Add qemu 2.4.0

Change-Id: Ic99cbad4b61f8b127b7dc74d04576c0bcbaaf4f5
Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>

6 files changed, 1192 insertions, 0 deletions

diff --git a/qemu/roms/u-boot/board/cm5200/Makefile b/qemu/roms/u-boot/board/cm5200/Makefile
new file mode 100644
index 000000000..76f8b9fc0
--- /dev/null
+++ b/qemu/roms/u-boot/board/cm5200/Makefile
@@ -0,0 +1,8 @@
+#
+# (C) Copyright 2003-2007
+# Wolfgang Denk, DENX Software Engineering, wd@denx.de.
+#
+# SPDX-License-Identifier:	GPL-2.0+
+#
+
+obj-y	:= cm5200.o cmd_cm5200.o fwupdate.o
diff --git a/qemu/roms/u-boot/board/cm5200/cm5200.c b/qemu/roms/u-boot/board/cm5200/cm5200.c
new file mode 100644
index 000000000..048aa6c2e
--- /dev/null
+++ b/qemu/roms/u-boot/board/cm5200/cm5200.c
@@ -0,0 +1,367 @@
+/*
+ * (C) Copyright 2003-2007
+ * Wolfgang Denk, DENX Software Engineering, wd@denx.de.
+ *
+ * (C) Copyright 2004
+ * Mark Jonas, Freescale Semiconductor, mark.jonas@motorola.com.
+ *
+ * (C) Copyright 2004-2005
+ * Martin Krause, TQ-Systems GmbH, martin.krause@tqs.de
+ *
+ * Adapted to U-Boot 1.2 by:
+ *   Bartlomiej Sieka <tur@semihalf.com>:
+ *      - HW ID readout from EEPROM
+ *      - module detection
+ *   Grzegorz Bernacki <gjb@semihalf.com>:
+ *      - run-time SDRAM controller configuration
+ *      - LIBFDT support
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <mpc5xxx.h>
+#include <pci.h>
+#include <asm/processor.h>
+#include <i2c.h>
+#include <linux/ctype.h>
+
+#ifdef CONFIG_OF_LIBFDT
+#include <libfdt.h>
+#include <fdt_support.h>
+#endif /* CONFIG_OF_LIBFDT */
+
+
+#include "cm5200.h"
+#include "fwupdate.h"
+
+DECLARE_GLOBAL_DATA_PTR;
+
+static hw_id_t hw_id;
+
+
+#ifndef CONFIG_SYS_RAMBOOT
+/*
+ * Helper function to initialize SDRAM controller.
+ */
+static void sdram_start(int hi_addr, mem_conf_t *mem_conf)
+{
+	long hi_addr_bit = hi_addr ? 0x01000000 : 0;
+
+	/* unlock mode register */
+	*(vu_long *)MPC5XXX_SDRAM_CTRL = mem_conf->control | 0x80000000 |
+						hi_addr_bit;
+
+	/* precharge all banks */
+	*(vu_long *)MPC5XXX_SDRAM_CTRL = mem_conf->control | 0x80000002 |
+						hi_addr_bit;
+
+	/* auto refresh */
+	*(vu_long *)MPC5XXX_SDRAM_CTRL = mem_conf->control | 0x80000004 |
+						hi_addr_bit;
+
+	/* auto refresh, second time */
+	*(vu_long *)MPC5XXX_SDRAM_CTRL = mem_conf->control | 0x80000004 |
+						hi_addr_bit;
+
+	/* set mode register */
+	*(vu_long *)MPC5XXX_SDRAM_MODE = mem_conf->mode;
+
+	/* normal operation */
+	*(vu_long *)MPC5XXX_SDRAM_CTRL = mem_conf->control | hi_addr_bit;
+}
+#endif /* CONFIG_SYS_RAMBOOT */
+
+
+/*
+ * Retrieve memory configuration for a given module. board_type is the index
+ * in hw_id_list[] corresponding to the module we are executing on; we return
+ * SDRAM controller settings approprate for this module.
+ */
+static mem_conf_t* get_mem_config(int board_type)
+{
+	switch(board_type){
+		case CM1_QA:
+			return memory_config[0];
+		case CM11_QA:
+		case CMU1_QA:
+			return memory_config[1];
+		default:
+			printf("ERROR: Unknown module, using a default SDRAM "
+				"configuration - things may not work!!!.\n");
+			return memory_config[0];
+	}
+}
+
+
+/*
+ * Initalize SDRAM - configure SDRAM controller, detect memory size.
+ */
+phys_size_t initdram(int board_type)
+{
+	ulong dramsize = 0;
+#ifndef CONFIG_SYS_RAMBOOT
+	ulong test1, test2;
+	mem_conf_t *mem_conf;
+
+	mem_conf = get_mem_config(board_type);
+
+	/* configure SDRAM start/end for detection */
+	*(vu_long *)MPC5XXX_SDRAM_CS0CFG = 0x0000001e; /* 2G at 0x0 */
+
+	/* setup config registers */
+	*(vu_long *)MPC5XXX_SDRAM_CONFIG1 = mem_conf->config1;
+	*(vu_long *)MPC5XXX_SDRAM_CONFIG2 = mem_conf->config2;
+
+	sdram_start(0, mem_conf);
+	test1 = get_ram_size((long *)CONFIG_SYS_SDRAM_BASE, 0x80000000);
+	sdram_start(1, mem_conf);
+	test2 = get_ram_size((long *)CONFIG_SYS_SDRAM_BASE, 0x80000000);
+	if (test1 > test2) {
+		sdram_start(0, mem_conf);
+		dramsize = test1;
+	} else
+		dramsize = test2;
+
+	/* memory smaller than 1MB is impossible */
+	if (dramsize < (1 << 20))
+		dramsize = 0;
+
+	/* set SDRAM CS0 size according to the amount of RAM found */
+	if (dramsize > 0) {
+		*(vu_long *)MPC5XXX_SDRAM_CS0CFG = 0x13 +
+			__builtin_ffs(dramsize >> 20) - 1;
+	} else
+		*(vu_long *)MPC5XXX_SDRAM_CS0CFG = 0; /* disabled */
+#else /* CONFIG_SYS_RAMBOOT */
+	/* retrieve size of memory connected to SDRAM CS0 */
+	dramsize = *(vu_long *)MPC5XXX_SDRAM_CS0CFG & 0xFF;
+	if (dramsize >= 0x13)
+		dramsize = (1 << (dramsize - 0x13)) << 20;
+	else
+		dramsize = 0;
+#endif /* !CONFIG_SYS_RAMBOOT */
+
+	/*
+	 * On MPC5200B we need to set the special configuration delay in the
+	 * DDR controller.  Refer to chapter 8.7.5 SDelay--MBAR + 0x0190 of
+	 * the MPC5200B User's Manual.
+	 */
+	*(vu_long *)MPC5XXX_SDRAM_SDELAY = 0x04;
+	__asm__ volatile ("sync");
+
+	return dramsize;
+}
+
+
+/*
+ * Read module hardware identification data from the I2C EEPROM.
+ */
+static void read_hw_id(hw_id_t hw_id)
+{
+	int i;
+	for (i = 0; i < HW_ID_ELEM_COUNT; ++i)
+		if (i2c_read(CONFIG_SYS_I2C_EEPROM,
+				hw_id_format[i].offset,
+				2,
+				(uchar *)&hw_id[i][0],
+				hw_id_format[i].length) != 0)
+			printf("ERROR: can't read HW ID from EEPROM\n");
+}
+
+
+/*
+ * Identify module we are running on, set gd->board_type to the index in
+ * hw_id_list[] corresponding to the module identifed, or to
+ * CM5200_UNKNOWN_MODULE if we can't identify the module.
+ */
+static void identify_module(hw_id_t hw_id)
+{
+	int i, j, element;
+	char match;
+	gd->board_type = CM5200_UNKNOWN_MODULE;
+	for (i = 0; i < sizeof (hw_id_list) / sizeof (char **); ++i) {
+		match = 1;
+		for (j = 0; j < sizeof (hw_id_identify) / sizeof (int); ++j) {
+			element = hw_id_identify[j];
+			if (strncmp(hw_id_list[i][element],
+					&hw_id[element][0],
+					hw_id_format[element].length) != 0) {
+				match = 0;
+				break;
+			}
+		}
+		if (match) {
+			gd->board_type = i;
+			break;
+		}
+	}
+}
+
+
+/*
+ * Compose string with module name.
+ * buf is assumed to have enough space, and be null-terminated.
+ */
+static void compose_module_name(hw_id_t hw_id, char *buf)
+{
+	char tmp[MODULE_NAME_MAXLEN];
+	strncat(buf, &hw_id[PCB_NAME][0], hw_id_format[PCB_NAME].length);
+	strncat(buf, ".", 1);
+	strncat(buf, &hw_id[FORM][0], hw_id_format[FORM].length);
+	strncat(buf, &hw_id[VERSION][0], hw_id_format[VERSION].length);
+	strncat(buf, " (", 2);
+	strncat(buf, &hw_id[IDENTIFICATION_NUMBER][0],
+		hw_id_format[IDENTIFICATION_NUMBER].length);
+	sprintf(tmp, " / %u.%u)",
+		hw_id[MAJOR_SW_VERSION][0],
+		hw_id[MINOR_SW_VERSION][0]);
+	strcat(buf, tmp);
+}
+
+
+/*
+ * Compose string with hostname.
+ * buf is assumed to have enough space, and be null-terminated.
+ */
+static void compose_hostname(hw_id_t hw_id, char *buf)
+{
+	char *p;
+	strncat(buf, &hw_id[PCB_NAME][0], hw_id_format[PCB_NAME].length);
+	strncat(buf, "_", 1);
+	strncat(buf, &hw_id[FORM][0], hw_id_format[FORM].length);
+	strncat(buf, &hw_id[VERSION][0], hw_id_format[VERSION].length);
+	for (p = buf; *p; ++p)
+		*p = tolower(*p);
+
+}
+
+
+#if defined(CONFIG_OF_BOARD_SETUP) && defined(CONFIG_OF_LIBFDT)
+/*
+ * Update 'model' and 'memory' properties in the blob according to the module
+ * that we are running on.
+ */
+static void ft_blob_update(void *blob, bd_t *bd)
+{
+	int len, ret, nodeoffset = 0;
+	char module_name[MODULE_NAME_MAXLEN] = {0};
+
+	compose_module_name(hw_id, module_name);
+	len = strlen(module_name) + 1;
+
+	ret = fdt_setprop(blob, nodeoffset, "model", module_name, len);
+	if (ret < 0)
+	printf("ft_blob_update(): cannot set /model property err:%s\n",
+		fdt_strerror(ret));
+}
+#endif /* defined(CONFIG_OF_BOARD_SETUP) && defined(CONFIG_OF_LIBFDT) */
+
+
+/*
+ * Read HW ID from I2C EEPROM and detect the modue we are running on. Note
+ * that we need to use local variable for readout, because global data is not
+ * writable yet (and we'll have to redo the readout later on).
+ */
+int checkboard(void)
+{
+	hw_id_t hw_id_tmp;
+	char module_name_tmp[MODULE_NAME_MAXLEN] = "";
+
+	/*
+	 * We need I2C to access HW ID data from EEPROM, so we call i2c_init()
+	 * here despite the fact that it will be called again later on. We
+	 * also use a little trick to silence I2C-related output.
+	 */
+	gd->flags |= GD_FLG_SILENT;
+	i2c_init (CONFIG_SYS_I2C_SPEED, CONFIG_SYS_I2C_SLAVE);
+	gd->flags &= ~GD_FLG_SILENT;
+
+	read_hw_id(hw_id_tmp);
+	identify_module(hw_id_tmp);	/* this sets gd->board_type */
+	compose_module_name(hw_id_tmp, module_name_tmp);
+
+	if (gd->board_type != CM5200_UNKNOWN_MODULE)
+		printf("Board: %s\n", module_name_tmp);
+	else
+		printf("Board: unrecognized cm5200 module (%s)\n",
+			module_name_tmp);
+
+	return 0;
+}
+
+
+int board_early_init_r(void)
+{
+	/*
+	 * Now, when we are in RAM, enable flash write access for detection
+	 * process. Note that CS_BOOT cannot be cleared when executing in
+	 * flash.
+	 */
+	*(vu_long *)MPC5XXX_BOOTCS_CFG &= ~0x1; /* clear RO */
+
+	/* Now that we can write to global data, read HW ID again. */
+	read_hw_id(hw_id);
+	return 0;
+}
+
+
+#ifdef CONFIG_MISC_INIT_R
+int misc_init_r(void)
+{
+#if defined(CONFIG_HARD_I2C) || defined(CONFIG_SYS_I2C_SOFT)
+	uchar buf[6];
+	char str[18];
+	char hostname[MODULE_NAME_MAXLEN];
+
+	/* Read ethaddr from EEPROM */
+	if (i2c_read(CONFIG_SYS_I2C_EEPROM, CONFIG_MAC_OFFSET, 2, buf, 6) == 0) {
+		sprintf(str, "%02X:%02X:%02X:%02X:%02X:%02X",
+			buf[0], buf[1], buf[2], buf[3], buf[4], buf[5]);
+		/* Check if MAC addr is owned by Schindler */
+		if (strstr(str, "00:06:C3") != str)
+			printf(LOG_PREFIX "Warning - Illegal MAC address (%s)"
+				" in EEPROM.\n", str);
+		else {
+			printf(LOG_PREFIX "Using MAC (%s) from I2C EEPROM\n",
+				str);
+			setenv("ethaddr", str);
+		}
+	} else {
+		printf(LOG_PREFIX "Warning - Unable to read MAC from I2C"
+			" device at address %02X:%04X\n", CONFIG_SYS_I2C_EEPROM,
+			CONFIG_MAC_OFFSET);
+	}
+#endif /* defined(CONFIG_HARD_I2C) || defined(CONFIG_SYS_I2C_SOFT) */
+	if (!getenv("ethaddr"))
+		printf(LOG_PREFIX "MAC address not set, networking is not "
+					"operational\n");
+
+	/* set the hostname appropriate to the module we're running on */
+	hostname[0] = 0x00;
+	compose_hostname(hw_id, hostname);
+	setenv("hostname", hostname);
+
+	return 0;
+}
+#endif /* CONFIG_MISC_INIT_R */
+
+
+#ifdef CONFIG_LAST_STAGE_INIT
+int last_stage_init(void)
+{
+#ifdef CONFIG_USB_STORAGE
+	cm5200_fwupdate();
+#endif /* CONFIG_USB_STORAGE */
+	return 0;
+}
+#endif /* CONFIG_LAST_STAGE_INIT */
+
+
+#if defined(CONFIG_OF_LIBFDT) && defined(CONFIG_OF_BOARD_SETUP)
+void ft_board_setup(void *blob, bd_t *bd)
+{
+	ft_cpu_setup(blob, bd);
+	ft_blob_update(blob, bd);
+}
+#endif /* defined(CONFIG_OF_LIBFDT) && defined(CONFIG_OF_BOARD_SETUP) */
diff --git a/qemu/roms/u-boot/board/cm5200/cm5200.h b/qemu/roms/u-boot/board/cm5200/cm5200.h
new file mode 100644
index 000000000..c2573f3bf
--- /dev/null
+++ b/qemu/roms/u-boot/board/cm5200/cm5200.h
@@ -0,0 +1,171 @@
+/*
+ * (C) Copyright 2007 DENX Software Engineering
+ *
+ * Author: Bartlomiej Sieka <tur@semihalf.com>
+ * Author: Grzegorz Bernacki <gjb@semihalf.com>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#ifndef _CM5200_H
+#define _CM5200_H
+
+
+/*
+ * Definitions and declarations for the modules of the cm5200 platform. Mostly
+ * related to reading the hardware identification data (HW ID) from the I2C
+ * EEPROM, detection of the particular module we are executing on, and
+ * appropriate SDRAM controller initialization.
+ */
+
+
+#define CM5200_UNKNOWN_MODULE	0xffffffff
+
+enum {
+	DEVICE_NAME,		/* 0 */
+	GENERATION,		/* 1 */
+	PCB_NAME,		/* 2 */
+	FORM,			/* 3 */
+	VERSION,		/* 4 */
+	IDENTIFICATION_NUMBER,	/* 5 */
+	MAJOR_SW_VERSION,	/* 6 */
+	MINOR_SW_VERSION,	/* 7 */
+	/* add new alements above this line */
+	HW_ID_ELEM_COUNT	/* count */
+};
+
+/*
+ * Sect. 4.1 "CM1.Q/CMU1.Q Supervisory Microcontroller Interface Definition"
+ */
+
+#define DEVICE_NAME_OFFSET		0x02
+#define GENERATION_OFFSET		0x0b
+#define PCB_NAME_OFFSET			0x0c
+#define FORM_OFFSET			0x15
+#define VERSION_OFFSET			0x16
+#define IDENTIFICATION_NUMBER_OFFSET	0x19
+#define MAJOR_SW_VERSION_OFFSET		0x0480
+#define MINOR_SW_VERSION_OFFSET		0x0481
+
+
+#define DEVICE_NAME_LEN			0x09
+#define GENERATION_LEN			0x01
+#define PCB_NAME_LEN			0x09
+#define FORM_LEN			0x01
+#define VERSION_LEN			0x03
+#define IDENTIFICATION_NUMBER_LEN	0x09
+#define MAJOR_SW_VERSION_LEN		0x01
+#define MINOR_SW_VERSION_LEN		0x01
+
+#define HW_ID_ELEM_MAXLEN		0x09	/* MAX(XXX_LEN) */
+
+/* entire HW ID in EEPROM is 64 bytes, so longer module name is unlikely */
+#define MODULE_NAME_MAXLEN		64
+
+
+/* storage for HW ID read from EEPROM */
+typedef char hw_id_t[HW_ID_ELEM_COUNT][HW_ID_ELEM_MAXLEN];
+
+
+/* HW ID layout in EEPROM */
+static struct {
+	unsigned int offset;
+	unsigned int length;
+} hw_id_format[HW_ID_ELEM_COUNT] = {
+	{DEVICE_NAME_OFFSET,		DEVICE_NAME_LEN},
+	{GENERATION_OFFSET,		GENERATION_LEN},
+	{PCB_NAME_OFFSET,		PCB_NAME_LEN},
+	{FORM_OFFSET,			FORM_LEN},
+	{VERSION_OFFSET,		VERSION_LEN},
+	{IDENTIFICATION_NUMBER_OFFSET,	IDENTIFICATION_NUMBER_LEN},
+	{MAJOR_SW_VERSION_OFFSET,	MAJOR_SW_VERSION_LEN},
+	{MINOR_SW_VERSION_OFFSET,	MINOR_SW_VERSION_LEN},
+};
+
+
+/* HW ID data found in EEPROM on supported modules */
+static char *cm1_qa_hw_id[HW_ID_ELEM_COUNT] = {
+	"CM",		/* DEVICE_NAME */
+	"1",		/* GENERATION */
+	"CM1",		/* PCB_NAME */
+	"Q",		/* FORM */
+	"A",		/* VERSION */
+	"591881",	/* IDENTIFICATION_NUMBER */
+	"",		/* MAJOR_SW_VERSION */
+	"",		/* MINOR_SW_VERSION */
+};
+
+static char *cm11_qa_hw_id[HW_ID_ELEM_COUNT] = {
+	"CM",		/* DEVICE_NAME */
+	"1",		/* GENERATION */
+	"CM11",		/* PCB_NAME */
+	"Q",		/* FORM */
+	"A",		/* VERSION */
+	"594200",	/* IDENTIFICATION_NUMBER */
+	"",		/* MAJOR_SW_VERSION */
+	"",		/* MINOR_SW_VERSION */
+};
+
+static char *cmu1_qa_hw_id[HW_ID_ELEM_COUNT] = {
+	"CMU",		/* DEVICE_NAME */
+	"1",		/* GENERATION */
+	"CMU1",		/* PCB_NAME */
+	"Q",		/* FORM */
+	"A",		/* VERSION */
+	"594128",	/* IDENTIFICATION_NUMBER */
+	"",		/* MAJOR_SW_VERSION */
+	"",		/* MINOR_SW_VERSION */
+};
+
+
+/* list of known modules */
+static char **hw_id_list[] = {
+	cm1_qa_hw_id,
+	cm11_qa_hw_id,
+	cmu1_qa_hw_id,
+};
+
+/* indices to the above list - keep in sync */
+enum {
+	CM1_QA,
+	CM11_QA,
+	CMU1_QA,
+};
+
+
+/* identify modules based on these hw id elements */
+static int hw_id_identify[] = {
+	PCB_NAME,
+	FORM,
+	VERSION,
+};
+
+
+/* Registers' settings for SDRAM controller intialization */
+typedef struct {
+	ulong mode;
+	ulong control;
+	ulong config1;
+	ulong config2;
+} mem_conf_t;
+
+static mem_conf_t k4s561632E = {
+	0x00CD0000,      /* CASL 3, burst length 8 */
+	0x514F0000,
+	0xE2333900,
+	0x8EE70000
+};
+
+static mem_conf_t mt48lc32m16a2 = {
+	0x00CD0000,      /* CASL 3, burst length 8 */
+	0x514F0000,
+	0xD2322800,
+	0x8AD70000
+};
+
+static mem_conf_t* memory_config[] = {
+	&k4s561632E,
+	&mt48lc32m16a2
+};
+
+#endif /* _CM5200_H */
diff --git a/qemu/roms/u-boot/board/cm5200/cmd_cm5200.c b/qemu/roms/u-boot/board/cm5200/cmd_cm5200.c
new file mode 100644
index 000000000..9c40ad7b2
--- /dev/null
+++ b/qemu/roms/u-boot/board/cm5200/cmd_cm5200.c
@@ -0,0 +1,432 @@
+/*
+ * (C) Copyright 2007 Markus Kappeler <markus.kappeler@objectxp.com>
+ *
+ * Adapted for U-Boot 1.2 by Piotr Kruszynski <ppk@semihalf.com>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <command.h>
+#include <i2c.h>
+#include <usb.h>
+
+#ifdef CONFIG_CMD_BSP
+
+static int do_i2c_test(char * const argv[])
+{
+	unsigned char temp, temp1;
+
+	printf("Starting I2C Test\n"
+		"Please set Jumper:\nI2C SDA 2-3\nI2C SCL 2-3\n\n"
+		"Please press any key to start\n\n");
+	getc();
+
+	temp = 0xf0; /* set io 0-4 as output */
+	i2c_write(CONFIG_SYS_I2C_IO, 3, 1, (uchar *)&temp, 1);
+
+	printf("Press I2C4-7. LED I2C0-3 should have the same state\n\n"
+		"Press any key to stop\n\n");
+
+	while (!tstc()) {
+		i2c_read(CONFIG_SYS_I2C_IO, 0, 1, (uchar *)&temp, 1);
+		temp1 = (temp >> 4) & 0x03;
+		temp1 |= (temp >> 3) & 0x08; /* S302 -> LED303 */
+		temp1 |= (temp >> 5) & 0x04; /* S303 -> LED302 */
+		temp = temp1;
+		i2c_write(CONFIG_SYS_I2C_IO, 1, 1, (uchar *)&temp, 1);
+	}
+	getc();
+
+	return 0;
+}
+
+static int do_usb_test(char * const argv[])
+{
+	int i;
+	static int usb_stor_curr_dev = -1; /* current device */
+
+	printf("Starting USB Test\n"
+		"Please insert USB Memmory Stick\n\n"
+		"Please press any key to start\n\n");
+	getc();
+
+	usb_stop();
+	printf("(Re)start USB...\n");
+	i = usb_init();
+#ifdef CONFIG_USB_STORAGE
+		/* try to recognize storage devices immediately */
+		if (i >= 0)
+			usb_stor_curr_dev = usb_stor_scan(1);
+#endif /* CONFIG_USB_STORAGE */
+	if (usb_stor_curr_dev >= 0)
+		printf("Found USB Storage Dev continue with Test...\n");
+	else {
+		printf("No USB Storage Device detected.. Stop Test\n");
+		return 1;
+	}
+
+	usb_stor_info();
+
+	printf("stopping USB..\n");
+	usb_stop();
+
+	return 0;
+}
+
+static int do_led_test(char * const argv[])
+{
+	int i = 0;
+	struct mpc5xxx_gpt_0_7 *gpt = (struct mpc5xxx_gpt_0_7 *)MPC5XXX_GPT;
+
+	printf("Starting LED Test\n"
+		"Please set Switch S500 all off\n\n"
+		"Please press any key to start\n\n");
+	getc();
+
+	/* configure timer 2-3 for simple GPIO output High */
+	gpt->gpt2.emsr |= 0x00000034;
+	gpt->gpt3.emsr |= 0x00000034;
+
+	(*(vu_long *)MPC5XXX_WU_GPIO_ENABLE) |= 0x80000000;
+	(*(vu_long *)MPC5XXX_WU_GPIO_DIR) |= 0x80000000;
+	printf("Please press any key to stop\n\n");
+	while (!tstc()) {
+		if (i == 1) {
+			(*(vu_long *)MPC5XXX_WU_GPIO_DATA_O) |= 0x80000000;
+			gpt->gpt2.emsr &= ~0x00000010;
+			gpt->gpt3.emsr &= ~0x00000010;
+		} else if (i == 2) {
+			(*(vu_long *)MPC5XXX_WU_GPIO_DATA_O) &= ~0x80000000;
+			gpt->gpt2.emsr &= ~0x00000010;
+			gpt->gpt3.emsr |= 0x00000010;
+		} else if (i >= 3) {
+			(*(vu_long *)MPC5XXX_WU_GPIO_DATA_O) &= ~0x80000000;
+			gpt->gpt3.emsr &= ~0x00000010;
+			gpt->gpt2.emsr |= 0x00000010;
+			i = 0;
+		}
+		i++;
+		udelay(200000);
+	}
+	getc();
+
+	(*(vu_long *)MPC5XXX_WU_GPIO_DATA_O) |= 0x80000000;
+	gpt->gpt2.emsr |= 0x00000010;
+	gpt->gpt3.emsr |= 0x00000010;
+
+	return 0;
+}
+
+static int do_rs232_test(char * const argv[])
+{
+	int error_status = 0;
+	struct mpc5xxx_gpio *gpio = (struct mpc5xxx_gpio *)MPC5XXX_GPIO;
+	struct mpc5xxx_psc *psc1 = (struct mpc5xxx_psc *)MPC5XXX_PSC1;
+
+	/* Configure PSC 2-3-6 as GPIO */
+	gpio->port_config &= 0xFF0FF80F;
+
+	switch (simple_strtoul(argv[2], NULL, 10)) {
+	case 1:
+		/* check RTS <-> CTS loop */
+		/* set rts to 0 */
+		printf("Uart 1 test: RX TX tested by using U-Boot\n"
+			"Please connect RTS with CTS on Uart1 plug\n\n"
+			"Press any key to start\n\n");
+		getc();
+
+		psc1->op1 |= 0x01;
+
+		/* wait some time before requesting status */
+		udelay(10);
+
+		/* check status at cts */
+		if ((psc1->ip & 0x01) != 0) {
+			error_status = 3;
+			printf("%s: failure at rs232_1, cts status is %d "
+				"(should be 0)\n",
+				__FUNCTION__, (psc1->ip & 0x01));
+		}
+
+		/* set rts to 1 */
+		psc1->op0 |= 0x01;
+
+		/* wait some time before requesting status */
+		udelay(10);
+
+		/* check status at cts */
+		if ((psc1->ip & 0x01) != 1) {
+			error_status = 3;
+			printf("%s: failure at rs232_1, cts status is %d "
+				"(should be 1)\n",
+				__FUNCTION__, (psc1->ip & 0x01));
+		}
+		break;
+	case 2:
+		/* set PSC2_0, PSC2_2 as output and PSC2_1, PSC2_3 as input */
+		printf("Uart 2 test: Please use RS232 Loopback plug on UART2\n"
+			"\nPress any key to start\n\n");
+		getc();
+
+		gpio->simple_gpioe &= ~(0x000000F0);
+		gpio->simple_gpioe |= 0x000000F0;
+		gpio->simple_ddr &= ~(0x000000F0);
+		gpio->simple_ddr |= 0x00000050;
+
+		/* check TXD <-> RXD loop */
+		/* set TXD to 1 */
+		gpio->simple_dvo |= (1 << 4);
+
+		/* wait some time before requesting status */
+		udelay(10);
+
+		if ((gpio->simple_ival & 0x00000020) != 0x00000020) {
+			error_status = 2;
+			printf("%s: failure at rs232_2, rxd status is %d "
+				"(should be 1)\n", __FUNCTION__,
+				(gpio->simple_ival & 0x00000020) >> 5);
+		}
+
+		/* set TXD to 0 */
+		gpio->simple_dvo &= ~(1 << 4);
+
+		/* wait some time before requesting status */
+		udelay(10);
+
+		if ((gpio->simple_ival & 0x00000020) != 0x00000000) {
+			error_status = 2;
+			printf("%s: failure at rs232_2, rxd status is %d "
+				"(should be 0)\n", __FUNCTION__,
+				(gpio->simple_ival & 0x00000020) >> 5);
+		}
+
+		/* check RTS <-> CTS loop */
+		/* set RTS to 1 */
+		gpio->simple_dvo |= (1 << 6);
+
+		/* wait some time before requesting status */
+		udelay(10);
+
+		if ((gpio->simple_ival & 0x00000080) != 0x00000080) {
+			error_status = 3;
+			printf("%s: failure at rs232_2, cts status is %d "
+				"(should be 1)\n", __FUNCTION__,
+				(gpio->simple_ival & 0x00000080) >> 7);
+		}
+
+		/* set RTS to 0 */
+		gpio->simple_dvo &= ~(1 << 6);
+
+		/* wait some time before requesting status */
+		udelay(10);
+
+		if ((gpio->simple_ival & 0x00000080) != 0x00000000) {
+			error_status = 3;
+			printf("%s: failure at rs232_2, cts status is %d "
+				"(should be 0)\n", __FUNCTION__,
+				(gpio->simple_ival & 0x00000080) >> 7);
+		}
+		break;
+	case 3:
+		/* set PSC3_0, PSC3_2 as output and PSC3_1, PSC3_3 as input */
+		printf("Uart 3 test: Please use RS232 Loopback plug on UART2\n"
+			"\nPress any key to start\n\n");
+		getc();
+
+		gpio->simple_gpioe &= ~(0x00000F00);
+		gpio->simple_gpioe |= 0x00000F00;
+
+		gpio->simple_ddr &= ~(0x00000F00);
+		gpio->simple_ddr |= 0x00000500;
+
+		/* check TXD <-> RXD loop */
+		/* set TXD to 1 */
+		gpio->simple_dvo |= (1 << 8);
+
+		/* wait some time before requesting status */
+		udelay(10);
+
+		if ((gpio->simple_ival & 0x00000200) != 0x00000200) {
+			error_status = 2;
+			printf("%s: failure at rs232_3, rxd status is %d "
+				"(should be 1)\n", __FUNCTION__,
+				(gpio->simple_ival & 0x00000200) >> 9);
+		}
+
+		/* set TXD to 0 */
+		gpio->simple_dvo &= ~(1 << 8);
+
+		/* wait some time before requesting status */
+		udelay(10);
+
+		if ((gpio->simple_ival & 0x00000200) != 0x00000000) {
+			error_status = 2;
+			printf("%s: failure at rs232_3, rxd status is %d "
+				"(should be 0)\n", __FUNCTION__,
+				(gpio->simple_ival & 0x00000200) >> 9);
+		}
+
+		/* check RTS <-> CTS loop */
+		/* set RTS to 1 */
+		gpio->simple_dvo |= (1 << 10);
+
+		/* wait some time before requesting status */
+		udelay(10);
+
+		if ((gpio->simple_ival & 0x00000800) != 0x00000800) {
+			error_status = 3;
+			printf("%s: failure at rs232_3, cts status is %d "
+				"(should be 1)\n", __FUNCTION__,
+				(gpio->simple_ival & 0x00000800) >> 11);
+		}
+
+		/* set RTS to 0 */
+		gpio->simple_dvo &= ~(1 << 10);
+
+		/* wait some time before requesting status */
+		udelay(10);
+
+		if ((gpio->simple_ival & 0x00000800) != 0x00000000) {
+			error_status = 3;
+			printf("%s: failure at rs232_3, cts status is %d "
+				"(should be 0)\n", __FUNCTION__,
+				(gpio->simple_ival & 0x00000800) >> 11);
+		}
+		break;
+	case 4:
+		/* set PSC6_2, PSC6_3 as output and PSC6_0, PSC6_1 as input */
+		printf("Uart 4 test: Please use RS232 Loopback plug on UART2\n"
+			"\nPress any key to start\n\n");
+		getc();
+
+		gpio->simple_gpioe &= ~(0xF0000000);
+		gpio->simple_gpioe |= 0x30000000;
+
+		gpio->simple_ddr &= ~(0xf0000000);
+		gpio->simple_ddr |= 0x30000000;
+
+		(*(vu_long *)MPC5XXX_WU_GPIO_ENABLE) |= 0x30000000;
+		(*(vu_long *)MPC5XXX_WU_GPIO_DIR) &= ~(0x30000000);
+
+		/* check TXD <-> RXD loop */
+		/* set TXD to 1 */
+		gpio->simple_dvo |= (1 << 28);
+
+		/* wait some time before requesting status */
+		udelay(10);
+
+		if (((*(vu_long *)MPC5XXX_WU_GPIO_DATA_I) & 0x10000000) !=
+				0x10000000) {
+			error_status = 2;
+			printf("%s: failure at rs232_4, rxd status is %lu "
+				"(should be 1)\n", __FUNCTION__,
+				((*(vu_long *)MPC5XXX_WU_GPIO_DATA_I) &
+					0x10000000) >> 28);
+		}
+
+		/* set TXD to 0 */
+		gpio->simple_dvo &= ~(1 << 28);
+
+		/* wait some time before requesting status */
+		udelay(10);
+
+		if (((*(vu_long *)MPC5XXX_WU_GPIO_DATA_I) & 0x10000000) !=
+				0x00000000) {
+			error_status = 2;
+			printf("%s: failure at rs232_4, rxd status is %lu "
+				"(should be 0)\n", __FUNCTION__,
+				((*(vu_long *)MPC5XXX_WU_GPIO_DATA_I) &
+					0x10000000) >> 28);
+		}
+
+		/* check RTS <-> CTS loop */
+		/* set RTS to 1 */
+		gpio->simple_dvo |= (1 << 29);
+
+		/* wait some time before requesting status */
+		udelay(10);
+
+		if (((*(vu_long *)MPC5XXX_WU_GPIO_DATA_I) & 0x20000000) !=
+				0x20000000) {
+			error_status = 3;
+			printf("%s: failure at rs232_4, cts status is %lu "
+				"(should be 1)\n", __FUNCTION__,
+				((*(vu_long *)MPC5XXX_WU_GPIO_DATA_I) &
+					0x20000000) >> 29);
+		}
+
+		/* set RTS to 0 */
+		gpio->simple_dvo &= ~(1 << 29);
+
+		/* wait some time before requesting status */
+		udelay(10);
+
+		if (((*(vu_long *)MPC5XXX_WU_GPIO_DATA_I) & 0x20000000) !=
+				0x00000000) {
+			error_status = 3;
+			printf("%s: failure at rs232_4, cts status is %lu "
+				"(should be 0)\n", __FUNCTION__,
+				((*(vu_long *)MPC5XXX_WU_GPIO_DATA_I) &
+					0x20000000) >> 29);
+		}
+		break;
+	default:
+		printf("%s: invalid rs232 number %s\n", __FUNCTION__, argv[2]);
+		error_status = 1;
+		break;
+	}
+	gpio->port_config |= (CONFIG_SYS_GPS_PORT_CONFIG & 0xFF0FF80F);
+
+	return error_status;
+}
+
+static int cmd_fkt(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+	int rcode = -1;
+
+	switch (argc) {
+	case 2:
+		if (strncmp(argv[1], "i2c", 3) == 0)
+			rcode = do_i2c_test(argv);
+		else if (strncmp(argv[1], "led", 3) == 0)
+			rcode = do_led_test(argv);
+		else if (strncmp(argv[1], "usb", 3) == 0)
+			rcode = do_usb_test(argv);
+		break;
+	case 3:
+		if (strncmp(argv[1], "rs232", 3) == 0)
+			rcode = do_rs232_test(argv);
+		break;
+	}
+
+	switch (rcode) {
+	case -1:
+		printf("Usage:\n"
+			"fkt { i2c | led | usb }\n"
+			"fkt rs232 number\n");
+		rcode = 1;
+		break;
+	case 0:
+		printf("Test passed\n");
+		break;
+	default:
+		printf("Test failed with code: %d\n", rcode);
+	}
+
+	return rcode;
+}
+
+U_BOOT_CMD(
+	fkt,	4,	1,	cmd_fkt,
+	"Function test routines",
+	"i2c\n"
+	"     - Test I2C communication\n"
+	"fkt led\n"
+	"     - Test LEDs\n"
+	"fkt rs232 number\n"
+	"     - Test RS232 (loopback plug(s) for RS232 required)\n"
+	"fkt usb\n"
+	"     - Test USB communication"
+);
+#endif /* CONFIG_CMD_BSP */
diff --git a/qemu/roms/u-boot/board/cm5200/fwupdate.c b/qemu/roms/u-boot/board/cm5200/fwupdate.c
new file mode 100644
index 000000000..06d50234e
--- /dev/null
+++ b/qemu/roms/u-boot/board/cm5200/fwupdate.c
@@ -0,0 +1,183 @@
+/*
+ * (C) Copyright 2007 Schindler Lift Inc.
+ * (C) Copyright 2007 DENX Software Engineering
+ *
+ * Author: Michel Marti <mma@objectxp.com>
+ * Adapted for U-Boot 1.2 by Piotr Kruszynski <ppk@semihalf.com>:
+ *   - code clean-up
+ *   - bugfix for overwriting bootargs by user
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <command.h>
+#include <malloc.h>
+#include <image.h>
+#include <usb.h>
+#include <fat.h>
+
+#include "fwupdate.h"
+
+extern long do_fat_read(const char *, void *, unsigned long, int);
+extern int do_fat_fsload(cmd_tbl_t *, int, int, char * const []);
+
+static int load_rescue_image(ulong);
+
+void cm5200_fwupdate(void)
+{
+	cmd_tbl_t *bcmd;
+	char *rsargs;
+	char *tmp = NULL;
+	char ka[16];
+	char * const argv[3] = { "bootm", ka, NULL };
+
+	/* Check if rescue system is disabled... */
+	if (getenv("norescue")) {
+		printf(LOG_PREFIX "Rescue System disabled.\n");
+		return;
+	}
+
+	/* Check if we have a USB storage device and load image */
+	if (load_rescue_image(LOAD_ADDR))
+		return;
+
+	bcmd = find_cmd("bootm");
+	if (!bcmd)
+		return;
+
+	sprintf(ka, "%lx", (ulong)LOAD_ADDR);
+
+	/* prepare our bootargs */
+	rsargs = getenv("rs-args");
+	if (!rsargs)
+		rsargs = RS_BOOTARGS;
+	else {
+		tmp = malloc(strlen(rsargs+1));
+		if (!tmp) {
+			printf(LOG_PREFIX "Memory allocation failed\n");
+			return;
+		}
+		strcpy(tmp, rsargs);
+		rsargs = tmp;
+	}
+
+	setenv("bootargs", rsargs);
+
+	if (rsargs == tmp)
+		free(rsargs);
+
+	printf(LOG_PREFIX "Starting update system (bootargs=%s)...\n", rsargs);
+	do_bootm(bcmd, 0, 2, argv);
+}
+
+static int load_rescue_image(ulong addr)
+{
+	disk_partition_t info;
+	int devno;
+	int partno;
+	int i;
+	char fwdir[64];
+	char nxri[128];
+	char *tmp;
+	char dev[7];
+	char addr_str[16];
+	char * const argv[6] = { "fatload", "usb", dev, addr_str, nxri, NULL };
+	block_dev_desc_t *stor_dev = NULL;
+	cmd_tbl_t *bcmd;
+
+	/* Get name of firmware directory */
+	tmp = getenv("fw-dir");
+
+	/* Copy it into fwdir */
+	strncpy(fwdir, tmp ? tmp : FW_DIR, sizeof(fwdir));
+	fwdir[sizeof(fwdir) - 1] = 0; /* Terminate string */
+
+	printf(LOG_PREFIX "Checking for firmware image directory '%s' on USB"
+		" storage...\n", fwdir);
+	usb_stop();
+	if (usb_init() != 0)
+		return 1;
+
+	/* Check for storage device */
+	if (usb_stor_scan(1) != 0) {
+		usb_stop();
+		return 1;
+	}
+
+	/* Detect storage device */
+	for (devno = 0; devno < USB_MAX_STOR_DEV; devno++) {
+		stor_dev = usb_stor_get_dev(devno);
+		if (stor_dev->type != DEV_TYPE_UNKNOWN)
+			break;
+	}
+	if (!stor_dev || stor_dev->type == DEV_TYPE_UNKNOWN) {
+		printf(LOG_PREFIX "No valid storage device found...\n");
+		usb_stop();
+		return 1;
+	}
+
+	/* Detect partition */
+	for (partno = -1, i = 0; i < 6; i++) {
+		if (get_partition_info(stor_dev, i, &info) == 0) {
+			if (fat_register_device(stor_dev, i) == 0) {
+				/* Check if rescue image is present */
+				FW_DEBUG("Looking for firmware directory '%s'"
+					" on partition %d\n", fwdir, i);
+				if (do_fat_read(fwdir, NULL, 0, LS_NO) == -1) {
+					FW_DEBUG("No NX rescue image on "
+						"partition %d.\n", i);
+					partno = -2;
+				} else {
+					partno = i;
+					FW_DEBUG("Partition %d contains "
+						"firmware directory\n", partno);
+					break;
+				}
+			}
+		}
+	}
+
+	if (partno < 0) {
+		switch (partno) {
+		case -1:
+			printf(LOG_PREFIX "Error: No valid (FAT) partition "
+				"detected\n");
+			break;
+		case -2:
+			printf(LOG_PREFIX "Error: No NX rescue image on FAT "
+				"partition\n");
+			break;
+		default:
+			printf(LOG_PREFIX "Error: Failed with code %d\n",
+				partno);
+		}
+		usb_stop();
+		return 1;
+	}
+
+	/* Load the rescue image */
+	bcmd = find_cmd("fatload");
+	if (!bcmd) {
+		printf(LOG_PREFIX "Error - 'fatload' command not present.\n");
+		usb_stop();
+		return 1;
+	}
+
+	tmp = getenv("nx-rescue-image");
+	sprintf(nxri, "%s/%s", fwdir, tmp ? tmp : RESCUE_IMAGE);
+	sprintf(dev, "%d:%d", devno, partno);
+	sprintf(addr_str, "%lx", addr);
+
+	FW_DEBUG("fat_fsload device='%s', addr='%s', file: %s\n",
+		dev, addr_str, nxri);
+
+	if (do_fat_fsload(bcmd, 0, 5, argv) != 0) {
+		usb_stop();
+		return 1;
+	}
+
+	/* Stop USB */
+	usb_stop();
+	return 0;
+}
diff --git a/qemu/roms/u-boot/board/cm5200/fwupdate.h b/qemu/roms/u-boot/board/cm5200/fwupdate.h
new file mode 100644
index 000000000..6ddf0bac3
--- /dev/null
+++ b/qemu/roms/u-boot/board/cm5200/fwupdate.h
@@ -0,0 +1,31 @@
+/*
+ * (C) Copyright 2007 Schindler Lift Inc.
+ *
+ * Author: Michel Marti <mma@objectxp.com>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#ifndef __FW_UPDATE_H
+#define __FW_UPDATE_H
+
+/* Default prefix for output messages */
+#define LOG_PREFIX	"CM5200:"
+
+/* Extra debug macro */
+#ifdef CONFIG_FWUPDATE_DEBUG
+#define FW_DEBUG(fmt...) printf(LOG_PREFIX fmt)
+#else
+#define FW_DEBUG(fmt...)
+#endif
+
+/* Name of the directory holding firmware images */
+#define FW_DIR		"nx-fw"
+#define RESCUE_IMAGE	"nxrs.img"
+#define LOAD_ADDR	0x400000
+#define RS_BOOTARGS	"ramdisk_size=8192K"
+
+/* Main function for fwupdate */
+void cm5200_fwupdate(void);
+
+#endif /* __FW_UPDATE_H */