mips_malta.c 31.2 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
/*
 * QEMU Malta board support
 *
 * Copyright (c) 2006 Aurelien Jarno
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */

P
pbrook 已提交
25 26
#include "hw.h"
#include "pc.h"
27
#include "fdc.h"
P
pbrook 已提交
28 29 30
#include "net.h"
#include "boards.h"
#include "smbus.h"
T
ths 已提交
31 32
#include "block.h"
#include "flash.h"
P
pbrook 已提交
33 34 35 36 37 38
#include "mips.h"
#include "pci.h"
#include "qemu-char.h"
#include "sysemu.h"
#include "audio/audio.h"
#include "boards.h"
B
blueswir1 已提交
39
#include "qemu-log.h"
40
#include "mips-bios.h"
G
Gerd Hoffmann 已提交
41
#include "ide.h"
42

T
ths 已提交
43 44
//#define DEBUG_BOARD_INIT

T
ths 已提交
45
#ifdef TARGET_MIPS64
T
ths 已提交
46
#define PHYS_TO_VIRT(x) ((x) | ~0x7fffffffULL)
47
#else
T
ths 已提交
48
#define PHYS_TO_VIRT(x) ((x) | ~0x7fffffffU)
49 50
#endif

T
ths 已提交
51 52
#define ENVP_ADDR (int32_t)0x80002000
#define VIRT_TO_PHYS_ADDEND (-((int64_t)(int32_t)0x80000000))
53 54 55 56

#define ENVP_NB_ENTRIES	 	16
#define ENVP_ENTRY_SIZE	 	256

T
ths 已提交
57 58
#define MAX_IDE_BUS 2

59 60 61 62
typedef struct {
    uint32_t leds;
    uint32_t brk;
    uint32_t gpout;
63
    uint32_t i2cin;
64 65 66 67 68
    uint32_t i2coe;
    uint32_t i2cout;
    uint32_t i2csel;
    CharDriverState *display;
    char display_text[9];
T
ths 已提交
69
    SerialState *uart;
70 71 72 73
} MaltaFPGAState;

static PITState *pit;

74 75 76 77 78 79 80
static struct _loaderparams {
    int ram_size;
    const char *kernel_filename;
    const char *kernel_cmdline;
    const char *initrd_filename;
} loaderparams;

81 82 83 84 85 86 87
/* Malta FPGA */
static void malta_fpga_update_display(void *opaque)
{
    char leds_text[9];
    int i;
    MaltaFPGAState *s = opaque;

T
ths 已提交
88 89 90 91 92
    for (i = 7 ; i >= 0 ; i--) {
        if (s->leds & (1 << i))
            leds_text[i] = '#';
        else
            leds_text[i] = ' ';
93
    }
T
ths 已提交
94 95 96 97
    leds_text[8] = '\0';

    qemu_chr_printf(s->display, "\e[H\n\n|\e[32m%-8.8s\e[00m|\r\n", leds_text);
    qemu_chr_printf(s->display, "\n\n\n\n|\e[31m%-8.8s\e[00m|", s->display_text);
98 99
}

100 101 102 103 104 105 106 107 108 109 110 111 112
/*
 * EEPROM 24C01 / 24C02 emulation.
 *
 * Emulation for serial EEPROMs:
 * 24C01 - 1024 bit (128 x 8)
 * 24C02 - 2048 bit (256 x 8)
 *
 * Typical device names include Microchip 24C02SC or SGS Thomson ST24C02.
 */

//~ #define DEBUG

#if defined(DEBUG)
113
#  define logout(fmt, ...) fprintf(stderr, "MALTA\t%-24s" fmt, __func__, ## __VA_ARGS__)
114
#else
115
#  define logout(fmt, ...) ((void)0)
116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152
#endif

struct _eeprom24c0x_t {
  uint8_t tick;
  uint8_t address;
  uint8_t command;
  uint8_t ack;
  uint8_t scl;
  uint8_t sda;
  uint8_t data;
  //~ uint16_t size;
  uint8_t contents[256];
};

typedef struct _eeprom24c0x_t eeprom24c0x_t;

static eeprom24c0x_t eeprom = {
    contents: {
        /* 00000000: */ 0x80,0x08,0x04,0x0D,0x0A,0x01,0x40,0x00,
        /* 00000008: */ 0x01,0x75,0x54,0x00,0x82,0x08,0x00,0x01,
        /* 00000010: */ 0x8F,0x04,0x02,0x01,0x01,0x00,0x0E,0x00,
        /* 00000018: */ 0x00,0x00,0x00,0x14,0x0F,0x14,0x2D,0x40,
        /* 00000020: */ 0x15,0x08,0x15,0x08,0x00,0x00,0x00,0x00,
        /* 00000028: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
        /* 00000030: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
        /* 00000038: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x12,0xD0,
        /* 00000040: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
        /* 00000048: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
        /* 00000050: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
        /* 00000058: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
        /* 00000060: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
        /* 00000068: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
        /* 00000070: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
        /* 00000078: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x64,0xF4,
    },
};

153
static uint8_t eeprom24c0x_read(void)
154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217
{
    logout("%u: scl = %u, sda = %u, data = 0x%02x\n",
        eeprom.tick, eeprom.scl, eeprom.sda, eeprom.data);
    return eeprom.sda;
}

static void eeprom24c0x_write(int scl, int sda)
{
    if (eeprom.scl && scl && (eeprom.sda != sda)) {
        logout("%u: scl = %u->%u, sda = %u->%u i2c %s\n",
                eeprom.tick, eeprom.scl, scl, eeprom.sda, sda, sda ? "stop" : "start");
        if (!sda) {
            eeprom.tick = 1;
            eeprom.command = 0;
        }
    } else if (eeprom.tick == 0 && !eeprom.ack) {
        /* Waiting for start. */
        logout("%u: scl = %u->%u, sda = %u->%u wait for i2c start\n",
                eeprom.tick, eeprom.scl, scl, eeprom.sda, sda);
    } else if (!eeprom.scl && scl) {
        logout("%u: scl = %u->%u, sda = %u->%u trigger bit\n",
                eeprom.tick, eeprom.scl, scl, eeprom.sda, sda);
        if (eeprom.ack) {
            logout("\ti2c ack bit = 0\n");
            sda = 0;
            eeprom.ack = 0;
        } else if (eeprom.sda == sda) {
            uint8_t bit = (sda != 0);
            logout("\ti2c bit = %d\n", bit);
            if (eeprom.tick < 9) {
                eeprom.command <<= 1;
                eeprom.command += bit;
                eeprom.tick++;
                if (eeprom.tick == 9) {
                    logout("\tcommand 0x%04x, %s\n", eeprom.command, bit ? "read" : "write");
                    eeprom.ack = 1;
                }
            } else if (eeprom.tick < 17) {
                if (eeprom.command & 1) {
                    sda = ((eeprom.data & 0x80) != 0);
                }
                eeprom.address <<= 1;
                eeprom.address += bit;
                eeprom.tick++;
                eeprom.data <<= 1;
                if (eeprom.tick == 17) {
                    eeprom.data = eeprom.contents[eeprom.address];
                    logout("\taddress 0x%04x, data 0x%02x\n", eeprom.address, eeprom.data);
                    eeprom.ack = 1;
                    eeprom.tick = 0;
                }
            } else if (eeprom.tick >= 17) {
                sda = 0;
            }
        } else {
            logout("\tsda changed with raising scl\n");
        }
    } else {
        logout("%u: scl = %u->%u, sda = %u->%u\n", eeprom.tick, eeprom.scl, scl, eeprom.sda, sda);
    }
    eeprom.scl = scl;
    eeprom.sda = sda;
}

218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256
static uint32_t malta_fpga_readl(void *opaque, target_phys_addr_t addr)
{
    MaltaFPGAState *s = opaque;
    uint32_t val = 0;
    uint32_t saddr;

    saddr = (addr & 0xfffff);

    switch (saddr) {

    /* SWITCH Register */
    case 0x00200:
        val = 0x00000000;		/* All switches closed */
	break;

    /* STATUS Register */
    case 0x00208:
#ifdef TARGET_WORDS_BIGENDIAN
        val = 0x00000012;
#else
        val = 0x00000010;
#endif
        break;

    /* JMPRS Register */
    case 0x00210:
        val = 0x00;
        break;

    /* LEDBAR Register */
    case 0x00408:
        val = s->leds;
        break;

    /* BRKRES Register */
    case 0x00508:
        val = s->brk;
        break;

T
ths 已提交
257
    /* UART Registers are handled directly by the serial device */
T
ths 已提交
258

259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276
    /* GPOUT Register */
    case 0x00a00:
        val = s->gpout;
        break;

    /* XXX: implement a real I2C controller */

    /* GPINP Register */
    case 0x00a08:
        /* IN = OUT until a real I2C control is implemented */
        if (s->i2csel)
            val = s->i2cout;
        else
            val = 0x00;
        break;

    /* I2CINP Register */
    case 0x00b00:
277
        val = ((s->i2cin & ~1) | eeprom24c0x_read());
278 279 280 281 282 283 284 285 286 287 288 289 290 291
        break;

    /* I2COE Register */
    case 0x00b08:
        val = s->i2coe;
        break;

    /* I2COUT Register */
    case 0x00b10:
        val = s->i2cout;
        break;

    /* I2CSEL Register */
    case 0x00b18:
292
        val = s->i2csel;
293 294 295 296
        break;

    default:
#if 0
T
ths 已提交
297
        printf ("malta_fpga_read: Bad register offset 0x" TARGET_FMT_lx "\n",
T
ths 已提交
298
		addr);
299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358
#endif
        break;
    }
    return val;
}

static void malta_fpga_writel(void *opaque, target_phys_addr_t addr,
                              uint32_t val)
{
    MaltaFPGAState *s = opaque;
    uint32_t saddr;

    saddr = (addr & 0xfffff);

    switch (saddr) {

    /* SWITCH Register */
    case 0x00200:
        break;

    /* JMPRS Register */
    case 0x00210:
        break;

    /* LEDBAR Register */
    /* XXX: implement a 8-LED array */
    case 0x00408:
        s->leds = val & 0xff;
        break;

    /* ASCIIWORD Register */
    case 0x00410:
        snprintf(s->display_text, 9, "%08X", val);
        malta_fpga_update_display(s);
        break;

    /* ASCIIPOS0 to ASCIIPOS7 Registers */
    case 0x00418:
    case 0x00420:
    case 0x00428:
    case 0x00430:
    case 0x00438:
    case 0x00440:
    case 0x00448:
    case 0x00450:
        s->display_text[(saddr - 0x00418) >> 3] = (char) val;
        malta_fpga_update_display(s);
        break;

    /* SOFTRES Register */
    case 0x00500:
        if (val == 0x42)
            qemu_system_reset_request ();
        break;

    /* BRKRES Register */
    case 0x00508:
        s->brk = val & 0xff;
        break;

T
ths 已提交
359
    /* UART Registers are handled directly by the serial device */
T
ths 已提交
360

361 362 363 364 365 366 367 368 369 370 371 372
    /* GPOUT Register */
    case 0x00a00:
        s->gpout = val & 0xff;
        break;

    /* I2COE Register */
    case 0x00b08:
        s->i2coe = val & 0x03;
        break;

    /* I2COUT Register */
    case 0x00b10:
373 374
        eeprom24c0x_write(val & 0x02, val & 0x01);
        s->i2cout = val;
375 376 377 378
        break;

    /* I2CSEL Register */
    case 0x00b18:
379
        s->i2csel = val & 0x01;
380 381 382 383
        break;

    default:
#if 0
T
ths 已提交
384
        printf ("malta_fpga_write: Bad register offset 0x" TARGET_FMT_lx "\n",
T
ths 已提交
385
		addr);
386 387 388 389 390
#endif
        break;
    }
}

391
static CPUReadMemoryFunc * const malta_fpga_read[] = {
392 393 394 395 396
   malta_fpga_readl,
   malta_fpga_readl,
   malta_fpga_readl
};

397
static CPUWriteMemoryFunc * const malta_fpga_write[] = {
398 399 400 401 402
   malta_fpga_writel,
   malta_fpga_writel,
   malta_fpga_writel
};

403
static void malta_fpga_reset(void *opaque)
404 405 406 407 408 409
{
    MaltaFPGAState *s = opaque;

    s->leds   = 0x00;
    s->brk    = 0x0a;
    s->gpout  = 0x00;
410
    s->i2cin  = 0x3;
411 412 413 414 415 416
    s->i2coe  = 0x0;
    s->i2cout = 0x3;
    s->i2csel = 0x1;

    s->display_text[8] = '\0';
    snprintf(s->display_text, 9, "        ");
417 418 419 420 421 422 423 424 425 426 427 428 429
}

static void malta_fpga_led_init(CharDriverState *chr)
{
    qemu_chr_printf(chr, "\e[HMalta LEDBAR\r\n");
    qemu_chr_printf(chr, "+--------+\r\n");
    qemu_chr_printf(chr, "+        +\r\n");
    qemu_chr_printf(chr, "+--------+\r\n");
    qemu_chr_printf(chr, "\n");
    qemu_chr_printf(chr, "Malta ASCII\r\n");
    qemu_chr_printf(chr, "+--------+\r\n");
    qemu_chr_printf(chr, "+        +\r\n");
    qemu_chr_printf(chr, "+--------+\r\n");
430 431
}

432
static MaltaFPGAState *malta_fpga_init(target_phys_addr_t base, qemu_irq uart_irq, CharDriverState *uart_chr)
433 434 435 436 437 438
{
    MaltaFPGAState *s;
    int malta;

    s = (MaltaFPGAState *)qemu_mallocz(sizeof(MaltaFPGAState));

439
    malta = cpu_register_io_memory(malta_fpga_read,
440
                                   malta_fpga_write, s);
T
ths 已提交
441

T
ths 已提交
442
    cpu_register_physical_memory(base, 0x900, malta);
443
    /* 0xa00 is less than a page, so will still get the right offsets.  */
T
ths 已提交
444
    cpu_register_physical_memory(base + 0xa00, 0x100000 - 0xa00, malta);
445

446 447
    s->display = qemu_chr_open("fpga", "vc:320x200", malta_fpga_led_init);

448
    s->uart = serial_mm_init(base + 0x900, 3, uart_irq, 230400, uart_chr, 1);
T
ths 已提交
449

450
    malta_fpga_reset(s);
451
    qemu_register_reset(malta_fpga_reset, s);
452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467

    return s;
}

/* Audio support */
#ifdef HAS_AUDIO
static void audio_init (PCIBus *pci_bus)
{
    struct soundhw *c;
    int audio_enabled = 0;

    for (c = soundhw; !audio_enabled && c->name; ++c) {
        audio_enabled = c->enabled;
    }

    if (audio_enabled) {
P
Paul Brook 已提交
468 469
        for (c = soundhw; c->name; ++c) {
            if (c->enabled) {
P
Paul Brook 已提交
470
                c->init.init_pci(pci_bus);
471 472 473 474 475 476 477
            }
        }
    }
}
#endif

/* Network support */
478
static void network_init(void)
479 480 481 482
{
    int i;

    for(i = 0; i < nb_nics; i++) {
483
        NICInfo *nd = &nd_table[i];
484
        const char *default_devaddr = NULL;
485 486

        if (i == 0 && (!nd->model || strcmp(nd->model, "pcnet") == 0))
487
            /* The malta board has a PCNet card using PCI SLOT 11 */
488
            default_devaddr = "0b";
489

490
        pci_nic_init(nd, "pcnet", default_devaddr);
491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515
    }
}

/* ROM and pseudo bootloader

   The following code implements a very very simple bootloader. It first
   loads the registers a0 to a3 to the values expected by the OS, and
   then jump at the kernel address.

   The bootloader should pass the locations of the kernel arguments and
   environment variables tables. Those tables contain the 32-bit address
   of NULL terminated strings. The environment variables table should be
   terminated by a NULL address.

   For a simpler implementation, the number of kernel arguments is fixed
   to two (the name of the kernel and the command line), and the two
   tables are actually the same one.

   The registers a0 to a3 should contain the following values:
     a0 - number of kernel arguments
     a1 - 32-bit address of the kernel arguments table
     a2 - 32-bit address of the environment variables table
     a3 - RAM size in bytes
*/

P
pbrook 已提交
516 517
static void write_bootloader (CPUState *env, uint8_t *base,
                              int64_t kernel_entry)
518 519 520 521
{
    uint32_t *p;

    /* Small bootloader */
P
pbrook 已提交
522
    p = (uint32_t *)base;
523
    stl_raw(p++, 0x0bf00160);                                      /* j 0x1fc00580 */
524
    stl_raw(p++, 0x00000000);                                      /* nop */
525

526
    /* YAMON service vector */
P
pbrook 已提交
527 528 529 530 531 532 533 534 535 536 537 538 539
    stl_raw(base + 0x500, 0xbfc00580);      /* start: */
    stl_raw(base + 0x504, 0xbfc0083c);      /* print_count: */
    stl_raw(base + 0x520, 0xbfc00580);      /* start: */
    stl_raw(base + 0x52c, 0xbfc00800);      /* flush_cache: */
    stl_raw(base + 0x534, 0xbfc00808);      /* print: */
    stl_raw(base + 0x538, 0xbfc00800);      /* reg_cpu_isr: */
    stl_raw(base + 0x53c, 0xbfc00800);      /* unred_cpu_isr: */
    stl_raw(base + 0x540, 0xbfc00800);      /* reg_ic_isr: */
    stl_raw(base + 0x544, 0xbfc00800);      /* unred_ic_isr: */
    stl_raw(base + 0x548, 0xbfc00800);      /* reg_esr: */
    stl_raw(base + 0x54c, 0xbfc00800);      /* unreg_esr: */
    stl_raw(base + 0x550, 0xbfc00800);      /* getchar: */
    stl_raw(base + 0x554, 0xbfc00800);      /* syscon_read: */
540 541


542
    /* Second part of the bootloader */
P
pbrook 已提交
543
    p = (uint32_t *) (base + 0x580);
544 545
    stl_raw(p++, 0x24040002);                                      /* addiu a0, zero, 2 */
    stl_raw(p++, 0x3c1d0000 | (((ENVP_ADDR - 64) >> 16) & 0xffff)); /* lui sp, high(ENVP_ADDR) */
T
ths 已提交
546
    stl_raw(p++, 0x37bd0000 | ((ENVP_ADDR - 64) & 0xffff));        /* ori sp, sp, low(ENVP_ADDR) */
547
    stl_raw(p++, 0x3c050000 | ((ENVP_ADDR >> 16) & 0xffff));       /* lui a1, high(ENVP_ADDR) */
T
ths 已提交
548
    stl_raw(p++, 0x34a50000 | (ENVP_ADDR & 0xffff));               /* ori a1, a1, low(ENVP_ADDR) */
549 550
    stl_raw(p++, 0x3c060000 | (((ENVP_ADDR + 8) >> 16) & 0xffff)); /* lui a2, high(ENVP_ADDR + 8) */
    stl_raw(p++, 0x34c60000 | ((ENVP_ADDR + 8) & 0xffff));         /* ori a2, a2, low(ENVP_ADDR + 8) */
551 552
    stl_raw(p++, 0x3c070000 | (loaderparams.ram_size >> 16));     /* lui a3, high(ram_size) */
    stl_raw(p++, 0x34e70000 | (loaderparams.ram_size & 0xffff));  /* ori a3, a3, low(ram_size) */
553 554

    /* Load BAR registers as done by YAMON */
T
ths 已提交
555 556 557 558 559 560 561 562 563
    stl_raw(p++, 0x3c09b400);                                      /* lui t1, 0xb400 */

#ifdef TARGET_WORDS_BIGENDIAN
    stl_raw(p++, 0x3c08df00);                                      /* lui t0, 0xdf00 */
#else
    stl_raw(p++, 0x340800df);                                      /* ori t0, r0, 0x00df */
#endif
    stl_raw(p++, 0xad280068);                                      /* sw t0, 0x0068(t1) */

564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605
    stl_raw(p++, 0x3c09bbe0);                                      /* lui t1, 0xbbe0 */

#ifdef TARGET_WORDS_BIGENDIAN
    stl_raw(p++, 0x3c08c000);                                      /* lui t0, 0xc000 */
#else
    stl_raw(p++, 0x340800c0);                                      /* ori t0, r0, 0x00c0 */
#endif
    stl_raw(p++, 0xad280048);                                      /* sw t0, 0x0048(t1) */
#ifdef TARGET_WORDS_BIGENDIAN
    stl_raw(p++, 0x3c084000);                                      /* lui t0, 0x4000 */
#else
    stl_raw(p++, 0x34080040);                                      /* ori t0, r0, 0x0040 */
#endif
    stl_raw(p++, 0xad280050);                                      /* sw t0, 0x0050(t1) */

#ifdef TARGET_WORDS_BIGENDIAN
    stl_raw(p++, 0x3c088000);                                      /* lui t0, 0x8000 */
#else
    stl_raw(p++, 0x34080080);                                      /* ori t0, r0, 0x0080 */
#endif
    stl_raw(p++, 0xad280058);                                      /* sw t0, 0x0058(t1) */
#ifdef TARGET_WORDS_BIGENDIAN
    stl_raw(p++, 0x3c083f00);                                      /* lui t0, 0x3f00 */
#else
    stl_raw(p++, 0x3408003f);                                      /* ori t0, r0, 0x003f */
#endif
    stl_raw(p++, 0xad280060);                                      /* sw t0, 0x0060(t1) */

#ifdef TARGET_WORDS_BIGENDIAN
    stl_raw(p++, 0x3c08c100);                                      /* lui t0, 0xc100 */
#else
    stl_raw(p++, 0x340800c1);                                      /* ori t0, r0, 0x00c1 */
#endif
    stl_raw(p++, 0xad280080);                                      /* sw t0, 0x0080(t1) */
#ifdef TARGET_WORDS_BIGENDIAN
    stl_raw(p++, 0x3c085e00);                                      /* lui t0, 0x5e00 */
#else
    stl_raw(p++, 0x3408005e);                                      /* ori t0, r0, 0x005e */
#endif
    stl_raw(p++, 0xad280088);                                      /* sw t0, 0x0088(t1) */

    /* Jump to kernel code */
T
ths 已提交
606 607
    stl_raw(p++, 0x3c1f0000 | ((kernel_entry >> 16) & 0xffff));    /* lui ra, high(kernel_entry) */
    stl_raw(p++, 0x37ff0000 | (kernel_entry & 0xffff));            /* ori ra, ra, low(kernel_entry) */
608 609
    stl_raw(p++, 0x03e00008);                                      /* jr ra */
    stl_raw(p++, 0x00000000);                                      /* nop */
610 611

    /* YAMON subroutines */
P
pbrook 已提交
612
    p = (uint32_t *) (base + 0x800);
613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653
    stl_raw(p++, 0x03e00008);                                     /* jr ra */
    stl_raw(p++, 0x24020000);                                     /* li v0,0 */
   /* 808 YAMON print */
    stl_raw(p++, 0x03e06821);                                     /* move t5,ra */
    stl_raw(p++, 0x00805821);                                     /* move t3,a0 */
    stl_raw(p++, 0x00a05021);                                     /* move t2,a1 */
    stl_raw(p++, 0x91440000);                                     /* lbu a0,0(t2) */
    stl_raw(p++, 0x254a0001);                                     /* addiu t2,t2,1 */
    stl_raw(p++, 0x10800005);                                     /* beqz a0,834 */
    stl_raw(p++, 0x00000000);                                     /* nop */
    stl_raw(p++, 0x0ff0021c);                                     /* jal 870 */
    stl_raw(p++, 0x00000000);                                     /* nop */
    stl_raw(p++, 0x08000205);                                     /* j 814 */
    stl_raw(p++, 0x00000000);                                     /* nop */
    stl_raw(p++, 0x01a00008);                                     /* jr t5 */
    stl_raw(p++, 0x01602021);                                     /* move a0,t3 */
    /* 0x83c YAMON print_count */
    stl_raw(p++, 0x03e06821);                                     /* move t5,ra */
    stl_raw(p++, 0x00805821);                                     /* move t3,a0 */
    stl_raw(p++, 0x00a05021);                                     /* move t2,a1 */
    stl_raw(p++, 0x00c06021);                                     /* move t4,a2 */
    stl_raw(p++, 0x91440000);                                     /* lbu a0,0(t2) */
    stl_raw(p++, 0x0ff0021c);                                     /* jal 870 */
    stl_raw(p++, 0x00000000);                                     /* nop */
    stl_raw(p++, 0x254a0001);                                     /* addiu t2,t2,1 */
    stl_raw(p++, 0x258cffff);                                     /* addiu t4,t4,-1 */
    stl_raw(p++, 0x1580fffa);                                     /* bnez t4,84c */
    stl_raw(p++, 0x00000000);                                     /* nop */
    stl_raw(p++, 0x01a00008);                                     /* jr t5 */
    stl_raw(p++, 0x01602021);                                     /* move a0,t3 */
    /* 0x870 */
    stl_raw(p++, 0x3c08b800);                                     /* lui t0,0xb400 */
    stl_raw(p++, 0x350803f8);                                     /* ori t0,t0,0x3f8 */
    stl_raw(p++, 0x91090005);                                     /* lbu t1,5(t0) */
    stl_raw(p++, 0x00000000);                                     /* nop */
    stl_raw(p++, 0x31290040);                                     /* andi t1,t1,0x40 */
    stl_raw(p++, 0x1120fffc);                                     /* beqz t1,878 <outch+0x8> */
    stl_raw(p++, 0x00000000);                                     /* nop */
    stl_raw(p++, 0x03e00008);                                     /* jr ra */
    stl_raw(p++, 0xa1040000);                                     /* sb a0,0(t0) */

654 655 656 657
}

static void prom_set(int index, const char *string, ...)
{
P
pbrook 已提交
658 659
    char buf[ENVP_ENTRY_SIZE];
    target_phys_addr_t p;
660
    va_list ap;
661
    int32_t table_addr;
662 663 664 665

    if (index >= ENVP_NB_ENTRIES)
        return;

P
pbrook 已提交
666
    p = ENVP_ADDR + VIRT_TO_PHYS_ADDEND + index * 4;
667 668

    if (string == NULL) {
P
pbrook 已提交
669
        stl_phys(p, 0);
670 671 672
        return;
    }

P
pbrook 已提交
673
    table_addr = ENVP_ADDR + sizeof(int32_t) * ENVP_NB_ENTRIES
A
aurel32 已提交
674 675
                 + index * ENVP_ENTRY_SIZE;
    stl_phys(p, table_addr);
676 677

    va_start(ap, string);
P
pbrook 已提交
678
    vsnprintf(buf, ENVP_ENTRY_SIZE, string, ap);
679
    va_end(ap);
A
aurel32 已提交
680
    pstrcpy_targphys(table_addr + VIRT_TO_PHYS_ADDEND, ENVP_ENTRY_SIZE, buf);
681 682 683 684 685
}

/* Kernel */
static int64_t load_kernel (CPUState *env)
{
T
ths 已提交
686
    int64_t kernel_entry, kernel_low, kernel_high;
687 688
    int index = 0;
    long initrd_size;
T
ths 已提交
689
    ram_addr_t initrd_offset;
690

691
    if (load_elf(loaderparams.kernel_filename, VIRT_TO_PHYS_ADDEND,
692 693
                 (uint64_t *)&kernel_entry, (uint64_t *)&kernel_low,
                 (uint64_t *)&kernel_high) < 0) {
694
        fprintf(stderr, "qemu: could not load kernel '%s'\n",
695
                loaderparams.kernel_filename);
T
ths 已提交
696
        exit(1);
697 698 699 700
    }

    /* load initrd */
    initrd_size = 0;
T
ths 已提交
701
    initrd_offset = 0;
702 703
    if (loaderparams.initrd_filename) {
        initrd_size = get_image_size (loaderparams.initrd_filename);
T
ths 已提交
704 705
        if (initrd_size > 0) {
            initrd_offset = (kernel_high + ~TARGET_PAGE_MASK) & TARGET_PAGE_MASK;
706
            if (initrd_offset + initrd_size > ram_size) {
T
ths 已提交
707 708
                fprintf(stderr,
                        "qemu: memory too small for initial ram disk '%s'\n",
709
                        loaderparams.initrd_filename);
T
ths 已提交
710 711
                exit(1);
            }
712 713 714
            initrd_size = load_image_targphys(loaderparams.initrd_filename,
                                              initrd_offset,
                                              ram_size - initrd_offset);
T
ths 已提交
715
        }
716 717
        if (initrd_size == (target_ulong) -1) {
            fprintf(stderr, "qemu: could not load initial ram disk '%s'\n",
718
                    loaderparams.initrd_filename);
719 720 721 722 723
            exit(1);
        }
    }

    /* Store command line.  */
724
    prom_set(index++, loaderparams.kernel_filename);
725
    if (initrd_size > 0)
T
ths 已提交
726 727
        prom_set(index++, "rd_start=0x" TARGET_FMT_lx " rd_size=%li %s",
                 PHYS_TO_VIRT(initrd_offset), initrd_size,
728
                 loaderparams.kernel_cmdline);
729
    else
730
        prom_set(index++, loaderparams.kernel_cmdline);
731 732 733

    /* Setup minimum environment variables */
    prom_set(index++, "memsize");
734
    prom_set(index++, "%i", loaderparams.ram_size);
735 736 737 738
    prom_set(index++, "modetty0");
    prom_set(index++, "38400n8r");
    prom_set(index++, NULL);

T
ths 已提交
739
    return kernel_entry;
740 741 742 743 744 745 746 747 748 749
}

static void main_cpu_reset(void *opaque)
{
    CPUState *env = opaque;
    cpu_reset(env);

    /* The bootload does not need to be rewritten as it is located in a
       read only location. The kernel location and the arguments table
       location does not change. */
750
    if (loaderparams.kernel_filename) {
T
ths 已提交
751
        env->CP0_Status &= ~((1 << CP0St_BEV) | (1 << CP0St_ERL));
752
        load_kernel (env);
T
ths 已提交
753
    }
754 755
}

756
static
P
Paul Brook 已提交
757
void mips_malta_init (ram_addr_t ram_size,
758
                      const char *boot_device,
759
                      const char *kernel_filename, const char *kernel_cmdline,
760
                      const char *initrd_filename, const char *cpu_model)
761
{
P
Paul Brook 已提交
762
    char *filename;
763 764
    ram_addr_t ram_offset;
    ram_addr_t bios_offset;
T
ths 已提交
765
    target_long bios_size;
T
ths 已提交
766
    int64_t kernel_entry;
767 768 769
    PCIBus *pci_bus;
    CPUState *env;
    RTCState *rtc_state;
770
    fdctrl_t *floppy_controller;
771
    MaltaFPGAState *malta_fpga;
P
pbrook 已提交
772
    qemu_irq *i8259;
T
ths 已提交
773 774 775 776
    int piix4_devfn;
    uint8_t *eeprom_buf;
    i2c_bus *smbus;
    int i;
G
Gerd Hoffmann 已提交
777
    DriveInfo *dinfo;
778
    DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
T
ths 已提交
779
    BlockDriverState *fd[MAX_FD];
T
ths 已提交
780 781
    int fl_idx = 0;
    int fl_sectors = 0;
782

783 784
    /* init CPUs */
    if (cpu_model == NULL) {
T
ths 已提交
785
#ifdef TARGET_MIPS64
786
        cpu_model = "20Kc";
787
#else
788
        cpu_model = "24Kf";
789 790
#endif
    }
B
bellard 已提交
791 792 793 794 795
    env = cpu_init(cpu_model);
    if (!env) {
        fprintf(stderr, "Unable to find CPU definition\n");
        exit(1);
    }
796
    qemu_register_reset(main_cpu_reset, env);
797 798

    /* allocate RAM */
799 800 801 802 803 804
    if (ram_size > (256 << 20)) {
        fprintf(stderr,
                "qemu: Too much memory for this machine: %d MB, maximum 256 MB\n",
                ((unsigned int)ram_size / (1 << 20)));
        exit(1);
    }
805 806 807 808 809
    ram_offset = qemu_ram_alloc(ram_size);
    bios_offset = qemu_ram_alloc(BIOS_SIZE);


    cpu_register_physical_memory(0, ram_size, ram_offset | IO_MEM_RAM);
810

T
ths 已提交
811
    /* Map the bios at two physical locations, as on the real board. */
812 813 814 815 816
    cpu_register_physical_memory(0x1e000000LL,
                                 BIOS_SIZE, bios_offset | IO_MEM_ROM);
    cpu_register_physical_memory(0x1fc00000LL,
                                 BIOS_SIZE, bios_offset | IO_MEM_ROM);

817
    /* FPGA */
818
    malta_fpga = malta_fpga_init(0x1f000000LL, env->irq[2], serial_hds[2]);
819

T
ths 已提交
820 821 822 823 824 825 826 827 828
    /* Load firmware in flash / BIOS unless we boot directly into a kernel. */
    if (kernel_filename) {
        /* Write a small bootloader to the flash location. */
        loaderparams.ram_size = ram_size;
        loaderparams.kernel_filename = kernel_filename;
        loaderparams.kernel_cmdline = kernel_cmdline;
        loaderparams.initrd_filename = initrd_filename;
        kernel_entry = load_kernel(env);
        env->CP0_Status &= ~((1 << CP0St_BEV) | (1 << CP0St_ERL));
P
pbrook 已提交
829
        write_bootloader(env, qemu_get_ram_ptr(bios_offset), kernel_entry);
T
ths 已提交
830
    } else {
G
Gerd Hoffmann 已提交
831 832
        dinfo = drive_get(IF_PFLASH, 0, fl_idx);
        if (dinfo) {
T
ths 已提交
833 834 835 836 837 838 839
            /* Load firmware from flash. */
            bios_size = 0x400000;
            fl_sectors = bios_size >> 16;
#ifdef DEBUG_BOARD_INIT
            printf("Register parallel flash %d size " TARGET_FMT_lx " at "
                   "offset %08lx addr %08llx '%s' %x\n",
                   fl_idx, bios_size, bios_offset, 0x1e000000LL,
G
Gerd Hoffmann 已提交
840
                   bdrv_get_device_name(dinfo->bdrv), fl_sectors);
T
ths 已提交
841 842
#endif
            pflash_cfi01_register(0x1e000000LL, bios_offset,
G
Gerd Hoffmann 已提交
843
                                  dinfo->bdrv, 65536, fl_sectors,
T
ths 已提交
844 845 846 847 848 849
                                  4, 0x0000, 0x0000, 0x0000, 0x0000);
            fl_idx++;
        } else {
            /* Load a BIOS image. */
            if (bios_name == NULL)
                bios_name = BIOS_FILENAME;
P
Paul Brook 已提交
850 851 852 853 854 855 856 857
            filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
            if (filename) {
                bios_size = load_image_targphys(filename, 0x1fc00000LL,
                                                BIOS_SIZE);
                qemu_free(filename);
            } else {
                bios_size = -1;
            }
T
ths 已提交
858 859 860
            if ((bios_size < 0 || bios_size > BIOS_SIZE) && !kernel_filename) {
                fprintf(stderr,
                        "qemu: Could not load MIPS bios '%s', and no -kernel argument was specified\n",
P
Paul Brook 已提交
861
                        bios_name);
T
ths 已提交
862 863
                exit(1);
            }
864
        }
T
ths 已提交
865 866 867 868
        /* In little endian mode the 32bit words in the bios are swapped,
           a neat trick which allows bi-endian firmware. */
#ifndef TARGET_WORDS_BIGENDIAN
        {
P
pbrook 已提交
869 870 871 872
            uint32_t *addr = qemu_get_ram_ptr(bios_offset);;
            uint32_t *end = addr + bios_size;
            while (addr < end) {
                bswap32s(addr);
T
ths 已提交
873 874 875
            }
        }
#endif
876 877
    }

878 879 880
    /* Board ID = 0x420 (Malta Board with CoreLV)
       XXX: theoretically 0x1e000010 should map to flash and 0x1fc00010 should
       map to the board ID. */
P
pbrook 已提交
881
    stl_phys(0x1fc00010LL, 0x00000420);
882 883

    /* Init internal devices */
P
pbrook 已提交
884
    cpu_mips_irq_init_cpu(env);
885 886 887
    cpu_mips_clock_init(env);

    /* Interrupt controller */
P
pbrook 已提交
888 889
    /* The 8259 is attached to the MIPS CPU INT0 pin, ie interrupt 2 */
    i8259 = i8259_init(env->irq[2]);
890 891

    /* Northbridge */
P
pbrook 已提交
892
    pci_bus = pci_gt64120_init(i8259);
893 894

    /* Southbridge */
T
ths 已提交
895 896 897 898 899 900 901

    if (drive_get_max_bus(IF_IDE) >= MAX_IDE_BUS) {
        fprintf(stderr, "qemu: too many IDE bus\n");
        exit(1);
    }

    for(i = 0; i < MAX_IDE_BUS * MAX_IDE_DEVS; i++) {
902
        hd[i] = drive_get(IF_IDE, i / MAX_IDE_DEVS, i % MAX_IDE_DEVS);
T
ths 已提交
903 904
    }

T
ths 已提交
905
    piix4_devfn = piix4_init(pci_bus, 80);
T
ths 已提交
906
    pci_piix4_ide_init(pci_bus, hd, piix4_devfn + 1, i8259);
T
ths 已提交
907
    usb_uhci_piix4_init(pci_bus, piix4_devfn + 2);
A
aurel32 已提交
908
    smbus = piix4_pm_init(pci_bus, piix4_devfn + 3, 0x1100, i8259[9]);
T
ths 已提交
909 910 911
    eeprom_buf = qemu_mallocz(8 * 256); /* XXX: make this persistent */
    for (i = 0; i < 8; i++) {
        /* TODO: Populate SPD eeprom data.  */
P
Paul Brook 已提交
912
        DeviceState *eeprom;
P
Paul Brook 已提交
913
        eeprom = qdev_create((BusState *)smbus, "smbus-eeprom");
G
Gerd Hoffmann 已提交
914 915
        qdev_prop_set_uint32(eeprom, "address", 0x50 + i);
        qdev_prop_set_ptr(eeprom, "data", eeprom_buf + (i * 256));
P
Paul Brook 已提交
916
        qdev_init(eeprom);
T
ths 已提交
917
    }
P
pbrook 已提交
918
    pit = pit_init(0x40, i8259[0]);
919 920 921
    DMA_init(0);

    /* Super I/O */
P
pbrook 已提交
922
    i8042_init(i8259[1], i8259[12], 0x60);
923
    rtc_state = rtc_init(0x70, i8259[8], 2000);
924 925
    serial_init(0x3f8, i8259[4], 115200, serial_hds[0]);
    serial_init(0x2f8, i8259[3], 115200, serial_hds[1]);
926
    if (parallel_hds[0])
P
pbrook 已提交
927
        parallel_init(0x378, i8259[7], parallel_hds[0]);
T
ths 已提交
928
    for(i = 0; i < MAX_FD; i++) {
G
Gerd Hoffmann 已提交
929 930
        dinfo = drive_get(IF_FLOPPY, 0, i);
        fd[i] = dinfo ? dinfo->bdrv : NULL;
T
ths 已提交
931
    }
G
Gerd Hoffmann 已提交
932
    floppy_controller = fdctrl_init_isa(6, 2, 0x3f0, fd);
933 934 935 936 937 938 939

    /* Sound card */
#ifdef HAS_AUDIO
    audio_init(pci_bus);
#endif

    /* Network card */
940
    network_init();
T
ths 已提交
941 942

    /* Optional PCI video card */
A
aurel32 已提交
943
    if (cirrus_vga_enabled) {
P
Paul Brook 已提交
944
        pci_cirrus_vga_init(pci_bus);
A
aurel32 已提交
945
    } else if (vmsvga_enabled) {
P
Paul Brook 已提交
946
        pci_vmsvga_init(pci_bus);
A
aurel32 已提交
947
    } else if (std_vga_enabled) {
P
Paul Brook 已提交
948
        pci_vga_init(pci_bus, 0, 0);
A
aurel32 已提交
949
    }
950 951
}

952
static QEMUMachine mips_malta_machine = {
953 954 955
    .name = "malta",
    .desc = "MIPS Malta Core LV",
    .init = mips_malta_init,
956
    .is_default = 1,
957
};
958 959 960 961 962 963 964

static void mips_malta_machine_init(void)
{
    qemu_register_machine(&mips_malta_machine);
}

machine_init(mips_malta_machine_init);