Statistics
| Branch: | Revision:

root / hw / integratorcp.c @ 95219897

History | View | Annotate | Download (33.9 kB)

1
/* 
2
 * ARM Integrator CP System emulation.
3
 *
4
 * Copyright (c) 2005 CodeSourcery, LLC.
5
 * Written by Paul Brook
6
 *
7
 * This code is licenced under the GPL
8
 */
9

    
10
#include <vl.h>
11

    
12
#define KERNEL_ARGS_ADDR 0x100
13
#define KERNEL_LOAD_ADDR 0x00010000
14
#define INITRD_LOAD_ADDR 0x00800000
15

    
16
/* Stub functions for hardware that doesn't exist.  */
17
void pic_set_irq(int irq, int level)
18
{
19
    cpu_abort (cpu_single_env, "pic_set_irq");
20
}
21

    
22
void pic_info(void)
23
{
24
}
25

    
26
void irq_info(void)
27
{
28
}
29

    
30
void DMA_run (void)
31
{
32
}
33

    
34
typedef struct {
35
    uint32_t flash_offset;
36
    uint32_t cm_osc;
37
    uint32_t cm_ctrl;
38
    uint32_t cm_lock;
39
    uint32_t cm_auxosc;
40
    uint32_t cm_sdram;
41
    uint32_t cm_init;
42
    uint32_t cm_flags;
43
    uint32_t cm_nvflags;
44
    uint32_t int_level;
45
    uint32_t irq_enabled;
46
    uint32_t fiq_enabled;
47
} integratorcm_state;
48

    
49
static uint8_t integrator_spd[128] = {
50
   128, 8, 4, 11, 9, 1, 64, 0,  2, 0xa0, 0xa0, 0, 0, 8, 0, 1,
51
   0xe, 4, 0x1c, 1, 2, 0x20, 0xc0, 0, 0, 0, 0, 0x30, 0x28, 0x30, 0x28, 0x40
52
};
53

    
54
static uint32_t integratorcm_read(void *opaque, target_phys_addr_t offset)
55
{
56
    integratorcm_state *s = (integratorcm_state *)opaque;
57
    offset -= 0x10000000;
58
    if (offset >= 0x100 && offset < 0x200) {
59
        /* CM_SPD */
60
        if (offset >= 0x180)
61
            return 0;
62
        return integrator_spd[offset >> 2];
63
    }
64
    switch (offset >> 2) {
65
    case 0: /* CM_ID */
66
        return 0x411a3001;
67
    case 1: /* CM_PROC */
68
        return 0;
69
    case 2: /* CM_OSC */
70
        return s->cm_osc;
71
    case 3: /* CM_CTRL */
72
        return s->cm_ctrl;
73
    case 4: /* CM_STAT */
74
        return 0x00100000;
75
    case 5: /* CM_LOCK */
76
        if (s->cm_lock == 0xa05f) {
77
            return 0x1a05f;
78
        } else {
79
            return s->cm_lock;
80
        }
81
    case 6: /* CM_LMBUSCNT */
82
        /* ??? High frequency timer.  */
83
        cpu_abort(cpu_single_env, "integratorcm_read: CM_LMBUSCNT");
84
    case 7: /* CM_AUXOSC */
85
        return s->cm_auxosc;
86
    case 8: /* CM_SDRAM */
87
        return s->cm_sdram;
88
    case 9: /* CM_INIT */
89
        return s->cm_init;
90
    case 10: /* CM_REFCT */
91
        /* ??? High frequency timer.  */
92
        cpu_abort(cpu_single_env, "integratorcm_read: CM_REFCT");
93
    case 12: /* CM_FLAGS */
94
        return s->cm_flags;
95
    case 14: /* CM_NVFLAGS */
96
        return s->cm_nvflags;
97
    case 16: /* CM_IRQ_STAT */
98
        return s->int_level & s->irq_enabled;
99
    case 17: /* CM_IRQ_RSTAT */
100
        return s->int_level;
101
    case 18: /* CM_IRQ_ENSET */
102
        return s->irq_enabled;
103
    case 20: /* CM_SOFT_INTSET */
104
        return s->int_level & 1;
105
    case 24: /* CM_FIQ_STAT */
106
        return s->int_level & s->fiq_enabled;
107
    case 25: /* CM_FIQ_RSTAT */
108
        return s->int_level;
109
    case 26: /* CM_FIQ_ENSET */
110
        return s->fiq_enabled;
111
    case 32: /* CM_VOLTAGE_CTL0 */
112
    case 33: /* CM_VOLTAGE_CTL1 */
113
    case 34: /* CM_VOLTAGE_CTL2 */
114
    case 35: /* CM_VOLTAGE_CTL3 */
115
        /* ??? Voltage control unimplemented.  */
116
        return 0;
117
    default:
118
        cpu_abort (cpu_single_env,
119
            "integratorcm_read: Unimplemented offset 0x%x\n", offset);
120
        return 0;
121
    }
122
}
123

    
124
static void integratorcm_do_remap(integratorcm_state *s, int flash)
125
{
126
    if (flash) {
127
        cpu_register_physical_memory(0, 0x100000, IO_MEM_RAM);
128
    } else {
129
        cpu_register_physical_memory(0, 0x100000, s->flash_offset | IO_MEM_RAM);
130
    }
131
    //??? tlb_flush (cpu_single_env, 1);
132
}
133

    
134
static void integratorcm_set_ctrl(integratorcm_state *s, uint32_t value)
135
{
136
    if (value & 8) {
137
        cpu_abort(cpu_single_env, "Board reset\n");
138
    }
139
    if ((s->cm_init ^ value) & 4) {
140
        integratorcm_do_remap(s, (value & 4) == 0);
141
    }
142
    if ((s->cm_init ^ value) & 1) {
143
        printf("Green LED %s\n", (value & 1) ? "on" : "off");
144
    }
145
    s->cm_init = (s->cm_init & ~ 5) | (value ^ 5);
146
}
147

    
148
static void integratorcm_update(integratorcm_state *s)
149
{
150
    /* ??? The CPU irq/fiq is raised when either the core module or base PIC
151
       are active.  */
152
    if (s->int_level & (s->irq_enabled | s->fiq_enabled))
153
        cpu_abort(cpu_single_env, "Core module interrupt\n");
154
}
155

    
156
static void integratorcm_write(void *opaque, target_phys_addr_t offset,
157
                               uint32_t value)
158
{
159
    integratorcm_state *s = (integratorcm_state *)opaque;
160
    offset -= 0x10000000;
161
    switch (offset >> 2) {
162
    case 2: /* CM_OSC */
163
        if (s->cm_lock == 0xa05f)
164
            s->cm_osc = value;
165
        break;
166
    case 3: /* CM_CTRL */
167
        integratorcm_set_ctrl(s, value);
168
        break;
169
    case 5: /* CM_LOCK */
170
        s->cm_lock = value & 0xffff;
171
        break;
172
    case 7: /* CM_AUXOSC */
173
        if (s->cm_lock == 0xa05f)
174
            s->cm_auxosc = value;
175
        break;
176
    case 8: /* CM_SDRAM */
177
        s->cm_sdram = value;
178
        break;
179
    case 9: /* CM_INIT */
180
        /* ??? This can change the memory bus frequency.  */
181
        s->cm_init = value;
182
        break;
183
    case 12: /* CM_FLAGSS */
184
        s->cm_flags |= value;
185
        break;
186
    case 13: /* CM_FLAGSC */
187
        s->cm_flags &= ~value;
188
        break;
189
    case 14: /* CM_NVFLAGSS */
190
        s->cm_nvflags |= value;
191
        break;
192
    case 15: /* CM_NVFLAGSS */
193
        s->cm_nvflags &= ~value;
194
        break;
195
    case 18: /* CM_IRQ_ENSET */
196
        s->irq_enabled |= value;
197
        integratorcm_update(s);
198
        break;
199
    case 19: /* CM_IRQ_ENCLR */
200
        s->irq_enabled &= ~value;
201
        integratorcm_update(s);
202
        break;
203
    case 20: /* CM_SOFT_INTSET */
204
        s->int_level |= (value & 1);
205
        integratorcm_update(s);
206
        break;
207
    case 21: /* CM_SOFT_INTCLR */
208
        s->int_level &= ~(value & 1);
209
        integratorcm_update(s);
210
        break;
211
    case 26: /* CM_FIQ_ENSET */
212
        s->fiq_enabled |= value;
213
        integratorcm_update(s);
214
        break;
215
    case 27: /* CM_FIQ_ENCLR */
216
        s->fiq_enabled &= ~value;
217
        integratorcm_update(s);
218
        break;
219
    case 32: /* CM_VOLTAGE_CTL0 */
220
    case 33: /* CM_VOLTAGE_CTL1 */
221
    case 34: /* CM_VOLTAGE_CTL2 */
222
    case 35: /* CM_VOLTAGE_CTL3 */
223
        /* ??? Voltage control unimplemented.  */
224
        break;
225
    default:
226
        cpu_abort (cpu_single_env,
227
            "integratorcm_write: Unimplemented offset 0x%x\n", offset);
228
        break;
229
    }
230
}
231

    
232
/* Integrator/CM control registers.  */
233

    
234
static CPUReadMemoryFunc *integratorcm_readfn[] = {
235
   integratorcm_read,
236
   integratorcm_read,
237
   integratorcm_read
238
};
239

    
240
static CPUWriteMemoryFunc *integratorcm_writefn[] = {
241
   integratorcm_write,
242
   integratorcm_write,
243
   integratorcm_write
244
};
245

    
246
static void integratorcm_init(int memsz, uint32_t flash_offset)
247
{
248
    int iomemtype;
249
    integratorcm_state *s;
250

    
251
    s = (integratorcm_state *)qemu_mallocz(sizeof(integratorcm_state));
252
    s->cm_osc = 0x01000048;
253
    /* ??? What should the high bits of this value be?  */
254
    s->cm_auxosc = 0x0007feff;
255
    s->cm_sdram = 0x00011122;
256
    if (memsz >= 256) {
257
        integrator_spd[31] = 64;
258
        s->cm_sdram |= 0x10;
259
    } else if (memsz >= 128) {
260
        integrator_spd[31] = 32;
261
        s->cm_sdram |= 0x0c;
262
    } else if (memsz >= 64) {
263
        integrator_spd[31] = 16;
264
        s->cm_sdram |= 0x08;
265
    } else if (memsz >= 32) {
266
        integrator_spd[31] = 4;
267
        s->cm_sdram |= 0x04;
268
    } else {
269
        integrator_spd[31] = 2;
270
    }
271
    memcpy(integrator_spd + 73, "QEMU-MEMORY", 11);
272
    s->cm_init = 0x00000112;
273
    s->flash_offset = flash_offset;
274

    
275
    iomemtype = cpu_register_io_memory(0, integratorcm_readfn,
276
                                       integratorcm_writefn, s);
277
    cpu_register_physical_memory(0x10000000, 0x007fffff, iomemtype);
278
    integratorcm_do_remap(s, 1);
279
    /* ??? Save/restore.  */
280
}
281

    
282
/* Integrator/CP hardware emulation.  */
283
/* Primary interrupt controller.  */
284

    
285
typedef struct icp_pic_state
286
{
287
  uint32_t base;
288
  uint32_t level;
289
  uint32_t irq_enabled;
290
  uint32_t fiq_enabled;
291
  void *parent;
292
  /* -1 if parent is a cpu, otherwise IRQ number on parent PIC.  */
293
  int parent_irq;
294
} icp_pic_state;
295

    
296
static void icp_pic_update(icp_pic_state *s)
297
{
298
    CPUState *env;
299
    if (s->parent_irq != -1) {
300
        uint32_t flags;
301

    
302
        flags = (s->level & s->irq_enabled);
303
        pic_set_irq_new(s->parent, s->parent_irq,
304
                        flags != 0);
305
        return;
306
    }
307
    /* Raise CPU interrupt.  */
308
    env = (CPUState *)s->parent;
309
    if (s->level & s->fiq_enabled) {
310
        cpu_interrupt (env, CPU_INTERRUPT_FIQ);
311
    } else {
312
        cpu_reset_interrupt (env, CPU_INTERRUPT_FIQ);
313
    }
314
    if (s->level & s->irq_enabled) {
315
      cpu_interrupt (env, CPU_INTERRUPT_HARD);
316
    } else {
317
      cpu_reset_interrupt (env, CPU_INTERRUPT_HARD);
318
    }
319
}
320

    
321
void pic_set_irq_new(void *opaque, int irq, int level)
322
{
323
    icp_pic_state *s = (icp_pic_state *)opaque;
324
    if (level)
325
        s->level |= 1 << irq;
326
    else
327
        s->level &= ~(1 << irq);
328
    icp_pic_update(s);
329
}
330

    
331
static uint32_t icp_pic_read(void *opaque, target_phys_addr_t offset)
332
{
333
    icp_pic_state *s = (icp_pic_state *)opaque;
334

    
335
    offset -= s->base;
336
    switch (offset >> 2) {
337
    case 0: /* IRQ_STATUS */
338
        return s->level & s->irq_enabled;
339
    case 1: /* IRQ_RAWSTAT */
340
        return s->level;
341
    case 2: /* IRQ_ENABLESET */
342
        return s->irq_enabled;
343
    case 4: /* INT_SOFTSET */
344
        return s->level & 1;
345
    case 8: /* FRQ_STATUS */
346
        return s->level & s->fiq_enabled;
347
    case 9: /* FRQ_RAWSTAT */
348
        return s->level;
349
    case 10: /* FRQ_ENABLESET */
350
        return s->fiq_enabled;
351
    case 3: /* IRQ_ENABLECLR */
352
    case 5: /* INT_SOFTCLR */
353
    case 11: /* FRQ_ENABLECLR */
354
    default:
355
        printf ("icp_pic_read: Bad register offset 0x%x\n", offset);
356
        return 0;
357
    }
358
}
359

    
360
static void icp_pic_write(void *opaque, target_phys_addr_t offset,
361
                          uint32_t value)
362
{
363
    icp_pic_state *s = (icp_pic_state *)opaque;
364
    offset -= s->base;
365

    
366
    switch (offset >> 2) {
367
    case 2: /* IRQ_ENABLESET */
368
        s->irq_enabled |= value;
369
        break;
370
    case 3: /* IRQ_ENABLECLR */
371
        s->irq_enabled &= ~value;
372
        break;
373
    case 4: /* INT_SOFTSET */
374
        if (value & 1)
375
            pic_set_irq_new(s, 0, 1);
376
        break;
377
    case 5: /* INT_SOFTCLR */
378
        if (value & 1)
379
            pic_set_irq_new(s, 0, 0);
380
        break;
381
    case 10: /* FRQ_ENABLESET */
382
        s->fiq_enabled |= value;
383
        break;
384
    case 11: /* FRQ_ENABLECLR */
385
        s->fiq_enabled &= ~value;
386
        break;
387
    case 0: /* IRQ_STATUS */
388
    case 1: /* IRQ_RAWSTAT */
389
    case 8: /* FRQ_STATUS */
390
    case 9: /* FRQ_RAWSTAT */
391
    default:
392
        printf ("icp_pic_write: Bad register offset 0x%x\n", offset);
393
        return;
394
    }
395
    icp_pic_update(s);
396
}
397

    
398
static CPUReadMemoryFunc *icp_pic_readfn[] = {
399
   icp_pic_read,
400
   icp_pic_read,
401
   icp_pic_read
402
};
403

    
404
static CPUWriteMemoryFunc *icp_pic_writefn[] = {
405
   icp_pic_write,
406
   icp_pic_write,
407
   icp_pic_write
408
};
409

    
410
static icp_pic_state *icp_pic_init(uint32_t base, void *parent,
411
                                   int parent_irq)
412
{
413
    icp_pic_state *s;
414
    int iomemtype;
415

    
416
    s = (icp_pic_state *)qemu_mallocz(sizeof(icp_pic_state));
417
    if (!s)
418
        return NULL;
419

    
420
    s->base = base;
421
    s->parent = parent;
422
    s->parent_irq = parent_irq;
423
    iomemtype = cpu_register_io_memory(0, icp_pic_readfn,
424
                                       icp_pic_writefn, s);
425
    cpu_register_physical_memory(base, 0x007fffff, iomemtype);
426
    /* ??? Save/restore.  */
427
    return s;
428
}
429

    
430
/* Timers.  */
431

    
432
/* System bus clock speed (40MHz) for timer 0.  Not sure about this value.  */
433
#define ICP_BUS_FREQ 40000000
434

    
435
typedef struct {
436
    int64_t next_time;
437
    int64_t expires[3];
438
    int64_t loaded[3];
439
    QEMUTimer *timer;
440
    icp_pic_state *pic;
441
    uint32_t base;
442
    uint32_t control[3];
443
    uint32_t count[3];
444
    uint32_t limit[3];
445
    int freq[3];
446
    int int_level[3];
447
} icp_pit_state;
448

    
449
/* Calculate the new expiry time of the given timer.  */
450

    
451
static void icp_pit_reload(icp_pit_state *s, int n)
452
{
453
    int64_t delay;
454

    
455
    s->loaded[n] = s->expires[n];
456
    delay = muldiv64(s->count[n], ticks_per_sec, s->freq[n]);
457
    if (delay == 0)
458
        delay = 1;
459
    s->expires[n] += delay;
460
}
461

    
462
/* Check all active timers, and schedule the next timer interrupt.  */
463

    
464
static void icp_pit_update(icp_pit_state *s, int64_t now)
465
{
466
    int n;
467
    int64_t next;
468

    
469
    next = now;
470
    for (n = 0; n < 3; n++) {
471
        /* Ignore disabled timers.  */
472
        if ((s->control[n] & 0x80) == 0)
473
            continue;
474
        /* Ignore expired one-shot timers.  */
475
        if (s->count[n] == 0 && s->control[n] & 1)
476
            continue;
477
        if (s->expires[n] - now <= 0) {
478
            /* Timer has expired.  */
479
            s->int_level[n] = 1;
480
            if (s->control[n] & 1) {
481
                /* One-shot.  */
482
                s->count[n] = 0;
483
            } else {
484
                if ((s->control[n] & 0x40) == 0) {
485
                    /* Free running.  */
486
                    if (s->control[n] & 2)
487
                        s->count[n] = 0xffffffff;
488
                    else
489
                        s->count[n] = 0xffff;
490
                } else {
491
                      /* Periodic.  */
492
                      s->count[n] = s->limit[n];
493
                }
494
            }
495
        }
496
        while (s->expires[n] - now <= 0) {
497
            icp_pit_reload(s, n);
498
        }
499
    }
500
    /* Update interrupts.  */
501
    for (n = 0; n < 3; n++) {
502
        if (s->int_level[n] && (s->control[n] & 0x20)) {
503
            pic_set_irq_new(s->pic, 5 + n, 1);
504
        } else {
505
            pic_set_irq_new(s->pic, 5 + n, 0);
506
        }
507
        if (next - s->expires[n] < 0)
508
            next = s->expires[n];
509
    }
510
    /* Schedule the next timer interrupt.  */
511
    if (next == now) {
512
        qemu_del_timer(s->timer);
513
        s->next_time = 0;
514
    } else if (next != s->next_time) {
515
        qemu_mod_timer(s->timer, next);
516
        s->next_time = next;
517
    }
518
}
519

    
520
/* Return the current value of the timer.  */
521
static uint32_t icp_pit_getcount(icp_pit_state *s, int n, int64_t now)
522
{
523
    int64_t elapsed;
524
    int64_t period;
525

    
526
    if (s->count[n] == 0)
527
        return 0;
528
    if ((s->control[n] & 0x80) == 0)
529
        return s->count[n];
530
    elapsed = now - s->loaded[n];
531
    period = s->expires[n] - s->loaded[n];
532
    /* If the timer should have expired then return 0.  This can happen
533
       when the host timer signal doesnt occur immediately.  It's better to
534
       have a timer appear to sit at zero for a while than have it wrap
535
       around before the guest interrupt is raised.  */
536
    /* ??? Could we trigger the interrupt here?  */
537
    if (elapsed > period)
538
        return 0;
539
    /* We need to calculate count * elapsed / period without overfowing.
540
       Scale both elapsed and period so they fit in a 32-bit int.  */
541
    while (period != (int32_t)period) {
542
        period >>= 1;
543
        elapsed >>= 1;
544
    }
545
    return ((uint64_t)s->count[n] * (uint64_t)(int32_t)elapsed)
546
            / (int32_t)period;
547
}
548

    
549
static uint32_t icp_pit_read(void *opaque, target_phys_addr_t offset)
550
{
551
    int n;
552
    icp_pit_state *s = (icp_pit_state *)opaque;
553

    
554
    offset -= s->base;
555
    n = offset >> 8;
556
    if (n > 2)
557
        cpu_abort (cpu_single_env, "icp_pit_read: Bad timer %x\n", offset);
558
    switch ((offset & 0xff) >> 2) {
559
    case 0: /* TimerLoad */
560
    case 6: /* TimerBGLoad */
561
        return s->limit[n];
562
    case 1: /* TimerValue */
563
        return icp_pit_getcount(s, n, qemu_get_clock(vm_clock));
564
    case 2: /* TimerControl */
565
        return s->control[n];
566
    case 4: /* TimerRIS */
567
        return s->int_level[n];
568
    case 5: /* TimerMIS */
569
        if ((s->control[n] & 0x20) == 0)
570
            return 0;
571
        return s->int_level[n];
572
    default:
573
        cpu_abort (cpu_single_env, "icp_pit_read: Bad offset %x\n", offset);
574
        return 0;
575
    }
576
}
577

    
578
static void icp_pit_write(void *opaque, target_phys_addr_t offset,
579
                          uint32_t value)
580
{
581
    icp_pit_state *s = (icp_pit_state *)opaque;
582
    int n;
583
    int64_t now;
584

    
585
    now = qemu_get_clock(vm_clock);
586
    offset -= s->base;
587
    n = offset >> 8;
588
    if (n > 2)
589
        cpu_abort (cpu_single_env, "icp_pit_write: Bad offset %x\n", offset);
590

    
591
    switch ((offset & 0xff) >> 2) {
592
    case 0: /* TimerLoad */
593
        s->limit[n] = value;
594
        s->count[n] = value;
595
        s->expires[n] = now;
596
        icp_pit_reload(s, n);
597
        break;
598
    case 1: /* TimerValue */
599
        /* ??? Linux seems to want to write to this readonly register.
600
           Ignore it.  */
601
        break;
602
    case 2: /* TimerControl */
603
        if (s->control[n] & 0x80) {
604
            /* Pause the timer if it is running.  This may cause some
605
               inaccuracy dure to rounding, but avoids a whole lot of other
606
               messyness.  */
607
            s->count[n] = icp_pit_getcount(s, n, now);
608
        }
609
        s->control[n] = value;
610
        if (n == 0)
611
            s->freq[n] = ICP_BUS_FREQ;
612
        else
613
            s->freq[n] = 1000000;
614
        /* ??? Need to recalculate expiry time after changing divisor.  */
615
        switch ((value >> 2) & 3) {
616
        case 1: s->freq[n] >>= 4; break;
617
        case 2: s->freq[n] >>= 8; break;
618
        }
619
        if (s->control[n] & 0x80) {
620
            /* Restart the timer if still enabled.  */
621
            s->expires[n] = now;
622
            icp_pit_reload(s, n);
623
        }
624
        break;
625
    case 3: /* TimerIntClr */
626
        s->int_level[n] = 0;
627
        break;
628
    case 6: /* TimerBGLoad */
629
        s->limit[n] = value;
630
        break;
631
    default:
632
        cpu_abort (cpu_single_env, "icp_pit_write: Bad offset %x\n", offset);
633
    }
634
    icp_pit_update(s, now);
635
}
636

    
637
static void icp_pit_tick(void *opaque)
638
{
639
    int64_t now;
640

    
641
    now = qemu_get_clock(vm_clock);
642
    icp_pit_update((icp_pit_state *)opaque, now);
643
}
644

    
645
static CPUReadMemoryFunc *icp_pit_readfn[] = {
646
   icp_pit_read,
647
   icp_pit_read,
648
   icp_pit_read
649
};
650

    
651
static CPUWriteMemoryFunc *icp_pit_writefn[] = {
652
   icp_pit_write,
653
   icp_pit_write,
654
   icp_pit_write
655
};
656

    
657
static void icp_pit_init(uint32_t base, icp_pic_state *pic)
658
{
659
    int iomemtype;
660
    icp_pit_state *s;
661
    int n;
662

    
663
    s = (icp_pit_state *)qemu_mallocz(sizeof(icp_pit_state));
664
    s->base = base;
665
    s->pic = pic;
666
    s->freq[0] = ICP_BUS_FREQ;
667
    s->freq[1] = 1000000;
668
    s->freq[2] = 1000000;
669
    for (n = 0; n < 3; n++) {
670
        s->control[n] = 0x20;
671
        s->count[n] = 0xffffffff;
672
    }
673

    
674
    iomemtype = cpu_register_io_memory(0, icp_pit_readfn,
675
                                       icp_pit_writefn, s);
676
    cpu_register_physical_memory(base, 0x007fffff, iomemtype);
677
    s->timer = qemu_new_timer(vm_clock, icp_pit_tick, s);
678
    /* ??? Save/restore.  */
679
}
680

    
681
/* ARM PrimeCell PL011 UART */
682

    
683
typedef struct {
684
    uint32_t base;
685
    uint32_t readbuff;
686
    uint32_t flags;
687
    uint32_t lcr;
688
    uint32_t cr;
689
    uint32_t dmacr;
690
    uint32_t int_enabled;
691
    uint32_t int_level;
692
    uint32_t read_fifo[16];
693
    uint32_t ilpr;
694
    uint32_t ibrd;
695
    uint32_t fbrd;
696
    uint32_t ifl;
697
    int read_pos;
698
    int read_count;
699
    int read_trigger;
700
    CharDriverState *chr;
701
    icp_pic_state *pic;
702
    int irq;
703
} pl011_state;
704

    
705
#define PL011_INT_TX 0x20
706
#define PL011_INT_RX 0x10
707

    
708
#define PL011_FLAG_TXFE 0x80
709
#define PL011_FLAG_RXFF 0x40
710
#define PL011_FLAG_TXFF 0x20
711
#define PL011_FLAG_RXFE 0x10
712

    
713
static const unsigned char pl011_id[] =
714
{ 0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
715

    
716
static void pl011_update(pl011_state *s)
717
{
718
    uint32_t flags;
719
    
720
    flags = s->int_level & s->int_enabled;
721
    pic_set_irq_new(s->pic, s->irq, flags != 0);
722
}
723

    
724
static uint32_t pl011_read(void *opaque, target_phys_addr_t offset)
725
{
726
    pl011_state *s = (pl011_state *)opaque;
727
    uint32_t c;
728

    
729
    offset -= s->base;
730
    if (offset >= 0xfe0 && offset < 0x1000) {
731
        return pl011_id[(offset - 0xfe0) >> 2];
732
    }
733
    switch (offset >> 2) {
734
    case 0: /* UARTDR */
735
        s->flags &= ~PL011_FLAG_RXFF;
736
        c = s->read_fifo[s->read_pos];
737
        if (s->read_count > 0) {
738
            s->read_count--;
739
            if (++s->read_pos == 16)
740
                s->read_pos = 0;
741
        }
742
        if (s->read_count == 0) {
743
            s->flags |= PL011_FLAG_RXFE;
744
        }
745
        if (s->read_count == s->read_trigger - 1)
746
            s->int_level &= ~ PL011_INT_RX;
747
        pl011_update(s);
748
        return c;
749
    case 1: /* UARTCR */
750
        return 0;
751
    case 6: /* UARTFR */
752
        return s->flags;
753
    case 8: /* UARTILPR */
754
        return s->ilpr;
755
    case 9: /* UARTIBRD */
756
        return s->ibrd;
757
    case 10: /* UARTFBRD */
758
        return s->fbrd;
759
    case 11: /* UARTLCR_H */
760
        return s->lcr;
761
    case 12: /* UARTCR */
762
        return s->cr;
763
    case 13: /* UARTIFLS */
764
        return s->ifl;
765
    case 14: /* UARTIMSC */
766
        return s->int_enabled;
767
    case 15: /* UARTRIS */
768
        return s->int_level;
769
    case 16: /* UARTMIS */
770
        return s->int_level & s->int_enabled;
771
    case 18: /* UARTDMACR */
772
        return s->dmacr;
773
    default:
774
        cpu_abort (cpu_single_env, "pl011_read: Bad offset %x\n", offset);
775
        return 0;
776
    }
777
}
778

    
779
static void pl011_set_read_trigger(pl011_state *s)
780
{
781
#if 0
782
    /* The docs say the RX interrupt is triggered when the FIFO exceeds
783
       the threshold.  However linux only reads the FIFO in response to an
784
       interrupt.  Triggering the interrupt when the FIFO is non-empty seems
785
       to make things work.  */
786
    if (s->lcr & 0x10)
787
        s->read_trigger = (s->ifl >> 1) & 0x1c;
788
    else
789
#endif
790
        s->read_trigger = 1;
791
}
792

    
793
static void pl011_write(void *opaque, target_phys_addr_t offset,
794
                          uint32_t value)
795
{
796
    pl011_state *s = (pl011_state *)opaque;
797
    unsigned char ch;
798

    
799
    offset -= s->base;
800
    switch (offset >> 2) {
801
    case 0: /* UARTDR */
802
        /* ??? Check if transmitter is enabled.  */
803
        ch = value;
804
        if (s->chr)
805
            qemu_chr_write(s->chr, &ch, 1);
806
        s->int_level |= PL011_INT_TX;
807
        pl011_update(s);
808
        break;
809
    case 1: /* UARTCR */
810
        s->cr = value;
811
        break;
812
    case 8: /* UARTUARTILPR */
813
        s->ilpr = value;
814
        break;
815
    case 9: /* UARTIBRD */
816
        s->ibrd = value;
817
        break;
818
    case 10: /* UARTFBRD */
819
        s->fbrd = value;
820
        break;
821
    case 11: /* UARTLCR_H */
822
        s->lcr = value;
823
        pl011_set_read_trigger(s);
824
        break;
825
    case 12: /* UARTCR */
826
        /* ??? Need to implement the enable and loopback bits.  */
827
        s->cr = value;
828
        break;
829
    case 13: /* UARTIFS */
830
        s->ifl = value;
831
        pl011_set_read_trigger(s);
832
        break;
833
    case 14: /* UARTIMSC */
834
        s->int_enabled = value;
835
        pl011_update(s);
836
        break;
837
    case 17: /* UARTICR */
838
        s->int_level &= ~value;
839
        pl011_update(s);
840
        break;
841
    case 18: /* UARTDMACR */
842
        s->dmacr = value;
843
        if (value & 3)
844
            cpu_abort(cpu_single_env, "PL011: DMA not implemented\n");
845
        break;
846
    default:
847
        cpu_abort (cpu_single_env, "pl011_write: Bad offset %x\n", offset);
848
    }
849
}
850

    
851
static int pl011_can_recieve(void *opaque)
852
{
853
    pl011_state *s = (pl011_state *)opaque;
854

    
855
    if (s->lcr & 0x10)
856
        return s->read_count < 16;
857
    else
858
        return s->read_count < 1;
859
}
860

    
861
static void pl011_recieve(void *opaque, const uint8_t *buf, int size)
862
{
863
    pl011_state *s = (pl011_state *)opaque;
864
    int slot;
865

    
866
    slot = s->read_pos + s->read_count;
867
    if (slot >= 16)
868
        slot -= 16;
869
    s->read_fifo[slot] = *buf;
870
    s->read_count++;
871
    s->flags &= ~PL011_FLAG_RXFE;
872
    if (s->cr & 0x10 || s->read_count == 16) {
873
        s->flags |= PL011_FLAG_RXFF;
874
    }
875
    if (s->read_count == s->read_trigger) {
876
        s->int_level |= PL011_INT_RX;
877
        pl011_update(s);
878
    }
879
}
880

    
881
static void pl011_event(void *opaque, int event)
882
{
883
    /* ??? Should probably implement break.  */
884
}
885

    
886
static CPUReadMemoryFunc *pl011_readfn[] = {
887
   pl011_read,
888
   pl011_read,
889
   pl011_read
890
};
891

    
892
static CPUWriteMemoryFunc *pl011_writefn[] = {
893
   pl011_write,
894
   pl011_write,
895
   pl011_write
896
};
897

    
898
static void pl011_init(uint32_t base, icp_pic_state *pic, int irq,
899
                       CharDriverState *chr)
900
{
901
    int iomemtype;
902
    pl011_state *s;
903

    
904
    s = (pl011_state *)qemu_mallocz(sizeof(pl011_state));
905
    iomemtype = cpu_register_io_memory(0, pl011_readfn,
906
                                       pl011_writefn, s);
907
    cpu_register_physical_memory(base, 0x007fffff, iomemtype);
908
    s->base = base;
909
    s->pic = pic;
910
    s->irq = irq;
911
    s->chr = chr;
912
    s->read_trigger = 1;
913
    s->ifl = 0x12;
914
    s->cr = 0x300;
915
    s->flags = 0x90;
916
    if (chr){ 
917
        qemu_chr_add_read_handler(chr, pl011_can_recieve, pl011_recieve, s);
918
        qemu_chr_add_event_handler(chr, pl011_event);
919
    }
920
    /* ??? Save/restore.  */
921
}
922

    
923
/* CP control registers.  */
924
typedef struct {
925
    uint32_t base;
926
} icp_control_state;
927

    
928
static uint32_t icp_control_read(void *opaque, target_phys_addr_t offset)
929
{
930
    icp_control_state *s = (icp_control_state *)opaque;
931
    offset -= s->base;
932
    switch (offset >> 2) {
933
    case 0: /* CP_IDFIELD */
934
        return 0x41034003;
935
    case 1: /* CP_FLASHPROG */
936
        return 0;
937
    case 2: /* CP_INTREG */
938
        return 0;
939
    case 3: /* CP_DECODE */
940
        return 0x11;
941
    default:
942
        cpu_abort (cpu_single_env, "icp_control_read: Bad offset %x\n", offset);
943
        return 0;
944
    }
945
}
946

    
947
static void icp_control_write(void *opaque, target_phys_addr_t offset,
948
                          uint32_t value)
949
{
950
    icp_control_state *s = (icp_control_state *)opaque;
951
    offset -= s->base;
952
    switch (offset >> 2) {
953
    case 1: /* CP_FLASHPROG */
954
    case 2: /* CP_INTREG */
955
    case 3: /* CP_DECODE */
956
        /* Nothing interesting implemented yet.  */
957
        break;
958
    default:
959
        cpu_abort (cpu_single_env, "icp_control_write: Bad offset %x\n", offset);
960
    }
961
}
962
static CPUReadMemoryFunc *icp_control_readfn[] = {
963
   icp_control_read,
964
   icp_control_read,
965
   icp_control_read
966
};
967

    
968
static CPUWriteMemoryFunc *icp_control_writefn[] = {
969
   icp_control_write,
970
   icp_control_write,
971
   icp_control_write
972
};
973

    
974
static void icp_control_init(uint32_t base)
975
{
976
    int iomemtype;
977
    icp_control_state *s;
978

    
979
    s = (icp_control_state *)qemu_mallocz(sizeof(icp_control_state));
980
    iomemtype = cpu_register_io_memory(0, icp_control_readfn,
981
                                       icp_control_writefn, s);
982
    cpu_register_physical_memory(base, 0x007fffff, iomemtype);
983
    s->base = base;
984
    /* ??? Save/restore.  */
985
}
986

    
987

    
988
/* Keyboard/Mouse Interface.  */
989

    
990
typedef struct {
991
    void *dev;
992
    uint32_t base;
993
    uint32_t cr;
994
    uint32_t clk;
995
    uint32_t last;
996
    icp_pic_state *pic;
997
    int pending;
998
    int irq;
999
    int is_mouse;
1000
} icp_kmi_state;
1001

    
1002
static void icp_kmi_update(void *opaque, int level)
1003
{
1004
    icp_kmi_state *s = (icp_kmi_state *)opaque;
1005
    int raise;
1006

    
1007
    s->pending = level;
1008
    raise = (s->pending && (s->cr & 0x10) != 0)
1009
            || (s->cr & 0x08) != 0;
1010
    pic_set_irq_new(s->pic, s->irq, raise);
1011
}
1012

    
1013
static uint32_t icp_kmi_read(void *opaque, target_phys_addr_t offset)
1014
{
1015
    icp_kmi_state *s = (icp_kmi_state *)opaque;
1016
    offset -= s->base;
1017
    if (offset >= 0xfe0 && offset < 0x1000)
1018
        return 0;
1019

    
1020
    switch (offset >> 2) {
1021
    case 0: /* KMICR */
1022
        return s->cr;
1023
    case 1: /* KMISTAT */
1024
        /* KMIC and KMID bits not implemented.  */
1025
        if (s->pending) {
1026
            return 0x10;
1027
        } else {
1028
            return 0;
1029
        }
1030
    case 2: /* KMIDATA */
1031
        if (s->pending)
1032
            s->last = ps2_read_data(s->dev);
1033
        return s->last;
1034
    case 3: /* KMICLKDIV */
1035
        return s->clk;
1036
    case 4: /* KMIIR */
1037
        return s->pending | 2;
1038
    default:
1039
        cpu_abort (cpu_single_env, "icp_kmi_read: Bad offset %x\n", offset);
1040
        return 0;
1041
    }
1042
}
1043

    
1044
static void icp_kmi_write(void *opaque, target_phys_addr_t offset,
1045
                          uint32_t value)
1046
{
1047
    icp_kmi_state *s = (icp_kmi_state *)opaque;
1048
    offset -= s->base;
1049
    switch (offset >> 2) {
1050
    case 0: /* KMICR */
1051
        s->cr = value;
1052
        icp_kmi_update(s, s->pending);
1053
        /* ??? Need to implement the enable/disable bit.  */
1054
        break;
1055
    case 2: /* KMIDATA */
1056
        /* ??? This should toggle the TX interrupt line.  */
1057
        /* ??? This means kbd/mouse can block each other.  */
1058
        if (s->is_mouse) {
1059
            ps2_write_mouse(s->dev, value);
1060
        } else {
1061
            ps2_write_keyboard(s->dev, value);
1062
        }
1063
        break;
1064
    case 3: /* KMICLKDIV */
1065
        s->clk = value;
1066
        return;
1067
    default:
1068
        cpu_abort (cpu_single_env, "icp_kmi_write: Bad offset %x\n", offset);
1069
    }
1070
}
1071
static CPUReadMemoryFunc *icp_kmi_readfn[] = {
1072
   icp_kmi_read,
1073
   icp_kmi_read,
1074
   icp_kmi_read
1075
};
1076

    
1077
static CPUWriteMemoryFunc *icp_kmi_writefn[] = {
1078
   icp_kmi_write,
1079
   icp_kmi_write,
1080
   icp_kmi_write
1081
};
1082

    
1083
static void icp_kmi_init(uint32_t base, icp_pic_state * pic, int irq,
1084
                         int is_mouse)
1085
{
1086
    int iomemtype;
1087
    icp_kmi_state *s;
1088

    
1089
    s = (icp_kmi_state *)qemu_mallocz(sizeof(icp_kmi_state));
1090
    iomemtype = cpu_register_io_memory(0, icp_kmi_readfn,
1091
                                       icp_kmi_writefn, s);
1092
    cpu_register_physical_memory(base, 0x007fffff, iomemtype);
1093
    s->base = base;
1094
    s->pic = pic;
1095
    s->irq = irq;
1096
    s->is_mouse = is_mouse;
1097
    if (is_mouse)
1098
        s->dev = ps2_mouse_init(icp_kmi_update, s);
1099
    else
1100
        s->dev = ps2_kbd_init(icp_kmi_update, s);
1101
    /* ??? Save/restore.  */
1102
}
1103

    
1104
/* The worlds second smallest bootloader.  Set r0-r2, then jump to kernel.  */
1105
static uint32_t bootloader[] = {
1106
  0xe3a00000, /* mov     r0, #0 */
1107
  0xe3a01013, /* mov     r1, #0x13 */
1108
  0xe3811c01, /* orr     r1, r1, #0x100 */
1109
  0xe59f2000, /* ldr     r2, [pc, #0] */
1110
  0xe59ff000, /* ldr     pc, [pc, #0] */
1111
  0, /* Address of kernel args.  Set by integratorcp_init.  */
1112
  0  /* Kernel entry point.  Set by integratorcp_init.  */
1113
};
1114

    
1115
static void set_kernel_args(uint32_t ram_size, int initrd_size,
1116
                            const char *kernel_cmdline)
1117
{
1118
    uint32_t *p;
1119

    
1120
    p = (uint32_t *)(phys_ram_base + KERNEL_ARGS_ADDR);
1121
    /* ATAG_CORE */
1122
    stl_raw(p++, 5);
1123
    stl_raw(p++, 0x54410001);
1124
    stl_raw(p++, 1);
1125
    stl_raw(p++, 0x1000);
1126
    stl_raw(p++, 0);
1127
    /* ATAG_MEM */
1128
    stl_raw(p++, 4);
1129
    stl_raw(p++, 0x54410002);
1130
    stl_raw(p++, ram_size);
1131
    stl_raw(p++, 0);
1132
    if (initrd_size) {
1133
        /* ATAG_INITRD2 */
1134
        stl_raw(p++, 4);
1135
        stl_raw(p++, 0x54420005);
1136
        stl_raw(p++, INITRD_LOAD_ADDR);
1137
        stl_raw(p++, initrd_size);
1138
    }
1139
    if (kernel_cmdline && *kernel_cmdline) {
1140
        /* ATAG_CMDLINE */
1141
        int cmdline_size;
1142

    
1143
        cmdline_size = strlen(kernel_cmdline);
1144
        memcpy (p + 2, kernel_cmdline, cmdline_size + 1);
1145
        cmdline_size = (cmdline_size >> 2) + 1;
1146
        stl_raw(p++, cmdline_size + 2);
1147
        stl_raw(p++, 0x54410009);
1148
        p += cmdline_size;
1149
    }
1150
    /* ATAG_END */
1151
    stl_raw(p++, 0);
1152
    stl_raw(p++, 0);
1153
}
1154

    
1155
/* Board init.  */
1156

    
1157
static void integratorcp_init(int ram_size, int vga_ram_size, int boot_device,
1158
                     DisplayState *ds, const char **fd_filename, int snapshot,
1159
                     const char *kernel_filename, const char *kernel_cmdline,
1160
                     const char *initrd_filename, uint32_t cpuid)
1161
{
1162
    CPUState *env;
1163
    uint32_t bios_offset;
1164
    icp_pic_state *pic;
1165
    int kernel_size;
1166
    int initrd_size;
1167
    int n;
1168

    
1169
    env = cpu_init();
1170
    cpu_arm_set_model(env, cpuid);
1171
    bios_offset = ram_size + vga_ram_size;
1172
    /* ??? On a real system the first 1Mb is mapped as SSRAM or boot flash.  */
1173
    /* ??? RAM shoud repeat to fill physical memory space.  */
1174
    /* SDRAM at address zero*/
1175
    cpu_register_physical_memory(0, ram_size, IO_MEM_RAM);
1176
    /* And again at address 0x80000000 */
1177
    cpu_register_physical_memory(0x80000000, ram_size, IO_MEM_RAM);
1178

    
1179
    integratorcm_init(ram_size >> 20, bios_offset);
1180
    pic = icp_pic_init(0x14000000, env, -1);
1181
    icp_pic_init(0xca000000, pic, 26);
1182
    icp_pit_init(0x13000000, pic);
1183
    pl011_init(0x16000000, pic, 1, serial_hds[0]);
1184
    pl011_init(0x17000000, pic, 2, serial_hds[1]);
1185
    icp_control_init(0xcb000000);
1186
    icp_kmi_init(0x18000000, pic, 3, 0);
1187
    icp_kmi_init(0x19000000, pic, 4, 1);
1188
    if (nd_table[0].vlan) {
1189
        if (nd_table[0].model == NULL
1190
            || strcmp(nd_table[0].model, "smc91c111") == 0) {
1191
            smc91c111_init(&nd_table[0], 0xc8000000, pic, 27);
1192
        } else {
1193
            fprintf(stderr, "qemu: Unsupported NIC: %s\n", nd_table[0].model);
1194
            exit (1);
1195
        }
1196
    }
1197
    pl110_init(ds, 0xc0000000, pic, 22, 0);
1198

    
1199
    /* Load the kernel.  */
1200
    if (!kernel_filename) {
1201
        fprintf(stderr, "Kernel image must be specified\n");
1202
        exit(1);
1203
    }
1204
    kernel_size = load_image(kernel_filename,
1205
                             phys_ram_base + KERNEL_LOAD_ADDR);
1206
    if (kernel_size < 0) {
1207
        fprintf(stderr, "qemu: could not load kernel '%s'\n", kernel_filename);
1208
        exit(1);
1209
    }
1210
    if (initrd_filename) {
1211
        initrd_size = load_image(initrd_filename,
1212
                                 phys_ram_base + INITRD_LOAD_ADDR);
1213
        if (initrd_size < 0) {
1214
            fprintf(stderr, "qemu: could not load initrd '%s'\n",
1215
                    initrd_filename);
1216
            exit(1);
1217
        }
1218
    } else {
1219
        initrd_size = 0;
1220
    }
1221
    bootloader[5] = KERNEL_ARGS_ADDR;
1222
    bootloader[6] = KERNEL_LOAD_ADDR;
1223
    for (n = 0; n < sizeof(bootloader) / 4; n++)
1224
        stl_raw(phys_ram_base + (n * 4), bootloader[n]);
1225
    set_kernel_args(ram_size, initrd_size, kernel_cmdline);
1226
}
1227

    
1228
static void integratorcp926_init(int ram_size, int vga_ram_size,
1229
    int boot_device, DisplayState *ds, const char **fd_filename, int snapshot,
1230
    const char *kernel_filename, const char *kernel_cmdline,
1231
    const char *initrd_filename)
1232
{
1233
    integratorcp_init(ram_size, vga_ram_size, boot_device, ds, fd_filename,
1234
                      snapshot, kernel_filename, kernel_cmdline,
1235
                      initrd_filename, ARM_CPUID_ARM926);
1236
}
1237

    
1238
static void integratorcp1026_init(int ram_size, int vga_ram_size,
1239
    int boot_device, DisplayState *ds, const char **fd_filename, int snapshot,
1240
    const char *kernel_filename, const char *kernel_cmdline,
1241
    const char *initrd_filename)
1242
{
1243
    integratorcp_init(ram_size, vga_ram_size, boot_device, ds, fd_filename,
1244
                      snapshot, kernel_filename, kernel_cmdline,
1245
                      initrd_filename, ARM_CPUID_ARM1026);
1246
}
1247

    
1248
QEMUMachine integratorcp926_machine = {
1249
    "integratorcp926",
1250
    "ARM Integrator/CP (ARM926EJ-S)",
1251
    integratorcp926_init,
1252
};
1253

    
1254
QEMUMachine integratorcp1026_machine = {
1255
    "integratorcp1026",
1256
    "ARM Integrator/CP (ARM1026EJ-S)",
1257
    integratorcp1026_init,
1258
};