Statistics
| Branch: | Revision:

root / hw / pxa2xx.c @ 9dda2465

History | View | Annotate | Download (66.1 kB)

1
/*
2
 * Intel XScale PXA255/270 processor support.
3
 *
4
 * Copyright (c) 2006 Openedhand Ltd.
5
 * Written by Andrzej Zaborowski <balrog@zabor.org>
6
 *
7
 * This code is licenced under the GPL.
8
 */
9

    
10
#include "sysbus.h"
11
#include "pxa.h"
12
#include "sysemu.h"
13
#include "pc.h"
14
#include "i2c.h"
15
#include "ssi.h"
16
#include "qemu-timer.h"
17
#include "qemu-char.h"
18
#include "blockdev.h"
19

    
20
static struct {
21
    target_phys_addr_t io_base;
22
    int irqn;
23
} pxa255_serial[] = {
24
    { 0x40100000, PXA2XX_PIC_FFUART },
25
    { 0x40200000, PXA2XX_PIC_BTUART },
26
    { 0x40700000, PXA2XX_PIC_STUART },
27
    { 0x41600000, PXA25X_PIC_HWUART },
28
    { 0, 0 }
29
}, pxa270_serial[] = {
30
    { 0x40100000, PXA2XX_PIC_FFUART },
31
    { 0x40200000, PXA2XX_PIC_BTUART },
32
    { 0x40700000, PXA2XX_PIC_STUART },
33
    { 0, 0 }
34
};
35

    
36
typedef struct PXASSPDef {
37
    target_phys_addr_t io_base;
38
    int irqn;
39
} PXASSPDef;
40

    
41
#if 0
42
static PXASSPDef pxa250_ssp[] = {
43
    { 0x41000000, PXA2XX_PIC_SSP },
44
    { 0, 0 }
45
};
46
#endif
47

    
48
static PXASSPDef pxa255_ssp[] = {
49
    { 0x41000000, PXA2XX_PIC_SSP },
50
    { 0x41400000, PXA25X_PIC_NSSP },
51
    { 0, 0 }
52
};
53

    
54
#if 0
55
static PXASSPDef pxa26x_ssp[] = {
56
    { 0x41000000, PXA2XX_PIC_SSP },
57
    { 0x41400000, PXA25X_PIC_NSSP },
58
    { 0x41500000, PXA26X_PIC_ASSP },
59
    { 0, 0 }
60
};
61
#endif
62

    
63
static PXASSPDef pxa27x_ssp[] = {
64
    { 0x41000000, PXA2XX_PIC_SSP },
65
    { 0x41700000, PXA27X_PIC_SSP2 },
66
    { 0x41900000, PXA2XX_PIC_SSP3 },
67
    { 0, 0 }
68
};
69

    
70
#define PMCR        0x00        /* Power Manager Control register */
71
#define PSSR        0x04        /* Power Manager Sleep Status register */
72
#define PSPR        0x08        /* Power Manager Scratch-Pad register */
73
#define PWER        0x0c        /* Power Manager Wake-Up Enable register */
74
#define PRER        0x10        /* Power Manager Rising-Edge Detect Enable register */
75
#define PFER        0x14        /* Power Manager Falling-Edge Detect Enable register */
76
#define PEDR        0x18        /* Power Manager Edge-Detect Status register */
77
#define PCFR        0x1c        /* Power Manager General Configuration register */
78
#define PGSR0        0x20        /* Power Manager GPIO Sleep-State register 0 */
79
#define PGSR1        0x24        /* Power Manager GPIO Sleep-State register 1 */
80
#define PGSR2        0x28        /* Power Manager GPIO Sleep-State register 2 */
81
#define PGSR3        0x2c        /* Power Manager GPIO Sleep-State register 3 */
82
#define RCSR        0x30        /* Reset Controller Status register */
83
#define PSLR        0x34        /* Power Manager Sleep Configuration register */
84
#define PTSR        0x38        /* Power Manager Standby Configuration register */
85
#define PVCR        0x40        /* Power Manager Voltage Change Control register */
86
#define PUCR        0x4c        /* Power Manager USIM Card Control/Status register */
87
#define PKWR        0x50        /* Power Manager Keyboard Wake-Up Enable register */
88
#define PKSR        0x54        /* Power Manager Keyboard Level-Detect Status */
89
#define PCMD0        0x80        /* Power Manager I2C Command register File 0 */
90
#define PCMD31        0xfc        /* Power Manager I2C Command register File 31 */
91

    
92
static uint32_t pxa2xx_pm_read(void *opaque, target_phys_addr_t addr)
93
{
94
    PXA2xxState *s = (PXA2xxState *) opaque;
95

    
96
    switch (addr) {
97
    case PMCR ... PCMD31:
98
        if (addr & 3)
99
            goto fail;
100

    
101
        return s->pm_regs[addr >> 2];
102
    default:
103
    fail:
104
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
105
        break;
106
    }
107
    return 0;
108
}
109

    
110
static void pxa2xx_pm_write(void *opaque, target_phys_addr_t addr,
111
                uint32_t value)
112
{
113
    PXA2xxState *s = (PXA2xxState *) opaque;
114

    
115
    switch (addr) {
116
    case PMCR:
117
        s->pm_regs[addr >> 2] &= 0x15 & ~(value & 0x2a);
118
        s->pm_regs[addr >> 2] |= value & 0x15;
119
        break;
120

    
121
    case PSSR:        /* Read-clean registers */
122
    case RCSR:
123
    case PKSR:
124
        s->pm_regs[addr >> 2] &= ~value;
125
        break;
126

    
127
    default:        /* Read-write registers */
128
        if (!(addr & 3)) {
129
            s->pm_regs[addr >> 2] = value;
130
            break;
131
        }
132

    
133
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
134
        break;
135
    }
136
}
137

    
138
static CPUReadMemoryFunc * const pxa2xx_pm_readfn[] = {
139
    pxa2xx_pm_read,
140
    pxa2xx_pm_read,
141
    pxa2xx_pm_read,
142
};
143

    
144
static CPUWriteMemoryFunc * const pxa2xx_pm_writefn[] = {
145
    pxa2xx_pm_write,
146
    pxa2xx_pm_write,
147
    pxa2xx_pm_write,
148
};
149

    
150
static void pxa2xx_pm_save(QEMUFile *f, void *opaque)
151
{
152
    PXA2xxState *s = (PXA2xxState *) opaque;
153
    int i;
154

    
155
    for (i = 0; i < 0x40; i ++)
156
        qemu_put_be32s(f, &s->pm_regs[i]);
157
}
158

    
159
static int pxa2xx_pm_load(QEMUFile *f, void *opaque, int version_id)
160
{
161
    PXA2xxState *s = (PXA2xxState *) opaque;
162
    int i;
163

    
164
    for (i = 0; i < 0x40; i ++)
165
        qemu_get_be32s(f, &s->pm_regs[i]);
166

    
167
    return 0;
168
}
169

    
170
#define CCCR        0x00        /* Core Clock Configuration register */
171
#define CKEN        0x04        /* Clock Enable register */
172
#define OSCC        0x08        /* Oscillator Configuration register */
173
#define CCSR        0x0c        /* Core Clock Status register */
174

    
175
static uint32_t pxa2xx_cm_read(void *opaque, target_phys_addr_t addr)
176
{
177
    PXA2xxState *s = (PXA2xxState *) opaque;
178

    
179
    switch (addr) {
180
    case CCCR:
181
    case CKEN:
182
    case OSCC:
183
        return s->cm_regs[addr >> 2];
184

    
185
    case CCSR:
186
        return s->cm_regs[CCCR >> 2] | (3 << 28);
187

    
188
    default:
189
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
190
        break;
191
    }
192
    return 0;
193
}
194

    
195
static void pxa2xx_cm_write(void *opaque, target_phys_addr_t addr,
196
                uint32_t value)
197
{
198
    PXA2xxState *s = (PXA2xxState *) opaque;
199

    
200
    switch (addr) {
201
    case CCCR:
202
    case CKEN:
203
        s->cm_regs[addr >> 2] = value;
204
        break;
205

    
206
    case OSCC:
207
        s->cm_regs[addr >> 2] &= ~0x6c;
208
        s->cm_regs[addr >> 2] |= value & 0x6e;
209
        if ((value >> 1) & 1)                        /* OON */
210
            s->cm_regs[addr >> 2] |= 1 << 0;        /* Oscillator is now stable */
211
        break;
212

    
213
    default:
214
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
215
        break;
216
    }
217
}
218

    
219
static CPUReadMemoryFunc * const pxa2xx_cm_readfn[] = {
220
    pxa2xx_cm_read,
221
    pxa2xx_cm_read,
222
    pxa2xx_cm_read,
223
};
224

    
225
static CPUWriteMemoryFunc * const pxa2xx_cm_writefn[] = {
226
    pxa2xx_cm_write,
227
    pxa2xx_cm_write,
228
    pxa2xx_cm_write,
229
};
230

    
231
static void pxa2xx_cm_save(QEMUFile *f, void *opaque)
232
{
233
    PXA2xxState *s = (PXA2xxState *) opaque;
234
    int i;
235

    
236
    for (i = 0; i < 4; i ++)
237
        qemu_put_be32s(f, &s->cm_regs[i]);
238
    qemu_put_be32s(f, &s->clkcfg);
239
    qemu_put_be32s(f, &s->pmnc);
240
}
241

    
242
static int pxa2xx_cm_load(QEMUFile *f, void *opaque, int version_id)
243
{
244
    PXA2xxState *s = (PXA2xxState *) opaque;
245
    int i;
246

    
247
    for (i = 0; i < 4; i ++)
248
        qemu_get_be32s(f, &s->cm_regs[i]);
249
    qemu_get_be32s(f, &s->clkcfg);
250
    qemu_get_be32s(f, &s->pmnc);
251

    
252
    return 0;
253
}
254

    
255
static uint32_t pxa2xx_clkpwr_read(void *opaque, int op2, int reg, int crm)
256
{
257
    PXA2xxState *s = (PXA2xxState *) opaque;
258

    
259
    switch (reg) {
260
    case 6:        /* Clock Configuration register */
261
        return s->clkcfg;
262

    
263
    case 7:        /* Power Mode register */
264
        return 0;
265

    
266
    default:
267
        printf("%s: Bad register 0x%x\n", __FUNCTION__, reg);
268
        break;
269
    }
270
    return 0;
271
}
272

    
273
static void pxa2xx_clkpwr_write(void *opaque, int op2, int reg, int crm,
274
                uint32_t value)
275
{
276
    PXA2xxState *s = (PXA2xxState *) opaque;
277
    static const char *pwrmode[8] = {
278
        "Normal", "Idle", "Deep-idle", "Standby",
279
        "Sleep", "reserved (!)", "reserved (!)", "Deep-sleep",
280
    };
281

    
282
    switch (reg) {
283
    case 6:        /* Clock Configuration register */
284
        s->clkcfg = value & 0xf;
285
        if (value & 2)
286
            printf("%s: CPU frequency change attempt\n", __FUNCTION__);
287
        break;
288

    
289
    case 7:        /* Power Mode register */
290
        if (value & 8)
291
            printf("%s: CPU voltage change attempt\n", __FUNCTION__);
292
        switch (value & 7) {
293
        case 0:
294
            /* Do nothing */
295
            break;
296

    
297
        case 1:
298
            /* Idle */
299
            if (!(s->cm_regs[CCCR >> 2] & (1 << 31))) {        /* CPDIS */
300
                cpu_interrupt(s->env, CPU_INTERRUPT_HALT);
301
                break;
302
            }
303
            /* Fall through.  */
304

    
305
        case 2:
306
            /* Deep-Idle */
307
            cpu_interrupt(s->env, CPU_INTERRUPT_HALT);
308
            s->pm_regs[RCSR >> 2] |= 0x8;        /* Set GPR */
309
            goto message;
310

    
311
        case 3:
312
            s->env->uncached_cpsr =
313
                    ARM_CPU_MODE_SVC | CPSR_A | CPSR_F | CPSR_I;
314
            s->env->cp15.c1_sys = 0;
315
            s->env->cp15.c1_coproc = 0;
316
            s->env->cp15.c2_base0 = 0;
317
            s->env->cp15.c3 = 0;
318
            s->pm_regs[PSSR >> 2] |= 0x8;        /* Set STS */
319
            s->pm_regs[RCSR >> 2] |= 0x8;        /* Set GPR */
320

    
321
            /*
322
             * The scratch-pad register is almost universally used
323
             * for storing the return address on suspend.  For the
324
             * lack of a resuming bootloader, perform a jump
325
             * directly to that address.
326
             */
327
            memset(s->env->regs, 0, 4 * 15);
328
            s->env->regs[15] = s->pm_regs[PSPR >> 2];
329

    
330
#if 0
331
            buffer = 0xe59ff000;        /* ldr     pc, [pc, #0] */
332
            cpu_physical_memory_write(0, &buffer, 4);
333
            buffer = s->pm_regs[PSPR >> 2];
334
            cpu_physical_memory_write(8, &buffer, 4);
335
#endif
336

    
337
            /* Suspend */
338
            cpu_interrupt(cpu_single_env, CPU_INTERRUPT_HALT);
339

    
340
            goto message;
341

    
342
        default:
343
        message:
344
            printf("%s: machine entered %s mode\n", __FUNCTION__,
345
                            pwrmode[value & 7]);
346
        }
347
        break;
348

    
349
    default:
350
        printf("%s: Bad register 0x%x\n", __FUNCTION__, reg);
351
        break;
352
    }
353
}
354

    
355
/* Performace Monitoring Registers */
356
#define CPPMNC                0        /* Performance Monitor Control register */
357
#define CPCCNT                1        /* Clock Counter register */
358
#define CPINTEN                4        /* Interrupt Enable register */
359
#define CPFLAG                5        /* Overflow Flag register */
360
#define CPEVTSEL        8        /* Event Selection register */
361

    
362
#define CPPMN0                0        /* Performance Count register 0 */
363
#define CPPMN1                1        /* Performance Count register 1 */
364
#define CPPMN2                2        /* Performance Count register 2 */
365
#define CPPMN3                3        /* Performance Count register 3 */
366

    
367
static uint32_t pxa2xx_perf_read(void *opaque, int op2, int reg, int crm)
368
{
369
    PXA2xxState *s = (PXA2xxState *) opaque;
370

    
371
    switch (reg) {
372
    case CPPMNC:
373
        return s->pmnc;
374
    case CPCCNT:
375
        if (s->pmnc & 1)
376
            return qemu_get_clock(vm_clock);
377
        else
378
            return 0;
379
    case CPINTEN:
380
    case CPFLAG:
381
    case CPEVTSEL:
382
        return 0;
383

    
384
    default:
385
        printf("%s: Bad register 0x%x\n", __FUNCTION__, reg);
386
        break;
387
    }
388
    return 0;
389
}
390

    
391
static void pxa2xx_perf_write(void *opaque, int op2, int reg, int crm,
392
                uint32_t value)
393
{
394
    PXA2xxState *s = (PXA2xxState *) opaque;
395

    
396
    switch (reg) {
397
    case CPPMNC:
398
        s->pmnc = value;
399
        break;
400

    
401
    case CPCCNT:
402
    case CPINTEN:
403
    case CPFLAG:
404
    case CPEVTSEL:
405
        break;
406

    
407
    default:
408
        printf("%s: Bad register 0x%x\n", __FUNCTION__, reg);
409
        break;
410
    }
411
}
412

    
413
static uint32_t pxa2xx_cp14_read(void *opaque, int op2, int reg, int crm)
414
{
415
    switch (crm) {
416
    case 0:
417
        return pxa2xx_clkpwr_read(opaque, op2, reg, crm);
418
    case 1:
419
        return pxa2xx_perf_read(opaque, op2, reg, crm);
420
    case 2:
421
        switch (reg) {
422
        case CPPMN0:
423
        case CPPMN1:
424
        case CPPMN2:
425
        case CPPMN3:
426
            return 0;
427
        }
428
        /* Fall through */
429
    default:
430
        printf("%s: Bad register 0x%x\n", __FUNCTION__, reg);
431
        break;
432
    }
433
    return 0;
434
}
435

    
436
static void pxa2xx_cp14_write(void *opaque, int op2, int reg, int crm,
437
                uint32_t value)
438
{
439
    switch (crm) {
440
    case 0:
441
        pxa2xx_clkpwr_write(opaque, op2, reg, crm, value);
442
        break;
443
    case 1:
444
        pxa2xx_perf_write(opaque, op2, reg, crm, value);
445
        break;
446
    case 2:
447
        switch (reg) {
448
        case CPPMN0:
449
        case CPPMN1:
450
        case CPPMN2:
451
        case CPPMN3:
452
            return;
453
        }
454
        /* Fall through */
455
    default:
456
        printf("%s: Bad register 0x%x\n", __FUNCTION__, reg);
457
        break;
458
    }
459
}
460

    
461
#define MDCNFG                0x00        /* SDRAM Configuration register */
462
#define MDREFR                0x04        /* SDRAM Refresh Control register */
463
#define MSC0                0x08        /* Static Memory Control register 0 */
464
#define MSC1                0x0c        /* Static Memory Control register 1 */
465
#define MSC2                0x10        /* Static Memory Control register 2 */
466
#define MECR                0x14        /* Expansion Memory Bus Config register */
467
#define SXCNFG                0x1c        /* Synchronous Static Memory Config register */
468
#define MCMEM0                0x28        /* PC Card Memory Socket 0 Timing register */
469
#define MCMEM1                0x2c        /* PC Card Memory Socket 1 Timing register */
470
#define MCATT0                0x30        /* PC Card Attribute Socket 0 register */
471
#define MCATT1                0x34        /* PC Card Attribute Socket 1 register */
472
#define MCIO0                0x38        /* PC Card I/O Socket 0 Timing register */
473
#define MCIO1                0x3c        /* PC Card I/O Socket 1 Timing register */
474
#define MDMRS                0x40        /* SDRAM Mode Register Set Config register */
475
#define BOOT_DEF        0x44        /* Boot-time Default Configuration register */
476
#define ARB_CNTL        0x48        /* Arbiter Control register */
477
#define BSCNTR0                0x4c        /* Memory Buffer Strength Control register 0 */
478
#define BSCNTR1                0x50        /* Memory Buffer Strength Control register 1 */
479
#define LCDBSCNTR        0x54        /* LCD Buffer Strength Control register */
480
#define MDMRSLP                0x58        /* Low Power SDRAM Mode Set Config register */
481
#define BSCNTR2                0x5c        /* Memory Buffer Strength Control register 2 */
482
#define BSCNTR3                0x60        /* Memory Buffer Strength Control register 3 */
483
#define SA1110                0x64        /* SA-1110 Memory Compatibility register */
484

    
485
static uint32_t pxa2xx_mm_read(void *opaque, target_phys_addr_t addr)
486
{
487
    PXA2xxState *s = (PXA2xxState *) opaque;
488

    
489
    switch (addr) {
490
    case MDCNFG ... SA1110:
491
        if ((addr & 3) == 0)
492
            return s->mm_regs[addr >> 2];
493

    
494
    default:
495
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
496
        break;
497
    }
498
    return 0;
499
}
500

    
501
static void pxa2xx_mm_write(void *opaque, target_phys_addr_t addr,
502
                uint32_t value)
503
{
504
    PXA2xxState *s = (PXA2xxState *) opaque;
505

    
506
    switch (addr) {
507
    case MDCNFG ... SA1110:
508
        if ((addr & 3) == 0) {
509
            s->mm_regs[addr >> 2] = value;
510
            break;
511
        }
512

    
513
    default:
514
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
515
        break;
516
    }
517
}
518

    
519
static CPUReadMemoryFunc * const pxa2xx_mm_readfn[] = {
520
    pxa2xx_mm_read,
521
    pxa2xx_mm_read,
522
    pxa2xx_mm_read,
523
};
524

    
525
static CPUWriteMemoryFunc * const pxa2xx_mm_writefn[] = {
526
    pxa2xx_mm_write,
527
    pxa2xx_mm_write,
528
    pxa2xx_mm_write,
529
};
530

    
531
static void pxa2xx_mm_save(QEMUFile *f, void *opaque)
532
{
533
    PXA2xxState *s = (PXA2xxState *) opaque;
534
    int i;
535

    
536
    for (i = 0; i < 0x1a; i ++)
537
        qemu_put_be32s(f, &s->mm_regs[i]);
538
}
539

    
540
static int pxa2xx_mm_load(QEMUFile *f, void *opaque, int version_id)
541
{
542
    PXA2xxState *s = (PXA2xxState *) opaque;
543
    int i;
544

    
545
    for (i = 0; i < 0x1a; i ++)
546
        qemu_get_be32s(f, &s->mm_regs[i]);
547

    
548
    return 0;
549
}
550

    
551
/* Synchronous Serial Ports */
552
typedef struct {
553
    SysBusDevice busdev;
554
    qemu_irq irq;
555
    int enable;
556
    SSIBus *bus;
557

    
558
    uint32_t sscr[2];
559
    uint32_t sspsp;
560
    uint32_t ssto;
561
    uint32_t ssitr;
562
    uint32_t sssr;
563
    uint8_t sstsa;
564
    uint8_t ssrsa;
565
    uint8_t ssacd;
566

    
567
    uint32_t rx_fifo[16];
568
    int rx_level;
569
    int rx_start;
570
} PXA2xxSSPState;
571

    
572
#define SSCR0        0x00        /* SSP Control register 0 */
573
#define SSCR1        0x04        /* SSP Control register 1 */
574
#define SSSR        0x08        /* SSP Status register */
575
#define SSITR        0x0c        /* SSP Interrupt Test register */
576
#define SSDR        0x10        /* SSP Data register */
577
#define SSTO        0x28        /* SSP Time-Out register */
578
#define SSPSP        0x2c        /* SSP Programmable Serial Protocol register */
579
#define SSTSA        0x30        /* SSP TX Time Slot Active register */
580
#define SSRSA        0x34        /* SSP RX Time Slot Active register */
581
#define SSTSS        0x38        /* SSP Time Slot Status register */
582
#define SSACD        0x3c        /* SSP Audio Clock Divider register */
583

    
584
/* Bitfields for above registers */
585
#define SSCR0_SPI(x)        (((x) & 0x30) == 0x00)
586
#define SSCR0_SSP(x)        (((x) & 0x30) == 0x10)
587
#define SSCR0_UWIRE(x)        (((x) & 0x30) == 0x20)
588
#define SSCR0_PSP(x)        (((x) & 0x30) == 0x30)
589
#define SSCR0_SSE        (1 << 7)
590
#define SSCR0_RIM        (1 << 22)
591
#define SSCR0_TIM        (1 << 23)
592
#define SSCR0_MOD        (1 << 31)
593
#define SSCR0_DSS(x)        (((((x) >> 16) & 0x10) | ((x) & 0xf)) + 1)
594
#define SSCR1_RIE        (1 << 0)
595
#define SSCR1_TIE        (1 << 1)
596
#define SSCR1_LBM        (1 << 2)
597
#define SSCR1_MWDS        (1 << 5)
598
#define SSCR1_TFT(x)        ((((x) >> 6) & 0xf) + 1)
599
#define SSCR1_RFT(x)        ((((x) >> 10) & 0xf) + 1)
600
#define SSCR1_EFWR        (1 << 14)
601
#define SSCR1_PINTE        (1 << 18)
602
#define SSCR1_TINTE        (1 << 19)
603
#define SSCR1_RSRE        (1 << 20)
604
#define SSCR1_TSRE        (1 << 21)
605
#define SSCR1_EBCEI        (1 << 29)
606
#define SSITR_INT        (7 << 5)
607
#define SSSR_TNF        (1 << 2)
608
#define SSSR_RNE        (1 << 3)
609
#define SSSR_TFS        (1 << 5)
610
#define SSSR_RFS        (1 << 6)
611
#define SSSR_ROR        (1 << 7)
612
#define SSSR_PINT        (1 << 18)
613
#define SSSR_TINT        (1 << 19)
614
#define SSSR_EOC        (1 << 20)
615
#define SSSR_TUR        (1 << 21)
616
#define SSSR_BCE        (1 << 23)
617
#define SSSR_RW                0x00bc0080
618

    
619
static void pxa2xx_ssp_int_update(PXA2xxSSPState *s)
620
{
621
    int level = 0;
622

    
623
    level |= s->ssitr & SSITR_INT;
624
    level |= (s->sssr & SSSR_BCE)  &&  (s->sscr[1] & SSCR1_EBCEI);
625
    level |= (s->sssr & SSSR_TUR)  && !(s->sscr[0] & SSCR0_TIM);
626
    level |= (s->sssr & SSSR_EOC)  &&  (s->sssr & (SSSR_TINT | SSSR_PINT));
627
    level |= (s->sssr & SSSR_TINT) &&  (s->sscr[1] & SSCR1_TINTE);
628
    level |= (s->sssr & SSSR_PINT) &&  (s->sscr[1] & SSCR1_PINTE);
629
    level |= (s->sssr & SSSR_ROR)  && !(s->sscr[0] & SSCR0_RIM);
630
    level |= (s->sssr & SSSR_RFS)  &&  (s->sscr[1] & SSCR1_RIE);
631
    level |= (s->sssr & SSSR_TFS)  &&  (s->sscr[1] & SSCR1_TIE);
632
    qemu_set_irq(s->irq, !!level);
633
}
634

    
635
static void pxa2xx_ssp_fifo_update(PXA2xxSSPState *s)
636
{
637
    s->sssr &= ~(0xf << 12);        /* Clear RFL */
638
    s->sssr &= ~(0xf << 8);        /* Clear TFL */
639
    s->sssr &= ~SSSR_TFS;
640
    s->sssr &= ~SSSR_TNF;
641
    if (s->enable) {
642
        s->sssr |= ((s->rx_level - 1) & 0xf) << 12;
643
        if (s->rx_level >= SSCR1_RFT(s->sscr[1]))
644
            s->sssr |= SSSR_RFS;
645
        else
646
            s->sssr &= ~SSSR_RFS;
647
        if (s->rx_level)
648
            s->sssr |= SSSR_RNE;
649
        else
650
            s->sssr &= ~SSSR_RNE;
651
        /* TX FIFO is never filled, so it is always in underrun
652
           condition if SSP is enabled */
653
        s->sssr |= SSSR_TFS;
654
        s->sssr |= SSSR_TNF;
655
    }
656

    
657
    pxa2xx_ssp_int_update(s);
658
}
659

    
660
static uint32_t pxa2xx_ssp_read(void *opaque, target_phys_addr_t addr)
661
{
662
    PXA2xxSSPState *s = (PXA2xxSSPState *) opaque;
663
    uint32_t retval;
664

    
665
    switch (addr) {
666
    case SSCR0:
667
        return s->sscr[0];
668
    case SSCR1:
669
        return s->sscr[1];
670
    case SSPSP:
671
        return s->sspsp;
672
    case SSTO:
673
        return s->ssto;
674
    case SSITR:
675
        return s->ssitr;
676
    case SSSR:
677
        return s->sssr | s->ssitr;
678
    case SSDR:
679
        if (!s->enable)
680
            return 0xffffffff;
681
        if (s->rx_level < 1) {
682
            printf("%s: SSP Rx Underrun\n", __FUNCTION__);
683
            return 0xffffffff;
684
        }
685
        s->rx_level --;
686
        retval = s->rx_fifo[s->rx_start ++];
687
        s->rx_start &= 0xf;
688
        pxa2xx_ssp_fifo_update(s);
689
        return retval;
690
    case SSTSA:
691
        return s->sstsa;
692
    case SSRSA:
693
        return s->ssrsa;
694
    case SSTSS:
695
        return 0;
696
    case SSACD:
697
        return s->ssacd;
698
    default:
699
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
700
        break;
701
    }
702
    return 0;
703
}
704

    
705
static void pxa2xx_ssp_write(void *opaque, target_phys_addr_t addr,
706
                uint32_t value)
707
{
708
    PXA2xxSSPState *s = (PXA2xxSSPState *) opaque;
709

    
710
    switch (addr) {
711
    case SSCR0:
712
        s->sscr[0] = value & 0xc7ffffff;
713
        s->enable = value & SSCR0_SSE;
714
        if (value & SSCR0_MOD)
715
            printf("%s: Attempt to use network mode\n", __FUNCTION__);
716
        if (s->enable && SSCR0_DSS(value) < 4)
717
            printf("%s: Wrong data size: %i bits\n", __FUNCTION__,
718
                            SSCR0_DSS(value));
719
        if (!(value & SSCR0_SSE)) {
720
            s->sssr = 0;
721
            s->ssitr = 0;
722
            s->rx_level = 0;
723
        }
724
        pxa2xx_ssp_fifo_update(s);
725
        break;
726

    
727
    case SSCR1:
728
        s->sscr[1] = value;
729
        if (value & (SSCR1_LBM | SSCR1_EFWR))
730
            printf("%s: Attempt to use SSP test mode\n", __FUNCTION__);
731
        pxa2xx_ssp_fifo_update(s);
732
        break;
733

    
734
    case SSPSP:
735
        s->sspsp = value;
736
        break;
737

    
738
    case SSTO:
739
        s->ssto = value;
740
        break;
741

    
742
    case SSITR:
743
        s->ssitr = value & SSITR_INT;
744
        pxa2xx_ssp_int_update(s);
745
        break;
746

    
747
    case SSSR:
748
        s->sssr &= ~(value & SSSR_RW);
749
        pxa2xx_ssp_int_update(s);
750
        break;
751

    
752
    case SSDR:
753
        if (SSCR0_UWIRE(s->sscr[0])) {
754
            if (s->sscr[1] & SSCR1_MWDS)
755
                value &= 0xffff;
756
            else
757
                value &= 0xff;
758
        } else
759
            /* Note how 32bits overflow does no harm here */
760
            value &= (1 << SSCR0_DSS(s->sscr[0])) - 1;
761

    
762
        /* Data goes from here to the Tx FIFO and is shifted out from
763
         * there directly to the slave, no need to buffer it.
764
         */
765
        if (s->enable) {
766
            uint32_t readval;
767
            readval = ssi_transfer(s->bus, value);
768
            if (s->rx_level < 0x10) {
769
                s->rx_fifo[(s->rx_start + s->rx_level ++) & 0xf] = readval;
770
            } else {
771
                s->sssr |= SSSR_ROR;
772
            }
773
        }
774
        pxa2xx_ssp_fifo_update(s);
775
        break;
776

    
777
    case SSTSA:
778
        s->sstsa = value;
779
        break;
780

    
781
    case SSRSA:
782
        s->ssrsa = value;
783
        break;
784

    
785
    case SSACD:
786
        s->ssacd = value;
787
        break;
788

    
789
    default:
790
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
791
        break;
792
    }
793
}
794

    
795
static CPUReadMemoryFunc * const pxa2xx_ssp_readfn[] = {
796
    pxa2xx_ssp_read,
797
    pxa2xx_ssp_read,
798
    pxa2xx_ssp_read,
799
};
800

    
801
static CPUWriteMemoryFunc * const pxa2xx_ssp_writefn[] = {
802
    pxa2xx_ssp_write,
803
    pxa2xx_ssp_write,
804
    pxa2xx_ssp_write,
805
};
806

    
807
static void pxa2xx_ssp_save(QEMUFile *f, void *opaque)
808
{
809
    PXA2xxSSPState *s = (PXA2xxSSPState *) opaque;
810
    int i;
811

    
812
    qemu_put_be32(f, s->enable);
813

    
814
    qemu_put_be32s(f, &s->sscr[0]);
815
    qemu_put_be32s(f, &s->sscr[1]);
816
    qemu_put_be32s(f, &s->sspsp);
817
    qemu_put_be32s(f, &s->ssto);
818
    qemu_put_be32s(f, &s->ssitr);
819
    qemu_put_be32s(f, &s->sssr);
820
    qemu_put_8s(f, &s->sstsa);
821
    qemu_put_8s(f, &s->ssrsa);
822
    qemu_put_8s(f, &s->ssacd);
823

    
824
    qemu_put_byte(f, s->rx_level);
825
    for (i = 0; i < s->rx_level; i ++)
826
        qemu_put_byte(f, s->rx_fifo[(s->rx_start + i) & 0xf]);
827
}
828

    
829
static int pxa2xx_ssp_load(QEMUFile *f, void *opaque, int version_id)
830
{
831
    PXA2xxSSPState *s = (PXA2xxSSPState *) opaque;
832
    int i;
833

    
834
    s->enable = qemu_get_be32(f);
835

    
836
    qemu_get_be32s(f, &s->sscr[0]);
837
    qemu_get_be32s(f, &s->sscr[1]);
838
    qemu_get_be32s(f, &s->sspsp);
839
    qemu_get_be32s(f, &s->ssto);
840
    qemu_get_be32s(f, &s->ssitr);
841
    qemu_get_be32s(f, &s->sssr);
842
    qemu_get_8s(f, &s->sstsa);
843
    qemu_get_8s(f, &s->ssrsa);
844
    qemu_get_8s(f, &s->ssacd);
845

    
846
    s->rx_level = qemu_get_byte(f);
847
    s->rx_start = 0;
848
    for (i = 0; i < s->rx_level; i ++)
849
        s->rx_fifo[i] = qemu_get_byte(f);
850

    
851
    return 0;
852
}
853

    
854
static int pxa2xx_ssp_init(SysBusDevice *dev)
855
{
856
    int iomemtype;
857
    PXA2xxSSPState *s = FROM_SYSBUS(PXA2xxSSPState, dev);
858

    
859
    sysbus_init_irq(dev, &s->irq);
860

    
861
    iomemtype = cpu_register_io_memory(pxa2xx_ssp_readfn,
862
                                       pxa2xx_ssp_writefn, s,
863
                                       DEVICE_NATIVE_ENDIAN);
864
    sysbus_init_mmio(dev, 0x1000, iomemtype);
865
    register_savevm(&dev->qdev, "pxa2xx_ssp", -1, 0,
866
                    pxa2xx_ssp_save, pxa2xx_ssp_load, s);
867

    
868
    s->bus = ssi_create_bus(&dev->qdev, "ssi");
869
    return 0;
870
}
871

    
872
/* Real-Time Clock */
873
#define RCNR                0x00        /* RTC Counter register */
874
#define RTAR                0x04        /* RTC Alarm register */
875
#define RTSR                0x08        /* RTC Status register */
876
#define RTTR                0x0c        /* RTC Timer Trim register */
877
#define RDCR                0x10        /* RTC Day Counter register */
878
#define RYCR                0x14        /* RTC Year Counter register */
879
#define RDAR1                0x18        /* RTC Wristwatch Day Alarm register 1 */
880
#define RYAR1                0x1c        /* RTC Wristwatch Year Alarm register 1 */
881
#define RDAR2                0x20        /* RTC Wristwatch Day Alarm register 2 */
882
#define RYAR2                0x24        /* RTC Wristwatch Year Alarm register 2 */
883
#define SWCR                0x28        /* RTC Stopwatch Counter register */
884
#define SWAR1                0x2c        /* RTC Stopwatch Alarm register 1 */
885
#define SWAR2                0x30        /* RTC Stopwatch Alarm register 2 */
886
#define RTCPICR                0x34        /* RTC Periodic Interrupt Counter register */
887
#define PIAR                0x38        /* RTC Periodic Interrupt Alarm register */
888

    
889
static inline void pxa2xx_rtc_int_update(PXA2xxState *s)
890
{
891
    qemu_set_irq(s->pic[PXA2XX_PIC_RTCALARM], !!(s->rtsr & 0x2553));
892
}
893

    
894
static void pxa2xx_rtc_hzupdate(PXA2xxState *s)
895
{
896
    int64_t rt = qemu_get_clock(rt_clock);
897
    s->last_rcnr += ((rt - s->last_hz) << 15) /
898
            (1000 * ((s->rttr & 0xffff) + 1));
899
    s->last_rdcr += ((rt - s->last_hz) << 15) /
900
            (1000 * ((s->rttr & 0xffff) + 1));
901
    s->last_hz = rt;
902
}
903

    
904
static void pxa2xx_rtc_swupdate(PXA2xxState *s)
905
{
906
    int64_t rt = qemu_get_clock(rt_clock);
907
    if (s->rtsr & (1 << 12))
908
        s->last_swcr += (rt - s->last_sw) / 10;
909
    s->last_sw = rt;
910
}
911

    
912
static void pxa2xx_rtc_piupdate(PXA2xxState *s)
913
{
914
    int64_t rt = qemu_get_clock(rt_clock);
915
    if (s->rtsr & (1 << 15))
916
        s->last_swcr += rt - s->last_pi;
917
    s->last_pi = rt;
918
}
919

    
920
static inline void pxa2xx_rtc_alarm_update(PXA2xxState *s,
921
                uint32_t rtsr)
922
{
923
    if ((rtsr & (1 << 2)) && !(rtsr & (1 << 0)))
924
        qemu_mod_timer(s->rtc_hz, s->last_hz +
925
                (((s->rtar - s->last_rcnr) * 1000 *
926
                  ((s->rttr & 0xffff) + 1)) >> 15));
927
    else
928
        qemu_del_timer(s->rtc_hz);
929

    
930
    if ((rtsr & (1 << 5)) && !(rtsr & (1 << 4)))
931
        qemu_mod_timer(s->rtc_rdal1, s->last_hz +
932
                (((s->rdar1 - s->last_rdcr) * 1000 *
933
                  ((s->rttr & 0xffff) + 1)) >> 15)); /* TODO: fixup */
934
    else
935
        qemu_del_timer(s->rtc_rdal1);
936

    
937
    if ((rtsr & (1 << 7)) && !(rtsr & (1 << 6)))
938
        qemu_mod_timer(s->rtc_rdal2, s->last_hz +
939
                (((s->rdar2 - s->last_rdcr) * 1000 *
940
                  ((s->rttr & 0xffff) + 1)) >> 15)); /* TODO: fixup */
941
    else
942
        qemu_del_timer(s->rtc_rdal2);
943

    
944
    if ((rtsr & 0x1200) == 0x1200 && !(rtsr & (1 << 8)))
945
        qemu_mod_timer(s->rtc_swal1, s->last_sw +
946
                        (s->swar1 - s->last_swcr) * 10); /* TODO: fixup */
947
    else
948
        qemu_del_timer(s->rtc_swal1);
949

    
950
    if ((rtsr & 0x1800) == 0x1800 && !(rtsr & (1 << 10)))
951
        qemu_mod_timer(s->rtc_swal2, s->last_sw +
952
                        (s->swar2 - s->last_swcr) * 10); /* TODO: fixup */
953
    else
954
        qemu_del_timer(s->rtc_swal2);
955

    
956
    if ((rtsr & 0xc000) == 0xc000 && !(rtsr & (1 << 13)))
957
        qemu_mod_timer(s->rtc_pi, s->last_pi +
958
                        (s->piar & 0xffff) - s->last_rtcpicr);
959
    else
960
        qemu_del_timer(s->rtc_pi);
961
}
962

    
963
static inline void pxa2xx_rtc_hz_tick(void *opaque)
964
{
965
    PXA2xxState *s = (PXA2xxState *) opaque;
966
    s->rtsr |= (1 << 0);
967
    pxa2xx_rtc_alarm_update(s, s->rtsr);
968
    pxa2xx_rtc_int_update(s);
969
}
970

    
971
static inline void pxa2xx_rtc_rdal1_tick(void *opaque)
972
{
973
    PXA2xxState *s = (PXA2xxState *) opaque;
974
    s->rtsr |= (1 << 4);
975
    pxa2xx_rtc_alarm_update(s, s->rtsr);
976
    pxa2xx_rtc_int_update(s);
977
}
978

    
979
static inline void pxa2xx_rtc_rdal2_tick(void *opaque)
980
{
981
    PXA2xxState *s = (PXA2xxState *) opaque;
982
    s->rtsr |= (1 << 6);
983
    pxa2xx_rtc_alarm_update(s, s->rtsr);
984
    pxa2xx_rtc_int_update(s);
985
}
986

    
987
static inline void pxa2xx_rtc_swal1_tick(void *opaque)
988
{
989
    PXA2xxState *s = (PXA2xxState *) opaque;
990
    s->rtsr |= (1 << 8);
991
    pxa2xx_rtc_alarm_update(s, s->rtsr);
992
    pxa2xx_rtc_int_update(s);
993
}
994

    
995
static inline void pxa2xx_rtc_swal2_tick(void *opaque)
996
{
997
    PXA2xxState *s = (PXA2xxState *) opaque;
998
    s->rtsr |= (1 << 10);
999
    pxa2xx_rtc_alarm_update(s, s->rtsr);
1000
    pxa2xx_rtc_int_update(s);
1001
}
1002

    
1003
static inline void pxa2xx_rtc_pi_tick(void *opaque)
1004
{
1005
    PXA2xxState *s = (PXA2xxState *) opaque;
1006
    s->rtsr |= (1 << 13);
1007
    pxa2xx_rtc_piupdate(s);
1008
    s->last_rtcpicr = 0;
1009
    pxa2xx_rtc_alarm_update(s, s->rtsr);
1010
    pxa2xx_rtc_int_update(s);
1011
}
1012

    
1013
static uint32_t pxa2xx_rtc_read(void *opaque, target_phys_addr_t addr)
1014
{
1015
    PXA2xxState *s = (PXA2xxState *) opaque;
1016

    
1017
    switch (addr) {
1018
    case RTTR:
1019
        return s->rttr;
1020
    case RTSR:
1021
        return s->rtsr;
1022
    case RTAR:
1023
        return s->rtar;
1024
    case RDAR1:
1025
        return s->rdar1;
1026
    case RDAR2:
1027
        return s->rdar2;
1028
    case RYAR1:
1029
        return s->ryar1;
1030
    case RYAR2:
1031
        return s->ryar2;
1032
    case SWAR1:
1033
        return s->swar1;
1034
    case SWAR2:
1035
        return s->swar2;
1036
    case PIAR:
1037
        return s->piar;
1038
    case RCNR:
1039
        return s->last_rcnr + ((qemu_get_clock(rt_clock) - s->last_hz) << 15) /
1040
                (1000 * ((s->rttr & 0xffff) + 1));
1041
    case RDCR:
1042
        return s->last_rdcr + ((qemu_get_clock(rt_clock) - s->last_hz) << 15) /
1043
                (1000 * ((s->rttr & 0xffff) + 1));
1044
    case RYCR:
1045
        return s->last_rycr;
1046
    case SWCR:
1047
        if (s->rtsr & (1 << 12))
1048
            return s->last_swcr + (qemu_get_clock(rt_clock) - s->last_sw) / 10;
1049
        else
1050
            return s->last_swcr;
1051
    default:
1052
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1053
        break;
1054
    }
1055
    return 0;
1056
}
1057

    
1058
static void pxa2xx_rtc_write(void *opaque, target_phys_addr_t addr,
1059
                uint32_t value)
1060
{
1061
    PXA2xxState *s = (PXA2xxState *) opaque;
1062

    
1063
    switch (addr) {
1064
    case RTTR:
1065
        if (!(s->rttr & (1 << 31))) {
1066
            pxa2xx_rtc_hzupdate(s);
1067
            s->rttr = value;
1068
            pxa2xx_rtc_alarm_update(s, s->rtsr);
1069
        }
1070
        break;
1071

    
1072
    case RTSR:
1073
        if ((s->rtsr ^ value) & (1 << 15))
1074
            pxa2xx_rtc_piupdate(s);
1075

    
1076
        if ((s->rtsr ^ value) & (1 << 12))
1077
            pxa2xx_rtc_swupdate(s);
1078

    
1079
        if (((s->rtsr ^ value) & 0x4aac) | (value & ~0xdaac))
1080
            pxa2xx_rtc_alarm_update(s, value);
1081

    
1082
        s->rtsr = (value & 0xdaac) | (s->rtsr & ~(value & ~0xdaac));
1083
        pxa2xx_rtc_int_update(s);
1084
        break;
1085

    
1086
    case RTAR:
1087
        s->rtar = value;
1088
        pxa2xx_rtc_alarm_update(s, s->rtsr);
1089
        break;
1090

    
1091
    case RDAR1:
1092
        s->rdar1 = value;
1093
        pxa2xx_rtc_alarm_update(s, s->rtsr);
1094
        break;
1095

    
1096
    case RDAR2:
1097
        s->rdar2 = value;
1098
        pxa2xx_rtc_alarm_update(s, s->rtsr);
1099
        break;
1100

    
1101
    case RYAR1:
1102
        s->ryar1 = value;
1103
        pxa2xx_rtc_alarm_update(s, s->rtsr);
1104
        break;
1105

    
1106
    case RYAR2:
1107
        s->ryar2 = value;
1108
        pxa2xx_rtc_alarm_update(s, s->rtsr);
1109
        break;
1110

    
1111
    case SWAR1:
1112
        pxa2xx_rtc_swupdate(s);
1113
        s->swar1 = value;
1114
        s->last_swcr = 0;
1115
        pxa2xx_rtc_alarm_update(s, s->rtsr);
1116
        break;
1117

    
1118
    case SWAR2:
1119
        s->swar2 = value;
1120
        pxa2xx_rtc_alarm_update(s, s->rtsr);
1121
        break;
1122

    
1123
    case PIAR:
1124
        s->piar = value;
1125
        pxa2xx_rtc_alarm_update(s, s->rtsr);
1126
        break;
1127

    
1128
    case RCNR:
1129
        pxa2xx_rtc_hzupdate(s);
1130
        s->last_rcnr = value;
1131
        pxa2xx_rtc_alarm_update(s, s->rtsr);
1132
        break;
1133

    
1134
    case RDCR:
1135
        pxa2xx_rtc_hzupdate(s);
1136
        s->last_rdcr = value;
1137
        pxa2xx_rtc_alarm_update(s, s->rtsr);
1138
        break;
1139

    
1140
    case RYCR:
1141
        s->last_rycr = value;
1142
        break;
1143

    
1144
    case SWCR:
1145
        pxa2xx_rtc_swupdate(s);
1146
        s->last_swcr = value;
1147
        pxa2xx_rtc_alarm_update(s, s->rtsr);
1148
        break;
1149

    
1150
    case RTCPICR:
1151
        pxa2xx_rtc_piupdate(s);
1152
        s->last_rtcpicr = value & 0xffff;
1153
        pxa2xx_rtc_alarm_update(s, s->rtsr);
1154
        break;
1155

    
1156
    default:
1157
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1158
    }
1159
}
1160

    
1161
static CPUReadMemoryFunc * const pxa2xx_rtc_readfn[] = {
1162
    pxa2xx_rtc_read,
1163
    pxa2xx_rtc_read,
1164
    pxa2xx_rtc_read,
1165
};
1166

    
1167
static CPUWriteMemoryFunc * const pxa2xx_rtc_writefn[] = {
1168
    pxa2xx_rtc_write,
1169
    pxa2xx_rtc_write,
1170
    pxa2xx_rtc_write,
1171
};
1172

    
1173
static void pxa2xx_rtc_init(PXA2xxState *s)
1174
{
1175
    struct tm tm;
1176
    int wom;
1177

    
1178
    s->rttr = 0x7fff;
1179
    s->rtsr = 0;
1180

    
1181
    qemu_get_timedate(&tm, 0);
1182
    wom = ((tm.tm_mday - 1) / 7) + 1;
1183

    
1184
    s->last_rcnr = (uint32_t) mktimegm(&tm);
1185
    s->last_rdcr = (wom << 20) | ((tm.tm_wday + 1) << 17) |
1186
            (tm.tm_hour << 12) | (tm.tm_min << 6) | tm.tm_sec;
1187
    s->last_rycr = ((tm.tm_year + 1900) << 9) |
1188
            ((tm.tm_mon + 1) << 5) | tm.tm_mday;
1189
    s->last_swcr = (tm.tm_hour << 19) |
1190
            (tm.tm_min << 13) | (tm.tm_sec << 7);
1191
    s->last_rtcpicr = 0;
1192
    s->last_hz = s->last_sw = s->last_pi = qemu_get_clock(rt_clock);
1193

    
1194
    s->rtc_hz    = qemu_new_timer(rt_clock, pxa2xx_rtc_hz_tick,    s);
1195
    s->rtc_rdal1 = qemu_new_timer(rt_clock, pxa2xx_rtc_rdal1_tick, s);
1196
    s->rtc_rdal2 = qemu_new_timer(rt_clock, pxa2xx_rtc_rdal2_tick, s);
1197
    s->rtc_swal1 = qemu_new_timer(rt_clock, pxa2xx_rtc_swal1_tick, s);
1198
    s->rtc_swal2 = qemu_new_timer(rt_clock, pxa2xx_rtc_swal2_tick, s);
1199
    s->rtc_pi    = qemu_new_timer(rt_clock, pxa2xx_rtc_pi_tick,    s);
1200
}
1201

    
1202
static void pxa2xx_rtc_save(QEMUFile *f, void *opaque)
1203
{
1204
    PXA2xxState *s = (PXA2xxState *) opaque;
1205

    
1206
    pxa2xx_rtc_hzupdate(s);
1207
    pxa2xx_rtc_piupdate(s);
1208
    pxa2xx_rtc_swupdate(s);
1209

    
1210
    qemu_put_be32s(f, &s->rttr);
1211
    qemu_put_be32s(f, &s->rtsr);
1212
    qemu_put_be32s(f, &s->rtar);
1213
    qemu_put_be32s(f, &s->rdar1);
1214
    qemu_put_be32s(f, &s->rdar2);
1215
    qemu_put_be32s(f, &s->ryar1);
1216
    qemu_put_be32s(f, &s->ryar2);
1217
    qemu_put_be32s(f, &s->swar1);
1218
    qemu_put_be32s(f, &s->swar2);
1219
    qemu_put_be32s(f, &s->piar);
1220
    qemu_put_be32s(f, &s->last_rcnr);
1221
    qemu_put_be32s(f, &s->last_rdcr);
1222
    qemu_put_be32s(f, &s->last_rycr);
1223
    qemu_put_be32s(f, &s->last_swcr);
1224
    qemu_put_be32s(f, &s->last_rtcpicr);
1225
    qemu_put_sbe64s(f, &s->last_hz);
1226
    qemu_put_sbe64s(f, &s->last_sw);
1227
    qemu_put_sbe64s(f, &s->last_pi);
1228
}
1229

    
1230
static int pxa2xx_rtc_load(QEMUFile *f, void *opaque, int version_id)
1231
{
1232
    PXA2xxState *s = (PXA2xxState *) opaque;
1233

    
1234
    qemu_get_be32s(f, &s->rttr);
1235
    qemu_get_be32s(f, &s->rtsr);
1236
    qemu_get_be32s(f, &s->rtar);
1237
    qemu_get_be32s(f, &s->rdar1);
1238
    qemu_get_be32s(f, &s->rdar2);
1239
    qemu_get_be32s(f, &s->ryar1);
1240
    qemu_get_be32s(f, &s->ryar2);
1241
    qemu_get_be32s(f, &s->swar1);
1242
    qemu_get_be32s(f, &s->swar2);
1243
    qemu_get_be32s(f, &s->piar);
1244
    qemu_get_be32s(f, &s->last_rcnr);
1245
    qemu_get_be32s(f, &s->last_rdcr);
1246
    qemu_get_be32s(f, &s->last_rycr);
1247
    qemu_get_be32s(f, &s->last_swcr);
1248
    qemu_get_be32s(f, &s->last_rtcpicr);
1249
    qemu_get_sbe64s(f, &s->last_hz);
1250
    qemu_get_sbe64s(f, &s->last_sw);
1251
    qemu_get_sbe64s(f, &s->last_pi);
1252

    
1253
    pxa2xx_rtc_alarm_update(s, s->rtsr);
1254

    
1255
    return 0;
1256
}
1257

    
1258
/* I2C Interface */
1259
typedef struct {
1260
    i2c_slave i2c;
1261
    PXA2xxI2CState *host;
1262
} PXA2xxI2CSlaveState;
1263

    
1264
struct PXA2xxI2CState {
1265
    SysBusDevice busdev;
1266
    PXA2xxI2CSlaveState *slave;
1267
    i2c_bus *bus;
1268
    qemu_irq irq;
1269
    uint32_t offset;
1270
    uint32_t region_size;
1271

    
1272
    uint16_t control;
1273
    uint16_t status;
1274
    uint8_t ibmr;
1275
    uint8_t data;
1276
};
1277

    
1278
#define IBMR        0x80        /* I2C Bus Monitor register */
1279
#define IDBR        0x88        /* I2C Data Buffer register */
1280
#define ICR        0x90        /* I2C Control register */
1281
#define ISR        0x98        /* I2C Status register */
1282
#define ISAR        0xa0        /* I2C Slave Address register */
1283

    
1284
static void pxa2xx_i2c_update(PXA2xxI2CState *s)
1285
{
1286
    uint16_t level = 0;
1287
    level |= s->status & s->control & (1 << 10);                /* BED */
1288
    level |= (s->status & (1 << 7)) && (s->control & (1 << 9));        /* IRF */
1289
    level |= (s->status & (1 << 6)) && (s->control & (1 << 8));        /* ITE */
1290
    level |= s->status & (1 << 9);                                /* SAD */
1291
    qemu_set_irq(s->irq, !!level);
1292
}
1293

    
1294
/* These are only stubs now.  */
1295
static void pxa2xx_i2c_event(i2c_slave *i2c, enum i2c_event event)
1296
{
1297
    PXA2xxI2CSlaveState *slave = FROM_I2C_SLAVE(PXA2xxI2CSlaveState, i2c);
1298
    PXA2xxI2CState *s = slave->host;
1299

    
1300
    switch (event) {
1301
    case I2C_START_SEND:
1302
        s->status |= (1 << 9);                                /* set SAD */
1303
        s->status &= ~(1 << 0);                                /* clear RWM */
1304
        break;
1305
    case I2C_START_RECV:
1306
        s->status |= (1 << 9);                                /* set SAD */
1307
        s->status |= 1 << 0;                                /* set RWM */
1308
        break;
1309
    case I2C_FINISH:
1310
        s->status |= (1 << 4);                                /* set SSD */
1311
        break;
1312
    case I2C_NACK:
1313
        s->status |= 1 << 1;                                /* set ACKNAK */
1314
        break;
1315
    }
1316
    pxa2xx_i2c_update(s);
1317
}
1318

    
1319
static int pxa2xx_i2c_rx(i2c_slave *i2c)
1320
{
1321
    PXA2xxI2CSlaveState *slave = FROM_I2C_SLAVE(PXA2xxI2CSlaveState, i2c);
1322
    PXA2xxI2CState *s = slave->host;
1323
    if ((s->control & (1 << 14)) || !(s->control & (1 << 6)))
1324
        return 0;
1325

    
1326
    if (s->status & (1 << 0)) {                        /* RWM */
1327
        s->status |= 1 << 6;                        /* set ITE */
1328
    }
1329
    pxa2xx_i2c_update(s);
1330

    
1331
    return s->data;
1332
}
1333

    
1334
static int pxa2xx_i2c_tx(i2c_slave *i2c, uint8_t data)
1335
{
1336
    PXA2xxI2CSlaveState *slave = FROM_I2C_SLAVE(PXA2xxI2CSlaveState, i2c);
1337
    PXA2xxI2CState *s = slave->host;
1338
    if ((s->control & (1 << 14)) || !(s->control & (1 << 6)))
1339
        return 1;
1340

    
1341
    if (!(s->status & (1 << 0))) {                /* RWM */
1342
        s->status |= 1 << 7;                        /* set IRF */
1343
        s->data = data;
1344
    }
1345
    pxa2xx_i2c_update(s);
1346

    
1347
    return 1;
1348
}
1349

    
1350
static uint32_t pxa2xx_i2c_read(void *opaque, target_phys_addr_t addr)
1351
{
1352
    PXA2xxI2CState *s = (PXA2xxI2CState *) opaque;
1353

    
1354
    addr -= s->offset;
1355
    switch (addr) {
1356
    case ICR:
1357
        return s->control;
1358
    case ISR:
1359
        return s->status | (i2c_bus_busy(s->bus) << 2);
1360
    case ISAR:
1361
        return s->slave->i2c.address;
1362
    case IDBR:
1363
        return s->data;
1364
    case IBMR:
1365
        if (s->status & (1 << 2))
1366
            s->ibmr ^= 3;        /* Fake SCL and SDA pin changes */
1367
        else
1368
            s->ibmr = 0;
1369
        return s->ibmr;
1370
    default:
1371
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1372
        break;
1373
    }
1374
    return 0;
1375
}
1376

    
1377
static void pxa2xx_i2c_write(void *opaque, target_phys_addr_t addr,
1378
                uint32_t value)
1379
{
1380
    PXA2xxI2CState *s = (PXA2xxI2CState *) opaque;
1381
    int ack;
1382

    
1383
    addr -= s->offset;
1384
    switch (addr) {
1385
    case ICR:
1386
        s->control = value & 0xfff7;
1387
        if ((value & (1 << 3)) && (value & (1 << 6))) {        /* TB and IUE */
1388
            /* TODO: slave mode */
1389
            if (value & (1 << 0)) {                        /* START condition */
1390
                if (s->data & 1)
1391
                    s->status |= 1 << 0;                /* set RWM */
1392
                else
1393
                    s->status &= ~(1 << 0);                /* clear RWM */
1394
                ack = !i2c_start_transfer(s->bus, s->data >> 1, s->data & 1);
1395
            } else {
1396
                if (s->status & (1 << 0)) {                /* RWM */
1397
                    s->data = i2c_recv(s->bus);
1398
                    if (value & (1 << 2))                /* ACKNAK */
1399
                        i2c_nack(s->bus);
1400
                    ack = 1;
1401
                } else
1402
                    ack = !i2c_send(s->bus, s->data);
1403
            }
1404

    
1405
            if (value & (1 << 1))                        /* STOP condition */
1406
                i2c_end_transfer(s->bus);
1407

    
1408
            if (ack) {
1409
                if (value & (1 << 0))                        /* START condition */
1410
                    s->status |= 1 << 6;                /* set ITE */
1411
                else
1412
                    if (s->status & (1 << 0))                /* RWM */
1413
                        s->status |= 1 << 7;                /* set IRF */
1414
                    else
1415
                        s->status |= 1 << 6;                /* set ITE */
1416
                s->status &= ~(1 << 1);                        /* clear ACKNAK */
1417
            } else {
1418
                s->status |= 1 << 6;                        /* set ITE */
1419
                s->status |= 1 << 10;                        /* set BED */
1420
                s->status |= 1 << 1;                        /* set ACKNAK */
1421
            }
1422
        }
1423
        if (!(value & (1 << 3)) && (value & (1 << 6)))        /* !TB and IUE */
1424
            if (value & (1 << 4))                        /* MA */
1425
                i2c_end_transfer(s->bus);
1426
        pxa2xx_i2c_update(s);
1427
        break;
1428

    
1429
    case ISR:
1430
        s->status &= ~(value & 0x07f0);
1431
        pxa2xx_i2c_update(s);
1432
        break;
1433

    
1434
    case ISAR:
1435
        i2c_set_slave_address(&s->slave->i2c, value & 0x7f);
1436
        break;
1437

    
1438
    case IDBR:
1439
        s->data = value & 0xff;
1440
        break;
1441

    
1442
    default:
1443
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1444
    }
1445
}
1446

    
1447
static CPUReadMemoryFunc * const pxa2xx_i2c_readfn[] = {
1448
    pxa2xx_i2c_read,
1449
    pxa2xx_i2c_read,
1450
    pxa2xx_i2c_read,
1451
};
1452

    
1453
static CPUWriteMemoryFunc * const pxa2xx_i2c_writefn[] = {
1454
    pxa2xx_i2c_write,
1455
    pxa2xx_i2c_write,
1456
    pxa2xx_i2c_write,
1457
};
1458

    
1459
static const VMStateDescription vmstate_pxa2xx_i2c_slave = {
1460
    .name = "pxa2xx_i2c_slave",
1461
    .version_id = 1,
1462
    .minimum_version_id = 1,
1463
    .minimum_version_id_old = 1,
1464
    .fields      = (VMStateField []) {
1465
        VMSTATE_I2C_SLAVE(i2c, PXA2xxI2CSlaveState),
1466
        VMSTATE_END_OF_LIST()
1467
    }
1468
};
1469

    
1470
static const VMStateDescription vmstate_pxa2xx_i2c = {
1471
    .name = "pxa2xx_i2c",
1472
    .version_id = 1,
1473
    .minimum_version_id = 1,
1474
    .minimum_version_id_old = 1,
1475
    .fields      = (VMStateField []) {
1476
        VMSTATE_UINT16(control, PXA2xxI2CState),
1477
        VMSTATE_UINT16(status, PXA2xxI2CState),
1478
        VMSTATE_UINT8(ibmr, PXA2xxI2CState),
1479
        VMSTATE_UINT8(data, PXA2xxI2CState),
1480
        VMSTATE_STRUCT_POINTER(slave, PXA2xxI2CState,
1481
                               vmstate_pxa2xx_i2c_slave, PXA2xxI2CSlaveState *),
1482
        VMSTATE_END_OF_LIST()
1483
    }
1484
};
1485

    
1486
static int pxa2xx_i2c_slave_init(i2c_slave *i2c)
1487
{
1488
    /* Nothing to do.  */
1489
    return 0;
1490
}
1491

    
1492
static I2CSlaveInfo pxa2xx_i2c_slave_info = {
1493
    .qdev.name = "pxa2xx-i2c-slave",
1494
    .qdev.size = sizeof(PXA2xxI2CSlaveState),
1495
    .init = pxa2xx_i2c_slave_init,
1496
    .event = pxa2xx_i2c_event,
1497
    .recv = pxa2xx_i2c_rx,
1498
    .send = pxa2xx_i2c_tx
1499
};
1500

    
1501
PXA2xxI2CState *pxa2xx_i2c_init(target_phys_addr_t base,
1502
                qemu_irq irq, uint32_t region_size)
1503
{
1504
    DeviceState *dev;
1505
    SysBusDevice *i2c_dev;
1506
    PXA2xxI2CState *s;
1507

    
1508
    i2c_dev = sysbus_from_qdev(qdev_create(NULL, "pxa2xx_i2c"));
1509
    qdev_prop_set_uint32(&i2c_dev->qdev, "size", region_size + 1);
1510
    qdev_prop_set_uint32(&i2c_dev->qdev, "offset",
1511
            base - (base & (~region_size) & TARGET_PAGE_MASK));
1512

    
1513
    qdev_init_nofail(&i2c_dev->qdev);
1514

    
1515
    sysbus_mmio_map(i2c_dev, 0, base & ~region_size);
1516
    sysbus_connect_irq(i2c_dev, 0, irq);
1517

    
1518
    s = FROM_SYSBUS(PXA2xxI2CState, i2c_dev);
1519
    /* FIXME: Should the slave device really be on a separate bus?  */
1520
    dev = i2c_create_slave(i2c_init_bus(NULL, "dummy"), "pxa2xx-i2c-slave", 0);
1521
    s->slave = FROM_I2C_SLAVE(PXA2xxI2CSlaveState, I2C_SLAVE_FROM_QDEV(dev));
1522
    s->slave->host = s;
1523

    
1524
    return s;
1525
}
1526

    
1527
static int pxa2xx_i2c_initfn(SysBusDevice *dev)
1528
{
1529
    PXA2xxI2CState *s = FROM_SYSBUS(PXA2xxI2CState, dev);
1530
    int iomemtype;
1531

    
1532
    s->bus = i2c_init_bus(&dev->qdev, "i2c");
1533

    
1534
    iomemtype = cpu_register_io_memory(pxa2xx_i2c_readfn,
1535
                    pxa2xx_i2c_writefn, s, DEVICE_NATIVE_ENDIAN);
1536
    sysbus_init_mmio(dev, s->region_size, iomemtype);
1537
    sysbus_init_irq(dev, &s->irq);
1538

    
1539
    return 0;
1540
}
1541

    
1542
i2c_bus *pxa2xx_i2c_bus(PXA2xxI2CState *s)
1543
{
1544
    return s->bus;
1545
}
1546

    
1547
static SysBusDeviceInfo pxa2xx_i2c_info = {
1548
    .init       = pxa2xx_i2c_initfn,
1549
    .qdev.name  = "pxa2xx_i2c",
1550
    .qdev.desc  = "PXA2xx I2C Bus Controller",
1551
    .qdev.size  = sizeof(PXA2xxI2CState),
1552
    .qdev.vmsd  = &vmstate_pxa2xx_i2c,
1553
    .qdev.props = (Property[]) {
1554
        DEFINE_PROP_UINT32("size", PXA2xxI2CState, region_size, 0x10000),
1555
        DEFINE_PROP_UINT32("offset", PXA2xxI2CState, offset, 0),
1556
        DEFINE_PROP_END_OF_LIST(),
1557
    },
1558
};
1559

    
1560
/* PXA Inter-IC Sound Controller */
1561
static void pxa2xx_i2s_reset(PXA2xxI2SState *i2s)
1562
{
1563
    i2s->rx_len = 0;
1564
    i2s->tx_len = 0;
1565
    i2s->fifo_len = 0;
1566
    i2s->clk = 0x1a;
1567
    i2s->control[0] = 0x00;
1568
    i2s->control[1] = 0x00;
1569
    i2s->status = 0x00;
1570
    i2s->mask = 0x00;
1571
}
1572

    
1573
#define SACR_TFTH(val)        ((val >> 8) & 0xf)
1574
#define SACR_RFTH(val)        ((val >> 12) & 0xf)
1575
#define SACR_DREC(val)        (val & (1 << 3))
1576
#define SACR_DPRL(val)        (val & (1 << 4))
1577

    
1578
static inline void pxa2xx_i2s_update(PXA2xxI2SState *i2s)
1579
{
1580
    int rfs, tfs;
1581
    rfs = SACR_RFTH(i2s->control[0]) < i2s->rx_len &&
1582
            !SACR_DREC(i2s->control[1]);
1583
    tfs = (i2s->tx_len || i2s->fifo_len < SACR_TFTH(i2s->control[0])) &&
1584
            i2s->enable && !SACR_DPRL(i2s->control[1]);
1585

    
1586
    pxa2xx_dma_request(i2s->dma, PXA2XX_RX_RQ_I2S, rfs);
1587
    pxa2xx_dma_request(i2s->dma, PXA2XX_TX_RQ_I2S, tfs);
1588

    
1589
    i2s->status &= 0xe0;
1590
    if (i2s->fifo_len < 16 || !i2s->enable)
1591
        i2s->status |= 1 << 0;                        /* TNF */
1592
    if (i2s->rx_len)
1593
        i2s->status |= 1 << 1;                        /* RNE */
1594
    if (i2s->enable)
1595
        i2s->status |= 1 << 2;                        /* BSY */
1596
    if (tfs)
1597
        i2s->status |= 1 << 3;                        /* TFS */
1598
    if (rfs)
1599
        i2s->status |= 1 << 4;                        /* RFS */
1600
    if (!(i2s->tx_len && i2s->enable))
1601
        i2s->status |= i2s->fifo_len << 8;        /* TFL */
1602
    i2s->status |= MAX(i2s->rx_len, 0xf) << 12;        /* RFL */
1603

    
1604
    qemu_set_irq(i2s->irq, i2s->status & i2s->mask);
1605
}
1606

    
1607
#define SACR0        0x00        /* Serial Audio Global Control register */
1608
#define SACR1        0x04        /* Serial Audio I2S/MSB-Justified Control register */
1609
#define SASR0        0x0c        /* Serial Audio Interface and FIFO Status register */
1610
#define SAIMR        0x14        /* Serial Audio Interrupt Mask register */
1611
#define SAICR        0x18        /* Serial Audio Interrupt Clear register */
1612
#define SADIV        0x60        /* Serial Audio Clock Divider register */
1613
#define SADR        0x80        /* Serial Audio Data register */
1614

    
1615
static uint32_t pxa2xx_i2s_read(void *opaque, target_phys_addr_t addr)
1616
{
1617
    PXA2xxI2SState *s = (PXA2xxI2SState *) opaque;
1618

    
1619
    switch (addr) {
1620
    case SACR0:
1621
        return s->control[0];
1622
    case SACR1:
1623
        return s->control[1];
1624
    case SASR0:
1625
        return s->status;
1626
    case SAIMR:
1627
        return s->mask;
1628
    case SAICR:
1629
        return 0;
1630
    case SADIV:
1631
        return s->clk;
1632
    case SADR:
1633
        if (s->rx_len > 0) {
1634
            s->rx_len --;
1635
            pxa2xx_i2s_update(s);
1636
            return s->codec_in(s->opaque);
1637
        }
1638
        return 0;
1639
    default:
1640
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1641
        break;
1642
    }
1643
    return 0;
1644
}
1645

    
1646
static void pxa2xx_i2s_write(void *opaque, target_phys_addr_t addr,
1647
                uint32_t value)
1648
{
1649
    PXA2xxI2SState *s = (PXA2xxI2SState *) opaque;
1650
    uint32_t *sample;
1651

    
1652
    switch (addr) {
1653
    case SACR0:
1654
        if (value & (1 << 3))                                /* RST */
1655
            pxa2xx_i2s_reset(s);
1656
        s->control[0] = value & 0xff3d;
1657
        if (!s->enable && (value & 1) && s->tx_len) {        /* ENB */
1658
            for (sample = s->fifo; s->fifo_len > 0; s->fifo_len --, sample ++)
1659
                s->codec_out(s->opaque, *sample);
1660
            s->status &= ~(1 << 7);                        /* I2SOFF */
1661
        }
1662
        if (value & (1 << 4))                                /* EFWR */
1663
            printf("%s: Attempt to use special function\n", __FUNCTION__);
1664
        s->enable = (value & 9) == 1;                        /* ENB && !RST*/
1665
        pxa2xx_i2s_update(s);
1666
        break;
1667
    case SACR1:
1668
        s->control[1] = value & 0x0039;
1669
        if (value & (1 << 5))                                /* ENLBF */
1670
            printf("%s: Attempt to use loopback function\n", __FUNCTION__);
1671
        if (value & (1 << 4))                                /* DPRL */
1672
            s->fifo_len = 0;
1673
        pxa2xx_i2s_update(s);
1674
        break;
1675
    case SAIMR:
1676
        s->mask = value & 0x0078;
1677
        pxa2xx_i2s_update(s);
1678
        break;
1679
    case SAICR:
1680
        s->status &= ~(value & (3 << 5));
1681
        pxa2xx_i2s_update(s);
1682
        break;
1683
    case SADIV:
1684
        s->clk = value & 0x007f;
1685
        break;
1686
    case SADR:
1687
        if (s->tx_len && s->enable) {
1688
            s->tx_len --;
1689
            pxa2xx_i2s_update(s);
1690
            s->codec_out(s->opaque, value);
1691
        } else if (s->fifo_len < 16) {
1692
            s->fifo[s->fifo_len ++] = value;
1693
            pxa2xx_i2s_update(s);
1694
        }
1695
        break;
1696
    default:
1697
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1698
    }
1699
}
1700

    
1701
static CPUReadMemoryFunc * const pxa2xx_i2s_readfn[] = {
1702
    pxa2xx_i2s_read,
1703
    pxa2xx_i2s_read,
1704
    pxa2xx_i2s_read,
1705
};
1706

    
1707
static CPUWriteMemoryFunc * const pxa2xx_i2s_writefn[] = {
1708
    pxa2xx_i2s_write,
1709
    pxa2xx_i2s_write,
1710
    pxa2xx_i2s_write,
1711
};
1712

    
1713
static void pxa2xx_i2s_save(QEMUFile *f, void *opaque)
1714
{
1715
    PXA2xxI2SState *s = (PXA2xxI2SState *) opaque;
1716

    
1717
    qemu_put_be32s(f, &s->control[0]);
1718
    qemu_put_be32s(f, &s->control[1]);
1719
    qemu_put_be32s(f, &s->status);
1720
    qemu_put_be32s(f, &s->mask);
1721
    qemu_put_be32s(f, &s->clk);
1722

    
1723
    qemu_put_be32(f, s->enable);
1724
    qemu_put_be32(f, s->rx_len);
1725
    qemu_put_be32(f, s->tx_len);
1726
    qemu_put_be32(f, s->fifo_len);
1727
}
1728

    
1729
static int pxa2xx_i2s_load(QEMUFile *f, void *opaque, int version_id)
1730
{
1731
    PXA2xxI2SState *s = (PXA2xxI2SState *) opaque;
1732

    
1733
    qemu_get_be32s(f, &s->control[0]);
1734
    qemu_get_be32s(f, &s->control[1]);
1735
    qemu_get_be32s(f, &s->status);
1736
    qemu_get_be32s(f, &s->mask);
1737
    qemu_get_be32s(f, &s->clk);
1738

    
1739
    s->enable = qemu_get_be32(f);
1740
    s->rx_len = qemu_get_be32(f);
1741
    s->tx_len = qemu_get_be32(f);
1742
    s->fifo_len = qemu_get_be32(f);
1743

    
1744
    return 0;
1745
}
1746

    
1747
static void pxa2xx_i2s_data_req(void *opaque, int tx, int rx)
1748
{
1749
    PXA2xxI2SState *s = (PXA2xxI2SState *) opaque;
1750
    uint32_t *sample;
1751

    
1752
    /* Signal FIFO errors */
1753
    if (s->enable && s->tx_len)
1754
        s->status |= 1 << 5;                /* TUR */
1755
    if (s->enable && s->rx_len)
1756
        s->status |= 1 << 6;                /* ROR */
1757

    
1758
    /* Should be tx - MIN(tx, s->fifo_len) but we don't really need to
1759
     * handle the cases where it makes a difference.  */
1760
    s->tx_len = tx - s->fifo_len;
1761
    s->rx_len = rx;
1762
    /* Note that is s->codec_out wasn't set, we wouldn't get called.  */
1763
    if (s->enable)
1764
        for (sample = s->fifo; s->fifo_len; s->fifo_len --, sample ++)
1765
            s->codec_out(s->opaque, *sample);
1766
    pxa2xx_i2s_update(s);
1767
}
1768

    
1769
static PXA2xxI2SState *pxa2xx_i2s_init(target_phys_addr_t base,
1770
                qemu_irq irq, PXA2xxDMAState *dma)
1771
{
1772
    int iomemtype;
1773
    PXA2xxI2SState *s = (PXA2xxI2SState *)
1774
            qemu_mallocz(sizeof(PXA2xxI2SState));
1775

    
1776
    s->irq = irq;
1777
    s->dma = dma;
1778
    s->data_req = pxa2xx_i2s_data_req;
1779

    
1780
    pxa2xx_i2s_reset(s);
1781

    
1782
    iomemtype = cpu_register_io_memory(pxa2xx_i2s_readfn,
1783
                    pxa2xx_i2s_writefn, s, DEVICE_NATIVE_ENDIAN);
1784
    cpu_register_physical_memory(base, 0x100000, iomemtype);
1785

    
1786
    register_savevm(NULL, "pxa2xx_i2s", base, 0,
1787
                    pxa2xx_i2s_save, pxa2xx_i2s_load, s);
1788

    
1789
    return s;
1790
}
1791

    
1792
/* PXA Fast Infra-red Communications Port */
1793
struct PXA2xxFIrState {
1794
    qemu_irq irq;
1795
    PXA2xxDMAState *dma;
1796
    int enable;
1797
    CharDriverState *chr;
1798

    
1799
    uint8_t control[3];
1800
    uint8_t status[2];
1801

    
1802
    int rx_len;
1803
    int rx_start;
1804
    uint8_t rx_fifo[64];
1805
};
1806

    
1807
static void pxa2xx_fir_reset(PXA2xxFIrState *s)
1808
{
1809
    s->control[0] = 0x00;
1810
    s->control[1] = 0x00;
1811
    s->control[2] = 0x00;
1812
    s->status[0] = 0x00;
1813
    s->status[1] = 0x00;
1814
    s->enable = 0;
1815
}
1816

    
1817
static inline void pxa2xx_fir_update(PXA2xxFIrState *s)
1818
{
1819
    static const int tresh[4] = { 8, 16, 32, 0 };
1820
    int intr = 0;
1821
    if ((s->control[0] & (1 << 4)) &&                        /* RXE */
1822
                    s->rx_len >= tresh[s->control[2] & 3])        /* TRIG */
1823
        s->status[0] |= 1 << 4;                                /* RFS */
1824
    else
1825
        s->status[0] &= ~(1 << 4);                        /* RFS */
1826
    if (s->control[0] & (1 << 3))                        /* TXE */
1827
        s->status[0] |= 1 << 3;                                /* TFS */
1828
    else
1829
        s->status[0] &= ~(1 << 3);                        /* TFS */
1830
    if (s->rx_len)
1831
        s->status[1] |= 1 << 2;                                /* RNE */
1832
    else
1833
        s->status[1] &= ~(1 << 2);                        /* RNE */
1834
    if (s->control[0] & (1 << 4))                        /* RXE */
1835
        s->status[1] |= 1 << 0;                                /* RSY */
1836
    else
1837
        s->status[1] &= ~(1 << 0);                        /* RSY */
1838

    
1839
    intr |= (s->control[0] & (1 << 5)) &&                /* RIE */
1840
            (s->status[0] & (1 << 4));                        /* RFS */
1841
    intr |= (s->control[0] & (1 << 6)) &&                /* TIE */
1842
            (s->status[0] & (1 << 3));                        /* TFS */
1843
    intr |= (s->control[2] & (1 << 4)) &&                /* TRAIL */
1844
            (s->status[0] & (1 << 6));                        /* EOC */
1845
    intr |= (s->control[0] & (1 << 2)) &&                /* TUS */
1846
            (s->status[0] & (1 << 1));                        /* TUR */
1847
    intr |= s->status[0] & 0x25;                        /* FRE, RAB, EIF */
1848

    
1849
    pxa2xx_dma_request(s->dma, PXA2XX_RX_RQ_ICP, (s->status[0] >> 4) & 1);
1850
    pxa2xx_dma_request(s->dma, PXA2XX_TX_RQ_ICP, (s->status[0] >> 3) & 1);
1851

    
1852
    qemu_set_irq(s->irq, intr && s->enable);
1853
}
1854

    
1855
#define ICCR0        0x00        /* FICP Control register 0 */
1856
#define ICCR1        0x04        /* FICP Control register 1 */
1857
#define ICCR2        0x08        /* FICP Control register 2 */
1858
#define ICDR        0x0c        /* FICP Data register */
1859
#define ICSR0        0x14        /* FICP Status register 0 */
1860
#define ICSR1        0x18        /* FICP Status register 1 */
1861
#define ICFOR        0x1c        /* FICP FIFO Occupancy Status register */
1862

    
1863
static uint32_t pxa2xx_fir_read(void *opaque, target_phys_addr_t addr)
1864
{
1865
    PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1866
    uint8_t ret;
1867

    
1868
    switch (addr) {
1869
    case ICCR0:
1870
        return s->control[0];
1871
    case ICCR1:
1872
        return s->control[1];
1873
    case ICCR2:
1874
        return s->control[2];
1875
    case ICDR:
1876
        s->status[0] &= ~0x01;
1877
        s->status[1] &= ~0x72;
1878
        if (s->rx_len) {
1879
            s->rx_len --;
1880
            ret = s->rx_fifo[s->rx_start ++];
1881
            s->rx_start &= 63;
1882
            pxa2xx_fir_update(s);
1883
            return ret;
1884
        }
1885
        printf("%s: Rx FIFO underrun.\n", __FUNCTION__);
1886
        break;
1887
    case ICSR0:
1888
        return s->status[0];
1889
    case ICSR1:
1890
        return s->status[1] | (1 << 3);                        /* TNF */
1891
    case ICFOR:
1892
        return s->rx_len;
1893
    default:
1894
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1895
        break;
1896
    }
1897
    return 0;
1898
}
1899

    
1900
static void pxa2xx_fir_write(void *opaque, target_phys_addr_t addr,
1901
                uint32_t value)
1902
{
1903
    PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1904
    uint8_t ch;
1905

    
1906
    switch (addr) {
1907
    case ICCR0:
1908
        s->control[0] = value;
1909
        if (!(value & (1 << 4)))                        /* RXE */
1910
            s->rx_len = s->rx_start = 0;
1911
        if (!(value & (1 << 3))) {                      /* TXE */
1912
            /* Nop */
1913
        }
1914
        s->enable = value & 1;                                /* ITR */
1915
        if (!s->enable)
1916
            s->status[0] = 0;
1917
        pxa2xx_fir_update(s);
1918
        break;
1919
    case ICCR1:
1920
        s->control[1] = value;
1921
        break;
1922
    case ICCR2:
1923
        s->control[2] = value & 0x3f;
1924
        pxa2xx_fir_update(s);
1925
        break;
1926
    case ICDR:
1927
        if (s->control[2] & (1 << 2))                        /* TXP */
1928
            ch = value;
1929
        else
1930
            ch = ~value;
1931
        if (s->chr && s->enable && (s->control[0] & (1 << 3)))        /* TXE */
1932
            qemu_chr_write(s->chr, &ch, 1);
1933
        break;
1934
    case ICSR0:
1935
        s->status[0] &= ~(value & 0x66);
1936
        pxa2xx_fir_update(s);
1937
        break;
1938
    case ICFOR:
1939
        break;
1940
    default:
1941
        printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1942
    }
1943
}
1944

    
1945
static CPUReadMemoryFunc * const pxa2xx_fir_readfn[] = {
1946
    pxa2xx_fir_read,
1947
    pxa2xx_fir_read,
1948
    pxa2xx_fir_read,
1949
};
1950

    
1951
static CPUWriteMemoryFunc * const pxa2xx_fir_writefn[] = {
1952
    pxa2xx_fir_write,
1953
    pxa2xx_fir_write,
1954
    pxa2xx_fir_write,
1955
};
1956

    
1957
static int pxa2xx_fir_is_empty(void *opaque)
1958
{
1959
    PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1960
    return (s->rx_len < 64);
1961
}
1962

    
1963
static void pxa2xx_fir_rx(void *opaque, const uint8_t *buf, int size)
1964
{
1965
    PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1966
    if (!(s->control[0] & (1 << 4)))                        /* RXE */
1967
        return;
1968

    
1969
    while (size --) {
1970
        s->status[1] |= 1 << 4;                                /* EOF */
1971
        if (s->rx_len >= 64) {
1972
            s->status[1] |= 1 << 6;                        /* ROR */
1973
            break;
1974
        }
1975

    
1976
        if (s->control[2] & (1 << 3))                        /* RXP */
1977
            s->rx_fifo[(s->rx_start + s->rx_len ++) & 63] = *(buf ++);
1978
        else
1979
            s->rx_fifo[(s->rx_start + s->rx_len ++) & 63] = ~*(buf ++);
1980
    }
1981

    
1982
    pxa2xx_fir_update(s);
1983
}
1984

    
1985
static void pxa2xx_fir_event(void *opaque, int event)
1986
{
1987
}
1988

    
1989
static void pxa2xx_fir_save(QEMUFile *f, void *opaque)
1990
{
1991
    PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1992
    int i;
1993

    
1994
    qemu_put_be32(f, s->enable);
1995

    
1996
    qemu_put_8s(f, &s->control[0]);
1997
    qemu_put_8s(f, &s->control[1]);
1998
    qemu_put_8s(f, &s->control[2]);
1999
    qemu_put_8s(f, &s->status[0]);
2000
    qemu_put_8s(f, &s->status[1]);
2001

    
2002
    qemu_put_byte(f, s->rx_len);
2003
    for (i = 0; i < s->rx_len; i ++)
2004
        qemu_put_byte(f, s->rx_fifo[(s->rx_start + i) & 63]);
2005
}
2006

    
2007
static int pxa2xx_fir_load(QEMUFile *f, void *opaque, int version_id)
2008
{
2009
    PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
2010
    int i;
2011

    
2012
    s->enable = qemu_get_be32(f);
2013

    
2014
    qemu_get_8s(f, &s->control[0]);
2015
    qemu_get_8s(f, &s->control[1]);
2016
    qemu_get_8s(f, &s->control[2]);
2017
    qemu_get_8s(f, &s->status[0]);
2018
    qemu_get_8s(f, &s->status[1]);
2019

    
2020
    s->rx_len = qemu_get_byte(f);
2021
    s->rx_start = 0;
2022
    for (i = 0; i < s->rx_len; i ++)
2023
        s->rx_fifo[i] = qemu_get_byte(f);
2024

    
2025
    return 0;
2026
}
2027

    
2028
static PXA2xxFIrState *pxa2xx_fir_init(target_phys_addr_t base,
2029
                qemu_irq irq, PXA2xxDMAState *dma,
2030
                CharDriverState *chr)
2031
{
2032
    int iomemtype;
2033
    PXA2xxFIrState *s = (PXA2xxFIrState *)
2034
            qemu_mallocz(sizeof(PXA2xxFIrState));
2035

    
2036
    s->irq = irq;
2037
    s->dma = dma;
2038
    s->chr = chr;
2039

    
2040
    pxa2xx_fir_reset(s);
2041

    
2042
    iomemtype = cpu_register_io_memory(pxa2xx_fir_readfn,
2043
                    pxa2xx_fir_writefn, s, DEVICE_NATIVE_ENDIAN);
2044
    cpu_register_physical_memory(base, 0x1000, iomemtype);
2045

    
2046
    if (chr)
2047
        qemu_chr_add_handlers(chr, pxa2xx_fir_is_empty,
2048
                        pxa2xx_fir_rx, pxa2xx_fir_event, s);
2049

    
2050
    register_savevm(NULL, "pxa2xx_fir", 0, 0, pxa2xx_fir_save,
2051
                    pxa2xx_fir_load, s);
2052

    
2053
    return s;
2054
}
2055

    
2056
static void pxa2xx_reset(void *opaque, int line, int level)
2057
{
2058
    PXA2xxState *s = (PXA2xxState *) opaque;
2059

    
2060
    if (level && (s->pm_regs[PCFR >> 2] & 0x10)) {        /* GPR_EN */
2061
        cpu_reset(s->env);
2062
        /* TODO: reset peripherals */
2063
    }
2064
}
2065

    
2066
/* Initialise a PXA270 integrated chip (ARM based core).  */
2067
PXA2xxState *pxa270_init(unsigned int sdram_size, const char *revision)
2068
{
2069
    PXA2xxState *s;
2070
    int iomemtype, i;
2071
    DriveInfo *dinfo;
2072
    s = (PXA2xxState *) qemu_mallocz(sizeof(PXA2xxState));
2073

    
2074
    if (revision && strncmp(revision, "pxa27", 5)) {
2075
        fprintf(stderr, "Machine requires a PXA27x processor.\n");
2076
        exit(1);
2077
    }
2078
    if (!revision)
2079
        revision = "pxa270";
2080
    
2081
    s->env = cpu_init(revision);
2082
    if (!s->env) {
2083
        fprintf(stderr, "Unable to find CPU definition\n");
2084
        exit(1);
2085
    }
2086
    s->reset = qemu_allocate_irqs(pxa2xx_reset, s, 1)[0];
2087

    
2088
    /* SDRAM & Internal Memory Storage */
2089
    cpu_register_physical_memory(PXA2XX_SDRAM_BASE,
2090
                    sdram_size, qemu_ram_alloc(NULL, "pxa270.sdram",
2091
                                               sdram_size) | IO_MEM_RAM);
2092
    cpu_register_physical_memory(PXA2XX_INTERNAL_BASE,
2093
                    0x40000, qemu_ram_alloc(NULL, "pxa270.internal",
2094
                                            0x40000) | IO_MEM_RAM);
2095

    
2096
    s->pic = pxa2xx_pic_init(0x40d00000, s->env);
2097

    
2098
    s->dma = pxa27x_dma_init(0x40000000, s->pic[PXA2XX_PIC_DMA]);
2099

    
2100
    pxa27x_timer_init(0x40a00000, &s->pic[PXA2XX_PIC_OST_0],
2101
                    s->pic[PXA27X_PIC_OST_4_11]);
2102

    
2103
    s->gpio = pxa2xx_gpio_init(0x40e00000, s->env, s->pic, 121);
2104

    
2105
    dinfo = drive_get(IF_SD, 0, 0);
2106
    if (!dinfo) {
2107
        fprintf(stderr, "qemu: missing SecureDigital device\n");
2108
        exit(1);
2109
    }
2110
    s->mmc = pxa2xx_mmci_init(0x41100000, dinfo->bdrv,
2111
                              s->pic[PXA2XX_PIC_MMC], s->dma);
2112

    
2113
    for (i = 0; pxa270_serial[i].io_base; i ++)
2114
        if (serial_hds[i])
2115
#ifdef TARGET_WORDS_BIGENDIAN
2116
            serial_mm_init(pxa270_serial[i].io_base, 2,
2117
                           s->pic[pxa270_serial[i].irqn], 14857000/16,
2118
                           serial_hds[i], 1, 1);
2119
#else
2120
            serial_mm_init(pxa270_serial[i].io_base, 2,
2121
                           s->pic[pxa270_serial[i].irqn], 14857000/16,
2122
                           serial_hds[i], 1, 0);
2123
#endif
2124
        else
2125
            break;
2126
    if (serial_hds[i])
2127
        s->fir = pxa2xx_fir_init(0x40800000, s->pic[PXA2XX_PIC_ICP],
2128
                        s->dma, serial_hds[i]);
2129

    
2130
    s->lcd = pxa2xx_lcdc_init(0x44000000, s->pic[PXA2XX_PIC_LCD]);
2131

    
2132
    s->cm_base = 0x41300000;
2133
    s->cm_regs[CCCR >> 2] = 0x02000210;        /* 416.0 MHz */
2134
    s->clkcfg = 0x00000009;                /* Turbo mode active */
2135
    iomemtype = cpu_register_io_memory(pxa2xx_cm_readfn,
2136
                    pxa2xx_cm_writefn, s, DEVICE_NATIVE_ENDIAN);
2137
    cpu_register_physical_memory(s->cm_base, 0x1000, iomemtype);
2138
    register_savevm(NULL, "pxa2xx_cm", 0, 0, pxa2xx_cm_save, pxa2xx_cm_load, s);
2139

    
2140
    cpu_arm_set_cp_io(s->env, 14, pxa2xx_cp14_read, pxa2xx_cp14_write, s);
2141

    
2142
    s->mm_base = 0x48000000;
2143
    s->mm_regs[MDMRS >> 2] = 0x00020002;
2144
    s->mm_regs[MDREFR >> 2] = 0x03ca4000;
2145
    s->mm_regs[MECR >> 2] = 0x00000001;        /* Two PC Card sockets */
2146
    iomemtype = cpu_register_io_memory(pxa2xx_mm_readfn,
2147
                    pxa2xx_mm_writefn, s, DEVICE_NATIVE_ENDIAN);
2148
    cpu_register_physical_memory(s->mm_base, 0x1000, iomemtype);
2149
    register_savevm(NULL, "pxa2xx_mm", 0, 0, pxa2xx_mm_save, pxa2xx_mm_load, s);
2150

    
2151
    s->pm_base = 0x40f00000;
2152
    iomemtype = cpu_register_io_memory(pxa2xx_pm_readfn,
2153
                    pxa2xx_pm_writefn, s, DEVICE_NATIVE_ENDIAN);
2154
    cpu_register_physical_memory(s->pm_base, 0x100, iomemtype);
2155
    register_savevm(NULL, "pxa2xx_pm", 0, 0, pxa2xx_pm_save, pxa2xx_pm_load, s);
2156

    
2157
    for (i = 0; pxa27x_ssp[i].io_base; i ++);
2158
    s->ssp = (SSIBus **)qemu_mallocz(sizeof(SSIBus *) * i);
2159
    for (i = 0; pxa27x_ssp[i].io_base; i ++) {
2160
        DeviceState *dev;
2161
        dev = sysbus_create_simple("pxa2xx-ssp", pxa27x_ssp[i].io_base,
2162
                                   s->pic[pxa27x_ssp[i].irqn]);
2163
        s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
2164
    }
2165

    
2166
    if (usb_enabled) {
2167
        sysbus_create_simple("sysbus-ohci", 0x4c000000,
2168
                             s->pic[PXA2XX_PIC_USBH1]);
2169
    }
2170

    
2171
    s->pcmcia[0] = pxa2xx_pcmcia_init(0x20000000);
2172
    s->pcmcia[1] = pxa2xx_pcmcia_init(0x30000000);
2173

    
2174
    s->rtc_base = 0x40900000;
2175
    iomemtype = cpu_register_io_memory(pxa2xx_rtc_readfn,
2176
                    pxa2xx_rtc_writefn, s, DEVICE_NATIVE_ENDIAN);
2177
    cpu_register_physical_memory(s->rtc_base, 0x1000, iomemtype);
2178
    pxa2xx_rtc_init(s);
2179
    register_savevm(NULL, "pxa2xx_rtc", 0, 0, pxa2xx_rtc_save,
2180
                    pxa2xx_rtc_load, s);
2181

    
2182
    s->i2c[0] = pxa2xx_i2c_init(0x40301600, s->pic[PXA2XX_PIC_I2C], 0xffff);
2183
    s->i2c[1] = pxa2xx_i2c_init(0x40f00100, s->pic[PXA2XX_PIC_PWRI2C], 0xff);
2184

    
2185
    s->i2s = pxa2xx_i2s_init(0x40400000, s->pic[PXA2XX_PIC_I2S], s->dma);
2186

    
2187
    s->kp = pxa27x_keypad_init(0x41500000, s->pic[PXA2XX_PIC_KEYPAD]);
2188

    
2189
    /* GPIO1 resets the processor */
2190
    /* The handler can be overridden by board-specific code */
2191
    qdev_connect_gpio_out(s->gpio, 1, s->reset);
2192
    return s;
2193
}
2194

    
2195
/* Initialise a PXA255 integrated chip (ARM based core).  */
2196
PXA2xxState *pxa255_init(unsigned int sdram_size)
2197
{
2198
    PXA2xxState *s;
2199
    int iomemtype, i;
2200
    DriveInfo *dinfo;
2201

    
2202
    s = (PXA2xxState *) qemu_mallocz(sizeof(PXA2xxState));
2203

    
2204
    s->env = cpu_init("pxa255");
2205
    if (!s->env) {
2206
        fprintf(stderr, "Unable to find CPU definition\n");
2207
        exit(1);
2208
    }
2209
    s->reset = qemu_allocate_irqs(pxa2xx_reset, s, 1)[0];
2210

    
2211
    /* SDRAM & Internal Memory Storage */
2212
    cpu_register_physical_memory(PXA2XX_SDRAM_BASE, sdram_size,
2213
                    qemu_ram_alloc(NULL, "pxa255.sdram",
2214
                                   sdram_size) | IO_MEM_RAM);
2215
    cpu_register_physical_memory(PXA2XX_INTERNAL_BASE, PXA2XX_INTERNAL_SIZE,
2216
                    qemu_ram_alloc(NULL, "pxa255.internal",
2217
                                   PXA2XX_INTERNAL_SIZE) | IO_MEM_RAM);
2218

    
2219
    s->pic = pxa2xx_pic_init(0x40d00000, s->env);
2220

    
2221
    s->dma = pxa255_dma_init(0x40000000, s->pic[PXA2XX_PIC_DMA]);
2222

    
2223
    pxa25x_timer_init(0x40a00000, &s->pic[PXA2XX_PIC_OST_0]);
2224

    
2225
    s->gpio = pxa2xx_gpio_init(0x40e00000, s->env, s->pic, 85);
2226

    
2227
    dinfo = drive_get(IF_SD, 0, 0);
2228
    if (!dinfo) {
2229
        fprintf(stderr, "qemu: missing SecureDigital device\n");
2230
        exit(1);
2231
    }
2232
    s->mmc = pxa2xx_mmci_init(0x41100000, dinfo->bdrv,
2233
                              s->pic[PXA2XX_PIC_MMC], s->dma);
2234

    
2235
    for (i = 0; pxa255_serial[i].io_base; i ++)
2236
        if (serial_hds[i]) {
2237
#ifdef TARGET_WORDS_BIGENDIAN
2238
            serial_mm_init(pxa255_serial[i].io_base, 2,
2239
                           s->pic[pxa255_serial[i].irqn], 14745600/16,
2240
                           serial_hds[i], 1, 1);
2241
#else
2242
            serial_mm_init(pxa255_serial[i].io_base, 2,
2243
                           s->pic[pxa255_serial[i].irqn], 14745600/16,
2244
                           serial_hds[i], 1, 0);
2245
#endif
2246
        } else {
2247
            break;
2248
        }
2249
    if (serial_hds[i])
2250
        s->fir = pxa2xx_fir_init(0x40800000, s->pic[PXA2XX_PIC_ICP],
2251
                        s->dma, serial_hds[i]);
2252

    
2253
    s->lcd = pxa2xx_lcdc_init(0x44000000, s->pic[PXA2XX_PIC_LCD]);
2254

    
2255
    s->cm_base = 0x41300000;
2256
    s->cm_regs[CCCR >> 2] = 0x02000210;        /* 416.0 MHz */
2257
    s->clkcfg = 0x00000009;                /* Turbo mode active */
2258
    iomemtype = cpu_register_io_memory(pxa2xx_cm_readfn,
2259
                    pxa2xx_cm_writefn, s, DEVICE_NATIVE_ENDIAN);
2260
    cpu_register_physical_memory(s->cm_base, 0x1000, iomemtype);
2261
    register_savevm(NULL, "pxa2xx_cm", 0, 0, pxa2xx_cm_save, pxa2xx_cm_load, s);
2262

    
2263
    cpu_arm_set_cp_io(s->env, 14, pxa2xx_cp14_read, pxa2xx_cp14_write, s);
2264

    
2265
    s->mm_base = 0x48000000;
2266
    s->mm_regs[MDMRS >> 2] = 0x00020002;
2267
    s->mm_regs[MDREFR >> 2] = 0x03ca4000;
2268
    s->mm_regs[MECR >> 2] = 0x00000001;        /* Two PC Card sockets */
2269
    iomemtype = cpu_register_io_memory(pxa2xx_mm_readfn,
2270
                    pxa2xx_mm_writefn, s, DEVICE_NATIVE_ENDIAN);
2271
    cpu_register_physical_memory(s->mm_base, 0x1000, iomemtype);
2272
    register_savevm(NULL, "pxa2xx_mm", 0, 0, pxa2xx_mm_save, pxa2xx_mm_load, s);
2273

    
2274
    s->pm_base = 0x40f00000;
2275
    iomemtype = cpu_register_io_memory(pxa2xx_pm_readfn,
2276
                    pxa2xx_pm_writefn, s, DEVICE_NATIVE_ENDIAN);
2277
    cpu_register_physical_memory(s->pm_base, 0x100, iomemtype);
2278
    register_savevm(NULL, "pxa2xx_pm", 0, 0, pxa2xx_pm_save, pxa2xx_pm_load, s);
2279

    
2280
    for (i = 0; pxa255_ssp[i].io_base; i ++);
2281
    s->ssp = (SSIBus **)qemu_mallocz(sizeof(SSIBus *) * i);
2282
    for (i = 0; pxa255_ssp[i].io_base; i ++) {
2283
        DeviceState *dev;
2284
        dev = sysbus_create_simple("pxa2xx-ssp", pxa255_ssp[i].io_base,
2285
                                   s->pic[pxa255_ssp[i].irqn]);
2286
        s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
2287
    }
2288

    
2289
    if (usb_enabled) {
2290
        sysbus_create_simple("sysbus-ohci", 0x4c000000,
2291
                             s->pic[PXA2XX_PIC_USBH1]);
2292
    }
2293

    
2294
    s->pcmcia[0] = pxa2xx_pcmcia_init(0x20000000);
2295
    s->pcmcia[1] = pxa2xx_pcmcia_init(0x30000000);
2296

    
2297
    s->rtc_base = 0x40900000;
2298
    iomemtype = cpu_register_io_memory(pxa2xx_rtc_readfn,
2299
                    pxa2xx_rtc_writefn, s, DEVICE_NATIVE_ENDIAN);
2300
    cpu_register_physical_memory(s->rtc_base, 0x1000, iomemtype);
2301
    pxa2xx_rtc_init(s);
2302
    register_savevm(NULL, "pxa2xx_rtc", 0, 0, pxa2xx_rtc_save,
2303
                    pxa2xx_rtc_load, s);
2304

    
2305
    s->i2c[0] = pxa2xx_i2c_init(0x40301600, s->pic[PXA2XX_PIC_I2C], 0xffff);
2306
    s->i2c[1] = pxa2xx_i2c_init(0x40f00100, s->pic[PXA2XX_PIC_PWRI2C], 0xff);
2307

    
2308
    s->i2s = pxa2xx_i2s_init(0x40400000, s->pic[PXA2XX_PIC_I2S], s->dma);
2309

    
2310
    /* GPIO1 resets the processor */
2311
    /* The handler can be overridden by board-specific code */
2312
    qdev_connect_gpio_out(s->gpio, 1, s->reset);
2313
    return s;
2314
}
2315

    
2316
static void pxa2xx_register_devices(void)
2317
{
2318
    i2c_register_slave(&pxa2xx_i2c_slave_info);
2319
    sysbus_register_dev("pxa2xx-ssp", sizeof(PXA2xxSSPState), pxa2xx_ssp_init);
2320
    sysbus_register_withprop(&pxa2xx_i2c_info);
2321
}
2322

    
2323
device_init(pxa2xx_register_devices)