Git Repo - qemu.git/blame_incremental

... / ...

Commit	Line	Data
	1	/*
	2	* Intel XScale PXA255/270 processor support.
	3	*
	4	* Copyright (c) 2006 Openedhand Ltd.
	5	* Written by Andrzej Zaborowski <[email protected]>
	6	*
	7	* This code is licensed under the GPL.
	8	*/
	9
	10	#include "qemu/osdep.h"
	11	#include "hw/sysbus.h"
	12	#include "hw/arm/pxa.h"
	13	#include "sysemu/sysemu.h"
	14	#include "hw/char/serial.h"
	15	#include "hw/i2c/i2c.h"
	16	#include "hw/ssi.h"
	17	#include "sysemu/char.h"
	18	#include "sysemu/block-backend.h"
	19	#include "sysemu/blockdev.h"
	20
	21	static struct {
	22	hwaddr io_base;
	23	int irqn;
	24	} pxa255_serial[] = {
	25	{ 0x40100000, PXA2XX_PIC_FFUART },
	26	{ 0x40200000, PXA2XX_PIC_BTUART },
	27	{ 0x40700000, PXA2XX_PIC_STUART },
	28	{ 0x41600000, PXA25X_PIC_HWUART },
	29	{ 0, 0 }
	30	}, pxa270_serial[] = {
	31	{ 0x40100000, PXA2XX_PIC_FFUART },
	32	{ 0x40200000, PXA2XX_PIC_BTUART },
	33	{ 0x40700000, PXA2XX_PIC_STUART },
	34	{ 0, 0 }
	35	};
	36
	37	typedef struct PXASSPDef {
	38	hwaddr io_base;
	39	int irqn;
	40	} PXASSPDef;
	41
	42	#if 0
	43	static PXASSPDef pxa250_ssp[] = {
	44	{ 0x41000000, PXA2XX_PIC_SSP },
	45	{ 0, 0 }
	46	};
	47	#endif
	48
	49	static PXASSPDef pxa255_ssp[] = {
	50	{ 0x41000000, PXA2XX_PIC_SSP },
	51	{ 0x41400000, PXA25X_PIC_NSSP },
	52	{ 0, 0 }
	53	};
	54
	55	#if 0
	56	static PXASSPDef pxa26x_ssp[] = {
	57	{ 0x41000000, PXA2XX_PIC_SSP },
	58	{ 0x41400000, PXA25X_PIC_NSSP },
	59	{ 0x41500000, PXA26X_PIC_ASSP },
	60	{ 0, 0 }
	61	};
	62	#endif
	63
	64	static PXASSPDef pxa27x_ssp[] = {
	65	{ 0x41000000, PXA2XX_PIC_SSP },
	66	{ 0x41700000, PXA27X_PIC_SSP2 },
	67	{ 0x41900000, PXA2XX_PIC_SSP3 },
	68	{ 0, 0 }
	69	};
	70
	71	#define PMCR 0x00 /* Power Manager Control register */
	72	#define PSSR 0x04 /* Power Manager Sleep Status register */
	73	#define PSPR 0x08 /* Power Manager Scratch-Pad register */
	74	#define PWER 0x0c /* Power Manager Wake-Up Enable register */
	75	#define PRER 0x10 /* Power Manager Rising-Edge Detect Enable register */
	76	#define PFER 0x14 /* Power Manager Falling-Edge Detect Enable register */
	77	#define PEDR 0x18 /* Power Manager Edge-Detect Status register */
	78	#define PCFR 0x1c /* Power Manager General Configuration register */
	79	#define PGSR0 0x20 /* Power Manager GPIO Sleep-State register 0 */
	80	#define PGSR1 0x24 /* Power Manager GPIO Sleep-State register 1 */
	81	#define PGSR2 0x28 /* Power Manager GPIO Sleep-State register 2 */
	82	#define PGSR3 0x2c /* Power Manager GPIO Sleep-State register 3 */
	83	#define RCSR 0x30 /* Reset Controller Status register */
	84	#define PSLR 0x34 /* Power Manager Sleep Configuration register */
	85	#define PTSR 0x38 /* Power Manager Standby Configuration register */
	86	#define PVCR 0x40 /* Power Manager Voltage Change Control register */
	87	#define PUCR 0x4c /* Power Manager USIM Card Control/Status register */
	88	#define PKWR 0x50 /* Power Manager Keyboard Wake-Up Enable register */
	89	#define PKSR 0x54 /* Power Manager Keyboard Level-Detect Status */
	90	#define PCMD0 0x80 /* Power Manager I2C Command register File 0 */
	91	#define PCMD31 0xfc /* Power Manager I2C Command register File 31 */
	92
	93	static uint64_t pxa2xx_pm_read(void *opaque, hwaddr addr,
	94	unsigned size)
	95	{
	96	PXA2xxState s = (PXA2xxState ) opaque;
	97
	98	switch (addr) {
	99	case PMCR ... PCMD31:
	100	if (addr & 3)
	101	goto fail;
	102
	103	return s->pm_regs[addr >> 2];
	104	default:
	105	fail:
	106	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	107	break;
	108	}
	109	return 0;
	110	}
	111
	112	static void pxa2xx_pm_write(void *opaque, hwaddr addr,
	113	uint64_t value, unsigned size)
	114	{
	115	PXA2xxState s = (PXA2xxState ) opaque;
	116
	117	switch (addr) {
	118	case PMCR:
	119	/* Clear the write-one-to-clear bits... */
	120	s->pm_regs[addr >> 2] &= ~(value & 0x2a);
	121	/* ...and set the plain r/w bits */
	122	s->pm_regs[addr >> 2] &= ~0x15;
	123	s->pm_regs[addr >> 2] \|= value & 0x15;
	124	break;
	125
	126	case PSSR: /* Read-clean registers */
	127	case RCSR:
	128	case PKSR:
	129	s->pm_regs[addr >> 2] &= ~value;
	130	break;
	131
	132	default: /* Read-write registers */
	133	if (!(addr & 3)) {
	134	s->pm_regs[addr >> 2] = value;
	135	break;
	136	}
	137
	138	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	139	break;
	140	}
	141	}
	142
	143	static const MemoryRegionOps pxa2xx_pm_ops = {
	144	.read = pxa2xx_pm_read,
	145	.write = pxa2xx_pm_write,
	146	.endianness = DEVICE_NATIVE_ENDIAN,
	147	};
	148
	149	static const VMStateDescription vmstate_pxa2xx_pm = {
	150	.name = "pxa2xx_pm",
	151	.version_id = 0,
	152	.minimum_version_id = 0,
	153	.fields = (VMStateField[]) {
	154	VMSTATE_UINT32_ARRAY(pm_regs, PXA2xxState, 0x40),
	155	VMSTATE_END_OF_LIST()
	156	}
	157	};
	158
	159	#define CCCR 0x00 /* Core Clock Configuration register */
	160	#define CKEN 0x04 /* Clock Enable register */
	161	#define OSCC 0x08 /* Oscillator Configuration register */
	162	#define CCSR 0x0c /* Core Clock Status register */
	163
	164	static uint64_t pxa2xx_cm_read(void *opaque, hwaddr addr,
	165	unsigned size)
	166	{
	167	PXA2xxState s = (PXA2xxState ) opaque;
	168
	169	switch (addr) {
	170	case CCCR:
	171	case CKEN:
	172	case OSCC:
	173	return s->cm_regs[addr >> 2];
	174
	175	case CCSR:
	176	return s->cm_regs[CCCR >> 2] \| (3 << 28);
	177
	178	default:
	179	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	180	break;
	181	}
	182	return 0;
	183	}
	184
	185	static void pxa2xx_cm_write(void *opaque, hwaddr addr,
	186	uint64_t value, unsigned size)
	187	{
	188	PXA2xxState s = (PXA2xxState ) opaque;
	189
	190	switch (addr) {
	191	case CCCR:
	192	case CKEN:
	193	s->cm_regs[addr >> 2] = value;
	194	break;
	195
	196	case OSCC:
	197	s->cm_regs[addr >> 2] &= ~0x6c;
	198	s->cm_regs[addr >> 2] \|= value & 0x6e;
	199	if ((value >> 1) & 1) /* OON */
	200	s->cm_regs[addr >> 2] \|= 1 << 0; /* Oscillator is now stable */
	201	break;
	202
	203	default:
	204	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	205	break;
	206	}
	207	}
	208
	209	static const MemoryRegionOps pxa2xx_cm_ops = {
	210	.read = pxa2xx_cm_read,
	211	.write = pxa2xx_cm_write,
	212	.endianness = DEVICE_NATIVE_ENDIAN,
	213	};
	214
	215	static const VMStateDescription vmstate_pxa2xx_cm = {
	216	.name = "pxa2xx_cm",
	217	.version_id = 0,
	218	.minimum_version_id = 0,
	219	.fields = (VMStateField[]) {
	220	VMSTATE_UINT32_ARRAY(cm_regs, PXA2xxState, 4),
	221	VMSTATE_UINT32(clkcfg, PXA2xxState),
	222	VMSTATE_UINT32(pmnc, PXA2xxState),
	223	VMSTATE_END_OF_LIST()
	224	}
	225	};
	226
	227	static uint64_t pxa2xx_clkcfg_read(CPUARMState env, const ARMCPRegInfo ri)
	228	{
	229	PXA2xxState s = (PXA2xxState )ri->opaque;
	230	return s->clkcfg;
	231	}
	232
	233	static void pxa2xx_clkcfg_write(CPUARMState env, const ARMCPRegInfo ri,
	234	uint64_t value)
	235	{
	236	PXA2xxState s = (PXA2xxState )ri->opaque;
	237	s->clkcfg = value & 0xf;
	238	if (value & 2) {
	239	printf("%s: CPU frequency change attempt\n", __func__);
	240	}
	241	}
	242
	243	static void pxa2xx_pwrmode_write(CPUARMState env, const ARMCPRegInfo ri,
	244	uint64_t value)
	245	{
	246	PXA2xxState s = (PXA2xxState )ri->opaque;
	247	static const char *pwrmode[8] = {
	248	"Normal", "Idle", "Deep-idle", "Standby",
	249	"Sleep", "reserved (!)", "reserved (!)", "Deep-sleep",
	250	};
	251
	252	if (value & 8) {
	253	printf("%s: CPU voltage change attempt\n", __func__);
	254	}
	255	switch (value & 7) {
	256	case 0:
	257	/* Do nothing */
	258	break;
	259
	260	case 1:
	261	/* Idle */
	262	if (!(s->cm_regs[CCCR >> 2] & (1U << 31))) { /* CPDIS */
	263	cpu_interrupt(CPU(s->cpu), CPU_INTERRUPT_HALT);
	264	break;
	265	}
	266	/* Fall through. */
	267
	268	case 2:
	269	/* Deep-Idle */
	270	cpu_interrupt(CPU(s->cpu), CPU_INTERRUPT_HALT);
	271	s->pm_regs[RCSR >> 2] \|= 0x8; /* Set GPR */
	272	goto message;
	273
	274	case 3:
	275	s->cpu->env.uncached_cpsr = ARM_CPU_MODE_SVC;
	276	s->cpu->env.daif = PSTATE_A \| PSTATE_F \| PSTATE_I;
	277	s->cpu->env.cp15.sctlr_ns = 0;
	278	s->cpu->env.cp15.cpacr_el1 = 0;
	279	s->cpu->env.cp15.ttbr0_el[1] = 0;
	280	s->cpu->env.cp15.dacr_ns = 0;
	281	s->pm_regs[PSSR >> 2] \|= 0x8; /* Set STS */
	282	s->pm_regs[RCSR >> 2] \|= 0x8; /* Set GPR */
	283
	284	/*
	285	* The scratch-pad register is almost universally used
	286	* for storing the return address on suspend. For the
	287	* lack of a resuming bootloader, perform a jump
	288	* directly to that address.
	289	*/
	290	memset(s->cpu->env.regs, 0, 4 * 15);
	291	s->cpu->env.regs[15] = s->pm_regs[PSPR >> 2];
	292
	293	#if 0
	294	buffer = 0xe59ff000; /* ldr pc, [pc, #0] */
	295	cpu_physical_memory_write(0, &buffer, 4);
	296	buffer = s->pm_regs[PSPR >> 2];
	297	cpu_physical_memory_write(8, &buffer, 4);
	298	#endif
	299
	300	/* Suspend */
	301	cpu_interrupt(current_cpu, CPU_INTERRUPT_HALT);
	302
	303	goto message;
	304
	305	default:
	306	message:
	307	printf("%s: machine entered %s mode\n", __func__,
	308	pwrmode[value & 7]);
	309	}
	310	}
	311
	312	static uint64_t pxa2xx_cppmnc_read(CPUARMState env, const ARMCPRegInfo ri)
	313	{
	314	PXA2xxState s = (PXA2xxState )ri->opaque;
	315	return s->pmnc;
	316	}
	317
	318	static void pxa2xx_cppmnc_write(CPUARMState env, const ARMCPRegInfo ri,
	319	uint64_t value)
	320	{
	321	PXA2xxState s = (PXA2xxState )ri->opaque;
	322	s->pmnc = value;
	323	}
	324
	325	static uint64_t pxa2xx_cpccnt_read(CPUARMState env, const ARMCPRegInfo ri)
	326	{
	327	PXA2xxState s = (PXA2xxState )ri->opaque;
	328	if (s->pmnc & 1) {
	329	return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
	330	} else {
	331	return 0;
	332	}
	333	}
	334
	335	static const ARMCPRegInfo pxa_cp_reginfo[] = {
	336	/* cp14 crm==1: perf registers */
	337	{ .name = "CPPMNC", .cp = 14, .crn = 0, .crm = 1, .opc1 = 0, .opc2 = 0,
	338	.access = PL1_RW, .type = ARM_CP_IO,
	339	.readfn = pxa2xx_cppmnc_read, .writefn = pxa2xx_cppmnc_write },
	340	{ .name = "CPCCNT", .cp = 14, .crn = 1, .crm = 1, .opc1 = 0, .opc2 = 0,
	341	.access = PL1_RW, .type = ARM_CP_IO,
	342	.readfn = pxa2xx_cpccnt_read, .writefn = arm_cp_write_ignore },
	343	{ .name = "CPINTEN", .cp = 14, .crn = 4, .crm = 1, .opc1 = 0, .opc2 = 0,
	344	.access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
	345	{ .name = "CPFLAG", .cp = 14, .crn = 5, .crm = 1, .opc1 = 0, .opc2 = 0,
	346	.access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
	347	{ .name = "CPEVTSEL", .cp = 14, .crn = 8, .crm = 1, .opc1 = 0, .opc2 = 0,
	348	.access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
	349	/* cp14 crm==2: performance count registers */
	350	{ .name = "CPPMN0", .cp = 14, .crn = 0, .crm = 2, .opc1 = 0, .opc2 = 0,
	351	.access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
	352	{ .name = "CPPMN1", .cp = 14, .crn = 1, .crm = 2, .opc1 = 0, .opc2 = 0,
	353	.access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
	354	{ .name = "CPPMN2", .cp = 14, .crn = 2, .crm = 2, .opc1 = 0, .opc2 = 0,
	355	.access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
	356	{ .name = "CPPMN3", .cp = 14, .crn = 2, .crm = 3, .opc1 = 0, .opc2 = 0,
	357	.access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
	358	/* cp14 crn==6: CLKCFG */
	359	{ .name = "CLKCFG", .cp = 14, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
	360	.access = PL1_RW, .type = ARM_CP_IO,
	361	.readfn = pxa2xx_clkcfg_read, .writefn = pxa2xx_clkcfg_write },
	362	/* cp14 crn==7: PWRMODE */
	363	{ .name = "PWRMODE", .cp = 14, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 0,
	364	.access = PL1_RW, .type = ARM_CP_IO,
	365	.readfn = arm_cp_read_zero, .writefn = pxa2xx_pwrmode_write },
	366	REGINFO_SENTINEL
	367	};
	368
	369	static void pxa2xx_setup_cp14(PXA2xxState *s)
	370	{
	371	define_arm_cp_regs_with_opaque(s->cpu, pxa_cp_reginfo, s);
	372	}
	373
	374	#define MDCNFG 0x00 /* SDRAM Configuration register */
	375	#define MDREFR 0x04 /* SDRAM Refresh Control register */
	376	#define MSC0 0x08 /* Static Memory Control register 0 */
	377	#define MSC1 0x0c /* Static Memory Control register 1 */
	378	#define MSC2 0x10 /* Static Memory Control register 2 */
	379	#define MECR 0x14 /* Expansion Memory Bus Config register */
	380	#define SXCNFG 0x1c /* Synchronous Static Memory Config register */
	381	#define MCMEM0 0x28 /* PC Card Memory Socket 0 Timing register */
	382	#define MCMEM1 0x2c /* PC Card Memory Socket 1 Timing register */
	383	#define MCATT0 0x30 /* PC Card Attribute Socket 0 register */
	384	#define MCATT1 0x34 /* PC Card Attribute Socket 1 register */
	385	#define MCIO0 0x38 /* PC Card I/O Socket 0 Timing register */
	386	#define MCIO1 0x3c /* PC Card I/O Socket 1 Timing register */
	387	#define MDMRS 0x40 /* SDRAM Mode Register Set Config register */
	388	#define BOOT_DEF 0x44 /* Boot-time Default Configuration register */
	389	#define ARB_CNTL 0x48 /* Arbiter Control register */
	390	#define BSCNTR0 0x4c /* Memory Buffer Strength Control register 0 */
	391	#define BSCNTR1 0x50 /* Memory Buffer Strength Control register 1 */
	392	#define LCDBSCNTR 0x54 /* LCD Buffer Strength Control register */
	393	#define MDMRSLP 0x58 /* Low Power SDRAM Mode Set Config register */
	394	#define BSCNTR2 0x5c /* Memory Buffer Strength Control register 2 */
	395	#define BSCNTR3 0x60 /* Memory Buffer Strength Control register 3 */
	396	#define SA1110 0x64 /* SA-1110 Memory Compatibility register */
	397
	398	static uint64_t pxa2xx_mm_read(void *opaque, hwaddr addr,
	399	unsigned size)
	400	{
	401	PXA2xxState s = (PXA2xxState ) opaque;
	402
	403	switch (addr) {
	404	case MDCNFG ... SA1110:
	405	if ((addr & 3) == 0)
	406	return s->mm_regs[addr >> 2];
	407
	408	default:
	409	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	410	break;
	411	}
	412	return 0;
	413	}
	414
	415	static void pxa2xx_mm_write(void *opaque, hwaddr addr,
	416	uint64_t value, unsigned size)
	417	{
	418	PXA2xxState s = (PXA2xxState ) opaque;
	419
	420	switch (addr) {
	421	case MDCNFG ... SA1110:
	422	if ((addr & 3) == 0) {
	423	s->mm_regs[addr >> 2] = value;
	424	break;
	425	}
	426
	427	default:
	428	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	429	break;
	430	}
	431	}
	432
	433	static const MemoryRegionOps pxa2xx_mm_ops = {
	434	.read = pxa2xx_mm_read,
	435	.write = pxa2xx_mm_write,
	436	.endianness = DEVICE_NATIVE_ENDIAN,
	437	};
	438
	439	static const VMStateDescription vmstate_pxa2xx_mm = {
	440	.name = "pxa2xx_mm",
	441	.version_id = 0,
	442	.minimum_version_id = 0,
	443	.fields = (VMStateField[]) {
	444	VMSTATE_UINT32_ARRAY(mm_regs, PXA2xxState, 0x1a),
	445	VMSTATE_END_OF_LIST()
	446	}
	447	};
	448
	449	#define TYPE_PXA2XX_SSP "pxa2xx-ssp"
	450	#define PXA2XX_SSP(obj) \
	451	OBJECT_CHECK(PXA2xxSSPState, (obj), TYPE_PXA2XX_SSP)
	452
	453	/* Synchronous Serial Ports */
	454	typedef struct {
	455	/< private >/
	456	SysBusDevice parent_obj;
	457	/< public >/
	458
	459	MemoryRegion iomem;
	460	qemu_irq irq;
	461	uint32_t enable;
	462	SSIBus *bus;
	463
	464	uint32_t sscr[2];
	465	uint32_t sspsp;
	466	uint32_t ssto;
	467	uint32_t ssitr;
	468	uint32_t sssr;
	469	uint8_t sstsa;
	470	uint8_t ssrsa;
	471	uint8_t ssacd;
	472
	473	uint32_t rx_fifo[16];
	474	uint32_t rx_level;
	475	uint32_t rx_start;
	476	} PXA2xxSSPState;
	477
	478	static bool pxa2xx_ssp_vmstate_validate(void *opaque, int version_id)
	479	{
	480	PXA2xxSSPState *s = opaque;
	481
	482	return s->rx_start < sizeof(s->rx_fifo);
	483	}
	484
	485	static const VMStateDescription vmstate_pxa2xx_ssp = {
	486	.name = "pxa2xx-ssp",
	487	.version_id = 1,
	488	.minimum_version_id = 1,
	489	.fields = (VMStateField[]) {
	490	VMSTATE_UINT32(enable, PXA2xxSSPState),
	491	VMSTATE_UINT32_ARRAY(sscr, PXA2xxSSPState, 2),
	492	VMSTATE_UINT32(sspsp, PXA2xxSSPState),
	493	VMSTATE_UINT32(ssto, PXA2xxSSPState),
	494	VMSTATE_UINT32(ssitr, PXA2xxSSPState),
	495	VMSTATE_UINT32(sssr, PXA2xxSSPState),
	496	VMSTATE_UINT8(sstsa, PXA2xxSSPState),
	497	VMSTATE_UINT8(ssrsa, PXA2xxSSPState),
	498	VMSTATE_UINT8(ssacd, PXA2xxSSPState),
	499	VMSTATE_UINT32(rx_level, PXA2xxSSPState),
	500	VMSTATE_UINT32(rx_start, PXA2xxSSPState),
	501	VMSTATE_VALIDATE("fifo is 16 bytes", pxa2xx_ssp_vmstate_validate),
	502	VMSTATE_UINT32_ARRAY(rx_fifo, PXA2xxSSPState, 16),
	503	VMSTATE_END_OF_LIST()
	504	}
	505	};
	506
	507	#define SSCR0 0x00 /* SSP Control register 0 */
	508	#define SSCR1 0x04 /* SSP Control register 1 */
	509	#define SSSR 0x08 /* SSP Status register */
	510	#define SSITR 0x0c /* SSP Interrupt Test register */
	511	#define SSDR 0x10 /* SSP Data register */
	512	#define SSTO 0x28 /* SSP Time-Out register */
	513	#define SSPSP 0x2c /* SSP Programmable Serial Protocol register */
	514	#define SSTSA 0x30 /* SSP TX Time Slot Active register */
	515	#define SSRSA 0x34 /* SSP RX Time Slot Active register */
	516	#define SSTSS 0x38 /* SSP Time Slot Status register */
	517	#define SSACD 0x3c /* SSP Audio Clock Divider register */
	518
	519	/* Bitfields for above registers */
	520	#define SSCR0_SPI(x) (((x) & 0x30) == 0x00)
	521	#define SSCR0_SSP(x) (((x) & 0x30) == 0x10)
	522	#define SSCR0_UWIRE(x) (((x) & 0x30) == 0x20)
	523	#define SSCR0_PSP(x) (((x) & 0x30) == 0x30)
	524	#define SSCR0_SSE (1 << 7)
	525	#define SSCR0_RIM (1 << 22)
	526	#define SSCR0_TIM (1 << 23)
	527	#define SSCR0_MOD (1U << 31)
	528	#define SSCR0_DSS(x) (((((x) >> 16) & 0x10) \| ((x) & 0xf)) + 1)
	529	#define SSCR1_RIE (1 << 0)
	530	#define SSCR1_TIE (1 << 1)
	531	#define SSCR1_LBM (1 << 2)
	532	#define SSCR1_MWDS (1 << 5)
	533	#define SSCR1_TFT(x) ((((x) >> 6) & 0xf) + 1)
	534	#define SSCR1_RFT(x) ((((x) >> 10) & 0xf) + 1)
	535	#define SSCR1_EFWR (1 << 14)
	536	#define SSCR1_PINTE (1 << 18)
	537	#define SSCR1_TINTE (1 << 19)
	538	#define SSCR1_RSRE (1 << 20)
	539	#define SSCR1_TSRE (1 << 21)
	540	#define SSCR1_EBCEI (1 << 29)
	541	#define SSITR_INT (7 << 5)
	542	#define SSSR_TNF (1 << 2)
	543	#define SSSR_RNE (1 << 3)
	544	#define SSSR_TFS (1 << 5)
	545	#define SSSR_RFS (1 << 6)
	546	#define SSSR_ROR (1 << 7)
	547	#define SSSR_PINT (1 << 18)
	548	#define SSSR_TINT (1 << 19)
	549	#define SSSR_EOC (1 << 20)
	550	#define SSSR_TUR (1 << 21)
	551	#define SSSR_BCE (1 << 23)
	552	#define SSSR_RW 0x00bc0080
	553
	554	static void pxa2xx_ssp_int_update(PXA2xxSSPState *s)
	555	{
	556	int level = 0;
	557
	558	level \|= s->ssitr & SSITR_INT;
	559	level \|= (s->sssr & SSSR_BCE) && (s->sscr[1] & SSCR1_EBCEI);
	560	level \|= (s->sssr & SSSR_TUR) && !(s->sscr[0] & SSCR0_TIM);
	561	level \|= (s->sssr & SSSR_EOC) && (s->sssr & (SSSR_TINT \| SSSR_PINT));
	562	level \|= (s->sssr & SSSR_TINT) && (s->sscr[1] & SSCR1_TINTE);
	563	level \|= (s->sssr & SSSR_PINT) && (s->sscr[1] & SSCR1_PINTE);
	564	level \|= (s->sssr & SSSR_ROR) && !(s->sscr[0] & SSCR0_RIM);
	565	level \|= (s->sssr & SSSR_RFS) && (s->sscr[1] & SSCR1_RIE);
	566	level \|= (s->sssr & SSSR_TFS) && (s->sscr[1] & SSCR1_TIE);
	567	qemu_set_irq(s->irq, !!level);
	568	}
	569
	570	static void pxa2xx_ssp_fifo_update(PXA2xxSSPState *s)
	571	{
	572	s->sssr &= ~(0xf << 12); /* Clear RFL */
	573	s->sssr &= ~(0xf << 8); /* Clear TFL */
	574	s->sssr &= ~SSSR_TFS;
	575	s->sssr &= ~SSSR_TNF;
	576	if (s->enable) {
	577	s->sssr \|= ((s->rx_level - 1) & 0xf) << 12;
	578	if (s->rx_level >= SSCR1_RFT(s->sscr[1]))
	579	s->sssr \|= SSSR_RFS;
	580	else
	581	s->sssr &= ~SSSR_RFS;
	582	if (s->rx_level)
	583	s->sssr \|= SSSR_RNE;
	584	else
	585	s->sssr &= ~SSSR_RNE;
	586	/* TX FIFO is never filled, so it is always in underrun
	587	condition if SSP is enabled */
	588	s->sssr \|= SSSR_TFS;
	589	s->sssr \|= SSSR_TNF;
	590	}
	591
	592	pxa2xx_ssp_int_update(s);
	593	}
	594
	595	static uint64_t pxa2xx_ssp_read(void *opaque, hwaddr addr,
	596	unsigned size)
	597	{
	598	PXA2xxSSPState s = (PXA2xxSSPState ) opaque;
	599	uint32_t retval;
	600
	601	switch (addr) {
	602	case SSCR0:
	603	return s->sscr[0];
	604	case SSCR1:
	605	return s->sscr[1];
	606	case SSPSP:
	607	return s->sspsp;
	608	case SSTO:
	609	return s->ssto;
	610	case SSITR:
	611	return s->ssitr;
	612	case SSSR:
	613	return s->sssr \| s->ssitr;
	614	case SSDR:
	615	if (!s->enable)
	616	return 0xffffffff;
	617	if (s->rx_level < 1) {
	618	printf("%s: SSP Rx Underrun\n", __FUNCTION__);
	619	return 0xffffffff;
	620	}
	621	s->rx_level --;
	622	retval = s->rx_fifo[s->rx_start ++];
	623	s->rx_start &= 0xf;
	624	pxa2xx_ssp_fifo_update(s);
	625	return retval;
	626	case SSTSA:
	627	return s->sstsa;
	628	case SSRSA:
	629	return s->ssrsa;
	630	case SSTSS:
	631	return 0;
	632	case SSACD:
	633	return s->ssacd;
	634	default:
	635	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	636	break;
	637	}
	638	return 0;
	639	}
	640
	641	static void pxa2xx_ssp_write(void *opaque, hwaddr addr,
	642	uint64_t value64, unsigned size)
	643	{
	644	PXA2xxSSPState s = (PXA2xxSSPState ) opaque;
	645	uint32_t value = value64;
	646
	647	switch (addr) {
	648	case SSCR0:
	649	s->sscr[0] = value & 0xc7ffffff;
	650	s->enable = value & SSCR0_SSE;
	651	if (value & SSCR0_MOD)
	652	printf("%s: Attempt to use network mode\n", __FUNCTION__);
	653	if (s->enable && SSCR0_DSS(value) < 4)
	654	printf("%s: Wrong data size: %i bits\n", __FUNCTION__,
	655	SSCR0_DSS(value));
	656	if (!(value & SSCR0_SSE)) {
	657	s->sssr = 0;
	658	s->ssitr = 0;
	659	s->rx_level = 0;
	660	}
	661	pxa2xx_ssp_fifo_update(s);
	662	break;
	663
	664	case SSCR1:
	665	s->sscr[1] = value;
	666	if (value & (SSCR1_LBM \| SSCR1_EFWR))
	667	printf("%s: Attempt to use SSP test mode\n", __FUNCTION__);
	668	pxa2xx_ssp_fifo_update(s);
	669	break;
	670
	671	case SSPSP:
	672	s->sspsp = value;
	673	break;
	674
	675	case SSTO:
	676	s->ssto = value;
	677	break;
	678
	679	case SSITR:
	680	s->ssitr = value & SSITR_INT;
	681	pxa2xx_ssp_int_update(s);
	682	break;
	683
	684	case SSSR:
	685	s->sssr &= ~(value & SSSR_RW);
	686	pxa2xx_ssp_int_update(s);
	687	break;
	688
	689	case SSDR:
	690	if (SSCR0_UWIRE(s->sscr[0])) {
	691	if (s->sscr[1] & SSCR1_MWDS)
	692	value &= 0xffff;
	693	else
	694	value &= 0xff;
	695	} else
	696	/* Note how 32bits overflow does no harm here */
	697	value &= (1 << SSCR0_DSS(s->sscr[0])) - 1;
	698
	699	/* Data goes from here to the Tx FIFO and is shifted out from
	700	* there directly to the slave, no need to buffer it.
	701	*/
	702	if (s->enable) {
	703	uint32_t readval;
	704	readval = ssi_transfer(s->bus, value);
	705	if (s->rx_level < 0x10) {
	706	s->rx_fifo[(s->rx_start + s->rx_level ++) & 0xf] = readval;
	707	} else {
	708	s->sssr \|= SSSR_ROR;
	709	}
	710	}
	711	pxa2xx_ssp_fifo_update(s);
	712	break;
	713
	714	case SSTSA:
	715	s->sstsa = value;
	716	break;
	717
	718	case SSRSA:
	719	s->ssrsa = value;
	720	break;
	721
	722	case SSACD:
	723	s->ssacd = value;
	724	break;
	725
	726	default:
	727	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	728	break;
	729	}
	730	}
	731
	732	static const MemoryRegionOps pxa2xx_ssp_ops = {
	733	.read = pxa2xx_ssp_read,
	734	.write = pxa2xx_ssp_write,
	735	.endianness = DEVICE_NATIVE_ENDIAN,
	736	};
	737
	738	static void pxa2xx_ssp_reset(DeviceState *d)
	739	{
	740	PXA2xxSSPState *s = PXA2XX_SSP(d);
	741
	742	s->enable = 0;
	743	s->sscr[0] = s->sscr[1] = 0;
	744	s->sspsp = 0;
	745	s->ssto = 0;
	746	s->ssitr = 0;
	747	s->sssr = 0;
	748	s->sstsa = 0;
	749	s->ssrsa = 0;
	750	s->ssacd = 0;
	751	s->rx_start = s->rx_level = 0;
	752	}
	753
	754	static int pxa2xx_ssp_init(SysBusDevice *sbd)
	755	{
	756	DeviceState *dev = DEVICE(sbd);
	757	PXA2xxSSPState *s = PXA2XX_SSP(dev);
	758
	759	sysbus_init_irq(sbd, &s->irq);
	760
	761	memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_ssp_ops, s,
	762	"pxa2xx-ssp", 0x1000);
	763	sysbus_init_mmio(sbd, &s->iomem);
	764
	765	s->bus = ssi_create_bus(dev, "ssi");
	766	return 0;
	767	}
	768
	769	/* Real-Time Clock */
	770	#define RCNR 0x00 /* RTC Counter register */
	771	#define RTAR 0x04 /* RTC Alarm register */
	772	#define RTSR 0x08 /* RTC Status register */
	773	#define RTTR 0x0c /* RTC Timer Trim register */
	774	#define RDCR 0x10 /* RTC Day Counter register */
	775	#define RYCR 0x14 /* RTC Year Counter register */
	776	#define RDAR1 0x18 /* RTC Wristwatch Day Alarm register 1 */
	777	#define RYAR1 0x1c /* RTC Wristwatch Year Alarm register 1 */
	778	#define RDAR2 0x20 /* RTC Wristwatch Day Alarm register 2 */
	779	#define RYAR2 0x24 /* RTC Wristwatch Year Alarm register 2 */
	780	#define SWCR 0x28 /* RTC Stopwatch Counter register */
	781	#define SWAR1 0x2c /* RTC Stopwatch Alarm register 1 */
	782	#define SWAR2 0x30 /* RTC Stopwatch Alarm register 2 */
	783	#define RTCPICR 0x34 /* RTC Periodic Interrupt Counter register */
	784	#define PIAR 0x38 /* RTC Periodic Interrupt Alarm register */
	785
	786	#define TYPE_PXA2XX_RTC "pxa2xx_rtc"
	787	#define PXA2XX_RTC(obj) \
	788	OBJECT_CHECK(PXA2xxRTCState, (obj), TYPE_PXA2XX_RTC)
	789
	790	typedef struct {
	791	/< private >/
	792	SysBusDevice parent_obj;
	793	/< public >/
	794
	795	MemoryRegion iomem;
	796	uint32_t rttr;
	797	uint32_t rtsr;
	798	uint32_t rtar;
	799	uint32_t rdar1;
	800	uint32_t rdar2;
	801	uint32_t ryar1;
	802	uint32_t ryar2;
	803	uint32_t swar1;
	804	uint32_t swar2;
	805	uint32_t piar;
	806	uint32_t last_rcnr;
	807	uint32_t last_rdcr;
	808	uint32_t last_rycr;
	809	uint32_t last_swcr;
	810	uint32_t last_rtcpicr;
	811	int64_t last_hz;
	812	int64_t last_sw;
	813	int64_t last_pi;
	814	QEMUTimer *rtc_hz;
	815	QEMUTimer *rtc_rdal1;
	816	QEMUTimer *rtc_rdal2;
	817	QEMUTimer *rtc_swal1;
	818	QEMUTimer *rtc_swal2;
	819	QEMUTimer *rtc_pi;
	820	qemu_irq rtc_irq;
	821	} PXA2xxRTCState;
	822
	823	static inline void pxa2xx_rtc_int_update(PXA2xxRTCState *s)
	824	{
	825	qemu_set_irq(s->rtc_irq, !!(s->rtsr & 0x2553));
	826	}
	827
	828	static void pxa2xx_rtc_hzupdate(PXA2xxRTCState *s)
	829	{
	830	int64_t rt = qemu_clock_get_ms(rtc_clock);
	831	s->last_rcnr += ((rt - s->last_hz) << 15) /
	832	(1000 * ((s->rttr & 0xffff) + 1));
	833	s->last_rdcr += ((rt - s->last_hz) << 15) /
	834	(1000 * ((s->rttr & 0xffff) + 1));
	835	s->last_hz = rt;
	836	}
	837
	838	static void pxa2xx_rtc_swupdate(PXA2xxRTCState *s)
	839	{
	840	int64_t rt = qemu_clock_get_ms(rtc_clock);
	841	if (s->rtsr & (1 << 12))
	842	s->last_swcr += (rt - s->last_sw) / 10;
	843	s->last_sw = rt;
	844	}
	845
	846	static void pxa2xx_rtc_piupdate(PXA2xxRTCState *s)
	847	{
	848	int64_t rt = qemu_clock_get_ms(rtc_clock);
	849	if (s->rtsr & (1 << 15))
	850	s->last_swcr += rt - s->last_pi;
	851	s->last_pi = rt;
	852	}
	853
	854	static inline void pxa2xx_rtc_alarm_update(PXA2xxRTCState *s,
	855	uint32_t rtsr)
	856	{
	857	if ((rtsr & (1 << 2)) && !(rtsr & (1 << 0)))
	858	timer_mod(s->rtc_hz, s->last_hz +
	859	(((s->rtar - s->last_rcnr) * 1000 *
	860	((s->rttr & 0xffff) + 1)) >> 15));
	861	else
	862	timer_del(s->rtc_hz);
	863
	864	if ((rtsr & (1 << 5)) && !(rtsr & (1 << 4)))
	865	timer_mod(s->rtc_rdal1, s->last_hz +
	866	(((s->rdar1 - s->last_rdcr) * 1000 *
	867	((s->rttr & 0xffff) + 1)) >> 15)); /* TODO: fixup */
	868	else
	869	timer_del(s->rtc_rdal1);
	870
	871	if ((rtsr & (1 << 7)) && !(rtsr & (1 << 6)))
	872	timer_mod(s->rtc_rdal2, s->last_hz +
	873	(((s->rdar2 - s->last_rdcr) * 1000 *
	874	((s->rttr & 0xffff) + 1)) >> 15)); /* TODO: fixup */
	875	else
	876	timer_del(s->rtc_rdal2);
	877
	878	if ((rtsr & 0x1200) == 0x1200 && !(rtsr & (1 << 8)))
	879	timer_mod(s->rtc_swal1, s->last_sw +
	880	(s->swar1 - s->last_swcr) * 10); /* TODO: fixup */
	881	else
	882	timer_del(s->rtc_swal1);
	883
	884	if ((rtsr & 0x1800) == 0x1800 && !(rtsr & (1 << 10)))
	885	timer_mod(s->rtc_swal2, s->last_sw +
	886	(s->swar2 - s->last_swcr) * 10); /* TODO: fixup */
	887	else
	888	timer_del(s->rtc_swal2);
	889
	890	if ((rtsr & 0xc000) == 0xc000 && !(rtsr & (1 << 13)))
	891	timer_mod(s->rtc_pi, s->last_pi +
	892	(s->piar & 0xffff) - s->last_rtcpicr);
	893	else
	894	timer_del(s->rtc_pi);
	895	}
	896
	897	static inline void pxa2xx_rtc_hz_tick(void *opaque)
	898	{
	899	PXA2xxRTCState s = (PXA2xxRTCState ) opaque;
	900	s->rtsr \|= (1 << 0);
	901	pxa2xx_rtc_alarm_update(s, s->rtsr);
	902	pxa2xx_rtc_int_update(s);
	903	}
	904
	905	static inline void pxa2xx_rtc_rdal1_tick(void *opaque)
	906	{
	907	PXA2xxRTCState s = (PXA2xxRTCState ) opaque;
	908	s->rtsr \|= (1 << 4);
	909	pxa2xx_rtc_alarm_update(s, s->rtsr);
	910	pxa2xx_rtc_int_update(s);
	911	}
	912
	913	static inline void pxa2xx_rtc_rdal2_tick(void *opaque)
	914	{
	915	PXA2xxRTCState s = (PXA2xxRTCState ) opaque;
	916	s->rtsr \|= (1 << 6);
	917	pxa2xx_rtc_alarm_update(s, s->rtsr);
	918	pxa2xx_rtc_int_update(s);
	919	}
	920
	921	static inline void pxa2xx_rtc_swal1_tick(void *opaque)
	922	{
	923	PXA2xxRTCState s = (PXA2xxRTCState ) opaque;
	924	s->rtsr \|= (1 << 8);
	925	pxa2xx_rtc_alarm_update(s, s->rtsr);
	926	pxa2xx_rtc_int_update(s);
	927	}
	928
	929	static inline void pxa2xx_rtc_swal2_tick(void *opaque)
	930	{
	931	PXA2xxRTCState s = (PXA2xxRTCState ) opaque;
	932	s->rtsr \|= (1 << 10);
	933	pxa2xx_rtc_alarm_update(s, s->rtsr);
	934	pxa2xx_rtc_int_update(s);
	935	}
	936
	937	static inline void pxa2xx_rtc_pi_tick(void *opaque)
	938	{
	939	PXA2xxRTCState s = (PXA2xxRTCState ) opaque;
	940	s->rtsr \|= (1 << 13);
	941	pxa2xx_rtc_piupdate(s);
	942	s->last_rtcpicr = 0;
	943	pxa2xx_rtc_alarm_update(s, s->rtsr);
	944	pxa2xx_rtc_int_update(s);
	945	}
	946
	947	static uint64_t pxa2xx_rtc_read(void *opaque, hwaddr addr,
	948	unsigned size)
	949	{
	950	PXA2xxRTCState s = (PXA2xxRTCState ) opaque;
	951
	952	switch (addr) {
	953	case RTTR:
	954	return s->rttr;
	955	case RTSR:
	956	return s->rtsr;
	957	case RTAR:
	958	return s->rtar;
	959	case RDAR1:
	960	return s->rdar1;
	961	case RDAR2:
	962	return s->rdar2;
	963	case RYAR1:
	964	return s->ryar1;
	965	case RYAR2:
	966	return s->ryar2;
	967	case SWAR1:
	968	return s->swar1;
	969	case SWAR2:
	970	return s->swar2;
	971	case PIAR:
	972	return s->piar;
	973	case RCNR:
	974	return s->last_rcnr +
	975	((qemu_clock_get_ms(rtc_clock) - s->last_hz) << 15) /
	976	(1000 * ((s->rttr & 0xffff) + 1));
	977	case RDCR:
	978	return s->last_rdcr +
	979	((qemu_clock_get_ms(rtc_clock) - s->last_hz) << 15) /
	980	(1000 * ((s->rttr & 0xffff) + 1));
	981	case RYCR:
	982	return s->last_rycr;
	983	case SWCR:
	984	if (s->rtsr & (1 << 12))
	985	return s->last_swcr +
	986	(qemu_clock_get_ms(rtc_clock) - s->last_sw) / 10;
	987	else
	988	return s->last_swcr;
	989	default:
	990	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	991	break;
	992	}
	993	return 0;
	994	}
	995
	996	static void pxa2xx_rtc_write(void *opaque, hwaddr addr,
	997	uint64_t value64, unsigned size)
	998	{
	999	PXA2xxRTCState s = (PXA2xxRTCState ) opaque;
	1000	uint32_t value = value64;
	1001
	1002	switch (addr) {
	1003	case RTTR:
	1004	if (!(s->rttr & (1U << 31))) {
	1005	pxa2xx_rtc_hzupdate(s);
	1006	s->rttr = value;
	1007	pxa2xx_rtc_alarm_update(s, s->rtsr);
	1008	}
	1009	break;
	1010
	1011	case RTSR:
	1012	if ((s->rtsr ^ value) & (1 << 15))
	1013	pxa2xx_rtc_piupdate(s);
	1014
	1015	if ((s->rtsr ^ value) & (1 << 12))
	1016	pxa2xx_rtc_swupdate(s);
	1017
	1018	if (((s->rtsr ^ value) & 0x4aac) \| (value & ~0xdaac))
	1019	pxa2xx_rtc_alarm_update(s, value);
	1020
	1021	s->rtsr = (value & 0xdaac) \| (s->rtsr & ~(value & ~0xdaac));
	1022	pxa2xx_rtc_int_update(s);
	1023	break;
	1024
	1025	case RTAR:
	1026	s->rtar = value;
	1027	pxa2xx_rtc_alarm_update(s, s->rtsr);
	1028	break;
	1029
	1030	case RDAR1:
	1031	s->rdar1 = value;
	1032	pxa2xx_rtc_alarm_update(s, s->rtsr);
	1033	break;
	1034
	1035	case RDAR2:
	1036	s->rdar2 = value;
	1037	pxa2xx_rtc_alarm_update(s, s->rtsr);
	1038	break;
	1039
	1040	case RYAR1:
	1041	s->ryar1 = value;
	1042	pxa2xx_rtc_alarm_update(s, s->rtsr);
	1043	break;
	1044
	1045	case RYAR2:
	1046	s->ryar2 = value;
	1047	pxa2xx_rtc_alarm_update(s, s->rtsr);
	1048	break;
	1049
	1050	case SWAR1:
	1051	pxa2xx_rtc_swupdate(s);
	1052	s->swar1 = value;
	1053	s->last_swcr = 0;
	1054	pxa2xx_rtc_alarm_update(s, s->rtsr);
	1055	break;
	1056
	1057	case SWAR2:
	1058	s->swar2 = value;
	1059	pxa2xx_rtc_alarm_update(s, s->rtsr);
	1060	break;
	1061
	1062	case PIAR:
	1063	s->piar = value;
	1064	pxa2xx_rtc_alarm_update(s, s->rtsr);
	1065	break;
	1066
	1067	case RCNR:
	1068	pxa2xx_rtc_hzupdate(s);
	1069	s->last_rcnr = value;
	1070	pxa2xx_rtc_alarm_update(s, s->rtsr);
	1071	break;
	1072
	1073	case RDCR:
	1074	pxa2xx_rtc_hzupdate(s);
	1075	s->last_rdcr = value;
	1076	pxa2xx_rtc_alarm_update(s, s->rtsr);
	1077	break;
	1078
	1079	case RYCR:
	1080	s->last_rycr = value;
	1081	break;
	1082
	1083	case SWCR:
	1084	pxa2xx_rtc_swupdate(s);
	1085	s->last_swcr = value;
	1086	pxa2xx_rtc_alarm_update(s, s->rtsr);
	1087	break;
	1088
	1089	case RTCPICR:
	1090	pxa2xx_rtc_piupdate(s);
	1091	s->last_rtcpicr = value & 0xffff;
	1092	pxa2xx_rtc_alarm_update(s, s->rtsr);
	1093	break;
	1094
	1095	default:
	1096	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	1097	}
	1098	}
	1099
	1100	static const MemoryRegionOps pxa2xx_rtc_ops = {
	1101	.read = pxa2xx_rtc_read,
	1102	.write = pxa2xx_rtc_write,
	1103	.endianness = DEVICE_NATIVE_ENDIAN,
	1104	};
	1105
	1106	static int pxa2xx_rtc_init(SysBusDevice *dev)
	1107	{
	1108	PXA2xxRTCState *s = PXA2XX_RTC(dev);
	1109	struct tm tm;
	1110	int wom;
	1111
	1112	s->rttr = 0x7fff;
	1113	s->rtsr = 0;
	1114
	1115	qemu_get_timedate(&tm, 0);
	1116	wom = ((tm.tm_mday - 1) / 7) + 1;
	1117
	1118	s->last_rcnr = (uint32_t) mktimegm(&tm);
	1119	s->last_rdcr = (wom << 20) \| ((tm.tm_wday + 1) << 17) \|
	1120	(tm.tm_hour << 12) \| (tm.tm_min << 6) \| tm.tm_sec;
	1121	s->last_rycr = ((tm.tm_year + 1900) << 9) \|
	1122	((tm.tm_mon + 1) << 5) \| tm.tm_mday;
	1123	s->last_swcr = (tm.tm_hour << 19) \|
	1124	(tm.tm_min << 13) \| (tm.tm_sec << 7);
	1125	s->last_rtcpicr = 0;
	1126	s->last_hz = s->last_sw = s->last_pi = qemu_clock_get_ms(rtc_clock);
	1127
	1128	s->rtc_hz = timer_new_ms(rtc_clock, pxa2xx_rtc_hz_tick, s);
	1129	s->rtc_rdal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal1_tick, s);
	1130	s->rtc_rdal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal2_tick, s);
	1131	s->rtc_swal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal1_tick, s);
	1132	s->rtc_swal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal2_tick, s);
	1133	s->rtc_pi = timer_new_ms(rtc_clock, pxa2xx_rtc_pi_tick, s);
	1134
	1135	sysbus_init_irq(dev, &s->rtc_irq);
	1136
	1137	memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_rtc_ops, s,
	1138	"pxa2xx-rtc", 0x10000);
	1139	sysbus_init_mmio(dev, &s->iomem);
	1140
	1141	return 0;
	1142	}
	1143
	1144	static void pxa2xx_rtc_pre_save(void *opaque)
	1145	{
	1146	PXA2xxRTCState s = (PXA2xxRTCState ) opaque;
	1147
	1148	pxa2xx_rtc_hzupdate(s);
	1149	pxa2xx_rtc_piupdate(s);
	1150	pxa2xx_rtc_swupdate(s);
	1151	}
	1152
	1153	static int pxa2xx_rtc_post_load(void *opaque, int version_id)
	1154	{
	1155	PXA2xxRTCState s = (PXA2xxRTCState ) opaque;
	1156
	1157	pxa2xx_rtc_alarm_update(s, s->rtsr);
	1158
	1159	return 0;
	1160	}
	1161
	1162	static const VMStateDescription vmstate_pxa2xx_rtc_regs = {
	1163	.name = "pxa2xx_rtc",
	1164	.version_id = 0,
	1165	.minimum_version_id = 0,
	1166	.pre_save = pxa2xx_rtc_pre_save,
	1167	.post_load = pxa2xx_rtc_post_load,
	1168	.fields = (VMStateField[]) {
	1169	VMSTATE_UINT32(rttr, PXA2xxRTCState),
	1170	VMSTATE_UINT32(rtsr, PXA2xxRTCState),
	1171	VMSTATE_UINT32(rtar, PXA2xxRTCState),
	1172	VMSTATE_UINT32(rdar1, PXA2xxRTCState),
	1173	VMSTATE_UINT32(rdar2, PXA2xxRTCState),
	1174	VMSTATE_UINT32(ryar1, PXA2xxRTCState),
	1175	VMSTATE_UINT32(ryar2, PXA2xxRTCState),
	1176	VMSTATE_UINT32(swar1, PXA2xxRTCState),
	1177	VMSTATE_UINT32(swar2, PXA2xxRTCState),
	1178	VMSTATE_UINT32(piar, PXA2xxRTCState),
	1179	VMSTATE_UINT32(last_rcnr, PXA2xxRTCState),
	1180	VMSTATE_UINT32(last_rdcr, PXA2xxRTCState),
	1181	VMSTATE_UINT32(last_rycr, PXA2xxRTCState),
	1182	VMSTATE_UINT32(last_swcr, PXA2xxRTCState),
	1183	VMSTATE_UINT32(last_rtcpicr, PXA2xxRTCState),
	1184	VMSTATE_INT64(last_hz, PXA2xxRTCState),
	1185	VMSTATE_INT64(last_sw, PXA2xxRTCState),
	1186	VMSTATE_INT64(last_pi, PXA2xxRTCState),
	1187	VMSTATE_END_OF_LIST(),
	1188	},
	1189	};
	1190
	1191	static void pxa2xx_rtc_sysbus_class_init(ObjectClass klass, void data)
	1192	{
	1193	DeviceClass *dc = DEVICE_CLASS(klass);
	1194	SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
	1195
	1196	k->init = pxa2xx_rtc_init;
	1197	dc->desc = "PXA2xx RTC Controller";
	1198	dc->vmsd = &vmstate_pxa2xx_rtc_regs;
	1199	}
	1200
	1201	static const TypeInfo pxa2xx_rtc_sysbus_info = {
	1202	.name = TYPE_PXA2XX_RTC,
	1203	.parent = TYPE_SYS_BUS_DEVICE,
	1204	.instance_size = sizeof(PXA2xxRTCState),
	1205	.class_init = pxa2xx_rtc_sysbus_class_init,
	1206	};
	1207
	1208	/* I2C Interface */
	1209
	1210	#define TYPE_PXA2XX_I2C_SLAVE "pxa2xx-i2c-slave"
	1211	#define PXA2XX_I2C_SLAVE(obj) \
	1212	OBJECT_CHECK(PXA2xxI2CSlaveState, (obj), TYPE_PXA2XX_I2C_SLAVE)
	1213
	1214	typedef struct PXA2xxI2CSlaveState {
	1215	I2CSlave parent_obj;
	1216
	1217	PXA2xxI2CState *host;
	1218	} PXA2xxI2CSlaveState;
	1219
	1220	#define TYPE_PXA2XX_I2C "pxa2xx_i2c"
	1221	#define PXA2XX_I2C(obj) \
	1222	OBJECT_CHECK(PXA2xxI2CState, (obj), TYPE_PXA2XX_I2C)
	1223
	1224	struct PXA2xxI2CState {
	1225	/< private >/
	1226	SysBusDevice parent_obj;
	1227	/< public >/
	1228
	1229	MemoryRegion iomem;
	1230	PXA2xxI2CSlaveState *slave;
	1231	I2CBus *bus;
	1232	qemu_irq irq;
	1233	uint32_t offset;
	1234	uint32_t region_size;
	1235
	1236	uint16_t control;
	1237	uint16_t status;
	1238	uint8_t ibmr;
	1239	uint8_t data;
	1240	};
	1241
	1242	#define IBMR 0x80 /* I2C Bus Monitor register */
	1243	#define IDBR 0x88 /* I2C Data Buffer register */
	1244	#define ICR 0x90 /* I2C Control register */
	1245	#define ISR 0x98 /* I2C Status register */
	1246	#define ISAR 0xa0 /* I2C Slave Address register */
	1247
	1248	static void pxa2xx_i2c_update(PXA2xxI2CState *s)
	1249	{
	1250	uint16_t level = 0;
	1251	level \|= s->status & s->control & (1 << 10); /* BED */
	1252	level \|= (s->status & (1 << 7)) && (s->control & (1 << 9)); /* IRF */
	1253	level \|= (s->status & (1 << 6)) && (s->control & (1 << 8)); /* ITE */
	1254	level \|= s->status & (1 << 9); /* SAD */
	1255	qemu_set_irq(s->irq, !!level);
	1256	}
	1257
	1258	/* These are only stubs now. */
	1259	static void pxa2xx_i2c_event(I2CSlave *i2c, enum i2c_event event)
	1260	{
	1261	PXA2xxI2CSlaveState *slave = PXA2XX_I2C_SLAVE(i2c);
	1262	PXA2xxI2CState *s = slave->host;
	1263
	1264	switch (event) {
	1265	case I2C_START_SEND:
	1266	s->status \|= (1 << 9); /* set SAD */
	1267	s->status &= ~(1 << 0); /* clear RWM */
	1268	break;
	1269	case I2C_START_RECV:
	1270	s->status \|= (1 << 9); /* set SAD */
	1271	s->status \|= 1 << 0; /* set RWM */
	1272	break;
	1273	case I2C_FINISH:
	1274	s->status \|= (1 << 4); /* set SSD */
	1275	break;
	1276	case I2C_NACK:
	1277	s->status \|= 1 << 1; /* set ACKNAK */
	1278	break;
	1279	}
	1280	pxa2xx_i2c_update(s);
	1281	}
	1282
	1283	static int pxa2xx_i2c_rx(I2CSlave *i2c)
	1284	{
	1285	PXA2xxI2CSlaveState *slave = PXA2XX_I2C_SLAVE(i2c);
	1286	PXA2xxI2CState *s = slave->host;
	1287
	1288	if ((s->control & (1 << 14)) \|\| !(s->control & (1 << 6))) {
	1289	return 0;
	1290	}
	1291
	1292	if (s->status & (1 << 0)) { /* RWM */
	1293	s->status \|= 1 << 6; /* set ITE */
	1294	}
	1295	pxa2xx_i2c_update(s);
	1296
	1297	return s->data;
	1298	}
	1299
	1300	static int pxa2xx_i2c_tx(I2CSlave *i2c, uint8_t data)
	1301	{
	1302	PXA2xxI2CSlaveState *slave = PXA2XX_I2C_SLAVE(i2c);
	1303	PXA2xxI2CState *s = slave->host;
	1304
	1305	if ((s->control & (1 << 14)) \|\| !(s->control & (1 << 6))) {
	1306	return 1;
	1307	}
	1308
	1309	if (!(s->status & (1 << 0))) { /* RWM */
	1310	s->status \|= 1 << 7; /* set IRF */
	1311	s->data = data;
	1312	}
	1313	pxa2xx_i2c_update(s);
	1314
	1315	return 1;
	1316	}
	1317
	1318	static uint64_t pxa2xx_i2c_read(void *opaque, hwaddr addr,
	1319	unsigned size)
	1320	{
	1321	PXA2xxI2CState s = (PXA2xxI2CState ) opaque;
	1322	I2CSlave *slave;
	1323
	1324	addr -= s->offset;
	1325	switch (addr) {
	1326	case ICR:
	1327	return s->control;
	1328	case ISR:
	1329	return s->status \| (i2c_bus_busy(s->bus) << 2);
	1330	case ISAR:
	1331	slave = I2C_SLAVE(s->slave);
	1332	return slave->address;
	1333	case IDBR:
	1334	return s->data;
	1335	case IBMR:
	1336	if (s->status & (1 << 2))
	1337	s->ibmr ^= 3; /* Fake SCL and SDA pin changes */
	1338	else
	1339	s->ibmr = 0;
	1340	return s->ibmr;
	1341	default:
	1342	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	1343	break;
	1344	}
	1345	return 0;
	1346	}
	1347
	1348	static void pxa2xx_i2c_write(void *opaque, hwaddr addr,
	1349	uint64_t value64, unsigned size)
	1350	{
	1351	PXA2xxI2CState s = (PXA2xxI2CState ) opaque;
	1352	uint32_t value = value64;
	1353	int ack;
	1354
	1355	addr -= s->offset;
	1356	switch (addr) {
	1357	case ICR:
	1358	s->control = value & 0xfff7;
	1359	if ((value & (1 << 3)) && (value & (1 << 6))) { /* TB and IUE */
	1360	/* TODO: slave mode */
	1361	if (value & (1 << 0)) { /* START condition */
	1362	if (s->data & 1)
	1363	s->status \|= 1 << 0; /* set RWM */
	1364	else
	1365	s->status &= ~(1 << 0); /* clear RWM */
	1366	ack = !i2c_start_transfer(s->bus, s->data >> 1, s->data & 1);
	1367	} else {
	1368	if (s->status & (1 << 0)) { /* RWM */
	1369	s->data = i2c_recv(s->bus);
	1370	if (value & (1 << 2)) /* ACKNAK */
	1371	i2c_nack(s->bus);
	1372	ack = 1;
	1373	} else
	1374	ack = !i2c_send(s->bus, s->data);
	1375	}
	1376
	1377	if (value & (1 << 1)) /* STOP condition */
	1378	i2c_end_transfer(s->bus);
	1379
	1380	if (ack) {
	1381	if (value & (1 << 0)) /* START condition */
	1382	s->status \|= 1 << 6; /* set ITE */
	1383	else
	1384	if (s->status & (1 << 0)) /* RWM */
	1385	s->status \|= 1 << 7; /* set IRF */
	1386	else
	1387	s->status \|= 1 << 6; /* set ITE */
	1388	s->status &= ~(1 << 1); /* clear ACKNAK */
	1389	} else {
	1390	s->status \|= 1 << 6; /* set ITE */
	1391	s->status \|= 1 << 10; /* set BED */
	1392	s->status \|= 1 << 1; /* set ACKNAK */
	1393	}
	1394	}
	1395	if (!(value & (1 << 3)) && (value & (1 << 6))) /* !TB and IUE */
	1396	if (value & (1 << 4)) /* MA */
	1397	i2c_end_transfer(s->bus);
	1398	pxa2xx_i2c_update(s);
	1399	break;
	1400
	1401	case ISR:
	1402	s->status &= ~(value & 0x07f0);
	1403	pxa2xx_i2c_update(s);
	1404	break;
	1405
	1406	case ISAR:
	1407	i2c_set_slave_address(I2C_SLAVE(s->slave), value & 0x7f);
	1408	break;
	1409
	1410	case IDBR:
	1411	s->data = value & 0xff;
	1412	break;
	1413
	1414	default:
	1415	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	1416	}
	1417	}
	1418
	1419	static const MemoryRegionOps pxa2xx_i2c_ops = {
	1420	.read = pxa2xx_i2c_read,
	1421	.write = pxa2xx_i2c_write,
	1422	.endianness = DEVICE_NATIVE_ENDIAN,
	1423	};
	1424
	1425	static const VMStateDescription vmstate_pxa2xx_i2c_slave = {
	1426	.name = "pxa2xx_i2c_slave",
	1427	.version_id = 1,
	1428	.minimum_version_id = 1,
	1429	.fields = (VMStateField[]) {
	1430	VMSTATE_I2C_SLAVE(parent_obj, PXA2xxI2CSlaveState),
	1431	VMSTATE_END_OF_LIST()
	1432	}
	1433	};
	1434
	1435	static const VMStateDescription vmstate_pxa2xx_i2c = {
	1436	.name = "pxa2xx_i2c",
	1437	.version_id = 1,
	1438	.minimum_version_id = 1,
	1439	.fields = (VMStateField[]) {
	1440	VMSTATE_UINT16(control, PXA2xxI2CState),
	1441	VMSTATE_UINT16(status, PXA2xxI2CState),
	1442	VMSTATE_UINT8(ibmr, PXA2xxI2CState),
	1443	VMSTATE_UINT8(data, PXA2xxI2CState),
	1444	VMSTATE_STRUCT_POINTER(slave, PXA2xxI2CState,
	1445	vmstate_pxa2xx_i2c_slave, PXA2xxI2CSlaveState),
	1446	VMSTATE_END_OF_LIST()
	1447	}
	1448	};
	1449
	1450	static int pxa2xx_i2c_slave_init(I2CSlave *i2c)
	1451	{
	1452	/* Nothing to do. */
	1453	return 0;
	1454	}
	1455
	1456	static void pxa2xx_i2c_slave_class_init(ObjectClass klass, void data)
	1457	{
	1458	I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
	1459
	1460	k->init = pxa2xx_i2c_slave_init;
	1461	k->event = pxa2xx_i2c_event;
	1462	k->recv = pxa2xx_i2c_rx;
	1463	k->send = pxa2xx_i2c_tx;
	1464	}
	1465
	1466	static const TypeInfo pxa2xx_i2c_slave_info = {
	1467	.name = TYPE_PXA2XX_I2C_SLAVE,
	1468	.parent = TYPE_I2C_SLAVE,
	1469	.instance_size = sizeof(PXA2xxI2CSlaveState),
	1470	.class_init = pxa2xx_i2c_slave_class_init,
	1471	};
	1472
	1473	PXA2xxI2CState *pxa2xx_i2c_init(hwaddr base,
	1474	qemu_irq irq, uint32_t region_size)
	1475	{
	1476	DeviceState *dev;
	1477	SysBusDevice *i2c_dev;
	1478	PXA2xxI2CState *s;
	1479	I2CBus *i2cbus;
	1480
	1481	dev = qdev_create(NULL, TYPE_PXA2XX_I2C);
	1482	qdev_prop_set_uint32(dev, "size", region_size + 1);
	1483	qdev_prop_set_uint32(dev, "offset", base & region_size);
	1484	qdev_init_nofail(dev);
	1485
	1486	i2c_dev = SYS_BUS_DEVICE(dev);
	1487	sysbus_mmio_map(i2c_dev, 0, base & ~region_size);
	1488	sysbus_connect_irq(i2c_dev, 0, irq);
	1489
	1490	s = PXA2XX_I2C(i2c_dev);
	1491	/* FIXME: Should the slave device really be on a separate bus? */
	1492	i2cbus = i2c_init_bus(dev, "dummy");
	1493	dev = i2c_create_slave(i2cbus, TYPE_PXA2XX_I2C_SLAVE, 0);
	1494	s->slave = PXA2XX_I2C_SLAVE(dev);
	1495	s->slave->host = s;
	1496
	1497	return s;
	1498	}
	1499
	1500	static int pxa2xx_i2c_initfn(SysBusDevice *sbd)
	1501	{
	1502	DeviceState *dev = DEVICE(sbd);
	1503	PXA2xxI2CState *s = PXA2XX_I2C(dev);
	1504
	1505	s->bus = i2c_init_bus(dev, "i2c");
	1506
	1507	memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_i2c_ops, s,
	1508	"pxa2xx-i2c", s->region_size);
	1509	sysbus_init_mmio(sbd, &s->iomem);
	1510	sysbus_init_irq(sbd, &s->irq);
	1511
	1512	return 0;
	1513	}
	1514
	1515	I2CBus pxa2xx_i2c_bus(PXA2xxI2CState s)
	1516	{
	1517	return s->bus;
	1518	}
	1519
	1520	static Property pxa2xx_i2c_properties[] = {
	1521	DEFINE_PROP_UINT32("size", PXA2xxI2CState, region_size, 0x10000),
	1522	DEFINE_PROP_UINT32("offset", PXA2xxI2CState, offset, 0),
	1523	DEFINE_PROP_END_OF_LIST(),
	1524	};
	1525
	1526	static void pxa2xx_i2c_class_init(ObjectClass klass, void data)
	1527	{
	1528	DeviceClass *dc = DEVICE_CLASS(klass);
	1529	SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
	1530
	1531	k->init = pxa2xx_i2c_initfn;
	1532	dc->desc = "PXA2xx I2C Bus Controller";
	1533	dc->vmsd = &vmstate_pxa2xx_i2c;
	1534	dc->props = pxa2xx_i2c_properties;
	1535	}
	1536
	1537	static const TypeInfo pxa2xx_i2c_info = {
	1538	.name = TYPE_PXA2XX_I2C,
	1539	.parent = TYPE_SYS_BUS_DEVICE,
	1540	.instance_size = sizeof(PXA2xxI2CState),
	1541	.class_init = pxa2xx_i2c_class_init,
	1542	};
	1543
	1544	/* PXA Inter-IC Sound Controller */
	1545	static void pxa2xx_i2s_reset(PXA2xxI2SState *i2s)
	1546	{
	1547	i2s->rx_len = 0;
	1548	i2s->tx_len = 0;
	1549	i2s->fifo_len = 0;
	1550	i2s->clk = 0x1a;
	1551	i2s->control[0] = 0x00;
	1552	i2s->control[1] = 0x00;
	1553	i2s->status = 0x00;
	1554	i2s->mask = 0x00;
	1555	}
	1556
	1557	#define SACR_TFTH(val) ((val >> 8) & 0xf)
	1558	#define SACR_RFTH(val) ((val >> 12) & 0xf)
	1559	#define SACR_DREC(val) (val & (1 << 3))
	1560	#define SACR_DPRL(val) (val & (1 << 4))
	1561
	1562	static inline void pxa2xx_i2s_update(PXA2xxI2SState *i2s)
	1563	{
	1564	int rfs, tfs;
	1565	rfs = SACR_RFTH(i2s->control[0]) < i2s->rx_len &&
	1566	!SACR_DREC(i2s->control[1]);
	1567	tfs = (i2s->tx_len \|\| i2s->fifo_len < SACR_TFTH(i2s->control[0])) &&
	1568	i2s->enable && !SACR_DPRL(i2s->control[1]);
	1569
	1570	qemu_set_irq(i2s->rx_dma, rfs);
	1571	qemu_set_irq(i2s->tx_dma, tfs);
	1572
	1573	i2s->status &= 0xe0;
	1574	if (i2s->fifo_len < 16 \|\| !i2s->enable)
	1575	i2s->status \|= 1 << 0; /* TNF */
	1576	if (i2s->rx_len)
	1577	i2s->status \|= 1 << 1; /* RNE */
	1578	if (i2s->enable)
	1579	i2s->status \|= 1 << 2; /* BSY */
	1580	if (tfs)
	1581	i2s->status \|= 1 << 3; /* TFS */
	1582	if (rfs)
	1583	i2s->status \|= 1 << 4; /* RFS */
	1584	if (!(i2s->tx_len && i2s->enable))
	1585	i2s->status \|= i2s->fifo_len << 8; /* TFL */
	1586	i2s->status \|= MAX(i2s->rx_len, 0xf) << 12; /* RFL */
	1587
	1588	qemu_set_irq(i2s->irq, i2s->status & i2s->mask);
	1589	}
	1590
	1591	#define SACR0 0x00 /* Serial Audio Global Control register */
	1592	#define SACR1 0x04 /* Serial Audio I2S/MSB-Justified Control register */
	1593	#define SASR0 0x0c /* Serial Audio Interface and FIFO Status register */
	1594	#define SAIMR 0x14 /* Serial Audio Interrupt Mask register */
	1595	#define SAICR 0x18 /* Serial Audio Interrupt Clear register */
	1596	#define SADIV 0x60 /* Serial Audio Clock Divider register */
	1597	#define SADR 0x80 /* Serial Audio Data register */
	1598
	1599	static uint64_t pxa2xx_i2s_read(void *opaque, hwaddr addr,
	1600	unsigned size)
	1601	{
	1602	PXA2xxI2SState s = (PXA2xxI2SState ) opaque;
	1603
	1604	switch (addr) {
	1605	case SACR0:
	1606	return s->control[0];
	1607	case SACR1:
	1608	return s->control[1];
	1609	case SASR0:
	1610	return s->status;
	1611	case SAIMR:
	1612	return s->mask;
	1613	case SAICR:
	1614	return 0;
	1615	case SADIV:
	1616	return s->clk;
	1617	case SADR:
	1618	if (s->rx_len > 0) {
	1619	s->rx_len --;
	1620	pxa2xx_i2s_update(s);
	1621	return s->codec_in(s->opaque);
	1622	}
	1623	return 0;
	1624	default:
	1625	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	1626	break;
	1627	}
	1628	return 0;
	1629	}
	1630
	1631	static void pxa2xx_i2s_write(void *opaque, hwaddr addr,
	1632	uint64_t value, unsigned size)
	1633	{
	1634	PXA2xxI2SState s = (PXA2xxI2SState ) opaque;
	1635	uint32_t *sample;
	1636
	1637	switch (addr) {
	1638	case SACR0:
	1639	if (value & (1 << 3)) /* RST */
	1640	pxa2xx_i2s_reset(s);
	1641	s->control[0] = value & 0xff3d;
	1642	if (!s->enable && (value & 1) && s->tx_len) { /* ENB */
	1643	for (sample = s->fifo; s->fifo_len > 0; s->fifo_len --, sample ++)
	1644	s->codec_out(s->opaque, *sample);
	1645	s->status &= ~(1 << 7); /* I2SOFF */
	1646	}
	1647	if (value & (1 << 4)) /* EFWR */
	1648	printf("%s: Attempt to use special function\n", __FUNCTION__);
	1649	s->enable = (value & 9) == 1; /* ENB && !RST*/
	1650	pxa2xx_i2s_update(s);
	1651	break;
	1652	case SACR1:
	1653	s->control[1] = value & 0x0039;
	1654	if (value & (1 << 5)) /* ENLBF */
	1655	printf("%s: Attempt to use loopback function\n", __FUNCTION__);
	1656	if (value & (1 << 4)) /* DPRL */
	1657	s->fifo_len = 0;
	1658	pxa2xx_i2s_update(s);
	1659	break;
	1660	case SAIMR:
	1661	s->mask = value & 0x0078;
	1662	pxa2xx_i2s_update(s);
	1663	break;
	1664	case SAICR:
	1665	s->status &= ~(value & (3 << 5));
	1666	pxa2xx_i2s_update(s);
	1667	break;
	1668	case SADIV:
	1669	s->clk = value & 0x007f;
	1670	break;
	1671	case SADR:
	1672	if (s->tx_len && s->enable) {
	1673	s->tx_len --;
	1674	pxa2xx_i2s_update(s);
	1675	s->codec_out(s->opaque, value);
	1676	} else if (s->fifo_len < 16) {
	1677	s->fifo[s->fifo_len ++] = value;
	1678	pxa2xx_i2s_update(s);
	1679	}
	1680	break;
	1681	default:
	1682	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	1683	}
	1684	}
	1685
	1686	static const MemoryRegionOps pxa2xx_i2s_ops = {
	1687	.read = pxa2xx_i2s_read,
	1688	.write = pxa2xx_i2s_write,
	1689	.endianness = DEVICE_NATIVE_ENDIAN,
	1690	};
	1691
	1692	static const VMStateDescription vmstate_pxa2xx_i2s = {
	1693	.name = "pxa2xx_i2s",
	1694	.version_id = 0,
	1695	.minimum_version_id = 0,
	1696	.fields = (VMStateField[]) {
	1697	VMSTATE_UINT32_ARRAY(control, PXA2xxI2SState, 2),
	1698	VMSTATE_UINT32(status, PXA2xxI2SState),
	1699	VMSTATE_UINT32(mask, PXA2xxI2SState),
	1700	VMSTATE_UINT32(clk, PXA2xxI2SState),
	1701	VMSTATE_INT32(enable, PXA2xxI2SState),
	1702	VMSTATE_INT32(rx_len, PXA2xxI2SState),
	1703	VMSTATE_INT32(tx_len, PXA2xxI2SState),
	1704	VMSTATE_INT32(fifo_len, PXA2xxI2SState),
	1705	VMSTATE_END_OF_LIST()
	1706	}
	1707	};
	1708
	1709	static void pxa2xx_i2s_data_req(void *opaque, int tx, int rx)
	1710	{
	1711	PXA2xxI2SState s = (PXA2xxI2SState ) opaque;
	1712	uint32_t *sample;
	1713
	1714	/* Signal FIFO errors */
	1715	if (s->enable && s->tx_len)
	1716	s->status \|= 1 << 5; /* TUR */
	1717	if (s->enable && s->rx_len)
	1718	s->status \|= 1 << 6; /* ROR */
	1719
	1720	/* Should be tx - MIN(tx, s->fifo_len) but we don't really need to
	1721	* handle the cases where it makes a difference. */
	1722	s->tx_len = tx - s->fifo_len;
	1723	s->rx_len = rx;
	1724	/* Note that is s->codec_out wasn't set, we wouldn't get called. */
	1725	if (s->enable)
	1726	for (sample = s->fifo; s->fifo_len; s->fifo_len --, sample ++)
	1727	s->codec_out(s->opaque, *sample);
	1728	pxa2xx_i2s_update(s);
	1729	}
	1730
	1731	static PXA2xxI2SState pxa2xx_i2s_init(MemoryRegion sysmem,
	1732	hwaddr base,
	1733	qemu_irq irq, qemu_irq rx_dma, qemu_irq tx_dma)
	1734	{
	1735	PXA2xxI2SState *s = g_new0(PXA2xxI2SState, 1);
	1736
	1737	s->irq = irq;
	1738	s->rx_dma = rx_dma;
	1739	s->tx_dma = tx_dma;
	1740	s->data_req = pxa2xx_i2s_data_req;
	1741
	1742	pxa2xx_i2s_reset(s);
	1743
	1744	memory_region_init_io(&s->iomem, NULL, &pxa2xx_i2s_ops, s,
	1745	"pxa2xx-i2s", 0x100000);
	1746	memory_region_add_subregion(sysmem, base, &s->iomem);
	1747
	1748	vmstate_register(NULL, base, &vmstate_pxa2xx_i2s, s);
	1749
	1750	return s;
	1751	}
	1752
	1753	/* PXA Fast Infra-red Communications Port */
	1754	#define TYPE_PXA2XX_FIR "pxa2xx-fir"
	1755	#define PXA2XX_FIR(obj) OBJECT_CHECK(PXA2xxFIrState, (obj), TYPE_PXA2XX_FIR)
	1756
	1757	struct PXA2xxFIrState {
	1758	/< private >/
	1759	SysBusDevice parent_obj;
	1760	/< public >/
	1761
	1762	MemoryRegion iomem;
	1763	qemu_irq irq;
	1764	qemu_irq rx_dma;
	1765	qemu_irq tx_dma;
	1766	uint32_t enable;
	1767	CharDriverState *chr;
	1768
	1769	uint8_t control[3];
	1770	uint8_t status[2];
	1771
	1772	uint32_t rx_len;
	1773	uint32_t rx_start;
	1774	uint8_t rx_fifo[64];
	1775	};
	1776
	1777	static void pxa2xx_fir_reset(DeviceState *d)
	1778	{
	1779	PXA2xxFIrState *s = PXA2XX_FIR(d);
	1780
	1781	s->control[0] = 0x00;
	1782	s->control[1] = 0x00;
	1783	s->control[2] = 0x00;
	1784	s->status[0] = 0x00;
	1785	s->status[1] = 0x00;
	1786	s->enable = 0;
	1787	}
	1788
	1789	static inline void pxa2xx_fir_update(PXA2xxFIrState *s)
	1790	{
	1791	static const int tresh[4] = { 8, 16, 32, 0 };
	1792	int intr = 0;
	1793	if ((s->control[0] & (1 << 4)) && /* RXE */
	1794	s->rx_len >= tresh[s->control[2] & 3]) /* TRIG */
	1795	s->status[0] \|= 1 << 4; /* RFS */
	1796	else
	1797	s->status[0] &= ~(1 << 4); /* RFS */
	1798	if (s->control[0] & (1 << 3)) /* TXE */
	1799	s->status[0] \|= 1 << 3; /* TFS */
	1800	else
	1801	s->status[0] &= ~(1 << 3); /* TFS */
	1802	if (s->rx_len)
	1803	s->status[1] \|= 1 << 2; /* RNE */
	1804	else
	1805	s->status[1] &= ~(1 << 2); /* RNE */
	1806	if (s->control[0] & (1 << 4)) /* RXE */
	1807	s->status[1] \|= 1 << 0; /* RSY */
	1808	else
	1809	s->status[1] &= ~(1 << 0); /* RSY */
	1810
	1811	intr \|= (s->control[0] & (1 << 5)) && /* RIE */
	1812	(s->status[0] & (1 << 4)); /* RFS */
	1813	intr \|= (s->control[0] & (1 << 6)) && /* TIE */
	1814	(s->status[0] & (1 << 3)); /* TFS */
	1815	intr \|= (s->control[2] & (1 << 4)) && /* TRAIL */
	1816	(s->status[0] & (1 << 6)); /* EOC */
	1817	intr \|= (s->control[0] & (1 << 2)) && /* TUS */
	1818	(s->status[0] & (1 << 1)); /* TUR */
	1819	intr \|= s->status[0] & 0x25; /* FRE, RAB, EIF */
	1820
	1821	qemu_set_irq(s->rx_dma, (s->status[0] >> 4) & 1);
	1822	qemu_set_irq(s->tx_dma, (s->status[0] >> 3) & 1);
	1823
	1824	qemu_set_irq(s->irq, intr && s->enable);
	1825	}
	1826
	1827	#define ICCR0 0x00 /* FICP Control register 0 */
	1828	#define ICCR1 0x04 /* FICP Control register 1 */
	1829	#define ICCR2 0x08 /* FICP Control register 2 */
	1830	#define ICDR 0x0c /* FICP Data register */
	1831	#define ICSR0 0x14 /* FICP Status register 0 */
	1832	#define ICSR1 0x18 /* FICP Status register 1 */
	1833	#define ICFOR 0x1c /* FICP FIFO Occupancy Status register */
	1834
	1835	static uint64_t pxa2xx_fir_read(void *opaque, hwaddr addr,
	1836	unsigned size)
	1837	{
	1838	PXA2xxFIrState s = (PXA2xxFIrState ) opaque;
	1839	uint8_t ret;
	1840
	1841	switch (addr) {
	1842	case ICCR0:
	1843	return s->control[0];
	1844	case ICCR1:
	1845	return s->control[1];
	1846	case ICCR2:
	1847	return s->control[2];
	1848	case ICDR:
	1849	s->status[0] &= ~0x01;
	1850	s->status[1] &= ~0x72;
	1851	if (s->rx_len) {
	1852	s->rx_len --;
	1853	ret = s->rx_fifo[s->rx_start ++];
	1854	s->rx_start &= 63;
	1855	pxa2xx_fir_update(s);
	1856	return ret;
	1857	}
	1858	printf("%s: Rx FIFO underrun.\n", __FUNCTION__);
	1859	break;
	1860	case ICSR0:
	1861	return s->status[0];
	1862	case ICSR1:
	1863	return s->status[1] \| (1 << 3); /* TNF */
	1864	case ICFOR:
	1865	return s->rx_len;
	1866	default:
	1867	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	1868	break;
	1869	}
	1870	return 0;
	1871	}
	1872
	1873	static void pxa2xx_fir_write(void *opaque, hwaddr addr,
	1874	uint64_t value64, unsigned size)
	1875	{
	1876	PXA2xxFIrState s = (PXA2xxFIrState ) opaque;
	1877	uint32_t value = value64;
	1878	uint8_t ch;
	1879
	1880	switch (addr) {
	1881	case ICCR0:
	1882	s->control[0] = value;
	1883	if (!(value & (1 << 4))) /* RXE */
	1884	s->rx_len = s->rx_start = 0;
	1885	if (!(value & (1 << 3))) { /* TXE */
	1886	/* Nop */
	1887	}
	1888	s->enable = value & 1; /* ITR */
	1889	if (!s->enable)
	1890	s->status[0] = 0;
	1891	pxa2xx_fir_update(s);
	1892	break;
	1893	case ICCR1:
	1894	s->control[1] = value;
	1895	break;
	1896	case ICCR2:
	1897	s->control[2] = value & 0x3f;
	1898	pxa2xx_fir_update(s);
	1899	break;
	1900	case ICDR:
	1901	if (s->control[2] & (1 << 2)) /* TXP */
	1902	ch = value;
	1903	else
	1904	ch = ~value;
	1905	if (s->chr && s->enable && (s->control[0] & (1 << 3))) /* TXE */
	1906	qemu_chr_fe_write(s->chr, &ch, 1);
	1907	break;
	1908	case ICSR0:
	1909	s->status[0] &= ~(value & 0x66);
	1910	pxa2xx_fir_update(s);
	1911	break;
	1912	case ICFOR:
	1913	break;
	1914	default:
	1915	printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
	1916	}
	1917	}
	1918
	1919	static const MemoryRegionOps pxa2xx_fir_ops = {
	1920	.read = pxa2xx_fir_read,
	1921	.write = pxa2xx_fir_write,
	1922	.endianness = DEVICE_NATIVE_ENDIAN,
	1923	};
	1924
	1925	static int pxa2xx_fir_is_empty(void *opaque)
	1926	{
	1927	PXA2xxFIrState s = (PXA2xxFIrState ) opaque;
	1928	return (s->rx_len < 64);
	1929	}
	1930
	1931	static void pxa2xx_fir_rx(void opaque, const uint8_t buf, int size)
	1932	{
	1933	PXA2xxFIrState s = (PXA2xxFIrState ) opaque;
	1934	if (!(s->control[0] & (1 << 4))) /* RXE */
	1935	return;
	1936
	1937	while (size --) {
	1938	s->status[1] \|= 1 << 4; /* EOF */
	1939	if (s->rx_len >= 64) {
	1940	s->status[1] \|= 1 << 6; /* ROR */
	1941	break;
	1942	}
	1943
	1944	if (s->control[2] & (1 << 3)) /* RXP */
	1945	s->rx_fifo[(s->rx_start + s->rx_len ++) & 63] = *(buf ++);
	1946	else
	1947	s->rx_fifo[(s->rx_start + s->rx_len ++) & 63] = ~*(buf ++);
	1948	}
	1949
	1950	pxa2xx_fir_update(s);
	1951	}
	1952
	1953	static void pxa2xx_fir_event(void *opaque, int event)
	1954	{
	1955	}
	1956
	1957	static void pxa2xx_fir_instance_init(Object *obj)
	1958	{
	1959	PXA2xxFIrState *s = PXA2XX_FIR(obj);
	1960	SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
	1961
	1962	memory_region_init_io(&s->iomem, obj, &pxa2xx_fir_ops, s,
	1963	"pxa2xx-fir", 0x1000);
	1964	sysbus_init_mmio(sbd, &s->iomem);
	1965	sysbus_init_irq(sbd, &s->irq);
	1966	sysbus_init_irq(sbd, &s->rx_dma);
	1967	sysbus_init_irq(sbd, &s->tx_dma);
	1968	}
	1969
	1970	static void pxa2xx_fir_realize(DeviceState dev, Error *errp)
	1971	{
	1972	PXA2xxFIrState *s = PXA2XX_FIR(dev);
	1973
	1974	if (s->chr) {
	1975	qemu_chr_fe_claim_no_fail(s->chr);
	1976	qemu_chr_add_handlers(s->chr, pxa2xx_fir_is_empty,
	1977	pxa2xx_fir_rx, pxa2xx_fir_event, s);
	1978	}
	1979	}
	1980
	1981	static bool pxa2xx_fir_vmstate_validate(void *opaque, int version_id)
	1982	{
	1983	PXA2xxFIrState *s = opaque;
	1984
	1985	return s->rx_start < ARRAY_SIZE(s->rx_fifo);
	1986	}
	1987
	1988	static const VMStateDescription pxa2xx_fir_vmsd = {
	1989	.name = "pxa2xx-fir",
	1990	.version_id = 1,
	1991	.minimum_version_id = 1,
	1992	.fields = (VMStateField[]) {
	1993	VMSTATE_UINT32(enable, PXA2xxFIrState),
	1994	VMSTATE_UINT8_ARRAY(control, PXA2xxFIrState, 3),
	1995	VMSTATE_UINT8_ARRAY(status, PXA2xxFIrState, 2),
	1996	VMSTATE_UINT32(rx_len, PXA2xxFIrState),
	1997	VMSTATE_UINT32(rx_start, PXA2xxFIrState),
	1998	VMSTATE_VALIDATE("fifo is 64 bytes", pxa2xx_fir_vmstate_validate),
	1999	VMSTATE_UINT8_ARRAY(rx_fifo, PXA2xxFIrState, 64),
	2000	VMSTATE_END_OF_LIST()
	2001	}
	2002	};
	2003
	2004	static Property pxa2xx_fir_properties[] = {
	2005	DEFINE_PROP_CHR("chardev", PXA2xxFIrState, chr),
	2006	DEFINE_PROP_END_OF_LIST(),
	2007	};
	2008
	2009	static void pxa2xx_fir_class_init(ObjectClass klass, void data)
	2010	{
	2011	DeviceClass *dc = DEVICE_CLASS(klass);
	2012
	2013	dc->realize = pxa2xx_fir_realize;
	2014	dc->vmsd = &pxa2xx_fir_vmsd;
	2015	dc->props = pxa2xx_fir_properties;
	2016	dc->reset = pxa2xx_fir_reset;
	2017	}
	2018
	2019	static const TypeInfo pxa2xx_fir_info = {
	2020	.name = TYPE_PXA2XX_FIR,
	2021	.parent = TYPE_SYS_BUS_DEVICE,
	2022	.instance_size = sizeof(PXA2xxFIrState),
	2023	.class_init = pxa2xx_fir_class_init,
	2024	.instance_init = pxa2xx_fir_instance_init,
	2025	};
	2026
	2027	static PXA2xxFIrState pxa2xx_fir_init(MemoryRegion sysmem,
	2028	hwaddr base,
	2029	qemu_irq irq, qemu_irq rx_dma,
	2030	qemu_irq tx_dma,
	2031	CharDriverState *chr)
	2032	{
	2033	DeviceState *dev;
	2034	SysBusDevice *sbd;
	2035
	2036	dev = qdev_create(NULL, TYPE_PXA2XX_FIR);
	2037	qdev_prop_set_chr(dev, "chardev", chr);
	2038	qdev_init_nofail(dev);
	2039	sbd = SYS_BUS_DEVICE(dev);
	2040	sysbus_mmio_map(sbd, 0, base);
	2041	sysbus_connect_irq(sbd, 0, irq);
	2042	sysbus_connect_irq(sbd, 1, rx_dma);
	2043	sysbus_connect_irq(sbd, 2, tx_dma);
	2044	return PXA2XX_FIR(dev);
	2045	}
	2046
	2047	static void pxa2xx_reset(void *opaque, int line, int level)
	2048	{
	2049	PXA2xxState s = (PXA2xxState ) opaque;
	2050
	2051	if (level && (s->pm_regs[PCFR >> 2] & 0x10)) { /* GPR_EN */
	2052	cpu_reset(CPU(s->cpu));
	2053	/* TODO: reset peripherals */
	2054	}
	2055	}
	2056
	2057	/* Initialise a PXA270 integrated chip (ARM based core). */
	2058	PXA2xxState pxa270_init(MemoryRegion address_space,
	2059	unsigned int sdram_size, const char *revision)
	2060	{
	2061	PXA2xxState *s;
	2062	int i;
	2063	DriveInfo *dinfo;
	2064	s = g_new0(PXA2xxState, 1);
	2065
	2066	if (revision && strncmp(revision, "pxa27", 5)) {
	2067	fprintf(stderr, "Machine requires a PXA27x processor.\n");
	2068	exit(1);
	2069	}
	2070	if (!revision)
	2071	revision = "pxa270";
	2072
	2073	s->cpu = cpu_arm_init(revision);
	2074	if (s->cpu == NULL) {
	2075	fprintf(stderr, "Unable to find CPU definition\n");
	2076	exit(1);
	2077	}
	2078	s->reset = qemu_allocate_irq(pxa2xx_reset, s, 0);
	2079
	2080	/* SDRAM & Internal Memory Storage */
	2081	memory_region_init_ram(&s->sdram, NULL, "pxa270.sdram", sdram_size,
	2082	&error_fatal);
	2083	vmstate_register_ram_global(&s->sdram);
	2084	memory_region_add_subregion(address_space, PXA2XX_SDRAM_BASE, &s->sdram);
	2085	memory_region_init_ram(&s->internal, NULL, "pxa270.internal", 0x40000,
	2086	&error_fatal);
	2087	vmstate_register_ram_global(&s->internal);
	2088	memory_region_add_subregion(address_space, PXA2XX_INTERNAL_BASE,
	2089	&s->internal);
	2090
	2091	s->pic = pxa2xx_pic_init(0x40d00000, s->cpu);
	2092
	2093	s->dma = pxa27x_dma_init(0x40000000,
	2094	qdev_get_gpio_in(s->pic, PXA2XX_PIC_DMA));
	2095
	2096	sysbus_create_varargs("pxa27x-timer", 0x40a00000,
	2097	qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 0),
	2098	qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 1),
	2099	qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 2),
	2100	qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 3),
	2101	qdev_get_gpio_in(s->pic, PXA27X_PIC_OST_4_11),
	2102	NULL);
	2103
	2104	s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 121);
	2105
	2106	dinfo = drive_get(IF_SD, 0, 0);
	2107	if (!dinfo) {
	2108	fprintf(stderr, "qemu: missing SecureDigital device\n");
	2109	exit(1);
	2110	}
	2111	s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
	2112	blk_by_legacy_dinfo(dinfo),
	2113	qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
	2114	qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
	2115	qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
	2116
	2117	for (i = 0; pxa270_serial[i].io_base; i++) {
	2118	if (serial_hds[i]) {
	2119	serial_mm_init(address_space, pxa270_serial[i].io_base, 2,
	2120	qdev_get_gpio_in(s->pic, pxa270_serial[i].irqn),
	2121	14857000 / 16, serial_hds[i],
	2122	DEVICE_NATIVE_ENDIAN);
	2123	} else {
	2124	break;
	2125	}
	2126	}
	2127	if (serial_hds[i])
	2128	s->fir = pxa2xx_fir_init(address_space, 0x40800000,
	2129	qdev_get_gpio_in(s->pic, PXA2XX_PIC_ICP),
	2130	qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_ICP),
	2131	qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_ICP),
	2132	serial_hds[i]);
	2133
	2134	s->lcd = pxa2xx_lcdc_init(address_space, 0x44000000,
	2135	qdev_get_gpio_in(s->pic, PXA2XX_PIC_LCD));
	2136
	2137	s->cm_base = 0x41300000;
	2138	s->cm_regs[CCCR >> 2] = 0x02000210; /* 416.0 MHz */
	2139	s->clkcfg = 0x00000009; /* Turbo mode active */
	2140	memory_region_init_io(&s->cm_iomem, NULL, &pxa2xx_cm_ops, s, "pxa2xx-cm", 0x1000);
	2141	memory_region_add_subregion(address_space, s->cm_base, &s->cm_iomem);
	2142	vmstate_register(NULL, 0, &vmstate_pxa2xx_cm, s);
	2143
	2144	pxa2xx_setup_cp14(s);
	2145
	2146	s->mm_base = 0x48000000;
	2147	s->mm_regs[MDMRS >> 2] = 0x00020002;
	2148	s->mm_regs[MDREFR >> 2] = 0x03ca4000;
	2149	s->mm_regs[MECR >> 2] = 0x00000001; /* Two PC Card sockets */
	2150	memory_region_init_io(&s->mm_iomem, NULL, &pxa2xx_mm_ops, s, "pxa2xx-mm", 0x1000);
	2151	memory_region_add_subregion(address_space, s->mm_base, &s->mm_iomem);
	2152	vmstate_register(NULL, 0, &vmstate_pxa2xx_mm, s);
	2153
	2154	s->pm_base = 0x40f00000;
	2155	memory_region_init_io(&s->pm_iomem, NULL, &pxa2xx_pm_ops, s, "pxa2xx-pm", 0x100);
	2156	memory_region_add_subregion(address_space, s->pm_base, &s->pm_iomem);
	2157	vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
	2158
	2159	for (i = 0; pxa27x_ssp[i].io_base; i ++);
	2160	s->ssp = g_new0(SSIBus *, i);
	2161	for (i = 0; pxa27x_ssp[i].io_base; i ++) {
	2162	DeviceState *dev;
	2163	dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa27x_ssp[i].io_base,
	2164	qdev_get_gpio_in(s->pic, pxa27x_ssp[i].irqn));
	2165	s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
	2166	}
	2167
	2168	if (usb_enabled()) {
	2169	sysbus_create_simple("sysbus-ohci", 0x4c000000,
	2170	qdev_get_gpio_in(s->pic, PXA2XX_PIC_USBH1));
	2171	}
	2172
	2173	s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
	2174	s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
	2175
	2176	sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000,
	2177	qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM));
	2178
	2179	s->i2c[0] = pxa2xx_i2c_init(0x40301600,
	2180	qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2C), 0xffff);
	2181	s->i2c[1] = pxa2xx_i2c_init(0x40f00100,
	2182	qdev_get_gpio_in(s->pic, PXA2XX_PIC_PWRI2C), 0xff);
	2183
	2184	s->i2s = pxa2xx_i2s_init(address_space, 0x40400000,
	2185	qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2S),
	2186	qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_I2S),
	2187	qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_I2S));
	2188
	2189	s->kp = pxa27x_keypad_init(address_space, 0x41500000,
	2190	qdev_get_gpio_in(s->pic, PXA2XX_PIC_KEYPAD));
	2191
	2192	/* GPIO1 resets the processor */
	2193	/* The handler can be overridden by board-specific code */
	2194	qdev_connect_gpio_out(s->gpio, 1, s->reset);
	2195	return s;
	2196	}
	2197
	2198	/* Initialise a PXA255 integrated chip (ARM based core). */
	2199	PXA2xxState pxa255_init(MemoryRegion address_space, unsigned int sdram_size)
	2200	{
	2201	PXA2xxState *s;
	2202	int i;
	2203	DriveInfo *dinfo;
	2204
	2205	s = g_new0(PXA2xxState, 1);
	2206
	2207	s->cpu = cpu_arm_init("pxa255");
	2208	if (s->cpu == NULL) {
	2209	fprintf(stderr, "Unable to find CPU definition\n");
	2210	exit(1);
	2211	}
	2212	s->reset = qemu_allocate_irq(pxa2xx_reset, s, 0);
	2213
	2214	/* SDRAM & Internal Memory Storage */
	2215	memory_region_init_ram(&s->sdram, NULL, "pxa255.sdram", sdram_size,
	2216	&error_fatal);
	2217	vmstate_register_ram_global(&s->sdram);
	2218	memory_region_add_subregion(address_space, PXA2XX_SDRAM_BASE, &s->sdram);
	2219	memory_region_init_ram(&s->internal, NULL, "pxa255.internal",
	2220	PXA2XX_INTERNAL_SIZE, &error_fatal);
	2221	vmstate_register_ram_global(&s->internal);
	2222	memory_region_add_subregion(address_space, PXA2XX_INTERNAL_BASE,
	2223	&s->internal);
	2224
	2225	s->pic = pxa2xx_pic_init(0x40d00000, s->cpu);
	2226
	2227	s->dma = pxa255_dma_init(0x40000000,
	2228	qdev_get_gpio_in(s->pic, PXA2XX_PIC_DMA));
	2229
	2230	sysbus_create_varargs("pxa25x-timer", 0x40a00000,
	2231	qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 0),
	2232	qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 1),
	2233	qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 2),
	2234	qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 3),
	2235	NULL);
	2236
	2237	s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 85);
	2238
	2239	dinfo = drive_get(IF_SD, 0, 0);
	2240	if (!dinfo) {
	2241	fprintf(stderr, "qemu: missing SecureDigital device\n");
	2242	exit(1);
	2243	}
	2244	s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
	2245	blk_by_legacy_dinfo(dinfo),
	2246	qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
	2247	qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
	2248	qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
	2249
	2250	for (i = 0; pxa255_serial[i].io_base; i++) {
	2251	if (serial_hds[i]) {
	2252	serial_mm_init(address_space, pxa255_serial[i].io_base, 2,
	2253	qdev_get_gpio_in(s->pic, pxa255_serial[i].irqn),
	2254	14745600 / 16, serial_hds[i],
	2255	DEVICE_NATIVE_ENDIAN);
	2256	} else {
	2257	break;
	2258	}
	2259	}
	2260	if (serial_hds[i])
	2261	s->fir = pxa2xx_fir_init(address_space, 0x40800000,
	2262	qdev_get_gpio_in(s->pic, PXA2XX_PIC_ICP),
	2263	qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_ICP),
	2264	qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_ICP),
	2265	serial_hds[i]);
	2266
	2267	s->lcd = pxa2xx_lcdc_init(address_space, 0x44000000,
	2268	qdev_get_gpio_in(s->pic, PXA2XX_PIC_LCD));
	2269
	2270	s->cm_base = 0x41300000;
	2271	s->cm_regs[CCCR >> 2] = 0x02000210; /* 416.0 MHz */
	2272	s->clkcfg = 0x00000009; /* Turbo mode active */
	2273	memory_region_init_io(&s->cm_iomem, NULL, &pxa2xx_cm_ops, s, "pxa2xx-cm", 0x1000);
	2274	memory_region_add_subregion(address_space, s->cm_base, &s->cm_iomem);
	2275	vmstate_register(NULL, 0, &vmstate_pxa2xx_cm, s);
	2276
	2277	pxa2xx_setup_cp14(s);
	2278
	2279	s->mm_base = 0x48000000;
	2280	s->mm_regs[MDMRS >> 2] = 0x00020002;
	2281	s->mm_regs[MDREFR >> 2] = 0x03ca4000;
	2282	s->mm_regs[MECR >> 2] = 0x00000001; /* Two PC Card sockets */
	2283	memory_region_init_io(&s->mm_iomem, NULL, &pxa2xx_mm_ops, s, "pxa2xx-mm", 0x1000);
	2284	memory_region_add_subregion(address_space, s->mm_base, &s->mm_iomem);
	2285	vmstate_register(NULL, 0, &vmstate_pxa2xx_mm, s);
	2286
	2287	s->pm_base = 0x40f00000;
	2288	memory_region_init_io(&s->pm_iomem, NULL, &pxa2xx_pm_ops, s, "pxa2xx-pm", 0x100);
	2289	memory_region_add_subregion(address_space, s->pm_base, &s->pm_iomem);
	2290	vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
	2291
	2292	for (i = 0; pxa255_ssp[i].io_base; i ++);
	2293	s->ssp = g_new0(SSIBus *, i);
	2294	for (i = 0; pxa255_ssp[i].io_base; i ++) {
	2295	DeviceState *dev;
	2296	dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa255_ssp[i].io_base,
	2297	qdev_get_gpio_in(s->pic, pxa255_ssp[i].irqn));
	2298	s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
	2299	}
	2300
	2301	if (usb_enabled()) {
	2302	sysbus_create_simple("sysbus-ohci", 0x4c000000,
	2303	qdev_get_gpio_in(s->pic, PXA2XX_PIC_USBH1));
	2304	}
	2305
	2306	s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
	2307	s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
	2308
	2309	sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000,
	2310	qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM));
	2311
	2312	s->i2c[0] = pxa2xx_i2c_init(0x40301600,
	2313	qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2C), 0xffff);
	2314	s->i2c[1] = pxa2xx_i2c_init(0x40f00100,
	2315	qdev_get_gpio_in(s->pic, PXA2XX_PIC_PWRI2C), 0xff);
	2316
	2317	s->i2s = pxa2xx_i2s_init(address_space, 0x40400000,
	2318	qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2S),
	2319	qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_I2S),
	2320	qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_I2S));
	2321
	2322	/* GPIO1 resets the processor */
	2323	/* The handler can be overridden by board-specific code */
	2324	qdev_connect_gpio_out(s->gpio, 1, s->reset);
	2325	return s;
	2326	}
	2327
	2328	static void pxa2xx_ssp_class_init(ObjectClass klass, void data)
	2329	{
	2330	SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
	2331	DeviceClass *dc = DEVICE_CLASS(klass);
	2332
	2333	sdc->init = pxa2xx_ssp_init;
	2334	dc->reset = pxa2xx_ssp_reset;
	2335	dc->vmsd = &vmstate_pxa2xx_ssp;
	2336	}
	2337
	2338	static const TypeInfo pxa2xx_ssp_info = {
	2339	.name = TYPE_PXA2XX_SSP,
	2340	.parent = TYPE_SYS_BUS_DEVICE,
	2341	.instance_size = sizeof(PXA2xxSSPState),
	2342	.class_init = pxa2xx_ssp_class_init,
	2343	};
	2344
	2345	static void pxa2xx_register_types(void)
	2346	{
	2347	type_register_static(&pxa2xx_i2c_slave_info);
	2348	type_register_static(&pxa2xx_ssp_info);
	2349	type_register_static(&pxa2xx_i2c_info);
	2350	type_register_static(&pxa2xx_rtc_sysbus_info);
	2351	type_register_static(&pxa2xx_fir_info);
	2352	}
	2353
	2354	type_init(pxa2xx_register_types)