Add qemu 2.4.0

Change-Id: Ic99cbad4b61f8b127b7dc74d04576c0bcbaaf4f5
Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>

16 files changed, 1837 insertions, 0 deletions

diff --git a/qemu/roms/u-boot/arch/x86/lib/Makefile b/qemu/roms/u-boot/arch/x86/lib/Makefile
new file mode 100644
index 000000000..f7303abcc
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/Makefile
@@ -0,0 +1,28 @@
+#
+# (C) Copyright 2002-2006
+# Wolfgang Denk, DENX Software Engineering, wd@denx.de.
+#
+# SPDX-License-Identifier:	GPL-2.0+
+#
+
+obj-$(CONFIG_CMD_BOOTM) += bootm.o
+obj-y	+= cmd_boot.o
+obj-y	+= gcc.o
+obj-y	+= init_helpers.o
+obj-y	+= interrupts.o
+obj-$(CONFIG_SYS_PCAT_INTERRUPTS) += pcat_interrupts.o
+obj-$(CONFIG_SYS_PCAT_TIMER) += pcat_timer.o
+obj-$(CONFIG_PCI) += pci_type1.o
+obj-y	+= relocate.o
+obj-y += physmem.o
+obj-y	+= string.o
+obj-$(CONFIG_SYS_X86_TSC_TIMER)	+= tsc_timer.o
+obj-$(CONFIG_VIDEO_VGA)	+= video.o
+obj-$(CONFIG_CMD_ZBOOT)	+= zimage.o
+
+LIBGCC := $(notdir $(NORMAL_LIBGCC))
+extra-y := $(LIBGCC)
+
+OBJCOPYFLAGS := --prefix-symbols=__normal_
+$(obj)/$(LIBGCC): $(NORMAL_LIBGCC) FORCE
+	$(call if_changed,objcopy)
diff --git a/qemu/roms/u-boot/arch/x86/lib/asm-offsets.c b/qemu/roms/u-boot/arch/x86/lib/asm-offsets.c
new file mode 100644
index 000000000..d65c6ab1b
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/asm-offsets.c
@@ -0,0 +1,22 @@
+/*
+ * Adapted from Linux v2.6.36 kernel: arch/powerpc/kernel/asm-offsets.c
+ *
+ * This program is used to generate definitions needed by
+ * assembly language modules.
+ *
+ * We use the technique used in the OSF Mach kernel code:
+ * generate asm statements containing #defines,
+ * compile this file to assembler, and then extract the
+ * #defines from the assembly-language output.
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <linux/kbuild.h>
+
+int main(void)
+{
+	DEFINE(GENERATED_GD_RELOC_OFF, offsetof(gd_t, reloc_off));
+	return 0;
+}
diff --git a/qemu/roms/u-boot/arch/x86/lib/bootm.c b/qemu/roms/u-boot/arch/x86/lib/bootm.c
new file mode 100644
index 000000000..ff158dd6a
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/bootm.c
@@ -0,0 +1,89 @@
+/*
+ * (C) Copyright 2002
+ * Sysgo Real-Time Solutions, GmbH <www.elinos.com>
+ * Marius Groeger <mgroeger@sysgo.de>
+ *
+ * Copyright (C) 2001  Erik Mouw (J.A.K.Mouw@its.tudelft.nl)
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <command.h>
+#include <image.h>
+#include <u-boot/zlib.h>
+#include <asm/bootparam.h>
+#include <asm/byteorder.h>
+#include <asm/zimage.h>
+
+#define COMMAND_LINE_OFFSET 0x9000
+
+/*cmd_boot.c*/
+int do_bootm_linux(int flag, int argc, char * const argv[],
+		bootm_headers_t *images)
+{
+	struct boot_params *base_ptr = NULL;
+	ulong os_data, os_len;
+	image_header_t *hdr;
+	void *load_address;
+
+#if defined(CONFIG_FIT)
+	const void	*data;
+	size_t		len;
+#endif
+
+	if (flag & BOOTM_STATE_OS_PREP)
+		return 0;
+	if ((flag != 0) && (flag != BOOTM_STATE_OS_GO))
+		return 1;
+
+	if (images->legacy_hdr_valid) {
+		hdr = images->legacy_hdr_os;
+		if (image_check_type(hdr, IH_TYPE_MULTI)) {
+			/* if multi-part image, we need to get first subimage */
+			image_multi_getimg(hdr, 0, &os_data, &os_len);
+		} else {
+			/* otherwise get image data */
+			os_data = image_get_data(hdr);
+			os_len = image_get_data_size(hdr);
+		}
+#if defined(CONFIG_FIT)
+	} else if (images->fit_uname_os) {
+		int ret;
+
+		ret = fit_image_get_data(images->fit_hdr_os,
+					images->fit_noffset_os, &data, &len);
+		if (ret) {
+			puts("Can't get image data/size!\n");
+			goto error;
+		}
+		os_data = (ulong)data;
+		os_len = (ulong)len;
+#endif
+	} else {
+		puts("Could not find kernel image!\n");
+		goto error;
+	}
+
+#ifdef CONFIG_CMD_ZBOOT
+	base_ptr = load_zimage((void *)os_data, os_len, &load_address);
+#endif
+
+	if (NULL == base_ptr) {
+		printf("## Kernel loading failed ...\n");
+		goto error;
+	}
+
+	if (setup_zimage(base_ptr, (char *)base_ptr + COMMAND_LINE_OFFSET,
+			0, images->rd_start,
+			images->rd_end - images->rd_start)) {
+		printf("## Setting up boot parameters failed ...\n");
+		goto error;
+	}
+
+	boot_zimage(base_ptr, load_address);
+	/* does not return */
+
+error:
+	return 1;
+}
diff --git a/qemu/roms/u-boot/arch/x86/lib/cmd_boot.c b/qemu/roms/u-boot/arch/x86/lib/cmd_boot.c
new file mode 100644
index 000000000..a24d3f013
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/cmd_boot.c
@@ -0,0 +1,50 @@
+/*
+ * (C) Copyright 2008-2011
+ * Graeme Russ, <graeme.russ@gmail.com>
+ *
+ * (C) Copyright 2002
+ * Daniel Engström, Omicron Ceti AB, <daniel@omicron.se>
+ *
+ * (C) Copyright 2002
+ * Wolfgang Denk, DENX Software Engineering, <wd@denx.de>
+ *
+ * (C) Copyright 2002
+ * Sysgo Real-Time Solutions, GmbH <www.elinos.com>
+ * Marius Groeger <mgroeger@sysgo.de>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <command.h>
+#include <malloc.h>
+#include <asm/u-boot-x86.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+unsigned long do_go_exec(ulong (*entry)(int, char * const []),
+			 int argc, char * const argv[])
+{
+	unsigned long ret = 0;
+	char **argv_tmp;
+
+	/*
+	 * x86 does not use a dedicated register to pass the pointer to
+	 * the global_data, so it is instead passed as argv[-1]. By using
+	 * argv[-1], the called 'Application' can use the contents of
+	 * argv natively. However, to safely use argv[-1] a new copy of
+	 * argv is needed with the extra element
+	 */
+	argv_tmp = malloc(sizeof(char *) * (argc + 1));
+
+	if (argv_tmp) {
+		argv_tmp[0] = (char *)gd;
+
+		memcpy(&argv_tmp[1], argv, (size_t)(sizeof(char *) * argc));
+
+		ret = (entry) (argc, &argv_tmp[1]);
+		free(argv_tmp);
+	}
+
+	return ret;
+}
diff --git a/qemu/roms/u-boot/arch/x86/lib/gcc.c b/qemu/roms/u-boot/arch/x86/lib/gcc.c
new file mode 100644
index 000000000..497ad75b7
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/gcc.c
@@ -0,0 +1,40 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright (C) 2009 coresystems GmbH
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 or later of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA, 02110-1301 USA
+ */
+
+#ifdef __GNUC__
+
+/*
+ * GCC's libgcc handling is quite broken. While the libgcc functions
+ * are always regparm(0) the code that calls them uses whatever the
+ * compiler call specifies. Therefore we need a wrapper around those
+ * functions. See gcc bug PR41055 for more information.
+ */
+#define WRAP_LIBGCC_CALL(type, name) \
+	type __normal_##name(type a, type b) __attribute__((regparm(0))); \
+	type __wrap_##name(type a, type b); \
+	type __attribute__((no_instrument_function)) \
+		__wrap_##name(type a, type b) \
+		 { return __normal_##name(a, b); }
+
+WRAP_LIBGCC_CALL(long long, __divdi3)
+WRAP_LIBGCC_CALL(unsigned long long, __udivdi3)
+WRAP_LIBGCC_CALL(long long, __moddi3)
+WRAP_LIBGCC_CALL(unsigned long long, __umoddi3)
+
+#endif
diff --git a/qemu/roms/u-boot/arch/x86/lib/init_helpers.c b/qemu/roms/u-boot/arch/x86/lib/init_helpers.c
new file mode 100644
index 000000000..b5d937feb
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/init_helpers.c
@@ -0,0 +1,116 @@
+/*
+ * (C) Copyright 2011
+ * Graeme Russ, <graeme.russ@gmail.com>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+#include <common.h>
+#include <fdtdec.h>
+#include <spi.h>
+#include <asm/sections.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+/* Get the top of usable RAM */
+__weak ulong board_get_usable_ram_top(ulong total_size)
+{
+	return gd->ram_size;
+}
+
+int calculate_relocation_address(void)
+{
+	const ulong uboot_size = (uintptr_t)&__bss_end -
+			(uintptr_t)&__text_start;
+	ulong total_size;
+	ulong dest_addr;
+	ulong fdt_size = 0;
+
+#if defined(CONFIG_OF_SEPARATE) && defined(CONFIG_OF_CONTROL)
+	if (gd->fdt_blob)
+		fdt_size = ALIGN(fdt_totalsize(gd->fdt_blob) + 0x1000, 32);
+#endif
+	total_size = ALIGN(uboot_size, 1 << 12) + CONFIG_SYS_MALLOC_LEN +
+		CONFIG_SYS_STACK_SIZE + fdt_size;
+
+	dest_addr = board_get_usable_ram_top(total_size);
+	/*
+	 * NOTE: All destination address are rounded down to 16-byte
+	 *       boundary to satisfy various worst-case alignment
+	 *       requirements
+	 */
+	dest_addr &= ~15;
+
+#if defined(CONFIG_OF_SEPARATE) && defined(CONFIG_OF_CONTROL)
+	/*
+	 * If the device tree is sitting immediate above our image then we
+	 * must relocate it. If it is embedded in the data section, then it
+	 * will be relocated with other data.
+	 */
+	if (gd->fdt_blob) {
+		dest_addr -= fdt_size;
+		gd->new_fdt = (void *)dest_addr;
+		dest_addr &= ~15;
+	}
+#endif
+	/* U-Boot is below the FDT */
+	dest_addr -= uboot_size;
+	dest_addr &= ~((1 << 12) - 1);
+	gd->relocaddr = dest_addr;
+	gd->reloc_off = dest_addr - (uintptr_t)&__text_start;
+
+	/* Stack is at the bottom, so it can grow down */
+	gd->start_addr_sp = dest_addr - CONFIG_SYS_MALLOC_LEN;
+
+	return 0;
+}
+
+int init_cache_f_r(void)
+{
+	/* Initialise the CPU cache(s) */
+	return init_cache();
+}
+
+bd_t bd_data;
+
+int init_bd_struct_r(void)
+{
+	gd->bd = &bd_data;
+	memset(gd->bd, 0, sizeof(bd_t));
+
+	return 0;
+}
+
+int init_func_spi(void)
+{
+	puts("SPI:   ");
+	spi_init();
+	puts("ready\n");
+	return 0;
+}
+
+int find_fdt(void)
+{
+#ifdef CONFIG_OF_EMBED
+	/* Get a pointer to the FDT */
+	gd->fdt_blob = __dtb_dt_begin;
+#elif defined CONFIG_OF_SEPARATE
+	/* FDT is at end of image */
+	gd->fdt_blob = (ulong *)&_end;
+#endif
+	/* Allow the early environment to override the fdt address */
+	gd->fdt_blob = (void *)getenv_ulong("fdtcontroladdr", 16,
+						(uintptr_t)gd->fdt_blob);
+
+	return 0;
+}
+
+int prepare_fdt(void)
+{
+	/* For now, put this check after the console is ready */
+	if (fdtdec_prepare_fdt()) {
+		panic("** CONFIG_OF_CONTROL defined but no FDT - please see "
+			"doc/README.fdt-control");
+	}
+
+	return 0;
+}
diff --git a/qemu/roms/u-boot/arch/x86/lib/interrupts.c b/qemu/roms/u-boot/arch/x86/lib/interrupts.c
new file mode 100644
index 000000000..6bb22d25e
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/interrupts.c
@@ -0,0 +1,145 @@
+/*
+ * (C) Copyright 2009
+ * Graeme Russ, <graeme.russ@gmail.com>
+ *
+ * (C) Copyright 2007
+ * Daniel Hellstrom, Gaisler Research, <daniel@gaisler.com>
+ *
+ * (C) Copyright 2006
+ * Detlev Zundel, DENX Software Engineering, <dzu@denx.de>
+ *
+ * (C) Copyright -2003
+ * Wolfgang Denk, DENX Software Engineering, <wd@denx.de>
+ *
+ * (C) Copyright 2002
+ * Daniel Engström, Omicron Ceti AB, <daniel@omicron.se>
+ *
+ * (C) Copyright 2001
+ * Josh Huber, Mission Critical Linux, Inc, <huber@mclx.com>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+/*
+ * This file contains the high-level API for the interrupt sub-system
+ * of the x86 port of U-Boot. Most of the functionality has been
+ * shamelessly stolen from the leon2 / leon3 ports of U-Boot.
+ * Daniel Hellstrom, Detlev Zundel, Wolfgang Denk and Josh Huber are
+ * credited for the corresponding work on those ports. The original
+ * interrupt handling routines for the x86 port were written by
+ * Daniel Engström
+ */
+
+#include <common.h>
+#include <asm/interrupt.h>
+
+struct irq_action {
+	interrupt_handler_t *handler;
+	void *arg;
+	unsigned int count;
+};
+
+static struct irq_action irq_handlers[CONFIG_SYS_NUM_IRQS] = { {0} };
+static int spurious_irq_cnt;
+static int spurious_irq;
+
+void irq_install_handler(int irq, interrupt_handler_t *handler, void *arg)
+{
+	int status;
+
+	if (irq < 0 || irq >= CONFIG_SYS_NUM_IRQS) {
+		printf("irq_install_handler: bad irq number %d\n", irq);
+		return;
+	}
+
+	if (irq_handlers[irq].handler != NULL)
+		printf("irq_install_handler: 0x%08lx replacing 0x%08lx\n",
+				(ulong) handler,
+				(ulong) irq_handlers[irq].handler);
+
+	status = disable_interrupts();
+
+	irq_handlers[irq].handler = handler;
+	irq_handlers[irq].arg = arg;
+	irq_handlers[irq].count = 0;
+
+	unmask_irq(irq);
+
+	if (status)
+		enable_interrupts();
+
+	return;
+}
+
+void irq_free_handler(int irq)
+{
+	int status;
+
+	if (irq < 0 || irq >= CONFIG_SYS_NUM_IRQS) {
+		printf("irq_free_handler: bad irq number %d\n", irq);
+		return;
+	}
+
+	status = disable_interrupts();
+
+	mask_irq(irq);
+
+	irq_handlers[irq].handler = NULL;
+	irq_handlers[irq].arg = NULL;
+
+	if (status)
+		enable_interrupts();
+
+	return;
+}
+
+void do_irq(int hw_irq)
+{
+	int irq = hw_irq - 0x20;
+
+	if (irq < 0 || irq >= CONFIG_SYS_NUM_IRQS) {
+		printf("do_irq: bad irq number %d\n", irq);
+		return;
+	}
+
+	if (irq_handlers[irq].handler) {
+		mask_irq(irq);
+
+		irq_handlers[irq].handler(irq_handlers[irq].arg);
+		irq_handlers[irq].count++;
+
+		unmask_irq(irq);
+		specific_eoi(irq);
+
+	} else {
+		if ((irq & 7) != 7) {
+			spurious_irq_cnt++;
+			spurious_irq = irq;
+		}
+	}
+}
+
+#if defined(CONFIG_CMD_IRQ)
+int do_irqinfo(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+	int irq;
+
+	printf("Spurious IRQ: %u, last unknown IRQ: %d\n",
+			spurious_irq_cnt, spurious_irq);
+
+	printf("Interrupt-Information:\n");
+	printf("Nr  Routine   Arg       Count\n");
+
+	for (irq = 0; irq <= CONFIG_SYS_NUM_IRQS; irq++) {
+		if (irq_handlers[irq].handler != NULL) {
+			printf("%02d  %08lx  %08lx  %d\n",
+					irq,
+					(ulong)irq_handlers[irq].handler,
+					(ulong)irq_handlers[irq].arg,
+					irq_handlers[irq].count);
+		}
+	}
+
+	return 0;
+}
+#endif
diff --git a/qemu/roms/u-boot/arch/x86/lib/pcat_interrupts.c b/qemu/roms/u-boot/arch/x86/lib/pcat_interrupts.c
new file mode 100644
index 000000000..4c86f7fc6
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/pcat_interrupts.c
@@ -0,0 +1,116 @@
+/*
+ * (C) Copyright 2009
+ * Graeme Russ, <graeme.russ@gmail.com>
+ *
+ * (C) Copyright 2002
+ * Daniel Engström, Omicron Ceti AB, <daniel@omicron.se>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+/*
+ * This file provides the interrupt handling functionality for systems
+ * based on the standard PC/AT architecture using two cascaded i8259
+ * Programmable Interrupt Controllers.
+ */
+
+#include <common.h>
+#include <asm/io.h>
+#include <asm/i8259.h>
+#include <asm/ibmpc.h>
+#include <asm/interrupt.h>
+
+#if CONFIG_SYS_NUM_IRQS != 16
+#error "CONFIG_SYS_NUM_IRQS must equal 16 if CONFIG_SYS_NUM_IRQS is defined"
+#endif
+
+int interrupt_init(void)
+{
+	u8 i;
+
+	disable_interrupts();
+
+	/* Mask all interrupts */
+	outb(0xff, MASTER_PIC + IMR);
+	outb(0xff, SLAVE_PIC + IMR);
+
+	/* Master PIC */
+	/* Place master PIC interrupts at INT20 */
+	/* ICW3, One slave PIC is present */
+	outb(ICW1_SEL|ICW1_EICW4, MASTER_PIC + ICW1);
+	outb(0x20, MASTER_PIC + ICW2);
+	outb(IR2, MASTER_PIC + ICW3);
+	outb(ICW4_PM, MASTER_PIC + ICW4);
+
+	for (i = 0; i < 8; i++)
+		outb(OCW2_SEOI | i, MASTER_PIC + OCW2);
+
+	/* Slave PIC */
+	/* Place slave PIC interrupts at INT28 */
+	/* Slave ID */
+	outb(ICW1_SEL|ICW1_EICW4, SLAVE_PIC + ICW1);
+	outb(0x28, SLAVE_PIC + ICW2);
+	outb(0x02, SLAVE_PIC + ICW3);
+	outb(ICW4_PM, SLAVE_PIC + ICW4);
+
+	for (i = 0; i < 8; i++)
+		outb(OCW2_SEOI | i, SLAVE_PIC + OCW2);
+
+	/*
+	 * Enable cascaded interrupts by unmasking the cascade IRQ pin of
+	 * the master PIC
+	 */
+	unmask_irq(2);
+
+	enable_interrupts();
+
+	return 0;
+}
+
+void mask_irq(int irq)
+{
+	int imr_port;
+
+	if (irq >= CONFIG_SYS_NUM_IRQS)
+		return;
+
+	if (irq > 7)
+		imr_port = SLAVE_PIC + IMR;
+	else
+		imr_port = MASTER_PIC + IMR;
+
+	outb(inb(imr_port) | (1 << (irq & 7)), imr_port);
+}
+
+void unmask_irq(int irq)
+{
+	int imr_port;
+
+	if (irq >= CONFIG_SYS_NUM_IRQS)
+		return;
+
+	if (irq > 7)
+		imr_port = SLAVE_PIC + IMR;
+	else
+		imr_port = MASTER_PIC + IMR;
+
+	outb(inb(imr_port) & ~(1 << (irq & 7)), imr_port);
+}
+
+void specific_eoi(int irq)
+{
+	if (irq >= CONFIG_SYS_NUM_IRQS)
+		return;
+
+	if (irq > 7) {
+		/*
+		 *  IRQ is on the slave - Issue a corresponding EOI to the
+		 *  slave PIC and an EOI for IRQ2 (the cascade interrupt)
+		 *  on the master PIC
+		 */
+		outb(OCW2_SEOI | (irq & 7), SLAVE_PIC + OCW2);
+		irq = SEOI_IR2;
+	}
+
+	outb(OCW2_SEOI | irq, MASTER_PIC + OCW2);
+}
diff --git a/qemu/roms/u-boot/arch/x86/lib/pcat_timer.c b/qemu/roms/u-boot/arch/x86/lib/pcat_timer.c
new file mode 100644
index 000000000..3545a5048
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/pcat_timer.c
@@ -0,0 +1,27 @@
+/*
+ * (C) Copyright 2002
+ * Daniel Engström, Omicron Ceti AB, <daniel@omicron.se>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <asm/io.h>
+#include <asm/i8254.h>
+
+#define TIMER2_VALUE 0x0a8e /* 440Hz */
+
+int pcat_timer_init(void)
+{
+	/*
+	 * initialize 2, used to drive the speaker
+	 * (to start a beep: write 3 to port 0x61,
+	 * to stop it again: write 0)
+	 */
+	outb(PIT_CMD_CTR2 | PIT_CMD_BOTH | PIT_CMD_MODE3,
+			PIT_BASE + PIT_COMMAND);
+	outb(TIMER2_VALUE & 0xff, PIT_BASE + PIT_T2);
+	outb(TIMER2_VALUE >> 8, PIT_BASE + PIT_T2);
+
+	return 0;
+}
diff --git a/qemu/roms/u-boot/arch/x86/lib/pci_type1.c b/qemu/roms/u-boot/arch/x86/lib/pci_type1.c
new file mode 100644
index 000000000..13942a33f
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/pci_type1.c
@@ -0,0 +1,53 @@
+/*
+ * (C) Copyright 2002
+ * Daniel Engström, Omicron Ceti AB, <daniel@omicron.se>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+/*
+ * Support for type PCI configuration cycles.
+ * based on pci_indirect.c
+ */
+#include <common.h>
+#include <asm/io.h>
+#include <pci.h>
+
+#define cfg_read(val, addr, op)		(*val = op((int)(addr)))
+#define cfg_write(val, addr, op)	op((val), (int)(addr))
+
+#define TYPE1_PCI_OP(rw, size, type, op, mask)				\
+static int								\
+type1_##rw##_config_##size(struct pci_controller *hose,			\
+			      pci_dev_t dev, int offset, type val)	\
+{									\
+	outl(dev | (offset & 0xfc) | 0x80000000, (int)hose->cfg_addr);	\
+	cfg_##rw(val, hose->cfg_data + (offset & mask), op);		\
+	return 0;							\
+}
+
+TYPE1_PCI_OP(read, byte, u8 *, inb, 3)
+TYPE1_PCI_OP(read, word, u16 *, inw, 2)
+TYPE1_PCI_OP(read, dword, u32 *, inl, 0)
+
+TYPE1_PCI_OP(write, byte, u8, outb, 3)
+TYPE1_PCI_OP(write, word, u16, outw, 2)
+TYPE1_PCI_OP(write, dword, u32, outl, 0)
+
+/* bus mapping constants (used for PCI core initialization) */
+#define PCI_REG_ADDR		0x00000cf8
+#define PCI_REG_DATA		0x00000cfc
+
+void pci_setup_type1(struct pci_controller *hose)
+{
+	pci_set_ops(hose,
+		    type1_read_config_byte,
+		    type1_read_config_word,
+		    type1_read_config_dword,
+		    type1_write_config_byte,
+		    type1_write_config_word,
+		    type1_write_config_dword);
+
+	hose->cfg_addr = (unsigned int *)PCI_REG_ADDR;
+	hose->cfg_data = (unsigned char *)PCI_REG_DATA;
+}
diff --git a/qemu/roms/u-boot/arch/x86/lib/physmem.c b/qemu/roms/u-boot/arch/x86/lib/physmem.c
new file mode 100644
index 000000000..59b3fe977
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/physmem.c
@@ -0,0 +1,230 @@
+/*
+ * Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ */
+
+#include <common.h>
+#include <physmem.h>
+#include <linux/compiler.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+/* Large pages are 2MB. */
+#define LARGE_PAGE_SIZE ((1 << 20) * 2)
+
+/*
+ * Paging data structures.
+ */
+
+struct pdpe {
+	uint64_t p:1;
+	uint64_t mbz_0:2;
+	uint64_t pwt:1;
+	uint64_t pcd:1;
+	uint64_t mbz_1:4;
+	uint64_t avl:3;
+	uint64_t base:40;
+	uint64_t mbz_2:12;
+};
+
+typedef struct pdpe pdpt_t[512];
+
+struct pde {
+	uint64_t p:1;      /* present */
+	uint64_t rw:1;     /* read/write */
+	uint64_t us:1;     /* user/supervisor */
+	uint64_t pwt:1;    /* page-level writethrough */
+	uint64_t pcd:1;    /* page-level cache disable */
+	uint64_t a:1;      /* accessed */
+	uint64_t d:1;      /* dirty */
+	uint64_t ps:1;     /* page size */
+	uint64_t g:1;      /* global page */
+	uint64_t avl:3;    /* available to software */
+	uint64_t pat:1;    /* page-attribute table */
+	uint64_t mbz_0:8;  /* must be zero */
+	uint64_t base:31;  /* base address */
+};
+
+typedef struct pde pdt_t[512];
+
+static pdpt_t pdpt __aligned(4096);
+static pdt_t pdts[4] __aligned(4096);
+
+/*
+ * Map a virtual address to a physical address and optionally invalidate any
+ * old mapping.
+ *
+ * @param virt		The virtual address to use.
+ * @param phys		The physical address to use.
+ * @param invlpg	Whether to use invlpg to clear any old mappings.
+ */
+static void x86_phys_map_page(uintptr_t virt, phys_addr_t phys, int invlpg)
+{
+	/* Extract the two bit PDPT index and the 9 bit PDT index. */
+	uintptr_t pdpt_idx = (virt >> 30) & 0x3;
+	uintptr_t pdt_idx = (virt >> 21) & 0x1ff;
+
+	/* Set up a handy pointer to the appropriate PDE. */
+	struct pde *pde = &(pdts[pdpt_idx][pdt_idx]);
+
+	memset(pde, 0, sizeof(struct pde));
+	pde->p = 1;
+	pde->rw = 1;
+	pde->us = 1;
+	pde->ps = 1;
+	pde->base = phys >> 21;
+
+	if (invlpg) {
+		/* Flush any stale mapping out of the TLBs. */
+		__asm__ __volatile__(
+			"invlpg %0\n\t"
+			:
+			: "m" (*(uint8_t *)virt)
+		);
+	}
+}
+
+/* Identity map the lower 4GB and turn on paging with PAE. */
+static void x86_phys_enter_paging(void)
+{
+	phys_addr_t page_addr;
+	unsigned i;
+
+	/* Zero out the page tables. */
+	memset(pdpt, 0, sizeof(pdpt));
+	memset(pdts, 0, sizeof(pdts));
+
+	/* Set up the PDPT. */
+	for (i = 0; i < ARRAY_SIZE(pdts); i++) {
+		pdpt[i].p = 1;
+		pdpt[i].base = ((uintptr_t)&pdts[i]) >> 12;
+	}
+
+	/* Identity map everything up to 4GB. */
+	for (page_addr = 0; page_addr < (1ULL << 32);
+			page_addr += LARGE_PAGE_SIZE) {
+		/* There's no reason to invalidate the TLB with paging off. */
+		x86_phys_map_page(page_addr, page_addr, 0);
+	}
+
+	/* Turn on paging */
+	__asm__ __volatile__(
+		/* Load the page table address */
+		"movl	%0, %%cr3\n\t"
+		/* Enable pae */
+		"movl	%%cr4, %%eax\n\t"
+		"orl	$0x00000020, %%eax\n\t"
+		"movl	%%eax, %%cr4\n\t"
+		/* Enable paging */
+		"movl	%%cr0, %%eax\n\t"
+		"orl	$0x80000000, %%eax\n\t"
+		"movl	%%eax, %%cr0\n\t"
+		:
+		: "r" (pdpt)
+		: "eax"
+	);
+}
+
+/* Disable paging and PAE mode. */
+static void x86_phys_exit_paging(void)
+{
+	/* Turn off paging */
+	__asm__ __volatile__ (
+		/* Disable paging */
+		"movl	%%cr0, %%eax\n\t"
+		"andl	$0x7fffffff, %%eax\n\t"
+		"movl	%%eax, %%cr0\n\t"
+		/* Disable pae */
+		"movl	%%cr4, %%eax\n\t"
+		"andl	$0xffffffdf, %%eax\n\t"
+		"movl	%%eax, %%cr4\n\t"
+		:
+		:
+		: "eax"
+	);
+}
+
+/*
+ * Set physical memory to a particular value when the whole region fits on one
+ * page.
+ *
+ * @param map_addr	The address that starts the physical page.
+ * @param offset	How far into that page to start setting a value.
+ * @param c		The value to set memory to.
+ * @param size		The size in bytes of the area to set.
+ */
+static void x86_phys_memset_page(phys_addr_t map_addr, uintptr_t offset, int c,
+				 unsigned size)
+{
+	/*
+	 * U-Boot should be far away from the beginning of memory, so that's a
+	 * good place to map our window on top of.
+	 */
+	const uintptr_t window = LARGE_PAGE_SIZE;
+
+	/* Make sure the window is below U-Boot. */
+	assert(window + LARGE_PAGE_SIZE <
+	       gd->relocaddr - CONFIG_SYS_MALLOC_LEN - CONFIG_SYS_STACK_SIZE);
+	/* Map the page into the window and then memset the appropriate part. */
+	x86_phys_map_page(window, map_addr, 1);
+	memset((void *)(window + offset), c, size);
+}
+
+/*
+ * A physical memory anologue to memset with matching parameters and return
+ * value.
+ */
+phys_addr_t arch_phys_memset(phys_addr_t start, int c, phys_size_t size)
+{
+	const phys_addr_t max_addr = (phys_addr_t)~(uintptr_t)0;
+	const phys_addr_t orig_start = start;
+
+	if (!size)
+		return orig_start;
+
+	/* Handle memory below 4GB. */
+	if (start <= max_addr) {
+		phys_size_t low_size = MIN(max_addr + 1 - start, size);
+		void *start_ptr = (void *)(uintptr_t)start;
+
+		assert(((phys_addr_t)(uintptr_t)start) == start);
+		memset(start_ptr, c, low_size);
+		start += low_size;
+		size -= low_size;
+	}
+
+	/* Use paging and PAE to handle memory above 4GB up to 64GB. */
+	if (size) {
+		phys_addr_t map_addr = start & ~(LARGE_PAGE_SIZE - 1);
+		phys_addr_t offset = start - map_addr;
+
+		x86_phys_enter_paging();
+
+		/* Handle the first partial page. */
+		if (offset) {
+			phys_addr_t end =
+				MIN(map_addr + LARGE_PAGE_SIZE, start + size);
+			phys_size_t cur_size = end - start;
+			x86_phys_memset_page(map_addr, offset, c, cur_size);
+			size -= cur_size;
+			map_addr += LARGE_PAGE_SIZE;
+		}
+		/* Handle the complete pages. */
+		while (size > LARGE_PAGE_SIZE) {
+			x86_phys_memset_page(map_addr, 0, c, LARGE_PAGE_SIZE);
+			size -= LARGE_PAGE_SIZE;
+			map_addr += LARGE_PAGE_SIZE;
+		}
+		/* Handle the last partial page. */
+		if (size)
+			x86_phys_memset_page(map_addr, 0, c, size);
+
+		x86_phys_exit_paging();
+	}
+	return orig_start;
+}
diff --git a/qemu/roms/u-boot/arch/x86/lib/relocate.c b/qemu/roms/u-boot/arch/x86/lib/relocate.c
new file mode 100644
index 000000000..526daaf93
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/relocate.c
@@ -0,0 +1,111 @@
+/*
+ * (C) Copyright 2008-2011
+ * Graeme Russ, <graeme.russ@gmail.com>
+ *
+ * (C) Copyright 2002
+ * Daniel Engström, Omicron Ceti AB, <daniel@omicron.se>
+ *
+ * (C) Copyright 2002
+ * Wolfgang Denk, DENX Software Engineering, <wd@denx.de>
+ *
+ * (C) Copyright 2002
+ * Sysgo Real-Time Solutions, GmbH <www.elinos.com>
+ * Marius Groeger <mgroeger@sysgo.de>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <libfdt.h>
+#include <malloc.h>
+#include <asm/u-boot-x86.h>
+#include <asm/relocate.h>
+#include <asm/sections.h>
+#include <elf.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+int copy_uboot_to_ram(void)
+{
+	size_t len = (size_t)&__data_end - (size_t)&__text_start;
+
+	memcpy((void *)gd->relocaddr, (void *)&__text_start, len);
+
+	return 0;
+}
+
+int copy_fdt_to_ram(void)
+{
+	if (gd->new_fdt) {
+		ulong fdt_size;
+
+		fdt_size = ALIGN(fdt_totalsize(gd->fdt_blob) + 0x1000, 32);
+
+		memcpy(gd->new_fdt, gd->fdt_blob, fdt_size);
+		debug("Relocated fdt from %p to %p, size %lx\n",
+		       gd->fdt_blob, gd->new_fdt, fdt_size);
+		gd->fdt_blob = gd->new_fdt;
+	}
+
+	return 0;
+}
+
+int clear_bss(void)
+{
+	ulong dst_addr = (ulong)&__bss_start + gd->reloc_off;
+	size_t len = (size_t)&__bss_end - (size_t)&__bss_start;
+
+	memset((void *)dst_addr, 0x00, len);
+
+	return 0;
+}
+
+/*
+ * This function has more error checking than you might expect. Please see
+ * the commit message for more informaiton.
+ */
+int do_elf_reloc_fixups(void)
+{
+	Elf32_Rel *re_src = (Elf32_Rel *)(&__rel_dyn_start);
+	Elf32_Rel *re_end = (Elf32_Rel *)(&__rel_dyn_end);
+
+	Elf32_Addr *offset_ptr_rom, *last_offset = NULL;
+	Elf32_Addr *offset_ptr_ram;
+
+	/* The size of the region of u-boot that runs out of RAM. */
+	uintptr_t size = (uintptr_t)&__bss_end - (uintptr_t)&__text_start;
+
+	do {
+		/* Get the location from the relocation entry */
+		offset_ptr_rom = (Elf32_Addr *)re_src->r_offset;
+
+		/* Check that the location of the relocation is in .text */
+		if (offset_ptr_rom >= (Elf32_Addr *)CONFIG_SYS_TEXT_BASE &&
+				offset_ptr_rom > last_offset) {
+
+			/* Switch to the in-RAM version */
+			offset_ptr_ram = (Elf32_Addr *)((ulong)offset_ptr_rom +
+							gd->reloc_off);
+
+			/* Check that the target points into .text */
+			if (*offset_ptr_ram >= CONFIG_SYS_TEXT_BASE &&
+					*offset_ptr_ram <=
+					(CONFIG_SYS_TEXT_BASE + size)) {
+				*offset_ptr_ram += gd->reloc_off;
+			} else {
+				debug("   %p: rom reloc %x, ram %p, value %x,"
+					" limit %lx\n", re_src,
+					re_src->r_offset, offset_ptr_ram,
+					*offset_ptr_ram,
+					CONFIG_SYS_TEXT_BASE + size);
+			}
+		} else {
+			debug("   %p: rom reloc %x, last %p\n", re_src,
+			       re_src->r_offset, last_offset);
+		}
+		last_offset = offset_ptr_rom;
+
+	} while (++re_src < re_end);
+
+	return 0;
+}
diff --git a/qemu/roms/u-boot/arch/x86/lib/string.c b/qemu/roms/u-boot/arch/x86/lib/string.c
new file mode 100644
index 000000000..a1656ccfe
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/string.c
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 1991,1992,1993,1997,1998,2003, 2005 Free Software Foundation, Inc.
+ * This file is part of the GNU C Library.
+ * Copyright (c) 2011 The Chromium OS Authors.
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+/* From glibc-2.14, sysdeps/i386/memset.c */
+
+#include <compiler.h>
+#include <asm/string.h>
+#include <linux/types.h>
+
+typedef uint32_t op_t;
+
+void *memset(void *dstpp, int c, size_t len)
+{
+	int d0;
+	unsigned long int dstp = (unsigned long int) dstpp;
+
+	/* This explicit register allocation improves code very much indeed. */
+	register op_t x asm("ax");
+
+	x = (unsigned char) c;
+
+	/* Clear the direction flag, so filling will move forward.  */
+	asm volatile("cld");
+
+	/* This threshold value is optimal.  */
+	if (len >= 12) {
+		/* Fill X with four copies of the char we want to fill with. */
+		x |= (x << 8);
+		x |= (x << 16);
+
+		/* Adjust LEN for the bytes handled in the first loop.  */
+		len -= (-dstp) % sizeof(op_t);
+
+		/*
+		 * There are at least some bytes to set. No need to test for
+		 * LEN == 0 in this alignment loop.
+		 */
+
+		/* Fill bytes until DSTP is aligned on a longword boundary. */
+		asm volatile(
+			"rep\n"
+			"stosb" /* %0, %2, %3 */ :
+			"=D" (dstp), "=c" (d0) :
+			"0" (dstp), "1" ((-dstp) % sizeof(op_t)), "a" (x) :
+			"memory");
+
+		/* Fill longwords.  */
+		asm volatile(
+			"rep\n"
+			"stosl" /* %0, %2, %3 */ :
+			"=D" (dstp), "=c" (d0) :
+			"0" (dstp), "1" (len / sizeof(op_t)), "a" (x) :
+			"memory");
+		len %= sizeof(op_t);
+	}
+
+	/* Write the last few bytes. */
+	asm volatile(
+		"rep\n"
+		"stosb" /* %0, %2, %3 */ :
+		"=D" (dstp), "=c" (d0) :
+		"0" (dstp), "1" (len), "a" (x) :
+		"memory");
+
+	return dstpp;
+}
+
+#define	OP_T_THRES	8
+#define OPSIZ	(sizeof(op_t))
+
+#define BYTE_COPY_FWD(dst_bp, src_bp, nbytes)				  \
+do {									  \
+	int __d0;							  \
+	asm volatile(							  \
+		/* Clear the direction flag, so copying goes forward.  */ \
+		"cld\n"							  \
+		/* Copy bytes.  */					  \
+		"rep\n"							  \
+		"movsb" :						  \
+		"=D" (dst_bp), "=S" (src_bp), "=c" (__d0) :		  \
+		"0" (dst_bp), "1" (src_bp), "2" (nbytes) :		  \
+		"memory");						  \
+} while (0)
+
+#define WORD_COPY_FWD(dst_bp, src_bp, nbytes_left, nbytes)		  \
+do {									  \
+	int __d0;							  \
+	asm volatile(							  \
+		/* Clear the direction flag, so copying goes forward.  */ \
+		"cld\n"							  \
+		/* Copy longwords.  */					  \
+		"rep\n"							  \
+		"movsl" :						  \
+		"=D" (dst_bp), "=S" (src_bp), "=c" (__d0) :		  \
+		"0" (dst_bp), "1" (src_bp), "2" ((nbytes) / 4) :	  \
+		"memory");						  \
+	(nbytes_left) = (nbytes) % 4;					  \
+} while (0)
+
+void *memcpy(void *dstpp, const void *srcpp, size_t len)
+{
+	unsigned long int dstp = (long int)dstpp;
+	unsigned long int srcp = (long int)srcpp;
+
+	/* Copy from the beginning to the end.  */
+
+	/* If there not too few bytes to copy, use word copy.  */
+	if (len >= OP_T_THRES) {
+		/* Copy just a few bytes to make DSTP aligned.  */
+		len -= (-dstp) % OPSIZ;
+		BYTE_COPY_FWD(dstp, srcp, (-dstp) % OPSIZ);
+
+		/* Copy from SRCP to DSTP taking advantage of the known
+		 * alignment of DSTP.  Number of bytes remaining is put
+		 * in the third argument, i.e. in LEN.  This number may
+		 * vary from machine to machine.
+		 */
+		WORD_COPY_FWD(dstp, srcp, len, len);
+
+		/* Fall out and copy the tail.  */
+	}
+
+	/* There are just a few bytes to copy. Use byte memory operations. */
+	BYTE_COPY_FWD(dstp, srcp, len);
+
+	return dstpp;
+}
diff --git a/qemu/roms/u-boot/arch/x86/lib/tsc_timer.c b/qemu/roms/u-boot/arch/x86/lib/tsc_timer.c
new file mode 100644
index 000000000..8b38702ef
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/tsc_timer.c
@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2012 The Chromium OS Authors.
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <malloc.h>
+#include <asm/io.h>
+#include <asm/i8254.h>
+#include <asm/ibmpc.h>
+#include <asm/msr.h>
+#include <asm/u-boot-x86.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+void timer_set_base(u64 base)
+{
+	gd->arch.tsc_base = base;
+}
+
+/*
+ * Get the number of CPU time counter ticks since it was read first time after
+ * restart. This yields a free running counter guaranteed to take almost 6
+ * years to wrap around even at 100GHz clock rate.
+ */
+u64 __attribute__((no_instrument_function)) get_ticks(void)
+{
+	u64 now_tick = rdtsc();
+
+	/* We assume that 0 means the base hasn't been set yet */
+	if (!gd->arch.tsc_base)
+		panic("No tick base available");
+	return now_tick - gd->arch.tsc_base;
+}
+
+#define PLATFORM_INFO_MSR 0xce
+
+/* Get the speed of the TSC timer in MHz */
+unsigned __attribute__((no_instrument_function)) long get_tbclk_mhz(void)
+{
+	u32 ratio;
+	u64 platform_info = native_read_msr(PLATFORM_INFO_MSR);
+
+	/* 100MHz times Max Non Turbo ratio */
+	ratio = (platform_info >> 8) & 0xff;
+	return 100 * ratio;
+}
+
+unsigned long get_tbclk(void)
+{
+	return get_tbclk_mhz() * 1000 * 1000;
+}
+
+static ulong get_ms_timer(void)
+{
+	return (get_ticks() * 1000) / get_tbclk();
+}
+
+ulong get_timer(ulong base)
+{
+	return get_ms_timer() - base;
+}
+
+ulong __attribute__((no_instrument_function)) timer_get_us(void)
+{
+	return get_ticks() / get_tbclk_mhz();
+}
+
+ulong timer_get_boot_us(void)
+{
+	return timer_get_us();
+}
+
+void __udelay(unsigned long usec)
+{
+	u64 now = get_ticks();
+	u64 stop;
+
+	stop = now + usec * get_tbclk_mhz();
+
+	while ((int64_t)(stop - get_ticks()) > 0)
+		;
+}
+
+int timer_init(void)
+{
+#ifdef CONFIG_SYS_PCAT_TIMER
+	/* Set up the PCAT timer if required */
+	pcat_timer_init();
+#endif
+
+	return 0;
+}
diff --git a/qemu/roms/u-boot/arch/x86/lib/video.c b/qemu/roms/u-boot/arch/x86/lib/video.c
new file mode 100644
index 000000000..dfd2a8496
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/video.c
@@ -0,0 +1,209 @@
+/*
+ * (C) Copyright 2002
+ * Daniel Engström, Omicron Ceti AB, <daniel@omicron.se>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <pci.h>
+#include <stdio_dev.h>
+#include <i8042.h>
+#include <asm/ptrace.h>
+#include <asm/io.h>
+#include <asm/pci.h>
+
+/* basic textmode I/O from linux kernel */
+static char *vidmem = (char *)0xb8000;
+static int vidport;
+static int lines, cols;
+static int orig_x, orig_y;
+
+static void beep(int dur)
+{
+	int i;
+
+	outb_p(3, 0x61);
+	for (i = 0; i < 10*dur; i++)
+		udelay(1000);
+
+	outb_p(0, 0x61);
+}
+
+static void scroll(void)
+{
+	int i;
+
+	memcpy(vidmem, vidmem + cols * 2, (lines - 1) * cols * 2);
+	for (i = (lines - 1) * cols * 2; i < lines * cols * 2; i += 2)
+		vidmem[i] = ' ';
+}
+
+static void __video_putc(const char c, int *x, int *y)
+{
+	if (c == '\n') {
+		(*x) = 0;
+		if (++(*y) >= lines) {
+			scroll();
+			(*y)--;
+		}
+	} else if (c == '\b') {
+		if ((*x) != 0) {
+			--(*x);
+			vidmem[((*x) + cols * (*y)) * 2] = ' ';
+		}
+	} else if (c == '\r') {
+		(*x) = 0;
+
+	} else if (c == '\a') {
+		beep(3);
+
+	} else if (c == '\t') {
+		__video_putc(' ', x, y);
+		__video_putc(' ', x, y);
+		__video_putc(' ', x, y);
+		__video_putc(' ', x, y);
+		__video_putc(' ', x, y);
+		__video_putc(' ', x, y);
+		__video_putc(' ', x, y);
+		__video_putc(' ', x, y);
+	} else if (c == '\v') {
+		switch ((*x) % 8) {
+		case 0:
+			__video_putc(' ', x, y);
+		case 7:
+			__video_putc(' ', x, y);
+		case 6:
+			__video_putc(' ', x, y);
+		case 5:
+			__video_putc(' ', x, y);
+		case 4:
+			__video_putc(' ', x, y);
+		case 3:
+			__video_putc(' ', x, y);
+		case 2:
+			__video_putc(' ', x, y);
+		case 1:
+			__video_putc(' ', x, y);
+		}
+	} else if (c == '\f') {
+		int i;
+		for (i = 0; i < lines * cols * 2; i += 2)
+			vidmem[i] = 0;
+		(*x) = 0;
+		(*y) = 0;
+	} else {
+		vidmem[((*x) + cols * (*y)) * 2] = c;
+		if (++(*x) >= cols) {
+			(*x) = 0;
+			if (++(*y) >= lines) {
+				scroll();
+				(*y)--;
+			}
+		}
+	}
+}
+
+static void video_putc(const char c)
+{
+	int x, y, pos;
+
+	x = orig_x;
+	y = orig_y;
+
+	__video_putc(c, &x, &y);
+
+	orig_x = x;
+	orig_y = y;
+
+	pos = (x + cols * y) * 2;	/* Update cursor position */
+	outb_p(14, vidport);
+	outb_p(0xff & (pos >> 9), vidport+1);
+	outb_p(15, vidport);
+	outb_p(0xff & (pos >> 1), vidport+1);
+}
+
+static void video_puts(const char *s)
+{
+	int x, y, pos;
+	char c;
+
+	x = orig_x;
+	y = orig_y;
+
+	while ((c = *s++) != '\0')
+		__video_putc(c, &x, &y);
+
+	orig_x = x;
+	orig_y = y;
+
+	pos = (x + cols * y) * 2;	/* Update cursor position */
+	outb_p(14, vidport);
+	outb_p(0xff & (pos >> 9), vidport+1);
+	outb_p(15, vidport);
+	outb_p(0xff & (pos >> 1), vidport+1);
+}
+
+int video_init(void)
+{
+	u16 pos;
+
+	static struct stdio_dev vga_dev;
+	static struct stdio_dev kbd_dev;
+
+	vidmem = (char *) 0xb8000;
+	vidport = 0x3d4;
+
+	lines = 25;
+	cols = 80;
+
+	outb_p(14, vidport);
+	pos = inb_p(vidport+1);
+	pos <<= 8;
+	outb_p(15, vidport);
+	pos |= inb_p(vidport+1);
+
+	orig_x = pos%cols;
+	orig_y = pos/cols;
+
+#if 0
+	printf("pos %x %d %d\n", pos, orig_x, orig_y);
+#endif
+	if (orig_y > lines)
+		orig_x = orig_y = 0;
+
+	memset(&vga_dev, 0, sizeof(vga_dev));
+	strcpy(vga_dev.name, "vga");
+	vga_dev.ext   = 0;
+	vga_dev.flags = DEV_FLAGS_OUTPUT | DEV_FLAGS_SYSTEM;
+	vga_dev.putc  = video_putc;        /* 'putc' function */
+	vga_dev.puts  = video_puts;        /* 'puts' function */
+	vga_dev.tstc  = NULL;              /* 'tstc' function */
+	vga_dev.getc  = NULL;              /* 'getc' function */
+
+	if (stdio_register(&vga_dev) == 0)
+		return 1;
+
+	if (i8042_kbd_init())
+		return 1;
+
+	memset(&kbd_dev, 0, sizeof(kbd_dev));
+	strcpy(kbd_dev.name, "kbd");
+	kbd_dev.ext   = 0;
+	kbd_dev.flags = DEV_FLAGS_INPUT | DEV_FLAGS_SYSTEM;
+	kbd_dev.putc  = NULL;        /* 'putc' function */
+	kbd_dev.puts  = NULL;        /* 'puts' function */
+	kbd_dev.tstc  = i8042_tstc;  /* 'tstc' function */
+	kbd_dev.getc  = i8042_getc;  /* 'getc' function */
+
+	if (stdio_register(&kbd_dev) == 0)
+		return 1;
+
+	return 0;
+}
+
+
+int drv_video_init(void)
+{
+	return video_init();
+}
diff --git a/qemu/roms/u-boot/arch/x86/lib/zimage.c b/qemu/roms/u-boot/arch/x86/lib/zimage.c
new file mode 100644
index 000000000..1dab3cc78
--- /dev/null
+++ b/qemu/roms/u-boot/arch/x86/lib/zimage.c
@@ -0,0 +1,375 @@
+/*
+ * Copyright (c) 2011 The Chromium OS Authors.
+ * (C) Copyright 2002
+ * Daniel Engström, Omicron Ceti AB, <daniel@omicron.se>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+/*
+ * Linux x86 zImage and bzImage loading
+ *
+ * based on the procdure described in
+ * linux/Documentation/i386/boot.txt
+ */
+
+#include <common.h>
+#include <asm/io.h>
+#include <asm/ptrace.h>
+#include <asm/zimage.h>
+#include <asm/byteorder.h>
+#include <asm/bootparam.h>
+#ifdef CONFIG_SYS_COREBOOT
+#include <asm/arch/timestamp.h>
+#endif
+#include <linux/compiler.h>
+
+/*
+ * Memory lay-out:
+ *
+ * relative to setup_base (which is 0x90000 currently)
+ *
+ *	0x0000-0x7FFF	Real mode kernel
+ *	0x8000-0x8FFF	Stack and heap
+ *	0x9000-0x90FF	Kernel command line
+ */
+#define DEFAULT_SETUP_BASE	0x90000
+#define COMMAND_LINE_OFFSET	0x9000
+#define HEAP_END_OFFSET		0x8e00
+
+#define COMMAND_LINE_SIZE	2048
+
+unsigned generic_install_e820_map(unsigned max_entries,
+				  struct e820entry *entries)
+{
+	return 0;
+}
+
+unsigned install_e820_map(unsigned max_entries,
+			  struct e820entry *entries)
+	__attribute__((weak, alias("generic_install_e820_map")));
+
+static void build_command_line(char *command_line, int auto_boot)
+{
+	char *env_command_line;
+
+	command_line[0] = '\0';
+
+	env_command_line =  getenv("bootargs");
+
+	/* set console= argument if we use a serial console */
+	if (!strstr(env_command_line, "console=")) {
+		if (!strcmp(getenv("stdout"), "serial")) {
+
+			/* We seem to use serial console */
+			sprintf(command_line, "console=ttyS0,%s ",
+				getenv("baudrate"));
+		}
+	}
+
+	if (auto_boot)
+		strcat(command_line, "auto ");
+
+	if (env_command_line)
+		strcat(command_line, env_command_line);
+
+	printf("Kernel command line: \"%s\"\n", command_line);
+}
+
+static int kernel_magic_ok(struct setup_header *hdr)
+{
+	if (KERNEL_MAGIC != hdr->boot_flag) {
+		printf("Error: Invalid Boot Flag "
+			"(found 0x%04x, expected 0x%04x)\n",
+			hdr->boot_flag, KERNEL_MAGIC);
+		return 0;
+	} else {
+		printf("Valid Boot Flag\n");
+		return 1;
+	}
+}
+
+static int get_boot_protocol(struct setup_header *hdr)
+{
+	if (hdr->header == KERNEL_V2_MAGIC) {
+		printf("Magic signature found\n");
+		return hdr->version;
+	} else {
+		/* Very old kernel */
+		printf("Magic signature not found\n");
+		return 0x0100;
+	}
+}
+
+struct boot_params *load_zimage(char *image, unsigned long kernel_size,
+				void **load_address)
+{
+	struct boot_params *setup_base;
+	int setup_size;
+	int bootproto;
+	int big_image;
+
+	struct boot_params *params = (struct boot_params *)image;
+	struct setup_header *hdr = &params->hdr;
+
+	/* base address for real-mode segment */
+	setup_base = (struct boot_params *)DEFAULT_SETUP_BASE;
+
+	if (!kernel_magic_ok(hdr))
+		return 0;
+
+	/* determine size of setup */
+	if (0 == hdr->setup_sects) {
+		printf("Setup Sectors = 0 (defaulting to 4)\n");
+		setup_size = 5 * 512;
+	} else {
+		setup_size = (hdr->setup_sects + 1) * 512;
+	}
+
+	printf("Setup Size = 0x%8.8lx\n", (ulong)setup_size);
+
+	if (setup_size > SETUP_MAX_SIZE)
+		printf("Error: Setup is too large (%d bytes)\n", setup_size);
+
+	/* determine boot protocol version */
+	bootproto = get_boot_protocol(hdr);
+
+	printf("Using boot protocol version %x.%02x\n",
+	       (bootproto & 0xff00) >> 8, bootproto & 0xff);
+
+	if (bootproto >= 0x0200) {
+		if (hdr->setup_sects >= 15) {
+			printf("Linux kernel version %s\n",
+				(char *)params +
+				hdr->kernel_version + 0x200);
+		} else {
+			printf("Setup Sectors < 15 - "
+				"Cannot print kernel version.\n");
+		}
+	}
+
+	/* Determine image type */
+	big_image = (bootproto >= 0x0200) &&
+		    (hdr->loadflags & BIG_KERNEL_FLAG);
+
+	/* Determine load address */
+	if (big_image)
+		*load_address = (void *)BZIMAGE_LOAD_ADDR;
+	else
+		*load_address = (void *)ZIMAGE_LOAD_ADDR;
+
+	printf("Building boot_params at 0x%8.8lx\n", (ulong)setup_base);
+	memset(setup_base, 0, sizeof(*setup_base));
+	setup_base->hdr = params->hdr;
+
+	if (bootproto >= 0x0204)
+		kernel_size = hdr->syssize * 16;
+	else
+		kernel_size -= setup_size;
+
+	if (bootproto == 0x0100) {
+		/*
+		 * A very old kernel MUST have its real-mode code
+		 * loaded at 0x90000
+		 */
+		if ((u32)setup_base != 0x90000) {
+			/* Copy the real-mode kernel */
+			memmove((void *)0x90000, setup_base, setup_size);
+
+			/* Copy the command line */
+			memmove((void *)0x99000,
+				(u8 *)setup_base + COMMAND_LINE_OFFSET,
+				COMMAND_LINE_SIZE);
+
+			 /* Relocated */
+			setup_base = (struct boot_params *)0x90000;
+		}
+
+		/* It is recommended to clear memory up to the 32K mark */
+		memset((u8 *)0x90000 + setup_size, 0,
+		       SETUP_MAX_SIZE - setup_size);
+	}
+
+	if (big_image) {
+		if (kernel_size > BZIMAGE_MAX_SIZE) {
+			printf("Error: bzImage kernel too big! "
+				"(size: %ld, max: %d)\n",
+				kernel_size, BZIMAGE_MAX_SIZE);
+			return 0;
+		}
+	} else if ((kernel_size) > ZIMAGE_MAX_SIZE) {
+		printf("Error: zImage kernel too big! (size: %ld, max: %d)\n",
+		       kernel_size, ZIMAGE_MAX_SIZE);
+		return 0;
+	}
+
+	printf("Loading %s at address %p (%ld bytes)\n",
+		big_image ? "bzImage" : "zImage", *load_address, kernel_size);
+
+	memmove(*load_address, image + setup_size, kernel_size);
+
+	return setup_base;
+}
+
+int setup_zimage(struct boot_params *setup_base, char *cmd_line, int auto_boot,
+		 unsigned long initrd_addr, unsigned long initrd_size)
+{
+	struct setup_header *hdr = &setup_base->hdr;
+	int bootproto = get_boot_protocol(hdr);
+
+	setup_base->e820_entries = install_e820_map(
+		ARRAY_SIZE(setup_base->e820_map), setup_base->e820_map);
+
+	if (bootproto == 0x0100) {
+		setup_base->screen_info.cl_magic = COMMAND_LINE_MAGIC;
+		setup_base->screen_info.cl_offset = COMMAND_LINE_OFFSET;
+	}
+	if (bootproto >= 0x0200) {
+		hdr->type_of_loader = 8;
+
+		if (initrd_addr) {
+			printf("Initial RAM disk at linear address "
+			       "0x%08lx, size %ld bytes\n",
+			       initrd_addr, initrd_size);
+
+			hdr->ramdisk_image = initrd_addr;
+			hdr->ramdisk_size = initrd_size;
+		}
+	}
+
+	if (bootproto >= 0x0201) {
+		hdr->heap_end_ptr = HEAP_END_OFFSET;
+		hdr->loadflags |= HEAP_FLAG;
+	}
+
+	if (bootproto >= 0x0202) {
+		hdr->cmd_line_ptr = (uintptr_t)cmd_line;
+	} else if (bootproto >= 0x0200) {
+		setup_base->screen_info.cl_magic = COMMAND_LINE_MAGIC;
+		setup_base->screen_info.cl_offset =
+			(uintptr_t)cmd_line - (uintptr_t)setup_base;
+
+		hdr->setup_move_size = 0x9100;
+	}
+
+	/* build command line at COMMAND_LINE_OFFSET */
+	build_command_line(cmd_line, auto_boot);
+	return 0;
+}
+
+/*
+ * Implement a weak default function for boards that optionally
+ * need to clean up the system before jumping to the kernel.
+ */
+__weak void board_final_cleanup(void)
+{
+}
+
+void boot_zimage(void *setup_base, void *load_address)
+{
+	debug("## Transferring control to Linux (at address %08x) ...\n",
+	      (u32)setup_base);
+
+	bootstage_mark_name(BOOTSTAGE_ID_BOOTM_HANDOFF, "start_kernel");
+#ifdef CONFIG_BOOTSTAGE_REPORT
+	bootstage_report();
+#endif
+	board_final_cleanup();
+
+	printf("\nStarting kernel ...\n\n");
+
+#ifdef CONFIG_SYS_COREBOOT
+	timestamp_add_now(TS_U_BOOT_START_KERNEL);
+#endif
+	/*
+	 * Set %ebx, %ebp, and %edi to 0, %esi to point to the boot_params
+	 * structure, and then jump to the kernel. We assume that %cs is
+	 * 0x10, 4GB flat, and read/execute, and the data segments are 0x18,
+	 * 4GB flat, and read/write. U-boot is setting them up that way for
+	 * itself in arch/i386/cpu/cpu.c.
+	 */
+	__asm__ __volatile__ (
+	"movl $0, %%ebp\n"
+	"cli\n"
+	"jmp *%[kernel_entry]\n"
+	:: [kernel_entry]"a"(load_address),
+	   [boot_params] "S"(setup_base),
+	   "b"(0), "D"(0)
+	:  "%ebp"
+	);
+}
+
+void setup_pcat_compatibility(void)
+	__attribute__((weak, alias("__setup_pcat_compatibility")));
+
+void __setup_pcat_compatibility(void)
+{
+}
+
+int do_zboot(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
+{
+	struct boot_params *base_ptr;
+	void *bzImage_addr = NULL;
+	void *load_address;
+	char *s;
+	ulong bzImage_size = 0;
+	ulong initrd_addr = 0;
+	ulong initrd_size = 0;
+
+	disable_interrupts();
+
+	/* Setup board for maximum PC/AT Compatibility */
+	setup_pcat_compatibility();
+
+	if (argc >= 2) {
+		/* argv[1] holds the address of the bzImage */
+		s = argv[1];
+	} else {
+		s = getenv("fileaddr");
+	}
+
+	if (s)
+		bzImage_addr = (void *)simple_strtoul(s, NULL, 16);
+
+	if (argc >= 3) {
+		/* argv[2] holds the size of the bzImage */
+		bzImage_size = simple_strtoul(argv[2], NULL, 16);
+	}
+
+	if (argc >= 4)
+		initrd_addr = simple_strtoul(argv[3], NULL, 16);
+	if (argc >= 5)
+		initrd_size = simple_strtoul(argv[4], NULL, 16);
+
+	/* Lets look for */
+	base_ptr = load_zimage(bzImage_addr, bzImage_size, &load_address);
+
+	if (!base_ptr) {
+		printf("## Kernel loading failed ...\n");
+		return -1;
+	}
+	if (setup_zimage(base_ptr, (char *)base_ptr + COMMAND_LINE_OFFSET,
+			0, initrd_addr, initrd_size)) {
+		printf("Setting up boot parameters failed ...\n");
+		return -1;
+	}
+
+	/* we assume that the kernel is in place */
+	boot_zimage(base_ptr, load_address);
+	/* does not return */
+
+	return -1;
+}
+
+U_BOOT_CMD(
+	zboot, 5, 0,	do_zboot,
+	"Boot bzImage",
+	"[addr] [size] [initrd addr] [initrd size]\n"
+	"      addr -        The optional starting address of the bzimage.\n"
+	"                    If not set it defaults to the environment\n"
+	"                    variable \"fileaddr\".\n"
+	"      size -        The optional size of the bzimage. Defaults to\n"
+	"                    zero.\n"
+	"      initrd addr - The address of the initrd image to use, if any.\n"
+	"      initrd size - The size of the initrd image to use, if any.\n"
+);