2 * QEMU Malta board support
4 * Copyright (c) 2006 Aurelien Jarno
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 #include "qemu/osdep.h"
26 #include "qemu/units.h"
27 #include "qemu/bitops.h"
28 #include "qemu/datadir.h"
29 #include "qemu/cutils.h"
30 #include "qemu/guest-random.h"
32 #include "hw/southbridge/piix.h"
33 #include "hw/isa/superio.h"
34 #include "hw/char/serial-mm.h"
36 #include "hw/boards.h"
37 #include "hw/i2c/smbus_eeprom.h"
38 #include "hw/block/flash.h"
39 #include "hw/mips/mips.h"
40 #include "hw/mips/bootloader.h"
41 #include "hw/pci/pci.h"
42 #include "hw/pci/pci_bus.h"
44 #include "hw/ide/pci.h"
46 #include "hw/loader.h"
48 #include "qom/object.h"
49 #include "hw/sysbus.h" /* SysBusDevice */
50 #include "qemu/host-utils.h"
51 #include "sysemu/qtest.h"
52 #include "sysemu/reset.h"
53 #include "sysemu/runstate.h"
54 #include "qapi/error.h"
55 #include "qemu/error-report.h"
56 #include "sysemu/kvm.h"
57 #include "semihosting/semihost.h"
58 #include "hw/mips/cps.h"
59 #include "hw/qdev-clock.h"
60 #include "target/mips/internal.h"
64 #define ENVP_PADDR 0x2000
65 #define ENVP_VADDR cpu_mips_phys_to_kseg0(NULL, ENVP_PADDR)
66 #define ENVP_NB_ENTRIES 16
67 #define ENVP_ENTRY_SIZE 256
69 /* Hardware addresses */
70 #define FLASH_ADDRESS 0x1e000000ULL
71 #define FPGA_ADDRESS 0x1f000000ULL
72 #define RESET_ADDRESS 0x1fc00000ULL
74 #define FLASH_SIZE 0x400000
75 #define BIOS_SIZE (4 * MiB)
77 #define PIIX4_PCI_DEVFN PCI_DEVFN(10, 0)
81 MemoryRegion iomem_lo
; /* 0 - 0x900 */
82 MemoryRegion iomem_hi
; /* 0xa00 - 0x100000 */
97 #define BIOS_FILENAME "mips_bios.bin"
99 #define BIOS_FILENAME "mipsel_bios.bin"
102 #define TYPE_MIPS_MALTA "mips-malta"
103 OBJECT_DECLARE_SIMPLE_TYPE(MaltaState
, MIPS_MALTA
)
106 SysBusDevice parent_obj
;
112 static struct _loaderparams
{
113 int ram_size
, ram_low_size
;
114 const char *kernel_filename
;
115 const char *kernel_cmdline
;
116 const char *initrd_filename
;
120 static void malta_fpga_update_display_leds(MaltaFPGAState
*s
)
125 for (i
= 7 ; i
>= 0 ; i
--) {
126 if (s
->leds
& (1 << i
)) {
134 trace_malta_fpga_leds(leds_text
);
135 qemu_chr_fe_printf(&s
->display
, "\e[H\n\n|\e[32m%-8.8s\e[00m|\r\n",
139 static void malta_fpga_update_display_ascii(MaltaFPGAState
*s
)
141 trace_malta_fpga_display(s
->display_text
);
142 qemu_chr_fe_printf(&s
->display
, "\n\n\n\n|\e[31m%-8.8s\e[00m|",
147 * EEPROM 24C01 / 24C02 emulation.
149 * Emulation for serial EEPROMs:
150 * 24C01 - 1024 bit (128 x 8)
151 * 24C02 - 2048 bit (256 x 8)
153 * Typical device names include Microchip 24C02SC or SGS Thomson ST24C02.
157 # define logout(fmt, ...) \
158 fprintf(stderr, "MALTA\t%-24s" fmt, __func__, ## __VA_ARGS__)
160 # define logout(fmt, ...) ((void)0)
163 struct _eeprom24c0x_t
{
172 uint8_t contents
[256];
175 typedef struct _eeprom24c0x_t eeprom24c0x_t
;
177 static eeprom24c0x_t spd_eeprom
= {
180 0x80, 0x08, 0xFF, 0x0D, 0x0A, 0xFF, 0x40, 0x00,
182 0x01, 0x75, 0x54, 0x00, 0x82, 0x08, 0x00, 0x01,
184 0x8F, 0x04, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00,
186 0x00, 0x00, 0x00, 0x14, 0x0F, 0x14, 0x2D, 0xFF,
188 0x15, 0x08, 0x15, 0x08, 0x00, 0x00, 0x00, 0x00,
190 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
192 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
194 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0xD0,
196 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
198 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
200 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
202 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
204 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
206 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
208 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
210 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x64, 0xF4,
214 static void generate_eeprom_spd(uint8_t *eeprom
, ram_addr_t ram_size
)
216 enum sdram_type type
;
217 uint8_t *spd
= spd_eeprom
.contents
;
219 uint16_t density
= 0;
222 /* work in terms of MB */
225 while ((ram_size
>= 4) && (nbanks
<= 2)) {
226 int sz_log2
= MIN(31 - clz32(ram_size
), 14);
228 density
|= 1 << (sz_log2
- 2);
229 ram_size
-= 1 << sz_log2
;
232 /* split to 2 banks if possible */
233 if ((nbanks
== 1) && (density
> 1)) {
238 if (density
& 0xff00) {
239 density
= (density
& 0xe0) | ((density
>> 8) & 0x1f);
241 } else if (!(density
& 0x1f)) {
248 warn_report("SPD cannot represent final " RAM_ADDR_FMT
"MB"
249 " of SDRAM", ram_size
);
252 /* fill in SPD memory information */
259 for (i
= 0; i
< 63; i
++) {
264 memcpy(eeprom
, spd
, sizeof(spd_eeprom
.contents
));
267 static void generate_eeprom_serial(uint8_t *eeprom
)
270 uint8_t mac
[6] = { 0x00 };
271 uint8_t sn
[5] = { 0x01, 0x23, 0x45, 0x67, 0x89 };
274 eeprom
[pos
++] = 0x01;
277 eeprom
[pos
++] = 0x02;
280 eeprom
[pos
++] = 0x01; /* MAC */
281 eeprom
[pos
++] = 0x06; /* length */
282 memcpy(&eeprom
[pos
], mac
, sizeof(mac
));
286 eeprom
[pos
++] = 0x02; /* serial */
287 eeprom
[pos
++] = 0x05; /* length */
288 memcpy(&eeprom
[pos
], sn
, sizeof(sn
));
293 for (i
= 0; i
< pos
; i
++) {
294 eeprom
[pos
] += eeprom
[i
];
298 static uint8_t eeprom24c0x_read(eeprom24c0x_t
*eeprom
)
300 logout("%u: scl = %u, sda = %u, data = 0x%02x\n",
301 eeprom
->tick
, eeprom
->scl
, eeprom
->sda
, eeprom
->data
);
305 static void eeprom24c0x_write(eeprom24c0x_t
*eeprom
, int scl
, int sda
)
307 if (eeprom
->scl
&& scl
&& (eeprom
->sda
!= sda
)) {
308 logout("%u: scl = %u->%u, sda = %u->%u i2c %s\n",
309 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
,
310 sda
? "stop" : "start");
315 } else if (eeprom
->tick
== 0 && !eeprom
->ack
) {
316 /* Waiting for start. */
317 logout("%u: scl = %u->%u, sda = %u->%u wait for i2c start\n",
318 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
);
319 } else if (!eeprom
->scl
&& scl
) {
320 logout("%u: scl = %u->%u, sda = %u->%u trigger bit\n",
321 eeprom
->tick
, eeprom
->scl
, scl
, eeprom
->sda
, sda
);
323 logout("\ti2c ack bit = 0\n");
326 } else if (eeprom
->sda
== sda
) {
327 uint8_t bit
= (sda
!= 0);
328 logout("\ti2c bit = %d\n", bit
);
329 if (eeprom
->tick
< 9) {
330 eeprom
->command
<<= 1;
331 eeprom
->command
+= bit
;
333 if (eeprom
->tick
== 9) {
334 logout("\tcommand 0x%04x, %s\n", eeprom
->command
,
335 bit
? "read" : "write");
338 } else if (eeprom
->tick
< 17) {
339 if (eeprom
->command
& 1) {
340 sda
= ((eeprom
->data
& 0x80) != 0);
342 eeprom
->address
<<= 1;
343 eeprom
->address
+= bit
;
346 if (eeprom
->tick
== 17) {
347 eeprom
->data
= eeprom
->contents
[eeprom
->address
];
348 logout("\taddress 0x%04x, data 0x%02x\n",
349 eeprom
->address
, eeprom
->data
);
353 } else if (eeprom
->tick
>= 17) {
357 logout("\tsda changed with raising scl\n");
360 logout("%u: scl = %u->%u, sda = %u->%u\n", eeprom
->tick
, eeprom
->scl
,
361 scl
, eeprom
->sda
, sda
);
367 static uint64_t malta_fpga_read(void *opaque
, hwaddr addr
,
370 MaltaFPGAState
*s
= opaque
;
374 saddr
= (addr
& 0xfffff);
378 /* SWITCH Register */
383 /* STATUS Register */
385 #if TARGET_BIG_ENDIAN
397 /* LEDBAR Register */
402 /* BRKRES Register */
407 /* UART Registers are handled directly by the serial device */
414 /* XXX: implement a real I2C controller */
418 /* IN = OUT until a real I2C control is implemented */
426 /* I2CINP Register */
428 val
= ((s
->i2cin
& ~1) | eeprom24c0x_read(&spd_eeprom
));
436 /* I2COUT Register */
441 /* I2CSEL Register */
447 qemu_log_mask(LOG_GUEST_ERROR
,
448 "malta_fpga_read: Bad register addr 0x%"HWADDR_PRIX
"\n",
455 static void malta_fpga_write(void *opaque
, hwaddr addr
,
456 uint64_t val
, unsigned size
)
458 MaltaFPGAState
*s
= opaque
;
461 saddr
= (addr
& 0xfffff);
465 /* SWITCH Register */
473 /* LEDBAR Register */
475 s
->leds
= val
& 0xff;
476 malta_fpga_update_display_leds(s
);
479 /* ASCIIWORD Register */
481 snprintf(s
->display_text
, 9, "%08X", (uint32_t)val
);
482 malta_fpga_update_display_ascii(s
);
485 /* ASCIIPOS0 to ASCIIPOS7 Registers */
494 s
->display_text
[(saddr
- 0x00418) >> 3] = (char) val
;
495 malta_fpga_update_display_ascii(s
);
498 /* SOFTRES Register */
501 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET
);
505 /* BRKRES Register */
510 /* UART Registers are handled directly by the serial device */
514 s
->gpout
= val
& 0xff;
519 s
->i2coe
= val
& 0x03;
522 /* I2COUT Register */
524 eeprom24c0x_write(&spd_eeprom
, val
& 0x02, val
& 0x01);
528 /* I2CSEL Register */
530 s
->i2csel
= val
& 0x01;
534 qemu_log_mask(LOG_GUEST_ERROR
,
535 "malta_fpga_write: Bad register addr 0x%"HWADDR_PRIX
"\n",
541 static const MemoryRegionOps malta_fpga_ops
= {
542 .read
= malta_fpga_read
,
543 .write
= malta_fpga_write
,
544 .endianness
= DEVICE_NATIVE_ENDIAN
,
547 static void malta_fpga_reset(void *opaque
)
549 MaltaFPGAState
*s
= opaque
;
559 s
->display_text
[8] = '\0';
560 snprintf(s
->display_text
, 9, " ");
563 static void malta_fgpa_display_event(void *opaque
, QEMUChrEvent event
)
565 MaltaFPGAState
*s
= opaque
;
567 if (event
== CHR_EVENT_OPENED
&& !s
->display_inited
) {
568 qemu_chr_fe_printf(&s
->display
, "\e[HMalta LEDBAR\r\n");
569 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
570 qemu_chr_fe_printf(&s
->display
, "+ +\r\n");
571 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
572 qemu_chr_fe_printf(&s
->display
, "\n");
573 qemu_chr_fe_printf(&s
->display
, "Malta ASCII\r\n");
574 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
575 qemu_chr_fe_printf(&s
->display
, "+ +\r\n");
576 qemu_chr_fe_printf(&s
->display
, "+--------+\r\n");
577 s
->display_inited
= true;
581 static MaltaFPGAState
*malta_fpga_init(MemoryRegion
*address_space
,
582 hwaddr base
, qemu_irq uart_irq
, Chardev
*uart_chr
)
587 s
= g_new0(MaltaFPGAState
, 1);
589 memory_region_init_io(&s
->iomem
, NULL
, &malta_fpga_ops
, s
,
590 "malta-fpga", 0x100000);
591 memory_region_init_alias(&s
->iomem_lo
, NULL
, "malta-fpga",
592 &s
->iomem
, 0, 0x900);
593 memory_region_init_alias(&s
->iomem_hi
, NULL
, "malta-fpga",
594 &s
->iomem
, 0xa00, 0x100000 - 0xa00);
596 memory_region_add_subregion(address_space
, base
, &s
->iomem_lo
);
597 memory_region_add_subregion(address_space
, base
+ 0xa00, &s
->iomem_hi
);
599 chr
= qemu_chr_new("fpga", "vc:320x200", NULL
);
600 qemu_chr_fe_init(&s
->display
, chr
, NULL
);
601 qemu_chr_fe_set_handlers(&s
->display
, NULL
, NULL
,
602 malta_fgpa_display_event
, NULL
, s
, NULL
, true);
604 s
->uart
= serial_mm_init(address_space
, base
+ 0x900, 3, uart_irq
,
605 230400, uart_chr
, DEVICE_NATIVE_ENDIAN
);
608 qemu_register_reset(malta_fpga_reset
, s
);
613 /* Network support */
614 static void network_init(PCIBus
*pci_bus
)
616 /* The malta board has a PCNet card using PCI SLOT 11 */
617 pci_init_nic_in_slot(pci_bus
, "pcnet", NULL
, "0b");
618 pci_init_nic_devices(pci_bus
, "pcnet");
621 static void bl_setup_gt64120_jump_kernel(void **p
, uint64_t run_addr
,
622 uint64_t kernel_entry
)
624 static const char pci_pins_cfg
[PCI_NUM_PINS
] = {
625 10, 10, 11, 11 /* PIIX IRQRC[A:D] */
628 /* Bus endianness is always reversed */
629 #if TARGET_BIG_ENDIAN
630 #define cpu_to_gt32(x) (x)
632 #define cpu_to_gt32(x) bswap32(x)
635 /* setup MEM-to-PCI0 mapping as done by YAMON */
637 /* move GT64120 registers from 0x14000000 to 0x1be00000 */
638 bl_gen_write_u32(p
, /* GT_ISD */
639 cpu_mips_phys_to_kseg1(NULL
, 0x14000000 + 0x68),
640 cpu_to_gt32(0x1be00000 << 3));
642 /* setup PCI0 io window to 0x18000000-0x181fffff */
643 bl_gen_write_u32(p
, /* GT_PCI0IOLD */
644 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x48),
645 cpu_to_gt32(0x18000000 << 3));
646 bl_gen_write_u32(p
, /* GT_PCI0IOHD */
647 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x50),
648 cpu_to_gt32(0x08000000 << 3));
650 /* setup PCI0 mem windows */
651 bl_gen_write_u32(p
, /* GT_PCI0M0LD */
652 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x58),
653 cpu_to_gt32(0x10000000 << 3));
654 bl_gen_write_u32(p
, /* GT_PCI0M0HD */
655 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x60),
656 cpu_to_gt32(0x07e00000 << 3));
657 bl_gen_write_u32(p
, /* GT_PCI0M1LD */
658 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x80),
659 cpu_to_gt32(0x18200000 << 3));
660 bl_gen_write_u32(p
, /* GT_PCI0M1HD */
661 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0x88),
662 cpu_to_gt32(0x0bc00000 << 3));
667 * The PIIX ISA bridge is on PCI bus 0 dev 10 func 0.
668 * Load the PIIX IRQC[A:D] routing config address, then
669 * write routing configuration to the config data register.
671 bl_gen_write_u32(p
, /* GT_PCI0_CFGADDR */
672 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0xcf8),
673 tswap32((1 << 31) /* ConfigEn */
674 | PCI_BUILD_BDF(0, PIIX4_PCI_DEVFN
) << 8
676 bl_gen_write_u32(p
, /* GT_PCI0_CFGDATA */
677 cpu_mips_phys_to_kseg1(NULL
, 0x1be00000 + 0xcfc),
678 tswap32(ldl_be_p(pci_pins_cfg
)));
680 bl_gen_jump_kernel(p
,
681 true, ENVP_VADDR
- 64,
683 * If semihosting is used, arguments have already
684 * been passed, so we preserve $a0.
686 !semihosting_get_argc(), 2,
688 true, ENVP_VADDR
+ 8,
689 true, loaderparams
.ram_low_size
,
693 static void write_bootloader_nanomips(uint8_t *base
, uint64_t run_addr
,
694 uint64_t kernel_entry
)
698 /* Small bootloader */
699 p
= (uint16_t *)base
;
701 stw_p(p
++, 0x2800); stw_p(p
++, 0x001c);
703 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
705 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
707 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
709 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
711 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
713 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
715 stw_p(p
++, 0x8000); stw_p(p
++, 0xc000);
720 bl_setup_gt64120_jump_kernel((void **)&p
, run_addr
, kernel_entry
);
724 * ROM and pseudo bootloader
726 * The following code implements a very very simple bootloader. It first
727 * loads the registers a0 to a3 to the values expected by the OS, and
728 * then jump at the kernel address.
730 * The bootloader should pass the locations of the kernel arguments and
731 * environment variables tables. Those tables contain the 32-bit address
732 * of NULL terminated strings. The environment variables table should be
733 * terminated by a NULL address.
735 * For a simpler implementation, the number of kernel arguments is fixed
736 * to two (the name of the kernel and the command line), and the two
737 * tables are actually the same one.
739 * The registers a0 to a3 should contain the following values:
740 * a0 - number of kernel arguments
741 * a1 - 32-bit address of the kernel arguments table
742 * a2 - 32-bit address of the environment variables table
743 * a3 - RAM size in bytes
745 static void write_bootloader(uint8_t *base
, uint64_t run_addr
,
746 uint64_t kernel_entry
)
750 /* Small bootloader */
751 p
= (uint32_t *)base
;
753 stl_p(p
++, 0x08000000 | /* j 0x1fc00580 */
754 ((run_addr
+ 0x580) & 0x0fffffff) >> 2);
755 stl_p(p
++, 0x00000000); /* nop */
757 /* YAMON service vector */
758 stl_p(base
+ 0x500, run_addr
+ 0x0580); /* start: */
759 stl_p(base
+ 0x504, run_addr
+ 0x083c); /* print_count: */
760 stl_p(base
+ 0x520, run_addr
+ 0x0580); /* start: */
761 stl_p(base
+ 0x52c, run_addr
+ 0x0800); /* flush_cache: */
762 stl_p(base
+ 0x534, run_addr
+ 0x0808); /* print: */
763 stl_p(base
+ 0x538, run_addr
+ 0x0800); /* reg_cpu_isr: */
764 stl_p(base
+ 0x53c, run_addr
+ 0x0800); /* unred_cpu_isr: */
765 stl_p(base
+ 0x540, run_addr
+ 0x0800); /* reg_ic_isr: */
766 stl_p(base
+ 0x544, run_addr
+ 0x0800); /* unred_ic_isr: */
767 stl_p(base
+ 0x548, run_addr
+ 0x0800); /* reg_esr: */
768 stl_p(base
+ 0x54c, run_addr
+ 0x0800); /* unreg_esr: */
769 stl_p(base
+ 0x550, run_addr
+ 0x0800); /* getchar: */
770 stl_p(base
+ 0x554, run_addr
+ 0x0800); /* syscon_read: */
773 /* Second part of the bootloader */
774 p
= (uint32_t *) (base
+ 0x580);
777 * Load BAR registers as done by YAMON:
779 * - set up PCI0 I/O BARs from 0x18000000 to 0x181fffff
780 * - set up PCI0 MEM0 at 0x10000000, size 0x7e00000
781 * - set up PCI0 MEM1 at 0x18200000, size 0xbc00000
785 bl_setup_gt64120_jump_kernel((void **)&p
, run_addr
, kernel_entry
);
787 /* YAMON subroutines */
788 p
= (uint32_t *) (base
+ 0x800);
789 stl_p(p
++, 0x03e00009); /* jalr ra */
790 stl_p(p
++, 0x24020000); /* li v0,0 */
791 /* 808 YAMON print */
792 stl_p(p
++, 0x03e06821); /* move t5,ra */
793 stl_p(p
++, 0x00805821); /* move t3,a0 */
794 stl_p(p
++, 0x00a05021); /* move t2,a1 */
795 stl_p(p
++, 0x91440000); /* lbu a0,0(t2) */
796 stl_p(p
++, 0x254a0001); /* addiu t2,t2,1 */
797 stl_p(p
++, 0x10800005); /* beqz a0,834 */
798 stl_p(p
++, 0x00000000); /* nop */
799 stl_p(p
++, 0x0ff0021c); /* jal 870 */
800 stl_p(p
++, 0x00000000); /* nop */
801 stl_p(p
++, 0x1000fff9); /* b 814 */
802 stl_p(p
++, 0x00000000); /* nop */
803 stl_p(p
++, 0x01a00009); /* jalr t5 */
804 stl_p(p
++, 0x01602021); /* move a0,t3 */
805 /* 0x83c YAMON print_count */
806 stl_p(p
++, 0x03e06821); /* move t5,ra */
807 stl_p(p
++, 0x00805821); /* move t3,a0 */
808 stl_p(p
++, 0x00a05021); /* move t2,a1 */
809 stl_p(p
++, 0x00c06021); /* move t4,a2 */
810 stl_p(p
++, 0x91440000); /* lbu a0,0(t2) */
811 stl_p(p
++, 0x0ff0021c); /* jal 870 */
812 stl_p(p
++, 0x00000000); /* nop */
813 stl_p(p
++, 0x254a0001); /* addiu t2,t2,1 */
814 stl_p(p
++, 0x258cffff); /* addiu t4,t4,-1 */
815 stl_p(p
++, 0x1580fffa); /* bnez t4,84c */
816 stl_p(p
++, 0x00000000); /* nop */
817 stl_p(p
++, 0x01a00009); /* jalr t5 */
818 stl_p(p
++, 0x01602021); /* move a0,t3 */
820 stl_p(p
++, 0x3c08b800); /* lui t0,0xb400 */
821 stl_p(p
++, 0x350803f8); /* ori t0,t0,0x3f8 */
822 stl_p(p
++, 0x91090005); /* lbu t1,5(t0) */
823 stl_p(p
++, 0x00000000); /* nop */
824 stl_p(p
++, 0x31290040); /* andi t1,t1,0x40 */
825 stl_p(p
++, 0x1120fffc); /* beqz t1,878 <outch+0x8> */
826 stl_p(p
++, 0x00000000); /* nop */
827 stl_p(p
++, 0x03e00009); /* jalr ra */
828 stl_p(p
++, 0xa1040000); /* sb a0,0(t0) */
831 static void G_GNUC_PRINTF(3, 4) prom_set(uint32_t *prom_buf
, int index
,
832 const char *string
, ...)
837 if (index
>= ENVP_NB_ENTRIES
) {
841 if (string
== NULL
) {
846 table_addr
= sizeof(uint32_t) * ENVP_NB_ENTRIES
+ index
* ENVP_ENTRY_SIZE
;
847 prom_buf
[index
] = tswap32(ENVP_VADDR
+ table_addr
);
849 va_start(ap
, string
);
850 vsnprintf((char *)prom_buf
+ table_addr
, ENVP_ENTRY_SIZE
, string
, ap
);
854 static GString
*rng_seed_hex_new(void)
856 uint8_t rng_seed
[32];
858 qemu_guest_getrandom_nofail(rng_seed
, sizeof(rng_seed
));
859 return qemu_hexdump_line(NULL
, rng_seed
, sizeof(rng_seed
), 0, 0);
862 static void reinitialize_rng_seed(void *opaque
)
864 g_autoptr(GString
) hex
= rng_seed_hex_new();
865 memcpy(opaque
, hex
->str
, hex
->len
);
869 static uint64_t load_kernel(void)
871 uint64_t kernel_entry
, kernel_high
, initrd_size
;
873 ram_addr_t initrd_offset
;
877 size_t rng_seed_prom_offset
;
879 kernel_size
= load_elf(loaderparams
.kernel_filename
, NULL
,
880 cpu_mips_kseg0_to_phys
, NULL
,
882 &kernel_high
, NULL
, TARGET_BIG_ENDIAN
, EM_MIPS
,
884 if (kernel_size
< 0) {
885 error_report("could not load kernel '%s': %s",
886 loaderparams
.kernel_filename
,
887 load_elf_strerror(kernel_size
));
891 /* Check where the kernel has been linked */
892 if (kernel_entry
<= USEG_LIMIT
) {
893 error_report("Trap-and-Emul kernels (Linux CONFIG_KVM_GUEST)"
894 " are not supported");
901 if (loaderparams
.initrd_filename
) {
902 initrd_size
= get_image_size(loaderparams
.initrd_filename
);
903 if (initrd_size
> 0) {
905 * The kernel allocates the bootmap memory in the low memory after
906 * the initrd. It takes at most 128kiB for 2GB RAM and 4kiB
909 initrd_offset
= ROUND_UP(loaderparams
.ram_low_size
910 - (initrd_size
+ 128 * KiB
),
912 if (kernel_high
>= initrd_offset
) {
913 error_report("memory too small for initial ram disk '%s'",
914 loaderparams
.initrd_filename
);
917 initrd_size
= load_image_targphys(loaderparams
.initrd_filename
,
919 loaderparams
.ram_size
- initrd_offset
);
921 if (initrd_size
== (target_ulong
) -1) {
922 error_report("could not load initial ram disk '%s'",
923 loaderparams
.initrd_filename
);
928 /* Setup prom parameters. */
929 prom_size
= ENVP_NB_ENTRIES
* (sizeof(int32_t) + ENVP_ENTRY_SIZE
);
930 prom_buf
= g_malloc(prom_size
);
932 prom_set(prom_buf
, prom_index
++, "%s", loaderparams
.kernel_filename
);
933 if (initrd_size
> 0) {
934 prom_set(prom_buf
, prom_index
++,
935 "rd_start=0x%" PRIx64
" rd_size=%" PRId64
" %s",
936 cpu_mips_phys_to_kseg0(NULL
, initrd_offset
),
937 initrd_size
, loaderparams
.kernel_cmdline
);
939 prom_set(prom_buf
, prom_index
++, "%s", loaderparams
.kernel_cmdline
);
942 prom_set(prom_buf
, prom_index
++, "memsize");
943 prom_set(prom_buf
, prom_index
++, "%u", loaderparams
.ram_low_size
);
945 prom_set(prom_buf
, prom_index
++, "ememsize");
946 prom_set(prom_buf
, prom_index
++, "%u", loaderparams
.ram_size
);
948 prom_set(prom_buf
, prom_index
++, "modetty0");
949 prom_set(prom_buf
, prom_index
++, "38400n8r");
951 prom_set(prom_buf
, prom_index
++, "rngseed");
952 rng_seed_prom_offset
= prom_index
* ENVP_ENTRY_SIZE
+
953 sizeof(uint32_t) * ENVP_NB_ENTRIES
;
955 g_autoptr(GString
) hex
= rng_seed_hex_new();
956 prom_set(prom_buf
, prom_index
++, "%s", hex
->str
);
959 prom_set(prom_buf
, prom_index
++, NULL
);
961 rom_add_blob_fixed("prom", prom_buf
, prom_size
, ENVP_PADDR
);
962 qemu_register_reset_nosnapshotload(reinitialize_rng_seed
,
963 rom_ptr(ENVP_PADDR
, prom_size
) + rng_seed_prom_offset
);
969 static void malta_mips_config(MIPSCPU
*cpu
)
971 MachineState
*ms
= MACHINE(qdev_get_machine());
972 unsigned int smp_cpus
= ms
->smp
.cpus
;
973 CPUMIPSState
*env
= &cpu
->env
;
974 CPUState
*cs
= CPU(cpu
);
976 if (ase_mt_available(env
)) {
977 env
->mvp
->CP0_MVPConf0
= deposit32(env
->mvp
->CP0_MVPConf0
,
979 smp_cpus
* cs
->nr_threads
- 1);
980 env
->mvp
->CP0_MVPConf0
= deposit32(env
->mvp
->CP0_MVPConf0
,
981 CP0MVPC0_PVPE
, 4, smp_cpus
- 1);
985 static int malta_pci_slot_get_pirq(PCIDevice
*pci_dev
, int irq_num
)
989 slot
= PCI_SLOT(pci_dev
->devfn
);
995 /* AMD 79C973 Ethernet */
998 /* Crystal 4281 Sound */
1001 /* PCI slot 1 to 4 */
1003 return ((slot
- 18) + irq_num
) & 0x03;
1004 /* Unknown device, don't do any translation */
1010 static void main_cpu_reset(void *opaque
)
1012 MIPSCPU
*cpu
= opaque
;
1013 CPUMIPSState
*env
= &cpu
->env
;
1015 cpu_reset(CPU(cpu
));
1018 * The bootloader does not need to be rewritten as it is located in a
1019 * read only location. The kernel location and the arguments table
1020 * location does not change.
1022 if (loaderparams
.kernel_filename
) {
1023 env
->CP0_Status
&= ~(1 << CP0St_ERL
);
1026 malta_mips_config(cpu
);
1029 static void create_cpu_without_cps(MachineState
*ms
, MaltaState
*s
,
1030 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
1036 for (i
= 0; i
< ms
->smp
.cpus
; i
++) {
1037 cpu
= mips_cpu_create_with_clock(ms
->cpu_type
, s
->cpuclk
,
1040 /* Init internal devices */
1041 cpu_mips_irq_init_cpu(cpu
);
1042 cpu_mips_clock_init(cpu
);
1043 qemu_register_reset(main_cpu_reset
, cpu
);
1046 cpu
= MIPS_CPU(first_cpu
);
1048 *i8259_irq
= env
->irq
[2];
1049 *cbus_irq
= env
->irq
[4];
1052 static void create_cps(MachineState
*ms
, MaltaState
*s
,
1053 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
1055 object_initialize_child(OBJECT(s
), "cps", &s
->cps
, TYPE_MIPS_CPS
);
1056 object_property_set_str(OBJECT(&s
->cps
), "cpu-type", ms
->cpu_type
,
1058 object_property_set_bool(OBJECT(&s
->cps
), "cpu-big-endian",
1059 TARGET_BIG_ENDIAN
, &error_abort
);
1060 object_property_set_uint(OBJECT(&s
->cps
), "num-vp", ms
->smp
.cpus
,
1062 qdev_connect_clock_in(DEVICE(&s
->cps
), "clk-in", s
->cpuclk
);
1063 sysbus_realize(SYS_BUS_DEVICE(&s
->cps
), &error_fatal
);
1065 sysbus_mmio_map_overlap(SYS_BUS_DEVICE(&s
->cps
), 0, 0, 1);
1067 *i8259_irq
= get_cps_irq(&s
->cps
, 3);
1071 static void mips_create_cpu(MachineState
*ms
, MaltaState
*s
,
1072 qemu_irq
*cbus_irq
, qemu_irq
*i8259_irq
)
1074 if ((ms
->smp
.cpus
> 1) && cpu_type_supports_cps_smp(ms
->cpu_type
)) {
1075 create_cps(ms
, s
, cbus_irq
, i8259_irq
);
1077 create_cpu_without_cps(ms
, s
, cbus_irq
, i8259_irq
);
1082 void mips_malta_init(MachineState
*machine
)
1084 ram_addr_t ram_size
= machine
->ram_size
;
1085 ram_addr_t ram_low_size
;
1086 const char *kernel_filename
= machine
->kernel_filename
;
1087 const char *kernel_cmdline
= machine
->kernel_cmdline
;
1088 const char *initrd_filename
= machine
->initrd_filename
;
1091 MemoryRegion
*system_memory
= get_system_memory();
1092 MemoryRegion
*ram_low_preio
= g_new(MemoryRegion
, 1);
1093 MemoryRegion
*ram_low_postio
;
1094 MemoryRegion
*bios
, *bios_copy
= g_new(MemoryRegion
, 1);
1095 const size_t smbus_eeprom_size
= 8 * 256;
1096 uint8_t *smbus_eeprom_buf
= g_malloc0(smbus_eeprom_size
);
1097 uint64_t kernel_entry
, bootloader_run_addr
;
1100 qemu_irq cbus_irq
, i8259_irq
;
1108 s
= MIPS_MALTA(qdev_new(TYPE_MIPS_MALTA
));
1109 sysbus_realize_and_unref(SYS_BUS_DEVICE(s
), &error_fatal
);
1112 mips_create_cpu(machine
, s
, &cbus_irq
, &i8259_irq
);
1115 if (ram_size
> 2 * GiB
) {
1116 error_report("Too much memory for this machine: %" PRId64
"MB,"
1117 " maximum 2048MB", ram_size
/ MiB
);
1121 /* register RAM at high address where it is undisturbed by IO */
1122 memory_region_add_subregion(system_memory
, 0x80000000, machine
->ram
);
1124 /* alias for pre IO hole access */
1125 memory_region_init_alias(ram_low_preio
, NULL
, "mips_malta_low_preio.ram",
1126 machine
->ram
, 0, MIN(ram_size
, 256 * MiB
));
1127 memory_region_add_subregion(system_memory
, 0, ram_low_preio
);
1129 /* alias for post IO hole access, if there is enough RAM */
1130 if (ram_size
> 512 * MiB
) {
1131 ram_low_postio
= g_new(MemoryRegion
, 1);
1132 memory_region_init_alias(ram_low_postio
, NULL
,
1133 "mips_malta_low_postio.ram",
1134 machine
->ram
, 512 * MiB
,
1135 ram_size
- 512 * MiB
);
1136 memory_region_add_subregion(system_memory
, 512 * MiB
,
1142 /* The CBUS UART is attached to the MIPS CPU INT2 pin, ie interrupt 4 */
1143 malta_fpga_init(system_memory
, FPGA_ADDRESS
, cbus_irq
, serial_hd(2));
1145 /* Load firmware in flash / BIOS. */
1146 dinfo
= drive_get(IF_PFLASH
, 0, fl_idx
);
1147 fl
= pflash_cfi01_register(FLASH_ADDRESS
, "mips_malta.bios",
1149 dinfo
? blk_by_legacy_dinfo(dinfo
) : NULL
,
1151 4, 0x0000, 0x0000, 0x0000, 0x0000,
1153 bios
= pflash_cfi01_get_memory(fl
);
1155 if (kernel_filename
) {
1156 ram_low_size
= MIN(ram_size
, 256 * MiB
);
1157 bootloader_run_addr
= cpu_mips_phys_to_kseg0(NULL
, RESET_ADDRESS
);
1159 /* Write a small bootloader to the flash location. */
1160 loaderparams
.ram_size
= ram_size
;
1161 loaderparams
.ram_low_size
= ram_low_size
;
1162 loaderparams
.kernel_filename
= kernel_filename
;
1163 loaderparams
.kernel_cmdline
= kernel_cmdline
;
1164 loaderparams
.initrd_filename
= initrd_filename
;
1165 kernel_entry
= load_kernel();
1167 if (!cpu_type_supports_isa(machine
->cpu_type
, ISA_NANOMIPS32
)) {
1168 write_bootloader(memory_region_get_ram_ptr(bios
),
1169 bootloader_run_addr
, kernel_entry
);
1171 write_bootloader_nanomips(memory_region_get_ram_ptr(bios
),
1172 bootloader_run_addr
, kernel_entry
);
1175 target_long bios_size
= FLASH_SIZE
;
1176 /* Load firmware from flash. */
1178 /* Load a BIOS image. */
1179 filename
= qemu_find_file(QEMU_FILE_TYPE_BIOS
,
1180 machine
->firmware
?: BIOS_FILENAME
);
1182 bios_size
= load_image_targphys(filename
, FLASH_ADDRESS
,
1188 if ((bios_size
< 0 || bios_size
> BIOS_SIZE
) &&
1189 machine
->firmware
&& !qtest_enabled()) {
1190 error_report("Could not load MIPS bios '%s'", machine
->firmware
);
1195 * In little endian mode the 32bit words in the bios are swapped,
1196 * a neat trick which allows bi-endian firmware.
1198 #if !TARGET_BIG_ENDIAN
1200 uint32_t *end
, *addr
;
1201 const size_t swapsize
= MIN(bios_size
, 0x3e0000);
1202 addr
= rom_ptr(FLASH_ADDRESS
, swapsize
);
1204 addr
= memory_region_get_ram_ptr(bios
);
1206 end
= (void *)addr
+ swapsize
;
1207 while (addr
< end
) {
1216 * Map the BIOS at a 2nd physical location, as on the real board.
1217 * Copy it so that we can patch in the MIPS revision, which cannot be
1218 * handled by an overlapping region as the resulting ROM code subpage
1219 * regions are not executable.
1221 memory_region_init_ram(bios_copy
, NULL
, "bios.1fc", BIOS_SIZE
,
1223 if (!rom_copy(memory_region_get_ram_ptr(bios_copy
),
1224 FLASH_ADDRESS
, BIOS_SIZE
)) {
1225 memcpy(memory_region_get_ram_ptr(bios_copy
),
1226 memory_region_get_ram_ptr(bios
), BIOS_SIZE
);
1228 memory_region_set_readonly(bios_copy
, true);
1229 memory_region_add_subregion(system_memory
, RESET_ADDRESS
, bios_copy
);
1231 /* Board ID = 0x420 (Malta Board with CoreLV) */
1232 stl_p(memory_region_get_ram_ptr(bios_copy
) + 0x10, 0x00000420);
1235 dev
= qdev_new("gt64120");
1236 qdev_prop_set_bit(dev
, "cpu-little-endian", !TARGET_BIG_ENDIAN
);
1237 sysbus_realize_and_unref(SYS_BUS_DEVICE(dev
), &error_fatal
);
1238 pci_bus
= PCI_BUS(qdev_get_child_bus(dev
, "pci"));
1239 pci_bus_map_irqs(pci_bus
, malta_pci_slot_get_pirq
);
1242 piix4
= pci_new_multifunction(PIIX4_PCI_DEVFN
, TYPE_PIIX4_PCI_DEVICE
);
1243 qdev_prop_set_uint32(DEVICE(piix4
), "smb_io_base", 0x1100);
1244 pci_realize_and_unref(piix4
, pci_bus
, &error_fatal
);
1245 isa_bus
= ISA_BUS(qdev_get_child_bus(DEVICE(piix4
), "isa.0"));
1247 dev
= DEVICE(object_resolve_path_component(OBJECT(piix4
), "ide"));
1248 pci_ide_create_devs(PCI_DEVICE(dev
));
1250 /* Interrupt controller */
1251 qdev_connect_gpio_out_named(DEVICE(piix4
), "intr", 0, i8259_irq
);
1253 /* generate SPD EEPROM data */
1254 dev
= DEVICE(object_resolve_path_component(OBJECT(piix4
), "pm"));
1255 smbus
= I2C_BUS(qdev_get_child_bus(dev
, "i2c"));
1256 generate_eeprom_spd(&smbus_eeprom_buf
[0 * 256], ram_size
);
1257 generate_eeprom_serial(&smbus_eeprom_buf
[6 * 256]);
1258 smbus_eeprom_init(smbus
, 8, smbus_eeprom_buf
, smbus_eeprom_size
);
1259 g_free(smbus_eeprom_buf
);
1261 /* Super I/O: SMS FDC37M817 */
1262 isa_create_simple(isa_bus
, TYPE_FDC37M81X_SUPERIO
);
1265 network_init(pci_bus
);
1267 /* Optional PCI video card */
1268 pci_vga_init(pci_bus
);
1271 static void mips_malta_instance_init(Object
*obj
)
1273 MaltaState
*s
= MIPS_MALTA(obj
);
1275 s
->cpuclk
= qdev_init_clock_out(DEVICE(obj
), "cpu-refclk");
1276 clock_set_hz(s
->cpuclk
, 320000000); /* 320 MHz */
1279 static const TypeInfo mips_malta_device
= {
1280 .name
= TYPE_MIPS_MALTA
,
1281 .parent
= TYPE_SYS_BUS_DEVICE
,
1282 .instance_size
= sizeof(MaltaState
),
1283 .instance_init
= mips_malta_instance_init
,
1286 GlobalProperty malta_compat
[] = {
1287 { "PIIX4_PM", "memory-hotplug-support", "off" },
1288 { "PIIX4_PM", "acpi-pci-hotplug-with-bridge-support", "off" },
1289 { "PIIX4_PM", "acpi-root-pci-hotplug", "off" },
1290 { "PIIX4_PM", "x-not-migrate-acpi-index", "true" },
1292 const size_t malta_compat_len
= G_N_ELEMENTS(malta_compat
);
1294 static void mips_malta_machine_init(MachineClass
*mc
)
1296 mc
->desc
= "MIPS Malta Core LV";
1297 mc
->init
= mips_malta_init
;
1298 mc
->block_default_type
= IF_IDE
;
1300 mc
->is_default
= true;
1301 #ifdef TARGET_MIPS64
1302 mc
->default_cpu_type
= MIPS_CPU_TYPE_NAME("20Kc");
1304 mc
->default_cpu_type
= MIPS_CPU_TYPE_NAME("24Kf");
1306 mc
->default_ram_id
= "mips_malta.ram";
1307 compat_props_add(mc
->compat_props
, malta_compat
, malta_compat_len
);
1310 DEFINE_MACHINE("malta", mips_malta_machine_init
)
1312 static void mips_malta_register_types(void)
1314 type_register_static(&mips_malta_device
);
1317 type_init(mips_malta_register_types
)