musicpal.c 46.5 KB
Newer Older
1 2 3 4 5
/*
 * Marvell MV88W8618 / Freecom MusicPal emulation.
 *
 * Copyright (c) 2008 Jan Kiszka
 *
6
 * This code is licensed under the GNU GPL v2.
7 8 9
 *
 * Contributions after 2012-01-13 are licensed under the terms of the
 * GNU GPL, version 2 or (at your option) any later version.
10 11
 */

P
Paul Brook 已提交
12
#include "sysbus.h"
13 14
#include "arm-misc.h"
#include "devices.h"
P
Paolo Bonzini 已提交
15
#include "net/net.h"
16
#include "sysemu/sysemu.h"
17
#include "boards.h"
G
Gerd Hoffmann 已提交
18
#include "serial.h"
19
#include "qemu/timer.h"
20
#include "ptimer.h"
21
#include "block/block.h"
22
#include "flash.h"
23
#include "ui/console.h"
24
#include "i2c.h"
25
#include "sysemu/blockdev.h"
26
#include "exec/address-spaces.h"
27
#include "ui/pixel_ops.h"
28

29 30 31
#define MP_MISC_BASE            0x80002000
#define MP_MISC_SIZE            0x00001000

32 33 34
#define MP_ETH_BASE             0x80008000
#define MP_ETH_SIZE             0x00001000

35 36 37
#define MP_WLAN_BASE            0x8000C000
#define MP_WLAN_SIZE            0x00000800

38 39 40
#define MP_UART1_BASE           0x8000C840
#define MP_UART2_BASE           0x8000C940

41 42 43
#define MP_GPIO_BASE            0x8000D000
#define MP_GPIO_SIZE            0x00001000

44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64
#define MP_FLASHCFG_BASE        0x90006000
#define MP_FLASHCFG_SIZE        0x00001000

#define MP_AUDIO_BASE           0x90007000

#define MP_PIC_BASE             0x90008000
#define MP_PIC_SIZE             0x00001000

#define MP_PIT_BASE             0x90009000
#define MP_PIT_SIZE             0x00001000

#define MP_LCD_BASE             0x9000c000
#define MP_LCD_SIZE             0x00001000

#define MP_SRAM_BASE            0xC0000000
#define MP_SRAM_SIZE            0x00020000

#define MP_RAM_DEFAULT_SIZE     32*1024*1024
#define MP_FLASH_SIZE_MAX       32*1024*1024

#define MP_TIMER1_IRQ           4
P
Paul Brook 已提交
65 66
#define MP_TIMER2_IRQ           5
#define MP_TIMER3_IRQ           6
67 68 69 70 71 72 73 74 75 76
#define MP_TIMER4_IRQ           7
#define MP_EHCI_IRQ             8
#define MP_ETH_IRQ              9
#define MP_UART1_IRQ            11
#define MP_UART2_IRQ            11
#define MP_GPIO_IRQ             12
#define MP_RTC_IRQ              28
#define MP_AUDIO_IRQ            30

/* Wolfson 8750 I2C address */
77
#define MP_WM_ADDR              0x1A
78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149

/* Ethernet register offsets */
#define MP_ETH_SMIR             0x010
#define MP_ETH_PCXR             0x408
#define MP_ETH_SDCMR            0x448
#define MP_ETH_ICR              0x450
#define MP_ETH_IMR              0x458
#define MP_ETH_FRDP0            0x480
#define MP_ETH_FRDP1            0x484
#define MP_ETH_FRDP2            0x488
#define MP_ETH_FRDP3            0x48C
#define MP_ETH_CRDP0            0x4A0
#define MP_ETH_CRDP1            0x4A4
#define MP_ETH_CRDP2            0x4A8
#define MP_ETH_CRDP3            0x4AC
#define MP_ETH_CTDP0            0x4E0
#define MP_ETH_CTDP1            0x4E4
#define MP_ETH_CTDP2            0x4E8
#define MP_ETH_CTDP3            0x4EC

/* MII PHY access */
#define MP_ETH_SMIR_DATA        0x0000FFFF
#define MP_ETH_SMIR_ADDR        0x03FF0000
#define MP_ETH_SMIR_OPCODE      (1 << 26) /* Read value */
#define MP_ETH_SMIR_RDVALID     (1 << 27)

/* PHY registers */
#define MP_ETH_PHY1_BMSR        0x00210000
#define MP_ETH_PHY1_PHYSID1     0x00410000
#define MP_ETH_PHY1_PHYSID2     0x00610000

#define MP_PHY_BMSR_LINK        0x0004
#define MP_PHY_BMSR_AUTONEG     0x0008

#define MP_PHY_88E3015          0x01410E20

/* TX descriptor status */
#define MP_ETH_TX_OWN           (1 << 31)

/* RX descriptor status */
#define MP_ETH_RX_OWN           (1 << 31)

/* Interrupt cause/mask bits */
#define MP_ETH_IRQ_RX_BIT       0
#define MP_ETH_IRQ_RX           (1 << MP_ETH_IRQ_RX_BIT)
#define MP_ETH_IRQ_TXHI_BIT     2
#define MP_ETH_IRQ_TXLO_BIT     3

/* Port config bits */
#define MP_ETH_PCXR_2BSM_BIT    28 /* 2-byte incoming suffix */

/* SDMA command bits */
#define MP_ETH_CMD_TXHI         (1 << 23)
#define MP_ETH_CMD_TXLO         (1 << 22)

typedef struct mv88w8618_tx_desc {
    uint32_t cmdstat;
    uint16_t res;
    uint16_t bytes;
    uint32_t buffer;
    uint32_t next;
} mv88w8618_tx_desc;

typedef struct mv88w8618_rx_desc {
    uint32_t cmdstat;
    uint16_t bytes;
    uint16_t buffer_size;
    uint32_t buffer;
    uint32_t next;
} mv88w8618_rx_desc;

typedef struct mv88w8618_eth_state {
P
Paul Brook 已提交
150
    SysBusDevice busdev;
151
    MemoryRegion iomem;
152 153 154 155
    qemu_irq irq;
    uint32_t smir;
    uint32_t icr;
    uint32_t imr;
156
    int mmio_index;
157
    uint32_t vlan_header;
P
pbrook 已提交
158 159 160 161
    uint32_t tx_queue[2];
    uint32_t rx_queue[4];
    uint32_t frx_queue[4];
    uint32_t cur_rx[4];
162
    NICState *nic;
163
    NICConf conf;
164 165
} mv88w8618_eth_state;

P
pbrook 已提交
166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185
static void eth_rx_desc_put(uint32_t addr, mv88w8618_rx_desc *desc)
{
    cpu_to_le32s(&desc->cmdstat);
    cpu_to_le16s(&desc->bytes);
    cpu_to_le16s(&desc->buffer_size);
    cpu_to_le32s(&desc->buffer);
    cpu_to_le32s(&desc->next);
    cpu_physical_memory_write(addr, (void *)desc, sizeof(*desc));
}

static void eth_rx_desc_get(uint32_t addr, mv88w8618_rx_desc *desc)
{
    cpu_physical_memory_read(addr, (void *)desc, sizeof(*desc));
    le32_to_cpus(&desc->cmdstat);
    le16_to_cpus(&desc->bytes);
    le16_to_cpus(&desc->buffer_size);
    le32_to_cpus(&desc->buffer);
    le32_to_cpus(&desc->next);
}

186
static int eth_can_receive(NetClientState *nc)
187 188 189 190
{
    return 1;
}

191
static ssize_t eth_receive(NetClientState *nc, const uint8_t *buf, size_t size)
192
{
193
    mv88w8618_eth_state *s = DO_UPCAST(NICState, nc, nc)->opaque;
P
pbrook 已提交
194 195
    uint32_t desc_addr;
    mv88w8618_rx_desc desc;
196 197 198
    int i;

    for (i = 0; i < 4; i++) {
P
pbrook 已提交
199
        desc_addr = s->cur_rx[i];
J
Jan Kiszka 已提交
200
        if (!desc_addr) {
201
            continue;
J
Jan Kiszka 已提交
202
        }
203
        do {
P
pbrook 已提交
204 205 206 207 208 209 210
            eth_rx_desc_get(desc_addr, &desc);
            if ((desc.cmdstat & MP_ETH_RX_OWN) && desc.buffer_size >= size) {
                cpu_physical_memory_write(desc.buffer + s->vlan_header,
                                          buf, size);
                desc.bytes = size + s->vlan_header;
                desc.cmdstat &= ~MP_ETH_RX_OWN;
                s->cur_rx[i] = desc.next;
211 212

                s->icr |= MP_ETH_IRQ_RX;
J
Jan Kiszka 已提交
213
                if (s->icr & s->imr) {
214
                    qemu_irq_raise(s->irq);
J
Jan Kiszka 已提交
215
                }
P
pbrook 已提交
216
                eth_rx_desc_put(desc_addr, &desc);
217
                return size;
218
            }
P
pbrook 已提交
219 220
            desc_addr = desc.next;
        } while (desc_addr != s->rx_queue[i]);
221
    }
222
    return size;
223 224
}

P
pbrook 已提交
225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244
static void eth_tx_desc_put(uint32_t addr, mv88w8618_tx_desc *desc)
{
    cpu_to_le32s(&desc->cmdstat);
    cpu_to_le16s(&desc->res);
    cpu_to_le16s(&desc->bytes);
    cpu_to_le32s(&desc->buffer);
    cpu_to_le32s(&desc->next);
    cpu_physical_memory_write(addr, (void *)desc, sizeof(*desc));
}

static void eth_tx_desc_get(uint32_t addr, mv88w8618_tx_desc *desc)
{
    cpu_physical_memory_read(addr, (void *)desc, sizeof(*desc));
    le32_to_cpus(&desc->cmdstat);
    le16_to_cpus(&desc->res);
    le16_to_cpus(&desc->bytes);
    le32_to_cpus(&desc->buffer);
    le32_to_cpus(&desc->next);
}

245 246
static void eth_send(mv88w8618_eth_state *s, int queue_index)
{
P
pbrook 已提交
247 248
    uint32_t desc_addr = s->tx_queue[queue_index];
    mv88w8618_tx_desc desc;
249
    uint32_t next_desc;
P
pbrook 已提交
250 251 252
    uint8_t buf[2048];
    int len;

253
    do {
P
pbrook 已提交
254
        eth_tx_desc_get(desc_addr, &desc);
255
        next_desc = desc.next;
P
pbrook 已提交
256 257 258 259
        if (desc.cmdstat & MP_ETH_TX_OWN) {
            len = desc.bytes;
            if (len < 2048) {
                cpu_physical_memory_read(desc.buffer, buf, len);
260
                qemu_send_packet(qemu_get_queue(s->nic), buf, len);
P
pbrook 已提交
261 262
            }
            desc.cmdstat &= ~MP_ETH_TX_OWN;
263
            s->icr |= 1 << (MP_ETH_IRQ_TXLO_BIT - queue_index);
P
pbrook 已提交
264
            eth_tx_desc_put(desc_addr, &desc);
265
        }
266
        desc_addr = next_desc;
P
pbrook 已提交
267
    } while (desc_addr != s->tx_queue[queue_index]);
268 269
}

270
static uint64_t mv88w8618_eth_read(void *opaque, hwaddr offset,
271
                                   unsigned size)
272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298
{
    mv88w8618_eth_state *s = opaque;

    switch (offset) {
    case MP_ETH_SMIR:
        if (s->smir & MP_ETH_SMIR_OPCODE) {
            switch (s->smir & MP_ETH_SMIR_ADDR) {
            case MP_ETH_PHY1_BMSR:
                return MP_PHY_BMSR_LINK | MP_PHY_BMSR_AUTONEG |
                       MP_ETH_SMIR_RDVALID;
            case MP_ETH_PHY1_PHYSID1:
                return (MP_PHY_88E3015 >> 16) | MP_ETH_SMIR_RDVALID;
            case MP_ETH_PHY1_PHYSID2:
                return (MP_PHY_88E3015 & 0xFFFF) | MP_ETH_SMIR_RDVALID;
            default:
                return MP_ETH_SMIR_RDVALID;
            }
        }
        return 0;

    case MP_ETH_ICR:
        return s->icr;

    case MP_ETH_IMR:
        return s->imr;

    case MP_ETH_FRDP0 ... MP_ETH_FRDP3:
P
pbrook 已提交
299
        return s->frx_queue[(offset - MP_ETH_FRDP0)/4];
300 301

    case MP_ETH_CRDP0 ... MP_ETH_CRDP3:
P
pbrook 已提交
302
        return s->rx_queue[(offset - MP_ETH_CRDP0)/4];
303 304

    case MP_ETH_CTDP0 ... MP_ETH_CTDP3:
P
pbrook 已提交
305
        return s->tx_queue[(offset - MP_ETH_CTDP0)/4];
306 307 308 309 310 311

    default:
        return 0;
    }
}

312
static void mv88w8618_eth_write(void *opaque, hwaddr offset,
313
                                uint64_t value, unsigned size)
314 315 316 317 318 319 320 321 322 323 324 325 326
{
    mv88w8618_eth_state *s = opaque;

    switch (offset) {
    case MP_ETH_SMIR:
        s->smir = value;
        break;

    case MP_ETH_PCXR:
        s->vlan_header = ((value >> MP_ETH_PCXR_2BSM_BIT) & 1) * 2;
        break;

    case MP_ETH_SDCMR:
J
Jan Kiszka 已提交
327
        if (value & MP_ETH_CMD_TXHI) {
328
            eth_send(s, 1);
J
Jan Kiszka 已提交
329 330
        }
        if (value & MP_ETH_CMD_TXLO) {
331
            eth_send(s, 0);
J
Jan Kiszka 已提交
332 333
        }
        if (value & (MP_ETH_CMD_TXHI | MP_ETH_CMD_TXLO) && s->icr & s->imr) {
334
            qemu_irq_raise(s->irq);
J
Jan Kiszka 已提交
335
        }
336 337 338 339 340 341 342 343
        break;

    case MP_ETH_ICR:
        s->icr &= value;
        break;

    case MP_ETH_IMR:
        s->imr = value;
J
Jan Kiszka 已提交
344
        if (s->icr & s->imr) {
345
            qemu_irq_raise(s->irq);
J
Jan Kiszka 已提交
346
        }
347 348 349
        break;

    case MP_ETH_FRDP0 ... MP_ETH_FRDP3:
P
pbrook 已提交
350
        s->frx_queue[(offset - MP_ETH_FRDP0)/4] = value;
351 352 353 354
        break;

    case MP_ETH_CRDP0 ... MP_ETH_CRDP3:
        s->rx_queue[(offset - MP_ETH_CRDP0)/4] =
P
pbrook 已提交
355
            s->cur_rx[(offset - MP_ETH_CRDP0)/4] = value;
356 357 358
        break;

    case MP_ETH_CTDP0 ... MP_ETH_CTDP3:
P
pbrook 已提交
359
        s->tx_queue[(offset - MP_ETH_CTDP0)/4] = value;
360 361 362 363
        break;
    }
}

364 365 366 367
static const MemoryRegionOps mv88w8618_eth_ops = {
    .read = mv88w8618_eth_read,
    .write = mv88w8618_eth_write,
    .endianness = DEVICE_NATIVE_ENDIAN,
368 369
};

370
static void eth_cleanup(NetClientState *nc)
371
{
372
    mv88w8618_eth_state *s = DO_UPCAST(NICState, nc, nc)->opaque;
373

374
    s->nic = NULL;
375 376
}

377
static NetClientInfo net_mv88w8618_info = {
378
    .type = NET_CLIENT_OPTIONS_KIND_NIC,
379 380 381 382 383 384
    .size = sizeof(NICState),
    .can_receive = eth_can_receive,
    .receive = eth_receive,
    .cleanup = eth_cleanup,
};

385
static int mv88w8618_eth_init(SysBusDevice *dev)
386
{
P
Paul Brook 已提交
387
    mv88w8618_eth_state *s = FROM_SYSBUS(mv88w8618_eth_state, dev);
388

P
Paul Brook 已提交
389
    sysbus_init_irq(dev, &s->irq);
390
    s->nic = qemu_new_nic(&net_mv88w8618_info, &s->conf,
391
                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
392 393
    memory_region_init_io(&s->iomem, &mv88w8618_eth_ops, s, "mv88w8618-eth",
                          MP_ETH_SIZE);
394
    sysbus_init_mmio(dev, &s->iomem);
395
    return 0;
396 397
}

398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415
static const VMStateDescription mv88w8618_eth_vmsd = {
    .name = "mv88w8618_eth",
    .version_id = 1,
    .minimum_version_id = 1,
    .minimum_version_id_old = 1,
    .fields = (VMStateField[]) {
        VMSTATE_UINT32(smir, mv88w8618_eth_state),
        VMSTATE_UINT32(icr, mv88w8618_eth_state),
        VMSTATE_UINT32(imr, mv88w8618_eth_state),
        VMSTATE_UINT32(vlan_header, mv88w8618_eth_state),
        VMSTATE_UINT32_ARRAY(tx_queue, mv88w8618_eth_state, 2),
        VMSTATE_UINT32_ARRAY(rx_queue, mv88w8618_eth_state, 4),
        VMSTATE_UINT32_ARRAY(frx_queue, mv88w8618_eth_state, 4),
        VMSTATE_UINT32_ARRAY(cur_rx, mv88w8618_eth_state, 4),
        VMSTATE_END_OF_LIST()
    }
};

416 417 418 419 420 421 422
static Property mv88w8618_eth_properties[] = {
    DEFINE_NIC_PROPERTIES(mv88w8618_eth_state, conf),
    DEFINE_PROP_END_OF_LIST(),
};

static void mv88w8618_eth_class_init(ObjectClass *klass, void *data)
{
423
    DeviceClass *dc = DEVICE_CLASS(klass);
424 425 426
    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);

    k->init = mv88w8618_eth_init;
427 428
    dc->vmsd = &mv88w8618_eth_vmsd;
    dc->props = mv88w8618_eth_properties;
429 430
}

431
static const TypeInfo mv88w8618_eth_info = {
432 433 434 435
    .name          = "mv88w8618_eth",
    .parent        = TYPE_SYS_BUS_DEVICE,
    .instance_size = sizeof(mv88w8618_eth_state),
    .class_init    = mv88w8618_eth_class_init,
436 437
};

438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457
/* LCD register offsets */
#define MP_LCD_IRQCTRL          0x180
#define MP_LCD_IRQSTAT          0x184
#define MP_LCD_SPICTRL          0x1ac
#define MP_LCD_INST             0x1bc
#define MP_LCD_DATA             0x1c0

/* Mode magics */
#define MP_LCD_SPI_DATA         0x00100011
#define MP_LCD_SPI_CMD          0x00104011
#define MP_LCD_SPI_INVALID      0x00000000

/* Commmands */
#define MP_LCD_INST_SETPAGE0    0xB0
/* ... */
#define MP_LCD_INST_SETPAGE7    0xB7

#define MP_LCD_TEXTCOLOR        0xe0e0ff /* RRGGBB */

typedef struct musicpal_lcd_state {
P
Paul Brook 已提交
458
    SysBusDevice busdev;
459
    MemoryRegion iomem;
460
    uint32_t brightness;
461 462
    uint32_t mode;
    uint32_t irqctrl;
463 464
    uint32_t page;
    uint32_t page_off;
465 466 467 468
    DisplayState *ds;
    uint8_t video_ram[128*64/8];
} musicpal_lcd_state;

469
static uint8_t scale_lcd_color(musicpal_lcd_state *s, uint8_t col)
470
{
471 472 473 474
    switch (s->brightness) {
    case 7:
        return col;
    case 0:
475 476
        return 0;
    default:
477
        return (col * s->brightness) / 7;
478 479 480
    }
}

481 482 483 484 485
#define SET_LCD_PIXEL(depth, type) \
static inline void glue(set_lcd_pixel, depth) \
        (musicpal_lcd_state *s, int x, int y, type col) \
{ \
    int dx, dy; \
486
    type *pixel = &((type *) ds_get_data(s->ds))[(y * 128 * 3 + x) * 3]; \
487 488 489 490
\
    for (dy = 0; dy < 3; dy++, pixel += 127 * 3) \
        for (dx = 0; dx < 3; dx++, pixel++) \
            *pixel = col; \
491
}
492 493 494 495
SET_LCD_PIXEL(8, uint8_t)
SET_LCD_PIXEL(16, uint16_t)
SET_LCD_PIXEL(32, uint32_t)

496 497 498
static void lcd_refresh(void *opaque)
{
    musicpal_lcd_state *s = opaque;
499
    int x, y, col;
500

501
    switch (ds_get_bits_per_pixel(s->ds)) {
502 503 504 505
    case 0:
        return;
#define LCD_REFRESH(depth, func) \
    case depth: \
506 507 508
        col = func(scale_lcd_color(s, (MP_LCD_TEXTCOLOR >> 16) & 0xff), \
                   scale_lcd_color(s, (MP_LCD_TEXTCOLOR >> 8) & 0xff), \
                   scale_lcd_color(s, MP_LCD_TEXTCOLOR & 0xff)); \
J
Jan Kiszka 已提交
509 510 511
        for (x = 0; x < 128; x++) { \
            for (y = 0; y < 64; y++) { \
                if (s->video_ram[x + (y/8)*128] & (1 << (y % 8))) { \
512
                    glue(set_lcd_pixel, depth)(s, x, y, col); \
J
Jan Kiszka 已提交
513
                } else { \
514
                    glue(set_lcd_pixel, depth)(s, x, y, 0); \
J
Jan Kiszka 已提交
515 516 517
                } \
            } \
        } \
518 519 520
        break;
    LCD_REFRESH(8, rgb_to_pixel8)
    LCD_REFRESH(16, rgb_to_pixel16)
521 522
    LCD_REFRESH(32, (is_surface_bgr(s->ds->surface) ?
                     rgb_to_pixel32bgr : rgb_to_pixel32))
523
    default:
524
        hw_error("unsupported colour depth %i\n",
525
                  ds_get_bits_per_pixel(s->ds));
526
    }
527

528
    dpy_gfx_update(s->ds, 0, 0, 128*3, 64*3);
529 530
}

531 532 533 534
static void lcd_invalidate(void *opaque)
{
}

535 536
static void musicpal_lcd_gpio_brigthness_in(void *opaque, int irq, int level)
{
J
Jan Kiszka 已提交
537
    musicpal_lcd_state *s = opaque;
538 539 540 541
    s->brightness &= ~(1 << irq);
    s->brightness |= level << irq;
}

542
static uint64_t musicpal_lcd_read(void *opaque, hwaddr offset,
543
                                  unsigned size)
544 545 546 547 548 549 550 551 552 553 554 555
{
    musicpal_lcd_state *s = opaque;

    switch (offset) {
    case MP_LCD_IRQCTRL:
        return s->irqctrl;

    default:
        return 0;
    }
}

556
static void musicpal_lcd_write(void *opaque, hwaddr offset,
557
                               uint64_t value, unsigned size)
558 559 560 561 562 563 564 565 566
{
    musicpal_lcd_state *s = opaque;

    switch (offset) {
    case MP_LCD_IRQCTRL:
        s->irqctrl = value;
        break;

    case MP_LCD_SPICTRL:
J
Jan Kiszka 已提交
567
        if (value == MP_LCD_SPI_DATA || value == MP_LCD_SPI_CMD) {
568
            s->mode = value;
J
Jan Kiszka 已提交
569
        } else {
570
            s->mode = MP_LCD_SPI_INVALID;
J
Jan Kiszka 已提交
571
        }
572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595
        break;

    case MP_LCD_INST:
        if (value >= MP_LCD_INST_SETPAGE0 && value <= MP_LCD_INST_SETPAGE7) {
            s->page = value - MP_LCD_INST_SETPAGE0;
            s->page_off = 0;
        }
        break;

    case MP_LCD_DATA:
        if (s->mode == MP_LCD_SPI_CMD) {
            if (value >= MP_LCD_INST_SETPAGE0 &&
                value <= MP_LCD_INST_SETPAGE7) {
                s->page = value - MP_LCD_INST_SETPAGE0;
                s->page_off = 0;
            }
        } else if (s->mode == MP_LCD_SPI_DATA) {
            s->video_ram[s->page*128 + s->page_off] = value;
            s->page_off = (s->page_off + 1) & 127;
        }
        break;
    }
}

596 597 598 599
static const MemoryRegionOps musicpal_lcd_ops = {
    .read = musicpal_lcd_read,
    .write = musicpal_lcd_write,
    .endianness = DEVICE_NATIVE_ENDIAN,
600 601
};

602
static int musicpal_lcd_init(SysBusDevice *dev)
603
{
P
Paul Brook 已提交
604
    musicpal_lcd_state *s = FROM_SYSBUS(musicpal_lcd_state, dev);
605

606 607
    s->brightness = 7;

608 609
    memory_region_init_io(&s->iomem, &musicpal_lcd_ops, s,
                          "musicpal-lcd", MP_LCD_SIZE);
610
    sysbus_init_mmio(dev, &s->iomem);
611

612 613 614
    s->ds = graphic_console_init(lcd_refresh, lcd_invalidate,
                                 NULL, NULL, s);
    qemu_console_resize(s->ds, 128*3, 64*3);
615 616

    qdev_init_gpio_in(&dev->qdev, musicpal_lcd_gpio_brigthness_in, 3);
617 618

    return 0;
619 620
}

621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636
static const VMStateDescription musicpal_lcd_vmsd = {
    .name = "musicpal_lcd",
    .version_id = 1,
    .minimum_version_id = 1,
    .minimum_version_id_old = 1,
    .fields = (VMStateField[]) {
        VMSTATE_UINT32(brightness, musicpal_lcd_state),
        VMSTATE_UINT32(mode, musicpal_lcd_state),
        VMSTATE_UINT32(irqctrl, musicpal_lcd_state),
        VMSTATE_UINT32(page, musicpal_lcd_state),
        VMSTATE_UINT32(page_off, musicpal_lcd_state),
        VMSTATE_BUFFER(video_ram, musicpal_lcd_state),
        VMSTATE_END_OF_LIST()
    }
};

637 638
static void musicpal_lcd_class_init(ObjectClass *klass, void *data)
{
639
    DeviceClass *dc = DEVICE_CLASS(klass);
640 641 642
    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);

    k->init = musicpal_lcd_init;
643
    dc->vmsd = &musicpal_lcd_vmsd;
644 645
}

646
static const TypeInfo musicpal_lcd_info = {
647 648 649 650
    .name          = "musicpal_lcd",
    .parent        = TYPE_SYS_BUS_DEVICE,
    .instance_size = sizeof(musicpal_lcd_state),
    .class_init    = musicpal_lcd_class_init,
651 652
};

653 654 655 656 657 658 659
/* PIC register offsets */
#define MP_PIC_STATUS           0x00
#define MP_PIC_ENABLE_SET       0x08
#define MP_PIC_ENABLE_CLR       0x0C

typedef struct mv88w8618_pic_state
{
P
Paul Brook 已提交
660
    SysBusDevice busdev;
661
    MemoryRegion iomem;
662 663 664 665 666 667 668 669 670 671 672 673 674 675
    uint32_t level;
    uint32_t enabled;
    qemu_irq parent_irq;
} mv88w8618_pic_state;

static void mv88w8618_pic_update(mv88w8618_pic_state *s)
{
    qemu_set_irq(s->parent_irq, (s->level & s->enabled));
}

static void mv88w8618_pic_set_irq(void *opaque, int irq, int level)
{
    mv88w8618_pic_state *s = opaque;

J
Jan Kiszka 已提交
676
    if (level) {
677
        s->level |= 1 << irq;
J
Jan Kiszka 已提交
678
    } else {
679
        s->level &= ~(1 << irq);
J
Jan Kiszka 已提交
680
    }
681 682 683
    mv88w8618_pic_update(s);
}

684
static uint64_t mv88w8618_pic_read(void *opaque, hwaddr offset,
685
                                   unsigned size)
686 687 688 689 690 691 692 693 694 695 696 697
{
    mv88w8618_pic_state *s = opaque;

    switch (offset) {
    case MP_PIC_STATUS:
        return s->level & s->enabled;

    default:
        return 0;
    }
}

698
static void mv88w8618_pic_write(void *opaque, hwaddr offset,
699
                                uint64_t value, unsigned size)
700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715
{
    mv88w8618_pic_state *s = opaque;

    switch (offset) {
    case MP_PIC_ENABLE_SET:
        s->enabled |= value;
        break;

    case MP_PIC_ENABLE_CLR:
        s->enabled &= ~value;
        s->level &= ~value;
        break;
    }
    mv88w8618_pic_update(s);
}

716
static void mv88w8618_pic_reset(DeviceState *d)
717
{
718
    mv88w8618_pic_state *s = FROM_SYSBUS(mv88w8618_pic_state,
719
                                         SYS_BUS_DEVICE(d));
720 721 722 723 724

    s->level = 0;
    s->enabled = 0;
}

725 726 727 728
static const MemoryRegionOps mv88w8618_pic_ops = {
    .read = mv88w8618_pic_read,
    .write = mv88w8618_pic_write,
    .endianness = DEVICE_NATIVE_ENDIAN,
729 730
};

731
static int mv88w8618_pic_init(SysBusDevice *dev)
732
{
P
Paul Brook 已提交
733
    mv88w8618_pic_state *s = FROM_SYSBUS(mv88w8618_pic_state, dev);
734

735
    qdev_init_gpio_in(&dev->qdev, mv88w8618_pic_set_irq, 32);
P
Paul Brook 已提交
736
    sysbus_init_irq(dev, &s->parent_irq);
737 738
    memory_region_init_io(&s->iomem, &mv88w8618_pic_ops, s,
                          "musicpal-pic", MP_PIC_SIZE);
739
    sysbus_init_mmio(dev, &s->iomem);
740
    return 0;
741 742
}

743 744 745 746 747 748 749 750 751 752 753 754
static const VMStateDescription mv88w8618_pic_vmsd = {
    .name = "mv88w8618_pic",
    .version_id = 1,
    .minimum_version_id = 1,
    .minimum_version_id_old = 1,
    .fields = (VMStateField[]) {
        VMSTATE_UINT32(level, mv88w8618_pic_state),
        VMSTATE_UINT32(enabled, mv88w8618_pic_state),
        VMSTATE_END_OF_LIST()
    }
};

755 756
static void mv88w8618_pic_class_init(ObjectClass *klass, void *data)
{
757
    DeviceClass *dc = DEVICE_CLASS(klass);
758 759 760
    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);

    k->init = mv88w8618_pic_init;
761 762
    dc->reset = mv88w8618_pic_reset;
    dc->vmsd = &mv88w8618_pic_vmsd;
763 764
}

765
static const TypeInfo mv88w8618_pic_info = {
766 767 768 769
    .name          = "mv88w8618_pic",
    .parent        = TYPE_SYS_BUS_DEVICE,
    .instance_size = sizeof(mv88w8618_pic_state),
    .class_init    = mv88w8618_pic_class_init,
770 771
};

772 773 774 775 776 777 778 779 780 781 782 783 784 785
/* PIT register offsets */
#define MP_PIT_TIMER1_LENGTH    0x00
/* ... */
#define MP_PIT_TIMER4_LENGTH    0x0C
#define MP_PIT_CONTROL          0x10
#define MP_PIT_TIMER1_VALUE     0x14
/* ... */
#define MP_PIT_TIMER4_VALUE     0x20
#define MP_BOARD_RESET          0x34

/* Magic board reset value (probably some watchdog behind it) */
#define MP_BOARD_RESET_MAGIC    0x10000

typedef struct mv88w8618_timer_state {
P
Paul Brook 已提交
786
    ptimer_state *ptimer;
787 788 789 790 791 792
    uint32_t limit;
    int freq;
    qemu_irq irq;
} mv88w8618_timer_state;

typedef struct mv88w8618_pit_state {
P
Paul Brook 已提交
793
    SysBusDevice busdev;
794
    MemoryRegion iomem;
P
Paul Brook 已提交
795
    mv88w8618_timer_state timer[4];
796 797 798 799 800 801 802 803 804
} mv88w8618_pit_state;

static void mv88w8618_timer_tick(void *opaque)
{
    mv88w8618_timer_state *s = opaque;

    qemu_irq_raise(s->irq);
}

P
Paul Brook 已提交
805 806
static void mv88w8618_timer_init(SysBusDevice *dev, mv88w8618_timer_state *s,
                                 uint32_t freq)
807 808 809
{
    QEMUBH *bh;

P
Paul Brook 已提交
810
    sysbus_init_irq(dev, &s->irq);
811 812 813
    s->freq = freq;

    bh = qemu_bh_new(mv88w8618_timer_tick, s);
P
Paul Brook 已提交
814
    s->ptimer = ptimer_init(bh);
815 816
}

817
static uint64_t mv88w8618_pit_read(void *opaque, hwaddr offset,
818
                                   unsigned size)
819 820 821 822 823 824
{
    mv88w8618_pit_state *s = opaque;
    mv88w8618_timer_state *t;

    switch (offset) {
    case MP_PIT_TIMER1_VALUE ... MP_PIT_TIMER4_VALUE:
P
Paul Brook 已提交
825 826
        t = &s->timer[(offset-MP_PIT_TIMER1_VALUE) >> 2];
        return ptimer_get_count(t->ptimer);
827 828 829 830 831 832

    default:
        return 0;
    }
}

833
static void mv88w8618_pit_write(void *opaque, hwaddr offset,
834
                                uint64_t value, unsigned size)
835 836 837 838 839 840 841
{
    mv88w8618_pit_state *s = opaque;
    mv88w8618_timer_state *t;
    int i;

    switch (offset) {
    case MP_PIT_TIMER1_LENGTH ... MP_PIT_TIMER4_LENGTH:
P
Paul Brook 已提交
842
        t = &s->timer[offset >> 2];
843
        t->limit = value;
844 845 846 847 848
        if (t->limit > 0) {
            ptimer_set_limit(t->ptimer, t->limit, 1);
        } else {
            ptimer_stop(t->ptimer);
        }
849 850 851 852
        break;

    case MP_PIT_CONTROL:
        for (i = 0; i < 4; i++) {
853 854
            t = &s->timer[i];
            if (value & 0xf && t->limit > 0) {
P
Paul Brook 已提交
855 856 857
                ptimer_set_limit(t->ptimer, t->limit, 0);
                ptimer_set_freq(t->ptimer, t->freq);
                ptimer_run(t->ptimer, 0);
858 859
            } else {
                ptimer_stop(t->ptimer);
860 861 862 863 864 865
            }
            value >>= 4;
        }
        break;

    case MP_BOARD_RESET:
J
Jan Kiszka 已提交
866
        if (value == MP_BOARD_RESET_MAGIC) {
867
            qemu_system_reset_request();
J
Jan Kiszka 已提交
868
        }
869 870 871 872
        break;
    }
}

873
static void mv88w8618_pit_reset(DeviceState *d)
874
{
875
    mv88w8618_pit_state *s = FROM_SYSBUS(mv88w8618_pit_state,
876
                                         SYS_BUS_DEVICE(d));
877 878 879 880 881 882 883 884
    int i;

    for (i = 0; i < 4; i++) {
        ptimer_stop(s->timer[i].ptimer);
        s->timer[i].limit = 0;
    }
}

885 886 887 888
static const MemoryRegionOps mv88w8618_pit_ops = {
    .read = mv88w8618_pit_read,
    .write = mv88w8618_pit_write,
    .endianness = DEVICE_NATIVE_ENDIAN,
889 890
};

891
static int mv88w8618_pit_init(SysBusDevice *dev)
892
{
P
Paul Brook 已提交
893 894
    mv88w8618_pit_state *s = FROM_SYSBUS(mv88w8618_pit_state, dev);
    int i;
895 896 897

    /* Letting them all run at 1 MHz is likely just a pragmatic
     * simplification. */
P
Paul Brook 已提交
898 899 900
    for (i = 0; i < 4; i++) {
        mv88w8618_timer_init(dev, &s->timer[i], 1000000);
    }
901

902 903
    memory_region_init_io(&s->iomem, &mv88w8618_pit_ops, s,
                          "musicpal-pit", MP_PIT_SIZE);
904
    sysbus_init_mmio(dev, &s->iomem);
905
    return 0;
906 907
}

908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931
static const VMStateDescription mv88w8618_timer_vmsd = {
    .name = "timer",
    .version_id = 1,
    .minimum_version_id = 1,
    .minimum_version_id_old = 1,
    .fields = (VMStateField[]) {
        VMSTATE_PTIMER(ptimer, mv88w8618_timer_state),
        VMSTATE_UINT32(limit, mv88w8618_timer_state),
        VMSTATE_END_OF_LIST()
    }
};

static const VMStateDescription mv88w8618_pit_vmsd = {
    .name = "mv88w8618_pit",
    .version_id = 1,
    .minimum_version_id = 1,
    .minimum_version_id_old = 1,
    .fields = (VMStateField[]) {
        VMSTATE_STRUCT_ARRAY(timer, mv88w8618_pit_state, 4, 1,
                             mv88w8618_timer_vmsd, mv88w8618_timer_state),
        VMSTATE_END_OF_LIST()
    }
};

932 933
static void mv88w8618_pit_class_init(ObjectClass *klass, void *data)
{
934
    DeviceClass *dc = DEVICE_CLASS(klass);
935 936 937
    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);

    k->init = mv88w8618_pit_init;
938 939
    dc->reset = mv88w8618_pit_reset;
    dc->vmsd = &mv88w8618_pit_vmsd;
940 941
}

942
static const TypeInfo mv88w8618_pit_info = {
943 944 945 946
    .name          = "mv88w8618_pit",
    .parent        = TYPE_SYS_BUS_DEVICE,
    .instance_size = sizeof(mv88w8618_pit_state),
    .class_init    = mv88w8618_pit_class_init,
947 948
};

949 950 951 952
/* Flash config register offsets */
#define MP_FLASHCFG_CFGR0    0x04

typedef struct mv88w8618_flashcfg_state {
P
Paul Brook 已提交
953
    SysBusDevice busdev;
954
    MemoryRegion iomem;
955 956 957
    uint32_t cfgr0;
} mv88w8618_flashcfg_state;

958
static uint64_t mv88w8618_flashcfg_read(void *opaque,
959
                                        hwaddr offset,
960
                                        unsigned size)
961 962 963 964 965 966 967 968 969 970 971 972
{
    mv88w8618_flashcfg_state *s = opaque;

    switch (offset) {
    case MP_FLASHCFG_CFGR0:
        return s->cfgr0;

    default:
        return 0;
    }
}

973
static void mv88w8618_flashcfg_write(void *opaque, hwaddr offset,
974
                                     uint64_t value, unsigned size)
975 976 977 978 979 980 981 982 983 984
{
    mv88w8618_flashcfg_state *s = opaque;

    switch (offset) {
    case MP_FLASHCFG_CFGR0:
        s->cfgr0 = value;
        break;
    }
}

985 986 987 988
static const MemoryRegionOps mv88w8618_flashcfg_ops = {
    .read = mv88w8618_flashcfg_read,
    .write = mv88w8618_flashcfg_write,
    .endianness = DEVICE_NATIVE_ENDIAN,
989 990
};

991
static int mv88w8618_flashcfg_init(SysBusDevice *dev)
992
{
P
Paul Brook 已提交
993
    mv88w8618_flashcfg_state *s = FROM_SYSBUS(mv88w8618_flashcfg_state, dev);
994 995

    s->cfgr0 = 0xfffe4285; /* Default as set by U-Boot for 8 MB flash */
996 997
    memory_region_init_io(&s->iomem, &mv88w8618_flashcfg_ops, s,
                          "musicpal-flashcfg", MP_FLASHCFG_SIZE);
998
    sysbus_init_mmio(dev, &s->iomem);
999
    return 0;
1000 1001
}

1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012
static const VMStateDescription mv88w8618_flashcfg_vmsd = {
    .name = "mv88w8618_flashcfg",
    .version_id = 1,
    .minimum_version_id = 1,
    .minimum_version_id_old = 1,
    .fields = (VMStateField[]) {
        VMSTATE_UINT32(cfgr0, mv88w8618_flashcfg_state),
        VMSTATE_END_OF_LIST()
    }
};

1013 1014
static void mv88w8618_flashcfg_class_init(ObjectClass *klass, void *data)
{
1015
    DeviceClass *dc = DEVICE_CLASS(klass);
1016 1017 1018
    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);

    k->init = mv88w8618_flashcfg_init;
1019
    dc->vmsd = &mv88w8618_flashcfg_vmsd;
1020 1021
}

1022
static const TypeInfo mv88w8618_flashcfg_info = {
1023 1024 1025 1026
    .name          = "mv88w8618_flashcfg",
    .parent        = TYPE_SYS_BUS_DEVICE,
    .instance_size = sizeof(mv88w8618_flashcfg_state),
    .class_init    = mv88w8618_flashcfg_class_init,
1027 1028
};

1029 1030 1031 1032 1033
/* Misc register offsets */
#define MP_MISC_BOARD_REVISION  0x18

#define MP_BOARD_REVISION       0x31

1034
static uint64_t musicpal_misc_read(void *opaque, hwaddr offset,
1035
                                   unsigned size)
1036 1037 1038 1039 1040 1041 1042 1043 1044 1045
{
    switch (offset) {
    case MP_MISC_BOARD_REVISION:
        return MP_BOARD_REVISION;

    default:
        return 0;
    }
}

1046
static void musicpal_misc_write(void *opaque, hwaddr offset,
1047
                                uint64_t value, unsigned size)
1048 1049 1050
{
}

1051 1052 1053 1054
static const MemoryRegionOps musicpal_misc_ops = {
    .read = musicpal_misc_read,
    .write = musicpal_misc_write,
    .endianness = DEVICE_NATIVE_ENDIAN,
1055 1056
};

1057
static void musicpal_misc_init(SysBusDevice *dev)
1058
{
1059
    MemoryRegion *iomem = g_new(MemoryRegion, 1);
1060

1061 1062 1063
    memory_region_init_io(iomem, &musicpal_misc_ops, NULL,
                          "musicpal-misc", MP_MISC_SIZE);
    sysbus_add_memory(dev, MP_MISC_BASE, iomem);
1064 1065 1066 1067 1068 1069
}

/* WLAN register offsets */
#define MP_WLAN_MAGIC1          0x11c
#define MP_WLAN_MAGIC2          0x124

1070
static uint64_t mv88w8618_wlan_read(void *opaque, hwaddr offset,
1071
                                    unsigned size)
1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085
{
    switch (offset) {
    /* Workaround to allow loading the binary-only wlandrv.ko crap
     * from the original Freecom firmware. */
    case MP_WLAN_MAGIC1:
        return ~3;
    case MP_WLAN_MAGIC2:
        return -1;

    default:
        return 0;
    }
}

1086
static void mv88w8618_wlan_write(void *opaque, hwaddr offset,
1087
                                 uint64_t value, unsigned size)
1088 1089 1090
{
}

1091 1092 1093 1094
static const MemoryRegionOps mv88w8618_wlan_ops = {
    .read = mv88w8618_wlan_read,
    .write =mv88w8618_wlan_write,
    .endianness = DEVICE_NATIVE_ENDIAN,
1095 1096
};

1097
static int mv88w8618_wlan_init(SysBusDevice *dev)
1098
{
1099
    MemoryRegion *iomem = g_new(MemoryRegion, 1);
1100

1101 1102
    memory_region_init_io(iomem, &mv88w8618_wlan_ops, NULL,
                          "musicpal-wlan", MP_WLAN_SIZE);
1103
    sysbus_init_mmio(dev, iomem);
1104
    return 0;
1105
}
1106

1107 1108 1109 1110
/* GPIO register offsets */
#define MP_GPIO_OE_LO           0x008
#define MP_GPIO_OUT_LO          0x00c
#define MP_GPIO_IN_LO           0x010
1111 1112
#define MP_GPIO_IER_LO          0x014
#define MP_GPIO_IMR_LO          0x018
1113 1114 1115 1116
#define MP_GPIO_ISR_LO          0x020
#define MP_GPIO_OE_HI           0x508
#define MP_GPIO_OUT_HI          0x50c
#define MP_GPIO_IN_HI           0x510
1117 1118
#define MP_GPIO_IER_HI          0x514
#define MP_GPIO_IMR_HI          0x518
1119
#define MP_GPIO_ISR_HI          0x520
1120 1121 1122 1123 1124 1125 1126 1127 1128

/* GPIO bits & masks */
#define MP_GPIO_LCD_BRIGHTNESS  0x00070000
#define MP_GPIO_I2C_DATA_BIT    29
#define MP_GPIO_I2C_CLOCK_BIT   30

/* LCD brightness bits in GPIO_OE_HI */
#define MP_OE_LCD_BRIGHTNESS    0x0007

1129 1130
typedef struct musicpal_gpio_state {
    SysBusDevice busdev;
1131
    MemoryRegion iomem;
1132 1133 1134
    uint32_t lcd_brightness;
    uint32_t out_state;
    uint32_t in_state;
1135 1136
    uint32_t ier;
    uint32_t imr;
1137 1138
    uint32_t isr;
    qemu_irq irq;
1139
    qemu_irq out[5]; /* 3 brightness out + 2 lcd (data and clock ) */
1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181
} musicpal_gpio_state;

static void musicpal_gpio_brightness_update(musicpal_gpio_state *s) {
    int i;
    uint32_t brightness;

    /* compute brightness ratio */
    switch (s->lcd_brightness) {
    case 0x00000007:
        brightness = 0;
        break;

    case 0x00020000:
        brightness = 1;
        break;

    case 0x00020001:
        brightness = 2;
        break;

    case 0x00040000:
        brightness = 3;
        break;

    case 0x00010006:
        brightness = 4;
        break;

    case 0x00020005:
        brightness = 5;
        break;

    case 0x00040003:
        brightness = 6;
        break;

    case 0x00030004:
    default:
        brightness = 7;
    }

    /* set lcd brightness GPIOs  */
J
Jan Kiszka 已提交
1182
    for (i = 0; i <= 2; i++) {
1183
        qemu_set_irq(s->out[i], (brightness >> i) & 1);
J
Jan Kiszka 已提交
1184
    }
1185 1186
}

1187
static void musicpal_gpio_pin_event(void *opaque, int pin, int level)
1188
{
J
Jan Kiszka 已提交
1189
    musicpal_gpio_state *s = opaque;
1190 1191 1192
    uint32_t mask = 1 << pin;
    uint32_t delta = level << pin;
    uint32_t old = s->in_state & mask;
1193

1194 1195
    s->in_state &= ~mask;
    s->in_state |= delta;
1196

1197 1198 1199 1200
    if ((old ^ delta) &&
        ((level && (s->imr & mask)) || (!level && (s->ier & mask)))) {
        s->isr = mask;
        qemu_irq_raise(s->irq);
1201 1202 1203
    }
}

1204
static uint64_t musicpal_gpio_read(void *opaque, hwaddr offset,
1205
                                   unsigned size)
1206
{
J
Jan Kiszka 已提交
1207
    musicpal_gpio_state *s = opaque;
1208

1209 1210
    switch (offset) {
    case MP_GPIO_OE_HI: /* used for LCD brightness control */
1211
        return s->lcd_brightness & MP_OE_LCD_BRIGHTNESS;
1212 1213

    case MP_GPIO_OUT_LO:
1214
        return s->out_state & 0xFFFF;
1215
    case MP_GPIO_OUT_HI:
1216
        return s->out_state >> 16;
1217 1218

    case MP_GPIO_IN_LO:
1219
        return s->in_state & 0xFFFF;
1220
    case MP_GPIO_IN_HI:
1221
        return s->in_state >> 16;
1222

1223 1224 1225 1226 1227 1228 1229 1230 1231 1232
    case MP_GPIO_IER_LO:
        return s->ier & 0xFFFF;
    case MP_GPIO_IER_HI:
        return s->ier >> 16;

    case MP_GPIO_IMR_LO:
        return s->imr & 0xFFFF;
    case MP_GPIO_IMR_HI:
        return s->imr >> 16;

1233
    case MP_GPIO_ISR_LO:
1234
        return s->isr & 0xFFFF;
1235
    case MP_GPIO_ISR_HI:
1236
        return s->isr >> 16;
1237 1238 1239 1240 1241 1242

    default:
        return 0;
    }
}

1243
static void musicpal_gpio_write(void *opaque, hwaddr offset,
1244
                                uint64_t value, unsigned size)
1245
{
J
Jan Kiszka 已提交
1246
    musicpal_gpio_state *s = opaque;
1247 1248
    switch (offset) {
    case MP_GPIO_OE_HI: /* used for LCD brightness control */
1249
        s->lcd_brightness = (s->lcd_brightness & MP_GPIO_LCD_BRIGHTNESS) |
1250
                         (value & MP_OE_LCD_BRIGHTNESS);
1251
        musicpal_gpio_brightness_update(s);
1252 1253 1254
        break;

    case MP_GPIO_OUT_LO:
1255
        s->out_state = (s->out_state & 0xFFFF0000) | (value & 0xFFFF);
1256 1257
        break;
    case MP_GPIO_OUT_HI:
1258 1259 1260 1261
        s->out_state = (s->out_state & 0xFFFF) | (value << 16);
        s->lcd_brightness = (s->lcd_brightness & 0xFFFF) |
                            (s->out_state & MP_GPIO_LCD_BRIGHTNESS);
        musicpal_gpio_brightness_update(s);
1262 1263
        qemu_set_irq(s->out[3], (s->out_state >> MP_GPIO_I2C_DATA_BIT) & 1);
        qemu_set_irq(s->out[4], (s->out_state >> MP_GPIO_I2C_CLOCK_BIT) & 1);
1264 1265
        break;

1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278
    case MP_GPIO_IER_LO:
        s->ier = (s->ier & 0xFFFF0000) | (value & 0xFFFF);
        break;
    case MP_GPIO_IER_HI:
        s->ier = (s->ier & 0xFFFF) | (value << 16);
        break;

    case MP_GPIO_IMR_LO:
        s->imr = (s->imr & 0xFFFF0000) | (value & 0xFFFF);
        break;
    case MP_GPIO_IMR_HI:
        s->imr = (s->imr & 0xFFFF) | (value << 16);
        break;
1279 1280 1281
    }
}

1282 1283 1284 1285
static const MemoryRegionOps musicpal_gpio_ops = {
    .read = musicpal_gpio_read,
    .write = musicpal_gpio_write,
    .endianness = DEVICE_NATIVE_ENDIAN,
1286 1287
};

1288
static void musicpal_gpio_reset(DeviceState *d)
1289
{
1290
    musicpal_gpio_state *s = FROM_SYSBUS(musicpal_gpio_state,
1291
                                         SYS_BUS_DEVICE(d));
1292 1293 1294

    s->lcd_brightness = 0;
    s->out_state = 0;
1295
    s->in_state = 0xffffffff;
1296 1297
    s->ier = 0;
    s->imr = 0;
1298 1299 1300
    s->isr = 0;
}

1301
static int musicpal_gpio_init(SysBusDevice *dev)
1302 1303
{
    musicpal_gpio_state *s = FROM_SYSBUS(musicpal_gpio_state, dev);
1304

1305 1306
    sysbus_init_irq(dev, &s->irq);

1307 1308
    memory_region_init_io(&s->iomem, &musicpal_gpio_ops, s,
                          "musicpal-gpio", MP_GPIO_SIZE);
1309
    sysbus_init_mmio(dev, &s->iomem);
1310

1311 1312 1313
    qdev_init_gpio_out(&dev->qdev, s->out, ARRAY_SIZE(s->out));

    qdev_init_gpio_in(&dev->qdev, musicpal_gpio_pin_event, 32);
1314 1315

    return 0;
1316 1317
}

1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333
static const VMStateDescription musicpal_gpio_vmsd = {
    .name = "musicpal_gpio",
    .version_id = 1,
    .minimum_version_id = 1,
    .minimum_version_id_old = 1,
    .fields = (VMStateField[]) {
        VMSTATE_UINT32(lcd_brightness, musicpal_gpio_state),
        VMSTATE_UINT32(out_state, musicpal_gpio_state),
        VMSTATE_UINT32(in_state, musicpal_gpio_state),
        VMSTATE_UINT32(ier, musicpal_gpio_state),
        VMSTATE_UINT32(imr, musicpal_gpio_state),
        VMSTATE_UINT32(isr, musicpal_gpio_state),
        VMSTATE_END_OF_LIST()
    }
};

1334 1335
static void musicpal_gpio_class_init(ObjectClass *klass, void *data)
{
1336
    DeviceClass *dc = DEVICE_CLASS(klass);
1337 1338 1339
    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);

    k->init = musicpal_gpio_init;
1340 1341
    dc->reset = musicpal_gpio_reset;
    dc->vmsd = &musicpal_gpio_vmsd;
1342 1343
}

1344
static const TypeInfo musicpal_gpio_info = {
1345 1346 1347 1348
    .name          = "musicpal_gpio",
    .parent        = TYPE_SYS_BUS_DEVICE,
    .instance_size = sizeof(musicpal_gpio_state),
    .class_init    = musicpal_gpio_class_init,
1349 1350
};

1351
/* Keyboard codes & masks */
1352
#define KEY_RELEASED            0x80
1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365
#define KEY_CODE                0x7f

#define KEYCODE_TAB             0x0f
#define KEYCODE_ENTER           0x1c
#define KEYCODE_F               0x21
#define KEYCODE_M               0x32

#define KEYCODE_EXTENDED        0xe0
#define KEYCODE_UP              0x48
#define KEYCODE_DOWN            0x50
#define KEYCODE_LEFT            0x4b
#define KEYCODE_RIGHT           0x4d

1366
#define MP_KEY_WHEEL_VOL       (1 << 0)
1367 1368 1369 1370 1371 1372 1373 1374 1375 1376
#define MP_KEY_WHEEL_VOL_INV   (1 << 1)
#define MP_KEY_WHEEL_NAV       (1 << 2)
#define MP_KEY_WHEEL_NAV_INV   (1 << 3)
#define MP_KEY_BTN_FAVORITS    (1 << 4)
#define MP_KEY_BTN_MENU        (1 << 5)
#define MP_KEY_BTN_VOLUME      (1 << 6)
#define MP_KEY_BTN_NAVIGATION  (1 << 7)

typedef struct musicpal_key_state {
    SysBusDevice busdev;
1377
    MemoryRegion iomem;
1378
    uint32_t kbd_extended;
1379 1380
    uint32_t pressed_keys;
    qemu_irq out[8];
1381 1382
} musicpal_key_state;

1383 1384
static void musicpal_key_event(void *opaque, int keycode)
{
J
Jan Kiszka 已提交
1385
    musicpal_key_state *s = opaque;
1386
    uint32_t event = 0;
1387
    int i;
1388 1389

    if (keycode == KEYCODE_EXTENDED) {
1390
        s->kbd_extended = 1;
1391 1392 1393
        return;
    }

J
Jan Kiszka 已提交
1394
    if (s->kbd_extended) {
1395 1396
        switch (keycode & KEY_CODE) {
        case KEYCODE_UP:
1397
            event = MP_KEY_WHEEL_NAV | MP_KEY_WHEEL_NAV_INV;
1398 1399 1400
            break;

        case KEYCODE_DOWN:
1401
            event = MP_KEY_WHEEL_NAV;
1402 1403 1404
            break;

        case KEYCODE_LEFT:
1405
            event = MP_KEY_WHEEL_VOL | MP_KEY_WHEEL_VOL_INV;
1406 1407 1408
            break;

        case KEYCODE_RIGHT:
1409
            event = MP_KEY_WHEEL_VOL;
1410 1411
            break;
        }
J
Jan Kiszka 已提交
1412
    } else {
1413 1414
        switch (keycode & KEY_CODE) {
        case KEYCODE_F:
1415
            event = MP_KEY_BTN_FAVORITS;
1416 1417 1418
            break;

        case KEYCODE_TAB:
1419
            event = MP_KEY_BTN_VOLUME;
1420 1421 1422
            break;

        case KEYCODE_ENTER:
1423
            event = MP_KEY_BTN_NAVIGATION;
1424 1425 1426
            break;

        case KEYCODE_M:
1427
            event = MP_KEY_BTN_MENU;
1428 1429
            break;
        }
1430
        /* Do not repeat already pressed buttons */
1431
        if (!(keycode & KEY_RELEASED) && (s->pressed_keys & event)) {
1432
            event = 0;
1433
        }
1434
    }
1435

1436
    if (event) {
1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449
        /* Raise GPIO pin first if repeating a key */
        if (!(keycode & KEY_RELEASED) && (s->pressed_keys & event)) {
            for (i = 0; i <= 7; i++) {
                if (event & (1 << i)) {
                    qemu_set_irq(s->out[i], 1);
                }
            }
        }
        for (i = 0; i <= 7; i++) {
            if (event & (1 << i)) {
                qemu_set_irq(s->out[i], !!(keycode & KEY_RELEASED));
            }
        }
1450
        if (keycode & KEY_RELEASED) {
1451
            s->pressed_keys &= ~event;
1452
        } else {
1453
            s->pressed_keys |= event;
1454
        }
1455 1456
    }

1457 1458 1459
    s->kbd_extended = 0;
}

1460
static int musicpal_key_init(SysBusDevice *dev)
1461 1462 1463
{
    musicpal_key_state *s = FROM_SYSBUS(musicpal_key_state, dev);

1464
    memory_region_init(&s->iomem, "dummy", 0);
1465
    sysbus_init_mmio(dev, &s->iomem);
1466 1467

    s->kbd_extended = 0;
1468
    s->pressed_keys = 0;
1469

1470
    qdev_init_gpio_out(&dev->qdev, s->out, ARRAY_SIZE(s->out));
1471 1472

    qemu_add_kbd_event_handler(musicpal_key_event, s);
1473 1474

    return 0;
1475 1476
}

1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488
static const VMStateDescription musicpal_key_vmsd = {
    .name = "musicpal_key",
    .version_id = 1,
    .minimum_version_id = 1,
    .minimum_version_id_old = 1,
    .fields = (VMStateField[]) {
        VMSTATE_UINT32(kbd_extended, musicpal_key_state),
        VMSTATE_UINT32(pressed_keys, musicpal_key_state),
        VMSTATE_END_OF_LIST()
    }
};

1489 1490
static void musicpal_key_class_init(ObjectClass *klass, void *data)
{
1491
    DeviceClass *dc = DEVICE_CLASS(klass);
1492 1493 1494
    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);

    k->init = musicpal_key_init;
1495
    dc->vmsd = &musicpal_key_vmsd;
1496 1497
}

1498
static const TypeInfo musicpal_key_info = {
1499 1500 1501 1502
    .name          = "musicpal_key",
    .parent        = TYPE_SYS_BUS_DEVICE,
    .instance_size = sizeof(musicpal_key_state),
    .class_init    = musicpal_key_class_init,
1503 1504
};

1505 1506 1507 1508 1509
static struct arm_boot_info musicpal_binfo = {
    .loader_start = 0x0,
    .board_id = 0x20e,
};

1510
static void musicpal_init(QEMUMachineInitArgs *args)
1511
{
1512 1513 1514 1515
    const char *cpu_model = args->cpu_model;
    const char *kernel_filename = args->kernel_filename;
    const char *kernel_cmdline = args->kernel_cmdline;
    const char *initrd_filename = args->initrd_filename;
1516
    ARMCPU *cpu;
P
Paul Brook 已提交
1517 1518 1519
    qemu_irq *cpu_pic;
    qemu_irq pic[32];
    DeviceState *dev;
1520
    DeviceState *i2c_dev;
1521 1522
    DeviceState *lcd_dev;
    DeviceState *key_dev;
1523 1524 1525
    DeviceState *wm8750_dev;
    SysBusDevice *s;
    i2c_bus *i2c;
P
Paul Brook 已提交
1526
    int i;
1527
    unsigned long flash_size;
G
Gerd Hoffmann 已提交
1528
    DriveInfo *dinfo;
1529 1530 1531
    MemoryRegion *address_space_mem = get_system_memory();
    MemoryRegion *ram = g_new(MemoryRegion, 1);
    MemoryRegion *sram = g_new(MemoryRegion, 1);
1532

J
Jan Kiszka 已提交
1533
    if (!cpu_model) {
1534
        cpu_model = "arm926";
J
Jan Kiszka 已提交
1535
    }
1536 1537
    cpu = cpu_arm_init(cpu_model);
    if (!cpu) {
1538 1539 1540
        fprintf(stderr, "Unable to find CPU definition\n");
        exit(1);
    }
1541
    cpu_pic = arm_pic_init_cpu(cpu);
1542 1543

    /* For now we use a fixed - the original - RAM size */
1544 1545
    memory_region_init_ram(ram, "musicpal.ram", MP_RAM_DEFAULT_SIZE);
    vmstate_register_ram_global(ram);
1546
    memory_region_add_subregion(address_space_mem, 0, ram);
1547

1548 1549
    memory_region_init_ram(sram, "musicpal.sram", MP_SRAM_SIZE);
    vmstate_register_ram_global(sram);
1550
    memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
1551

P
Paul Brook 已提交
1552 1553 1554
    dev = sysbus_create_simple("mv88w8618_pic", MP_PIC_BASE,
                               cpu_pic[ARM_PIC_CPU_IRQ]);
    for (i = 0; i < 32; i++) {
1555
        pic[i] = qdev_get_gpio_in(dev, i);
P
Paul Brook 已提交
1556 1557 1558 1559
    }
    sysbus_create_varargs("mv88w8618_pit", MP_PIT_BASE, pic[MP_TIMER1_IRQ],
                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                          pic[MP_TIMER4_IRQ], NULL);
1560

J
Jan Kiszka 已提交
1561
    if (serial_hds[0]) {
1562 1563
        serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
                       1825000, serial_hds[0], DEVICE_NATIVE_ENDIAN);
J
Jan Kiszka 已提交
1564 1565
    }
    if (serial_hds[1]) {
1566 1567
        serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
                       1825000, serial_hds[1], DEVICE_NATIVE_ENDIAN);
J
Jan Kiszka 已提交
1568
    }
1569 1570

    /* Register flash */
G
Gerd Hoffmann 已提交
1571 1572 1573
    dinfo = drive_get(IF_PFLASH, 0, 0);
    if (dinfo) {
        flash_size = bdrv_getlength(dinfo->bdrv);
1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584
        if (flash_size != 8*1024*1024 && flash_size != 16*1024*1024 &&
            flash_size != 32*1024*1024) {
            fprintf(stderr, "Invalid flash image size\n");
            exit(1);
        }

        /*
         * The original U-Boot accesses the flash at 0xFE000000 instead of
         * 0xFF800000 (if there is 8 MB flash). So remap flash access if the
         * image is smaller than 32 MB.
         */
1585
#ifdef TARGET_WORDS_BIGENDIAN
J
Jan Kiszka 已提交
1586
        pflash_cfi02_register(0x100000000ULL-MP_FLASH_SIZE_MAX, NULL,
1587
                              "musicpal.flash", flash_size,
G
Gerd Hoffmann 已提交
1588
                              dinfo->bdrv, 0x10000,
1589 1590 1591
                              (flash_size + 0xffff) >> 16,
                              MP_FLASH_SIZE_MAX / flash_size,
                              2, 0x00BF, 0x236D, 0x0000, 0x0000,
1592
                              0x5555, 0x2AAA, 1);
1593
#else
J
Jan Kiszka 已提交
1594
        pflash_cfi02_register(0x100000000ULL-MP_FLASH_SIZE_MAX, NULL,
1595
                              "musicpal.flash", flash_size,
1596 1597 1598 1599
                              dinfo->bdrv, 0x10000,
                              (flash_size + 0xffff) >> 16,
                              MP_FLASH_SIZE_MAX / flash_size,
                              2, 0x00BF, 0x236D, 0x0000, 0x0000,
1600
                              0x5555, 0x2AAA, 0);
1601 1602
#endif

1603
    }
P
Paul Brook 已提交
1604
    sysbus_create_simple("mv88w8618_flashcfg", MP_FLASHCFG_BASE, NULL);
1605

P
Paul Brook 已提交
1606 1607
    qemu_check_nic_model(&nd_table[0], "mv88w8618");
    dev = qdev_create(NULL, "mv88w8618_eth");
1608
    qdev_set_nic_properties(dev, &nd_table[0]);
1609
    qdev_init_nofail(dev);
1610 1611
    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
1612

P
Paul Brook 已提交
1613
    sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
1614

1615
    musicpal_misc_init(SYS_BUS_DEVICE(dev));
1616 1617

    dev = sysbus_create_simple("musicpal_gpio", MP_GPIO_BASE, pic[MP_GPIO_IRQ]);
1618
    i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
1619 1620
    i2c = (i2c_bus *)qdev_get_child_bus(i2c_dev, "i2c");

1621
    lcd_dev = sysbus_create_simple("musicpal_lcd", MP_LCD_BASE, NULL);
1622
    key_dev = sysbus_create_simple("musicpal_key", -1, NULL);
1623

1624
    /* I2C read data */
1625 1626
    qdev_connect_gpio_out(i2c_dev, 0,
                          qdev_get_gpio_in(dev, MP_GPIO_I2C_DATA_BIT));
1627 1628 1629 1630 1631
    /* I2C data */
    qdev_connect_gpio_out(dev, 3, qdev_get_gpio_in(i2c_dev, 0));
    /* I2C clock */
    qdev_connect_gpio_out(dev, 4, qdev_get_gpio_in(i2c_dev, 1));

J
Jan Kiszka 已提交
1632
    for (i = 0; i < 3; i++) {
1633
        qdev_connect_gpio_out(dev, i, qdev_get_gpio_in(lcd_dev, i));
J
Jan Kiszka 已提交
1634
    }
1635 1636 1637 1638 1639 1640
    for (i = 0; i < 4; i++) {
        qdev_connect_gpio_out(key_dev, i, qdev_get_gpio_in(dev, i + 8));
    }
    for (i = 4; i < 8; i++) {
        qdev_connect_gpio_out(key_dev, i, qdev_get_gpio_in(dev, i + 15));
    }
1641

1642 1643
    wm8750_dev = i2c_create_slave(i2c, "wm8750", MP_WM_ADDR);
    dev = qdev_create(NULL, "mv88w8618_audio");
1644
    s = SYS_BUS_DEVICE(dev);
1645
    qdev_prop_set_ptr(dev, "wm8750", wm8750_dev);
1646
    qdev_init_nofail(dev);
1647 1648 1649
    sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);

1650 1651 1652 1653
    musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
    musicpal_binfo.kernel_filename = kernel_filename;
    musicpal_binfo.kernel_cmdline = kernel_cmdline;
    musicpal_binfo.initrd_filename = initrd_filename;
1654
    arm_load_kernel(cpu, &musicpal_binfo);
1655 1656
}

1657
static QEMUMachine musicpal_machine = {
1658 1659 1660
    .name = "musicpal",
    .desc = "Marvell 88w8618 / MusicPal (ARM926EJ-S)",
    .init = musicpal_init,
1661
    DEFAULT_MACHINE_OPTIONS,
1662
};
P
Paul Brook 已提交
1663

1664 1665 1666 1667 1668 1669 1670
static void musicpal_machine_init(void)
{
    qemu_register_machine(&musicpal_machine);
}

machine_init(musicpal_machine_init);

1671 1672 1673 1674 1675 1676 1677
static void mv88w8618_wlan_class_init(ObjectClass *klass, void *data)
{
    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);

    sdc->init = mv88w8618_wlan_init;
}

1678
static const TypeInfo mv88w8618_wlan_info = {
1679 1680 1681 1682
    .name          = "mv88w8618_wlan",
    .parent        = TYPE_SYS_BUS_DEVICE,
    .instance_size = sizeof(SysBusDevice),
    .class_init    = mv88w8618_wlan_class_init,
1683 1684
};

1685
static void musicpal_register_types(void)
P
Paul Brook 已提交
1686
{
1687 1688 1689 1690 1691 1692 1693 1694
    type_register_static(&mv88w8618_pic_info);
    type_register_static(&mv88w8618_pit_info);
    type_register_static(&mv88w8618_flashcfg_info);
    type_register_static(&mv88w8618_eth_info);
    type_register_static(&mv88w8618_wlan_info);
    type_register_static(&musicpal_lcd_info);
    type_register_static(&musicpal_gpio_info);
    type_register_static(&musicpal_key_info);
P
Paul Brook 已提交
1695 1696
}

1697
type_init(musicpal_register_types)
新手
引导
客服 返回
顶部