2011-07-15 Till Straumann <strauman@slac.stanford.edu>

	* shared/bootloader/mm.c, shared/bootloader/pci.c,
	shared/bootloader/qemu_fakeres.c, shared/bootloader/qemu_fakerom.S,
	shared/irq/irq.h, shared/motorola/motorola.c, shared/residual/residual.h,
	shared/startup/bspstart.c,
	Added 'qemuprep' BSP variant.

9 files changed, 506 insertions, 4 deletions

diff --git a/c/src/lib/libbsp/powerpc/ChangeLog b/c/src/lib/libbsp/powerpc/ChangeLog
index 55020ec622..75180fa97c 100644
--- a/c/src/lib/libbsp/powerpc/ChangeLog
+++ b/c/src/lib/libbsp/powerpc/ChangeLog
@@ -1,5 +1,13 @@
 2011-07-15  Till Straumann <strauman@slac.stanford.edu>
 
+	* shared/bootloader/mm.c, shared/bootloader/pci.c,
+	shared/bootloader/qemu_fakeres.c, shared/bootloader/qemu_fakerom.S,
+	shared/irq/irq.h, shared/motorola/motorola.c, shared/residual/residual.h,
+	shared/startup/bspstart.c,
+	Added 'qemuprep' BSP variant.
+
+2011-07-15  Till Straumann <strauman@slac.stanford.edu>
+
 	* shared/bootloader/misc.c: Copy residual data 
 	_before_ decompressing the kernel since the firmware
 	may have stored it in an area that is overwritten
diff --git a/c/src/lib/libbsp/powerpc/shared/bootloader/mm.c b/c/src/lib/libbsp/powerpc/shared/bootloader/mm.c
index 1c0311b68a..219bb8e9c3 100644
--- a/c/src/lib/libbsp/powerpc/shared/bootloader/mm.c
+++ b/c/src/lib/libbsp/powerpc/shared/bootloader/mm.c
@@ -474,6 +474,19 @@ int early_setup(u_long image_size) {
 	register RESIDUAL *res = bd->residual;
 	u_long minpages = PAGE_ALIGN(image_size)>>PAGE_SHIFT;
 
+	if ( residual_fw_is_qemu( res ) ) {
+		/* save command-line - QEMU firmware sets R6/R7 to
+		 * commandline start/end (NON-PReP STD)
+		 */
+		int len = bd->r7 - bd->r6;
+		if ( len > 0 ) {
+			if ( len > sizeof(bd->cmd_line) - 1 )
+				len = sizeof(bd->cmd_line) - 1;
+			codemove(bd->cmd_line, bd->r6, len, bd->cache_lsize);
+			bd->cmd_line[len] = 0;
+		}
+	}
+
 	/* Fix residual if we are loaded by Motorola NT firmware */
 	if ( res && res->VitalProductData.FirmwareSupplier == 0x10000 )
 	    fix_residual( res );
diff --git a/c/src/lib/libbsp/powerpc/shared/bootloader/pci.c b/c/src/lib/libbsp/powerpc/shared/bootloader/pci.c
index 71f9f0ebb6..3fc4c5e104 100644
--- a/c/src/lib/libbsp/powerpc/shared/bootloader/pci.c
+++ b/c/src/lib/libbsp/powerpc/shared/bootloader/pci.c
@@ -24,6 +24,7 @@
 #include <libcpu/page.h>
 #include <bsp/consoleIo.h>
 #include <string.h>
+#include <bsp.h>
 
 #include <string.h>
 
@@ -480,6 +481,14 @@ static void reconfigure_pci(void) {
    pci_resource *r;
    struct pci_dev *dev;
 
+   u_long bus0_mem_start = BUS0_MEM_START;
+   u_long bus0_mem_end   = BUS0_MEM_END;
+
+   if ( residual_fw_is_qemu( bd->residual ) ) {
+     bus0_mem_start += PREP_ISA_MEM_BASE;
+     bus0_mem_end   += PREP_ISA_MEM_BASE;
+   }
+
    /* FIXME: for now memory is relocated from low, it's better
     * to start from higher addresses.
     */
@@ -489,7 +498,7 @@ static void reconfigure_pci(void) {
    */
 
    init_free_area(&pci->io, BUS0_IO_START, BUS0_IO_END, 0xfff, 0);
-   init_free_area(&pci->mem, BUS0_MEM_START, BUS0_MEM_END, 0xfffff, 0);
+   init_free_area(&pci->mem, bus0_mem_start, bus0_mem_end, 0xfffff, 0);
 
    /* First reconfigure the I/O space, this will be more
     * complex when there is more than 1 bus. And 64 bits
@@ -520,6 +529,14 @@ static void reconfigure_pci(void) {
       pci_bootloader_write_config_dword(r->dev,
                              PCI_BASE_ADDRESS_0+(r->reg<<2),
                              r->base);
+
+      if ( residual_fw_is_qemu( bd->residual ) && r->dev->sysdata ) {
+        if ( PCI_BASE_ADDRESS_SPACE_IO == (r->type &  PCI_BASE_ADDRESS_SPACE) )
+			((pci_resource*)r->dev->sysdata)->cmd |= PCI_COMMAND_IO;
+		else
+			((pci_resource*)r->dev->sysdata)->cmd |= PCI_COMMAND_MEMORY;
+      }
+
       if ((r->type&
            (PCI_BASE_ADDRESS_SPACE|
             PCI_BASE_ADDRESS_MEM_TYPE_MASK)) ==
diff --git a/c/src/lib/libbsp/powerpc/shared/bootloader/qemu_fakeres.c b/c/src/lib/libbsp/powerpc/shared/bootloader/qemu_fakeres.c
new file mode 100644
index 0000000000..e8944b9f05
--- /dev/null
+++ b/c/src/lib/libbsp/powerpc/shared/bootloader/qemu_fakeres.c
@@ -0,0 +1,226 @@
+#include <bsp/residual.h>
+#include <stdint.h>
+
+/* Magic knowledge - qemu loads image here. 
+ * However, we use the value from NVRAM if possible...
+ */
+#define KERNELBASE 0x01000000
+
+/* When starting qemu make sure to give the correct
+ * amount of memory!
+ *
+ * NOTE: Code now supports reading the actual memory
+ *       amount from NVRAM. The residual copy in RAM
+ *       is fixed-up accordingly.
+ */
+#define MEM_MEGS 32
+
+/* Mock up a minimal/fake residual; just enough to make the
+ * bootloader happy.
+ */
+struct fake_data {
+	unsigned long dat_len;
+	unsigned long res_off;
+	unsigned long cmd_off;
+	unsigned long cmd_len;
+	unsigned long img_adr;
+	RESIDUAL      fake_residual;
+	char          cmdline[1024];
+} fake_data = {
+dat_len: sizeof(fake_data),
+res_off: (unsigned long) &fake_data.fake_residual
+        -(unsigned long) &fake_data,
+cmd_off: (unsigned long) &fake_data.cmdline
+        -(unsigned long) &fake_data,
+cmd_len: sizeof(fake_data.cmdline),
+img_adr: KERNELBASE,
+fake_residual: 
+{
+  ResidualLength: sizeof(RESIDUAL),
+  Version:          0,
+  Revision:         0,
+  EC:               0,
+  VitalProductData: {
+	FirmwareSupplier:  QEMU,
+	ProcessorHz:    300000000, /* fantasy */
+	ProcessorBusHz: 100000000, /* qemu timebase clock */
+	TimeBaseDivisor:1*1000,
+  },
+  MaxNumCpus:       1,
+  ActualNumCpus:    1,
+  Cpus: {
+    {
+	CpuType:        0x00040103, /* FIXME: fill from PVR */
+	CpuNumber:      0,  
+    CpuState:       0,
+    },
+  },
+  /* Memory */
+  TotalMemory:      1024*1024*MEM_MEGS,
+  GoodMemory:       1024*1024*MEM_MEGS,
+  ActualNumMemSegs: 13,
+  Segs: {
+    { 0x2000, 0xFFF00, 0x00100 },
+    { 0x0020, MEM_MEGS*0x100, 0x80000 - MEM_MEGS*0x100 },
+    { 0x0008, 0x00800, 0x00168 },
+    { 0x0004, 0x00000, 0x00005 },
+    { 0x0001, 0x006F1, 0x0010F },
+    { 0x0002, 0x006AD, 0x00044 },
+    { 0x0010, 0x00005, 0x006A8 },
+    { 0x0010, 0x00968, MEM_MEGS*0x100 - 0x00968 },
+    { 0x0800, 0xC0000, 0x3F000 },
+    { 0x0600, 0xBF800, 0x00800 },
+    { 0x0500, 0x81000, 0x3E800 },
+    { 0x0480, 0x80800, 0x00800 },
+    { 0x0440, 0x80000, 0x00800 }  
+  },
+  ActualNumMemories: 0,
+  Memories: {
+	{0},
+  },
+  /* Devices */
+  ActualNumDevices:  1,
+  Devices: {
+	{
+	DeviceId: {
+		BusId:     PROCESSORDEVICE,
+		BaseType:  BridgeController,
+		SubType:   PCIBridge,
+		Interface: PCIBridgeIndirect,
+	},
+	}
+  },
+  DevicePnPHeap: {0}
+},
+/* This is overwritten by command line passed by qemu. */
+cmdline: {
+	'-','-','n','e','2','k','-','i','r','q','=','9',
+	0,
+}
+};
+
+/* Read one byte from NVRAM */
+static inline uint8_t
+nvram_rd(void)
+{
+uint8_t rval = *(volatile uint8_t*)0x80000077;
+	asm volatile("eieio");
+	return rval;
+}
+
+/* Set NVRAM address pointer */
+static inline void
+nvram_addr(uint16_t addr)
+{
+	*(volatile uint8_t*)0x80000074 = (addr & 0xff);
+	asm volatile("eieio");
+	*(volatile uint8_t*)0x80000075 = ((addr>>8) & 0xff);
+	asm volatile("eieio");
+}
+
+/* Read a 32-bit (big-endian) work from NVRAM */
+uint32_t
+nvram_rdl_be(uint16_t addr)
+{
+int i;
+uint32_t rval = 0;
+	for ( i=0; i<sizeof(rval); i++ ) { 
+		nvram_addr( addr + i );
+		rval = (rval<<8) | nvram_rd();
+	}
+	return rval;
+}
+
+
+/* !!! NOTE !!!
+ *
+ * We use a special hack to propagate command-line info to the bootloader.
+ * This is NOT PreP compliant (but who cares).
+ * We set R6 and R7 to point to the start/end of the command line string
+ * and hacked the bootloader so it uses R6/R7 (provided that the firmware
+ * is detected as 'QEMU').
+ *
+ * (see bootloader/mm.c, bootloader/misc.c,  bootloader/bootldr.h, -- boot_data.cmd_line[])
+ */
+uint32_t
+res_copy(void)
+{
+struct   fake_data *p;
+uint32_t addr, cmdl, l, imga;
+uint32_t mem_sz, pgs;
+int      i;
+int      have_nvram;
+
+	/* Make sure we have a valid NVRAM -- just check for 'QEMU' at the
+	 * beginning 
+	 */
+	have_nvram = ( (('Q'<<24) | ('E'<<16) | ('M'<< 8) | ('U'<< 0)) == nvram_rdl_be( 0x0000 ) );
+
+	if ( !have_nvram ) {
+		/* reading NVRAM failed - fall back to using the static residual copy;
+		 * this means no support for variable memory size or 'true' command line.
+		 */
+		return (uint32_t)&fake_data;
+	}
+
+	/* Dilemma - we don't really know where to put the residual copy
+     * (original is in ROM and cannot be modified).
+	 * We can't put it at the top of memory since the bootloader starts
+	 * allocating memory from there, before saving the residual, that is.
+	 * Too close to the final image might not work either because RTEMS
+	 * zeroes its BSS *before* making its copies of the residual and commandline.
+	 *
+ 	 * For now we hope that appending to the kernel image works (and that
+	 * the bootloader puts it somewhere safe).
+	 */
+	imga  = nvram_rdl_be( 0x0038 );
+	addr  = imga + nvram_rdl_be( 0x003c );
+	addr += 0x1f;
+	addr &= ~(0x1f);
+
+	p     = (struct fake_data *)addr;
+
+	/* commandline + length from NVRAM */
+	cmdl  = nvram_rdl_be( 0x0040 );
+	l     = nvram_rdl_be( 0x0044 );
+
+	if ( l > 0 ) {
+		/* have a command-line; copy it into our local buffer */
+		if ( l > sizeof( p->cmdline ) - 1 ) {
+			l = sizeof( p->cmdline ) - 1;
+		}
+		/* original may overlap our buffer; must safely move around */
+		if ( p->cmdline < (char*)cmdl ) {
+			for ( i=0; i<l; i++ ) {
+				p->cmdline[i] = ((char*)cmdl)[i];
+			}
+		} else {
+			for ( i=l-1; i>=0; i-- ) {
+				p->cmdline[i] = ((char*)cmdl)[i];
+			}
+		}
+	}
+	p->cmdline[l]      = 0;
+	/* Copy rest of residual */
+	for ( i=0; i<sizeof(p->fake_residual); i++ )
+		((char*)&p->fake_residual)[i] = ((char*)&fake_data.fake_residual)[i];
+	p->dat_len         = fake_data.dat_len;
+	p->res_off         = fake_data.res_off;
+	p->cmd_off         = fake_data.cmd_off;
+	p->cmd_len         = l+1;
+	p->img_adr         = imga;
+
+	/* Fix up memory in residual from NVRAM settings */
+
+	mem_sz = nvram_rdl_be( 0x0030 );
+	pgs    = mem_sz >> 12;
+
+	p->fake_residual.TotalMemory = mem_sz;
+	p->fake_residual.GoodMemory  = mem_sz;
+
+	p->fake_residual.Segs[1].BasePage  = pgs;
+	p->fake_residual.Segs[1].PageCount = 0x80000 - pgs;
+	p->fake_residual.Segs[7].PageCount = pgs - 0x00968;
+
+	return (uint32_t)p;
+}
diff --git a/c/src/lib/libbsp/powerpc/shared/bootloader/qemu_fakerom.S b/c/src/lib/libbsp/powerpc/shared/bootloader/qemu_fakerom.S
new file mode 100644
index 0000000000..b0b8e4d38c
--- /dev/null
+++ b/c/src/lib/libbsp/powerpc/shared/bootloader/qemu_fakerom.S
@@ -0,0 +1,198 @@
+/* A fake 'bios' which does nothing but move a kernel image 
+ * to RAM address zero and then starts that...
+ */
+#define LD_CACHE_LINE_SIZE  5
+#define INIT_STACK (0x100 - 16) /* 16-byte/svr4 aligned */
+
+/* These offsets must correspond to declaration in qemu_fakeres.c */
+#define DAT_LEN    0
+#define RES_OFF    4
+#define CMD_OFF    8
+#define CMD_LEN   12
+#define IMG_ADR   16
+
+/* Non-volatile registers */
+#define OBASE     30
+#define PCID      25
+#define PCIA      26
+
+#define PCI_MAX_DEV 32
+
+	.global fake_data
+	.global res_set_memsz
+
+	.global _start
+_start:
+	lis    1,  INIT_STACK@h
+	ori    1,1,INIT_STACK@l
+	bl     pci_irq_set
+		/* copy residual to RAM and fix up; 
+		 * this routine returns a pointer to
+		 * a 'fake_data' struct. If reading
+		 * NVRAM failed then the return value
+		 * points to a fall-back version in
+		 * ROM...
+		 */
+	bl     res_copy
+		/* fake_data pointer to R29 */
+	mr     29, 3
+
+		/* Load up R3..R5 with PreP mandated 
+		 * values (R3: residual, R4: kernel image,
+		 * R5: OpenFirmware PTR (or NULL).
+		 */
+
+		/* load R3 with residual pointer  */
+	lwz    3, RES_OFF(29)
+	add    3, 3, 29
+
+		/* load R4 with image address     */
+	lwz    4, IMG_ADR(29)
+
+		/* load R5 with zero (OFW = NULL) */
+	li     5, 0
+		/* EXTENSION: R6 = cmdline start  */
+	lwz    6, CMD_OFF(29)
+	add    6, 6, 29
+		/* EXTENSION: R7 = cmdline end    */
+	lwz    7, CMD_LEN(29)
+	add    7, 7, 6
+
+		/* jump to image address          */
+	mtctr  4
+	bctr
+
+	.org 0x100
+	b    _start
+
+	.org 0x110
+template:
+	mfsrr0 30
+	mfsrr1 31
+1:  b      1b
+template_end:
+
+	.org 0xc00
+	b    monitor
+	
+
+	.org 0x4000
+codemove: /* src/dst are cache-aligned */
+	addi   5,5,(1<<LD_CACHE_LINE_SIZE)-1
+	srwi   5,5,LD_CACHE_LINE_SIZE
+	addi   3,3,-4
+	addi   4,4,-4
+1:
+	li     0,  (1<<LD_CACHE_LINE_SIZE)
+	mtctr  0
+2:
+	lwzu   0,  4(3)
+	stwu   0,  4(4)
+	bdnz   2b
+	dcbf   0,4
+	icbi   0,4
+	addic. 5,5,-1
+	bne  1b
+	blr
+
+cpexc:
+	lis    3,template@h
+	ori    3,3,template@l
+	li     5,template_end-template
+	b      codemove
+
+monitor:
+	stwu   1,-16(1)
+	stw    OBASE, 8(1)
+	lis    OBASE, 0x80000000@h
+	cmplwi 10,0x63 /* enter_monitor -> RESET */
+	bne    10f
+hwreset:
+	li   3,1
+	stb  3,0x92(OBASE)
+1:  b 1b
+10: cmplwi 10,0x1d /* .NETCTRL -> ignore */
+	bne    10f
+	b      ret_from_mon
+10: b hwreset      /* unknown -> RESET */ 
+
+ret_from_mon:
+	lwz    OBASE,8(1)
+	lwz    1,0(1)
+	rfi
+
+rcb:
+	stwbrx 3, 0, PCIA
+	lbzx   3, 0, PCID
+	blr
+
+wcb:
+	stwbrx 3, 0, PCIA
+	stbx   4, 0, PCID
+	blr
+
+rcd:
+	stwbrx 3, 0, PCIA
+	lwbrx  3, 0, PCID
+	blr
+
+/* fixup pci interrupt line register according to what
+ * qemu does: line = ((pin-1) +  slot_no) & 1 ? 11 : 9;
+ */
+pci_irq_set:
+		/* set up stack frame */
+	stwu    1, -32(1)
+	mflr    0
+	stw     0,  32+4(1)
+		/* load counter with # of PCI devs */	
+	li      0, PCI_MAX_DEV
+	mtctr   0
+		/* save non-volatile registers we use
+		 * in stack frame
+		 */
+	stw    20,               8(1)
+	stw  PCIA,              12(1)
+	stw  PCID,              16(1)
+		/* load non-volatile registers with
+		 * intended values.
+		 */
+	lis  20,         0x80000000@h /* key for slot # 0             */
+	lis  PCIA,       0x80000cf8@h /* PCI config space address reg */
+	ori  PCIA, PCIA, 0x80000cf8@l 
+	addi PCID, PCIA, 4            /* PCI config space data    reg */
+
+		/* loop over all slots and fix up PCI IRQ LINE */
+1:
+	mr   3, 20
+	bl   rcd
+	addi 3, 3, 1
+	cmplwi 3, 0      /* slot empty (= -1 + 1 = 0) ? */
+	beq  2f
+	addi 3, 20, 0x3d
+	bl   rcb
+	cmplwi 3, 0
+	beq  2f
+	slwi  4, 3, 11
+	addi  3, 20, 0x3c
+	xor   4, 4, 3    /* bit 11 = slot # + irq_num [zero-based] + 1 */
+	andi. 4, 4, 0x0800
+	li   4, 11
+	beq  3f
+	li   4,  9
+3:
+	bl   wcb
+2:
+	addi 20, 20, 0x0800 /* next slot */
+    bdnz 1b
+
+		/* restore and return */
+	lwz 20,  32+4(1)
+	mtlr 20
+	lwz PCID, 16(1)
+	lwz PCIA, 12(1)
+	lwz 20,    8(1)
+	lwz 1,     0(1)
+	blr
+
+	.section .romentry, "ax"
+	b     _start
diff --git a/c/src/lib/libbsp/powerpc/shared/irq/irq.h b/c/src/lib/libbsp/powerpc/shared/irq/irq.h
index 4e59f57838..75a155e483 100644
--- a/c/src/lib/libbsp/powerpc/shared/irq/irq.h
+++ b/c/src/lib/libbsp/powerpc/shared/irq/irq.h
@@ -78,7 +78,11 @@ extern "C" {
  * PCI IRQ handlers related definitions
  * CAUTION : BSP_PCI_IRQ_LOWEST_OFFSET should be equal to OPENPIC_VEC_SOURCE
  */
+#ifndef qemu
 #define BSP_PCI_IRQ_NUMBER		(16)
+#else
+#define BSP_PCI_IRQ_NUMBER		(0)
+#endif
 #define BSP_PCI_IRQ_LOWEST_OFFSET	(BSP_ISA_IRQ_NUMBER)
 #define BSP_PCI_IRQ_MAX_OFFSET		(BSP_PCI_IRQ_LOWEST_OFFSET + BSP_PCI_IRQ_NUMBER - 1)
 /*
@@ -90,7 +94,12 @@ extern "C" {
 #define BSP_PROCESSOR_IRQ_MAX_OFFSET	(BSP_PROCESSOR_IRQ_LOWEST_OFFSET + BSP_PROCESSOR_IRQ_NUMBER - 1)
 /* Misc vectors for OPENPIC irqs (IPI, timers)
  */
+#ifndef qemu
 #define BSP_MISC_IRQ_NUMBER		(8)
+#else
+#define BSP_MISC_IRQ_NUMBER		(0)
+#endif
+
 #define BSP_MISC_IRQ_LOWEST_OFFSET	(BSP_PROCESSOR_IRQ_MAX_OFFSET + 1)
 #define BSP_MISC_IRQ_MAX_OFFSET		(BSP_MISC_IRQ_LOWEST_OFFSET + BSP_MISC_IRQ_NUMBER - 1)
 /*
@@ -112,7 +121,9 @@ extern "C" {
  * Some PCI IRQ symbolic name definition
  */
 #define BSP_PCI_IRQ0			(BSP_PCI_IRQ_LOWEST_OFFSET)
+#if     BSP_PCI_IRQ_NUMBER > 0
 #define BSP_PCI_ISA_BRIDGE_IRQ		(BSP_PCI_IRQ0)
+#endif
 
 #if defined(mvme2100)
 #define BSP_DEC21143_IRQ                (BSP_PCI_IRQ_LOWEST_OFFSET + 1)
diff --git a/c/src/lib/libbsp/powerpc/shared/motorola/motorola.c b/c/src/lib/libbsp/powerpc/shared/motorola/motorola.c
index ac658f2418..ed24b44ca9 100644
--- a/c/src/lib/libbsp/powerpc/shared/motorola/motorola.c
+++ b/c/src/lib/libbsp/powerpc/shared/motorola/motorola.c
@@ -67,6 +67,16 @@
 #define NULL_PINMAP     {-1,{-1,-1,-1,-1}}
 #define NULL_INTMAP     {-1,-1,-1,{}}
 
+#ifdef qemu
+static struct _int_map qemu_prep_intmap[] = {
+    { 0, -1, PCI_FIXUP_OPT_OVERRIDE_NAME,
+	            { { 1, { 9, -1, -1, -1}},
+                  { 2, {11, -1  -1, -1}},
+                  NULL_PINMAP }},
+	NULL_INTMAP
+};
+#endif
+
 static struct _int_map mcp750_intmap[] = {
 
    { 0, 16, 0, {{1,  {5, 19,-1,-1}}, /* pmc slot */
@@ -304,7 +314,11 @@ static const mot_info_t mot_boards[] = {
   {0x050, 0x00, PPC_UNKNOWN, "Omaha (PowerStack II Pro3000)", NULL, NULL},
   {0x060, 0x00, PPC_UNKNOWN, "Utah (Powerstack II Pro4000)", NULL, NULL},
   {0x0A0, 0x00, PPC_UNKNOWN, "Powerstack (Series EX)", NULL, NULL},
+#ifdef qemu
+  {0x1E0, 0xE0, PPC_UNKNOWN, "QEMU", qemu_prep_intmap, prep_pci_swizzle},
+#else
   {0x1E0, 0xE0, PPC_UNKNOWN, "Mesquite cPCI (MCP750)", mcp750_intmap, prep_pci_swizzle},
+#endif
   {0x1E0, 0xE1, PPC_UNKNOWN, "Sitka cPCI (MCPN750)", mcp750_intmap, prep_pci_swizzle},
   {0x1E0, 0xE2, PPC_UNKNOWN, "Mesquite cPCI (MCP750) w/ HAC", mcp750_intmap, prep_pci_swizzle},
   {0x1E0, 0xF6, PPC_UNKNOWN, "MTX Plus", NULL, NULL},
diff --git a/c/src/lib/libbsp/powerpc/shared/residual/residual.h b/c/src/lib/libbsp/powerpc/shared/residual/residual.h
index b0267f5073..114778e706 100644
--- a/c/src/lib/libbsp/powerpc/shared/residual/residual.h
+++ b/c/src/lib/libbsp/powerpc/shared/residual/residual.h
@@ -63,6 +63,7 @@ typedef enum _FIRMWARE_SUPPLIERS {
   MotoFirmware = 0x01,                  /* 7/18/95                            */
   FirmWorks = 0x02,                     /* 10/5/95                            */
   Bull = 0x03,                          /* 04/03/96                           */
+  QEMU = ('q'<<24) | ('e'<<16) | ('m'<<8) | ('u'<<0),
   } FIRMWARE_SUPPLIERS;
 
 typedef enum _ENDIAN_SWITCH_METHODS {
@@ -321,6 +322,12 @@ typedef struct _RESIDUAL {
 #define NULL	0
 #endif
 
+static inline int
+residual_fw_is_qemu(RESIDUAL *r)
+{
+	return QEMU == r->VitalProductData.FirmwareSupplier;
+}
+
 extern RESIDUAL residualCopy;
 
 extern void print_residual_device_info(void);
diff --git a/c/src/lib/libbsp/powerpc/shared/startup/bspstart.c b/c/src/lib/libbsp/powerpc/shared/startup/bspstart.c
index aa4c8ff73c..274809623d 100644
--- a/c/src/lib/libbsp/powerpc/shared/startup/bspstart.c
+++ b/c/src/lib/libbsp/powerpc/shared/startup/bspstart.c
@@ -41,7 +41,6 @@ extern unsigned get_L2CR(void);
 extern void set_L2CR(unsigned);
 extern Triv121PgTbl BSP_pgtbl_setup(unsigned int *);
 extern void			BSP_pgtbl_activate(Triv121PgTbl);
-extern void			BSP_vme_config(void);
 
 SPR_RW(SPRG1)
 
@@ -180,7 +179,11 @@ void bsp_start( void )
   /*
    * Must have acces to open pic PCI ACK registers provided by the RAVEN
    */
+#ifndef qemu
   setdbat(3, 0xf0000000, 0xf0000000, 0x10000000, IO_PAGE);
+#else
+  setdbat(3, 0xb0000000, 0xb0000000, 0x10000000, IO_PAGE);
+#endif
 
 #if defined(mvme2100)
   /* Need 0xfec00000 mapped for this */
@@ -253,7 +256,6 @@ void bsp_start( void )
 #ifdef SHOW_MORE_INIT_SETTINGS
   printk("Residuals are located at %x\n", (unsigned) &residualCopy);
   printk("Additionnal boot options are %s\n", loaderParam);
-  printk("Initial system stack at %x\n",stack);
   printk("Software IRQ stack starts at %x with size %u\n", intrStackStart, intrStackSize);
   printk("-----------------------------------------\n");
 #endif
@@ -329,7 +331,13 @@ void bsp_start( void )
   pt = BSP_pgtbl_setup(&BSP_mem_size);
 
   if (!pt || TRIV121_MAP_SUCCESS != triv121PgTblMap(
-            pt, TRIV121_121_VSID, 0xfeff0000, 1,
+            pt, TRIV121_121_VSID,
+#ifndef qemu
+            0xfeff0000,
+#else
+            0xbffff000,
+#endif
+            1,
             TRIV121_ATTR_IO_PAGE, TRIV121_PP_RW_PAGE)) {
 	printk("WARNING: unable to setup page tables VME "
                "bridge must share PCI space\n");