Add qemu 2.4.0

Change-Id: Ic99cbad4b61f8b127b7dc74d04576c0bcbaaf4f5
Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>

11 files changed, 3572 insertions, 0 deletions

diff --git a/qemu/roms/u-boot/board/mpl/common/common_util.c b/qemu/roms/u-boot/board/mpl/common/common_util.c
new file mode 100644
index 000000000..6b96bd526
--- /dev/null
+++ b/qemu/roms/u-boot/board/mpl/common/common_util.c
@@ -0,0 +1,757 @@
+/*
+ * (C) Copyright 2001
+ * Denis Peter, MPL AG Switzerland, d.peter@mpl.ch
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <command.h>
+#include <video_fb.h>
+#include "common_util.h"
+#include <asm/processor.h>
+#include <asm/byteorder.h>
+#include <i2c.h>
+#include <pci.h>
+#include <malloc.h>
+#include <bzlib.h>
+
+#ifdef CONFIG_PIP405
+#include "../pip405/pip405.h"
+#include <asm/4xx_pci.h>
+#endif
+#ifdef CONFIG_MIP405
+#include "../mip405/mip405.h"
+#include <asm/4xx_pci.h>
+#endif
+
+DECLARE_GLOBAL_DATA_PTR;
+
+#if defined(CONFIG_PATI)
+#define FIRM_START 0xFFF00000
+#endif
+
+extern int mem_test(ulong start, ulong ramsize, int quiet);
+
+#define I2C_BACKUP_ADDR 0x7C00		/* 0x200 bytes for backup */
+#define IMAGE_SIZE CONFIG_SYS_MONITOR_LEN	/* ugly, but it works for now */
+
+#if defined(CONFIG_PIP405) || defined(CONFIG_MIP405)
+/*-----------------------------------------------------------------------
+ * On PIP/MIP405 we have 3 (4) possible boot mode
+ *
+ * - Boot from Flash (Flash CS = CS0, MPS CS = CS1)
+ * - Boot from MPS   (Flash CS = CS1, MPS CS = CS0)
+ * - Boot from PCI with Flash map (Flash CS = CS0, MPS CS = CS1)
+ * - Boot from PCI with MPS map   (Flash CS = CS1, MPS CS = CS0)
+ * The flash init is the first board specific routine which is called
+ * after code relocation (running from SDRAM)
+ * The first thing we do is to map the Flash CS to the Flash area and
+ * the MPS CS to the MPS area. Since the flash size is unknown at this
+ * point, we use the max flash size and the lowest flash address as base.
+ *
+ * After flash detection we adjust the size of the CS area accordingly.
+ * update_flash_size() will fix in wrong values in the flash_info structure,
+ * misc_init_r() will fix the values in the board info structure
+ */
+int get_boot_mode(void)
+{
+	unsigned long pbcr;
+	int res = 0;
+	pbcr = mfdcr(CPC0_PSR);
+	if ((pbcr & PSR_ROM_WIDTH_MASK) == 0)
+		/* boot via MPS or MPS mapping */
+		res = BOOT_MPS;
+	if (pbcr & PSR_ROM_LOC)
+		/* boot via PCI.. */
+		res |= BOOT_PCI;
+	 return res;
+}
+
+/* Map the flash high (in boot area)
+   This code can only be executed from SDRAM (after relocation).
+*/
+void setup_cs_reloc(void)
+{
+	int mode;
+	/*
+	 * since we are relocated, we can set-up the CS finaly
+	 * but first of all, switch off PCI mapping (in case it
+	 * was a PCI boot)
+	 */
+	out32r(PMM0MA, 0L);
+	/* get boot mode */
+	mode = get_boot_mode();
+	/*
+	 * we map the flash high in every case
+	 * first find out to which CS the flash is attached to
+	 */
+	if (mode & BOOT_MPS) {
+		/* map flash high on CS1 and MPS on CS0 */
+		mtdcr(EBC0_CFGADDR, PB0AP);
+		mtdcr(EBC0_CFGDATA, MPS_AP);
+		mtdcr(EBC0_CFGADDR, PB0CR);
+		mtdcr(EBC0_CFGDATA, MPS_CR);
+		/*
+		 * we use the default values (max values) for the flash
+		 * because its real size is not yet known
+		 */
+		mtdcr(EBC0_CFGADDR, PB1AP);
+		mtdcr(EBC0_CFGDATA, FLASH_AP);
+		mtdcr(EBC0_CFGADDR, PB1CR);
+		mtdcr(EBC0_CFGDATA, FLASH_CR_B);
+	} else {
+		/* map flash high on CS0 and MPS on CS1 */
+		mtdcr(EBC0_CFGADDR, PB1AP);
+		mtdcr(EBC0_CFGDATA, MPS_AP);
+		mtdcr(EBC0_CFGADDR, PB1CR);
+		mtdcr(EBC0_CFGDATA, MPS_CR);
+		/*
+		 * we use the default values (max values) for the flash
+		 * because its real size is not yet known
+		 */
+		mtdcr(EBC0_CFGADDR, PB0AP);
+		mtdcr(EBC0_CFGDATA, FLASH_AP);
+		mtdcr(EBC0_CFGADDR, PB0CR);
+		mtdcr(EBC0_CFGDATA, FLASH_CR_B);
+	}
+}
+#endif /* #if defined(CONFIG_PIP405) || defined(CONFIG_MIP405) */
+
+#ifdef CONFIG_SYS_UPDATE_FLASH_SIZE
+/* adjust flash start and protection info */
+int update_flash_size(int flash_size)
+{
+	int i = 0, mode;
+	flash_info_t *info = &flash_info[0];
+	unsigned long flashcr;
+	unsigned long flash_base = (0 - flash_size) & 0xFFF00000;
+
+	if (flash_size > 128*1024*1024) {
+		printf("\n ### ERROR, wrong flash size: %X, reset board ###\n",
+		       flash_size);
+		hang();
+	}
+
+	if ((flash_size >> 20) != 0)
+		i = __ilog2(flash_size >> 20);
+
+	/* set up flash CS according to the size */
+	mode = get_boot_mode();
+	if (mode & BOOT_MPS) {
+		/* flash is on CS1 */
+		mtdcr(EBC0_CFGADDR, PB1CR);
+		flashcr = mfdcr(EBC0_CFGDATA);
+		/* we map the flash high in every case */
+		flashcr &= 0x0001FFFF; /* mask out address bits */
+		flashcr |= flash_base; /* start addr */
+		flashcr |= (i << 17); /* size addr */
+		mtdcr(EBC0_CFGADDR, PB1CR);
+		mtdcr(EBC0_CFGDATA, flashcr);
+	} else {
+		/* flash is on CS0 */
+		mtdcr(EBC0_CFGADDR, PB0CR);
+		flashcr = mfdcr(EBC0_CFGDATA);
+		/* we map the flash high in every case */
+		flashcr &= 0x0001FFFF; /* mask out address bits */
+		flashcr |= flash_base; /* start addr */
+		flashcr |= (i << 17); /* size addr */
+		mtdcr(EBC0_CFGADDR, PB0CR);
+		mtdcr(EBC0_CFGDATA, flashcr);
+	}
+
+	for (i = 0; i < info->sector_count; i++)
+		/* adjust sector start address */
+		info->start[i] = flash_base +
+				(info->start[i] - CONFIG_SYS_FLASH_BASE);
+
+	/* unprotect all sectors */
+	flash_protect(FLAG_PROTECT_CLEAR,
+		      info->start[0],
+		      0xFFFFFFFF,
+		      info);
+	flash_protect_default();
+	/* protect reset vector too*/
+	flash_protect(FLAG_PROTECT_SET,
+		      info->start[info->sector_count-1],
+		      0xFFFFFFFF,
+		      info);
+
+	return 0;
+}
+#endif
+
+static int
+mpl_prg(uchar *src, ulong size)
+{
+	ulong start;
+	flash_info_t *info = &flash_info[0];
+	int i, rc;
+#if defined(CONFIG_PATI)
+	int start_sect;
+#endif
+#if defined(CONFIG_PIP405) || defined(CONFIG_MIP405) || defined(CONFIG_PATI)
+	char *copystr = (char *)src;
+	ulong *magic = (ulong *)src;
+#endif
+
+#if defined(CONFIG_PIP405) || defined(CONFIG_MIP405) || defined(CONFIG_PATI)
+	if (uimage_to_cpu (magic[0]) != IH_MAGIC) {
+		puts("Bad Magic number\n");
+		return -1;
+	}
+	/* some more checks before we delete the Flash... */
+	/* Checking the ISO_STRING prevents to program a
+	 * wrong Firmware Image into the flash.
+	 */
+	i = 4; /* skip Magic number */
+	while (1) {
+		if (strncmp(&copystr[i], "MEV-", 4) == 0)
+			break;
+		if (i++ >= 0x100) {
+			puts("Firmware Image for unknown Target\n");
+			return -1;
+		}
+	}
+	/* we have the ISO STRING, check */
+	if (strncmp(&copystr[i], CONFIG_ISO_STRING, sizeof(CONFIG_ISO_STRING)-1) != 0) {
+		printf("Wrong Firmware Image: %s\n", &copystr[i]);
+		return -1;
+	}
+#if !defined(CONFIG_PATI)
+	start = 0 - size;
+
+	/* unprotect sectors used by u-boot */
+	flash_protect(FLAG_PROTECT_CLEAR,
+		      start,
+		      0xFFFFFFFF,
+		      info);
+
+	/* search start sector */
+	for (i = info->sector_count-1; i > 0; i--)
+		if (start >= info->start[i])
+			break;
+
+	/* now erase flash */
+	printf("Erasing at %lx (sector %d) (start %lx)\n",
+				start,i,info->start[i]);
+	if ((rc = flash_erase (info, i, info->sector_count-1)) != 0) {
+		puts("ERROR ");
+		flash_perror(rc);
+		return (1);
+	}
+
+#else /* #if !defined(CONFIG_PATI */
+	start = FIRM_START;
+	start_sect = -1;
+
+	/* search start sector */
+	for (i = info->sector_count-1; i > 0; i--)
+		if (start >= info->start[i])
+			break;
+
+	start_sect = i;
+
+	for (i = info->sector_count-1; i > 0; i--)
+		if ((start + size) >= info->start[i])
+			break;
+
+	/* unprotect sectors used by u-boot */
+	flash_protect(FLAG_PROTECT_CLEAR,
+		      start,
+		      start + size,
+		      info);
+
+	/* now erase flash */
+	printf ("Erasing at %lx to %lx (sector %d to %d) (%lx to %lx)\n",
+		start, start + size, start_sect, i,
+		info->start[start_sect], info->start[i]);
+	if ((rc = flash_erase (info, start_sect, i)) != 0) {
+		puts ("ERROR ");
+		flash_perror (rc);
+		return (1);
+	}
+#endif /* defined(CONFIG_PATI) */
+
+#elif defined(CONFIG_VCMA9)
+	start = 0;
+
+	/* search end sector */
+	for (i = 0; i < info->sector_count; i++)
+		if (size < info->start[i])
+		    break;
+
+	flash_protect(FLAG_PROTECT_CLEAR,
+		      start,
+		      size,
+		      info);
+
+	/* now erase flash */
+	printf("Erasing at %lx (sector %d) (start %lx)\n",
+				start,0,info->start[0]);
+	if ((rc = flash_erase (info, 0, i)) != 0) {
+		puts("ERROR ");
+		flash_perror(rc);
+		return (1);
+	}
+
+#endif
+	printf("flash erased, programming from 0x%lx 0x%lx Bytes\n",
+		(ulong)src, size);
+	if ((rc = flash_write ((char *)src, start, size)) != 0) {
+		puts("ERROR ");
+		flash_perror(rc);
+		return (1);
+	}
+	puts("OK programming done\n");
+	return 0;
+}
+
+
+static int
+mpl_prg_image(uchar *ld_addr)
+{
+	unsigned long len;
+	uchar *data;
+	image_header_t *hdr = (image_header_t *)ld_addr;
+	int rc;
+
+#if defined(CONFIG_FIT)
+	if (genimg_get_format ((void *)hdr) != IMAGE_FORMAT_LEGACY) {
+		puts ("Non legacy image format not supported\n");
+		return -1;
+	}
+#endif
+
+	if (!image_check_magic (hdr)) {
+		puts("Bad Magic Number\n");
+		return 1;
+	}
+	image_print_contents (hdr);
+	if (!image_check_os (hdr, IH_OS_U_BOOT)) {
+		puts("No U-Boot Image\n");
+		return 1;
+	}
+	if (!image_check_type (hdr, IH_TYPE_FIRMWARE)) {
+		puts("No Firmware Image\n");
+		return 1;
+	}
+	if (!image_check_hcrc (hdr)) {
+		puts("Bad Header Checksum\n");
+		return 1;
+	}
+	puts("Verifying Checksum ... ");
+	if (!image_check_dcrc (hdr)) {
+		puts("Bad Data CRC\n");
+		return 1;
+	}
+	puts("OK\n");
+
+	data = (uchar *)image_get_data (hdr);
+	len = image_get_data_size (hdr);
+
+	if (image_get_comp (hdr) != IH_COMP_NONE) {
+		uchar *buf;
+		/* reserve space for uncompressed image */
+		if ((buf = malloc(IMAGE_SIZE)) == NULL) {
+			puts("Insufficient space for decompression\n");
+			return 1;
+		}
+
+		switch (image_get_comp (hdr)) {
+		case IH_COMP_GZIP:
+			puts("Uncompressing (GZIP) ... ");
+			rc = gunzip ((void *)(buf), IMAGE_SIZE, data, &len);
+			if (rc != 0) {
+				puts("GUNZIP ERROR\n");
+				free(buf);
+				return 1;
+			}
+			puts("OK\n");
+			break;
+#ifdef CONFIG_BZIP2
+		case IH_COMP_BZIP2:
+			puts("Uncompressing (BZIP2) ... ");
+			{
+			uint retlen = IMAGE_SIZE;
+			rc = BZ2_bzBuffToBuffDecompress ((char *)(buf), &retlen,
+				(char *)data, len, 0, 0);
+			len = retlen;
+			}
+			if (rc != BZ_OK) {
+				printf ("BUNZIP2 ERROR: %d\n", rc);
+				free(buf);
+				return 1;
+			}
+			puts("OK\n");
+			break;
+#endif
+		default:
+			printf ("Unimplemented compression type %d\n",
+				image_get_comp (hdr));
+			free(buf);
+			return 1;
+		}
+
+		rc = mpl_prg(buf, len);
+		free(buf);
+	} else {
+		rc = mpl_prg(data, len);
+	}
+
+	return(rc);
+}
+
+#if !defined(CONFIG_PATI)
+void get_backup_values(backup_t *buf)
+{
+	i2c_read(CONFIG_SYS_DEF_EEPROM_ADDR, I2C_BACKUP_ADDR,2,(void *)buf,sizeof(backup_t));
+}
+
+void set_backup_values(int overwrite)
+{
+	backup_t back;
+	int i;
+
+	get_backup_values(&back);
+	if(!overwrite) {
+		if(strncmp(back.signature,"MPL\0",4)==0) {
+			puts("Not possible to write Backup\n");
+			return;
+		}
+	}
+	memcpy(back.signature,"MPL\0",4);
+	i = getenv_f("serial#",back.serial_name,16);
+	if(i < 0) {
+		puts("Not possible to write Backup\n");
+		return;
+	}
+	back.serial_name[16]=0;
+	i = getenv_f("ethaddr",back.eth_addr,20);
+	if(i < 0) {
+		puts("Not possible to write Backup\n");
+		return;
+	}
+	back.eth_addr[20]=0;
+	i2c_write(CONFIG_SYS_DEF_EEPROM_ADDR, I2C_BACKUP_ADDR,2,(void *)&back,sizeof(backup_t));
+}
+
+void clear_env_values(void)
+{
+	backup_t back;
+	unsigned char env_crc[4];
+
+	memset(&back,0xff,sizeof(backup_t));
+	memset(env_crc,0x00,4);
+	i2c_write(CONFIG_SYS_DEF_EEPROM_ADDR,I2C_BACKUP_ADDR,2,(void *)&back,sizeof(backup_t));
+	i2c_write(CONFIG_SYS_DEF_EEPROM_ADDR,CONFIG_ENV_OFFSET,2,(void *)env_crc,4);
+}
+
+/*
+ * check crc of "older" environment
+ */
+int check_env_old_size(ulong oldsize)
+{
+	ulong crc, len, new;
+	unsigned off;
+	uchar buf[64];
+
+	/* read old CRC */
+	eeprom_read (CONFIG_SYS_DEF_EEPROM_ADDR,
+		     CONFIG_ENV_OFFSET,
+		     (uchar *)&crc, sizeof(ulong));
+
+	new = 0;
+	len = oldsize;
+	off = sizeof(long);
+	len = oldsize-off;
+	while (len > 0) {
+		int n = (len > sizeof(buf)) ? sizeof(buf) : len;
+
+		eeprom_read (CONFIG_SYS_DEF_EEPROM_ADDR, CONFIG_ENV_OFFSET+off, buf, n);
+		new = crc32 (new, buf, n);
+		len -= n;
+		off += n;
+	}
+
+	return (crc == new);
+}
+
+static ulong oldsizes[] = {
+	0x200,
+	0x800,
+	0
+};
+
+void copy_old_env(ulong size)
+{
+	uchar name_buf[64];
+	uchar value_buf[0x800];
+	uchar c;
+	ulong len;
+	unsigned off;
+	uchar *name, *value;
+
+	name = &name_buf[0];
+	value = &value_buf[0];
+	len=size;
+	off = sizeof(long);
+	while (len > off) {
+		eeprom_read (CONFIG_SYS_DEF_EEPROM_ADDR, CONFIG_ENV_OFFSET+off, &c, 1);
+		if(c != '=') {
+			*name++=c;
+			off++;
+		}
+		else {
+			*name++='\0';
+			off++;
+			do {
+				eeprom_read (CONFIG_SYS_DEF_EEPROM_ADDR, CONFIG_ENV_OFFSET+off, &c, 1);
+				*value++=c;
+				off++;
+				if(c == '\0')
+					break;
+			} while(len > off);
+			name = &name_buf[0];
+			value = &value_buf[0];
+			if(strncmp((char *)name,"baudrate",8)!=0) {
+				setenv((char *)name,(char *)value);
+			}
+
+		}
+	}
+}
+
+
+void check_env(void)
+{
+	char *s;
+	int i=0;
+	char buf[32];
+	backup_t back;
+
+	s=getenv("serial#");
+	if(!s) {
+		while(oldsizes[i]) {
+			if(check_env_old_size(oldsizes[i]))
+				break;
+			i++;
+		}
+		if(!oldsizes[i]) {
+			/* no old environment has been found */
+			get_backup_values (&back);
+			if (strncmp (back.signature, "MPL\0", 4) == 0) {
+				sprintf (buf, "%s", back.serial_name);
+				setenv ("serial#", buf);
+				sprintf (buf, "%s", back.eth_addr);
+				setenv ("ethaddr", buf);
+				printf ("INFO:  serial# and ethaddr recovered, use saveenv\n");
+				return;
+			}
+		}
+		else {
+			copy_old_env(oldsizes[i]);
+			puts("INFO:  old environment ajusted, use saveenv\n");
+		}
+	}
+	else {
+		/* check if back up is set */
+		get_backup_values(&back);
+		if(strncmp(back.signature,"MPL\0",4)!=0) {
+			set_backup_values(0);
+		}
+	}
+}
+
+#endif /* #if !defined(CONFIG_PATI) */
+
+int do_mplcommon(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+	ulong ld_addr;
+	int result;
+#if !defined(CONFIG_PATI)
+	ulong size = IMAGE_SIZE;
+	ulong src = MULTI_PURPOSE_SOCKET_ADDR;
+	backup_t back;
+#endif
+
+	if (strcmp(argv[1], "flash") == 0)
+	{
+#if defined(CONFIG_CMD_FDC)
+		if (strcmp(argv[2], "floppy") == 0) {
+			char *local_args[3];
+			extern int do_fdcboot (cmd_tbl_t *, int, int, char *[]);
+			puts("\nupdating bootloader image from floppy\n");
+			local_args[0] = argv[0];
+			if(argc==4) {
+				local_args[1] = argv[3];
+				local_args[2] = NULL;
+				ld_addr=simple_strtoul(argv[3], NULL, 16);
+				result=do_fdcboot(cmdtp, 0, 2, local_args);
+			}
+			else {
+				local_args[1] = NULL;
+				ld_addr=CONFIG_SYS_LOAD_ADDR;
+				result=do_fdcboot(cmdtp, 0, 1, local_args);
+			}
+			result=mpl_prg_image((uchar *)ld_addr);
+			return result;
+		}
+#endif
+		if (strcmp(argv[2], "mem") == 0) {
+			if(argc==4) {
+				ld_addr=simple_strtoul(argv[3], NULL, 16);
+			}
+			else {
+				ld_addr=load_addr;
+			}
+			printf ("\nupdating bootloader image from memory at %lX\n",ld_addr);
+			result=mpl_prg_image((uchar *)ld_addr);
+			return result;
+		}
+#if !defined(CONFIG_PATI)
+		if (strcmp(argv[2], "mps") == 0) {
+			puts("\nupdating bootloader image from MPS\n");
+			result=mpl_prg((uchar *)src,size);
+			return result;
+		}
+#endif /* #if !defined(CONFIG_PATI)	*/
+	}
+#if !defined(CONFIG_PATI)
+	if (strcmp(argv[1], "clearenvvalues") == 0)
+	{
+		if (strcmp(argv[2], "yes") == 0)
+		{
+			clear_env_values();
+			return 0;
+		}
+	}
+	if (strcmp(argv[1], "getback") == 0) {
+		get_backup_values(&back);
+		back.signature[3]=0;
+		back.serial_name[16]=0;
+		back.eth_addr[20]=0;
+		printf("GetBackUp: signature: %s\n",back.signature);
+		printf("           serial#:   %s\n",back.serial_name);
+		printf("           ethaddr:   %s\n",back.eth_addr);
+		return 0;
+	}
+	if (strcmp(argv[1], "setback") == 0) {
+		set_backup_values(1);
+		return 0;
+	}
+#endif
+	return cmd_usage(cmdtp);
+}
+
+
+#if defined(CONFIG_CMD_DOC)
+void doc_init (void)
+{
+  doc_probe(MULTI_PURPOSE_SOCKET_ADDR);
+}
+#endif
+
+
+#ifdef CONFIG_VIDEO
+/******************************************************
+ * Routines to display the Board information
+ * to the screen (since the VGA will be initialized as last,
+ * we must resend the infos)
+ */
+
+#ifdef CONFIG_CONSOLE_EXTRA_INFO
+extern GraphicDevice ctfb;
+extern int get_boot_mode(void);
+
+void video_get_info_str (int line_number, char *info)
+{
+	/* init video info strings for graphic console */
+	PPC4xx_SYS_INFO sys_info;
+	char rev;
+	int i,boot;
+	unsigned long pvr;
+	char buf[64];
+	char buf1[32], buf2[32], buf3[32], buf4[32];
+	char cpustr[16];
+	char *s, *e, bc;
+	switch (line_number)
+	{
+	case 2:
+		/* CPU and board infos */
+		pvr=get_pvr();
+		get_sys_info (&sys_info);
+		switch (pvr) {
+			case PVR_405GP_RB: rev='B'; break;
+			case PVR_405GP_RC: rev='C'; break;
+			case PVR_405GP_RD: rev='D'; break;
+			case PVR_405GP_RE: rev='E'; break;
+			case PVR_405GPR_RB: rev='B'; break;
+			default:           rev='?'; break;
+		}
+		if(pvr==PVR_405GPR_RB)
+			sprintf(cpustr,"PPC405GPr %c",rev);
+		else
+			sprintf(cpustr,"PPC405GP %c",rev);
+		/* Board info */
+		i=0;
+		s=getenv ("serial#");
+#ifdef CONFIG_PIP405
+		if (!s || strncmp (s, "PIP405", 6)) {
+			sprintf(buf,"### No HW ID - assuming PIP405");
+		}
+#endif
+#ifdef CONFIG_MIP405
+		if (!s || strncmp (s, "MIP405", 6)) {
+			sprintf(buf,"### No HW ID - assuming MIP405");
+		}
+#endif
+		else {
+			for (e = s; *e; ++e) {
+				if (*e == ' ')
+					break;
+			}
+			for (; s < e; ++s) {
+				if (*s == '_') {
+					++s;
+					break;
+				}
+				buf[i++] = *s;
+			}
+			sprintf(&buf[i]," SN ");
+			i+=4;
+			for (; s < e; ++s) {
+				buf[i++] = *s;
+			}
+			buf[i++]=0;
+		}
+		sprintf (info," %s %s %s MHz (%s/%s/%s MHz)",
+			buf, cpustr,
+			strmhz (buf1, gd->cpu_clk),
+			strmhz (buf2, sys_info.freqPLB),
+			strmhz (buf3, sys_info.freqPLB / sys_info.pllOpbDiv),
+			strmhz (buf4, sys_info.freqPLB / sys_info.pllExtBusDiv));
+		return;
+	case 3:
+		/* Memory Info */
+		boot = get_boot_mode();
+		bc = in8 (CONFIG_PORT_ADDR);
+		sprintf(info, " %luMB RAM, %luMB Flash Cfg 0x%02X %s %s",
+			gd->bd->bi_memsize / 0x100000,
+			gd->bd->bi_flashsize / 0x100000,
+			bc,
+			(boot & BOOT_MPS) ? "MPS boot" : "Flash boot",
+			ctfb.modeIdent);
+		return;
+	case 1:
+		sprintf	(buf, "%s",CONFIG_IDENT_STRING);
+		sprintf (info, " %s", &buf[1]);
+		return;
+    }
+    /* no more info lines */
+    *info = 0;
+    return;
+}
+#endif /* CONFIG_CONSOLE_EXTRA_INFO */
+
+#endif /* CONFIG_VIDEO */
diff --git a/qemu/roms/u-boot/board/mpl/common/common_util.h b/qemu/roms/u-boot/board/mpl/common/common_util.h
new file mode 100644
index 000000000..e81ee35eb
--- /dev/null
+++ b/qemu/roms/u-boot/board/mpl/common/common_util.h
@@ -0,0 +1,32 @@
+/*
+ * (C) Copyright 2001
+ * Denis Peter, MPL AG Switzerland, d.peter@mpl.ch
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+#ifndef _COMMON_UTIL_H_
+#define _COMMON_UTIL_H_
+
+typedef struct {
+	char signature[4];
+	char serial_name[17];	/* "MIP405_1000xxxxx" */
+	char eth_addr[21];	/* "00:60:C2:0a:00:00" */
+} backup_t;
+
+extern flash_info_t flash_info[];	/* info for FLASH chips */
+
+void get_backup_values(backup_t *buf);
+
+#if defined(CONFIG_PIP405) || defined(CONFIG_MIP405)
+#define BOOT_MPS	0x01
+#define BOOT_PCI	0x02
+int get_boot_mode(void);
+void setup_cs_reloc(void);
+#endif
+
+void check_env(void);
+#if defined(CONFIG_CMD_DOC)
+void doc_init (void);
+#endif
+
+#endif /* _COMMON_UTIL_H_ */
diff --git a/qemu/roms/u-boot/board/mpl/common/isa.c b/qemu/roms/u-boot/board/mpl/common/isa.c
new file mode 100644
index 000000000..54ec66bd4
--- /dev/null
+++ b/qemu/roms/u-boot/board/mpl/common/isa.c
@@ -0,0 +1,470 @@
+/*
+ * (C) Copyright 2001
+ * Denis Peter, MPL AG Switzerland
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ *
+ * TODO: clean-up
+ */
+
+#include <common.h>
+#include <asm/processor.h>
+#include <stdio_dev.h>
+#include "isa.h"
+#include "piix4_pci.h"
+#include "kbd.h"
+#include "video.h"
+
+
+#undef	ISA_DEBUG
+
+#ifdef	ISA_DEBUG
+#define	PRINTF(fmt,args...)	printf (fmt ,##args)
+#else
+#define PRINTF(fmt,args...)
+#endif
+
+#if defined(CONFIG_PIP405)
+
+extern int drv_isa_kbd_init (void);
+
+/* fdc (logical device 0) */
+const SIO_LOGDEV_TABLE sio_fdc[] = {
+	{0x60, 3},			/* set IO to FDPort (3F0) */
+	{0x61, 0xF0},		/* set IO to FDPort (3F0) */
+	{0x70, 06},			/* set IRQ 6 for FDPort */
+	{0x74, 02},			/* set DMA 2 for FDPort */
+	{0xF0, 0x05},		/* set to PS2 type */
+	{0xF1, 0x00},	  /* default value */
+	{0x30, 1},			/* and activate the device */
+	{0xFF, 0}				/* end of device table */
+};
+/* paralell port (logical device 3) */
+const SIO_LOGDEV_TABLE sio_pport[] = {
+	{0x60, 3},			/* set IO to PPort (378) */
+	{0x61, 0x78},		/* set IO to PPort (378) */
+	{0x70, 07},			/* set IRQ 7 for PPort */
+	{0xF1, 00},			/* set PPort to normal */
+	{0x30, 1},			/* and activate the device */
+	{0xFF, 0}				/* end of device table */
+};
+/* paralell port (logical device 3) Floppy assigned to lpt */
+const SIO_LOGDEV_TABLE sio_pport_fdc[] = {
+	{0x60, 3},			/* set IO to PPort (378) */
+	{0x61, 0x78},		/* set IO to PPort (378) */
+	{0x70, 07},			/* set IRQ 7 for PPort */
+	{0xF1, 02},			/* set PPort to Floppy */
+	{0x30, 1},			/* and activate the device */
+	{0xFF, 0}				/* end of device table */
+};
+/* uart 1 (logical device 4) */
+const SIO_LOGDEV_TABLE sio_com1[] = {
+	{0x60, 3},			/* set IO to COM1 (3F8) */
+	{0x61, 0xF8},		/* set IO to COM1 (3F8) */
+	{0x70, 04},			/* set IRQ 4 for COM1 */
+	{0x30, 1},			/* and activate the device */
+	{0xFF, 0}				/* end of device table */
+};
+/* uart 2 (logical device 5) */
+const SIO_LOGDEV_TABLE sio_com2[] = {
+	{0x60, 2},			/* set IO to COM2 (2F8) */
+	{0x61, 0xF8},		/* set IO to COM2 (2F8) */
+	{0x70, 03},			/* set IRQ 3 for COM2 */
+	{0x30, 1},			/* and activate the device */
+	{0xFF, 0}				/* end of device table */
+};
+
+/* keyboard controller (logical device 7) */
+const SIO_LOGDEV_TABLE sio_keyboard[] = {
+	{0x70, 1},			/* set IRQ 1 for keyboard */
+	{0x72, 12},			/* set IRQ 12 for mouse */
+	{0xF0, 0},			/* disable Port92 (this is a PowerPC!!) */
+	{0x30, 1},			/* and activate the device */
+	{0xFF, 0}				/* end of device table */
+};
+
+
+/*******************************************************************************
+* Config SuperIO FDC37C672
+********************************************************************************/
+unsigned char open_cfg_super_IO(int address)
+{
+	out8(CONFIG_SYS_ISA_IO_BASE_ADDRESS | address,0x55); /* open config */
+	out8(CONFIG_SYS_ISA_IO_BASE_ADDRESS | address,0x20); /* set address to DEV ID */
+	if(in8(CONFIG_SYS_ISA_IO_BASE_ADDRESS | address | 0x1)==0x40) /* ok Device ID is correct */
+		return true;
+	else
+		return false;
+}
+
+void close_cfg_super_IO(int address)
+{
+	out8(CONFIG_SYS_ISA_IO_BASE_ADDRESS | address,0xAA); /* close config */
+}
+
+
+unsigned char read_cfg_super_IO(int address, unsigned char function, unsigned char regaddr)
+{
+	/* assuming config reg is open */
+	out8(CONFIG_SYS_ISA_IO_BASE_ADDRESS | address,0x7); /* points to the function reg */
+	out8(CONFIG_SYS_ISA_IO_BASE_ADDRESS | address | 1,function); /* set the function no */
+	out8(CONFIG_SYS_ISA_IO_BASE_ADDRESS | address,regaddr); /* sets the address in the function */
+	return in8(CONFIG_SYS_ISA_IO_BASE_ADDRESS | address | 1);
+}
+
+void write_cfg_super_IO(int address, unsigned char function, unsigned char regaddr, unsigned char data)
+{
+	/* assuming config reg is open */
+	out8(CONFIG_SYS_ISA_IO_BASE_ADDRESS | address,0x7); /* points to the function reg */
+	out8(CONFIG_SYS_ISA_IO_BASE_ADDRESS | address | 1,function); /* set the function no */
+	out8(CONFIG_SYS_ISA_IO_BASE_ADDRESS | address,regaddr); /* sets the address in the function */
+	out8(CONFIG_SYS_ISA_IO_BASE_ADDRESS | address | 1,data); /* writes the data */
+}
+
+void isa_write_table(SIO_LOGDEV_TABLE *ldt,unsigned char ldev)
+{
+	while (ldt->index != 0xFF) {
+		write_cfg_super_IO(SIO_CFG_PORT, ldev, ldt->index, ldt->val);
+		ldt++;
+	} /* endwhile */
+}
+
+void isa_sio_loadtable(void)
+{
+	char *s = getenv("floppy");
+	/* setup Floppy device 0*/
+	isa_write_table((SIO_LOGDEV_TABLE *)&sio_fdc,0);
+	/* setup parallel port device 3 */
+	if(s && !strncmp(s, "lpt", 3)) {
+		printf("SIO:   Floppy assigned to LPT\n");
+		/* floppy is assigned to the LPT */
+		isa_write_table((SIO_LOGDEV_TABLE *)&sio_pport_fdc,3);
+	}
+	else {
+		/*printf("Floppy assigned to internal port\n");*/
+		isa_write_table((SIO_LOGDEV_TABLE *)&sio_pport,3);
+	}
+	/* setup Com1 port device 4 */
+	isa_write_table((SIO_LOGDEV_TABLE *)&sio_com1,4);
+	/* setup Com2 port device 5 */
+	isa_write_table((SIO_LOGDEV_TABLE *)&sio_com2,5);
+	/* setup keyboards device 7 */
+	isa_write_table((SIO_LOGDEV_TABLE *)&sio_keyboard,7);
+}
+
+
+void isa_sio_setup(void)
+{
+	if (open_cfg_super_IO(SIO_CFG_PORT) == true)
+	{
+		isa_sio_loadtable();
+		close_cfg_super_IO(0x3F0);
+	}
+}
+#endif
+
+/******************************************************************************
+ * IRQ Controller
+ * we use the Vector mode
+ */
+
+struct	isa_irq_action {
+	 interrupt_handler_t *handler;
+	 void *arg;
+	 int count;
+};
+
+static struct isa_irq_action isa_irqs[16];
+
+
+/*
+ * This contains the irq mask for both 8259A irq controllers,
+ */
+static unsigned int cached_irq_mask = 0xfff9;
+
+#define cached_imr1	(unsigned char)cached_irq_mask
+#define cached_imr2	(unsigned char)(cached_irq_mask>>8)
+#define IMR_1		CONFIG_SYS_ISA_IO_BASE_ADDRESS + PIIX4_ISA_INT1_OCW1
+#define IMR_2		CONFIG_SYS_ISA_IO_BASE_ADDRESS + PIIX4_ISA_INT2_OCW1
+#define ICW1_1	CONFIG_SYS_ISA_IO_BASE_ADDRESS + PIIX4_ISA_INT1_ICW1
+#define ICW1_2	CONFIG_SYS_ISA_IO_BASE_ADDRESS + PIIX4_ISA_INT2_ICW1
+#define ICW2_1	CONFIG_SYS_ISA_IO_BASE_ADDRESS + PIIX4_ISA_INT1_ICW2
+#define ICW2_2	CONFIG_SYS_ISA_IO_BASE_ADDRESS + PIIX4_ISA_INT2_ICW2
+#define ICW3_1	ICW2_1
+#define ICW3_2	ICW2_2
+#define ICW4_1	ICW2_1
+#define ICW4_2	ICW2_2
+#define ISR_1		ICW1_1
+#define ISR_2		ICW1_2
+
+
+void disable_8259A_irq(unsigned int irq)
+{
+	unsigned int mask = 1 << irq;
+
+	cached_irq_mask |= mask;
+	if (irq & 8)
+		out8(IMR_2,cached_imr2);
+	else
+		out8(IMR_1,cached_imr1);
+}
+
+void enable_8259A_irq(unsigned int irq)
+{
+	unsigned int mask = ~(1 << irq);
+
+	cached_irq_mask &= mask;
+	if (irq & 8)
+		out8(IMR_2,cached_imr2);
+	else
+		out8(IMR_1,cached_imr1);
+}
+/*
+int i8259A_irq_pending(unsigned int irq)
+{
+	unsigned int mask = 1<<irq;
+	int ret;
+
+	if (irq < 8)
+		ret = inb(0x20) & mask;
+	else
+		ret = inb(0xA0) & (mask >> 8);
+	spin_unlock_irqrestore(&i8259A_lock, flags);
+
+	return ret;
+}
+*/
+
+/*
+ * This function assumes to be called rarely. Switching between
+ * 8259A registers is slow.
+ */
+int i8259A_irq_real(unsigned int irq)
+{
+	int value;
+	int irqmask = 1<<irq;
+
+	if (irq < 8) {
+		out8(ISR_1,0x0B);		/* ISR register */
+		value = in8(ISR_1) & irqmask;
+		out8(ISR_1,0x0A);		/* back to the IRR register */
+		return value;
+	}
+	out8(ISR_2,0x0B);		/* ISR register */
+	value = in8(ISR_2) & (irqmask >> 8);
+	out8(ISR_2,0x0A);		/* back to the IRR register */
+	return value;
+}
+
+/*
+ * Careful! The 8259A is a fragile beast, it pretty
+ * much _has_ to be done exactly like this (mask it
+ * first, _then_ send the EOI, and the order of EOI
+ * to the two 8259s is important!
+ */
+void mask_and_ack_8259A(unsigned int irq)
+{
+	unsigned int irqmask = 1 << irq;
+	unsigned int temp_irqmask = cached_irq_mask;
+	/*
+	 * Lightweight spurious IRQ detection. We do not want
+	 * to overdo spurious IRQ handling - it's usually a sign
+	 * of hardware problems, so we only do the checks we can
+	 * do without slowing down good hardware unnecesserily.
+	 *
+	 * Note that IRQ7 and IRQ15 (the two spurious IRQs
+	 * usually resulting from the 8259A-1|2 PICs) occur
+	 * even if the IRQ is masked in the 8259A. Thus we
+	 * can check spurious 8259A IRQs without doing the
+	 * quite slow i8259A_irq_real() call for every IRQ.
+	 * This does not cover 100% of spurious interrupts,
+	 * but should be enough to warn the user that there
+	 * is something bad going on ...
+	 */
+	if (temp_irqmask & irqmask)
+		goto spurious_8259A_irq;
+	temp_irqmask |= irqmask;
+
+handle_real_irq:
+	if (irq & 8) {
+		in8(IMR_2);		/* DUMMY - (do we need this?) */
+		out8(IMR_2,(unsigned char)(temp_irqmask>>8));
+		out8(ISR_2,0x60+(irq&7));/* 'Specific EOI' to slave */
+		out8(ISR_1,0x62);	/* 'Specific EOI' to master-IRQ2 */
+		out8(IMR_2,cached_imr2); /* turn it on again */
+	} else {
+		in8(IMR_1);		/* DUMMY - (do we need this?) */
+		out8(IMR_1,(unsigned char)temp_irqmask);
+		out8(ISR_1,0x60+irq);	/* 'Specific EOI' to master */
+		out8(IMR_1,cached_imr1); /* turn it on again */
+	}
+
+	return;
+
+spurious_8259A_irq:
+	/*
+	 * this is the slow path - should happen rarely.
+	 */
+	if (i8259A_irq_real(irq))
+		/*
+		 * oops, the IRQ _is_ in service according to the
+		 * 8259A - not spurious, go handle it.
+		 */
+		goto handle_real_irq;
+
+	{
+		static int spurious_irq_mask;
+		/*
+		 * At this point we can be sure the IRQ is spurious,
+		 * lets ACK and report it. [once per IRQ]
+		 */
+		if (!(spurious_irq_mask & irqmask)) {
+			PRINTF("spurious 8259A interrupt: IRQ%d.\n", irq);
+			spurious_irq_mask |= irqmask;
+		}
+		/* irq_err_count++; */
+		/*
+		 * Theoretically we do not have to handle this IRQ,
+		 * but in Linux this does not cause problems and is
+		 * simpler for us.
+		 */
+		goto handle_real_irq;
+	}
+}
+
+void init_8259A(void)
+{
+	out8(IMR_1,0xff);	/* mask all of 8259A-1 */
+	out8(IMR_2,0xff);	/* mask all of 8259A-2 */
+
+	out8(ICW1_1,0x11);	/* ICW1: select 8259A-1 init */
+	out8(ICW2_1,0x20 + 0);	/* ICW2: 8259A-1 IR0-7 mapped to 0x20-0x27 */
+	out8(ICW3_1,0x04);	/* 8259A-1 (the master) has a slave on IR2 */
+	out8(ICW4_1,0x01);	/* master expects normal EOI */
+	out8(ICW1_2,0x11);	/* ICW2: select 8259A-2 init */
+	out8(ICW2_2,0x20 + 8);	/* ICW2: 8259A-2 IR0-7 mapped to 0x28-0x2f */
+	out8(ICW3_2,0x02);	/* 8259A-2 is a slave on master's IR2 */
+	out8(ICW4_2,0x01);	/* (slave's support for AEOI in flat mode
+				    is to be investigated) */
+	udelay(10000);		/* wait for 8259A to initialize */
+	out8(IMR_1,cached_imr1);	/* restore master IRQ mask */
+	udelay(10000);		/* wait for 8259A to initialize */
+	out8(IMR_2,cached_imr2);	/* restore slave IRQ mask */
+}
+
+
+#define PCI_INT_ACK_ADDR 0xEED00000
+
+int handle_isa_int(void)
+{
+	unsigned long irqack;
+	unsigned char irq;
+	/* first we acknokledge the int via the PCI bus */
+	irqack=in32(PCI_INT_ACK_ADDR);
+	/* now we get the ISRs */
+	in8(ISR_2);
+	in8(ISR_1);
+	irq=(unsigned char)irqack;
+	irq-=32;
+/*	if((irq==7)&&((isr1&0x80)==0)) {
+		PRINTF("IRQ7 detected but not in ISR\n");
+	}
+	else {
+*/		/* we should handle cascaded interrupts here also */
+	{
+/*		printf("ISA Irq %d\n",irq); */
+		isa_irqs[irq].count++;
+		if(irq!=2) { /* just swallow the cascade irq 2 */
+			if (isa_irqs[irq].handler != NULL)
+				(*isa_irqs[irq].handler)(isa_irqs[irq].arg);      /* call isr */
+			else {
+				PRINTF ("bogus interrupt vector 0x%x\n", irq);
+			}
+		}
+	}
+	/* issue EOI instruction to clear the IRQ */
+	mask_and_ack_8259A(irq);
+	return 0;
+}
+
+
+/******************************************************************
+ * Install and free an ISA interrupt handler.
+ */
+
+void isa_irq_install_handler(int vec, interrupt_handler_t *handler, void *arg)
+{
+	if (isa_irqs[vec].handler != NULL) {
+		printf ("ISA Interrupt vector %d: handler 0x%x replacing 0x%x\n",
+			vec, (uint)handler, (uint)isa_irqs[vec].handler);
+	}
+	isa_irqs[vec].handler = handler;
+	isa_irqs[vec].arg     = arg;
+	enable_8259A_irq(vec);
+	PRINTF ("Install ISA IRQ %d ==> %p, @ %p mask=%04x\n", vec, handler, &isa_irqs[vec].handler,cached_irq_mask);
+
+}
+
+void isa_irq_free_handler(int vec)
+{
+	disable_8259A_irq(vec);
+	isa_irqs[vec].handler = NULL;
+	isa_irqs[vec].arg     = NULL;
+	PRINTF ("Free ISA IRQ %d mask=%04x\n", vec, cached_irq_mask);
+
+}
+
+/****************************************************************************/
+void isa_init_irq_contr(void)
+{
+	int i;
+	/* disable all Interrupts */
+	/* first write icws controller 1 */
+	for(i=0;i<16;i++)
+	{
+		isa_irqs[i].handler=NULL;
+		isa_irqs[i].arg=NULL;
+		isa_irqs[i].count=0;
+	}
+	init_8259A();
+	out8(IMR_2,0xFF);
+}
+/*************************************************************************/
+
+void isa_show_irq(void)
+{
+	int vec;
+
+	printf ("\nISA Interrupt-Information:\n");
+	printf ("Nr  Routine   Arg       Count\n");
+
+	for (vec=0; vec<16; vec++) {
+		if (isa_irqs[vec].handler != NULL) {
+			printf ("%02d  %08lx  %08lx  %d\n",
+				vec,
+				(ulong)isa_irqs[vec].handler,
+				(ulong)isa_irqs[vec].arg,
+				isa_irqs[vec].count);
+		}
+	}
+}
+
+int isa_irq_get_count(int vec)
+{
+	return(isa_irqs[vec].count);
+}
+
+/******************************************************************
+ * Init the ISA bus and devices.
+ */
+
+#if defined(CONFIG_PIP405)
+
+int isa_init(void)
+{
+	isa_sio_setup();
+	isa_init_irq_contr();
+	drv_isa_kbd_init();
+	return 0;
+}
+#endif
diff --git a/qemu/roms/u-boot/board/mpl/common/isa.h b/qemu/roms/u-boot/board/mpl/common/isa.h
new file mode 100644
index 000000000..c706d679c
--- /dev/null
+++ b/qemu/roms/u-boot/board/mpl/common/isa.h
@@ -0,0 +1,41 @@
+/*
+ * (C) Copyright 2001
+ * Denis Peter, MPL AG Switzerland, d.peter@mpl.ch
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#ifndef _ISA_H_
+#define _ISA_H_
+/* Super IO */
+#define SIO_CFG_PORT	0x3F0	/* Config Port Address */
+
+#if defined(CONFIG_PIP405)
+/* table fore SIO initialization */
+typedef struct {
+	const uchar index;
+	const uchar val;
+} SIO_LOGDEV_TABLE;
+
+typedef struct {
+	const uchar ldev;
+	const SIO_LOGDEV_TABLE *ldev_table;
+} SIO_TABLE;
+
+
+unsigned char open_cfg_super_IO(int address);
+unsigned char read_cfg_super_IO(int address, unsigned char function, unsigned char regaddr);
+void write_cfg_super_IO(int address, unsigned char function, unsigned char regaddr, unsigned char data);
+void close_cfg_super_IO(int address);
+void isa_sio_setup(void);
+#endif
+
+void isa_irq_install_handler(int vec, interrupt_handler_t *handler, void *arg);
+void isa_irq_free_handler(int vec);
+int handle_isa_int(void);
+void isa_init_irq_contr(void);
+void isa_show_irq(void);
+int isa_irq_get_count(int vec);
+
+
+#endif
diff --git a/qemu/roms/u-boot/board/mpl/common/kbd.c b/qemu/roms/u-boot/board/mpl/common/kbd.c
new file mode 100644
index 000000000..1b5487b14
--- /dev/null
+++ b/qemu/roms/u-boot/board/mpl/common/kbd.c
@@ -0,0 +1,626 @@
+/*
+ * (C) Copyright 2001
+ * Denis Peter, MPL AG Switzerland, d.peter@mpl.ch
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ *
+ * Source partly derived from:
+ * linux/drivers/char/pc_keyb.c
+ */
+#include <common.h>
+#include <asm/processor.h>
+#include <stdio_dev.h>
+#include "isa.h"
+#include "kbd.h"
+
+
+unsigned char kbd_read_status(void);
+unsigned char kbd_read_input(void);
+void kbd_send_data(unsigned char data);
+void disable_8259A_irq(unsigned int irq);
+void enable_8259A_irq(unsigned int irq);
+
+/* used only by send_data - set by keyboard_interrupt */
+
+
+#undef KBG_DEBUG
+
+#ifdef KBG_DEBUG
+#define	PRINTF(fmt,args...)	printf (fmt ,##args)
+#else
+#define PRINTF(fmt,args...)
+#endif
+
+#define KBD_STAT_KOBF		0x01
+#define KBD_STAT_IBF		0x02
+#define KBD_STAT_SYS		0x04
+#define KBD_STAT_CD		0x08
+#define KBD_STAT_LOCK		0x10
+#define KBD_STAT_MOBF		0x20
+#define KBD_STAT_TI_OUT		0x40
+#define KBD_STAT_PARERR		0x80
+
+#define KBD_INIT_TIMEOUT	1000	/* Timeout in ms for initializing the keyboard */
+#define KBC_TIMEOUT		250	/* Timeout in ms for sending to keyboard controller */
+#define KBD_TIMEOUT		2000	/* Timeout in ms for keyboard command acknowledge */
+/*
+ *	Keyboard Controller Commands
+ */
+
+#define KBD_CCMD_READ_MODE	0x20	/* Read mode bits */
+#define KBD_CCMD_WRITE_MODE	0x60	/* Write mode bits */
+#define KBD_CCMD_GET_VERSION	0xA1	/* Get controller version */
+#define KBD_CCMD_MOUSE_DISABLE	0xA7	/* Disable mouse interface */
+#define KBD_CCMD_MOUSE_ENABLE	0xA8	/* Enable mouse interface */
+#define KBD_CCMD_TEST_MOUSE	0xA9	/* Mouse interface test */
+#define KBD_CCMD_SELF_TEST	0xAA	/* Controller self test */
+#define KBD_CCMD_KBD_TEST	0xAB	/* Keyboard interface test */
+#define KBD_CCMD_KBD_DISABLE	0xAD	/* Keyboard interface disable */
+#define KBD_CCMD_KBD_ENABLE	0xAE	/* Keyboard interface enable */
+#define KBD_CCMD_WRITE_AUX_OBUF	0xD3    /* Write to output buffer as if
+					   initiated by the auxiliary device */
+#define KBD_CCMD_WRITE_MOUSE	0xD4	/* Write the following byte to the mouse */
+
+/*
+ *	Keyboard Commands
+ */
+
+#define KBD_CMD_SET_LEDS	0xED	/* Set keyboard leds */
+#define KBD_CMD_SET_RATE	0xF3	/* Set typematic rate */
+#define KBD_CMD_ENABLE		0xF4	/* Enable scanning */
+#define KBD_CMD_DISABLE		0xF5	/* Disable scanning */
+#define KBD_CMD_RESET		0xFF	/* Reset */
+
+/*
+ *	Keyboard Replies
+ */
+
+#define KBD_REPLY_POR		0xAA	/* Power on reset */
+#define KBD_REPLY_ACK		0xFA	/* Command ACK */
+#define KBD_REPLY_RESEND	0xFE	/* Command NACK, send the cmd again */
+
+/*
+ *	Status Register Bits
+ */
+
+#define KBD_STAT_OBF		0x01	/* Keyboard output buffer full */
+#define KBD_STAT_IBF		0x02	/* Keyboard input buffer full */
+#define KBD_STAT_SELFTEST	0x04	/* Self test successful */
+#define KBD_STAT_CMD		0x08	/* Last write was a command write (0=data) */
+#define KBD_STAT_UNLOCKED	0x10	/* Zero if keyboard locked */
+#define KBD_STAT_MOUSE_OBF	0x20	/* Mouse output buffer full */
+#define KBD_STAT_GTO		0x40	/* General receive/xmit timeout */
+#define KBD_STAT_PERR		0x80	/* Parity error */
+
+#define AUX_STAT_OBF (KBD_STAT_OBF | KBD_STAT_MOUSE_OBF)
+
+/*
+ *	Controller Mode Register Bits
+ */
+
+#define KBD_MODE_KBD_INT	0x01	/* Keyboard data generate IRQ1 */
+#define KBD_MODE_MOUSE_INT	0x02	/* Mouse data generate IRQ12 */
+#define KBD_MODE_SYS		0x04	/* The system flag (?) */
+#define KBD_MODE_NO_KEYLOCK	0x08	/* The keylock doesn't affect the keyboard if set */
+#define KBD_MODE_DISABLE_KBD	0x10	/* Disable keyboard interface */
+#define KBD_MODE_DISABLE_MOUSE	0x20	/* Disable mouse interface */
+#define KBD_MODE_KCC		0x40	/* Scan code conversion to PC format */
+#define KBD_MODE_RFU		0x80
+
+
+#define KDB_DATA_PORT		0x60
+#define KDB_COMMAND_PORT	0x64
+
+#define	LED_SCR			0x01	/* scroll lock led */
+#define	LED_CAP			0x04	/* caps lock led */
+#define	LED_NUM			0x02	/* num lock led */
+
+#define	KBD_BUFFER_LEN		0x20	/* size of the keyboardbuffer */
+
+
+static volatile char kbd_buffer[KBD_BUFFER_LEN];
+static volatile int in_pointer = 0;
+static volatile int out_pointer = 0;
+
+
+static unsigned char num_lock = 0;
+static unsigned char caps_lock = 0;
+static unsigned char scroll_lock = 0;
+static unsigned char shift = 0;
+static unsigned char ctrl = 0;
+static unsigned char alt = 0;
+static unsigned char e0 = 0;
+static unsigned char leds = 0;
+
+#define DEVNAME "kbd"
+
+/* Simple translation table for the keys */
+
+static unsigned char kbd_plain_xlate[] = {
+	0xff,0x1b, '1', '2', '3', '4', '5', '6', '7', '8', '9', '0', '-', '=','\b','\t',	/* 0x00 - 0x0f */
+	 'q', 'w', 'e', 'r', 't', 'y', 'u', 'i', 'o', 'p', '[', ']','\r',0xff, 'a', 's',	/* 0x10 - 0x1f */
+	 'd', 'f', 'g', 'h', 'j', 'k', 'l', ';','\'', '`',0xff,'\\', 'z', 'x', 'c', 'v',	/* 0x20 - 0x2f */
+	 'b', 'n', 'm', ',', '.', '/',0xff,0xff,0xff, ' ',0xff,0xff,0xff,0xff,0xff,0xff,	/* 0x30 - 0x3f */
+	0xff,0xff,0xff,0xff,0xff,0xff,0xff, '7', '8', '9', '-', '4', '5', '6', '+', '1',	/* 0x40 - 0x4f */
+	 '2', '3', '0', '.',0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,  /* 0x50 - 0x5F */
+	'\r',0xff,0xff
+	};
+
+static unsigned char kbd_shift_xlate[] = {
+	0xff,0x1b, '!', '@', '#', '$', '%', '^', '&', '*', '(', ')', '_', '+','\b','\t',	/* 0x00 - 0x0f */
+	 'Q', 'W', 'E', 'R', 'T', 'Y', 'U', 'I', 'O', 'P', '{', '}','\r',0xff, 'A', 'S',	/* 0x10 - 0x1f */
+	 'D', 'F', 'G', 'H', 'J', 'K', 'L', ':', '"', '~',0xff, '|', 'Z', 'X', 'C', 'V',	/* 0x20 - 0x2f */
+	 'B', 'N', 'M', '<', '>', '?',0xff,0xff,0xff, ' ',0xff,0xff,0xff,0xff,0xff,0xff,	/* 0x30 - 0x3f */
+	0xff,0xff,0xff,0xff,0xff,0xff,0xff, '7', '8', '9', '-', '4', '5', '6', '+', '1',	/* 0x40 - 0x4f */
+	 '2', '3', '0', '.',0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,  /* 0x50 - 0x5F */
+	'\r',0xff,0xff
+	};
+
+static unsigned char kbd_ctrl_xlate[] = {
+	0xff,0x1b, '1',0x00, '3', '4', '5',0x1E, '7', '8', '9', '0',0x1F, '=','\b','\t',	/* 0x00 - 0x0f */
+	0x11,0x17,0x05,0x12,0x14,0x18,0x15,0x09,0x0f,0x10,0x1b,0x1d,'\n',0xff,0x01,0x13,	/* 0x10 - 0x1f */
+	0x04,0x06,0x08,0x09,0x0a,0x0b,0x0c, ';','\'', '~',0x00,0x1c,0x1a,0x18,0x03,0x16,	/* 0x20 - 0x2f */
+	0x02,0x0e,0x0d, '<', '>', '?',0xff,0xff,0xff,0x00,0xff,0xff,0xff,0xff,0xff,0xff,	/* 0x30 - 0x3f */
+	0xff,0xff,0xff,0xff,0xff,0xff,0xff, '7', '8', '9', '-', '4', '5', '6', '+', '1',	/* 0x40 - 0x4f */
+	 '2', '3', '0', '.',0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,  /* 0x50 - 0x5F */
+	'\r',0xff,0xff
+	};
+
+/******************************************************************
+ * Init
+ ******************************************************************/
+int isa_kbd_init(void)
+{
+	char* result;
+	result=kbd_initialize();
+	if(result==NULL) {
+		PRINTF("AT Keyboard initialized\n");
+		irq_install_handler(25, (interrupt_handler_t *)handle_isa_int, NULL);
+		isa_irq_install_handler(KBD_INTERRUPT, (interrupt_handler_t *)kbd_interrupt, NULL);
+		return (1);
+	} else {
+		printf("%s\n",result);
+		return (-1);
+	}
+}
+
+#ifdef CONFIG_SYS_CONSOLE_OVERWRITE_ROUTINE
+extern int overwrite_console (void);
+#else
+int overwrite_console (void)
+{
+	return (0);
+}
+#endif
+
+int drv_isa_kbd_init (void)
+{
+	int error;
+	struct stdio_dev kbddev ;
+	char *stdinname  = getenv ("stdin");
+
+	if(isa_kbd_init()==-1)
+		return -1;
+	memset (&kbddev, 0, sizeof(kbddev));
+	strcpy(kbddev.name, DEVNAME);
+	kbddev.flags =  DEV_FLAGS_INPUT | DEV_FLAGS_SYSTEM;
+	kbddev.putc = NULL ;
+	kbddev.puts = NULL ;
+	kbddev.getc = kbd_getc ;
+	kbddev.tstc = kbd_testc ;
+
+	error = stdio_register (&kbddev);
+	if(error==0) {
+		/* check if this is the standard input device */
+		if(strcmp(stdinname,DEVNAME)==0) {
+			/* reassign the console */
+			if(overwrite_console()) {
+				return 1;
+			}
+			error=console_assign(stdin,DEVNAME);
+			if(error==0)
+				return 1;
+			else
+				return error;
+		}
+		return 1;
+	}
+	return error;
+}
+
+/******************************************************************
+ * Queue handling
+ ******************************************************************/
+/* puts character in the queue and sets up the in and out pointer */
+void kbd_put_queue(char data)
+{
+	if((in_pointer+1)==KBD_BUFFER_LEN) {
+		if(out_pointer==0) {
+			return; /* buffer full */
+		} else{
+			in_pointer=0;
+		}
+	} else {
+		if((in_pointer+1)==out_pointer)
+			return; /* buffer full */
+		in_pointer++;
+	}
+	kbd_buffer[in_pointer]=data;
+	return;
+}
+
+/* test if a character is in the queue */
+int kbd_testc(void)
+{
+	if(in_pointer==out_pointer)
+		return(0); /* no data */
+	else
+		return(1);
+}
+/* gets the character from the queue */
+int kbd_getc(void)
+{
+	char c;
+	while(in_pointer==out_pointer);
+	if((out_pointer+1)==KBD_BUFFER_LEN)
+		out_pointer=0;
+	else
+		out_pointer++;
+	c=kbd_buffer[out_pointer];
+	return (int)c;
+
+}
+
+
+/* set LEDs */
+
+void kbd_set_leds(void)
+{
+	if(caps_lock==0)
+		leds&=~LED_CAP; /* switch caps_lock off */
+	else
+		leds|=LED_CAP; /* switch on LED */
+	if(num_lock==0)
+		leds&=~LED_NUM; /* switch LED off */
+	else
+		leds|=LED_NUM;  /* switch on LED */
+	if(scroll_lock==0)
+		leds&=~LED_SCR; /* switch LED off */
+	else
+		leds|=LED_SCR; /* switch on LED */
+	kbd_send_data(KBD_CMD_SET_LEDS);
+	kbd_send_data(leds);
+}
+
+
+void handle_keyboard_event (unsigned char scancode)
+{
+	unsigned char keycode;
+
+	/*  Convert scancode to keycode */
+	PRINTF ("scancode %x\n", scancode);
+	if (scancode == 0xe0) {
+		e0 = 1;		/* special charakters */
+		return;
+	}
+	if (e0 == 1) {
+		e0 = 0;		/* delete flag */
+		if (!(((scancode & 0x7F) == 0x38) ||	/* the right ctrl key */
+		      ((scancode & 0x7F) == 0x1D) ||	/* the right alt key */
+		      ((scancode & 0x7F) == 0x35) ||	/* the right '/' key */
+		      ((scancode & 0x7F) == 0x1C)))
+			/* the right enter key */
+			/* we swallow unknown e0 codes */
+			return;
+	}
+	/* special cntrl keys */
+	switch (scancode) {
+	case 0x2A:
+	case 0x36:		/* shift pressed */
+		shift = 1;
+		return;		/* do nothing else */
+	case 0xAA:
+	case 0xB6:		/* shift released */
+		shift = 0;
+		return;		/* do nothing else */
+	case 0x38:		/* alt pressed */
+		alt = 1;
+		return;		/* do nothing else */
+	case 0xB8:		/* alt released */
+		alt = 0;
+		return;		/* do nothing else */
+	case 0x1d:		/* ctrl pressed */
+		ctrl = 1;
+		return;		/* do nothing else */
+	case 0x9d:		/* ctrl released */
+		ctrl = 0;
+		return;		/* do nothing else */
+	case 0x46:		/* scrollock pressed */
+		scroll_lock = ~scroll_lock;
+		kbd_set_leds ();
+		return;		/* do nothing else */
+	case 0x3A:		/* capslock pressed */
+		caps_lock = ~caps_lock;
+		kbd_set_leds ();
+		return;
+	case 0x45:		/* numlock pressed */
+		num_lock = ~num_lock;
+		kbd_set_leds ();
+		return;
+	case 0xC6:		/* scroll lock released */
+	case 0xC5:		/* num lock released */
+	case 0xBA:		/* caps lock released */
+		return;		/* just swallow */
+	}
+	if ((scancode & 0x80) == 0x80)	/* key released */
+		return;
+	/* now, decide which table we need */
+	if (scancode > (sizeof (kbd_plain_xlate) / sizeof (kbd_plain_xlate[0]))) {	/* scancode not in list */
+		PRINTF ("unkown scancode %X\n", scancode);
+		return;		/* swallow it */
+	}
+	/* setup plain code first */
+	keycode = kbd_plain_xlate[scancode];
+	if (caps_lock == 1) {	/* caps_lock is pressed, overwrite plain code */
+		if (scancode > (sizeof (kbd_shift_xlate) / sizeof (kbd_shift_xlate[0]))) {	/* scancode not in list */
+			PRINTF ("unkown caps-locked scancode %X\n", scancode);
+			return;	/* swallow it */
+		}
+		keycode = kbd_shift_xlate[scancode];
+		if (keycode < 'A') {	/* we only want the alphas capital */
+			keycode = kbd_plain_xlate[scancode];
+		}
+	}
+	if (shift == 1) {	/* shift overwrites caps_lock */
+		if (scancode > (sizeof (kbd_shift_xlate) / sizeof (kbd_shift_xlate[0]))) {	/* scancode not in list */
+			PRINTF ("unkown shifted scancode %X\n", scancode);
+			return;	/* swallow it */
+		}
+		keycode = kbd_shift_xlate[scancode];
+	}
+	if (ctrl == 1) {	/* ctrl overwrites caps_lock and shift */
+		if (scancode > (sizeof (kbd_ctrl_xlate) / sizeof (kbd_ctrl_xlate[0]))) {	/* scancode not in list */
+			PRINTF ("unkown ctrl scancode %X\n", scancode);
+			return;	/* swallow it */
+		}
+		keycode = kbd_ctrl_xlate[scancode];
+	}
+	/* check if valid keycode */
+	if (keycode == 0xff) {
+		PRINTF ("unkown scancode %X\n", scancode);
+		return;		/* swallow unknown codes */
+	}
+
+	kbd_put_queue (keycode);
+	PRINTF ("%x\n", keycode);
+}
+
+/*
+ * This reads the keyboard status port, and does the
+ * appropriate action.
+ *
+ */
+unsigned char handle_kbd_event(void)
+{
+	unsigned char status = kbd_read_status();
+	unsigned int work = 10000;
+
+	while ((--work > 0) && (status & KBD_STAT_OBF)) {
+		unsigned char scancode;
+
+		scancode = kbd_read_input();
+
+		/* Error bytes must be ignored to make the
+		   Synaptics touchpads compaq use work */
+		/* Ignore error bytes */
+		if (!(status & (KBD_STAT_GTO | KBD_STAT_PERR)))
+		{
+			if (status & KBD_STAT_MOUSE_OBF)
+				; /* not supported: handle_mouse_event(scancode); */
+			else
+				handle_keyboard_event(scancode);
+		}
+		status = kbd_read_status();
+	}
+	if (!work)
+		PRINTF("pc_keyb: controller jammed (0x%02X).\n", status);
+	return status;
+}
+
+
+/******************************************************************************
+ * Lowlevel Part of keyboard section
+ */
+unsigned char kbd_read_status(void)
+{
+	return(in8(CONFIG_SYS_ISA_IO_BASE_ADDRESS + KDB_COMMAND_PORT));
+}
+
+unsigned char kbd_read_input(void)
+{
+	return(in8(CONFIG_SYS_ISA_IO_BASE_ADDRESS + KDB_DATA_PORT));
+}
+
+void kbd_write_command(unsigned char cmd)
+{
+	out8(CONFIG_SYS_ISA_IO_BASE_ADDRESS + KDB_COMMAND_PORT,cmd);
+}
+
+void kbd_write_output(unsigned char data)
+{
+	out8(CONFIG_SYS_ISA_IO_BASE_ADDRESS + KDB_DATA_PORT, data);
+}
+
+int kbd_read_data(void)
+{
+	int val;
+	unsigned char status;
+
+	val = -1;
+	status = kbd_read_status();
+	if (status & KBD_STAT_OBF) {
+		val = kbd_read_input();
+		if (status & (KBD_STAT_GTO | KBD_STAT_PERR))
+			val = -2;
+	}
+	return val;
+}
+
+int kbd_wait_for_input(void)
+{
+	unsigned long timeout;
+	int val;
+
+	timeout = KBD_TIMEOUT;
+	val=kbd_read_data();
+	while(val < 0)
+	{
+		if(timeout--==0)
+			return -1;
+		udelay(1000);
+		val=kbd_read_data();
+	}
+	return val;
+}
+
+
+int kb_wait(void)
+{
+	unsigned long timeout = KBC_TIMEOUT * 10;
+
+	do {
+		unsigned char status = handle_kbd_event();
+		if (!(status & KBD_STAT_IBF))
+			return 0; /* ok */
+		udelay(1000);
+		timeout--;
+	} while (timeout);
+	return 1;
+}
+
+void kbd_write_command_w(int data)
+{
+	if(kb_wait())
+		PRINTF("timeout in kbd_write_command_w\n");
+	kbd_write_command(data);
+}
+
+void kbd_write_output_w(int data)
+{
+	if(kb_wait())
+		PRINTF("timeout in kbd_write_output_w\n");
+	kbd_write_output(data);
+}
+
+void kbd_send_data(unsigned char data)
+{
+	unsigned char status;
+	disable_8259A_irq(1); /* disable interrupt */
+	kbd_write_output_w(data);
+	status = kbd_wait_for_input();
+	if (status == KBD_REPLY_ACK)
+		enable_8259A_irq(1); /* enable interrupt */
+}
+
+
+char * kbd_initialize(void)
+{
+	int status;
+
+	in_pointer = 0; /* delete in Buffer */
+	out_pointer = 0;
+	/*
+	 * Test the keyboard interface.
+	 * This seems to be the only way to get it going.
+	 * If the test is successful a x55 is placed in the input buffer.
+	 */
+	kbd_write_command_w(KBD_CCMD_SELF_TEST);
+	if (kbd_wait_for_input() != 0x55)
+		return "Kbd:   failed self test";
+	/*
+	 * Perform a keyboard interface test.  This causes the controller
+	 * to test the keyboard clock and data lines.  The results of the
+	 * test are placed in the input buffer.
+	 */
+	kbd_write_command_w(KBD_CCMD_KBD_TEST);
+	if (kbd_wait_for_input() != 0x00)
+		return "Kbd:   interface failed self test";
+	/*
+	 * Enable the keyboard by allowing the keyboard clock to run.
+	 */
+	kbd_write_command_w(KBD_CCMD_KBD_ENABLE);
+	status = kbd_wait_for_input();
+	/*
+	 * Reset keyboard. If the read times out
+	 * then the assumption is that no keyboard is
+	 * plugged into the machine.
+	 * This defaults the keyboard to scan-code set 2.
+	 *
+	 * Set up to try again if the keyboard asks for RESEND.
+	 */
+	do {
+		kbd_write_output_w(KBD_CMD_RESET);
+		status = kbd_wait_for_input();
+		if (status == KBD_REPLY_ACK)
+			break;
+		if (status != KBD_REPLY_RESEND) {
+			PRINTF("status: %X\n",status);
+			return "Kbd:   reset failed, no ACK";
+		}
+	} while (1);
+	if (kbd_wait_for_input() != KBD_REPLY_POR)
+		return "Kbd:   reset failed, no POR";
+
+	/*
+	 * Set keyboard controller mode. During this, the keyboard should be
+	 * in the disabled state.
+	 *
+	 * Set up to try again if the keyboard asks for RESEND.
+	 */
+	do {
+		kbd_write_output_w(KBD_CMD_DISABLE);
+		status = kbd_wait_for_input();
+		if (status == KBD_REPLY_ACK)
+			break;
+		if (status != KBD_REPLY_RESEND)
+			return "Kbd:   disable keyboard: no ACK";
+	} while (1);
+
+	kbd_write_command_w(KBD_CCMD_WRITE_MODE);
+	kbd_write_output_w(KBD_MODE_KBD_INT
+			      | KBD_MODE_SYS
+			      | KBD_MODE_DISABLE_MOUSE
+			      | KBD_MODE_KCC);
+
+	/* AMCC powerpc portables need this to use scan-code set 1 -- Cort */
+	kbd_write_command_w(KBD_CCMD_READ_MODE);
+	if (!(kbd_wait_for_input() & KBD_MODE_KCC)) {
+		/*
+		 * If the controller does not support conversion,
+		 * Set the keyboard to scan-code set 1.
+		 */
+		kbd_write_output_w(0xF0);
+		kbd_wait_for_input();
+		kbd_write_output_w(0x01);
+		kbd_wait_for_input();
+	}
+	kbd_write_output_w(KBD_CMD_ENABLE);
+	if (kbd_wait_for_input() != KBD_REPLY_ACK)
+		return "Kbd:   enable keyboard: no ACK";
+
+	/*
+	 * Finally, set the typematic rate to maximum.
+	 */
+	kbd_write_output_w(KBD_CMD_SET_RATE);
+	if (kbd_wait_for_input() != KBD_REPLY_ACK)
+		return "Kbd:   Set rate: no ACK";
+	kbd_write_output_w(0x00);
+	if (kbd_wait_for_input() != KBD_REPLY_ACK)
+		return "Kbd:   Set rate: no ACK";
+	return NULL;
+}
+
+void kbd_interrupt(void)
+{
+	handle_kbd_event();
+}
diff --git a/qemu/roms/u-boot/board/mpl/common/kbd.h b/qemu/roms/u-boot/board/mpl/common/kbd.h
new file mode 100644
index 000000000..7b19b3725
--- /dev/null
+++ b/qemu/roms/u-boot/board/mpl/common/kbd.h
@@ -0,0 +1,18 @@
+/*
+ * (C) Copyright 2001
+ * Denis Peter, MPL AG Switzerland, d.peter@mpl.ch
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#ifndef _KBD_H_
+#define _KBD_H_
+
+extern int kbd_testc(void);
+extern int kbd_getc(void);
+extern void kbd_interrupt(void);
+extern char *kbd_initialize(void);
+
+unsigned char kbd_is_init(void);
+#define KBD_INTERRUPT 1
+#endif
diff --git a/qemu/roms/u-boot/board/mpl/common/pci.c b/qemu/roms/u-boot/board/mpl/common/pci.c
new file mode 100644
index 000000000..cd969cb51
--- /dev/null
+++ b/qemu/roms/u-boot/board/mpl/common/pci.c
@@ -0,0 +1,90 @@
+/*
+ * SPDX-License-Identifier:	GPL-2.0	IBM-pibs
+ */
+/*
+ * Adapted for PIP405 03.07.01
+ * Denis Peter, MPL AG Switzerland, d.peter@mpl.ch
+ *
+ * TODO: Clean-up
+ */
+
+#include <common.h>
+#include <pci.h>
+#include "isa.h"
+
+#ifdef CONFIG_405GP
+#ifdef CONFIG_PCI
+
+DECLARE_GLOBAL_DATA_PTR;
+
+#include "piix4_pci.h"
+#include "pci_parts.h"
+
+void pci_pip405_write_regs(struct pci_controller *hose, pci_dev_t dev,
+			   struct pci_config_table *entry)
+{
+	struct pci_pip405_config_entry *table;
+	int i;
+
+	table = (struct pci_pip405_config_entry*) entry->priv[0];
+
+	for (i=0; table[i].width; i++)
+	{
+#ifdef DEBUG
+		printf("Reg 0x%02X Value 0x%08lX Width %02d written\n",
+		       table[i].index, table[i].val, table[i].width);
+#endif
+
+		switch(table[i].width)
+		{
+		case 1: pci_hose_write_config_byte(hose, dev, table[i].index, table[i].val); break;
+		case 2: pci_hose_write_config_word(hose, dev, table[i].index, table[i].val); break;
+		case 4: pci_hose_write_config_dword(hose, dev, table[i].index, table[i].val); break;
+		}
+	}
+}
+
+
+static void pci_pip405_fixup_irq(struct pci_controller *hose, pci_dev_t dev)
+{
+	unsigned char int_line = 0xff;
+	unsigned char pin;
+	/*
+	 * Write pci interrupt line register
+	 */
+	if(PCI_DEV(dev)==0) /* Device0 = PPC405 -> skip */
+		return;
+	pci_hose_read_config_byte(hose, dev, PCI_INTERRUPT_PIN, &pin);
+	if ((pin == 0) || (pin > 4))
+	    return;
+
+	int_line = ((PCI_DEV(dev) + (pin-1) + 10) % 4) + 28;
+	pci_hose_write_config_byte(hose, dev, PCI_INTERRUPT_LINE, int_line);
+#ifdef DEBUG
+	printf("Fixup IRQ: dev %d (%x) int line %d 0x%x\n",
+	       PCI_DEV(dev),dev,int_line,int_line);
+#endif
+}
+
+extern void pci_405gp_init(struct pci_controller *hose);
+
+
+static struct pci_controller hose = {
+  config_table: pci_pip405_config_table,
+  fixup_irq: pci_pip405_fixup_irq,
+};
+
+
+void pci_init_board(void)
+{
+	/*we want the ptrs to RAM not flash (ie don't use init list)*/
+	hose.fixup_irq    = pci_pip405_fixup_irq;
+	hose.config_table = pci_pip405_config_table;
+#ifdef DEBUG
+	printf("Init PCI: fixup_irq=%p config_table=%p hose=%p\n",pci_pip405_fixup_irq,pci_pip405_config_table,hose);
+#endif
+	pci_405gp_init(&hose);
+}
+
+#endif /* CONFIG_PCI */
+#endif /* CONFIG_405GP */
diff --git a/qemu/roms/u-boot/board/mpl/common/pci_parts.h b/qemu/roms/u-boot/board/mpl/common/pci_parts.h
new file mode 100644
index 000000000..4193e9233
--- /dev/null
+++ b/qemu/roms/u-boot/board/mpl/common/pci_parts.h
@@ -0,0 +1,176 @@
+ /*
+ * (C) Copyright 2001
+ * Denis Peter, MPL AG Switzerland, d.peter@mpl.ch
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+#ifndef _PCI_PARTS_H_
+#define _PCI_PARTS_H_
+
+
+/* Board specific file containing:
+ * - PCI Memory Mapping
+ * - PCI IO Mapping
+ * - PCI Interrupt Mapping
+ */
+
+/* PIP405 PCI INT Routing:
+ *                      IRQ0  VECTOR
+ * PIXX4 IDSEL  = AD16  INTA#  28 (Function 2 USB is INTD# = 31)
+ * VGA   IDSEL  = AD17  INTB#  29
+ * SCSI  IDSEL  = AD18  INTC#  30
+ * PC104 IDSEL0 = AD20  INTA#  28
+ * PC104 IDSEL1 = AD21  INTB#  29
+ * PC104 IDSEL2 = AD22  INTC#  30
+ * PC104 IDSEL3 = AD23  INTD#  31
+ *
+ * busdevfunc = EXXX XXXX BBBB BBBB DDDD DFFF RRRR RR00
+ *              ^         ^         ^     ^   ^
+ *             31        23        15    10   7
+ * E = Enabled
+ * B = Bussnumber
+ * D = Devicenumber (Device0 = AD10)
+ * F = Functionnumber
+ * R = Registernumber
+ *
+ * Device = (busdevfunc>>11) + 10
+ * Vector = devicenumber % 4 + 28
+ *
+ */
+#define PCI_HIGHEST_ON_BOARD_ID	19
+/*#define PCI_DEV_NUMBER(x)	(((x>>11) & 0x1f) + 10) */
+#define PCI_IRQ_VECTOR(x)	((PCI_DEV(x) + 10) % 4) + 28
+
+
+/* PCI Device List for PIP405 */
+
+/* Mapping:
+ * +-------------+------------+------------+--------------------------------+
+ * | PCI MemAddr | PCI IOAddr | Local Addr | Device / Function              |
+ * +-------------+------------+------------+--------------------------------+
+ * |  0x00000000 |            | 0xA0000000 | ISA Memory (hard wired)        |
+ * |  0x00FFFFFF |            | 0xA0FFFFFF |                                |
+ * +-------------+------------+------------+--------------------------------+
+ * |             | 0x00000000 | 0xE8000000 | ISA IO (hard wired)            |
+ * |             | 0x0000FFFF | 0xE800FFFF |                                |
+ * +-------------+------------+------------+--------------------------------+
+ * |  0x80000000 |            | 0x80000000 | VGA Controller Memory          |
+ * |  0x80FFFFFF |            | 0x80FFFFFF |                                |
+ * +-------------+------------+------------+--------------------------------+
+ * |  0x81000000 |            | 0x81000000 | SCSI Controller Memory         |
+ * |  0x81FFFFFF |            | 0x81FFFFFF |                                |
+ * +-------------+------------+------------+--------------------------------+
+ */
+
+struct pci_pip405_config_entry {
+	int		index;	/* address */
+	unsigned long	val;	/* value */
+	int		width;	/* data size */
+};
+
+extern void pci_pip405_write_regs(struct pci_controller *,
+				  pci_dev_t,
+				  struct pci_config_table *);
+
+/* PIIX4 ISA Bridge Function 0 */
+static struct pci_pip405_config_entry piix4_isa_bridge_f0[] = {
+	{PCI_CFG_PIIX4_SERIRQ,	0xD0,		1}, /* enable Continous SERIRQ Pin */
+	{PCI_CFG_PIIX4_GENCFG,	0x00018041,	4}, /* enable SERIRQs, ISA, PNP, GPI11 */
+	{PCI_CFG_PIIX4_TOM,	0xFE,		1}, /* Top of Memory		*/
+	{PCI_CFG_PIIX4_XBCS,	0x02C4,		2}, /* disable all peri CS	*/
+	{PCI_CFG_PIIX4_RTCCFG,	0x21,		1}, /* enable RTC		*/
+#if defined(CONFIG_PIP405)
+	{PCI_CFG_PIIX4_MBDMA,	0x82,		1}, /* set MBDMA0 to DMA 2	*/
+	{PCI_CFG_PIIX4_MBDMA+1,	0x83,		1}, /* set MBDMA1 to DMA 3	*/
+#endif
+	{PCI_CFG_PIIX4_DLC,	0x0,		1}, /* disable passive release feature */
+	{ }					    /* end of device table	*/
+};
+
+/* PIIX4 IDE Controller Function 1 */
+static struct pci_pip405_config_entry piix4_ide_cntrl_f1[] = {
+	{PCI_CFG_PIIX4_BMIBA,	0x0001000,	4}, /* set BMI to a valid address */
+	{PCI_COMMAND,		0x0001,		2}, /* enable IO access	*/
+#if !defined(CONFIG_MIP405T)
+	{PCI_CFG_PIIX4_IDETIM,	0x80008000,	4}, /* enable Both IDE channels	*/
+#else
+	{PCI_CFG_PIIX4_IDETIM,	0x00008000,	4}, /* enable IDE channel0	*/
+#endif
+	{ }					    /* end of device table	*/
+};
+
+/* PIIX4 USB Controller Function 2 */
+static struct pci_pip405_config_entry piix4_usb_cntrl_f2[] = {
+#if !defined(CONFIG_MIP405T)
+	{PCI_INTERRUPT_LINE,	31,		1}, /* Int vector = 31		*/
+	{PCI_BASE_ADDRESS_4,	0x0000E001,	4}, /* Set IO Address to 0xe000 to 0xe01F */
+	{PCI_LATENCY_TIMER,	0x80,		1}, /* Latency Timer 0x80	*/
+	{0xC0,			0x2000,		2}, /* Legacy support		*/
+	{PCI_COMMAND,		0x0005,		2}, /* enable IO access and Master */
+#endif
+	{ }					    /* end of device table	*/
+};
+
+/* PIIX4 Power Management Function 3 */
+static struct pci_pip405_config_entry piix4_pmm_cntrl_f3[] = {
+	{PCI_CFG_PIIX4_PMBA,	0x00004000,	4}, /* set PMBA to "valid" value */
+	{PCI_CFG_PIIX4_SMBBA,	0x00005000,	4}, /* set SMBBA to "valid" value */
+	{PCI_CFG_PIIX4_PMMISC,	0x01,		1}, /* enable PMBA IO access	*/
+	{PCI_COMMAND,		0x0001,		2}, /* enable IO access	*/
+	{ }					    /* end of device table	*/
+};
+/* PPC405 Dummy only used to prevent autosetup on this host bridge */
+static struct pci_pip405_config_entry ppc405_dummy[] = {
+	{ }					    /* end of device table	*/
+};
+
+void pci_405gp_setup_vga(struct pci_controller *hose, pci_dev_t dev,
+			 struct pci_config_table *entry);
+
+
+static struct pci_config_table pci_pip405_config_table[]={
+	{PCI_VENDOR_ID_IBM,			/* 405 dummy */
+	 PCI_DEVICE_ID_IBM_405GP,
+	 PCI_ANY_ID,
+	 PCI_ANY_ID, PCI_ANY_ID, 0,
+	 pci_pip405_write_regs, {(unsigned long) ppc405_dummy}},
+
+	{PCI_VENDOR_ID_INTEL,			/* PIIX4 ISA Bridge Function 0 */
+	 PCI_DEVICE_ID_INTEL_82371AB_0,
+	 PCI_ANY_ID,
+	 PCI_ANY_ID, PCI_ANY_ID, 0,
+	 pci_pip405_write_regs, {(unsigned long) piix4_isa_bridge_f0}},
+
+	{PCI_VENDOR_ID_INTEL,			/* PIIX4 IDE Controller Function 1 */
+	 PCI_DEVICE_ID_INTEL_82371AB,
+	 PCI_ANY_ID,
+	 PCI_ANY_ID, PCI_ANY_ID, 1,
+	 pci_pip405_write_regs, {(unsigned long) piix4_ide_cntrl_f1}},
+
+	{PCI_VENDOR_ID_INTEL,			/* PIIX4 USB Controller Function 2 */
+	 PCI_DEVICE_ID_INTEL_82371AB_2,
+	 PCI_ANY_ID,
+	 PCI_ANY_ID, PCI_ANY_ID, 2,
+	 pci_pip405_write_regs, {(unsigned long) piix4_usb_cntrl_f2}},
+
+	{PCI_VENDOR_ID_INTEL,			/* PIIX4 USB Controller Function 3 */
+	 PCI_DEVICE_ID_INTEL_82371AB_3,
+	 PCI_ANY_ID,
+	 PCI_ANY_ID, PCI_ANY_ID, 3,
+	 pci_pip405_write_regs, {(unsigned long) piix4_pmm_cntrl_f3}},
+
+	{PCI_ANY_ID,
+	 PCI_ANY_ID,
+	 PCI_CLASS_DISPLAY_VGA,
+	 PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+	 pci_405gp_setup_vga},
+
+	{PCI_ANY_ID,
+	 PCI_ANY_ID,
+	 PCI_CLASS_NOT_DEFINED_VGA,
+	 PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+	 pci_405gp_setup_vga},
+
+	{ }
+};
+#endif /* _PCI_PARTS_H_ */
diff --git a/qemu/roms/u-boot/board/mpl/common/piix4_pci.h b/qemu/roms/u-boot/board/mpl/common/piix4_pci.h
new file mode 100644
index 000000000..c19b64e0c
--- /dev/null
+++ b/qemu/roms/u-boot/board/mpl/common/piix4_pci.h
@@ -0,0 +1,149 @@
+/*
+ * (C) Copyright 2001
+ * Denis Peter, MPL AG Switzerland, d.peter@mpl.ch
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+
+#ifndef _PIIX4_PCI_H
+#define _PIIX4_PCI_H
+
+/***************************************************************************
+* Defines PIIX4 Config Registers
+****************************************************************************/
+
+/* Function 0 ISA Bridge */
+#define	PCI_CFG_PIIX4_IORT		0x4C	/* 8 bit ISA Recovery Timer Reg (default 0x4D) */
+#define	PCI_CFG_PIIX4_XBCS		0x4E	/* 16 bit XBus Chip select reg (default 0x0003) */
+#define	PCI_CFG_PIIX4_PIRQC		0x60  /* PCI IRQ Route Register 4 x 8bit (default )*/
+#define	PCI_CFG_PIIX4_SERIRQ	0x64
+#define	PCI_CFG_PIIX4_TOM			0x69
+#define	PCI_CFG_PIIX4_MSTAT		0x6A
+#define	PCI_CFG_PIIX4_MBDMA		0x76
+#define	PCI_CFG_PIIX4_APICBS	0x80
+#define	PCI_CFG_PIIX4_DLC			0x82
+#define	PCI_CFG_PIIX4_PDMACFG	0x90
+#define	PCI_CFG_PIIX4_DDMABS	0x92
+#define	PCI_CFG_PIIX4_GENCFG	0xB0
+#define	PCI_CFG_PIIX4_RTCCFG	0xCB
+
+/* IO Addresses */
+#define PIIX4_ISA_DMA1_CH0BA	0x00
+#define PIIX4_ISA_DMA1_CH0CA	0x01
+#define PIIX4_ISA_DMA1_CH1BA	0x02
+#define PIIX4_ISA_DMA1_CH1CA	0x03
+#define PIIX4_ISA_DMA1_CH2BA	0x04
+#define PIIX4_ISA_DMA1_CH2CA	0x05
+#define PIIX4_ISA_DMA1_CH3BA	0x06
+#define PIIX4_ISA_DMA1_CH3CA	0x07
+#define PIIX4_ISA_DMA1_CMDST	0x08
+#define PIIX4_ISA_DMA1_REQ		0x09
+#define PIIX4_ISA_DMA1_WSBM		0x0A
+#define PIIX4_ISA_DMA1_CH_MOD	0x0B
+#define PIIX4_ISA_DMA1_CLR_PT	0x0C
+#define PIIX4_ISA_DMA1_M_CLR	0x0D
+#define PIIX4_ISA_DMA1_CLR_M	0x0E
+#define PIIX4_ISA_DMA1_RWAMB	0x0F
+
+#define PIIX4_ISA_DMA2_CH0BA	0xC0
+#define PIIX4_ISA_DMA2_CH0CA	0xC1
+#define PIIX4_ISA_DMA2_CH1BA	0xC2
+#define PIIX4_ISA_DMA2_CH1CA	0xC3
+#define PIIX4_ISA_DMA2_CH2BA	0xC4
+#define PIIX4_ISA_DMA2_CH2CA	0xC5
+#define PIIX4_ISA_DMA2_CH3BA	0xC6
+#define PIIX4_ISA_DMA2_CH3CA	0xC7
+#define PIIX4_ISA_DMA2_CMDST	0xD0
+#define PIIX4_ISA_DMA2_REQ		0xD2
+#define PIIX4_ISA_DMA2_WSBM		0xD4
+#define PIIX4_ISA_DMA2_CH_MOD	0xD6
+#define PIIX4_ISA_DMA2_CLR_PT	0xD8
+#define PIIX4_ISA_DMA2_M_CLR	0xDA
+#define PIIX4_ISA_DMA2_CLR_M	0xDC
+#define PIIX4_ISA_DMA2_RWAMB	0xDE
+
+#define PIIX4_ISA_INT1_ICW1		0x20
+#define PIIX4_ISA_INT1_OCW2		0x20
+#define PIIX4_ISA_INT1_OCW3		0x20
+#define PIIX4_ISA_INT1_ICW2		0x21
+#define PIIX4_ISA_INT1_ICW3		0x21
+#define PIIX4_ISA_INT1_ICW4		0x21
+#define PIIX4_ISA_INT1_OCW1		0x21
+
+#define PIIX4_ISA_INT1_ELCR		0x4D0
+
+#define PIIX4_ISA_INT2_ICW1		0xA0
+#define PIIX4_ISA_INT2_OCW2		0xA0
+#define PIIX4_ISA_INT2_OCW3		0xA0
+#define PIIX4_ISA_INT2_ICW2		0xA1
+#define PIIX4_ISA_INT2_ICW3		0xA1
+#define PIIX4_ISA_INT2_ICW4		0xA1
+#define PIIX4_ISA_INT2_OCW1		0xA1
+#define PIIX4_ISA_INT2_IMR		0xA1 /* read only */
+
+#define PIIX4_ISA_INT2_ELCR		0x4D1
+
+#define PIIX4_ISA_TMR0_CNT_ST	0x40
+#define PIIX4_ISA_TMR1_CNT_ST	0x41
+#define PIIX4_ISA_TMR2_CNT_ST	0x42
+#define PIIX4_ISA_TMR_TCW			0x43
+
+#define PIIX4_ISA_RST_XBUS		0x60
+
+#define PIIX4_ISA_NMI_CNT_ST	0x61
+#define PIIX4_ISA_NMI_ENABLE	0x70
+
+#define PIIX4_ISA_RTC_INDEX		0x70
+#define PIIX4_ISA_RTC_DATA		0x71
+#define PIIX4_ISA_RTCEXT_IND	0x70
+#define PIIX4_ISA_RTCEXT_DATA	0x71
+
+#define PIIX4_ISA_DMA1_CH2LPG	0x81
+#define PIIX4_ISA_DMA1_CH3LPG	0x82
+#define PIIX4_ISA_DMA1_CH1LPG	0x83
+#define PIIX4_ISA_DMA1_CH0LPG	0x87
+#define PIIX4_ISA_DMA2_CH2LPG	0x89
+#define PIIX4_ISA_DMA2_CH3LPG	0x8A
+#define PIIX4_ISA_DMA2_CH1LPG	0x8B
+#define PIIX4_ISA_DMA2_LPGRFR	0x8F
+
+#define PIIX4_ISA_PORT_92			0x92
+
+#define PIIX4_ISA_APM_CONTRL	0xB2
+#define PIIX4_ISA_APM_STATUS	0xB3
+
+#define PIIX4_ISA_COCPU_ERROR	0xF0
+
+/* Function 1 IDE Controller */
+#define	PCI_CFG_PIIX4_BMIBA		0x20
+#define	PCI_CFG_PIIX4_IDETIM	0x40
+#define	PCI_CFG_PIIX4_SIDETIM	0x44
+#define	PCI_CFG_PIIX4_UDMACTL	0x48
+#define	PCI_CFG_PIIX4_UDMATIM 0x4A
+
+/* Function 2 USB Controller */
+#define	PCI_CFG_PIIX4_SBRNUM	0x60
+#define	PCI_CFG_PIIX4_LEGSUP	0xC0
+
+/* Function 3 Power Management */
+#define	PCI_CFG_PIIX4_PMBA		0x40
+#define	PCI_CFG_PIIX4_CNTA		0x44
+#define	PCI_CFG_PIIX4_CNTB		0x48
+#define	PCI_CFG_PIIX4_GPICTL	0x4C
+#define	PCI_CFG_PIIX4_DEVRESD	0x50
+#define	PCI_CFG_PIIX4_DEVACTA	0x54
+#define	PCI_CFG_PIIX4_DEVACTB	0x58
+#define	PCI_CFG_PIIX4_DEVRESA	0x5C
+#define	PCI_CFG_PIIX4_DEVRESB	0x60
+#define	PCI_CFG_PIIX4_DEVRESC	0x64
+#define	PCI_CFG_PIIX4_DEVRESE	0x68
+#define	PCI_CFG_PIIX4_DEVRESF	0x6C
+#define	PCI_CFG_PIIX4_DEVRESG	0x70
+#define	PCI_CFG_PIIX4_DEVRESH	0x74
+#define	PCI_CFG_PIIX4_DEVRESI	0x78
+#define	PCI_CFG_PIIX4_PMMISC	0x80
+#define	PCI_CFG_PIIX4_SMBBA	0x90
+
+
+#endif
diff --git a/qemu/roms/u-boot/board/mpl/common/usb_uhci.c b/qemu/roms/u-boot/board/mpl/common/usb_uhci.c
new file mode 100644
index 000000000..5590be196
--- /dev/null
+++ b/qemu/roms/u-boot/board/mpl/common/usb_uhci.c
@@ -0,0 +1,1042 @@
+/*
+ * Part of this code has been derived from linux:
+ * Universal Host Controller Interface driver for USB (take II).
+ *
+ * (c) 1999-2001 Georg Acher, acher@in.tum.de (executive slave) (base guitar)
+ *               Deti Fliegl, deti@fliegl.de (executive slave) (lead voice)
+ *               Thomas Sailer, sailer@ife.ee.ethz.ch (chief consultant) (cheer leader)
+ *               Roman Weissgaerber, weissg@vienna.at (virt root hub) (studio porter)
+ * (c) 2000      Yggdrasil Computing, Inc. (port of new PCI interface support
+ *               from usb-ohci.c by Adam Richter, adam@yggdrasil.com).
+ * (C) 2000      David Brownell, david-b@pacbell.net (usb-ohci.c)
+ *
+ * HW-initalization based on material of
+ *
+ * (C) Copyright 1999 Linus Torvalds
+ * (C) Copyright 1999 Johannes Erdfelt
+ * (C) Copyright 1999 Randy Dunlap
+ * (C) Copyright 1999 Gregory P. Smith
+ *
+ *
+ * Adapted for U-Boot:
+ * (C) Copyright 2001 Denis Peter, MPL AG Switzerland
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+/**********************************************************************
+ * How it works:
+ * -------------
+ * The framelist / Transfer descriptor / Queue Heads are similar like
+ * in the linux usb_uhci.c.
+ *
+ * During initialization, the following skeleton is allocated in init_skel:
+ *
+ *         framespecific           |           common chain
+ *
+ * framelist[]
+ * [  0 ]-----> TD ---------\
+ * [  1 ]-----> TD ----------> TD ------> QH -------> QH -------> QH ---> NULL
+ *   ...        TD ---------/
+ * [1023]-----> TD --------/
+ *
+ *              ^^             ^^         ^^          ^^          ^^
+ *              7 TDs for      1 TD for   Start of    Start of    End Chain
+ *              INT (2-128ms)  1ms-INT    CTRL Chain  BULK Chain
+ *
+ *
+ * Since this is a bootloader, the isochronous transfer descriptor have been removed.
+ *
+ * Interrupt Transfers.
+ * --------------------
+ * For Interrupt transfers USB_MAX_TEMP_INT_TD Transfer descriptor are available. They
+ * will be inserted after the appropriate (depending the interval setting) skeleton TD.
+ * If an interrupt has been detected the dev->irqhandler is called. The status and number
+ * of transfered bytes is stored in dev->irq_status resp. dev->irq_act_len. If the
+ * dev->irqhandler returns 0, the interrupt TD is removed and disabled. If an 1 is returned,
+ * the interrupt TD will be reactivated.
+ *
+ * Control Transfers
+ * -----------------
+ * Control Transfers are issued by filling the tmp_td with the appropriate data and connect
+ * them to the qh_cntrl queue header. Before other control/bulk transfers can be issued,
+ * the programm has to wait for completion. This does not allows asynchronous data transfer.
+ *
+ * Bulk Transfers
+ * --------------
+ * Bulk Transfers are issued by filling the tmp_td with the appropriate data and connect
+ * them to the qh_bulk queue header. Before other control/bulk transfers can be issued,
+ * the programm has to wait for completion. This does not allows asynchronous data transfer.
+ *
+ *
+ */
+
+#include <common.h>
+#include <pci.h>
+
+#ifdef CONFIG_USB_UHCI
+
+#include <usb.h>
+#include "usb_uhci.h"
+
+#define USB_MAX_TEMP_TD      128  /* number of temporary TDs for bulk and control transfers */
+#define USB_MAX_TEMP_INT_TD  32   /* number of temporary TDs for Interrupt transfers */
+
+
+#undef USB_UHCI_DEBUG
+
+#ifdef	USB_UHCI_DEBUG
+#define	USB_UHCI_PRINTF(fmt,args...)	printf (fmt ,##args)
+#else
+#define USB_UHCI_PRINTF(fmt,args...)
+#endif
+
+
+static int irqvec = -1;            /* irq vector, if -1 uhci is stopped / reseted */
+unsigned int usb_base_addr;       /* base address */
+
+static uhci_td_t td_int[8];        /* Interrupt Transfer descriptors */
+static uhci_qh_t qh_cntrl;         /* control Queue Head */
+static uhci_qh_t qh_bulk;          /*  bulk Queue Head */
+static uhci_qh_t qh_end;           /* end Queue Head */
+static uhci_td_t td_last;          /* last TD (linked with end chain) */
+
+/* temporary tds */
+static uhci_td_t tmp_td[USB_MAX_TEMP_TD];          /* temporary bulk/control td's  */
+static uhci_td_t tmp_int_td[USB_MAX_TEMP_INT_TD];  /* temporary interrupt td's  */
+
+static unsigned long framelist[1024] __attribute__ ((aligned (0x1000))); /* frame list */
+
+static struct virt_root_hub rh;   /* struct for root hub */
+
+/**********************************************************************
+ * some forward decleration
+ */
+int uhci_submit_rh_msg(struct usb_device *dev, unsigned long pipe,
+						void *buffer, int transfer_len,struct devrequest *setup);
+
+/* fill a td with the approproiate data. Link, status, info and buffer
+ * are used by the USB controller itselfes, dev is used to identify the
+ * "connected" device
+ */
+void usb_fill_td(uhci_td_t* td,unsigned long link,unsigned long status,
+					unsigned long info, unsigned long buffer, unsigned long dev)
+{
+	td->link=swap_32(link);
+	td->status=swap_32(status);
+	td->info=swap_32(info);
+	td->buffer=swap_32(buffer);
+	td->dev_ptr=dev;
+}
+
+/* fill a qh with the approproiate data. Head and element are used by the USB controller
+ * itselfes. As soon as a valid dev_ptr is filled, a td chain is connected to the qh.
+ * Please note, that after completion of the td chain, the entry element is removed /
+ * marked invalid by the USB controller.
+ */
+void usb_fill_qh(uhci_qh_t* qh,unsigned long head,unsigned long element)
+{
+	qh->head=swap_32(head);
+	qh->element=swap_32(element);
+	qh->dev_ptr=0L;
+}
+
+/* get the status of a td->status
+ */
+unsigned long usb_uhci_td_stat(unsigned long status)
+{
+	unsigned long result=0;
+	result |= (status & TD_CTRL_NAK)      ? USB_ST_NAK_REC : 0;
+	result |= (status & TD_CTRL_STALLED)  ? USB_ST_STALLED : 0;
+	result |= (status & TD_CTRL_DBUFERR)  ? USB_ST_BUF_ERR : 0;
+	result |= (status & TD_CTRL_BABBLE)   ? USB_ST_BABBLE_DET : 0;
+	result |= (status & TD_CTRL_CRCTIMEO) ? USB_ST_CRC_ERR : 0;
+	result |= (status & TD_CTRL_BITSTUFF) ? USB_ST_BIT_ERR : 0;
+	result |= (status & TD_CTRL_ACTIVE)   ? USB_ST_NOT_PROC : 0;
+	return result;
+}
+
+/* get the status and the transfered len of a td chain.
+ * called from the completion handler
+ */
+int usb_get_td_status(uhci_td_t *td,struct usb_device *dev)
+{
+	unsigned long temp,info;
+	unsigned long stat;
+	uhci_td_t *mytd=td;
+
+	if(dev->devnum==rh.devnum)
+		return 0;
+	dev->act_len=0;
+	stat=0;
+	do {
+		temp=swap_32((unsigned long)mytd->status);
+		stat=usb_uhci_td_stat(temp);
+		info=swap_32((unsigned long)mytd->info);
+		if(((info & 0xff)!= USB_PID_SETUP) &&
+				(((info >> 21) & 0x7ff)!= 0x7ff) &&
+				(temp & 0x7FF)!=0x7ff)
+		{  /* if not setup and not null data pack */
+			dev->act_len+=(temp & 0x7FF) + 1; /* the transfered len is act_len + 1 */
+		}
+		if(stat) {           /* status no ok */
+			dev->status=stat;
+			return -1;
+		}
+		temp=swap_32((unsigned long)mytd->link);
+		mytd=(uhci_td_t *)(temp & 0xfffffff0);
+	}while((temp & 0x1)==0); /* process all TDs */
+	dev->status=stat;
+	return 0; /* Ok */
+}
+
+
+/*-------------------------------------------------------------------
+ *                         LOW LEVEL STUFF
+ *          assembles QHs und TDs for control, bulk and iso
+ *-------------------------------------------------------------------*/
+
+/* Submits a control message. That is a Setup, Data and Status transfer.
+ * Routine does not wait for completion.
+ */
+int submit_control_msg(struct usb_device *dev, unsigned long pipe, void *buffer,
+										int transfer_len,struct devrequest *setup)
+{
+	unsigned long destination, status;
+	int maxsze = usb_maxpacket(dev, pipe);
+	unsigned long dataptr;
+	int len;
+	int pktsze;
+	int i=0;
+
+	if (!maxsze) {
+		USB_UHCI_PRINTF("uhci_submit_control_urb: pipesize for pipe %lx is zero\n", pipe);
+		return -1;
+	}
+	if(((pipe>>8)&0x7f)==rh.devnum) {
+		/* this is the root hub -> redirect it */
+		return uhci_submit_rh_msg(dev,pipe,buffer,transfer_len,setup);
+	}
+	USB_UHCI_PRINTF("uhci_submit_control start len %x, maxsize %x\n",transfer_len,maxsze);
+	/* The "pipe" thing contains the destination in bits 8--18 */
+	destination = (pipe & PIPE_DEVEP_MASK) | USB_PID_SETUP; /* Setup stage */
+	/* 3 errors */
+	status = (pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE | (3 << 27);
+	/* (urb->transfer_flags & USB_DISABLE_SPD ? 0 : TD_CTRL_SPD); */
+	/*  Build the TD for the control request, try forever, 8 bytes of data */
+	usb_fill_td(&tmp_td[i],UHCI_PTR_TERM ,status, destination | (7 << 21),(unsigned long)setup,(unsigned long)dev);
+#if 0
+	{
+		char *sp=(char *)setup;
+		printf("SETUP to pipe %lx: %x %x %x %x %x %x %x %x\n", pipe,
+		    sp[0],sp[1],sp[2],sp[3],sp[4],sp[5],sp[6],sp[7]);
+	}
+#endif
+	dataptr = (unsigned long)buffer;
+	len=transfer_len;
+
+	/* If direction is "send", change the frame from SETUP (0x2D)
+	   to OUT (0xE1). Else change it from SETUP to IN (0x69). */
+	destination = (pipe & PIPE_DEVEP_MASK) | ((pipe & USB_DIR_IN)==0 ? USB_PID_OUT : USB_PID_IN);
+	while (len > 0) {
+		/* data stage */
+		pktsze = len;
+		i++;
+		if (pktsze > maxsze)
+			pktsze = maxsze;
+		destination ^= 1 << TD_TOKEN_TOGGLE;	/* toggle DATA0/1 */
+		usb_fill_td(&tmp_td[i],UHCI_PTR_TERM, status, destination | ((pktsze - 1) << 21),dataptr,(unsigned long)dev);	/* Status, pktsze bytes of data */
+		tmp_td[i-1].link=swap_32((unsigned long)&tmp_td[i]);
+
+		dataptr += pktsze;
+		len -= pktsze;
+	}
+
+	/*  Build the final TD for control status */
+	/* It's only IN if the pipe is out AND we aren't expecting data */
+
+	destination &= ~UHCI_PID;
+	if (((pipe & USB_DIR_IN)==0) || (transfer_len == 0))
+		destination |= USB_PID_IN;
+	else
+		destination |= USB_PID_OUT;
+	destination |= 1 << TD_TOKEN_TOGGLE;	/* End in Data1 */
+	i++;
+	status &=~TD_CTRL_SPD;
+	/* no limit on errors on final packet , 0 bytes of data */
+	usb_fill_td(&tmp_td[i],UHCI_PTR_TERM, status | TD_CTRL_IOC, destination | (UHCI_NULL_DATA_SIZE << 21),0,(unsigned long)dev);
+	tmp_td[i-1].link=swap_32((unsigned long)&tmp_td[i]);	/* queue status td */
+	/*	usb_show_td(i+1);*/
+	USB_UHCI_PRINTF("uhci_submit_control end (%d tmp_tds used)\n",i);
+	/* first mark the control QH element terminated */
+	qh_cntrl.element=0xffffffffL;
+	/* set qh active */
+	qh_cntrl.dev_ptr=(unsigned long)dev;
+	/* fill in tmp_td_chain */
+	qh_cntrl.element=swap_32((unsigned long)&tmp_td[0]);
+	return 0;
+}
+
+/*-------------------------------------------------------------------
+ * Prepare TDs for bulk transfers.
+ */
+int submit_bulk_msg(struct usb_device *dev, unsigned long pipe, void *buffer,int transfer_len)
+{
+	unsigned long destination, status,info;
+	unsigned long dataptr;
+	int maxsze = usb_maxpacket(dev, pipe);
+	int len;
+	int i=0;
+
+	if(transfer_len < 0) {
+		printf("Negative transfer length in submit_bulk\n");
+		return -1;
+	}
+	if (!maxsze)
+		return -1;
+	/* The "pipe" thing contains the destination in bits 8--18. */
+	destination = (pipe & PIPE_DEVEP_MASK) | usb_packetid (pipe);
+	/* 3 errors */
+	status = (pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE | (3 << 27);
+	/*	((urb->transfer_flags & USB_DISABLE_SPD) ? 0 : TD_CTRL_SPD) | (3 << 27); */
+	/* Build the TDs for the bulk request */
+	len = transfer_len;
+	dataptr = (unsigned long)buffer;
+	do {
+		int pktsze = len;
+		if (pktsze > maxsze)
+			pktsze = maxsze;
+		/* pktsze bytes of data  */
+		info = destination | (((pktsze - 1)&UHCI_NULL_DATA_SIZE) << 21) |
+			(usb_gettoggle (dev, usb_pipeendpoint (pipe), usb_pipeout (pipe)) << TD_TOKEN_TOGGLE);
+
+		if((len-pktsze)==0)
+			status |= TD_CTRL_IOC;	/* last one generates INT */
+
+		usb_fill_td(&tmp_td[i],UHCI_PTR_TERM, status, info,dataptr,(unsigned long)dev);	/* Status, pktsze bytes of data */
+		if(i>0)
+			tmp_td[i-1].link=swap_32((unsigned long)&tmp_td[i]);
+		i++;
+		dataptr += pktsze;
+		len -= pktsze;
+		usb_dotoggle (dev, usb_pipeendpoint (pipe), usb_pipeout (pipe));
+	} while (len > 0);
+	/* first mark the bulk QH element terminated */
+	qh_bulk.element=0xffffffffL;
+	/* set qh active */
+	qh_bulk.dev_ptr=(unsigned long)dev;
+	/* fill in tmp_td_chain */
+	qh_bulk.element=swap_32((unsigned long)&tmp_td[0]);
+	return 0;
+}
+
+
+/* search a free interrupt td
+ */
+uhci_td_t *uhci_alloc_int_td(void)
+{
+	int i;
+	for(i=0;i<USB_MAX_TEMP_INT_TD;i++) {
+		if(tmp_int_td[i].dev_ptr==0) /* no device assigned -> free TD */
+			return &tmp_int_td[i];
+	}
+	return NULL;
+}
+
+#if 0
+void uhci_show_temp_int_td(void)
+{
+	int i;
+	for(i=0;i<USB_MAX_TEMP_INT_TD;i++) {
+		if((tmp_int_td[i].dev_ptr&0x01)!=0x1L) /* no device assigned -> free TD */
+			printf("temp_td %d is assigned to dev %lx\n",i,tmp_int_td[i].dev_ptr);
+	}
+	printf("all others temp_tds are free\n");
+}
+#endif
+/*-------------------------------------------------------------------
+ * submits USB interrupt (ie. polling ;-)
+ */
+int submit_int_msg(struct usb_device *dev, unsigned long pipe, void *buffer,int transfer_len, int interval)
+{
+	int nint, n;
+	unsigned long status, destination;
+	unsigned long info,tmp;
+	uhci_td_t *mytd;
+	if (interval < 0 || interval >= 256)
+		return -1;
+
+	if (interval == 0)
+		nint = 0;
+	else {
+		for (nint = 0, n = 1; nint <= 8; nint++, n += n)	/* round interval down to 2^n */
+		 {
+			if(interval < n) {
+				interval = n / 2;
+				break;
+			}
+		}
+		nint--;
+	}
+
+	USB_UHCI_PRINTF("Rounded interval to %i, chain  %i\n", interval, nint);
+	mytd=uhci_alloc_int_td();
+	if(mytd==NULL) {
+		printf("No free INT TDs found\n");
+		return -1;
+	}
+	status = (pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE | TD_CTRL_IOC | (3 << 27);
+/*		(urb->transfer_flags & USB_DISABLE_SPD ? 0 : TD_CTRL_SPD) | (3 << 27);
+*/
+
+	destination =(pipe & PIPE_DEVEP_MASK) | usb_packetid (pipe) | (((transfer_len - 1) & 0x7ff) << 21);
+
+	info = destination | (usb_gettoggle(dev, usb_pipeendpoint(pipe), usb_pipeout(pipe)) << TD_TOKEN_TOGGLE);
+	tmp = swap_32(td_int[nint].link);
+	usb_fill_td(mytd,tmp,status, info,(unsigned long)buffer,(unsigned long)dev);
+	/* Link it */
+	tmp = swap_32((unsigned long)mytd);
+	td_int[nint].link=tmp;
+
+	usb_dotoggle (dev, usb_pipeendpoint (pipe), usb_pipeout (pipe));
+
+	return 0;
+}
+
+/**********************************************************************
+ * Low Level functions
+ */
+
+
+void reset_hc(void)
+{
+
+	/* Global reset for 100ms */
+	out16r( usb_base_addr + USBPORTSC1,0x0204);
+	out16r( usb_base_addr + USBPORTSC2,0x0204);
+	out16r( usb_base_addr + USBCMD,USBCMD_GRESET | USBCMD_RS);
+	/* Turn off all interrupts */
+	out16r(usb_base_addr + USBINTR,0);
+	mdelay(50);
+	out16r( usb_base_addr + USBCMD,0);
+	mdelay(10);
+}
+
+void start_hc(void)
+{
+	int timeout = 1000;
+
+	while(in16r(usb_base_addr + USBCMD) & USBCMD_HCRESET) {
+		if (!--timeout) {
+			printf("USBCMD_HCRESET timed out!\n");
+			break;
+		}
+	}
+	/* Turn on all interrupts */
+	out16r(usb_base_addr + USBINTR,USBINTR_TIMEOUT | USBINTR_RESUME | USBINTR_IOC | USBINTR_SP);
+	/* Start at frame 0 */
+	out16r(usb_base_addr + USBFRNUM,0);
+	/* set Framebuffer base address */
+	out32r(usb_base_addr+USBFLBASEADD,(unsigned long)&framelist);
+	/* Run and mark it configured with a 64-byte max packet */
+	out16r(usb_base_addr + USBCMD,USBCMD_RS | USBCMD_CF | USBCMD_MAXP);
+}
+
+/* Initialize the skeleton
+ */
+void usb_init_skel(void)
+{
+	unsigned long temp;
+	int n;
+
+	for(n=0;n<USB_MAX_TEMP_INT_TD;n++)
+		tmp_int_td[n].dev_ptr=0L; /* no devices connected */
+	/* last td */
+	usb_fill_td(&td_last,UHCI_PTR_TERM,TD_CTRL_IOC ,0,0,0L);
+  /* usb_fill_td(&td_last,UHCI_PTR_TERM,0,0,0); */
+	/* End Queue Header */
+	usb_fill_qh(&qh_end,UHCI_PTR_TERM,(unsigned long)&td_last);
+	/* Bulk Queue Header */
+	temp=(unsigned long)&qh_end;
+	usb_fill_qh(&qh_bulk,temp | UHCI_PTR_QH,UHCI_PTR_TERM);
+	/* Control Queue Header */
+	temp=(unsigned long)&qh_bulk;
+	usb_fill_qh(&qh_cntrl, temp | UHCI_PTR_QH,UHCI_PTR_TERM);
+	/* 1ms Interrupt td */
+	temp=(unsigned long)&qh_cntrl;
+	usb_fill_td(&td_int[0],temp | UHCI_PTR_QH,0,0,0,0L);
+	temp=(unsigned long)&td_int[0];
+	for(n=1; n<8; n++)
+		usb_fill_td(&td_int[n],temp,0,0,0,0L);
+	for (n = 0; n < 1024; n++) {
+	/* link all framelist pointers to one of the interrupts */
+		int m, o;
+		if ((n&127)==127)
+			framelist[n]= swap_32((unsigned long)&td_int[0]);
+		else
+			for (o = 1, m = 2; m <= 128; o++, m += m)
+				if ((n & (m - 1)) == ((m - 1) / 2))
+						framelist[n]= swap_32((unsigned long)&td_int[o]);
+	}
+}
+
+/* check the common skeleton for completed transfers, and update the status
+ * of the "connected" device. Called from the IRQ routine.
+ */
+void usb_check_skel(void)
+{
+	struct usb_device *dev;
+	/* start with the control qh */
+	if(qh_cntrl.dev_ptr!=0) /* it's a device assigned check if this caused IRQ */
+	{
+		dev=(struct usb_device *)qh_cntrl.dev_ptr;
+		usb_get_td_status(&tmp_td[0],dev); /* update status */
+		if(!(dev->status & USB_ST_NOT_PROC)) { /* is not active anymore, disconnect devices */
+			qh_cntrl.dev_ptr=0;
+		}
+	}
+	/* now process the bulk */
+	if(qh_bulk.dev_ptr!=0) /* it's a device assigned check if this caused IRQ */
+	{
+		dev=(struct usb_device *)qh_bulk.dev_ptr;
+		usb_get_td_status(&tmp_td[0],dev); /* update status */
+		if(!(dev->status & USB_ST_NOT_PROC)) { /* is not active anymore, disconnect devices */
+			qh_bulk.dev_ptr=0;
+		}
+	}
+}
+
+/* check the interrupt chain, ubdate the status of the appropriate device,
+ * call the appropriate irqhandler and reactivate the TD if the irqhandler
+ * returns with 1
+ */
+void usb_check_int_chain(void)
+{
+	int i,res;
+	unsigned long link,status;
+	struct usb_device *dev;
+	uhci_td_t *td,*prevtd;
+
+	for(i=0;i<8;i++) {
+		prevtd = &td_int[i]; /* the first previous td is the skeleton td */
+		link=swap_32(td_int[i].link) & 0xfffffff0; /* next in chain */
+		td=(uhci_td_t *)link; /* assign it */
+		/* all interrupt TDs are finally linked to the td_int[0].
+		 * so we process all until we find the td_int[0].
+		 * if int0 chain points to a QH, we're also done
+	   */
+		while(((i>0) && (link != (unsigned long)&td_int[0])) ||
+					((i==0) && !(swap_32(td->link) &  UHCI_PTR_QH)))
+		{
+			/* check if a device is assigned with this td */
+			status=swap_32(td->status);
+			if((td->dev_ptr!=0L) && !(status & TD_CTRL_ACTIVE)) {
+				/* td is not active and a device is assigned -> call irqhandler */
+				dev=(struct usb_device *)td->dev_ptr;
+				dev->irq_act_len=((status & 0x7FF)==0x7FF) ? 0 : (status & 0x7FF) + 1; /* transfered length */
+				dev->irq_status=usb_uhci_td_stat(status); /* get status */
+				res=dev->irq_handle(dev); /* call irqhandler */
+				if(res==1) {
+					/* reactivate */
+					status|=TD_CTRL_ACTIVE;
+					td->status=swap_32(status);
+					prevtd=td; /* previous td = this td */
+				}
+				else {
+					prevtd->link=td->link; /* link previous td directly to the nex td -> unlinked */
+					/* remove device pointer */
+					td->dev_ptr=0L;
+				}
+			} /* if we call the irq handler */
+			link=swap_32(td->link) & 0xfffffff0; /* next in chain */
+			td=(uhci_td_t *)link; /* assign it */
+		} /* process all td in this int chain */
+	} /* next interrupt chain */
+}
+
+
+/* usb interrupt service routine.
+ */
+void handle_usb_interrupt(void)
+{
+	unsigned short status;
+
+	/*
+	 * Read the interrupt status, and write it back to clear the
+	 * interrupt cause
+	 */
+
+	status = in16r(usb_base_addr + USBSTS);
+
+	if (!status)		/* shared interrupt, not mine */
+		return;
+	if (status != 1) {
+		/* remove host controller halted state */
+		if ((status&0x20) && ((in16r(usb_base_addr+USBCMD) && USBCMD_RS)==0)) {
+			out16r(usb_base_addr + USBCMD, USBCMD_RS | in16r(usb_base_addr + USBCMD));
+		}
+	}
+	usb_check_int_chain(); /* call interrupt handlers for int tds */
+	usb_check_skel(); /* call completion handler for common transfer routines */
+	out16r(usb_base_addr+USBSTS,status);
+}
+
+
+/* init uhci
+ */
+int usb_lowlevel_init(int index, enum usb_init_type init, void **controller)
+{
+	unsigned char temp;
+	int	busdevfunc;
+
+	busdevfunc=pci_find_device(USB_UHCI_VEND_ID,USB_UHCI_DEV_ID,0); /* get PCI Device ID */
+	if(busdevfunc==-1) {
+		printf("Error USB UHCI (%04X,%04X) not found\n",USB_UHCI_VEND_ID,USB_UHCI_DEV_ID);
+		return -1;
+	}
+	pci_read_config_byte(busdevfunc,PCI_INTERRUPT_LINE,&temp);
+	irqvec = temp;
+	irq_free_handler(irqvec);
+	USB_UHCI_PRINTF("Interrupt Line = %d, is %d\n",irqvec);
+	pci_read_config_byte(busdevfunc,PCI_INTERRUPT_PIN,&temp);
+	USB_UHCI_PRINTF("Interrupt Pin = %ld\n",temp);
+	pci_read_config_dword(busdevfunc,PCI_BASE_ADDRESS_4,&usb_base_addr);
+	USB_UHCI_PRINTF("IO Base Address = 0x%lx\n",usb_base_addr);
+	usb_base_addr&=0xFFFFFFF0;
+	usb_base_addr+=CONFIG_SYS_ISA_IO_BASE_ADDRESS;
+	rh.devnum = 0;
+	usb_init_skel();
+	reset_hc();
+	start_hc();
+	irq_install_handler(irqvec, (interrupt_handler_t *)handle_usb_interrupt, NULL);
+	return 0;
+}
+
+/* stop uhci
+ */
+int usb_lowlevel_stop(int index)
+{
+	if(irqvec==-1)
+		return 1;
+	irq_free_handler(irqvec);
+	reset_hc();
+	irqvec = -1;
+	return 0;
+}
+
+/*******************************************************************************************
+ * Virtual Root Hub
+ * Since the uhci does not have a real HUB, we simulate one ;-)
+ */
+#undef	USB_RH_DEBUG
+
+#ifdef	USB_RH_DEBUG
+#define	USB_RH_PRINTF(fmt,args...)	printf (fmt ,##args)
+static void usb_display_wValue(unsigned short wValue,unsigned short wIndex);
+static void usb_display_Req(unsigned short req);
+#else
+#define USB_RH_PRINTF(fmt,args...)
+static void usb_display_wValue(unsigned short wValue,unsigned short wIndex) {}
+static void usb_display_Req(unsigned short req) {}
+#endif
+
+#define WANT_USB_ROOT_HUB_HUB_DES
+#include <usbroothubdes.h>
+#undef WANT_USB_ROOT_HUB_HUB_DES
+
+/*
+ * Root Hub Control Pipe (interrupt Pipes are not supported)
+ */
+
+
+int uhci_submit_rh_msg(struct usb_device *dev, unsigned long pipe, void *buffer,int transfer_len,struct devrequest *cmd)
+{
+	void *data = buffer;
+	int leni = transfer_len;
+	int len = 0;
+	int status = 0;
+	int stat = 0;
+	int i;
+
+	unsigned short cstatus;
+
+	unsigned short bmRType_bReq;
+	unsigned short wValue;
+	unsigned short wIndex;
+	unsigned short wLength;
+
+	if (usb_pipeint(pipe)) {
+		printf("Root-Hub submit IRQ: NOT implemented\n");
+#if 0
+		uhci->rh.urb = urb;
+		uhci->rh.send = 1;
+		uhci->rh.interval = urb->interval;
+		rh_init_int_timer (urb);
+#endif
+		return 0;
+	}
+	bmRType_bReq = cmd->requesttype | cmd->request << 8;
+	wValue = swap_16(cmd->value);
+	wIndex = swap_16(cmd->index);
+	wLength = swap_16(cmd->length);
+	usb_display_Req(bmRType_bReq);
+	for (i = 0; i < 8; i++)
+		rh.c_p_r[i] = 0;
+	USB_RH_PRINTF("Root-Hub: adr: %2x cmd(%1x): %02x%02x %04x %04x %04x\n",
+	     dev->devnum, 8, cmd->requesttype,cmd->request, wValue, wIndex, wLength);
+
+	switch (bmRType_bReq) {
+		/* Request Destination:
+		   without flags: Device,
+		   RH_INTERFACE: interface,
+		   RH_ENDPOINT: endpoint,
+		   RH_CLASS means HUB here,
+		   RH_OTHER | RH_CLASS  almost ever means HUB_PORT here
+		 */
+
+	case RH_GET_STATUS:
+		*(unsigned short *) data = swap_16(1);
+		len=2;
+		break;
+	case RH_GET_STATUS | RH_INTERFACE:
+		*(unsigned short *) data = swap_16(0);
+		len=2;
+		break;
+	case RH_GET_STATUS | RH_ENDPOINT:
+		*(unsigned short *) data = swap_16(0);
+		len=2;
+		break;
+	case RH_GET_STATUS | RH_CLASS:
+		*(unsigned long *) data = swap_32(0);
+		len=4;
+		break;	/* hub power ** */
+	case RH_GET_STATUS | RH_OTHER | RH_CLASS:
+
+		status = in16r(usb_base_addr + USBPORTSC1 + 2 * (wIndex - 1));
+		cstatus = ((status & USBPORTSC_CSC) >> (1 - 0)) |
+			((status & USBPORTSC_PEC) >> (3 - 1)) |
+			(rh.c_p_r[wIndex - 1] << (0 + 4));
+		status = (status & USBPORTSC_CCS) |
+			((status & USBPORTSC_PE) >> (2 - 1)) |
+			((status & USBPORTSC_SUSP) >> (12 - 2)) |
+			((status & USBPORTSC_PR) >> (9 - 4)) |
+			(1 << 8) |	/* power on ** */
+			((status & USBPORTSC_LSDA) << (-8 + 9));
+
+		*(unsigned short *) data = swap_16(status);
+		*(unsigned short *) (data + 2) = swap_16(cstatus);
+		len=4;
+		break;
+	case RH_CLEAR_FEATURE | RH_ENDPOINT:
+		switch (wValue) {
+		case (RH_ENDPOINT_STALL):
+			len=0;
+			break;
+		}
+		break;
+
+	case RH_CLEAR_FEATURE | RH_CLASS:
+		switch (wValue) {
+		case (RH_C_HUB_OVER_CURRENT):
+			len=0;	/* hub power over current ** */
+			break;
+		}
+		break;
+
+	case RH_CLEAR_FEATURE | RH_OTHER | RH_CLASS:
+		usb_display_wValue(wValue,wIndex);
+		switch (wValue) {
+		case (RH_PORT_ENABLE):
+			status = in16r(usb_base_addr+USBPORTSC1+2*(wIndex-1));
+			status = (status & 0xfff5) & ~USBPORTSC_PE;
+			out16r(usb_base_addr+USBPORTSC1+2*(wIndex-1),status);
+			len=0;
+			break;
+		case (RH_PORT_SUSPEND):
+			status = in16r(usb_base_addr+USBPORTSC1+2*(wIndex-1));
+			status = (status & 0xfff5) & ~USBPORTSC_SUSP;
+			out16r(usb_base_addr+USBPORTSC1+2*(wIndex-1),status);
+			len=0;
+			break;
+		case (RH_PORT_POWER):
+			len=0;	/* port power ** */
+			break;
+		case (RH_C_PORT_CONNECTION):
+			status = in16r(usb_base_addr+USBPORTSC1+2*(wIndex-1));
+			status = (status & 0xfff5) | USBPORTSC_CSC;
+			out16r(usb_base_addr+USBPORTSC1+2*(wIndex-1),status);
+			len=0;
+			break;
+		case (RH_C_PORT_ENABLE):
+			status = in16r(usb_base_addr+USBPORTSC1+2*(wIndex-1));
+			status = (status & 0xfff5) | USBPORTSC_PEC;
+			out16r(usb_base_addr+USBPORTSC1+2*(wIndex-1),status);
+			len=0;
+			break;
+		case (RH_C_PORT_SUSPEND):
+/*** WR_RH_PORTSTAT(RH_PS_PSSC); */
+			len=0;
+			break;
+		case (RH_C_PORT_OVER_CURRENT):
+			len=0;
+			break;
+		case (RH_C_PORT_RESET):
+			rh.c_p_r[wIndex - 1] = 0;
+			len=0;
+			break;
+		}
+		break;
+	case RH_SET_FEATURE | RH_OTHER | RH_CLASS:
+		usb_display_wValue(wValue,wIndex);
+		switch (wValue) {
+		case (RH_PORT_SUSPEND):
+			status = in16r(usb_base_addr+USBPORTSC1+2*(wIndex-1));
+			status = (status & 0xfff5) | USBPORTSC_SUSP;
+			out16r(usb_base_addr+USBPORTSC1+2*(wIndex-1),status);
+			len=0;
+			break;
+		case (RH_PORT_RESET):
+			status = in16r(usb_base_addr+USBPORTSC1+2*(wIndex-1));
+			status = (status & 0xfff5) | USBPORTSC_PR;
+			out16r(usb_base_addr+USBPORTSC1+2*(wIndex-1),status);
+			mdelay(10);
+			status = (status & 0xfff5) & ~USBPORTSC_PR;
+			out16r(usb_base_addr+USBPORTSC1+2*(wIndex-1),status);
+			udelay(10);
+			status = (status & 0xfff5) | USBPORTSC_PE;
+			out16r(usb_base_addr+USBPORTSC1+2*(wIndex-1),status);
+			mdelay(10);
+			status = (status & 0xfff5) | 0xa;
+			out16r(usb_base_addr+USBPORTSC1+2*(wIndex-1),status);
+			len=0;
+			break;
+		case (RH_PORT_POWER):
+			len=0;	/* port power ** */
+			break;
+		case (RH_PORT_ENABLE):
+			status = in16r(usb_base_addr+USBPORTSC1+2*(wIndex-1));
+			status = (status & 0xfff5) | USBPORTSC_PE;
+			out16r(usb_base_addr+USBPORTSC1+2*(wIndex-1),status);
+			len=0;
+			break;
+		}
+		break;
+
+	case RH_SET_ADDRESS:
+		rh.devnum = wValue;
+		len=0;
+		break;
+	case RH_GET_DESCRIPTOR:
+		switch ((wValue & 0xff00) >> 8) {
+		case (0x01):	/* device descriptor */
+			i=sizeof(root_hub_config_des);
+			status=i > wLength ? wLength : i;
+			len = leni > status ? status : leni;
+			memcpy (data, root_hub_dev_des, len);
+			break;
+		case (0x02):	/* configuration descriptor */
+			i=sizeof(root_hub_config_des);
+			status=i > wLength ? wLength : i;
+			len = leni > status ? status : leni;
+			memcpy (data, root_hub_config_des, len);
+			break;
+		case (0x03):	/*string descriptors */
+			if(wValue==0x0300) {
+				i=sizeof(root_hub_str_index0);
+				status = i > wLength ? wLength : i;
+				len = leni > status ? status : leni;
+				memcpy (data, root_hub_str_index0, len);
+				break;
+			}
+			if(wValue==0x0301) {
+				i=sizeof(root_hub_str_index1);
+				status = i > wLength ? wLength : i;
+				len = leni > status ? status : leni;
+				memcpy (data, root_hub_str_index1, len);
+				break;
+			}
+			stat = USB_ST_STALLED;
+		}
+		break;
+
+	case RH_GET_DESCRIPTOR | RH_CLASS:
+		root_hub_hub_des[2] = 2;
+		i=sizeof(root_hub_hub_des);
+		status= i > wLength ? wLength : i;
+		len = leni > status ? status : leni;
+		memcpy (data, root_hub_hub_des, len);
+		break;
+	case RH_GET_CONFIGURATION:
+		*(unsigned char *) data = 0x01;
+		len = 1;
+		break;
+	case RH_SET_CONFIGURATION:
+		len=0;
+		break;
+	default:
+		stat = USB_ST_STALLED;
+	}
+	USB_RH_PRINTF("Root-Hub stat %lx port1: %x port2: %x\n\n",stat,
+	     in16r(usb_base_addr + USBPORTSC1), in16r(usb_base_addr + USBPORTSC2));
+	dev->act_len=len;
+	dev->status=stat;
+	return stat;
+
+}
+
+/********************************************************************************
+ * Some Debug Routines
+ */
+
+#ifdef	USB_RH_DEBUG
+
+static void usb_display_Req(unsigned short req)
+{
+	USB_RH_PRINTF("- Root-Hub Request: ");
+	switch (req) {
+	case RH_GET_STATUS:
+		USB_RH_PRINTF("Get Status ");
+		break;
+	case RH_GET_STATUS | RH_INTERFACE:
+		USB_RH_PRINTF("Get Status Interface ");
+		break;
+	case RH_GET_STATUS | RH_ENDPOINT:
+		USB_RH_PRINTF("Get Status Endpoint ");
+		break;
+	case RH_GET_STATUS | RH_CLASS:
+		USB_RH_PRINTF("Get Status Class");
+		break;	/* hub power ** */
+	case RH_GET_STATUS | RH_OTHER | RH_CLASS:
+		USB_RH_PRINTF("Get Status Class Others");
+		break;
+	case RH_CLEAR_FEATURE | RH_ENDPOINT:
+		USB_RH_PRINTF("Clear Feature Endpoint ");
+		break;
+	case RH_CLEAR_FEATURE | RH_CLASS:
+		USB_RH_PRINTF("Clear Feature Class ");
+		break;
+	case RH_CLEAR_FEATURE | RH_OTHER | RH_CLASS:
+		USB_RH_PRINTF("Clear Feature Other Class ");
+		break;
+	case RH_SET_FEATURE | RH_OTHER | RH_CLASS:
+		USB_RH_PRINTF("Set Feature Other Class ");
+		break;
+	case RH_SET_ADDRESS:
+		USB_RH_PRINTF("Set Address ");
+		break;
+	case RH_GET_DESCRIPTOR:
+		USB_RH_PRINTF("Get Descriptor ");
+		break;
+	case RH_GET_DESCRIPTOR | RH_CLASS:
+		USB_RH_PRINTF("Get Descriptor Class ");
+		break;
+	case RH_GET_CONFIGURATION:
+		USB_RH_PRINTF("Get Configuration ");
+		break;
+	case RH_SET_CONFIGURATION:
+		USB_RH_PRINTF("Get Configuration ");
+		break;
+	default:
+		USB_RH_PRINTF("****UNKNOWN**** 0x%04X ",req);
+	}
+	USB_RH_PRINTF("\n");
+
+}
+
+static void usb_display_wValue(unsigned short wValue,unsigned short wIndex)
+{
+	switch (wValue) {
+		case (RH_PORT_ENABLE):
+			USB_RH_PRINTF("Root-Hub: Enable Port %d\n",wIndex);
+			break;
+		case (RH_PORT_SUSPEND):
+			USB_RH_PRINTF("Root-Hub: Suspend Port %d\n",wIndex);
+			break;
+		case (RH_PORT_POWER):
+			USB_RH_PRINTF("Root-Hub: Port Power %d\n",wIndex);
+			break;
+		case (RH_C_PORT_CONNECTION):
+			USB_RH_PRINTF("Root-Hub: C Port Connection Port %d\n",wIndex);
+			break;
+		case (RH_C_PORT_ENABLE):
+			USB_RH_PRINTF("Root-Hub: C Port Enable Port %d\n",wIndex);
+			break;
+		case (RH_C_PORT_SUSPEND):
+			USB_RH_PRINTF("Root-Hub: C Port Suspend Port %d\n",wIndex);
+			break;
+		case (RH_C_PORT_OVER_CURRENT):
+			USB_RH_PRINTF("Root-Hub: C Port Over Current Port %d\n",wIndex);
+			break;
+		case (RH_C_PORT_RESET):
+			USB_RH_PRINTF("Root-Hub: C Port reset Port %d\n",wIndex);
+			break;
+		default:
+			USB_RH_PRINTF("Root-Hub: unknown %x %x\n",wValue,wIndex);
+			break;
+	}
+}
+
+#endif
+
+
+#ifdef	USB_UHCI_DEBUG
+
+static int usb_display_td(uhci_td_t *td)
+{
+	unsigned long tmp;
+	int valid;
+
+	printf("TD at %p:\n",td);
+
+	tmp=swap_32(td->link);
+	printf("Link points to 0x%08lX, %s first, %s, %s\n",tmp&0xfffffff0,
+		((tmp & 0x4)==0x4) ? "Depth" : "Breath",
+		((tmp & 0x2)==0x2) ? "QH" : "TD",
+		((tmp & 0x1)==0x1) ? "invalid" : "valid");
+	valid=((tmp & 0x1)==0x0);
+	tmp=swap_32(td->status);
+	printf("     %s %ld Errors %s %s %s \n     %s %s %s %s %s %s\n     Len 0x%lX\n",
+		(((tmp>>29)&0x1)==0x1) ? "SPD Enable" : "SPD Disable",
+		((tmp>>28)&0x3),
+		(((tmp>>26)&0x1)==0x1) ? "Low Speed" : "Full Speed",
+		(((tmp>>25)&0x1)==0x1) ? "ISO " : "",
+		(((tmp>>24)&0x1)==0x1) ? "IOC " : "",
+		(((tmp>>23)&0x1)==0x1) ? "Active " : "Inactive ",
+		(((tmp>>22)&0x1)==0x1) ? "Stalled" : "",
+		(((tmp>>21)&0x1)==0x1) ? "Data Buffer Error" : "",
+		(((tmp>>20)&0x1)==0x1) ? "Babble" : "",
+		(((tmp>>19)&0x1)==0x1) ? "NAK" : "",
+		(((tmp>>18)&0x1)==0x1) ? "Bitstuff Error" : "",
+		(tmp&0x7ff));
+	tmp=swap_32(td->info);
+	printf("     MaxLen 0x%lX\n",((tmp>>21)&0x7FF));
+	printf("     %s Endpoint 0x%lX Dev Addr 0x%lX PID 0x%lX\n",((tmp>>19)&0x1)==0x1 ? "TOGGLE" : "",
+		((tmp>>15)&0xF),((tmp>>8)&0x7F),tmp&0xFF);
+	tmp=swap_32(td->buffer);
+	printf("     Buffer 0x%08lX\n",tmp);
+	printf("     DEV %08lX\n",td->dev_ptr);
+	return valid;
+}
+
+
+void usb_show_td(int max)
+{
+	int i;
+	if(max>0) {
+		for(i=0;i<max;i++) {
+			usb_display_td(&tmp_td[i]);
+		}
+	}
+	else {
+		i=0;
+		do {
+			printf("tmp_td[%d]\n",i);
+		}while(usb_display_td(&tmp_td[i++]));
+	}
+}
+
+
+#endif
+#endif /* CONFIG_USB_UHCI */
+
+/* EOF */
diff --git a/qemu/roms/u-boot/board/mpl/common/usb_uhci.h b/qemu/roms/u-boot/board/mpl/common/usb_uhci.h
new file mode 100644
index 000000000..582015f91
--- /dev/null
+++ b/qemu/roms/u-boot/board/mpl/common/usb_uhci.h
@@ -0,0 +1,171 @@
+/*
+ * (C) Copyright 2001
+ * Denis Peter, MPL AG Switzerland
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ *
+ * Note: Part of this code has been derived from linux
+ */
+#ifndef _USB_UHCI_H_
+#define _USB_UHCI_H_
+
+
+/* Command register */
+#define USBCMD		0
+#define   USBCMD_RS       0x0001	/* Run/Stop */
+#define   USBCMD_HCRESET  0x0002	/* Host reset */
+#define   USBCMD_GRESET   0x0004	/* Global reset */
+#define   USBCMD_EGSM     0x0008	/* Global Suspend Mode */
+#define   USBCMD_FGR      0x0010	/* Force Global Resume */
+#define   USBCMD_SWDBG    0x0020	/* SW Debug mode */
+#define   USBCMD_CF       0x0040	/* Config Flag (sw only) */
+#define   USBCMD_MAXP     0x0080	/* Max Packet (0 = 32, 1 = 64) */
+
+/* Status register */
+#define USBSTS		2
+#define   USBSTS_USBINT   0x0001	/* Interrupt due to IOC */
+#define   USBSTS_ERROR    0x0002	/* Interrupt due to error */
+#define   USBSTS_RD       0x0004	/* Resume Detect */
+#define   USBSTS_HSE      0x0008	/* Host System Error - basically PCI problems */
+#define   USBSTS_HCPE     0x0010	/* Host Controller Process Error - the scripts were buggy */
+#define   USBSTS_HCH      0x0020	/* HC Halted */
+
+/* Interrupt enable register */
+#define USBINTR		4
+#define   USBINTR_TIMEOUT 0x0001	/* Timeout/CRC error enable */
+#define   USBINTR_RESUME  0x0002	/* Resume interrupt enable */
+#define   USBINTR_IOC     0x0004	/* Interrupt On Complete enable */
+#define   USBINTR_SP      0x0008	/* Short packet interrupt enable */
+
+#define USBFRNUM      6
+#define USBFLBASEADD  8
+#define USBSOF        12
+
+/* USB port status and control registers */
+#define USBPORTSC1	16
+#define USBPORTSC2	18
+#define   USBPORTSC_CCS   0x0001	/* Current Connect Status ("device present") */
+#define   USBPORTSC_CSC   0x0002	/* Connect Status Change */
+#define   USBPORTSC_PE    0x0004	/* Port Enable */
+#define   USBPORTSC_PEC   0x0008	/* Port Enable Change */
+#define   USBPORTSC_LS    0x0030	/* Line Status */
+#define   USBPORTSC_RD    0x0040	/* Resume Detect */
+#define   USBPORTSC_LSDA  0x0100	/* Low Speed Device Attached */
+#define   USBPORTSC_PR    0x0200	/* Port Reset */
+#define   USBPORTSC_SUSP  0x1000	/* Suspend */
+
+/* Legacy support register */
+#define USBLEGSUP 0xc0
+#define USBLEGSUP_DEFAULT 0x2000	/* only PIRQ enable set */
+
+#define UHCI_NULL_DATA_SIZE 0x7ff	/* for UHCI controller TD */
+#define UHCI_PID            0xff	/* PID MASK */
+
+#define UHCI_PTR_BITS       0x000F
+#define UHCI_PTR_TERM       0x0001
+#define UHCI_PTR_QH         0x0002
+#define UHCI_PTR_DEPTH      0x0004
+
+/* for TD <status>: */
+#define TD_CTRL_SPD         (1 << 29)	/* Short Packet Detect */
+#define TD_CTRL_C_ERR_MASK  (3 << 27)	/* Error Counter bits */
+#define TD_CTRL_LS          (1 << 26)	/* Low Speed Device */
+#define TD_CTRL_IOS         (1 << 25)	/* Isochronous Select */
+#define TD_CTRL_IOC         (1 << 24)	/* Interrupt on Complete */
+#define TD_CTRL_ACTIVE      (1 << 23)	/* TD Active */
+#define TD_CTRL_STALLED     (1 << 22)	/* TD Stalled */
+#define TD_CTRL_DBUFERR     (1 << 21)	/* Data Buffer Error */
+#define TD_CTRL_BABBLE      (1 << 20)	/* Babble Detected */
+#define TD_CTRL_NAK         (1 << 19)	/* NAK Received */
+#define TD_CTRL_CRCTIMEO    (1 << 18)	/* CRC/Time Out Error */
+#define TD_CTRL_BITSTUFF    (1 << 17)	/* Bit Stuff Error */
+#define TD_CTRL_ACTLEN_MASK 0x7ff	/* actual length, encoded as n - 1 */
+
+#define TD_CTRL_ANY_ERROR	(TD_CTRL_STALLED | TD_CTRL_DBUFERR | \
+				 TD_CTRL_BABBLE | TD_CTRL_CRCTIME | TD_CTRL_BITSTUFF)
+
+#define TD_TOKEN_TOGGLE		19
+
+/* ------------------------------------------------------------------------------------
+   Virtual Root HUB
+   ------------------------------------------------------------------------------------ */
+/* destination of request */
+#define RH_INTERFACE               0x01
+#define RH_ENDPOINT                0x02
+#define RH_OTHER                   0x03
+
+#define RH_CLASS                   0x20
+#define RH_VENDOR                  0x40
+
+/* Requests: bRequest << 8 | bmRequestType */
+#define RH_GET_STATUS           0x0080
+#define RH_CLEAR_FEATURE        0x0100
+#define RH_SET_FEATURE          0x0300
+#define RH_SET_ADDRESS          0x0500
+#define RH_GET_DESCRIPTOR       0x0680
+#define RH_SET_DESCRIPTOR       0x0700
+#define RH_GET_CONFIGURATION    0x0880
+#define RH_SET_CONFIGURATION    0x0900
+#define RH_GET_STATE            0x0280
+#define RH_GET_INTERFACE        0x0A80
+#define RH_SET_INTERFACE        0x0B00
+#define RH_SYNC_FRAME           0x0C80
+/* Our Vendor Specific Request */
+#define RH_SET_EP               0x2000
+
+/* Hub port features */
+#define RH_PORT_CONNECTION         0x00
+#define RH_PORT_ENABLE             0x01
+#define RH_PORT_SUSPEND            0x02
+#define RH_PORT_OVER_CURRENT       0x03
+#define RH_PORT_RESET              0x04
+#define RH_PORT_POWER              0x08
+#define RH_PORT_LOW_SPEED          0x09
+#define RH_C_PORT_CONNECTION       0x10
+#define RH_C_PORT_ENABLE           0x11
+#define RH_C_PORT_SUSPEND          0x12
+#define RH_C_PORT_OVER_CURRENT     0x13
+#define RH_C_PORT_RESET            0x14
+
+/* Hub features */
+#define RH_C_HUB_LOCAL_POWER       0x00
+#define RH_C_HUB_OVER_CURRENT      0x01
+
+#define RH_DEVICE_REMOTE_WAKEUP    0x00
+#define RH_ENDPOINT_STALL          0x01
+
+/* Our Vendor Specific feature */
+#define RH_REMOVE_EP               0x00
+
+
+#define RH_ACK                     0x01
+#define RH_REQ_ERR                 -1
+#define RH_NACK                    0x00
+
+
+/* Transfer descriptor structure */
+typedef struct {
+	unsigned long link;     /* next td/qh (LE)*/
+	unsigned long status;   /* status of the td */
+	unsigned long info;     /* Max Lenght / Endpoint / device address and PID */
+	unsigned long buffer;   /* pointer to data buffer (LE) */
+	unsigned long dev_ptr;  /* pointer to the assigned device (BE) */
+	unsigned long res[3];   /* reserved (TDs must be 8Byte aligned) */
+} uhci_td_t, *puhci_td_t;
+
+/* Queue Header structure */
+typedef struct {
+	unsigned long head;       /* Next QH (LE)*/
+	unsigned long element;		/* Queue element pointer (LE) */
+	unsigned long res[5];     /* reserved */
+	unsigned long dev_ptr;    /* if 0 no tds have been assigned to this qh */
+} uhci_qh_t, *puhci_qh_t;
+
+struct virt_root_hub {
+	int devnum;		            /* Address of Root Hub endpoint */
+	int numports;             /* number of ports */
+	int c_p_r[8];             /* C_PORT_RESET */
+};
+
+
+#endif /* _USB_UHCI_H_ */