pc.c 44.6 KB
Newer Older
B
bellard 已提交
1 2
/*
 * QEMU PC System Emulator
3
 *
B
bellard 已提交
4
 * Copyright (c) 2003-2004 Fabrice Bellard
5
 *
B
bellard 已提交
6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
P
pbrook 已提交
24 25 26 27 28 29 30 31 32 33
#include "hw.h"
#include "pc.h"
#include "fdc.h"
#include "pci.h"
#include "block.h"
#include "sysemu.h"
#include "audio/audio.h"
#include "net.h"
#include "smbus.h"
#include "boards.h"
A
aliguori 已提交
34
#include "monitor.h"
35
#include "fw_cfg.h"
A
aliguori 已提交
36
#include "hpet_emul.h"
R
Richard W.M. Jones 已提交
37
#include "watchdog.h"
38
#include "smbios.h"
B
bellard 已提交
39

B
bellard 已提交
40 41 42
/* output Bochs bios info messages */
//#define DEBUG_BIOS

A
Alexander Graf 已提交
43 44 45
/* Show multiboot debug output */
//#define DEBUG_MULTIBOOT

B
bellard 已提交
46 47
#define BIOS_FILENAME "bios.bin"
#define VGABIOS_FILENAME "vgabios.bin"
B
bellard 已提交
48
#define VGABIOS_CIRRUS_FILENAME "vgabios-cirrus.bin"
B
bellard 已提交
49

50 51
#define PC_MAX_BIOS_SIZE (4 * 1024 * 1024)

52 53
/* Leave a chunk of memory at the top of RAM for the BIOS ACPI tables.  */
#define ACPI_DATA_SIZE       0x10000
54
#define BIOS_CFG_IOPORT 0x510
55
#define FW_CFG_ACPI_TABLES (FW_CFG_ARCH_LOCAL + 0)
56
#define FW_CFG_SMBIOS_ENTRIES (FW_CFG_ARCH_LOCAL + 1)
J
Jes Sorensen 已提交
57
#define FW_CFG_IRQ0_OVERRIDE (FW_CFG_ARCH_LOCAL + 2)
B
bellard 已提交
58

T
ths 已提交
59 60
#define MAX_IDE_BUS 2

61
static fdctrl_t *floppy_controller;
B
bellard 已提交
62
static RTCState *rtc_state;
B
bellard 已提交
63
static PITState *pit;
B
bellard 已提交
64
static PCIDevice *i440fx_state;
B
bellard 已提交
65

66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86
typedef struct rom_reset_data {
    uint8_t *data;
    target_phys_addr_t addr;
    unsigned size;
} RomResetData;

static void option_rom_reset(void *_rrd)
{
    RomResetData *rrd = _rrd;

    cpu_physical_memory_write_rom(rrd->addr, rrd->data, rrd->size);
}

static void option_rom_setup_reset(target_phys_addr_t addr, unsigned size)
{
    RomResetData *rrd = qemu_malloc(sizeof *rrd);

    rrd->data = qemu_malloc(size);
    cpu_physical_memory_read(addr, rrd->data, size);
    rrd->addr = addr;
    rrd->size = size;
87
    qemu_register_reset(option_rom_reset, rrd);
88 89
}

90 91
typedef struct isa_irq_state {
    qemu_irq *i8259;
A
Avi Kivity 已提交
92
    qemu_irq *ioapic;
93 94 95 96 97 98
} IsaIrqState;

static void isa_irq_handler(void *opaque, int n, int level)
{
    IsaIrqState *isa = (IsaIrqState *)opaque;

A
Avi Kivity 已提交
99 100 101 102 103
    if (n < 16) {
        qemu_set_irq(isa->i8259[n], level);
    }
    qemu_set_irq(isa->ioapic[n], level);
};
104

B
bellard 已提交
105
static void ioport80_write(void *opaque, uint32_t addr, uint32_t data)
B
bellard 已提交
106 107 108
{
}

109
/* MSDOS compatibility mode FPU exception support */
P
pbrook 已提交
110
static qemu_irq ferr_irq;
111 112 113
/* XXX: add IGNNE support */
void cpu_set_ferr(CPUX86State *s)
{
P
pbrook 已提交
114
    qemu_irq_raise(ferr_irq);
115 116 117 118
}

static void ioportF0_write(void *opaque, uint32_t addr, uint32_t data)
{
P
pbrook 已提交
119
    qemu_irq_lower(ferr_irq);
120 121
}

B
bellard 已提交
122 123 124
/* TSC handling */
uint64_t cpu_get_tsc(CPUX86State *env)
{
125
    return cpu_get_ticks();
B
bellard 已提交
126 127
}

B
bellard 已提交
128 129 130 131 132 133 134 135
/* SMM support */
void cpu_smm_update(CPUState *env)
{
    if (i440fx_state && env == first_cpu)
        i440fx_set_smm(i440fx_state, (env->hflags >> HF_SMM_SHIFT) & 1);
}


B
bellard 已提交
136 137 138 139 140 141 142 143 144
/* IRQ handling */
int cpu_get_pic_interrupt(CPUState *env)
{
    int intno;

    intno = apic_get_interrupt(env);
    if (intno >= 0) {
        /* set irq request if a PIC irq is still pending */
        /* XXX: improve that */
145
        pic_update_irq(isa_pic);
B
bellard 已提交
146 147 148
        return intno;
    }
    /* read the irq from the PIC */
149 150 151
    if (!apic_accept_pic_intr(env))
        return -1;

B
bellard 已提交
152 153 154 155
    intno = pic_read_irq(isa_pic);
    return intno;
}

P
pbrook 已提交
156
static void pic_irq_request(void *opaque, int irq, int level)
B
bellard 已提交
157
{
158 159
    CPUState *env = first_cpu;

A
aurel32 已提交
160 161 162
    if (env->apic_state) {
        while (env) {
            if (apic_accept_pic_intr(env))
163
                apic_deliver_pic_intr(env, level);
A
aurel32 已提交
164 165 166
            env = env->next_cpu;
        }
    } else {
A
aurel32 已提交
167 168 169 170
        if (level)
            cpu_interrupt(env, CPU_INTERRUPT_HARD);
        else
            cpu_reset_interrupt(env, CPU_INTERRUPT_HARD);
171
    }
B
bellard 已提交
172 173
}

B
bellard 已提交
174 175
/* PC cmos mappings */

B
bellard 已提交
176 177
#define REG_EQUIPMENT_BYTE          0x14

178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201
static int cmos_get_fd_drive_type(int fd0)
{
    int val;

    switch (fd0) {
    case 0:
        /* 1.44 Mb 3"5 drive */
        val = 4;
        break;
    case 1:
        /* 2.88 Mb 3"5 drive */
        val = 5;
        break;
    case 2:
        /* 1.2 Mb 5"5 drive */
        val = 2;
        break;
    default:
        val = 0;
        break;
    }
    return val;
}

202
static void cmos_init_hd(int type_ofs, int info_ofs, BlockDriverState *hd)
B
bellard 已提交
203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218
{
    RTCState *s = rtc_state;
    int cylinders, heads, sectors;
    bdrv_get_geometry_hint(hd, &cylinders, &heads, &sectors);
    rtc_set_memory(s, type_ofs, 47);
    rtc_set_memory(s, info_ofs, cylinders);
    rtc_set_memory(s, info_ofs + 1, cylinders >> 8);
    rtc_set_memory(s, info_ofs + 2, heads);
    rtc_set_memory(s, info_ofs + 3, 0xff);
    rtc_set_memory(s, info_ofs + 4, 0xff);
    rtc_set_memory(s, info_ofs + 5, 0xc0 | ((heads > 8) << 3));
    rtc_set_memory(s, info_ofs + 6, cylinders);
    rtc_set_memory(s, info_ofs + 7, cylinders >> 8);
    rtc_set_memory(s, info_ofs + 8, sectors);
}

219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235
/* convert boot_device letter to something recognizable by the bios */
static int boot_device2nibble(char boot_device)
{
    switch(boot_device) {
    case 'a':
    case 'b':
        return 0x01; /* floppy boot */
    case 'c':
        return 0x02; /* hard drive boot */
    case 'd':
        return 0x03; /* CD-ROM boot */
    case 'n':
        return 0x04; /* Network boot */
    }
    return 0;
}

236 237
/* copy/pasted from cmos_init, should be made a general function
 and used there as well */
238
static int pc_boot_set(void *opaque, const char *boot_device)
239
{
A
aliguori 已提交
240
    Monitor *mon = cur_mon;
241
#define PC_MAX_BOOT_DEVICES 3
242
    RTCState *s = (RTCState *)opaque;
243 244 245 246 247
    int nbds, bds[3] = { 0, };
    int i;

    nbds = strlen(boot_device);
    if (nbds > PC_MAX_BOOT_DEVICES) {
A
aliguori 已提交
248
        monitor_printf(mon, "Too many boot devices for PC\n");
249 250 251 252 253
        return(1);
    }
    for (i = 0; i < nbds; i++) {
        bds[i] = boot_device2nibble(boot_device[i]);
        if (bds[i] == 0) {
A
aliguori 已提交
254 255
            monitor_printf(mon, "Invalid boot device for PC: '%c'\n",
                           boot_device[i]);
256 257 258 259 260 261 262 263
            return(1);
        }
    }
    rtc_set_memory(s, 0x3d, (bds[1] << 4) | bds[0]);
    rtc_set_memory(s, 0x38, (bds[2] << 4));
    return(0);
}

B
bellard 已提交
264
/* hd_table must contain 4 block drivers */
265 266
static void cmos_init(ram_addr_t ram_size, ram_addr_t above_4g_mem_size,
                      const char *boot_device, BlockDriverState **hd_table)
B
bellard 已提交
267
{
B
bellard 已提交
268
    RTCState *s = rtc_state;
269
    int nbds, bds[3] = { 0, };
B
bellard 已提交
270
    int val;
B
bellard 已提交
271
    int fd0, fd1, nb;
B
bellard 已提交
272
    int i;
B
bellard 已提交
273 274

    /* various important CMOS locations needed by PC/Bochs bios */
B
bellard 已提交
275 276

    /* memory size */
B
bellard 已提交
277 278 279 280
    val = 640; /* base memory in K */
    rtc_set_memory(s, 0x15, val);
    rtc_set_memory(s, 0x16, val >> 8);

B
bellard 已提交
281 282 283
    val = (ram_size / 1024) - 1024;
    if (val > 65535)
        val = 65535;
B
bellard 已提交
284 285 286 287
    rtc_set_memory(s, 0x17, val);
    rtc_set_memory(s, 0x18, val >> 8);
    rtc_set_memory(s, 0x30, val);
    rtc_set_memory(s, 0x31, val >> 8);
B
bellard 已提交
288

289 290 291 292 293 294
    if (above_4g_mem_size) {
        rtc_set_memory(s, 0x5b, (unsigned int)above_4g_mem_size >> 16);
        rtc_set_memory(s, 0x5c, (unsigned int)above_4g_mem_size >> 24);
        rtc_set_memory(s, 0x5d, (uint64_t)above_4g_mem_size >> 32);
    }

B
bellard 已提交
295 296 297 298
    if (ram_size > (16 * 1024 * 1024))
        val = (ram_size / 65536) - ((16 * 1024 * 1024) / 65536);
    else
        val = 0;
B
bellard 已提交
299 300
    if (val > 65535)
        val = 65535;
B
bellard 已提交
301 302
    rtc_set_memory(s, 0x34, val);
    rtc_set_memory(s, 0x35, val >> 8);
303

A
aurel32 已提交
304 305 306
    /* set the number of CPU */
    rtc_set_memory(s, 0x5f, smp_cpus - 1);

307
    /* set boot devices, and disable floppy signature check if requested */
308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323
#define PC_MAX_BOOT_DEVICES 3
    nbds = strlen(boot_device);
    if (nbds > PC_MAX_BOOT_DEVICES) {
        fprintf(stderr, "Too many boot devices for PC\n");
        exit(1);
    }
    for (i = 0; i < nbds; i++) {
        bds[i] = boot_device2nibble(boot_device[i]);
        if (bds[i] == 0) {
            fprintf(stderr, "Invalid boot device for PC: '%c'\n",
                    boot_device[i]);
            exit(1);
        }
    }
    rtc_set_memory(s, 0x3d, (bds[1] << 4) | bds[0]);
    rtc_set_memory(s, 0x38, (bds[2] << 4) | (fd_bootchk ?  0x0 : 0x1));
B
bellard 已提交
324

B
bellard 已提交
325 326
    /* floppy type */

327 328
    fd0 = fdctrl_get_drive_type(floppy_controller, 0);
    fd1 = fdctrl_get_drive_type(floppy_controller, 1);
B
bellard 已提交
329

330
    val = (cmos_get_fd_drive_type(fd0) << 4) | cmos_get_fd_drive_type(fd1);
B
bellard 已提交
331
    rtc_set_memory(s, 0x10, val);
332

B
bellard 已提交
333
    val = 0;
B
bellard 已提交
334
    nb = 0;
B
bellard 已提交
335 336 337 338 339 340 341 342
    if (fd0 < 3)
        nb++;
    if (fd1 < 3)
        nb++;
    switch (nb) {
    case 0:
        break;
    case 1:
B
bellard 已提交
343
        val |= 0x01; /* 1 drive, ready for boot */
B
bellard 已提交
344 345
        break;
    case 2:
B
bellard 已提交
346
        val |= 0x41; /* 2 drives, ready for boot */
B
bellard 已提交
347 348
        break;
    }
B
bellard 已提交
349 350 351 352
    val |= 0x02; /* FPU is there */
    val |= 0x04; /* PS/2 mouse installed */
    rtc_set_memory(s, REG_EQUIPMENT_BYTE, val);

B
bellard 已提交
353 354 355 356 357
    /* hard drives */

    rtc_set_memory(s, 0x12, (hd_table[0] ? 0xf0 : 0) | (hd_table[1] ? 0x0f : 0));
    if (hd_table[0])
        cmos_init_hd(0x19, 0x1b, hd_table[0]);
358
    if (hd_table[1])
B
bellard 已提交
359 360 361
        cmos_init_hd(0x1a, 0x24, hd_table[1]);

    val = 0;
B
bellard 已提交
362
    for (i = 0; i < 4; i++) {
B
bellard 已提交
363
        if (hd_table[i]) {
B
bellard 已提交
364 365 366 367 368 369 370 371 372 373 374 375 376 377 378
            int cylinders, heads, sectors, translation;
            /* NOTE: bdrv_get_geometry_hint() returns the physical
                geometry.  It is always such that: 1 <= sects <= 63, 1
                <= heads <= 16, 1 <= cylinders <= 16383. The BIOS
                geometry can be different if a translation is done. */
            translation = bdrv_get_translation_hint(hd_table[i]);
            if (translation == BIOS_ATA_TRANSLATION_AUTO) {
                bdrv_get_geometry_hint(hd_table[i], &cylinders, &heads, &sectors);
                if (cylinders <= 1024 && heads <= 16 && sectors <= 63) {
                    /* No translation. */
                    translation = 0;
                } else {
                    /* LBA translation. */
                    translation = 1;
                }
B
bellard 已提交
379
            } else {
B
bellard 已提交
380
                translation--;
B
bellard 已提交
381 382 383
            }
            val |= translation << (i * 2);
        }
B
bellard 已提交
384
    }
B
bellard 已提交
385
    rtc_set_memory(s, 0x39, val);
B
bellard 已提交
386 387
}

388 389 390 391 392 393 394 395 396 397 398
void ioport_set_a20(int enable)
{
    /* XXX: send to all CPUs ? */
    cpu_x86_set_a20(first_cpu, enable);
}

int ioport_get_a20(void)
{
    return ((first_cpu->a20_mask >> 20) & 1);
}

B
bellard 已提交
399 400
static void ioport92_write(void *opaque, uint32_t addr, uint32_t val)
{
401
    ioport_set_a20((val >> 1) & 1);
B
bellard 已提交
402 403 404 405 406
    /* XXX: bit 0 is fast reset */
}

static uint32_t ioport92_read(void *opaque, uint32_t addr)
{
407
    return ioport_get_a20() << 1;
B
bellard 已提交
408 409
}

B
bellard 已提交
410 411 412
/***********************************************************/
/* Bochs BIOS debug ports */

413
static void bochs_bios_write(void *opaque, uint32_t addr, uint32_t val)
B
bellard 已提交
414
{
B
bellard 已提交
415 416
    static const char shutdown_str[8] = "Shutdown";
    static int shutdown_index = 0;
417

B
bellard 已提交
418 419 420 421 422 423 424 425 426 427 428 429
    switch(addr) {
        /* Bochs BIOS messages */
    case 0x400:
    case 0x401:
        fprintf(stderr, "BIOS panic at rombios.c, line %d\n", val);
        exit(1);
    case 0x402:
    case 0x403:
#ifdef DEBUG_BIOS
        fprintf(stderr, "%c", val);
#endif
        break;
B
bellard 已提交
430 431 432 433 434 435 436 437 438 439 440 441
    case 0x8900:
        /* same as Bochs power off */
        if (val == shutdown_str[shutdown_index]) {
            shutdown_index++;
            if (shutdown_index == 8) {
                shutdown_index = 0;
                qemu_system_shutdown_request();
            }
        } else {
            shutdown_index = 0;
        }
        break;
B
bellard 已提交
442 443 444 445 446 447 448 449 450 451 452 453 454 455 456

        /* LGPL'ed VGA BIOS messages */
    case 0x501:
    case 0x502:
        fprintf(stderr, "VGA BIOS panic, line %d\n", val);
        exit(1);
    case 0x500:
    case 0x503:
#ifdef DEBUG_BIOS
        fprintf(stderr, "%c", val);
#endif
        break;
    }
}

457 458
extern uint64_t node_cpumask[MAX_NODES];

A
Alexander Graf 已提交
459
static void *bochs_bios_init(void)
B
bellard 已提交
460
{
461
    void *fw_cfg;
462 463
    uint8_t *smbios_table;
    size_t smbios_len;
464 465
    uint64_t *numa_fw_cfg;
    int i, j;
466

B
bellard 已提交
467 468 469 470
    register_ioport_write(0x400, 1, 2, bochs_bios_write, NULL);
    register_ioport_write(0x401, 1, 2, bochs_bios_write, NULL);
    register_ioport_write(0x402, 1, 1, bochs_bios_write, NULL);
    register_ioport_write(0x403, 1, 1, bochs_bios_write, NULL);
B
bellard 已提交
471
    register_ioport_write(0x8900, 1, 1, bochs_bios_write, NULL);
B
bellard 已提交
472 473 474 475 476

    register_ioport_write(0x501, 1, 2, bochs_bios_write, NULL);
    register_ioport_write(0x502, 1, 2, bochs_bios_write, NULL);
    register_ioport_write(0x500, 1, 1, bochs_bios_write, NULL);
    register_ioport_write(0x503, 1, 1, bochs_bios_write, NULL);
477 478

    fw_cfg = fw_cfg_init(BIOS_CFG_IOPORT, BIOS_CFG_IOPORT + 1, 0, 0);
A
Alexander Graf 已提交
479

480
    fw_cfg_add_i32(fw_cfg, FW_CFG_ID, 1);
481
    fw_cfg_add_i64(fw_cfg, FW_CFG_RAM_SIZE, (uint64_t)ram_size);
482 483
    fw_cfg_add_bytes(fw_cfg, FW_CFG_ACPI_TABLES, (uint8_t *)acpi_tables,
                     acpi_tables_len);
J
Jes Sorensen 已提交
484
    fw_cfg_add_bytes(fw_cfg, FW_CFG_IRQ0_OVERRIDE, &irq0override, 1);
485 486 487 488 489

    smbios_table = smbios_get_table(&smbios_len);
    if (smbios_table)
        fw_cfg_add_bytes(fw_cfg, FW_CFG_SMBIOS_ENTRIES,
                         smbios_table, smbios_len);
490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509

    /* allocate memory for the NUMA channel: one (64bit) word for the number
     * of nodes, one word for each VCPU->node and one word for each node to
     * hold the amount of memory.
     */
    numa_fw_cfg = qemu_mallocz((1 + smp_cpus + nb_numa_nodes) * 8);
    numa_fw_cfg[0] = cpu_to_le64(nb_numa_nodes);
    for (i = 0; i < smp_cpus; i++) {
        for (j = 0; j < nb_numa_nodes; j++) {
            if (node_cpumask[j] & (1 << i)) {
                numa_fw_cfg[i + 1] = cpu_to_le64(j);
                break;
            }
        }
    }
    for (i = 0; i < nb_numa_nodes; i++) {
        numa_fw_cfg[smp_cpus + 1 + i] = cpu_to_le64(node_mem[i]);
    }
    fw_cfg_add_bytes(fw_cfg, FW_CFG_NUMA, (uint8_t *)numa_fw_cfg,
                     (1 + smp_cpus + nb_numa_nodes) * 8);
A
Alexander Graf 已提交
510 511

    return fw_cfg;
B
bellard 已提交
512 513
}

T
ths 已提交
514 515
/* Generate an initial boot sector which sets state and jump to
   a specified vector */
516
static void generate_bootsect(target_phys_addr_t option_rom,
517
                              uint32_t gpr[8], uint16_t segs[6], uint16_t ip)
T
ths 已提交
518
{
519 520
    uint8_t rom[512], *p, *reloc;
    uint8_t sum;
T
ths 已提交
521 522
    int i;

523 524 525 526 527 528
    memset(rom, 0, sizeof(rom));

    p = rom;
    /* Make sure we have an option rom signature */
    *p++ = 0x55;
    *p++ = 0xaa;
T
ths 已提交
529

530 531
    /* ROM size in sectors*/
    *p++ = 1;
T
ths 已提交
532

533
    /* Hook int19 */
T
ths 已提交
534

535 536 537 538
    *p++ = 0x50;		/* push ax */
    *p++ = 0x1e;		/* push ds */
    *p++ = 0x31; *p++ = 0xc0;	/* xor ax, ax */
    *p++ = 0x8e; *p++ = 0xd8;	/* mov ax, ds */
T
ths 已提交
539

540 541 542 543 544 545 546 547 548 549 550 551
    *p++ = 0xc7; *p++ = 0x06;   /* movvw _start,0x64 */
    *p++ = 0x64; *p++ = 0x00;
    reloc = p;
    *p++ = 0x00; *p++ = 0x00;

    *p++ = 0x8c; *p++ = 0x0e;   /* mov cs,0x66 */
    *p++ = 0x66; *p++ = 0x00;

    *p++ = 0x1f;		/* pop ds */
    *p++ = 0x58;		/* pop ax */
    *p++ = 0xcb;		/* lret */
    
T
ths 已提交
552
    /* Actual code */
553 554
    *reloc = (p - rom);

T
ths 已提交
555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583
    *p++ = 0xfa;		/* CLI */
    *p++ = 0xfc;		/* CLD */

    for (i = 0; i < 6; i++) {
	if (i == 1)		/* Skip CS */
	    continue;

	*p++ = 0xb8;		/* MOV AX,imm16 */
	*p++ = segs[i];
	*p++ = segs[i] >> 8;
	*p++ = 0x8e;		/* MOV <seg>,AX */
	*p++ = 0xc0 + (i << 3);
    }

    for (i = 0; i < 8; i++) {
	*p++ = 0x66;		/* 32-bit operand size */
	*p++ = 0xb8 + i;	/* MOV <reg>,imm32 */
	*p++ = gpr[i];
	*p++ = gpr[i] >> 8;
	*p++ = gpr[i] >> 16;
	*p++ = gpr[i] >> 24;
    }

    *p++ = 0xea;		/* JMP FAR */
    *p++ = ip;			/* IP */
    *p++ = ip >> 8;
    *p++ = segs[1];		/* CS */
    *p++ = segs[1] >> 8;

584 585 586 587 588 589
    /* sign rom */
    sum = 0;
    for (i = 0; i < (sizeof(rom) - 1); i++)
        sum += rom[i];
    rom[sizeof(rom) - 1] = -sum;

590
    cpu_physical_memory_write_rom(option_rom, rom, sizeof(rom));
G
Glauber Costa 已提交
591
    option_rom_setup_reset(option_rom, sizeof (rom));
T
ths 已提交
592
}
B
bellard 已提交
593

T
ths 已提交
594 595 596 597 598 599 600 601 602 603 604 605 606 607
static long get_file_size(FILE *f)
{
    long where, size;

    /* XXX: on Unix systems, using fstat() probably makes more sense */

    where = ftell(f);
    fseek(f, 0, SEEK_END);
    size = ftell(f);
    fseek(f, where, SEEK_SET);

    return size;
}

A
Alexander Graf 已提交
608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819
#define MULTIBOOT_STRUCT_ADDR 0x9000

#if MULTIBOOT_STRUCT_ADDR > 0xf0000
#error multiboot struct needs to fit in 16 bit real mode
#endif

static int load_multiboot(void *fw_cfg,
                          FILE *f,
                          const char *kernel_filename,
                          const char *initrd_filename,
                          const char *kernel_cmdline,
                          uint8_t *header)
{
    int i, t, is_multiboot = 0;
    uint32_t flags = 0;
    uint32_t mh_entry_addr;
    uint32_t mh_load_addr;
    uint32_t mb_kernel_size;
    uint32_t mmap_addr = MULTIBOOT_STRUCT_ADDR;
    uint32_t mb_bootinfo = MULTIBOOT_STRUCT_ADDR + 0x500;
    uint32_t mb_cmdline = mb_bootinfo + 0x200;
    uint32_t mb_mod_end;

    /* Ok, let's see if it is a multiboot image.
       The header is 12x32bit long, so the latest entry may be 8192 - 48. */
    for (i = 0; i < (8192 - 48); i += 4) {
        if (ldl_p(header+i) == 0x1BADB002) {
            uint32_t checksum = ldl_p(header+i+8);
            flags = ldl_p(header+i+4);
            checksum += flags;
            checksum += (uint32_t)0x1BADB002;
            if (!checksum) {
                is_multiboot = 1;
                break;
            }
        }
    }

    if (!is_multiboot)
        return 0; /* no multiboot */

#ifdef DEBUG_MULTIBOOT
    fprintf(stderr, "qemu: I believe we found a multiboot image!\n");
#endif

    if (flags & 0x00000004) { /* MULTIBOOT_HEADER_HAS_VBE */
        fprintf(stderr, "qemu: multiboot knows VBE. we don't.\n");
    }
    if (!(flags & 0x00010000)) { /* MULTIBOOT_HEADER_HAS_ADDR */
        uint64_t elf_entry;
        int kernel_size;
        fclose(f);
        kernel_size = load_elf(kernel_filename, 0, &elf_entry, NULL, NULL);
        if (kernel_size < 0) {
            fprintf(stderr, "Error while loading elf kernel\n");
            exit(1);
        }
        mh_load_addr = mh_entry_addr = elf_entry;
        mb_kernel_size = kernel_size;

#ifdef DEBUG_MULTIBOOT
        fprintf(stderr, "qemu: loading multiboot-elf kernel (%#x bytes) with entry %#zx\n",
                mb_kernel_size, (size_t)mh_entry_addr);
#endif
    } else {
        /* Valid if mh_flags sets MULTIBOOT_HEADER_HAS_ADDR. */
        uint32_t mh_header_addr = ldl_p(header+i+12);
        mh_load_addr = ldl_p(header+i+16);
#ifdef DEBUG_MULTIBOOT
        uint32_t mh_load_end_addr = ldl_p(header+i+20);
        uint32_t mh_bss_end_addr = ldl_p(header+i+24);
#endif
        uint32_t mb_kernel_text_offset = i - (mh_header_addr - mh_load_addr);

        mh_entry_addr = ldl_p(header+i+28);
        mb_kernel_size = get_file_size(f) - mb_kernel_text_offset;

        /* Valid if mh_flags sets MULTIBOOT_HEADER_HAS_VBE.
        uint32_t mh_mode_type = ldl_p(header+i+32);
        uint32_t mh_width = ldl_p(header+i+36);
        uint32_t mh_height = ldl_p(header+i+40);
        uint32_t mh_depth = ldl_p(header+i+44); */

#ifdef DEBUG_MULTIBOOT
        fprintf(stderr, "multiboot: mh_header_addr = %#x\n", mh_header_addr);
        fprintf(stderr, "multiboot: mh_load_addr = %#x\n", mh_load_addr);
        fprintf(stderr, "multiboot: mh_load_end_addr = %#x\n", mh_load_end_addr);
        fprintf(stderr, "multiboot: mh_bss_end_addr = %#x\n", mh_bss_end_addr);
#endif

        fseek(f, mb_kernel_text_offset, SEEK_SET);

#ifdef DEBUG_MULTIBOOT
        fprintf(stderr, "qemu: loading multiboot kernel (%#x bytes) at %#x\n",
                mb_kernel_size, mh_load_addr);
#endif

        if (!fread_targphys_ok(mh_load_addr, mb_kernel_size, f)) {
            fprintf(stderr, "qemu: read error on multiboot kernel '%s' (%#x)\n",
                    kernel_filename, mb_kernel_size);
            exit(1);
        }
        fclose(f);
    }

    /* blob size is only the kernel for now */
    mb_mod_end = mh_load_addr + mb_kernel_size;

    /* load modules */
    stl_phys(mb_bootinfo + 20, 0x0); /* mods_count */
    if (initrd_filename) {
        uint32_t mb_mod_info = mb_bootinfo + 0x100;
        uint32_t mb_mod_cmdline = mb_bootinfo + 0x300;
        uint32_t mb_mod_start = mh_load_addr;
        uint32_t mb_mod_length = mb_kernel_size;
        char *next_initrd;
        char *next_space;
        int mb_mod_count = 0;

        do {
            next_initrd = strchr(initrd_filename, ',');
            if (next_initrd)
                *next_initrd = '\0';
            /* if a space comes after the module filename, treat everything
               after that as parameters */
            cpu_physical_memory_write(mb_mod_cmdline, (uint8_t*)initrd_filename,
                                      strlen(initrd_filename) + 1);
            stl_phys(mb_mod_info + 8, mb_mod_cmdline); /* string */
            mb_mod_cmdline += strlen(initrd_filename) + 1;
            if ((next_space = strchr(initrd_filename, ' ')))
                *next_space = '\0';
#ifdef DEBUG_MULTIBOOT
	     printf("multiboot loading module: %s\n", initrd_filename);
#endif
            f = fopen(initrd_filename, "rb");
            if (f) {
                mb_mod_start = (mb_mod_start + mb_mod_length + (TARGET_PAGE_SIZE - 1))
                             & (TARGET_PAGE_MASK);
                mb_mod_length = get_file_size(f);
                mb_mod_end = mb_mod_start + mb_mod_length;

                if (!fread_targphys_ok(mb_mod_start, mb_mod_length, f)) {
                    fprintf(stderr, "qemu: read error on multiboot module '%s' (%#x)\n",
                            initrd_filename, mb_mod_length);
                    exit(1);
                }

                mb_mod_count++;
                stl_phys(mb_mod_info + 0, mb_mod_start);
                stl_phys(mb_mod_info + 4, mb_mod_start + mb_mod_length);
#ifdef DEBUG_MULTIBOOT
                printf("mod_start: %#x\nmod_end:   %#x\n", mb_mod_start,
                       mb_mod_start + mb_mod_length);
#endif
                stl_phys(mb_mod_info + 12, 0x0); /* reserved */
            }
            initrd_filename = next_initrd+1;
            mb_mod_info += 16;
        } while (next_initrd);
        stl_phys(mb_bootinfo + 20, mb_mod_count); /* mods_count */
        stl_phys(mb_bootinfo + 24, mb_bootinfo + 0x100); /* mods_addr */
    }

    /* Make sure we're getting kernel + modules back after reset */
    option_rom_setup_reset(mh_load_addr, mb_mod_end - mh_load_addr);

    /* Commandline support */
    stl_phys(mb_bootinfo + 16, mb_cmdline);
    t = strlen(kernel_filename);
    cpu_physical_memory_write(mb_cmdline, (uint8_t*)kernel_filename, t);
    mb_cmdline += t;
    stb_phys(mb_cmdline++, ' ');
    t = strlen(kernel_cmdline) + 1;
    cpu_physical_memory_write(mb_cmdline, (uint8_t*)kernel_cmdline, t);

    /* the kernel is where we want it to be now */

#define MULTIBOOT_FLAGS_MEMORY (1 << 0)
#define MULTIBOOT_FLAGS_BOOT_DEVICE (1 << 1)
#define MULTIBOOT_FLAGS_CMDLINE (1 << 2)
#define MULTIBOOT_FLAGS_MODULES (1 << 3)
#define MULTIBOOT_FLAGS_MMAP (1 << 6)
    stl_phys(mb_bootinfo, MULTIBOOT_FLAGS_MEMORY
                        | MULTIBOOT_FLAGS_BOOT_DEVICE
                        | MULTIBOOT_FLAGS_CMDLINE
                        | MULTIBOOT_FLAGS_MODULES
                        | MULTIBOOT_FLAGS_MMAP);
    stl_phys(mb_bootinfo + 4, 640); /* mem_lower */
    stl_phys(mb_bootinfo + 8, ram_size / 1024); /* mem_upper */
    stl_phys(mb_bootinfo + 12, 0x8001ffff); /* XXX: use the -boot switch? */
    stl_phys(mb_bootinfo + 48, mmap_addr); /* mmap_addr */

#ifdef DEBUG_MULTIBOOT
    fprintf(stderr, "multiboot: mh_entry_addr = %#x\n", mh_entry_addr);
#endif

    /* Pass variables to option rom */
    fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_ADDR, mh_entry_addr);
    fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_ADDR, mb_bootinfo);
    fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_SIZE, mmap_addr);

    /* Make sure we're getting the config space back after reset */
    option_rom_setup_reset(mb_bootinfo, 0x500);

    option_rom[nb_option_roms] = "multiboot.bin";
    nb_option_roms++;

    return 1; /* yes, we are multiboot */
}

static void load_linux(void *fw_cfg,
                       target_phys_addr_t option_rom,
820
                       const char *kernel_filename,
T
ths 已提交
821
		       const char *initrd_filename,
G
Glauber Costa 已提交
822 823
		       const char *kernel_cmdline,
               target_phys_addr_t max_ram_size)
T
ths 已提交
824 825 826 827 828
{
    uint16_t protocol;
    uint32_t gpr[8];
    uint16_t seg[6];
    uint16_t real_seg;
P
Paul Brook 已提交
829
    int setup_size, kernel_size, initrd_size = 0, cmdline_size;
T
ths 已提交
830
    uint32_t initrd_max;
A
Alexander Graf 已提交
831
    uint8_t header[8192];
P
Paul Brook 已提交
832
    target_phys_addr_t real_addr, prot_addr, cmdline_addr, initrd_addr = 0;
T
ths 已提交
833
    FILE *f, *fi;
P
Pascal Terjan 已提交
834
    char *vmode;
T
ths 已提交
835 836 837 838 839 840 841

    /* Align to 16 bytes as a paranoia measure */
    cmdline_size = (strlen(kernel_cmdline)+16) & ~15;

    /* load the kernel header */
    f = fopen(kernel_filename, "rb");
    if (!f || !(kernel_size = get_file_size(f)) ||
A
Alexander Graf 已提交
842 843
	fread(header, 1, MIN(ARRAY_SIZE(header), kernel_size), f) !=
	MIN(ARRAY_SIZE(header), kernel_size)) {
T
ths 已提交
844 845 846 847 848 849
	fprintf(stderr, "qemu: could not load kernel '%s'\n",
		kernel_filename);
	exit(1);
    }

    /* kernel protocol version */
B
bellard 已提交
850
#if 0
T
ths 已提交
851
    fprintf(stderr, "header magic: %#x\n", ldl_p(header+0x202));
B
bellard 已提交
852
#endif
T
ths 已提交
853 854
    if (ldl_p(header+0x202) == 0x53726448)
	protocol = lduw_p(header+0x206);
A
Alexander Graf 已提交
855 856 857 858 859 860
    else {
	/* This looks like a multiboot kernel. If it is, let's stop
	   treating it like a Linux kernel. */
	if (load_multiboot(fw_cfg, f, kernel_filename,
                           initrd_filename, kernel_cmdline, header))
	   return;
T
ths 已提交
861
	protocol = 0;
A
Alexander Graf 已提交
862
    }
T
ths 已提交
863 864 865

    if (protocol < 0x200 || !(header[0x211] & 0x01)) {
	/* Low kernel */
866 867 868
	real_addr    = 0x90000;
	cmdline_addr = 0x9a000 - cmdline_size;
	prot_addr    = 0x10000;
T
ths 已提交
869 870
    } else if (protocol < 0x202) {
	/* High but ancient kernel */
871 872 873
	real_addr    = 0x90000;
	cmdline_addr = 0x9a000 - cmdline_size;
	prot_addr    = 0x100000;
T
ths 已提交
874 875
    } else {
	/* High and recent kernel */
876 877 878
	real_addr    = 0x10000;
	cmdline_addr = 0x20000;
	prot_addr    = 0x100000;
T
ths 已提交
879 880
    }

B
bellard 已提交
881
#if 0
T
ths 已提交
882
    fprintf(stderr,
883 884 885
	    "qemu: real_addr     = 0x" TARGET_FMT_plx "\n"
	    "qemu: cmdline_addr  = 0x" TARGET_FMT_plx "\n"
	    "qemu: prot_addr     = 0x" TARGET_FMT_plx "\n",
886 887 888
	    real_addr,
	    cmdline_addr,
	    prot_addr);
B
bellard 已提交
889
#endif
T
ths 已提交
890 891 892 893 894 895 896

    /* highest address for loading the initrd */
    if (protocol >= 0x203)
	initrd_max = ldl_p(header+0x22c);
    else
	initrd_max = 0x37ffffff;

G
Glauber Costa 已提交
897 898
    if (initrd_max >= max_ram_size-ACPI_DATA_SIZE)
    	initrd_max = max_ram_size-ACPI_DATA_SIZE-1;
T
ths 已提交
899 900

    /* kernel command line */
901
    pstrcpy_targphys(cmdline_addr, 4096, kernel_cmdline);
T
ths 已提交
902 903

    if (protocol >= 0x202) {
904
	stl_p(header+0x228, cmdline_addr);
T
ths 已提交
905 906 907 908 909
    } else {
	stw_p(header+0x20, 0xA33F);
	stw_p(header+0x22, cmdline_addr-real_addr);
    }

P
Pascal Terjan 已提交
910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927
    /* handle vga= parameter */
    vmode = strstr(kernel_cmdline, "vga=");
    if (vmode) {
        unsigned int video_mode;
        /* skip "vga=" */
        vmode += 4;
        if (!strncmp(vmode, "normal", 6)) {
            video_mode = 0xffff;
        } else if (!strncmp(vmode, "ext", 3)) {
            video_mode = 0xfffe;
        } else if (!strncmp(vmode, "ask", 3)) {
            video_mode = 0xfffd;
        } else {
            video_mode = strtol(vmode, NULL, 0);
        }
        stw_p(header+0x1fa, video_mode);
    }

T
ths 已提交
928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955
    /* loader type */
    /* High nybble = B reserved for Qemu; low nybble is revision number.
       If this code is substantially changed, you may want to consider
       incrementing the revision. */
    if (protocol >= 0x200)
	header[0x210] = 0xB0;

    /* heap */
    if (protocol >= 0x201) {
	header[0x211] |= 0x80;	/* CAN_USE_HEAP */
	stw_p(header+0x224, cmdline_addr-real_addr-0x200);
    }

    /* load initrd */
    if (initrd_filename) {
	if (protocol < 0x200) {
	    fprintf(stderr, "qemu: linux kernel too old to load a ram disk\n");
	    exit(1);
	}

	fi = fopen(initrd_filename, "rb");
	if (!fi) {
	    fprintf(stderr, "qemu: could not load initial ram disk '%s'\n",
		    initrd_filename);
	    exit(1);
	}

	initrd_size = get_file_size(fi);
956
	initrd_addr = (initrd_max-initrd_size) & ~4095;
T
ths 已提交
957

958
	if (!fread_targphys_ok(initrd_addr, initrd_size, fi)) {
T
ths 已提交
959 960 961 962 963 964
	    fprintf(stderr, "qemu: read error on initial ram disk '%s'\n",
		    initrd_filename);
	    exit(1);
	}
	fclose(fi);

965
	stl_p(header+0x218, initrd_addr);
T
ths 已提交
966 967 968 969
	stl_p(header+0x21c, initrd_size);
    }

    /* store the finalized header and load the rest of the kernel */
A
Alexander Graf 已提交
970
    cpu_physical_memory_write(real_addr, header, ARRAY_SIZE(header));
T
ths 已提交
971 972 973 974 975 976

    setup_size = header[0x1f1];
    if (setup_size == 0)
	setup_size = 4;

    setup_size = (setup_size+1)*512;
A
Alexander Graf 已提交
977 978 979 980 981 982 983 984 985
    /* Size of protected-mode code */
    kernel_size -= (setup_size > ARRAY_SIZE(header)) ? setup_size : ARRAY_SIZE(header);

    /* In case we have read too much already, copy that over */
    if (setup_size < ARRAY_SIZE(header)) {
        cpu_physical_memory_write(prot_addr, header + setup_size, ARRAY_SIZE(header) - setup_size);
        prot_addr += (ARRAY_SIZE(header) - setup_size);
        setup_size = ARRAY_SIZE(header);
    }
T
ths 已提交
986

A
Alexander Graf 已提交
987 988
    if (!fread_targphys_ok(real_addr + ARRAY_SIZE(header),
                           setup_size - ARRAY_SIZE(header), f) ||
989
	!fread_targphys_ok(prot_addr, kernel_size, f)) {
T
ths 已提交
990 991 992 993 994 995 996
	fprintf(stderr, "qemu: read error on kernel '%s'\n",
		kernel_filename);
	exit(1);
    }
    fclose(f);

    /* generate bootsector to set up the initial register state */
997
    real_seg = real_addr >> 4;
T
ths 已提交
998 999 1000 1001 1002
    seg[0] = seg[2] = seg[3] = seg[4] = seg[4] = real_seg;
    seg[1] = real_seg+0x20;	/* CS */
    memset(gpr, 0, sizeof gpr);
    gpr[4] = cmdline_addr-real_addr-16;	/* SP (-16 is paranoia) */

G
Glauber Costa 已提交
1003 1004 1005 1006 1007 1008
    option_rom_setup_reset(real_addr, setup_size);
    option_rom_setup_reset(prot_addr, kernel_size);
    option_rom_setup_reset(cmdline_addr, cmdline_size);
    if (initrd_filename)
        option_rom_setup_reset(initrd_addr, initrd_size);

1009
    generate_bootsect(option_rom, gpr, seg, 0);
T
ths 已提交
1010 1011
}

B
bellard 已提交
1012 1013 1014 1015 1016 1017
static const int ide_iobase[2] = { 0x1f0, 0x170 };
static const int ide_iobase2[2] = { 0x3f6, 0x376 };
static const int ide_irq[2] = { 14, 15 };

#define NE2000_NB_MAX 6

1018
static int ne2000_io[NE2000_NB_MAX] = { 0x300, 0x320, 0x340, 0x360, 0x280, 0x380 };
B
bellard 已提交
1019 1020
static int ne2000_irq[NE2000_NB_MAX] = { 9, 10, 11, 3, 4, 5 };

1021 1022 1023
static int serial_io[MAX_SERIAL_PORTS] = { 0x3f8, 0x2f8, 0x3e8, 0x2e8 };
static int serial_irq[MAX_SERIAL_PORTS] = { 4, 3, 4, 3 };

1024 1025 1026
static int parallel_io[MAX_PARALLEL_PORTS] = { 0x378, 0x278, 0x3bc };
static int parallel_irq[MAX_PARALLEL_PORTS] = { 7, 7, 7 };

1027
#ifdef HAS_AUDIO
P
pbrook 已提交
1028
static void audio_init (PCIBus *pci_bus, qemu_irq *pic)
1029 1030 1031
{
    struct soundhw *c;

M
malc 已提交
1032 1033 1034 1035 1036 1037 1038
    for (c = soundhw; c->name; ++c) {
        if (c->enabled) {
            if (c->isa) {
                c->init.init_isa(pic);
            } else {
                if (pci_bus) {
                    c->init.init_pci(pci_bus);
1039 1040 1041 1042 1043 1044 1045
                }
            }
        }
    }
}
#endif

J
Jes Sorensen 已提交
1046
static void pc_init_ne2k_isa(NICInfo *nd)
1047 1048 1049 1050 1051
{
    static int nb_ne2k = 0;

    if (nb_ne2k == NE2000_NB_MAX)
        return;
J
Jes Sorensen 已提交
1052 1053
    isa_ne2000_init(ne2000_io[nb_ne2k],
                    isa_reserve_irq(ne2000_irq[nb_ne2k]), nd);
1054 1055 1056
    nb_ne2k++;
}

1057 1058 1059 1060
static int load_option_rom(const char *oprom, target_phys_addr_t start,
                           target_phys_addr_t end)
{
        int size;
P
Paul Brook 已提交
1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074
        char *filename;

        filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, oprom);
        if (filename) {
            size = get_image_size(filename);
            if (size > 0 && start + size > end) {
                fprintf(stderr, "Not enough space to load option rom '%s'\n",
                        oprom);
                exit(1);
            }
            size = load_image_targphys(filename, start, end - start);
            qemu_free(filename);
        } else {
            size = -1;
1075 1076 1077 1078 1079 1080 1081
        }
        if (size < 0) {
            fprintf(stderr, "Could not load option rom '%s'\n", oprom);
            exit(1);
        }
        /* Round up optiom rom size to the next 2k boundary */
        size = (size + 2047) & ~2047;
1082
        option_rom_setup_reset(start, size);
1083 1084 1085
        return size;
}

G
Gleb Natapov 已提交
1086 1087 1088 1089 1090
int cpu_is_bsp(CPUState *env)
{
	return env->cpuid_apic_id == 0;
}

J
Jan Kiszka 已提交
1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109
static CPUState *pc_new_cpu(const char *cpu_model)
{
    CPUState *env;

    env = cpu_init(cpu_model);
    if (!env) {
        fprintf(stderr, "Unable to find x86 CPU definition\n");
        exit(1);
    }
    if ((env->cpuid_features & CPUID_APIC) || smp_cpus > 1) {
        env->cpuid_apic_id = env->cpu_index;
        /* APIC reset callback resets cpu */
        apic_init(env);
    } else {
        qemu_register_reset((QEMUResetHandler*)cpu_reset, env);
    }
    return env;
}

B
bellard 已提交
1110
/* PC hardware initialisation */
P
Paul Brook 已提交
1111
static void pc_init1(ram_addr_t ram_size,
1112
                     const char *boot_device,
1113 1114
                     const char *kernel_filename,
                     const char *kernel_cmdline,
1115
                     const char *initrd_filename,
1116
                     const char *cpu_model,
1117
                     int pci_enabled)
B
bellard 已提交
1118
{
P
Paul Brook 已提交
1119
    char *filename;
T
ths 已提交
1120
    int ret, linux_boot, i;
P
pbrook 已提交
1121
    ram_addr_t ram_addr, bios_offset, option_rom_offset;
1122
    ram_addr_t below_4g_mem_size, above_4g_mem_size = 0;
1123
    int bios_size, isa_bios_size, oprom_area_size;
B
bellard 已提交
1124
    PCIBus *pci_bus;
1125
    PCIDevice *pci_dev;
1126
    ISADevice *isa_dev;
P
pbrook 已提交
1127
    int piix3_devfn = -1;
1128
    CPUState *env;
P
pbrook 已提交
1129
    qemu_irq *cpu_irq;
1130
    qemu_irq *isa_irq;
P
pbrook 已提交
1131
    qemu_irq *i8259;
1132
    IsaIrqState *isa_irq_state;
G
Gerd Hoffmann 已提交
1133
    DriveInfo *dinfo;
T
ths 已提交
1134 1135
    BlockDriverState *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
    BlockDriverState *fd[MAX_FD];
A
aliguori 已提交
1136
    int using_vga = cirrus_vga_enabled || std_vga_enabled || vmsvga_enabled;
A
Alexander Graf 已提交
1137
    void *fw_cfg;
1138

1139 1140 1141 1142 1143 1144 1145
    if (ram_size >= 0xe0000000 ) {
        above_4g_mem_size = ram_size - 0xe0000000;
        below_4g_mem_size = 0xe0000000;
    } else {
        below_4g_mem_size = ram_size;
    }

B
bellard 已提交
1146 1147
    linux_boot = (kernel_filename != NULL);

1148
    /* init CPUs */
1149 1150 1151 1152 1153 1154 1155
    if (cpu_model == NULL) {
#ifdef TARGET_X86_64
        cpu_model = "qemu64";
#else
        cpu_model = "qemu32";
#endif
    }
J
Jan Kiszka 已提交
1156 1157 1158

    for (i = 0; i < smp_cpus; i++) {
        env = pc_new_cpu(cpu_model);
1159 1160
    }

A
aurel32 已提交
1161 1162
    vmport_init();

B
bellard 已提交
1163
    /* allocate RAM */
1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175
    ram_addr = qemu_ram_alloc(0xa0000);
    cpu_register_physical_memory(0, 0xa0000, ram_addr);

    /* Allocate, even though we won't register, so we don't break the
     * phys_ram_base + PA assumption. This range includes vga (0xa0000 - 0xc0000),
     * and some bios areas, which will be registered later
     */
    ram_addr = qemu_ram_alloc(0x100000 - 0xa0000);
    ram_addr = qemu_ram_alloc(below_4g_mem_size - 0x100000);
    cpu_register_physical_memory(0x100000,
                 below_4g_mem_size - 0x100000,
                 ram_addr);
1176 1177 1178

    /* above 4giga memory allocation */
    if (above_4g_mem_size > 0) {
1179 1180 1181
#if TARGET_PHYS_ADDR_BITS == 32
        hw_error("To much RAM for 32-bit physical address");
#else
1182 1183
        ram_addr = qemu_ram_alloc(above_4g_mem_size);
        cpu_register_physical_memory(0x100000000ULL,
1184
                                     above_4g_mem_size,
1185
                                     ram_addr);
1186
#endif
1187
    }
B
bellard 已提交
1188

1189

B
bellard 已提交
1190
    /* BIOS load */
1191 1192
    if (bios_name == NULL)
        bios_name = BIOS_FILENAME;
P
Paul Brook 已提交
1193 1194 1195 1196 1197 1198
    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
    if (filename) {
        bios_size = get_image_size(filename);
    } else {
        bios_size = -1;
    }
1199
    if (bios_size <= 0 ||
B
bellard 已提交
1200
        (bios_size % 65536) != 0) {
B
bellard 已提交
1201 1202
        goto bios_error;
    }
B
bellard 已提交
1203
    bios_offset = qemu_ram_alloc(bios_size);
P
Paul Brook 已提交
1204
    ret = load_image(filename, qemu_get_ram_ptr(bios_offset));
B
bellard 已提交
1205 1206
    if (ret != bios_size) {
    bios_error:
P
Paul Brook 已提交
1207
        fprintf(stderr, "qemu: could not load PC BIOS '%s'\n", bios_name);
B
bellard 已提交
1208 1209
        exit(1);
    }
P
Paul Brook 已提交
1210 1211 1212
    if (filename) {
        qemu_free(filename);
    }
B
bellard 已提交
1213 1214 1215 1216
    /* map the last 128KB of the BIOS in ISA space */
    isa_bios_size = bios_size;
    if (isa_bios_size > (128 * 1024))
        isa_bios_size = 128 * 1024;
1217 1218
    cpu_register_physical_memory(0x100000 - isa_bios_size,
                                 isa_bios_size,
B
bellard 已提交
1219
                                 (bios_offset + bios_size - isa_bios_size) | IO_MEM_ROM);
1220

1221

1222 1223 1224

    option_rom_offset = qemu_ram_alloc(0x20000);
    oprom_area_size = 0;
1225
    cpu_register_physical_memory(0xc0000, 0x20000, option_rom_offset);
1226 1227

    if (using_vga) {
P
Paul Brook 已提交
1228
        const char *vgabios_filename;
1229 1230
        /* VGA BIOS load */
        if (cirrus_vga_enabled) {
P
Paul Brook 已提交
1231
            vgabios_filename = VGABIOS_CIRRUS_FILENAME;
1232
        } else {
P
Paul Brook 已提交
1233
            vgabios_filename = VGABIOS_FILENAME;
B
bellard 已提交
1234
        }
P
Paul Brook 已提交
1235
        oprom_area_size = load_option_rom(vgabios_filename, 0xc0000, 0xe0000);
1236 1237 1238 1239 1240 1241 1242
    }
    /* Although video roms can grow larger than 0x8000, the area between
     * 0xc0000 - 0xc8000 is reserved for them. It means we won't be looking
     * for any other kind of option rom inside this area */
    if (oprom_area_size < 0x8000)
        oprom_area_size = 0x8000;

A
Alexander Graf 已提交
1243 1244 1245 1246
    /* map all the bios at the top of memory */
    cpu_register_physical_memory((uint32_t)(-bios_size),
                                 bios_size, bios_offset | IO_MEM_ROM);

A
Alexander Graf 已提交
1247
    fw_cfg = bochs_bios_init();
A
Alexander Graf 已提交
1248

1249
    if (linux_boot) {
A
Alexander Graf 已提交
1250
        load_linux(fw_cfg, 0xc0000 + oprom_area_size,
G
Glauber Costa 已提交
1251
                   kernel_filename, initrd_filename, kernel_cmdline, below_4g_mem_size);
1252 1253 1254 1255
        oprom_area_size += 2048;
    }

    for (i = 0; i < nb_option_roms; i++) {
1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267
        oprom_area_size += load_option_rom(option_rom[i], 0xc0000 + oprom_area_size,
                                           0xe0000);
    }

    for (i = 0; i < nb_nics; i++) {
        char nic_oprom[1024];
        const char *model = nd_table[i].model;

        if (!nd_table[i].bootable)
            continue;

        if (model == NULL)
1268
            model = "e1000";
1269 1270 1271 1272
        snprintf(nic_oprom, sizeof(nic_oprom), "pxe-%s.bin", model);

        oprom_area_size += load_option_rom(nic_oprom, 0xc0000 + oprom_area_size,
                                           0xe0000);
1273 1274
    }

1275
    cpu_irq = qemu_allocate_irqs(pic_irq_request, NULL, 1);
P
pbrook 已提交
1276
    i8259 = i8259_init(cpu_irq[0]);
1277 1278
    isa_irq_state = qemu_mallocz(sizeof(*isa_irq_state));
    isa_irq_state->i8259 = i8259;
A
Avi Kivity 已提交
1279
    isa_irq = qemu_allocate_irqs(isa_irq_handler, isa_irq_state, 24);
P
pbrook 已提交
1280

B
bellard 已提交
1281
    if (pci_enabled) {
1282
        pci_bus = i440fx_init(&i440fx_state, isa_irq);
1283
        piix3_devfn = piix3_init(pci_bus, -1);
B
bellard 已提交
1284 1285
    } else {
        pci_bus = NULL;
G
Gerd Hoffmann 已提交
1286
        isa_bus_new(NULL);
B
bellard 已提交
1287
    }
G
Gerd Hoffmann 已提交
1288
    isa_bus_irqs(isa_irq);
B
bellard 已提交
1289

J
Jes Sorensen 已提交
1290 1291
    ferr_irq = isa_reserve_irq(13);

B
bellard 已提交
1292
    /* init basic PC hardware */
B
bellard 已提交
1293
    register_ioport_write(0x80, 1, 1, ioport80_write, NULL);
B
bellard 已提交
1294

1295 1296
    register_ioport_write(0xf0, 1, 1, ioportF0_write, NULL);

B
bellard 已提交
1297 1298
    if (cirrus_vga_enabled) {
        if (pci_enabled) {
P
Paul Brook 已提交
1299
            pci_cirrus_vga_init(pci_bus);
B
bellard 已提交
1300
        } else {
P
Paul Brook 已提交
1301
            isa_cirrus_vga_init();
B
bellard 已提交
1302
        }
1303 1304
    } else if (vmsvga_enabled) {
        if (pci_enabled)
P
Paul Brook 已提交
1305
            pci_vmsvga_init(pci_bus);
1306 1307
        else
            fprintf(stderr, "%s: vmware_vga: no PCI bus\n", __FUNCTION__);
1308
    } else if (std_vga_enabled) {
B
bellard 已提交
1309
        if (pci_enabled) {
P
Paul Brook 已提交
1310
            pci_vga_init(pci_bus, 0, 0);
B
bellard 已提交
1311
        } else {
P
Paul Brook 已提交
1312
            isa_vga_init();
B
bellard 已提交
1313
        }
B
bellard 已提交
1314
    }
B
bellard 已提交
1315

J
Jes Sorensen 已提交
1316
    rtc_state = rtc_init(0x70, isa_reserve_irq(8), 2000);
B
bellard 已提交
1317

1318 1319
    qemu_register_boot_set(pc_boot_set, rtc_state);

B
bellard 已提交
1320 1321 1322
    register_ioport_read(0x92, 1, 1, ioport92_read, NULL);
    register_ioport_write(0x92, 1, 1, ioport92_write, NULL);

1323
    if (pci_enabled) {
A
Avi Kivity 已提交
1324
        isa_irq_state->ioapic = ioapic_init();
1325
    }
J
Jes Sorensen 已提交
1326
    pit = pit_init(0x40, isa_reserve_irq(0));
B
bellard 已提交
1327
    pcspk_init(pit);
A
aliguori 已提交
1328
    if (!no_hpet) {
1329
        hpet_init(isa_irq);
A
aliguori 已提交
1330
    }
B
bellard 已提交
1331

1332 1333
    for(i = 0; i < MAX_SERIAL_PORTS; i++) {
        if (serial_hds[i]) {
J
Jes Sorensen 已提交
1334
            serial_init(serial_io[i], isa_reserve_irq(serial_irq[i]), 115200,
A
aurel32 已提交
1335
                        serial_hds[i]);
1336 1337
        }
    }
B
bellard 已提交
1338

1339 1340
    for(i = 0; i < MAX_PARALLEL_PORTS; i++) {
        if (parallel_hds[i]) {
J
Jes Sorensen 已提交
1341
            parallel_init(parallel_io[i], isa_reserve_irq(parallel_irq[i]),
P
pbrook 已提交
1342
                          parallel_hds[i]);
1343 1344 1345
        }
    }

R
Richard W.M. Jones 已提交
1346 1347
    watchdog_pc_init(pci_bus);

1348
    for(i = 0; i < nb_nics; i++) {
1349 1350 1351
        NICInfo *nd = &nd_table[i];

        if (!pci_enabled || (nd->model && strcmp(nd->model, "ne2k_isa") == 0))
J
Jes Sorensen 已提交
1352
            pc_init_ne2k_isa(nd);
1353
        else
1354
            pci_nic_init(nd, "e1000", NULL);
1355
    }
B
bellard 已提交
1356

1357
    piix4_acpi_system_hot_add_init();
1358

T
ths 已提交
1359 1360 1361 1362 1363 1364
    if (drive_get_max_bus(IF_IDE) >= MAX_IDE_BUS) {
        fprintf(stderr, "qemu: too many IDE bus\n");
        exit(1);
    }

    for(i = 0; i < MAX_IDE_BUS * MAX_IDE_DEVS; i++) {
G
Gerd Hoffmann 已提交
1365 1366
        dinfo = drive_get(IF_IDE, i / MAX_IDE_DEVS, i % MAX_IDE_DEVS);
        hd[i] = dinfo ? dinfo->bdrv : NULL;
T
ths 已提交
1367 1368
    }

1369
    if (pci_enabled) {
1370
        pci_piix3_ide_init(pci_bus, hd, piix3_devfn + 1, isa_irq);
1371
    } else {
T
ths 已提交
1372
        for(i = 0; i < MAX_IDE_BUS; i++) {
J
Jes Sorensen 已提交
1373 1374
            isa_ide_init(ide_iobase[i], ide_iobase2[i],
                         isa_reserve_irq(ide_irq[i]),
T
ths 已提交
1375
	                 hd[MAX_IDE_DEVS * i], hd[MAX_IDE_DEVS * i + 1]);
B
bellard 已提交
1376
        }
B
bellard 已提交
1377
    }
B
bellard 已提交
1378

1379
    isa_dev = isa_create_simple("i8042", 0x60, 0x64);
G
Gerd Hoffmann 已提交
1380 1381
    isa_connect_irq(isa_dev, 0, 1);
    isa_connect_irq(isa_dev, 1, 12);
B
bellard 已提交
1382
    DMA_init(0);
1383
#ifdef HAS_AUDIO
1384
    audio_init(pci_enabled ? pci_bus : NULL, isa_irq);
B
bellard 已提交
1385
#endif
B
bellard 已提交
1386

T
ths 已提交
1387
    for(i = 0; i < MAX_FD; i++) {
G
Gerd Hoffmann 已提交
1388 1389
        dinfo = drive_get(IF_FLOPPY, 0, i);
        fd[i] = dinfo ? dinfo->bdrv : NULL;
T
ths 已提交
1390
    }
G
Gerd Hoffmann 已提交
1391
    floppy_controller = fdctrl_init_isa(6, 2, 0x3f0, fd);
B
bellard 已提交
1392

1393
    cmos_init(below_4g_mem_size, above_4g_mem_size, boot_device, hd);
B
bellard 已提交
1394

B
bellard 已提交
1395
    if (pci_enabled && usb_enabled) {
T
ths 已提交
1396
        usb_uhci_piix3_init(pci_bus, piix3_devfn + 2);
B
bellard 已提交
1397 1398
    }

B
bellard 已提交
1399
    if (pci_enabled && acpi_enabled) {
1400
        uint8_t *eeprom_buf = qemu_mallocz(8 * 256); /* XXX: make this persistent */
P
pbrook 已提交
1401 1402 1403
        i2c_bus *smbus;

        /* TODO: Populate SPD eeprom data.  */
J
Jes Sorensen 已提交
1404 1405
        smbus = piix4_pm_init(pci_bus, piix3_devfn + 3, 0xb100,
                              isa_reserve_irq(9));
1406
        for (i = 0; i < 8; i++) {
P
Paul Brook 已提交
1407
            DeviceState *eeprom;
P
Paul Brook 已提交
1408
            eeprom = qdev_create((BusState *)smbus, "smbus-eeprom");
G
Gerd Hoffmann 已提交
1409 1410
            qdev_prop_set_uint32(eeprom, "address", 0x50 + i);
            qdev_prop_set_ptr(eeprom, "data", eeprom_buf + (i * 256));
P
Paul Brook 已提交
1411
            qdev_init(eeprom);
1412
        }
B
bellard 已提交
1413
    }
1414

B
bellard 已提交
1415 1416 1417
    if (i440fx_state) {
        i440fx_init_memory_mappings(i440fx_state);
    }
T
ths 已提交
1418

P
pbrook 已提交
1419
    if (pci_enabled) {
T
ths 已提交
1420
	int max_bus;
P
Paul Brook 已提交
1421
        int bus;
1422

T
ths 已提交
1423 1424
        max_bus = drive_get_max_bus(IF_SCSI);
	for (bus = 0; bus <= max_bus; bus++) {
P
Paul Brook 已提交
1425
            pci_create_simple(pci_bus, -1, "lsi53c895a");
T
ths 已提交
1426
        }
P
pbrook 已提交
1427
    }
A
aliguori 已提交
1428

A
aliguori 已提交
1429
    /* Add virtio balloon device */
1430 1431 1432
    if (pci_enabled && virtio_balloon) {
        pci_dev = pci_create("virtio-balloon-pci", virtio_balloon_devaddr);
        qdev_init(&pci_dev->qdev);
P
Paul Brook 已提交
1433
    }
1434 1435 1436 1437

    /* Add virtio console devices */
    if (pci_enabled) {
        for(i = 0; i < MAX_VIRTIO_CONSOLES; i++) {
P
Paul Brook 已提交
1438
            if (virtcon_hds[i]) {
1439
                pci_create_simple(pci_bus, -1, "virtio-console-pci");
P
Paul Brook 已提交
1440
            }
1441 1442
        }
    }
B
bellard 已提交
1443
}
B
bellard 已提交
1444

P
Paul Brook 已提交
1445
static void pc_init_pci(ram_addr_t ram_size,
1446
                        const char *boot_device,
1447
                        const char *kernel_filename,
1448
                        const char *kernel_cmdline,
1449 1450
                        const char *initrd_filename,
                        const char *cpu_model)
1451
{
P
Paul Brook 已提交
1452
    pc_init1(ram_size, boot_device,
1453
             kernel_filename, kernel_cmdline,
1454
             initrd_filename, cpu_model, 1);
1455 1456
}

P
Paul Brook 已提交
1457
static void pc_init_isa(ram_addr_t ram_size,
1458
                        const char *boot_device,
1459
                        const char *kernel_filename,
1460
                        const char *kernel_cmdline,
1461 1462
                        const char *initrd_filename,
                        const char *cpu_model)
1463
{
P
Paul Brook 已提交
1464
    pc_init1(ram_size, boot_device,
1465
             kernel_filename, kernel_cmdline,
1466
             initrd_filename, cpu_model, 0);
1467 1468
}

A
aliguori 已提交
1469 1470 1471 1472 1473 1474 1475 1476
/* set CMOS shutdown status register (index 0xF) as S3_resume(0xFE)
   BIOS will read it and start S3 resume at POST Entry */
void cmos_set_s3_resume(void)
{
    if (rtc_state)
        rtc_set_memory(rtc_state, 0xF, 0xFE);
}

1477
static QEMUMachine pc_machine = {
1478 1479
    .name = "pc-0.11",
    .alias = "pc",
A
aurel32 已提交
1480 1481
    .desc = "Standard PC",
    .init = pc_init_pci,
1482
    .max_cpus = 255,
1483
    .is_default = 1,
1484 1485
};

1486 1487 1488 1489 1490 1491
static QEMUMachine pc_machine_v0_10 = {
    .name = "pc-0.10",
    .desc = "Standard PC, qemu 0.10",
    .init = pc_init_pci,
    .max_cpus = 255,
    .compat_props = (CompatProperty[]) {
1492 1493 1494 1495
        {
            .driver   = "virtio-blk-pci",
            .property = "class",
            .value    = stringify(PCI_CLASS_STORAGE_OTHER),
1496 1497 1498 1499
        },{
            .driver   = "virtio-console-pci",
            .property = "class",
            .value    = stringify(PCI_CLASS_DISPLAY_OTHER),
1500 1501 1502 1503
        },{
            .driver   = "virtio-net-pci",
            .property = "vectors",
            .value    = stringify(0),
G
Gerd Hoffmann 已提交
1504 1505 1506 1507
        },{
            .driver   = "virtio-blk-pci",
            .property = "vectors",
            .value    = stringify(0),
1508
        },
1509 1510 1511 1512
        { /* end of list */ }
    },
};

1513
static QEMUMachine isapc_machine = {
A
aurel32 已提交
1514 1515 1516
    .name = "isapc",
    .desc = "ISA-only PC",
    .init = pc_init_isa,
1517
    .max_cpus = 1,
B
bellard 已提交
1518
};
1519 1520 1521 1522

static void pc_machine_init(void)
{
    qemu_register_machine(&pc_machine);
1523
    qemu_register_machine(&pc_machine_v0_10);
1524 1525 1526 1527
    qemu_register_machine(&isapc_machine);
}

machine_init(pc_machine_init);