2 * QEMU Malta board support
4 * Copyright (c) 2006 Aurelien Jarno
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 #include "qemu/osdep.h"
26 #include "qemu-common.h"
29 #include "hw/i386/pc.h"
30 #include "hw/dma/i8257.h"
31 #include "hw/char/serial.h"
32 #include "hw/char/parallel.h"
33 #include "hw/block/fdc.h"
35 #include "hw/boards.h"
36 #include "hw/i2c/smbus.h"
37 #include "sysemu/block-backend.h"
38 #include "hw/block/flash.h"
39 #include "hw/mips/mips.h"
40 #include "hw/mips/cpudevs.h"
41 #include "hw/pci/pci.h"
42 #include "sysemu/sysemu.h"
43 #include "sysemu/arch_init.h"
45 #include "hw/mips/bios.h"
47 #include "hw/loader.h"
49 #include "hw/timer/mc146818rtc.h"
50 #include "hw/input/i8042.h"
51 #include "hw/timer/i8254.h"
52 #include "sysemu/blockdev.h"
53 #include "exec/address-spaces.h"
54 #include "hw/sysbus.h" /* SysBusDevice */
55 #include "qemu/host-utils.h"
56 #include "sysemu/qtest.h"
57 #include "qapi/error.h"
58 #include "qemu/error-report.h"
59 #include "hw/empty_slot.h"
60 #include "sysemu/kvm.h"
61 #include "exec/semihost.h"
62 #include "hw/mips/cps.h"
64 //#define DEBUG_BOARD_INIT
66 #define ENVP_ADDR 0x80002000l
67 #define ENVP_NB_ENTRIES 16
68 #define ENVP_ENTRY_SIZE 256
70 /* Hardware addresses */
71 #define FLASH_ADDRESS 0x1e000000ULL
72 #define FPGA_ADDRESS 0x1f000000ULL
73 #define RESET_ADDRESS 0x1fc00000ULL
75 #define FLASH_SIZE 0x400000
81 MemoryRegion iomem_lo
; /* 0 - 0x900 */
82 MemoryRegion iomem_hi
; /* 0xa00 - 0x100000 */
96 #define TYPE_MIPS_MALTA "mips-malta"
97 #define MIPS_MALTA(obj) OBJECT_CHECK(MaltaState, (obj), TYPE_MIPS_MALTA)
100 SysBusDevice parent_obj
;
106 static ISADevice
*pit
;
108 static struct _loaderparams
{
109 int ram_size
, ram_low_size
;
110 const char *kernel_filename
;
111 const char *kernel_cmdline
;
112 const char *initrd_filename
;
116 static void malta_fpga_update_display(void *opaque
)
120 MaltaFPGAState
*s
= opaque
;
122 for (i
= 7 ; i
>= 0 ; i
--) {
123 if (s
->leds
& (1 << i
))
130 qemu_chr_fe_printf(&s
->display
, "\e[H\n\n|\e[32m%-8.8s\e[00m|\r\n",
132 qemu_chr_fe_printf(&s
->display
, "\n\n\n\n|\e[31m%-8.8s\e[00m|",
137 * EEPROM 24C01 / 24C02 emulation.
139 * Emulation for serial EEPROMs:
140 * 24C01 - 1024 bit (128 x 8)
141 * 24C02 - 2048 bit (256 x 8)
143 * Typical device names include Microchip 24C02SC or SGS Thomson ST24C02.
149 # define logout(fmt, ...) fprintf(stderr, "MALTA\t%-24s" fmt, __func__, ## __VA_ARGS__)
151 # define logout(fmt, ...) ((void)0)
154 struct _eeprom24c0x_t
{
163 uint8_t contents
[256];
166 typedef struct _eeprom24c0x_t eeprom24c0x_t
;
168 static eeprom24c0x_t spd_eeprom
= {
170 /* 00000000: */ 0x80,0x08,0xFF,0x0D,0x0A,0xFF,0x40,0x00,
171 /* 00000008: */ 0x01,0x75,0x54,0x00,0x82,0x08,0x00,0x01,
172 /* 00000010: */ 0x8F,0x04,0x02,0x01,0x01,0x00,0x00,0x00,
173 /* 00000018: */ 0x00,0x00,0x00,0x14,0x0F,0x14,0x2D,0xFF,
174 /* 00000020: */ 0x15,0x08,0x15,0x08,0x00,0x00,0x00,0x00,
175 /* 00000028: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
176 /* 00000030: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
177 /* 00000038: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x12,0xD0,
178 /* 00000040: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
179 /* 00000048: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
180 /* 00000050: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
181 /* 00000058: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
182 /* 00000060: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
183 /* 00000068: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
184 /* 00000070: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
185 /* 00000078: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x64,0xF4,
189 static void generate_eeprom_spd(uint8_t *eeprom
, ram_addr_t ram_size
)
191 enum { SDR
= 0x4, DDR2
= 0x8 } type
;
192 uint8_t *spd
= spd_eeprom
.contents
;
194 uint16_t density
= 0;
197 /* work in terms of MB */
200 while ((ram_size
>= 4) && (nbanks
<= 2)) {
201 int sz_log2
= MIN(31 - clz32(ram_size
), 14);
203 density
|= 1 << (sz_log2
- 2);
204 ram_size
-= 1 << sz_log2
;
207 /* split to 2 banks if possible */
208 if ((nbanks
== 1) && (density
> 1)) {
213 if (density
& 0xff00) {
214 density
= (density
& 0xe0) | ((density
>> 8) & 0x1f);
216 } else if (!(density
& 0x1f)) {
223 warn_report("SPD cannot represent final " RAM_ADDR_FMT
"MB"
224 " of SDRAM", ram_size
);
227 /* fill in SPD memory information */
234 for (i
= 0; i
< 63; i
++) {
239 memcpy(eeprom
, spd
, sizeof(spd_eeprom
.contents
));
242 static void generate_eeprom_serial(uint8_t *eeprom
)
245 uint8_t mac
[6] = { 0x00 };
246 uint8_t sn
[5] = { 0x01, 0x23, 0x45, 0x67, 0x89 };
249 eeprom
[pos
++] = 0x01;
252 eeprom
[pos
++] = 0x02;
255 eeprom
[pos
++] = 0x01; /* MAC */
256 eeprom
[pos
++] = 0x06; /* length */
257 memcpy(&eeprom
[pos
], mac
, sizeof(mac
));
261 eeprom
[pos
++] = 0x02; /* serial */
262 eeprom
[pos
++] = 0x05; /* length */
263 memcpy(&eeprom
[pos
], sn
, sizeof(sn
));
268 for (i
= 0; i
< pos
; i
++) {
269 eeprom
[pos
] += eeprom
[i
];
273 static uint8_t eeprom24c0x_read(eeprom24c0x_t
*eeprom
)
275 logout("%u: scl = %u, sda = %u, data = 0x%02x\n",
276 eeprom
->tick
, eeprom
->scl
, eeprom
->sda
, eeprom
->data
);
280 static void eeprom24c0x_write(eeprom24c0x_t
*eeprom
, int scl
, int sda
)
282 if (eeprom
->scl
&& scl
&& (eeprom
->sda
!= sda
)) {
283 logout("%u: scl = %u->%u, sda = %u->%u i2c %s\n",
284 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
,
285 sda
? "stop" : "start");
290 } else if (eeprom
->tick
== 0 && !eeprom
->ack
) {
291 /* Waiting for start. */
292 logout("%u: scl = %u->%u, sda = %u->%u wait for i2c start\n",
293 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
);
294 } else if (!eeprom
->scl
&& scl
) {
295 logout("%u: scl = %u->%u, sda = %u->%u trigger bit\n",
296 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
);
298 logout("\ti2c ack bit = 0\n");
301 } else if (eeprom
->sda
== sda
) {
302 uint8_t bit
= (sda
!= 0);
303 logout("\ti2c bit = %d\n", bit
);
304 if (eeprom
->tick
< 9) {
305 eeprom
->command
<<= 1;
306 eeprom
->command
+= bit
;
308 if (eeprom
->tick
== 9) {
309 logout("\tcommand 0x%04x, %s\n", eeprom
->command
,
310 bit
? "read" : "write");
313 } else if (eeprom
->tick
< 17) {
314 if (eeprom
->command
& 1) {
315 sda
= ((eeprom
->data
& 0x80) != 0);
317 eeprom
->address
<<= 1;
318 eeprom
->address
+= bit
;
321 if (eeprom
->tick
== 17) {
322 eeprom
->data
= eeprom
->contents
[eeprom
->address
];
323 logout("\taddress 0x%04x, data 0x%02x\n",
324 eeprom
->address
, eeprom
->data
);
328 } else if (eeprom
->tick
>= 17) {
332 logout("\tsda changed with raising scl\n");
335 logout("%u: scl = %u->%u, sda = %u->%u\n", eeprom
->tick
, eeprom
->scl
,
336 scl
, eeprom
->sda
, sda
);
342 static uint64_t malta_fpga_read(void *opaque
, hwaddr addr
,
345 MaltaFPGAState
*s
= opaque
;
349 saddr
= (addr
& 0xfffff);
353 /* SWITCH Register */
355 val
= 0x00000000; /* All switches closed */
358 /* STATUS Register */
360 #ifdef TARGET_WORDS_BIGENDIAN
372 /* LEDBAR Register */
377 /* BRKRES Register */
382 /* UART Registers are handled directly by the serial device */
389 /* XXX: implement a real I2C controller */
393 /* IN = OUT until a real I2C control is implemented */
400 /* I2CINP Register */
402 val
= ((s
->i2cin
& ~1) | eeprom24c0x_read(&spd_eeprom
));
410 /* I2COUT Register */
415 /* I2CSEL Register */
422 printf ("malta_fpga_read: Bad register offset 0x" TARGET_FMT_lx
"\n",
430 static void malta_fpga_write(void *opaque
, hwaddr addr
,
431 uint64_t val
, unsigned size
)
433 MaltaFPGAState
*s
= opaque
;
436 saddr
= (addr
& 0xfffff);
440 /* SWITCH Register */
448 /* LEDBAR Register */
450 s
->leds
= val
& 0xff;
451 malta_fpga_update_display(s
);
454 /* ASCIIWORD Register */
456 snprintf(s
->display_text
, 9, "%08X", (uint32_t)val
);
457 malta_fpga_update_display(s
);
460 /* ASCIIPOS0 to ASCIIPOS7 Registers */
469 s
->display_text
[(saddr
- 0x00418) >> 3] = (char) val
;
470 malta_fpga_update_display(s
);
473 /* SOFTRES Register */
476 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET
);
479 /* BRKRES Register */
484 /* UART Registers are handled directly by the serial device */
488 s
->gpout
= val
& 0xff;
493 s
->i2coe
= val
& 0x03;
496 /* I2COUT Register */
498 eeprom24c0x_write(&spd_eeprom
, val
& 0x02, val
& 0x01);
502 /* I2CSEL Register */
504 s
->i2csel
= val
& 0x01;
509 printf ("malta_fpga_write: Bad register offset 0x" TARGET_FMT_lx
"\n",
516 static const MemoryRegionOps malta_fpga_ops
= {
517 .read
= malta_fpga_read
,
518 .write
= malta_fpga_write
,
519 .endianness
= DEVICE_NATIVE_ENDIAN
,
522 static void malta_fpga_reset(void *opaque
)
524 MaltaFPGAState
*s
= opaque
;
534 s
->display_text
[8] = '\0';
535 snprintf(s
->display_text
, 9, " ");
538 static void malta_fgpa_display_event(void *opaque
, int event
)
540 MaltaFPGAState
*s
= opaque
;
542 if (event
== CHR_EVENT_OPENED
&& !s
->display_inited
) {
543 qemu_chr_fe_printf(&s
->display
, "\e[HMalta LEDBAR\r\n");
544 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
545 qemu_chr_fe_printf(&s
->display
, "+ +\r\n");
546 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
547 qemu_chr_fe_printf(&s
->display
, "\n");
548 qemu_chr_fe_printf(&s
->display
, "Malta ASCII\r\n");
549 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
550 qemu_chr_fe_printf(&s
->display
, "+ +\r\n");
551 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
552 s
->display_inited
= true;
556 static MaltaFPGAState
*malta_fpga_init(MemoryRegion
*address_space
,
557 hwaddr base
, qemu_irq uart_irq
, Chardev
*uart_chr
)
562 s
= (MaltaFPGAState
*)g_malloc0(sizeof(MaltaFPGAState
));
564 memory_region_init_io(&s
->iomem
, NULL
, &malta_fpga_ops
, s
,
565 "malta-fpga", 0x100000);
566 memory_region_init_alias(&s
->iomem_lo
, NULL
, "malta-fpga",
567 &s
->iomem
, 0, 0x900);
568 memory_region_init_alias(&s
->iomem_hi
, NULL
, "malta-fpga",
569 &s
->iomem
, 0xa00, 0x10000-0xa00);
571 memory_region_add_subregion(address_space
, base
, &s
->iomem_lo
);
572 memory_region_add_subregion(address_space
, base
+ 0xa00, &s
->iomem_hi
);
574 chr
= qemu_chr_new("fpga", "vc:320x200");
575 qemu_chr_fe_init(&s
->display
, chr
, NULL
);
576 qemu_chr_fe_set_handlers(&s
->display
, NULL
, NULL
,
577 malta_fgpa_display_event
, NULL
, s
, NULL
, true);
579 s
->uart
= serial_mm_init(address_space
, base
+ 0x900, 3, uart_irq
,
580 230400, uart_chr
, DEVICE_NATIVE_ENDIAN
);
583 qemu_register_reset(malta_fpga_reset
, s
);
588 /* Network support */
589 static void network_init(PCIBus
*pci_bus
)
593 for(i
= 0; i
< nb_nics
; i
++) {
594 NICInfo
*nd
= &nd_table
[i
];
595 const char *default_devaddr
= NULL
;
597 if (i
== 0 && (!nd
->model
|| strcmp(nd
->model
, "pcnet") == 0))
598 /* The malta board has a PCNet card using PCI SLOT 11 */
599 default_devaddr
= "0b";
601 pci_nic_init_nofail(nd
, pci_bus
, "pcnet", default_devaddr
);
605 /* ROM and pseudo bootloader
607 The following code implements a very very simple bootloader. It first
608 loads the registers a0 to a3 to the values expected by the OS, and
609 then jump at the kernel address.
611 The bootloader should pass the locations of the kernel arguments and
612 environment variables tables. Those tables contain the 32-bit address
613 of NULL terminated strings. The environment variables table should be
614 terminated by a NULL address.
616 For a simpler implementation, the number of kernel arguments is fixed
617 to two (the name of the kernel and the command line), and the two
618 tables are actually the same one.
620 The registers a0 to a3 should contain the following values:
621 a0 - number of kernel arguments
622 a1 - 32-bit address of the kernel arguments table
623 a2 - 32-bit address of the environment variables table
624 a3 - RAM size in bytes
627 static void write_bootloader(uint8_t *base
, int64_t run_addr
,
628 int64_t kernel_entry
)
632 /* Small bootloader */
633 p
= (uint32_t *)base
;
635 stl_p(p
++, 0x08000000 | /* j 0x1fc00580 */
636 ((run_addr
+ 0x580) & 0x0fffffff) >> 2);
637 stl_p(p
++, 0x00000000); /* nop */
639 /* YAMON service vector */
640 stl_p(base
+ 0x500, run_addr
+ 0x0580); /* start: */
641 stl_p(base
+ 0x504, run_addr
+ 0x083c); /* print_count: */
642 stl_p(base
+ 0x520, run_addr
+ 0x0580); /* start: */
643 stl_p(base
+ 0x52c, run_addr
+ 0x0800); /* flush_cache: */
644 stl_p(base
+ 0x534, run_addr
+ 0x0808); /* print: */
645 stl_p(base
+ 0x538, run_addr
+ 0x0800); /* reg_cpu_isr: */
646 stl_p(base
+ 0x53c, run_addr
+ 0x0800); /* unred_cpu_isr: */
647 stl_p(base
+ 0x540, run_addr
+ 0x0800); /* reg_ic_isr: */
648 stl_p(base
+ 0x544, run_addr
+ 0x0800); /* unred_ic_isr: */
649 stl_p(base
+ 0x548, run_addr
+ 0x0800); /* reg_esr: */
650 stl_p(base
+ 0x54c, run_addr
+ 0x0800); /* unreg_esr: */
651 stl_p(base
+ 0x550, run_addr
+ 0x0800); /* getchar: */
652 stl_p(base
+ 0x554, run_addr
+ 0x0800); /* syscon_read: */
655 /* Second part of the bootloader */
656 p
= (uint32_t *) (base
+ 0x580);
658 if (semihosting_get_argc()) {
659 /* Preserve a0 content as arguments have been passed */
660 stl_p(p
++, 0x00000000); /* nop */
662 stl_p(p
++, 0x24040002); /* addiu a0, zero, 2 */
664 stl_p(p
++, 0x3c1d0000 | (((ENVP_ADDR
- 64) >> 16) & 0xffff)); /* lui sp, high(ENVP_ADDR) */
665 stl_p(p
++, 0x37bd0000 | ((ENVP_ADDR
- 64) & 0xffff)); /* ori sp, sp, low(ENVP_ADDR) */
666 stl_p(p
++, 0x3c050000 | ((ENVP_ADDR
>> 16) & 0xffff)); /* lui a1, high(ENVP_ADDR) */
667 stl_p(p
++, 0x34a50000 | (ENVP_ADDR
& 0xffff)); /* ori a1, a1, low(ENVP_ADDR) */
668 stl_p(p
++, 0x3c060000 | (((ENVP_ADDR
+ 8) >> 16) & 0xffff)); /* lui a2, high(ENVP_ADDR + 8) */
669 stl_p(p
++, 0x34c60000 | ((ENVP_ADDR
+ 8) & 0xffff)); /* ori a2, a2, low(ENVP_ADDR + 8) */
670 stl_p(p
++, 0x3c070000 | (loaderparams
.ram_low_size
>> 16)); /* lui a3, high(ram_low_size) */
671 stl_p(p
++, 0x34e70000 | (loaderparams
.ram_low_size
& 0xffff)); /* ori a3, a3, low(ram_low_size) */
673 /* Load BAR registers as done by YAMON */
674 stl_p(p
++, 0x3c09b400); /* lui t1, 0xb400 */
676 #ifdef TARGET_WORDS_BIGENDIAN
677 stl_p(p
++, 0x3c08df00); /* lui t0, 0xdf00 */
679 stl_p(p
++, 0x340800df); /* ori t0, r0, 0x00df */
681 stl_p(p
++, 0xad280068); /* sw t0, 0x0068(t1) */
683 stl_p(p
++, 0x3c09bbe0); /* lui t1, 0xbbe0 */
685 #ifdef TARGET_WORDS_BIGENDIAN
686 stl_p(p
++, 0x3c08c000); /* lui t0, 0xc000 */
688 stl_p(p
++, 0x340800c0); /* ori t0, r0, 0x00c0 */
690 stl_p(p
++, 0xad280048); /* sw t0, 0x0048(t1) */
691 #ifdef TARGET_WORDS_BIGENDIAN
692 stl_p(p
++, 0x3c084000); /* lui t0, 0x4000 */
694 stl_p(p
++, 0x34080040); /* ori t0, r0, 0x0040 */
696 stl_p(p
++, 0xad280050); /* sw t0, 0x0050(t1) */
698 #ifdef TARGET_WORDS_BIGENDIAN
699 stl_p(p
++, 0x3c088000); /* lui t0, 0x8000 */
701 stl_p(p
++, 0x34080080); /* ori t0, r0, 0x0080 */
703 stl_p(p
++, 0xad280058); /* sw t0, 0x0058(t1) */
704 #ifdef TARGET_WORDS_BIGENDIAN
705 stl_p(p
++, 0x3c083f00); /* lui t0, 0x3f00 */
707 stl_p(p
++, 0x3408003f); /* ori t0, r0, 0x003f */
709 stl_p(p
++, 0xad280060); /* sw t0, 0x0060(t1) */
711 #ifdef TARGET_WORDS_BIGENDIAN
712 stl_p(p
++, 0x3c08c100); /* lui t0, 0xc100 */
714 stl_p(p
++, 0x340800c1); /* ori t0, r0, 0x00c1 */
716 stl_p(p
++, 0xad280080); /* sw t0, 0x0080(t1) */
717 #ifdef TARGET_WORDS_BIGENDIAN
718 stl_p(p
++, 0x3c085e00); /* lui t0, 0x5e00 */
720 stl_p(p
++, 0x3408005e); /* ori t0, r0, 0x005e */
722 stl_p(p
++, 0xad280088); /* sw t0, 0x0088(t1) */
724 /* Jump to kernel code */
725 stl_p(p
++, 0x3c1f0000 | ((kernel_entry
>> 16) & 0xffff)); /* lui ra, high(kernel_entry) */
726 stl_p(p
++, 0x37ff0000 | (kernel_entry
& 0xffff)); /* ori ra, ra, low(kernel_entry) */
727 stl_p(p
++, 0x03e00009); /* jalr ra */
728 stl_p(p
++, 0x00000000); /* nop */
730 /* YAMON subroutines */
731 p
= (uint32_t *) (base
+ 0x800);
732 stl_p(p
++, 0x03e00009); /* jalr ra */
733 stl_p(p
++, 0x24020000); /* li v0,0 */
734 /* 808 YAMON print */
735 stl_p(p
++, 0x03e06821); /* move t5,ra */
736 stl_p(p
++, 0x00805821); /* move t3,a0 */
737 stl_p(p
++, 0x00a05021); /* move t2,a1 */
738 stl_p(p
++, 0x91440000); /* lbu a0,0(t2) */
739 stl_p(p
++, 0x254a0001); /* addiu t2,t2,1 */
740 stl_p(p
++, 0x10800005); /* beqz a0,834 */
741 stl_p(p
++, 0x00000000); /* nop */
742 stl_p(p
++, 0x0ff0021c); /* jal 870 */
743 stl_p(p
++, 0x00000000); /* nop */
744 stl_p(p
++, 0x1000fff9); /* b 814 */
745 stl_p(p
++, 0x00000000); /* nop */
746 stl_p(p
++, 0x01a00009); /* jalr t5 */
747 stl_p(p
++, 0x01602021); /* move a0,t3 */
748 /* 0x83c YAMON print_count */
749 stl_p(p
++, 0x03e06821); /* move t5,ra */
750 stl_p(p
++, 0x00805821); /* move t3,a0 */
751 stl_p(p
++, 0x00a05021); /* move t2,a1 */
752 stl_p(p
++, 0x00c06021); /* move t4,a2 */
753 stl_p(p
++, 0x91440000); /* lbu a0,0(t2) */
754 stl_p(p
++, 0x0ff0021c); /* jal 870 */
755 stl_p(p
++, 0x00000000); /* nop */
756 stl_p(p
++, 0x254a0001); /* addiu t2,t2,1 */
757 stl_p(p
++, 0x258cffff); /* addiu t4,t4,-1 */
758 stl_p(p
++, 0x1580fffa); /* bnez t4,84c */
759 stl_p(p
++, 0x00000000); /* nop */
760 stl_p(p
++, 0x01a00009); /* jalr t5 */
761 stl_p(p
++, 0x01602021); /* move a0,t3 */
763 stl_p(p
++, 0x3c08b800); /* lui t0,0xb400 */
764 stl_p(p
++, 0x350803f8); /* ori t0,t0,0x3f8 */
765 stl_p(p
++, 0x91090005); /* lbu t1,5(t0) */
766 stl_p(p
++, 0x00000000); /* nop */
767 stl_p(p
++, 0x31290040); /* andi t1,t1,0x40 */
768 stl_p(p
++, 0x1120fffc); /* beqz t1,878 <outch+0x8> */
769 stl_p(p
++, 0x00000000); /* nop */
770 stl_p(p
++, 0x03e00009); /* jalr ra */
771 stl_p(p
++, 0xa1040000); /* sb a0,0(t0) */
775 static void GCC_FMT_ATTR(3, 4) prom_set(uint32_t* prom_buf
, int index
,
776 const char *string
, ...)
781 if (index
>= ENVP_NB_ENTRIES
)
784 if (string
== NULL
) {
789 table_addr
= sizeof(int32_t) * ENVP_NB_ENTRIES
+ index
* ENVP_ENTRY_SIZE
;
790 prom_buf
[index
] = tswap32(ENVP_ADDR
+ table_addr
);
792 va_start(ap
, string
);
793 vsnprintf((char *)prom_buf
+ table_addr
, ENVP_ENTRY_SIZE
, string
, ap
);
798 static int64_t load_kernel (void)
800 int64_t kernel_entry
, kernel_high
;
801 long kernel_size
, initrd_size
;
802 ram_addr_t initrd_offset
;
807 uint64_t (*xlate_to_kseg0
) (void *opaque
, uint64_t addr
);
809 #ifdef TARGET_WORDS_BIGENDIAN
815 kernel_size
= load_elf(loaderparams
.kernel_filename
, cpu_mips_kseg0_to_phys
,
816 NULL
, (uint64_t *)&kernel_entry
, NULL
,
817 (uint64_t *)&kernel_high
, big_endian
, EM_MIPS
, 1, 0);
818 if (kernel_size
< 0) {
819 error_report("could not load kernel '%s': %s",
820 loaderparams
.kernel_filename
,
821 load_elf_strerror(kernel_size
));
825 /* Check where the kernel has been linked */
826 if (kernel_entry
& 0x80000000ll
) {
828 error_report("KVM guest kernels must be linked in useg. "
829 "Did you forget to enable CONFIG_KVM_GUEST?");
833 xlate_to_kseg0
= cpu_mips_phys_to_kseg0
;
835 /* if kernel entry is in useg it is probably a KVM T&E kernel */
836 mips_um_ksegs_enable();
838 xlate_to_kseg0
= cpu_mips_kvm_um_phys_to_kseg0
;
844 if (loaderparams
.initrd_filename
) {
845 initrd_size
= get_image_size (loaderparams
.initrd_filename
);
846 if (initrd_size
> 0) {
847 /* The kernel allocates the bootmap memory in the low memory after
848 the initrd. It takes at most 128kiB for 2GB RAM and 4kiB
850 initrd_offset
= (loaderparams
.ram_low_size
- initrd_size
- 131072
851 - ~INITRD_PAGE_MASK
) & INITRD_PAGE_MASK
;
852 if (kernel_high
>= initrd_offset
) {
853 error_report("memory too small for initial ram disk '%s'",
854 loaderparams
.initrd_filename
);
857 initrd_size
= load_image_targphys(loaderparams
.initrd_filename
,
859 ram_size
- initrd_offset
);
861 if (initrd_size
== (target_ulong
) -1) {
862 error_report("could not load initial ram disk '%s'",
863 loaderparams
.initrd_filename
);
868 /* Setup prom parameters. */
869 prom_size
= ENVP_NB_ENTRIES
* (sizeof(int32_t) + ENVP_ENTRY_SIZE
);
870 prom_buf
= g_malloc(prom_size
);
872 prom_set(prom_buf
, prom_index
++, "%s", loaderparams
.kernel_filename
);
873 if (initrd_size
> 0) {
874 prom_set(prom_buf
, prom_index
++, "rd_start=0x%" PRIx64
" rd_size=%li %s",
875 xlate_to_kseg0(NULL
, initrd_offset
), initrd_size
,
876 loaderparams
.kernel_cmdline
);
878 prom_set(prom_buf
, prom_index
++, "%s", loaderparams
.kernel_cmdline
);
881 prom_set(prom_buf
, prom_index
++, "memsize");
882 prom_set(prom_buf
, prom_index
++, "%u", loaderparams
.ram_low_size
);
884 prom_set(prom_buf
, prom_index
++, "ememsize");
885 prom_set(prom_buf
, prom_index
++, "%u", loaderparams
.ram_size
);
887 prom_set(prom_buf
, prom_index
++, "modetty0");
888 prom_set(prom_buf
, prom_index
++, "38400n8r");
889 prom_set(prom_buf
, prom_index
++, NULL
);
891 rom_add_blob_fixed("prom", prom_buf
, prom_size
,
892 cpu_mips_kseg0_to_phys(NULL
, ENVP_ADDR
));
898 static void malta_mips_config(MIPSCPU
*cpu
)
900 CPUMIPSState
*env
= &cpu
->env
;
901 CPUState
*cs
= CPU(cpu
);
903 env
->mvp
->CP0_MVPConf0
|= ((smp_cpus
- 1) << CP0MVPC0_PVPE
) |
904 ((smp_cpus
* cs
->nr_threads
- 1) << CP0MVPC0_PTC
);
907 static void main_cpu_reset(void *opaque
)
909 MIPSCPU
*cpu
= opaque
;
910 CPUMIPSState
*env
= &cpu
->env
;
914 /* The bootloader does not need to be rewritten as it is located in a
915 read only location. The kernel location and the arguments table
916 location does not change. */
917 if (loaderparams
.kernel_filename
) {
918 env
->CP0_Status
&= ~(1 << CP0St_ERL
);
921 malta_mips_config(cpu
);
924 /* Start running from the bootloader we wrote to end of RAM */
925 env
->active_tc
.PC
= 0x40000000 + loaderparams
.ram_low_size
;
929 static void create_cpu_without_cps(const char *cpu_type
,
930 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
936 for (i
= 0; i
< smp_cpus
; i
++) {
937 cpu
= MIPS_CPU(cpu_create(cpu_type
));
939 /* Init internal devices */
940 cpu_mips_irq_init_cpu(cpu
);
941 cpu_mips_clock_init(cpu
);
942 qemu_register_reset(main_cpu_reset
, cpu
);
945 cpu
= MIPS_CPU(first_cpu
);
947 *i8259_irq
= env
->irq
[2];
948 *cbus_irq
= env
->irq
[4];
951 static void create_cps(MaltaState
*s
, const char *cpu_type
,
952 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
956 s
->cps
= MIPS_CPS(object_new(TYPE_MIPS_CPS
));
957 qdev_set_parent_bus(DEVICE(s
->cps
), sysbus_get_default());
959 object_property_set_str(OBJECT(s
->cps
), cpu_type
, "cpu-type", &err
);
960 object_property_set_int(OBJECT(s
->cps
), smp_cpus
, "num-vp", &err
);
961 object_property_set_bool(OBJECT(s
->cps
), true, "realized", &err
);
963 error_report("%s", error_get_pretty(err
));
967 sysbus_mmio_map_overlap(SYS_BUS_DEVICE(s
->cps
), 0, 0, 1);
969 *i8259_irq
= get_cps_irq(s
->cps
, 3);
973 static void mips_create_cpu(MaltaState
*s
, const char *cpu_type
,
974 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
976 if ((smp_cpus
> 1) && cpu_supports_cps_smp(cpu_type
)) {
977 create_cps(s
, cpu_type
, cbus_irq
, i8259_irq
);
979 create_cpu_without_cps(cpu_type
, cbus_irq
, i8259_irq
);
984 void mips_malta_init(MachineState
*machine
)
986 ram_addr_t ram_size
= machine
->ram_size
;
987 ram_addr_t ram_low_size
;
988 const char *kernel_filename
= machine
->kernel_filename
;
989 const char *kernel_cmdline
= machine
->kernel_cmdline
;
990 const char *initrd_filename
= machine
->initrd_filename
;
993 MemoryRegion
*system_memory
= get_system_memory();
994 MemoryRegion
*ram_high
= g_new(MemoryRegion
, 1);
995 MemoryRegion
*ram_low_preio
= g_new(MemoryRegion
, 1);
996 MemoryRegion
*ram_low_postio
;
997 MemoryRegion
*bios
, *bios_copy
= g_new(MemoryRegion
, 1);
998 target_long bios_size
= FLASH_SIZE
;
999 const size_t smbus_eeprom_size
= 8 * 256;
1000 uint8_t *smbus_eeprom_buf
= g_malloc0(smbus_eeprom_size
);
1001 int64_t kernel_entry
, bootloader_run_addr
;
1005 qemu_irq cbus_irq
, i8259_irq
;
1010 DriveInfo
*hd
[MAX_IDE_BUS
* MAX_IDE_DEVS
];
1011 DriveInfo
*fd
[MAX_FD
];
1013 int fl_sectors
= bios_size
>> 16;
1016 DeviceState
*dev
= qdev_create(NULL
, TYPE_MIPS_MALTA
);
1017 MaltaState
*s
= MIPS_MALTA(dev
);
1019 /* The whole address space decoded by the GT-64120A doesn't generate
1020 exception when accessing invalid memory. Create an empty slot to
1021 emulate this feature. */
1022 empty_slot_init(0, 0x20000000);
1024 qdev_init_nofail(dev
);
1026 /* Make sure the first 3 serial ports are associated with a device. */
1027 for(i
= 0; i
< 3; i
++) {
1028 if (!serial_hds
[i
]) {
1030 snprintf(label
, sizeof(label
), "serial%d", i
);
1031 serial_hds
[i
] = qemu_chr_new(label
, "null");
1036 mips_create_cpu(s
, machine
->cpu_type
, &cbus_irq
, &i8259_irq
);
1039 if (ram_size
> (2048u << 20)) {
1040 error_report("Too much memory for this machine: %dMB, maximum 2048MB",
1041 ((unsigned int)ram_size
/ (1 << 20)));
1045 /* register RAM at high address where it is undisturbed by IO */
1046 memory_region_allocate_system_memory(ram_high
, NULL
, "mips_malta.ram",
1048 memory_region_add_subregion(system_memory
, 0x80000000, ram_high
);
1050 /* alias for pre IO hole access */
1051 memory_region_init_alias(ram_low_preio
, NULL
, "mips_malta_low_preio.ram",
1052 ram_high
, 0, MIN(ram_size
, (256 << 20)));
1053 memory_region_add_subregion(system_memory
, 0, ram_low_preio
);
1055 /* alias for post IO hole access, if there is enough RAM */
1056 if (ram_size
> (512 << 20)) {
1057 ram_low_postio
= g_new(MemoryRegion
, 1);
1058 memory_region_init_alias(ram_low_postio
, NULL
,
1059 "mips_malta_low_postio.ram",
1060 ram_high
, 512 << 20,
1061 ram_size
- (512 << 20));
1062 memory_region_add_subregion(system_memory
, 512 << 20, ram_low_postio
);
1065 /* generate SPD EEPROM data */
1066 generate_eeprom_spd(&smbus_eeprom_buf
[0 * 256], ram_size
);
1067 generate_eeprom_serial(&smbus_eeprom_buf
[6 * 256]);
1069 #ifdef TARGET_WORDS_BIGENDIAN
1075 /* The CBUS UART is attached to the MIPS CPU INT2 pin, ie interrupt 4 */
1076 malta_fpga_init(system_memory
, FPGA_ADDRESS
, cbus_irq
, serial_hds
[2]);
1078 /* Load firmware in flash / BIOS. */
1079 dinfo
= drive_get(IF_PFLASH
, 0, fl_idx
);
1080 #ifdef DEBUG_BOARD_INIT
1082 printf("Register parallel flash %d size " TARGET_FMT_lx
" at "
1083 "addr %08llx '%s' %x\n",
1084 fl_idx
, bios_size
, FLASH_ADDRESS
,
1085 blk_name(dinfo
->bdrv
), fl_sectors
);
1088 fl
= pflash_cfi01_register(FLASH_ADDRESS
, NULL
, "mips_malta.bios",
1090 dinfo
? blk_by_legacy_dinfo(dinfo
) : NULL
,
1092 4, 0x0000, 0x0000, 0x0000, 0x0000, be
);
1093 bios
= pflash_cfi01_get_memory(fl
);
1095 if (kernel_filename
) {
1096 ram_low_size
= MIN(ram_size
, 256 << 20);
1097 /* For KVM we reserve 1MB of RAM for running bootloader */
1098 if (kvm_enabled()) {
1099 ram_low_size
-= 0x100000;
1100 bootloader_run_addr
= 0x40000000 + ram_low_size
;
1102 bootloader_run_addr
= 0xbfc00000;
1105 /* Write a small bootloader to the flash location. */
1106 loaderparams
.ram_size
= ram_size
;
1107 loaderparams
.ram_low_size
= ram_low_size
;
1108 loaderparams
.kernel_filename
= kernel_filename
;
1109 loaderparams
.kernel_cmdline
= kernel_cmdline
;
1110 loaderparams
.initrd_filename
= initrd_filename
;
1111 kernel_entry
= load_kernel();
1113 write_bootloader(memory_region_get_ram_ptr(bios
),
1114 bootloader_run_addr
, kernel_entry
);
1115 if (kvm_enabled()) {
1116 /* Write the bootloader code @ the end of RAM, 1MB reserved */
1117 write_bootloader(memory_region_get_ram_ptr(ram_low_preio
) +
1119 bootloader_run_addr
, kernel_entry
);
1122 /* The flash region isn't executable from a KVM guest */
1123 if (kvm_enabled()) {
1124 error_report("KVM enabled but no -kernel argument was specified. "
1125 "Booting from flash is not supported with KVM.");
1128 /* Load firmware from flash. */
1130 /* Load a BIOS image. */
1131 if (bios_name
== NULL
) {
1132 bios_name
= BIOS_FILENAME
;
1134 filename
= qemu_find_file(QEMU_FILE_TYPE_BIOS
, bios_name
);
1136 bios_size
= load_image_targphys(filename
, FLASH_ADDRESS
,
1142 if ((bios_size
< 0 || bios_size
> BIOS_SIZE
) &&
1143 !kernel_filename
&& !qtest_enabled()) {
1144 error_report("Could not load MIPS bios '%s', and no "
1145 "-kernel argument was specified", bios_name
);
1149 /* In little endian mode the 32bit words in the bios are swapped,
1150 a neat trick which allows bi-endian firmware. */
1151 #ifndef TARGET_WORDS_BIGENDIAN
1153 uint32_t *end
, *addr
= rom_ptr(FLASH_ADDRESS
);
1155 addr
= memory_region_get_ram_ptr(bios
);
1157 end
= (void *)addr
+ MIN(bios_size
, 0x3e0000);
1158 while (addr
< end
) {
1167 * Map the BIOS at a 2nd physical location, as on the real board.
1168 * Copy it so that we can patch in the MIPS revision, which cannot be
1169 * handled by an overlapping region as the resulting ROM code subpage
1170 * regions are not executable.
1172 memory_region_init_ram_nomigrate(bios_copy
, NULL
, "bios.1fc", BIOS_SIZE
,
1174 if (!rom_copy(memory_region_get_ram_ptr(bios_copy
),
1175 FLASH_ADDRESS
, BIOS_SIZE
)) {
1176 memcpy(memory_region_get_ram_ptr(bios_copy
),
1177 memory_region_get_ram_ptr(bios
), BIOS_SIZE
);
1179 memory_region_set_readonly(bios_copy
, true);
1180 memory_region_add_subregion(system_memory
, RESET_ADDRESS
, bios_copy
);
1182 /* Board ID = 0x420 (Malta Board with CoreLV) */
1183 stl_p(memory_region_get_ram_ptr(bios_copy
) + 0x10, 0x00000420);
1186 * We have a circular dependency problem: pci_bus depends on isa_irq,
1187 * isa_irq is provided by i8259, i8259 depends on ISA, ISA depends
1188 * on piix4, and piix4 depends on pci_bus. To stop the cycle we have
1189 * qemu_irq_proxy() adds an extra bit of indirection, allowing us
1190 * to resolve the isa_irq -> i8259 dependency after i8259 is initialized.
1192 isa_irq
= qemu_irq_proxy(&s
->i8259
, 16);
1195 pci_bus
= gt64120_register(isa_irq
);
1198 ide_drive_get(hd
, ARRAY_SIZE(hd
));
1200 piix4_devfn
= piix4_init(pci_bus
, &isa_bus
, 80);
1202 /* Interrupt controller */
1203 /* The 8259 is attached to the MIPS CPU INT0 pin, ie interrupt 2 */
1204 s
->i8259
= i8259_init(isa_bus
, i8259_irq
);
1206 isa_bus_irqs(isa_bus
, s
->i8259
);
1207 pci_piix4_ide_init(pci_bus
, hd
, piix4_devfn
+ 1);
1208 pci_create_simple(pci_bus
, piix4_devfn
+ 2, "piix4-usb-uhci");
1209 smbus
= piix4_pm_init(pci_bus
, piix4_devfn
+ 3, 0x1100,
1210 isa_get_irq(NULL
, 9), NULL
, 0, NULL
);
1211 smbus_eeprom_init(smbus
, 8, smbus_eeprom_buf
, smbus_eeprom_size
);
1212 g_free(smbus_eeprom_buf
);
1213 pit
= i8254_pit_init(isa_bus
, 0x40, 0, NULL
);
1214 i8257_dma_init(isa_bus
, 0);
1217 isa_create_simple(isa_bus
, TYPE_I8042
);
1219 mc146818_rtc_init(isa_bus
, 2000, NULL
);
1220 serial_hds_isa_init(isa_bus
, 0, 2);
1221 parallel_hds_isa_init(isa_bus
, 1);
1223 for(i
= 0; i
< MAX_FD
; i
++) {
1224 fd
[i
] = drive_get(IF_FLOPPY
, 0, i
);
1226 fdctrl_init_isa(isa_bus
, fd
);
1229 network_init(pci_bus
);
1231 /* Optional PCI video card */
1232 pci_vga_init(pci_bus
);
1235 static int mips_malta_sysbus_device_init(SysBusDevice
*sysbusdev
)
1240 static void mips_malta_class_init(ObjectClass
*klass
, void *data
)
1242 SysBusDeviceClass
*k
= SYS_BUS_DEVICE_CLASS(klass
);
1244 k
->init
= mips_malta_sysbus_device_init
;
1247 static const TypeInfo mips_malta_device
= {
1248 .name
= TYPE_MIPS_MALTA
,
1249 .parent
= TYPE_SYS_BUS_DEVICE
,
1250 .instance_size
= sizeof(MaltaState
),
1251 .class_init
= mips_malta_class_init
,
1254 static void mips_malta_machine_init(MachineClass
*mc
)
1256 mc
->desc
= "MIPS Malta Core LV";
1257 mc
->init
= mips_malta_init
;
1258 mc
->block_default_type
= IF_IDE
;
1261 #ifdef TARGET_MIPS64
1262 mc
->default_cpu_type
= MIPS_CPU_TYPE_NAME("20Kc");
1264 mc
->default_cpu_type
= MIPS_CPU_TYPE_NAME("24Kf");
1268 DEFINE_MACHINE("malta", mips_malta_machine_init
)
1270 static void mips_malta_register_types(void)
1272 type_register_static(&mips_malta_device
);
1275 type_init(mips_malta_register_types
)