddr base
, qemu_irq uart_irq
, Chardev
*uart_chr
)
561 s
= (MaltaFPGAState
*)g_malloc0(sizeof(MaltaFPGAState
));
563 memory_region_init_io(&s
->iomem
, NULL
, &malta_fpga_ops
, s
,
564 "malta-fpga", 0x100000);
565 memory_region_init_alias(&s
->iomem_lo
, NULL
, "malta-fpga",
566 &s
->iomem
, 0, 0x900);
567 memory_region_init_alias(&s
->iomem_hi
, NULL
, "malta-fpga",
568 &s
->iomem
, 0xa00, 0x10000-0xa00);
570 memory_region_add_subregion(address_space
, base
, &s
->iomem_lo
);
571 memory_region_add_subregion(address_space
, base
+ 0xa00, &s
->iomem_hi
);
573 chr
= qemu_chr_new("fpga", "vc:320x200");
574 qemu_chr_fe_init(&s
->display
, chr
, NULL
);
575 qemu_chr_fe_set_handlers(&s
->display
, NULL
, NULL
,
576 malta_fgpa_display_event
, NULL
, s
, NULL
, true);
578 s
->uart
= serial_mm_init(address_space
, base
+ 0x900, 3, uart_irq
,
579 230400, uart_chr
, DEVICE_NATIVE_ENDIAN
);
582 qemu_register_reset(malta_fpga_reset
, s
);
587 /* Network support */
588 static void network_init(PCIBus
*pci_bus
)
592 for(i
= 0; i
< nb_nics
; i
++) {
593 NICInfo
*nd
= &nd_table
[i
];
594 const char *default_devaddr
= NULL
;
596 if (i
== 0 && (!nd
->model
|| strcmp(nd
->model
, "pcnet") == 0))
597 /* The malta board has a PCNet card using PCI SLOT 11 */
598 default_devaddr
= "0b";
600 pci_nic_init_nofail(nd
, pci_bus
, "pcnet", default_devaddr
);
604 /* ROM and pseudo bootloader
606 The following code implements a very very simple bootloader. It first
607 loads the registers a0 to a3 to the values expected by the OS, and
608 then jump at the kernel address.
610 The bootloader should pass the locations of the kernel arguments and
611 environment variables tables. Those tables contain the 32-bit address
612 of NULL terminated strings. The environment variables table should be
613 terminated by a NULL address.
615 For a simpler implementation, the number of kernel arguments is fixed
616 to two (the name of the kernel and the command line), and the two
617 tables are actually the same one.
619 The registers a0 to a3 should contain the following values:
620 a0 - number of kernel arguments
621 a1 - 32-bit address of the kernel arguments table
622 a2 - 32-bit address of the environment variables table
623 a3 - RAM size in bytes
626 static void write_bootloader(uint8_t *base
, int64_t run_addr
,
627 int64_t kernel_entry
)
631 /* Small bootloader */
632 p
= (uint32_t *)base
;
634 stl_p(p
++, 0x08000000 | /* j 0x1fc00580 */
635 ((run_addr
+ 0x580) & 0x0fffffff) >> 2);
636 stl_p(p
++, 0x00000000); /* nop */
638 /* YAMON service vector */
639 stl_p(base
+ 0x500, run_addr
+ 0x0580); /* start: */
640 stl_p(base
+ 0x504, run_addr
+ 0x083c); /* print_count: */
641 stl_p(base
+ 0x520, run_addr
+ 0x0580); /* start: */
642 stl_p(base
+ 0x52c, run_addr
+ 0x0800); /* flush_cache: */
643 stl_p(base
+ 0x534, run_addr
+ 0x0808); /* print: */
644 stl_p(base
+ 0x538, run_addr
+ 0x0800); /* reg_cpu_isr: */
645 stl_p(base
+ 0x53c, run_addr
+ 0x0800); /* unred_cpu_isr: */
646 stl_p(base
+ 0x540, run_addr
+ 0x0800); /* reg_ic_isr: */
647 stl_p(base
+ 0x544, run_addr
+ 0x0800); /* unred_ic_isr: */
648 stl_p(base
+ 0x548, run_addr
+ 0x0800); /* reg_esr: */
649 stl_p(base
+ 0x54c, run_addr
+ 0x0800); /* unreg_esr: */
650 stl_p(base
+ 0x550, run_addr
+ 0x0800); /* getchar: */
651 stl_p(base
+ 0x554, run_addr
+ 0x0800); /* syscon_read: */
654 /* Second part of the bootloader */
655 p
= (uint32_t *) (base
+ 0x580);
657 if (semihosting_get_argc()) {
658 /* Preserve a0 content as arguments have been passed */
659 stl_p(p
++, 0x00000000); /* nop */
661 stl_p(p
++, 0x24040002); /* addiu a0, zero, 2 */
663 stl_p(p
++, 0x3c1d0000 | (((ENVP_ADDR
- 64) >> 16) & 0xffff)); /* lui sp, high(ENVP_ADDR) */
664 stl_p(p
++, 0x37bd0000 | ((ENVP_ADDR
- 64) & 0xffff)); /* ori sp, sp, low(ENVP_ADDR) */
665 stl_p(p
++, 0x3c050000 | ((ENVP_ADDR
>> 16) & 0xffff)); /* lui a1, high(ENVP_ADDR) */
666 stl_p(p
++, 0x34a50000 | (ENVP_ADDR
& 0xffff)); /* ori a1, a1, low(ENVP_ADDR) */
667 stl_p(p
++, 0x3c060000 | (((ENVP_ADDR
+ 8) >> 16) & 0xffff)); /* lui a2, high(ENVP_ADDR + 8) */
668 stl_p(p
++, 0x34c60000 | ((ENVP_ADDR
+ 8) & 0xffff)); /* ori a2, a2, low(ENVP_ADDR + 8) */
669 stl_p(p
++, 0x3c070000 | (loaderparams
.ram_low_size
>> 16)); /* lui a3, high(ram_low_size) */
670 stl_p(p
++, 0x34e70000 | (loaderparams
.ram_low_size
& 0xffff)); /* ori a3, a3, low(ram_low_size) */
672 /* Load BAR registers as done by YAMON */
673 stl_p(p
++, 0x3c09b400); /* lui t1, 0xb400 */
675 #ifdef TARGET_WORDS_BIGENDIAN
676 stl_p(p
++, 0x3c08df00); /* lui t0, 0xdf00 */
678 stl_p(p
++, 0x340800df); /* ori t0, r0, 0x00df */
680 stl_p(p
++, 0xad280068); /* sw t0, 0x0068(t1) */
682 stl_p(p
++, 0x3c09bbe0); /* lui t1, 0xbbe0 */
684 #ifdef TARGET_WORDS_BIGENDIAN
685 stl_p(p
++, 0x3c08c000); /* lui t0, 0xc000 */
687 stl_p(p
++, 0x340800c0); /* ori t0, r0, 0x00c0 */
689 stl_p(p
++, 0xad280048); /* sw t0, 0x0048(t1) */
690 #ifdef TARGET_WORDS_BIGENDIAN
691 stl_p(p
++, 0x3c084000); /* lui t0, 0x4000 */
693 stl_p(p
++, 0x34080040); /* ori t0, r0, 0x0040 */
695 stl_p(p
++, 0xad280050); /* sw t0, 0x0050(t1) */
697 #ifdef TARGET_WORDS_BIGENDIAN
698 stl_p(p
++, 0x3c088000); /* lui t0, 0x8000 */
700 stl_p(p
++, 0x34080080); /* ori t0, r0, 0x0080 */
702 stl_p(p
++, 0xad280058); /* sw t0, 0x0058(t1) */
703 #ifdef TARGET_WORDS_BIGENDIAN
704 stl_p(p
++, 0x3c083f00); /* lui t0, 0x3f00 */
706 stl_p(p
++, 0x3408003f); /* ori t0, r0, 0x003f */
708 stl_p(p
++, 0xad280060); /* sw t0, 0x0060(t1) */
710 #ifdef TARGET_WORDS_BIGENDIAN
711 stl_p(p
++, 0x3c08c100); /* lui t0, 0xc100 */
713 stl_p(p
++, 0x340800c1); /* ori t0, r0, 0x00c1 */
715 stl_p(p
++, 0xad280080); /* sw t0, 0x0080(t1) */
716 #ifdef TARGET_WORDS_BIGENDIAN
717 stl_p(p
++, 0x3c085e00); /* lui t0, 0x5e00 */
719 stl_p(p
++, 0x3408005e); /* ori t0, r0, 0x005e */
721 stl_p(p
++, 0xad280088); /* sw t0, 0x0088(t1) */
723 /* Jump to kernel code */
724 stl_p(p
++, 0x3c1f0000 | ((kernel_entry
>> 16) & 0xffff)); /* lui ra, high(kernel_entry) */
725 stl_p(p
++, 0x37ff0000 | (kernel_entry
& 0xffff)); /* ori ra, ra, low(kernel_entry) */
726 stl_p(p
++, 0x03e00009); /* jalr ra */
727 stl_p(p
++, 0x00000000); /* nop */
729 /* YAMON subroutines */
730 p
= (uint32_t *) (base
+ 0x800);
731 stl_p(p
++, 0x03e00009); /* jalr ra */
732 stl_p(p
++, 0x24020000); /* li v0,0 */
733 /* 808 YAMON print */
734 stl_p(p
++, 0x03e06821); /* move t5,ra */
735 stl_p(p
++, 0x00805821); /* move t3,a0 */
736 stl_p(p
++, 0x00a05021); /* move t2,a1 */
737 stl_p(p
++, 0x91440000); /* lbu a0,0(t2) */
738 stl_p(p
++, 0x254a0001); /* addiu t2,t2,1 */
739 stl_p(p
++, 0x10800005); /* beqz a0,834 */
740 stl_p(p
++, 0x00000000); /* nop */
741 stl_p(p
++, 0x0ff0021c); /* jal 870 */
742 stl_p(p
++, 0x00000000); /* nop */
743 stl_p(p
++, 0x1000fff9); /* b 814 */
744 stl_p(p
++, 0x00000000); /* nop */
745 stl_p(p
++, 0x01a00009); /* jalr t5 */
746 stl_p(p
++, 0x01602021); /* move a0,t3 */
747 /* 0x83c YAMON print_count */
748 stl_p(p
++, 0x03e06821); /* move t5,ra */
749 stl_p(p
++, 0x00805821); /* move t3,a0 */
750 stl_p(p
++, 0x00a05021); /* move t2,a1 */
751 stl_p(p
++, 0x00c06021); /* move t4,a2 */
752 stl_p(p
++, 0x91440000); /* lbu a0,0(t2) */
753 stl_p(p
++, 0x0ff0021c); /* jal 870 */
754 stl_p(p
++, 0x00000000); /* nop */
755 stl_p(p
++, 0x254a0001); /* addiu t2,t2,1 */
756 stl_p(p
++, 0x258cffff); /* addiu t4,t4,-1 */
757 stl_p(p
++, 0x1580fffa); /* bnez t4,84c */
758 stl_p(p
++, 0x00000000); /* nop */
759 stl_p(p
++, 0x01a00009); /* jalr t5 */
760 stl_p(p
++, 0x01602021); /* move a0,t3 */
762 stl_p(p
++, 0x3c08b800); /* lui t0,0xb400 */
763 stl_p(p
++, 0x350803f8); /* ori t0,t0,0x3f8 */
764 stl_p(p
++, 0x91090005); /* lbu t1,5(t0) */
765 stl_p(p
++, 0x00000000); /* nop */
766 stl_p(p
++, 0x31290040); /* andi t1,t1,0x40 */
767 stl_p(p
++, 0x1120fffc); /* beqz t1,878 <outch+0x8> */
768 stl_p(p
++, 0x00000000); /* nop */
769 stl_p(p
++, 0x03e00009); /* jalr ra */
770 stl_p(p
++, 0xa1040000); /* sb a0,0(t0) */
774 static void GCC_FMT_ATTR(3, 4) prom_set(uint32_t* prom_buf
, int index
,
775 const char *string
, ...)
780 if (index
>= ENVP_NB_ENTRIES
)
783 if (string
== NULL
) {
788 table_addr
= sizeof(int32_t) * ENVP_NB_ENTRIES
+ index
* ENVP_ENTRY_SIZE
;
789 prom_buf
[index
] = tswap32(ENVP_ADDR
+ table_addr
);
791 va_start(ap
, string
);
792 vsnprintf((char *)prom_buf
+ table_addr
, ENVP_ENTRY_SIZE
, string
, ap
);
797 static int64_t load_kernel (void)
799 int64_t kernel_entry
, kernel_high
;
800 long kernel_size
, initrd_size
;
801 ram_addr_t initrd_offset
;
806 uint64_t (*xlate_to_kseg0
) (void *opaque
, uint64_t addr
);
808 #ifdef TARGET_WORDS_BIGENDIAN
814 kernel_size
= load_elf(loaderparams
.kernel_filename
, cpu_mips_kseg0_to_phys
,
815 NULL
, (uint64_t *)&kernel_entry
, NULL
,
816 (uint64_t *)&kernel_high
, big_endian
, EM_MIPS
, 1, 0);
817 if (kernel_size
< 0) {
818 error_report("could not load kernel '%s': %s",
819 loaderparams
.kernel_filename
,
820 load_elf_strerror(kernel_size
));
824 /* Check where the kernel has been linked */
825 if (kernel_entry
& 0x80000000ll
) {
827 error_report("KVM guest kernels must be linked in useg. "
828 "Did you forget to enable CONFIG_KVM_GUEST?");
832 xlate_to_kseg0
= cpu_mips_phys_to_kseg0
;
834 /* if kernel entry is in useg it is probably a KVM T&E kernel */
835 mips_um_ksegs_enable();
837 xlate_to_kseg0
= cpu_mips_kvm_um_phys_to_kseg0
;
843 if (loaderparams
.initrd_filename
) {
844 initrd_size
= get_image_size (loaderparams
.initrd_filename
);
845 if (initrd_size
> 0) {
846 /* The kernel allocates the bootmap memory in the low memory after
847 the initrd. It takes at most 128kiB for 2GB RAM and 4kiB
849 initrd_offset
= (loaderparams
.ram_low_size
- initrd_size
- 131072
850 - ~INITRD_PAGE_MASK
) & INITRD_PAGE_MASK
;
851 if (kernel_high
>= initrd_offset
) {
852 error_report("memory too small for initial ram disk '%s'",
853 loaderparams
.initrd_filename
);
856 initrd_size
= load_image_targphys(loaderparams
.initrd_filename
,
858 ram_size
- initrd_offset
);
860 if (initrd_size
== (target_ulong
) -1) {
861 error_report("could not load initial ram disk '%s'",
862 loaderparams
.initrd_filename
);
867 /* Setup prom parameters. */
868 prom_size
= ENVP_NB_ENTRIES
* (sizeof(int32_t) + ENVP_ENTRY_SIZE
);
869 prom_buf
= g_malloc(prom_size
);
871 prom_set(prom_buf
, prom_index
++, "%s", loaderparams
.kernel_filename
);
872 if (initrd_size
> 0) {
873 prom_set(prom_buf
, prom_index
++, "rd_start=0x%" PRIx64
" rd_size=%li %s",
874 xlate_to_kseg0(NULL
, initrd_offset
), initrd_size
,
875 loaderparams
.kernel_cmdline
);
877 prom_set(prom_buf
, prom_index
++, "%s", loaderparams
.kernel_cmdline
);
880 prom_set(prom_buf
, prom_index
++, "memsize");
881 prom_set(prom_buf
, prom_index
++, "%u", loaderparams
.ram_low_size
);
883 prom_set(prom_buf
, prom_index
++, "ememsize");
884 prom_set(prom_buf
, prom_index
++, "%u", loaderparams
.ram_size
);
886 prom_set(prom_buf
, prom_index
++, "modetty0");
887 prom_set(prom_buf
, prom_index
++, "38400n8r");
888 prom_set(prom_buf
, prom_index
++, NULL
);
890 rom_add_blob_fixed("prom", prom_buf
, prom_size
,
891 cpu_mips_kseg0_to_phys(NULL
, ENVP_ADDR
));
897 static void malta_mips_config(MIPSCPU
*cpu
)
899 CPUMIPSState
*env
= &cpu
->env
;
900 CPUState
*cs
= CPU(cpu
);
902 env
->mvp
->CP0_MVPConf0
|= ((smp_cpus
- 1) << CP0MVPC0_PVPE
) |
903 ((smp_cpus
* cs
->nr_threads
- 1) << CP0MVPC0_PTC
);
906 static void main_cpu_reset(void *opaque
)
908 MIPSCPU
*cpu
= opaque
;
909 CPUMIPSState
*env
= &cpu
->env
;
913 /* The bootloader does not need to be rewritten as it is located in a
914 read only location. The kernel location and the arguments table
915 location does not change. */
916 if (loaderparams
.kernel_filename
) {
917 env
->CP0_Status
&= ~(1 << CP0St_ERL
);
920 malta_mips_config(cpu
);
923 /* Start running from the bootloader we wrote to end of RAM */
924 env
->active_tc
.PC
= 0x40000000 + loaderparams
.ram_low_size
;
928 static void create_cpu_without_cps(const char *cpu_type
,
929 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
935 for (i
= 0; i
< smp_cpus
; i
++) {
936 cpu
= MIPS_CPU(cpu_create(cpu_type
));
938 /* Init internal devices */
939 cpu_mips_irq_init_cpu(cpu
);
940 cpu_mips_clock_init(cpu
);
941 qemu_register_reset(main_cpu_reset
, cpu
);
944 cpu
= MIPS_CPU(first_cpu
);
946 *i8259_irq
= env
->irq
[2];
947 *cbus_irq
= env
->irq
[4];
950 static void create_cps(MaltaState
*s
, const char *cpu_type
,
951 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
955 s
->cps
= MIPS_CPS(object_new(TYPE_MIPS_CPS
));
956 qdev_set_parent_bus(DEVICE(s
->cps
), sysbus_get_default());
958 object_property_set_str(OBJECT(s
->cps
), cpu_type
, "cpu-type", &err
);
959 object_property_set_int(OBJECT(s
->cps
), smp_cpus
, "num-vp", &err
);
960 object_property_set_bool(OBJECT(s
->cps
), true, "realized", &err
);
962 error_report("%s", error_get_pretty(err
));
966 sysbus_mmio_map_overlap(SYS_BUS_DEVICE(s
->cps
), 0, 0, 1);
968 *i8259_irq
= get_cps_irq(s
->cps
, 3);
972 static void mips_create_cpu(MaltaState
*s
, const char *cpu_type
,
973 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
975 if ((smp_cpus
> 1) && cpu_supports_cps_smp(cpu_type
)) {
976 create_cps(s
, cpu_type
, cbus_irq
, i8259_irq
);
978 create_cpu_without_cps(cpu_type
, cbus_irq
, i8259_irq
);
983 void mips_malta_init(MachineState
*machine
)
985 ram_addr_t ram_size
= machine
->ram_size
;
986 ram_addr_t ram_low_size
;
987 const char *kernel_filename
= machine
->kernel_filename
;
988 const char *kernel_cmdline
= machine
->kernel_cmdline
;
989 const char *initrd_filename
= machine
->initrd_filename
;
992 MemoryRegion
*system_memory
= get_system_memory();
993 MemoryRegion
*ram_high
= g_new(MemoryRegion
, 1);
994 MemoryRegion
*ram_low_preio
= g_new(MemoryRegion
, 1);
995 MemoryRegion
*ram_low_postio
;
996 MemoryRegion
*bios
, *bios_copy
= g_new(MemoryRegion
, 1);
997 target_long bios_size
= FLASH_SIZE
;
998 const size_t smbus_eeprom_size
= 8 * 256;
999 uint8_t *smbus_eeprom_buf
= g_malloc0(smbus_eeprom_size
);
1000 int64_t kernel_entry
, bootloader_run_addr
;
1004 qemu_irq cbus_irq
, i8259_irq
;
1009 DriveInfo
*hd
[MAX_IDE_BUS
* MAX_IDE_DEVS
];
1010 DriveInfo
*fd
[MAX_FD
];
1012 int fl_sectors
= bios_size
>> 16;
1015 DeviceState
*dev
= qdev_create(NULL
, TYPE_MIPS_MALTA
);
1016 MaltaState
*s
= MIPS_MALTA(dev
);
1018 /* The whole address space decoded by the GT-64120A doesn't generate
1019 exception when accessing invalid memory. Create an empty slot to
1020 emulate this feature. */
1021 empty_slot_init(0, 0x20000000);
1023 qdev_init_nofail(dev
);
1025 /* Make sure the first 3 serial ports are associated with a device. */
1026 for(i
= 0; i
< 3; i
++) {
1027 if (!serial_hds
[i
]) {
1029 snprintf(label
, sizeof(label
), "serial%d", i
);
1030 serial_hds
[i
] = qemu_chr_new(label
, "null");
1035 mips_create_cpu(s
, machine
->cpu_type
, &cbus_irq
, &i8259_irq
);
1038 if (ram_size
> (2048u << 20)) {
1039 error_report("Too much memory for this machine: %dMB, maximum 2048MB",
1040 ((unsigned int)ram_size
/ (1 << 20)));
1044 /* register RAM at high address where it is undisturbed by IO */
1045 memory_region_allocate_system_memory(ram_high
, NULL
, "mips_malta.ram",
1047 memory_region_add_subregion(system_memory
, 0x80000000, ram_high
);
1049 /* alias for pre IO hole access */
1050 memory_region_init_alias(ram_low_preio
, NULL
, "mips_malta_low_preio.ram",
1051 ram_high
, 0, MIN(ram_size
, (256 << 20)));
1052 memory_region_add_subregion(system_memory
, 0, ram_low_preio
);
1054 /* alias for post IO hole access, if there is enough RAM */
1055 if (ram_size
> (512 << 20)) {
1056 ram_low_postio
= g_new(MemoryRegion
, 1);
1057 memory_region_init_alias(ram_low_postio
, NULL
,
1058 "mips_malta_low_postio.ram",
1059 ram_high
, 512 << 20,
1060 ram_size
- (512 << 20));
1061 memory_region_add_subregion(system_memory
, 512 << 20, ram_low_postio
);
1064 /* generate SPD EEPROM data */
1065 generate_eeprom_spd(&smbus_eeprom_buf
[0 * 256], ram_size
);
1066 generate_eeprom_serial(&smbus_eeprom_buf
[6 * 256]);
1068 #ifdef TARGET_WORDS_BIGENDIAN
1074 /* The CBUS UART is attached to the MIPS CPU INT2 pin, ie interrupt 4 */
1075 malta_fpga_init(system_memory
, FPGA_ADDRESS
, cbus_irq
, serial_hds
[2]);
1077 /* Load firmware in flash / BIOS. */
1078 dinfo
= drive_get(IF_PFLASH
, 0, fl_idx
);
1079 #ifdef DEBUG_BOARD_INIT
1081 printf("Register parallel flash %d size " TARGET_FMT_lx
" at "
1082 "addr %08llx '%s' %x\n",
1083 fl_idx
, bios_size
, FLASH_ADDRESS
,
1084 blk_name(dinfo
->bdrv
), fl_sectors
);
1087 fl
= pflash_cfi01_register(FLASH_ADDRESS
, NULL
, "mips_malta.bios",
1089 dinfo
? blk_by_legacy_dinfo(dinfo
) : NULL
,
1091 4, 0x0000, 0x0000, 0x0000, 0x0000, be
);
1092 bios
= pflash_cfi01_get_memory(fl
);
1094 if (kernel_filename
) {
1095 ram_low_size
= MIN(ram_size
, 256 << 20);
1096 /* For KVM we reserve 1MB of RAM for running bootloader */
1097 if (kvm_enabled()) {
1098 ram_low_size
-= 0x100000;
1099 bootloader_run_addr
= 0x40000000 + ram_low_size
;
1101 bootloader_run_addr
= 0xbfc00000;
1104 /* Write a small bootloader to the flash location. */
1105 loaderparams
.ram_size
= ram_size
;
1106 loaderparams
.ram_low_size
= ram_low_size
;
1107 loaderparams
.kernel_filename
= kernel_filename
;
1108 loaderparams
.kernel_cmdline
= kernel_cmdline
;
1109 loaderparams
.initrd_filename
= initrd_filename
;
1110 kernel_entry
= load_kernel();
1112 write_bootloader(memory_region_get_ram_ptr(bios
),
1113 bootloader_run_addr
, kernel_entry
);
1114 if (kvm_enabled()) {
1115 /* Write the bootloader code @ the end of RAM, 1MB reserved */
1116 write_bootloader(memory_region_get_ram_ptr(ram_low_preio
) +
1118 bootloader_run_addr
, kernel_entry
);
1121 /* The flash region isn't executable from a KVM guest */
1122 if (kvm_enabled()) {
1123 error_report("KVM enabled but no -kernel argument was specified. "
1124 "Booting from flash is not supported with KVM.");
1127 /* Load firmware from flash. */
1129 /* Load a BIOS image. */
1130 if (bios_name
== NULL
) {
1131 bios_name
= BIOS_FILENAME
;
1133 filename
= qemu_find_file(QEMU_FILE_TYPE_BIOS
, bios_name
);
1135 bios_size
= load_image_targphys(filename
, FLASH_ADDRESS
,
1141 if ((bios_size
< 0 || bios_size
> BIOS_SIZE
) &&
1142 !kernel_filename
&& !qtest_enabled()) {
1143 error_report("Could not load MIPS bios '%s', and no "
1144 "-kernel argument was specified", bios_name
);
1148 /* In little endian mode the 32bit words in the bios are swapped,
1149 a neat trick which allows bi-endian firmware. */
1150 #ifndef TARGET_WORDS_BIGENDIAN
1152 uint32_t *end
, *addr
= rom_ptr(FLASH_ADDRESS
);
1154 addr
= memory_region_get_ram_ptr(bios
);
1156 end
= (void *)addr
+ MIN(bios_size
, 0x3e0000);
1157 while (addr
< end
) {
1166 * Map the BIOS at a 2nd physical location, as on the real board.
1167 * Copy it so that we can patch in the MIPS revision, which cannot be
1168 * handled by an overlapping region as the resulting ROM code subpage
1169 * regions are not executable.
1171 memory_region_init_ram_nomigrate(bios_copy
, NULL
, "bios.1fc", BIOS_SIZE
,
1173 if (!rom_copy(memory_region_get_ram_ptr(bios_copy
),
1174 FLASH_ADDRESS
, BIOS_SIZE
)) {
1175 memcpy(memory_region_get_ram_ptr(bios_copy
),
1176 memory_region_get_ram_ptr(bios
), BIOS_SIZE
);
1178 memory_region_set_readonly(bios_copy
, true);
1179 memory_region_add_subregion(system_memory
, RESET_ADDRESS
, bios_copy
);
1181 /* Board ID = 0x420 (Malta Board with CoreLV) */
1182 stl_p(memory_region_get_ram_ptr(bios_copy
) + 0x10, 0x00000420);
1185 * We have a circular dependency problem: pci_bus depends on isa_irq,
1186 * isa_irq is provided by i8259, i8259 depends on ISA, ISA depends
1187 * on piix4, and piix4 depends on pci_bus. To stop the cycle we have
1188 * qemu_irq_proxy() adds an extra bit of indirection, allowing us
1189 * to resolve the isa_irq -> i8259 dependency after i8259 is initialized.
1191 isa_irq
= qemu_irq_proxy(&s
->i8259
, 16);
1194 pci_bus
= gt64120_register(isa_irq
);
1197 ide_drive_get(hd
, ARRAY_SIZE(hd
));
1199 piix4_devfn
= piix4_init(pci_bus
, &isa_bus
, 80);
1201 /* Interrupt controller */
1202 /* The 8259 is attached to the MIPS CPU INT0 pin, ie interrupt 2 */
1203 s
->i8259
= i8259_init(isa_bus
, i8259_irq
);
1205 isa_bus_irqs(isa_bus
, s
->i8259
);
1206 pci_piix4_ide_init(pci_bus
, hd
, piix4_devfn
+ 1);
1207 pci_create_simple(pci_bus
, piix4_devfn
+ 2, "piix4-usb-uhci");
1208 smbus
= piix4_pm_init(pci_bus
, piix4_devfn
+ 3, 0x1100,
1209 isa_get_irq(NULL
, 9), NULL
, 0, NULL
);
1210 smbus_eeprom_init(smbus
, 8, smbus_eeprom_buf
, smbus_eeprom_size
);
1211 g_free(smbus_eeprom_buf
);
1212 pit
= i8254_pit_init(isa_bus
, 0x40, 0, NULL
);
1213 i8257_dma_init(isa_bus
, 0);
1216 isa_create_simple(isa_bus
, "i8042");
1218 mc146818_rtc_init(isa_bus
, 2000, NULL
);
1219 serial_hds_isa_init(isa_bus
, 0, 2);
1220 parallel_hds_isa_init(isa_bus
, 1);
1222 for(i
= 0; i
< MAX_FD
; i
++) {
1223 fd
[i
] = drive_get(IF_FLOPPY
, 0, i
);
1225 fdctrl_init_isa(isa_bus
, fd
);
1228 network_init(pci_bus
);
1230 /* Optional PCI video card */
1231 pci_vga_init(pci_bus
);
1234 static int mips_malta_sysbus_device_init(SysBusDevice
*sysbusdev
)
1239 static void mips_malta_class_init(ObjectClass
*klass
, void *data
)
1241 SysBusDeviceClass
*k
= SYS_BUS_DEVICE_CLASS(klass
);
1243 k
->init
= mips_malta_sysbus_device_init
;
1246 static const TypeInfo mips_malta_device
= {
1247 .name
= TYPE_MIPS_MALTA
,
1248 .parent
= TYPE_SYS_BUS_DEVICE
,
1249 .instance_size
= sizeof(MaltaState
),
1250 .class_init
= mips_malta_class_init
,
1253 static void mips_malta_machine_init(MachineClass
*mc
)
1255 mc
->desc
= "MIPS Malta Core LV";
1256 mc
->init
= mips_malta_init
;
1257 mc
->block_default_type
= IF_IDE
;
1260 #ifdef TARGET_MIPS64
1261 mc
->default_cpu_type
= MIPS_CPU_TYPE_NAME("20Kc");
1263 mc
->default_cpu_type
= MIPS_CPU_TYPE_NAME("24Kf");
1267 DEFINE_MACHINE("malta", mips_malta_machine_init
)
1269 static void mips_malta_register_types(void)
1271 type_register_static(&mips_malta_device
);
1274 type_init(mips_malta_register_types
)