]> git.proxmox.com Git - mirror_qemu.git/blame - hw/musicpal.c
projects / mirror_qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Fix disassembler memory accesses
[mirror_qemu.git] / hw / musicpal.c
CommitLineData
24859b68
AZ		 1/*
2 * Marvell MV88W8618 / Freecom MusicPal emulation.
3 *
4 * Copyright (c) 2008 Jan Kiszka
5 *
6 * This code is licenced under the GNU GPL v2.
7 */
8
9#include "hw.h"
10#include "arm-misc.h"
11#include "devices.h"
12#include "net.h"
13#include "sysemu.h"
14#include "boards.h"
15#include "pc.h"
16#include "qemu-timer.h"
17#include "block.h"
18#include "flash.h"
19#include "console.h"
20#include "audio/audio.h"
21#include "i2c.h"
22
718ec0be 23#define MP_MISC_BASE 0x80002000
24#define MP_MISC_SIZE 0x00001000
25
24859b68
AZ		 26#define MP_ETH_BASE 0x80008000
27#define MP_ETH_SIZE 0x00001000
28
718ec0be 29#define MP_WLAN_BASE 0x8000C000
30#define MP_WLAN_SIZE 0x00000800
31
24859b68
AZ		 32#define MP_UART1_BASE 0x8000C840
33#define MP_UART2_BASE 0x8000C940
34
718ec0be 35#define MP_GPIO_BASE 0x8000D000
36#define MP_GPIO_SIZE 0x00001000
37
24859b68
AZ		 38#define MP_FLASHCFG_BASE 0x90006000
39#define MP_FLASHCFG_SIZE 0x00001000
40
41#define MP_AUDIO_BASE 0x90007000
42#define MP_AUDIO_SIZE 0x00001000
43
44#define MP_PIC_BASE 0x90008000
45#define MP_PIC_SIZE 0x00001000
46
47#define MP_PIT_BASE 0x90009000
48#define MP_PIT_SIZE 0x00001000
49
50#define MP_LCD_BASE 0x9000c000
51#define MP_LCD_SIZE 0x00001000
52
53#define MP_SRAM_BASE 0xC0000000
54#define MP_SRAM_SIZE 0x00020000
55
56#define MP_RAM_DEFAULT_SIZE 32*1024*1024
57#define MP_FLASH_SIZE_MAX 32*1024*1024
58
59#define MP_TIMER1_IRQ 4
60/* ... */
61#define MP_TIMER4_IRQ 7
62#define MP_EHCI_IRQ 8
63#define MP_ETH_IRQ 9
64#define MP_UART1_IRQ 11
65#define MP_UART2_IRQ 11
66#define MP_GPIO_IRQ 12
67#define MP_RTC_IRQ 28
68#define MP_AUDIO_IRQ 30
69
70static uint32_t gpio_in_state = 0xffffffff;
7c6ce4ba 71static uint32_t gpio_isr;
24859b68
AZ		 72static uint32_t gpio_out_state;
73static ram_addr_t sram_off;
74
24859b68
AZ		 75typedef enum i2c_state {
76 STOPPED = 0,
77 INITIALIZING,
78 SENDING_BIT7,
79 SENDING_BIT6,
80 SENDING_BIT5,
81 SENDING_BIT4,
82 SENDING_BIT3,
83 SENDING_BIT2,
84 SENDING_BIT1,
85 SENDING_BIT0,
86 WAITING_FOR_ACK,
87 RECEIVING_BIT7,
88 RECEIVING_BIT6,
89 RECEIVING_BIT5,
90 RECEIVING_BIT4,
91 RECEIVING_BIT3,
92 RECEIVING_BIT2,
93 RECEIVING_BIT1,
94 RECEIVING_BIT0,
95 SENDING_ACK
96} i2c_state;
97
98typedef struct i2c_interface {
99 i2c_bus *bus;
100 i2c_state state;
101 int last_data;
102 int last_clock;
103 uint8_t buffer;
104 int current_addr;
105} i2c_interface;
106
107static void i2c_enter_stop(i2c_interface *i2c)
108{
109 if (i2c->current_addr >= 0)
110 i2c_end_transfer(i2c->bus);
111 i2c->current_addr = -1;
112 i2c->state = STOPPED;
113}
114
115static void i2c_state_update(i2c_interface *i2c, int data, int clock)
116{
117 if (!i2c)
118 return;
119
120 switch (i2c->state) {
121 case STOPPED:
122 if (data == 0 && i2c->last_data == 1 && clock == 1)
123 i2c->state = INITIALIZING;
124 break;
125
126 case INITIALIZING:
127 if (clock == 0 && i2c->last_clock == 1 && data == 0)
128 i2c->state = SENDING_BIT7;
129 else
130 i2c_enter_stop(i2c);
131 break;
132
133 case SENDING_BIT7 ... SENDING_BIT0:
134 if (clock == 0 && i2c->last_clock == 1) {
135 i2c->buffer = (i2c->buffer << 1) | data;
136 i2c->state++; /* will end up in WAITING_FOR_ACK */
137 } else if (data == 1 && i2c->last_data == 0 && clock == 1)
138 i2c_enter_stop(i2c);
139 break;
140
141 case WAITING_FOR_ACK:
142 if (clock == 0 && i2c->last_clock == 1) {
143 if (i2c->current_addr < 0) {
144 i2c->current_addr = i2c->buffer;
145 i2c_start_transfer(i2c->bus, i2c->current_addr & 0xfe,
146 i2c->buffer & 1);
147 } else
148 i2c_send(i2c->bus, i2c->buffer);
149 if (i2c->current_addr & 1) {
150 i2c->state = RECEIVING_BIT7;
151 i2c->buffer = i2c_recv(i2c->bus);
152 } else
153 i2c->state = SENDING_BIT7;
154 } else if (data == 1 && i2c->last_data == 0 && clock == 1)
155 i2c_enter_stop(i2c);
156 break;
157
158 case RECEIVING_BIT7 ... RECEIVING_BIT0:
159 if (clock == 0 && i2c->last_clock == 1) {
160 i2c->state++; /* will end up in SENDING_ACK */
161 i2c->buffer <<= 1;
162 } else if (data == 1 && i2c->last_data == 0 && clock == 1)
163 i2c_enter_stop(i2c);
164 break;
165
166 case SENDING_ACK:
167 if (clock == 0 && i2c->last_clock == 1) {
168 i2c->state = RECEIVING_BIT7;
169 if (data == 0)
170 i2c->buffer = i2c_recv(i2c->bus);
171 else
172 i2c_nack(i2c->bus);
173 } else if (data == 1 && i2c->last_data == 0 && clock == 1)
174 i2c_enter_stop(i2c);
175 break;
176 }
177
178 i2c->last_data = data;
179 i2c->last_clock = clock;
180}
181
182static int i2c_get_data(i2c_interface *i2c)
183{
184 if (!i2c)
185 return 0;
186
187 switch (i2c->state) {
188 case RECEIVING_BIT7 ... RECEIVING_BIT0:
189 return (i2c->buffer >> 7);
190
191 case WAITING_FOR_ACK:
192 default:
193 return 0;
194 }
195}
196
197static i2c_interface *mixer_i2c;
198
199#ifdef HAS_AUDIO
200
201/* Audio register offsets */
202#define MP_AUDIO_PLAYBACK_MODE 0x00
203#define MP_AUDIO_CLOCK_DIV 0x18
204#define MP_AUDIO_IRQ_STATUS 0x20
205#define MP_AUDIO_IRQ_ENABLE 0x24
206#define MP_AUDIO_TX_START_LO 0x28
207#define MP_AUDIO_TX_THRESHOLD 0x2C
208#define MP_AUDIO_TX_STATUS 0x38
209#define MP_AUDIO_TX_START_HI 0x40
210
211/* Status register and IRQ enable bits */
212#define MP_AUDIO_TX_HALF (1 << 6)
213#define MP_AUDIO_TX_FULL (1 << 7)
214
215/* Playback mode bits */
216#define MP_AUDIO_16BIT_SAMPLE (1 << 0)
217#define MP_AUDIO_PLAYBACK_EN (1 << 7)
218#define MP_AUDIO_CLOCK_24MHZ (1 << 9)
4001a81e 219#define MP_AUDIO_MONO (1 << 14)
24859b68
AZ		 220
221/* Wolfson 8750 I2C address */
222#define MP_WM_ADDR 0x34
223
b1d8e52e 224static const char audio_name[] = "mv88w8618";
24859b68
AZ		 225
226typedef struct musicpal_audio_state {
24859b68
AZ		 227 qemu_irq irq;
228 uint32_t playback_mode;
229 uint32_t status;
230 uint32_t irq_enable;
231 unsigned long phys_buf;
930c8682 232 uint32_t target_buffer;
24859b68
AZ		 233 unsigned int threshold;
234 unsigned int play_pos;
235 unsigned int last_free;
236 uint32_t clock_div;
237 i2c_slave *wm;
238} musicpal_audio_state;
239
240static void audio_callback(void *opaque, int free_out, int free_in)
241{
242 musicpal_audio_state *s = opaque;
4f3cb3be 243 int16_t *codec_buffer;
930c8682 244 int8_t buf[4096];
a350e694 245 int8_t *mem_buffer;
24859b68
AZ		 246 int pos, block_size;
247
248 if (!(s->playback_mode & MP_AUDIO_PLAYBACK_EN))
249 return;
250
251 if (s->playback_mode & MP_AUDIO_16BIT_SAMPLE)
4001a81e
AZ		 252 free_out <<= 1;
253
254 if (!(s->playback_mode & MP_AUDIO_MONO))
24859b68
AZ		 255 free_out <<= 1;
256
257 block_size = s->threshold/2;
258 if (free_out - s->last_free < block_size)
259 return;
260
930c8682
PB		 261 if (block_size > 4096)
262 return;
263
264 cpu_physical_memory_read(s->target_buffer + s->play_pos, (void *)buf,
265 block_size);
266 mem_buffer = buf;
4001a81e
AZ		 267 if (s->playback_mode & MP_AUDIO_16BIT_SAMPLE) {
268 if (s->playback_mode & MP_AUDIO_MONO) {
269 codec_buffer = wm8750_dac_buffer(s->wm, block_size >> 1);
270 for (pos = 0; pos < block_size; pos += 2) {
a350e694
AZ		 271 *codec_buffer++ = *(int16_t *)mem_buffer;
272 *codec_buffer++ = *(int16_t *)mem_buffer;
4f3cb3be 273 mem_buffer += 2;
4001a81e
AZ		 274 }
275 } else
276 memcpy(wm8750_dac_buffer(s->wm, block_size >> 2),
277 (uint32_t *)mem_buffer, block_size);
278 } else {
279 if (s->playback_mode & MP_AUDIO_MONO) {
280 codec_buffer = wm8750_dac_buffer(s->wm, block_size);
281 for (pos = 0; pos < block_size; pos++) {
a350e694
AZ		 282 *codec_buffer++ = cpu_to_le16(256 * *mem_buffer);
283 *codec_buffer++ = cpu_to_le16(256 * *mem_buffer++);
4001a81e
AZ		 284 }
285 } else {
286 codec_buffer = wm8750_dac_buffer(s->wm, block_size >> 1);
287 for (pos = 0; pos < block_size; pos += 2) {
a350e694
AZ		 288 *codec_buffer++ = cpu_to_le16(256 * *mem_buffer++);
289 *codec_buffer++ = cpu_to_le16(256 * *mem_buffer++);
4001a81e 290 }
24859b68 291 }
662caa6f
AZ		 292 }
293 wm8750_dac_commit(s->wm);
24859b68
AZ		 294
295 s->last_free = free_out - block_size;
296
297 if (s->play_pos == 0) {
298 s->status |= MP_AUDIO_TX_HALF;
299 s->play_pos = block_size;
300 } else {
301 s->status |= MP_AUDIO_TX_FULL;
302 s->play_pos = 0;
303 }
304
305 if (s->status & s->irq_enable)
306 qemu_irq_raise(s->irq);
307}
308
af83e09e
AZ		 309static void musicpal_audio_clock_update(musicpal_audio_state *s)
310{
311 int rate;
312
313 if (s->playback_mode & MP_AUDIO_CLOCK_24MHZ)
314 rate = 24576000 / 64; /* 24.576MHz */
315 else
316 rate = 11289600 / 64; /* 11.2896MHz */
317
318 rate /= ((s->clock_div >> 8) & 0xff) + 1;
319
91834991 320 wm8750_set_bclk_in(s->wm, rate);
af83e09e
AZ		 321}
322
24859b68
AZ		 323static uint32_t musicpal_audio_read(void *opaque, target_phys_addr_t offset)
324{
325 musicpal_audio_state *s = opaque;
326
24859b68
AZ		 327 switch (offset) {
328 case MP_AUDIO_PLAYBACK_MODE:
329 return s->playback_mode;
330
331 case MP_AUDIO_CLOCK_DIV:
332 return s->clock_div;
333
334 case MP_AUDIO_IRQ_STATUS:
335 return s->status;
336
337 case MP_AUDIO_IRQ_ENABLE:
338 return s->irq_enable;
339
340 case MP_AUDIO_TX_STATUS:
341 return s->play_pos >> 2;
342
343 default:
344 return 0;
345 }
346}
347
348static void musicpal_audio_write(void *opaque, target_phys_addr_t offset,
349 uint32_t value)
350{
351 musicpal_audio_state *s = opaque;
352
24859b68
AZ		 353 switch (offset) {
354 case MP_AUDIO_PLAYBACK_MODE:
355 if (value & MP_AUDIO_PLAYBACK_EN &&
356 !(s->playback_mode & MP_AUDIO_PLAYBACK_EN)) {
357 s->status = 0;
358 s->last_free = 0;
359 s->play_pos = 0;
360 }
361 s->playback_mode = value;
af83e09e 362 musicpal_audio_clock_update(s);
24859b68
AZ		 363 break;
364
365 case MP_AUDIO_CLOCK_DIV:
366 s->clock_div = value;
367 s->last_free = 0;
368 s->play_pos = 0;
af83e09e 369 musicpal_audio_clock_update(s);
24859b68
AZ		 370 break;
371
372 case MP_AUDIO_IRQ_STATUS:
373 s->status &= ~value;
374 break;
375
376 case MP_AUDIO_IRQ_ENABLE:
377 s->irq_enable = value;
378 if (s->status & s->irq_enable)
379 qemu_irq_raise(s->irq);
380 break;
381
382 case MP_AUDIO_TX_START_LO:
383 s->phys_buf = (s->phys_buf & 0xFFFF0000) | (value & 0xFFFF);
930c8682 384 s->target_buffer = s->phys_buf;
24859b68
AZ		 385 s->play_pos = 0;
386 s->last_free = 0;
387 break;
388
389 case MP_AUDIO_TX_THRESHOLD:
390 s->threshold = (value + 1) * 4;
391 break;
392
393 case MP_AUDIO_TX_START_HI:
394 s->phys_buf = (s->phys_buf & 0xFFFF) | (value << 16);
930c8682 395 s->target_buffer = s->phys_buf;
24859b68
AZ		 396 s->play_pos = 0;
397 s->last_free = 0;
398 break;
399 }
400}
401
402static void musicpal_audio_reset(void *opaque)
403{
404 musicpal_audio_state *s = opaque;
405
406 s->playback_mode = 0;
407 s->status = 0;
408 s->irq_enable = 0;
409}
410
411static CPUReadMemoryFunc *musicpal_audio_readfn[] = {
412 musicpal_audio_read,
413 musicpal_audio_read,
414 musicpal_audio_read
415};
416
417static CPUWriteMemoryFunc *musicpal_audio_writefn[] = {
418 musicpal_audio_write,
419 musicpal_audio_write,
420 musicpal_audio_write
421};
422
718ec0be 423static i2c_interface *musicpal_audio_init(qemu_irq irq)
24859b68
AZ		 424{
425 AudioState *audio;
426 musicpal_audio_state *s;
427 i2c_interface *i2c;
428 int iomemtype;
429
430 audio = AUD_init();
431 if (!audio) {
432 AUD_log(audio_name, "No audio state\n");
433 return NULL;
434 }
435
436 s = qemu_mallocz(sizeof(musicpal_audio_state));
24859b68
AZ		 437 s->irq = irq;
438
439 i2c = qemu_mallocz(sizeof(i2c_interface));
24859b68
AZ		 440 i2c->bus = i2c_init_bus();
441 i2c->current_addr = -1;
442
443 s->wm = wm8750_init(i2c->bus, audio);
444 if (!s->wm)
445 return NULL;
446 i2c_set_slave_address(s->wm, MP_WM_ADDR);
447 wm8750_data_req_set(s->wm, audio_callback, s);
448
449 iomemtype = cpu_register_io_memory(0, musicpal_audio_readfn,
450 musicpal_audio_writefn, s);
718ec0be 451 cpu_register_physical_memory(MP_AUDIO_BASE, MP_AUDIO_SIZE, iomemtype);
24859b68
AZ		 452
453 qemu_register_reset(musicpal_audio_reset, s);
454
455 return i2c;
456}
457#else /* !HAS_AUDIO */
718ec0be 458static i2c_interface *musicpal_audio_init(qemu_irq irq)
24859b68
AZ		 459{
460 return NULL;
461}
462#endif /* !HAS_AUDIO */
463
464/* Ethernet register offsets */
465#define MP_ETH_SMIR 0x010
466#define MP_ETH_PCXR 0x408
467#define MP_ETH_SDCMR 0x448
468#define MP_ETH_ICR 0x450
469#define MP_ETH_IMR 0x458
470#define MP_ETH_FRDP0 0x480
471#define MP_ETH_FRDP1 0x484
472#define MP_ETH_FRDP2 0x488
473#define MP_ETH_FRDP3 0x48C
474#define MP_ETH_CRDP0 0x4A0
475#define MP_ETH_CRDP1 0x4A4
476#define MP_ETH_CRDP2 0x4A8
477#define MP_ETH_CRDP3 0x4AC
478#define MP_ETH_CTDP0 0x4E0
479#define MP_ETH_CTDP1 0x4E4
480#define MP_ETH_CTDP2 0x4E8
481#define MP_ETH_CTDP3 0x4EC
482
483/* MII PHY access */
484#define MP_ETH_SMIR_DATA 0x0000FFFF
485#define MP_ETH_SMIR_ADDR 0x03FF0000
486#define MP_ETH_SMIR_OPCODE (1 << 26) /* Read value */
487#define MP_ETH_SMIR_RDVALID (1 << 27)
488
489/* PHY registers */
490#define MP_ETH_PHY1_BMSR 0x00210000
491#define MP_ETH_PHY1_PHYSID1 0x00410000
492#define MP_ETH_PHY1_PHYSID2 0x00610000
493
494#define MP_PHY_BMSR_LINK 0x0004
495#define MP_PHY_BMSR_AUTONEG 0x0008
496
497#define MP_PHY_88E3015 0x01410E20
498
499/* TX descriptor status */
500#define MP_ETH_TX_OWN (1 << 31)
501
502/* RX descriptor status */
503#define MP_ETH_RX_OWN (1 << 31)
504
505/* Interrupt cause/mask bits */
506#define MP_ETH_IRQ_RX_BIT 0
507#define MP_ETH_IRQ_RX (1 << MP_ETH_IRQ_RX_BIT)
508#define MP_ETH_IRQ_TXHI_BIT 2
509#define MP_ETH_IRQ_TXLO_BIT 3
510
511/* Port config bits */
512#define MP_ETH_PCXR_2BSM_BIT 28 /* 2-byte incoming suffix */
513
514/* SDMA command bits */
515#define MP_ETH_CMD_TXHI (1 << 23)
516#define MP_ETH_CMD_TXLO (1 << 22)
517
518typedef struct mv88w8618_tx_desc {
519 uint32_t cmdstat;
520 uint16_t res;
521 uint16_t bytes;
522 uint32_t buffer;
523 uint32_t next;
524} mv88w8618_tx_desc;
525
526typedef struct mv88w8618_rx_desc {
527 uint32_t cmdstat;
528 uint16_t bytes;
529 uint16_t buffer_size;
530 uint32_t buffer;
531 uint32_t next;
532} mv88w8618_rx_desc;
533
534typedef struct mv88w8618_eth_state {
24859b68
AZ		 535 qemu_irq irq;
536 uint32_t smir;
537 uint32_t icr;
538 uint32_t imr;
b946a153 539 int mmio_index;
24859b68 540 int vlan_header;
930c8682
PB		 541 uint32_t tx_queue[2];
542 uint32_t rx_queue[4];
543 uint32_t frx_queue[4];
544 uint32_t cur_rx[4];
24859b68
AZ		 545 VLANClientState *vc;
546} mv88w8618_eth_state;
547
930c8682
PB		 548static void eth_rx_desc_put(uint32_t addr, mv88w8618_rx_desc *desc)
549{
550 cpu_to_le32s(&desc->cmdstat);
551 cpu_to_le16s(&desc->bytes);
552 cpu_to_le16s(&desc->buffer_size);
553 cpu_to_le32s(&desc->buffer);
554 cpu_to_le32s(&desc->next);
555 cpu_physical_memory_write(addr, (void *)desc, sizeof(*desc));
556}
557
558static void eth_rx_desc_get(uint32_t addr, mv88w8618_rx_desc *desc)
559{
560 cpu_physical_memory_read(addr, (void *)desc, sizeof(*desc));
561 le32_to_cpus(&desc->cmdstat);
562 le16_to_cpus(&desc->bytes);
563 le16_to_cpus(&desc->buffer_size);
564 le32_to_cpus(&desc->buffer);
565 le32_to_cpus(&desc->next);
566}
567
24859b68
AZ		 568static int eth_can_receive(void *opaque)
569{
570 return 1;
571}
572
573static void eth_receive(void *opaque, const uint8_t *buf, int size)
574{
575 mv88w8618_eth_state *s = opaque;
930c8682
PB		 576 uint32_t desc_addr;
577 mv88w8618_rx_desc desc;
24859b68
AZ		 578 int i;
579
580 for (i = 0; i < 4; i++) {
930c8682
PB		 581 desc_addr = s->cur_rx[i];
582 if (!desc_addr)
24859b68
AZ		 583 continue;
584 do {
930c8682
PB		 585 eth_rx_desc_get(desc_addr, &desc);
586 if ((desc.cmdstat & MP_ETH_RX_OWN) && desc.buffer_size >= size) {
587 cpu_physical_memory_write(desc.buffer + s->vlan_header,
588 buf, size);
589 desc.bytes = size + s->vlan_header;
590 desc.cmdstat &= ~MP_ETH_RX_OWN;
591 s->cur_rx[i] = desc.next;
24859b68
AZ		 592
593 s->icr |= MP_ETH_IRQ_RX;
594 if (s->icr & s->imr)
595 qemu_irq_raise(s->irq);
930c8682 596 eth_rx_desc_put(desc_addr, &desc);
24859b68
AZ		 597 return;
598 }
930c8682
PB		 599 desc_addr = desc.next;
600 } while (desc_addr != s->rx_queue[i]);
24859b68
AZ		 601 }
602}
603
930c8682
PB		 604static void eth_tx_desc_put(uint32_t addr, mv88w8618_tx_desc *desc)
605{
606 cpu_to_le32s(&desc->cmdstat);
607 cpu_to_le16s(&desc->res);
608 cpu_to_le16s(&desc->bytes);
609 cpu_to_le32s(&desc->buffer);
610 cpu_to_le32s(&desc->next);
611 cpu_physical_memory_write(addr, (void *)desc, sizeof(*desc));
612}
613
614static void eth_tx_desc_get(uint32_t addr, mv88w8618_tx_desc *desc)
615{
616 cpu_physical_memory_read(addr, (void *)desc, sizeof(*desc));
617 le32_to_cpus(&desc->cmdstat);
618 le16_to_cpus(&desc->res);
619 le16_to_cpus(&desc->bytes);
620 le32_to_cpus(&desc->buffer);
621 le32_to_cpus(&desc->next);
622}
623
24859b68
AZ		 624static void eth_send(mv88w8618_eth_state *s, int queue_index)
625{
930c8682
PB		 626 uint32_t desc_addr = s->tx_queue[queue_index];
627 mv88w8618_tx_desc desc;
628 uint8_t buf[2048];
629 int len;
630
24859b68
AZ		 631
632 do {
930c8682
PB		 633 eth_tx_desc_get(desc_addr, &desc);
634 if (desc.cmdstat & MP_ETH_TX_OWN) {
635 len = desc.bytes;
636 if (len < 2048) {
637 cpu_physical_memory_read(desc.buffer, buf, len);
638 qemu_send_packet(s->vc, buf, len);
639 }
640 desc.cmdstat &= ~MP_ETH_TX_OWN;
24859b68 641 s->icr |= 1 << (MP_ETH_IRQ_TXLO_BIT - queue_index);
930c8682 642 eth_tx_desc_put(desc_addr, &desc);
24859b68 643 }
930c8682
PB		 644 desc_addr = desc.next;
645 } while (desc_addr != s->tx_queue[queue_index]);
24859b68
AZ		 646}
647
648static uint32_t mv88w8618_eth_read(void *opaque, target_phys_addr_t offset)
649{
650 mv88w8618_eth_state *s = opaque;
651
24859b68
AZ		 652 switch (offset) {
653 case MP_ETH_SMIR:
654 if (s->smir & MP_ETH_SMIR_OPCODE) {
655 switch (s->smir & MP_ETH_SMIR_ADDR) {
656 case MP_ETH_PHY1_BMSR:
657 return MP_PHY_BMSR_LINK | MP_PHY_BMSR_AUTONEG |
658 MP_ETH_SMIR_RDVALID;
659 case MP_ETH_PHY1_PHYSID1:
660 return (MP_PHY_88E3015 >> 16) | MP_ETH_SMIR_RDVALID;
661 case MP_ETH_PHY1_PHYSID2:
662 return (MP_PHY_88E3015 & 0xFFFF) | MP_ETH_SMIR_RDVALID;
663 default:
664 return MP_ETH_SMIR_RDVALID;
665 }
666 }
667 return 0;
668
669 case MP_ETH_ICR:
670 return s->icr;
671
672 case MP_ETH_IMR:
673 return s->imr;
674
675 case MP_ETH_FRDP0 ... MP_ETH_FRDP3:
930c8682 676 return s->frx_queue[(offset - MP_ETH_FRDP0)/4];
24859b68
AZ		 677
678 case MP_ETH_CRDP0 ... MP_ETH_CRDP3:
930c8682 679 return s->rx_queue[(offset - MP_ETH_CRDP0)/4];
24859b68
AZ		 680
681 case MP_ETH_CTDP0 ... MP_ETH_CTDP3:
930c8682 682 return s->tx_queue[(offset - MP_ETH_CTDP0)/4];
24859b68
AZ		 683
684 default:
685 return 0;
686 }
687}
688
689static void mv88w8618_eth_write(void *opaque, target_phys_addr_t offset,
690 uint32_t value)
691{
692 mv88w8618_eth_state *s = opaque;
693
24859b68
AZ		 694 switch (offset) {
695 case MP_ETH_SMIR:
696 s->smir = value;
697 break;
698
699 case MP_ETH_PCXR:
700 s->vlan_header = ((value >> MP_ETH_PCXR_2BSM_BIT) & 1) * 2;
701 break;
702
703 case MP_ETH_SDCMR:
704 if (value & MP_ETH_CMD_TXHI)
705 eth_send(s, 1);
706 if (value & MP_ETH_CMD_TXLO)
707 eth_send(s, 0);
708 if (value & (MP_ETH_CMD_TXHI | MP_ETH_CMD_TXLO) && s->icr & s->imr)
709 qemu_irq_raise(s->irq);
710 break;
711
712 case MP_ETH_ICR:
713 s->icr &= value;
714 break;
715
716 case MP_ETH_IMR:
717 s->imr = value;
718 if (s->icr & s->imr)
719 qemu_irq_raise(s->irq);
720 break;
721
722 case MP_ETH_FRDP0 ... MP_ETH_FRDP3:
930c8682 723 s->frx_queue[(offset - MP_ETH_FRDP0)/4] = value;
24859b68
AZ		 724 break;
725
726 case MP_ETH_CRDP0 ... MP_ETH_CRDP3:
727 s->rx_queue[(offset - MP_ETH_CRDP0)/4] =
930c8682 728 s->cur_rx[(offset - MP_ETH_CRDP0)/4] = value;
24859b68
AZ		 729 break;
730
731 case MP_ETH_CTDP0 ... MP_ETH_CTDP3:
930c8682 732 s->tx_queue[(offset - MP_ETH_CTDP0)/4] = value;
24859b68
AZ		 733 break;
734 }
735}
736
737static CPUReadMemoryFunc *mv88w8618_eth_readfn[] = {
738 mv88w8618_eth_read,
739 mv88w8618_eth_read,
740 mv88w8618_eth_read
741};
742
743static CPUWriteMemoryFunc *mv88w8618_eth_writefn[] = {
744 mv88w8618_eth_write,
745 mv88w8618_eth_write,
746 mv88w8618_eth_write
747};
748
b946a153
AL		 749static void eth_cleanup(VLANClientState *vc)
750{
751 mv88w8618_eth_state *s = vc->opaque;
752
753 cpu_unregister_io_memory(s->mmio_index);
754
755 qemu_free(s);
756}
757
24859b68
AZ		 758static void mv88w8618_eth_init(NICInfo *nd, uint32_t base, qemu_irq irq)
759{
760 mv88w8618_eth_state *s;
24859b68 761
0ae18cee
AL		 762 qemu_check_nic_model(nd, "mv88w8618");
763
24859b68 764 s = qemu_mallocz(sizeof(mv88w8618_eth_state));
24859b68 765 s->irq = irq;
7a9f6e4a 766 s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
b946a153
AL		 767 eth_receive, eth_can_receive,
768 eth_cleanup, s);
769 s->mmio_index = cpu_register_io_memory(0, mv88w8618_eth_readfn,
770 mv88w8618_eth_writefn, s);
771 cpu_register_physical_memory(base, MP_ETH_SIZE, s->mmio_index);
24859b68
AZ		 772}
773
774/* LCD register offsets */
775#define MP_LCD_IRQCTRL 0x180
776#define MP_LCD_IRQSTAT 0x184
777#define MP_LCD_SPICTRL 0x1ac
778#define MP_LCD_INST 0x1bc
779#define MP_LCD_DATA 0x1c0
780
781/* Mode magics */
782#define MP_LCD_SPI_DATA 0x00100011
783#define MP_LCD_SPI_CMD 0x00104011
784#define MP_LCD_SPI_INVALID 0x00000000
785
786/* Commmands */
787#define MP_LCD_INST_SETPAGE0 0xB0
788/* ... */
789#define MP_LCD_INST_SETPAGE7 0xB7
790
791#define MP_LCD_TEXTCOLOR 0xe0e0ff /* RRGGBB */
792
793typedef struct musicpal_lcd_state {
24859b68
AZ		 794 uint32_t mode;
795 uint32_t irqctrl;
796 int page;
797 int page_off;
798 DisplayState *ds;
799 uint8_t video_ram[128*64/8];
800} musicpal_lcd_state;
801
802static uint32_t lcd_brightness;
803
804static uint8_t scale_lcd_color(uint8_t col)
805{
806 int tmp = col;
807
808 switch (lcd_brightness) {
809 case 0x00000007: /* 0 */
810 return 0;
811
812 case 0x00020000: /* 1 */
813 return (tmp * 1) / 7;
814
815 case 0x00020001: /* 2 */
816 return (tmp * 2) / 7;
817
818 case 0x00040000: /* 3 */
819 return (tmp * 3) / 7;
820
821 case 0x00010006: /* 4 */
822 return (tmp * 4) / 7;
823
824 case 0x00020005: /* 5 */
825 return (tmp * 5) / 7;
826
827 case 0x00040003: /* 6 */
828 return (tmp * 6) / 7;
829
830 case 0x00030004: /* 7 */
831 default:
832 return col;
833 }
834}
835
0266f2c7
AZ		 836#define SET_LCD_PIXEL(depth, type) \
837static inline void glue(set_lcd_pixel, depth) \
838 (musicpal_lcd_state *s, int x, int y, type col) \
839{ \
840 int dx, dy; \
0e1f5a0c 841 type *pixel = &((type *) ds_get_data(s->ds))[(y * 128 * 3 + x) * 3]; \
0266f2c7
AZ		 842\
843 for (dy = 0; dy < 3; dy++, pixel += 127 * 3) \
844 for (dx = 0; dx < 3; dx++, pixel++) \
845 *pixel = col; \
24859b68 846}
0266f2c7
AZ		 847SET_LCD_PIXEL(8, uint8_t)
848SET_LCD_PIXEL(16, uint16_t)
849SET_LCD_PIXEL(32, uint32_t)
850
851#include "pixel_ops.h"
24859b68
AZ		 852
853static void lcd_refresh(void *opaque)
854{
855 musicpal_lcd_state *s = opaque;
0266f2c7 856 int x, y, col;
24859b68 857
0e1f5a0c 858 switch (ds_get_bits_per_pixel(s->ds)) {
0266f2c7
AZ		 859 case 0:
860 return;
861#define LCD_REFRESH(depth, func) \
862 case depth: \
863 col = func(scale_lcd_color((MP_LCD_TEXTCOLOR >> 16) & 0xff), \
864 scale_lcd_color((MP_LCD_TEXTCOLOR >> 8) & 0xff), \
865 scale_lcd_color(MP_LCD_TEXTCOLOR & 0xff)); \
866 for (x = 0; x < 128; x++) \
867 for (y = 0; y < 64; y++) \
868 if (s->video_ram[x + (y/8)*128] & (1 << (y % 8))) \
869 glue(set_lcd_pixel, depth)(s, x, y, col); \
870 else \
871 glue(set_lcd_pixel, depth)(s, x, y, 0); \
872 break;
873 LCD_REFRESH(8, rgb_to_pixel8)
874 LCD_REFRESH(16, rgb_to_pixel16)
bf9b48af
AL		 875 LCD_REFRESH(32, (is_surface_bgr(s->ds->surface) ?
876 rgb_to_pixel32bgr : rgb_to_pixel32))
0266f2c7
AZ		 877 default:
878 cpu_abort(cpu_single_env, "unsupported colour depth %i\n",
0e1f5a0c 879 ds_get_bits_per_pixel(s->ds));
0266f2c7 880 }
24859b68
AZ		 881
882 dpy_update(s->ds, 0, 0, 128*3, 64*3);
883}
884
167bc3d2
AZ		 885static void lcd_invalidate(void *opaque)
886{
167bc3d2
AZ		 887}
888
24859b68
AZ		 889static uint32_t musicpal_lcd_read(void *opaque, target_phys_addr_t offset)
890{
891 musicpal_lcd_state *s = opaque;
892
24859b68
AZ		 893 switch (offset) {
894 case MP_LCD_IRQCTRL:
895 return s->irqctrl;
896
897 default:
898 return 0;
899 }
900}
901
902static void musicpal_lcd_write(void *opaque, target_phys_addr_t offset,
903 uint32_t value)
904{
905 musicpal_lcd_state *s = opaque;
906
24859b68
AZ		 907 switch (offset) {
908 case MP_LCD_IRQCTRL:
909 s->irqctrl = value;
910 break;
911
912 case MP_LCD_SPICTRL:
913 if (value == MP_LCD_SPI_DATA || value == MP_LCD_SPI_CMD)
914 s->mode = value;
915 else
916 s->mode = MP_LCD_SPI_INVALID;
917 break;
918
919 case MP_LCD_INST:
920 if (value >= MP_LCD_INST_SETPAGE0 && value <= MP_LCD_INST_SETPAGE7) {
921 s->page = value - MP_LCD_INST_SETPAGE0;
922 s->page_off = 0;
923 }
924 break;
925
926 case MP_LCD_DATA:
927 if (s->mode == MP_LCD_SPI_CMD) {
928 if (value >= MP_LCD_INST_SETPAGE0 &&
929 value <= MP_LCD_INST_SETPAGE7) {
930 s->page = value - MP_LCD_INST_SETPAGE0;
931 s->page_off = 0;
932 }
933 } else if (s->mode == MP_LCD_SPI_DATA) {
934 s->video_ram[s->page*128 + s->page_off] = value;
935 s->page_off = (s->page_off + 1) & 127;
936 }
937 break;
938 }
939}
940
941static CPUReadMemoryFunc *musicpal_lcd_readfn[] = {
942 musicpal_lcd_read,
943 musicpal_lcd_read,
944 musicpal_lcd_read
945};
946
947static CPUWriteMemoryFunc *musicpal_lcd_writefn[] = {
948 musicpal_lcd_write,
949 musicpal_lcd_write,
950 musicpal_lcd_write
951};
952
718ec0be 953static void musicpal_lcd_init(void)
24859b68
AZ		 954{
955 musicpal_lcd_state *s;
956 int iomemtype;
957
958 s = qemu_mallocz(sizeof(musicpal_lcd_state));
24859b68
AZ		 959 iomemtype = cpu_register_io_memory(0, musicpal_lcd_readfn,
960 musicpal_lcd_writefn, s);
718ec0be 961 cpu_register_physical_memory(MP_LCD_BASE, MP_LCD_SIZE, iomemtype);
24859b68 962
3023f332
AL		 963 s->ds = graphic_console_init(lcd_refresh, lcd_invalidate,
964 NULL, NULL, s);
965 qemu_console_resize(s->ds, 128*3, 64*3);
24859b68
AZ		 966}
967
968/* PIC register offsets */
969#define MP_PIC_STATUS 0x00
970#define MP_PIC_ENABLE_SET 0x08
971#define MP_PIC_ENABLE_CLR 0x0C
972
973typedef struct mv88w8618_pic_state
974{
24859b68
AZ		 975 uint32_t level;
976 uint32_t enabled;
977 qemu_irq parent_irq;
978} mv88w8618_pic_state;
979
980static void mv88w8618_pic_update(mv88w8618_pic_state *s)
981{
982 qemu_set_irq(s->parent_irq, (s->level & s->enabled));
983}
984
985static void mv88w8618_pic_set_irq(void *opaque, int irq, int level)
986{
987 mv88w8618_pic_state *s = opaque;
988
989 if (level)
990 s->level |= 1 << irq;
991 else
992 s->level &= ~(1 << irq);
993 mv88w8618_pic_update(s);
994}
995
996static uint32_t mv88w8618_pic_read(void *opaque, target_phys_addr_t offset)
997{
998 mv88w8618_pic_state *s = opaque;
999
24859b68
AZ		 1000 switch (offset) {
1001 case MP_PIC_STATUS:
1002 return s->level & s->enabled;
1003
1004 default:
1005 return 0;
1006 }
1007}
1008
1009static void mv88w8618_pic_write(void *opaque, target_phys_addr_t offset,
1010 uint32_t value)
1011{
1012 mv88w8618_pic_state *s = opaque;
1013
24859b68
AZ		 1014 switch (offset) {
1015 case MP_PIC_ENABLE_SET:
1016 s->enabled |= value;
1017 break;
1018
1019 case MP_PIC_ENABLE_CLR:
1020 s->enabled &= ~value;
1021 s->level &= ~value;
1022 break;
1023 }
1024 mv88w8618_pic_update(s);
1025}
1026
1027static void mv88w8618_pic_reset(void *opaque)
1028{
1029 mv88w8618_pic_state *s = opaque;
1030
1031 s->level = 0;
1032 s->enabled = 0;
1033}
1034
1035static CPUReadMemoryFunc *mv88w8618_pic_readfn[] = {
1036 mv88w8618_pic_read,
1037 mv88w8618_pic_read,
1038 mv88w8618_pic_read
1039};
1040
1041static CPUWriteMemoryFunc *mv88w8618_pic_writefn[] = {
1042 mv88w8618_pic_write,
1043 mv88w8618_pic_write,
1044 mv88w8618_pic_write
1045};
1046
1047static qemu_irq *mv88w8618_pic_init(uint32_t base, qemu_irq parent_irq)
1048{
1049 mv88w8618_pic_state *s;
1050 int iomemtype;
1051 qemu_irq *qi;
1052
1053 s = qemu_mallocz(sizeof(mv88w8618_pic_state));
24859b68 1054 qi = qemu_allocate_irqs(mv88w8618_pic_set_irq, s, 32);
24859b68
AZ		 1055 s->parent_irq = parent_irq;
1056 iomemtype = cpu_register_io_memory(0, mv88w8618_pic_readfn,
1057 mv88w8618_pic_writefn, s);
1058 cpu_register_physical_memory(base, MP_PIC_SIZE, iomemtype);
1059
1060 qemu_register_reset(mv88w8618_pic_reset, s);
1061
1062 return qi;
1063}
1064
1065/* PIT register offsets */
1066#define MP_PIT_TIMER1_LENGTH 0x00
1067/* ... */
1068#define MP_PIT_TIMER4_LENGTH 0x0C
1069#define MP_PIT_CONTROL 0x10
1070#define MP_PIT_TIMER1_VALUE 0x14
1071/* ... */
1072#define MP_PIT_TIMER4_VALUE 0x20
1073#define MP_BOARD_RESET 0x34
1074
1075/* Magic board reset value (probably some watchdog behind it) */
1076#define MP_BOARD_RESET_MAGIC 0x10000
1077
1078typedef struct mv88w8618_timer_state {
1079 ptimer_state *timer;
1080 uint32_t limit;
1081 int freq;
1082 qemu_irq irq;
1083} mv88w8618_timer_state;
1084
1085typedef struct mv88w8618_pit_state {
1086 void *timer[4];
1087 uint32_t control;
24859b68
AZ		 1088} mv88w8618_pit_state;
1089
1090static void mv88w8618_timer_tick(void *opaque)
1091{
1092 mv88w8618_timer_state *s = opaque;
1093
1094 qemu_irq_raise(s->irq);
1095}
1096
1097static void *mv88w8618_timer_init(uint32_t freq, qemu_irq irq)
1098{
1099 mv88w8618_timer_state *s;
1100 QEMUBH *bh;
1101
1102 s = qemu_mallocz(sizeof(mv88w8618_timer_state));
1103 s->irq = irq;
1104 s->freq = freq;
1105
1106 bh = qemu_bh_new(mv88w8618_timer_tick, s);
1107 s->timer = ptimer_init(bh);
1108
1109 return s;
1110}
1111
1112static uint32_t mv88w8618_pit_read(void *opaque, target_phys_addr_t offset)
1113{
1114 mv88w8618_pit_state *s = opaque;
1115 mv88w8618_timer_state *t;
1116
24859b68
AZ		 1117 switch (offset) {
1118 case MP_PIT_TIMER1_VALUE ... MP_PIT_TIMER4_VALUE:
1119 t = s->timer[(offset-MP_PIT_TIMER1_VALUE) >> 2];
1120 return ptimer_get_count(t->timer);
1121
1122 default:
1123 return 0;
1124 }
1125}
1126
1127static void mv88w8618_pit_write(void *opaque, target_phys_addr_t offset,
1128 uint32_t value)
1129{
1130 mv88w8618_pit_state *s = opaque;
1131 mv88w8618_timer_state *t;
1132 int i;
1133
24859b68
AZ		 1134 switch (offset) {
1135 case MP_PIT_TIMER1_LENGTH ... MP_PIT_TIMER4_LENGTH:
1136 t = s->timer[offset >> 2];
1137 t->limit = value;
1138 ptimer_set_limit(t->timer, t->limit, 1);
1139 break;
1140
1141 case MP_PIT_CONTROL:
1142 for (i = 0; i < 4; i++) {
1143 if (value & 0xf) {
1144 t = s->timer[i];
1145 ptimer_set_limit(t->timer, t->limit, 0);
1146 ptimer_set_freq(t->timer, t->freq);
1147 ptimer_run(t->timer, 0);
1148 }
1149 value >>= 4;
1150 }
1151 break;
1152
1153 case MP_BOARD_RESET:
1154 if (value == MP_BOARD_RESET_MAGIC)
1155 qemu_system_reset_request();
1156 break;
1157 }
1158}
1159
1160static CPUReadMemoryFunc *mv88w8618_pit_readfn[] = {
1161 mv88w8618_pit_read,
1162 mv88w8618_pit_read,
1163 mv88w8618_pit_read
1164};
1165
1166static CPUWriteMemoryFunc *mv88w8618_pit_writefn[] = {
1167 mv88w8618_pit_write,
1168 mv88w8618_pit_write,
1169 mv88w8618_pit_write
1170};
1171
1172static void mv88w8618_pit_init(uint32_t base, qemu_irq *pic, int irq)
1173{
1174 int iomemtype;
1175 mv88w8618_pit_state *s;
1176
1177 s = qemu_mallocz(sizeof(mv88w8618_pit_state));
24859b68 1178
24859b68
AZ		 1179 /* Letting them all run at 1 MHz is likely just a pragmatic
1180 * simplification. */
1181 s->timer[0] = mv88w8618_timer_init(1000000, pic[irq]);
1182 s->timer[1] = mv88w8618_timer_init(1000000, pic[irq + 1]);
1183 s->timer[2] = mv88w8618_timer_init(1000000, pic[irq + 2]);
1184 s->timer[3] = mv88w8618_timer_init(1000000, pic[irq + 3]);
1185
1186 iomemtype = cpu_register_io_memory(0, mv88w8618_pit_readfn,
1187 mv88w8618_pit_writefn, s);
1188 cpu_register_physical_memory(base, MP_PIT_SIZE, iomemtype);
1189}
1190
1191/* Flash config register offsets */
1192#define MP_FLASHCFG_CFGR0 0x04
1193
1194typedef struct mv88w8618_flashcfg_state {
24859b68
AZ		 1195 uint32_t cfgr0;
1196} mv88w8618_flashcfg_state;
1197
1198static uint32_t mv88w8618_flashcfg_read(void *opaque,
1199 target_phys_addr_t offset)
1200{
1201 mv88w8618_flashcfg_state *s = opaque;
1202
24859b68
AZ		 1203 switch (offset) {
1204 case MP_FLASHCFG_CFGR0:
1205 return s->cfgr0;
1206
1207 default:
1208 return 0;
1209 }
1210}
1211
1212static void mv88w8618_flashcfg_write(void *opaque, target_phys_addr_t offset,
1213 uint32_t value)
1214{
1215 mv88w8618_flashcfg_state *s = opaque;
1216
24859b68
AZ		 1217 switch (offset) {
1218 case MP_FLASHCFG_CFGR0:
1219 s->cfgr0 = value;
1220 break;
1221 }
1222}
1223
1224static CPUReadMemoryFunc *mv88w8618_flashcfg_readfn[] = {
1225 mv88w8618_flashcfg_read,
1226 mv88w8618_flashcfg_read,
1227 mv88w8618_flashcfg_read
1228};
1229
1230static CPUWriteMemoryFunc *mv88w8618_flashcfg_writefn[] = {
1231 mv88w8618_flashcfg_write,
1232 mv88w8618_flashcfg_write,
1233 mv88w8618_flashcfg_write
1234};
1235
1236static void mv88w8618_flashcfg_init(uint32_t base)
1237{
1238 int iomemtype;
1239 mv88w8618_flashcfg_state *s;
1240
1241 s = qemu_mallocz(sizeof(mv88w8618_flashcfg_state));
24859b68 1242
24859b68
AZ		 1243 s->cfgr0 = 0xfffe4285; /* Default as set by U-Boot for 8 MB flash */
1244 iomemtype = cpu_register_io_memory(0, mv88w8618_flashcfg_readfn,
1245 mv88w8618_flashcfg_writefn, s);
1246 cpu_register_physical_memory(base, MP_FLASHCFG_SIZE, iomemtype);
1247}
1248
718ec0be 1249/* Misc register offsets */
1250#define MP_MISC_BOARD_REVISION 0x18
1251
1252#define MP_BOARD_REVISION 0x31
1253
1254static uint32_t musicpal_misc_read(void *opaque, target_phys_addr_t offset)
1255{
1256 switch (offset) {
1257 case MP_MISC_BOARD_REVISION:
1258 return MP_BOARD_REVISION;
1259
1260 default:
1261 return 0;
1262 }
1263}
1264
1265static void musicpal_misc_write(void *opaque, target_phys_addr_t offset,
1266 uint32_t value)
1267{
1268}
1269
1270static CPUReadMemoryFunc *musicpal_misc_readfn[] = {
1271 musicpal_misc_read,
1272 musicpal_misc_read,
1273 musicpal_misc_read,
1274};
1275
1276static CPUWriteMemoryFunc *musicpal_misc_writefn[] = {
1277 musicpal_misc_write,
1278 musicpal_misc_write,
1279 musicpal_misc_write,
1280};
1281
1282static void musicpal_misc_init(void)
1283{
1284 int iomemtype;
1285
1286 iomemtype = cpu_register_io_memory(0, musicpal_misc_readfn,
1287 musicpal_misc_writefn, NULL);
1288 cpu_register_physical_memory(MP_MISC_BASE, MP_MISC_SIZE, iomemtype);
1289}
1290
1291/* WLAN register offsets */
1292#define MP_WLAN_MAGIC1 0x11c
1293#define MP_WLAN_MAGIC2 0x124
1294
1295static uint32_t mv88w8618_wlan_read(void *opaque, target_phys_addr_t offset)
1296{
1297 switch (offset) {
1298 /* Workaround to allow loading the binary-only wlandrv.ko crap
1299 * from the original Freecom firmware. */
1300 case MP_WLAN_MAGIC1:
1301 return ~3;
1302 case MP_WLAN_MAGIC2:
1303 return -1;
1304
1305 default:
1306 return 0;
1307 }
1308}
1309
1310static void mv88w8618_wlan_write(void *opaque, target_phys_addr_t offset,
1311 uint32_t value)
1312{
1313}
1314
1315static CPUReadMemoryFunc *mv88w8618_wlan_readfn[] = {
1316 mv88w8618_wlan_read,
1317 mv88w8618_wlan_read,
1318 mv88w8618_wlan_read,
1319};
1320
1321static CPUWriteMemoryFunc *mv88w8618_wlan_writefn[] = {
1322 mv88w8618_wlan_write,
1323 mv88w8618_wlan_write,
1324 mv88w8618_wlan_write,
1325};
1326
1327static void mv88w8618_wlan_init(uint32_t base)
1328{
1329 int iomemtype;
24859b68 1330
718ec0be 1331 iomemtype = cpu_register_io_memory(0, mv88w8618_wlan_readfn,
1332 mv88w8618_wlan_writefn, NULL);
1333 cpu_register_physical_memory(base, MP_WLAN_SIZE, iomemtype);
1334}
24859b68 1335
718ec0be 1336/* GPIO register offsets */
1337#define MP_GPIO_OE_LO 0x008
1338#define MP_GPIO_OUT_LO 0x00c
1339#define MP_GPIO_IN_LO 0x010
1340#define MP_GPIO_ISR_LO 0x020
1341#define MP_GPIO_OE_HI 0x508
1342#define MP_GPIO_OUT_HI 0x50c
1343#define MP_GPIO_IN_HI 0x510
1344#define MP_GPIO_ISR_HI 0x520
24859b68
AZ		 1345
1346/* GPIO bits & masks */
1347#define MP_GPIO_WHEEL_VOL (1 << 8)
1348#define MP_GPIO_WHEEL_VOL_INV (1 << 9)
1349#define MP_GPIO_WHEEL_NAV (1 << 10)
1350#define MP_GPIO_WHEEL_NAV_INV (1 << 11)
1351#define MP_GPIO_LCD_BRIGHTNESS 0x00070000
1352#define MP_GPIO_BTN_FAVORITS (1 << 19)
1353#define MP_GPIO_BTN_MENU (1 << 20)
1354#define MP_GPIO_BTN_VOLUME (1 << 21)
1355#define MP_GPIO_BTN_NAVIGATION (1 << 22)
1356#define MP_GPIO_I2C_DATA_BIT 29
1357#define MP_GPIO_I2C_DATA (1 << MP_GPIO_I2C_DATA_BIT)
1358#define MP_GPIO_I2C_CLOCK_BIT 30
1359
1360/* LCD brightness bits in GPIO_OE_HI */
1361#define MP_OE_LCD_BRIGHTNESS 0x0007
1362
718ec0be 1363static uint32_t musicpal_gpio_read(void *opaque, target_phys_addr_t offset)
24859b68 1364{
24859b68 1365 switch (offset) {
24859b68
AZ		 1366 case MP_GPIO_OE_HI: /* used for LCD brightness control */
1367 return lcd_brightness & MP_OE_LCD_BRIGHTNESS;
1368
1369 case MP_GPIO_OUT_LO:
1370 return gpio_out_state & 0xFFFF;
1371 case MP_GPIO_OUT_HI:
1372 return gpio_out_state >> 16;
1373
1374 case MP_GPIO_IN_LO:
1375 return gpio_in_state & 0xFFFF;
1376 case MP_GPIO_IN_HI:
1377 /* Update received I2C data */
1378 gpio_in_state = (gpio_in_state & ~MP_GPIO_I2C_DATA) |
1379 (i2c_get_data(mixer_i2c) << MP_GPIO_I2C_DATA_BIT);
1380 return gpio_in_state >> 16;
1381
24859b68 1382 case MP_GPIO_ISR_LO:
7c6ce4ba 1383 return gpio_isr & 0xFFFF;
24859b68 1384 case MP_GPIO_ISR_HI:
7c6ce4ba 1385 return gpio_isr >> 16;
24859b68 1386
24859b68
AZ		 1387 default:
1388 return 0;
1389 }
1390}
1391
718ec0be 1392static void musicpal_gpio_write(void *opaque, target_phys_addr_t offset,
1393 uint32_t value)
24859b68 1394{
24859b68
AZ		 1395 switch (offset) {
1396 case MP_GPIO_OE_HI: /* used for LCD brightness control */
1397 lcd_brightness = (lcd_brightness & MP_GPIO_LCD_BRIGHTNESS) |
1398 (value & MP_OE_LCD_BRIGHTNESS);
1399 break;
1400
1401 case MP_GPIO_OUT_LO:
1402 gpio_out_state = (gpio_out_state & 0xFFFF0000) | (value & 0xFFFF);
1403 break;
1404 case MP_GPIO_OUT_HI:
1405 gpio_out_state = (gpio_out_state & 0xFFFF) | (value << 16);
1406 lcd_brightness = (lcd_brightness & 0xFFFF) |
1407 (gpio_out_state & MP_GPIO_LCD_BRIGHTNESS);
1408 i2c_state_update(mixer_i2c,
1409 (gpio_out_state >> MP_GPIO_I2C_DATA_BIT) & 1,
1410 (gpio_out_state >> MP_GPIO_I2C_CLOCK_BIT) & 1);
1411 break;
1412
1413 }
1414}
1415
718ec0be 1416static CPUReadMemoryFunc *musicpal_gpio_readfn[] = {
1417 musicpal_gpio_read,
1418 musicpal_gpio_read,
1419 musicpal_gpio_read,
1420};
1421
1422static CPUWriteMemoryFunc *musicpal_gpio_writefn[] = {
1423 musicpal_gpio_write,
1424 musicpal_gpio_write,
1425 musicpal_gpio_write,
1426};
1427
1428static void musicpal_gpio_init(void)
1429{
1430 int iomemtype;
1431
1432 iomemtype = cpu_register_io_memory(0, musicpal_gpio_readfn,
1433 musicpal_gpio_writefn, NULL);
1434 cpu_register_physical_memory(MP_GPIO_BASE, MP_GPIO_SIZE, iomemtype);
1435}
1436
24859b68 1437/* Keyboard codes & masks */
7c6ce4ba 1438#define KEY_RELEASED 0x80
24859b68
AZ		 1439#define KEY_CODE 0x7f
1440
1441#define KEYCODE_TAB 0x0f
1442#define KEYCODE_ENTER 0x1c
1443#define KEYCODE_F 0x21
1444#define KEYCODE_M 0x32
1445
1446#define KEYCODE_EXTENDED 0xe0
1447#define KEYCODE_UP 0x48
1448#define KEYCODE_DOWN 0x50
1449#define KEYCODE_LEFT 0x4b
1450#define KEYCODE_RIGHT 0x4d
1451
1452static void musicpal_key_event(void *opaque, int keycode)
1453{
1454 qemu_irq irq = opaque;
1455 uint32_t event = 0;
1456 static int kbd_extended;
1457
1458 if (keycode == KEYCODE_EXTENDED) {
1459 kbd_extended = 1;
1460 return;
1461 }
1462
1463 if (kbd_extended)
1464 switch (keycode & KEY_CODE) {
1465 case KEYCODE_UP:
1466 event = MP_GPIO_WHEEL_NAV | MP_GPIO_WHEEL_NAV_INV;
1467 break;
1468
1469 case KEYCODE_DOWN:
1470 event = MP_GPIO_WHEEL_NAV;
1471 break;
1472
1473 case KEYCODE_LEFT:
1474 event = MP_GPIO_WHEEL_VOL | MP_GPIO_WHEEL_VOL_INV;
1475 break;
1476
1477 case KEYCODE_RIGHT:
1478 event = MP_GPIO_WHEEL_VOL;
1479 break;
1480 }
7c6ce4ba 1481 else {
24859b68
AZ		 1482 switch (keycode & KEY_CODE) {
1483 case KEYCODE_F:
1484 event = MP_GPIO_BTN_FAVORITS;
1485 break;
1486
1487 case KEYCODE_TAB:
1488 event = MP_GPIO_BTN_VOLUME;
1489 break;
1490
1491 case KEYCODE_ENTER:
1492 event = MP_GPIO_BTN_NAVIGATION;
1493 break;
1494
1495 case KEYCODE_M:
1496 event = MP_GPIO_BTN_MENU;
1497 break;
1498 }
7c6ce4ba
AZ		 1499 /* Do not repeat already pressed buttons */
1500 if (!(keycode & KEY_RELEASED) && !(gpio_in_state & event))
1501 event = 0;
1502 }
24859b68 1503
7c6ce4ba
AZ		 1504 if (event) {
1505 if (keycode & KEY_RELEASED) {
1506 gpio_in_state |= event;
1507 } else {
1508 gpio_in_state &= ~event;
1509 gpio_isr = event;
1510 qemu_irq_raise(irq);
1511 }
24859b68
AZ		 1512 }
1513
1514 kbd_extended = 0;
1515}
1516
24859b68
AZ		 1517static struct arm_boot_info musicpal_binfo = {
1518 .loader_start = 0x0,
1519 .board_id = 0x20e,
1520};
1521
b0f6edb1 1522static void musicpal_init(ram_addr_t ram_size, int vga_ram_size,
3023f332 1523 const char *boot_device,
24859b68
AZ		 1524 const char *kernel_filename, const char *kernel_cmdline,
1525 const char *initrd_filename, const char *cpu_model)
1526{
1527 CPUState *env;
1528 qemu_irq *pic;
1529 int index;
24859b68
AZ		 1530 unsigned long flash_size;
1531
1532 if (!cpu_model)
1533 cpu_model = "arm926";
1534
1535 env = cpu_init(cpu_model);
1536 if (!env) {
1537 fprintf(stderr, "Unable to find CPU definition\n");
1538 exit(1);
1539 }
1540 pic = arm_pic_init_cpu(env);
1541
1542 /* For now we use a fixed - the original - RAM size */
1543 cpu_register_physical_memory(0, MP_RAM_DEFAULT_SIZE,
1544 qemu_ram_alloc(MP_RAM_DEFAULT_SIZE));
1545
1546 sram_off = qemu_ram_alloc(MP_SRAM_SIZE);
1547 cpu_register_physical_memory(MP_SRAM_BASE, MP_SRAM_SIZE, sram_off);
1548
24859b68
AZ		 1549 pic = mv88w8618_pic_init(MP_PIC_BASE, pic[ARM_PIC_CPU_IRQ]);
1550 mv88w8618_pit_init(MP_PIT_BASE, pic, MP_TIMER1_IRQ);
1551
1552 if (serial_hds[0])
b6cd0ea1 1553 serial_mm_init(MP_UART1_BASE, 2, pic[MP_UART1_IRQ], 1825000,
24859b68
AZ		 1554 serial_hds[0], 1);
1555 if (serial_hds[1])
b6cd0ea1 1556 serial_mm_init(MP_UART2_BASE, 2, pic[MP_UART2_IRQ], 1825000,
24859b68
AZ		 1557 serial_hds[1], 1);
1558
1559 /* Register flash */
1560 index = drive_get_index(IF_PFLASH, 0, 0);
1561 if (index != -1) {
1562 flash_size = bdrv_getlength(drives_table[index].bdrv);
1563 if (flash_size != 8*1024*1024 && flash_size != 16*1024*1024 &&
1564 flash_size != 32*1024*1024) {
1565 fprintf(stderr, "Invalid flash image size\n");
1566 exit(1);
1567 }
1568
1569 /*
1570 * The original U-Boot accesses the flash at 0xFE000000 instead of
1571 * 0xFF800000 (if there is 8 MB flash). So remap flash access if the
1572 * image is smaller than 32 MB.
1573 */
1574 pflash_cfi02_register(0-MP_FLASH_SIZE_MAX, qemu_ram_alloc(flash_size),
1575 drives_table[index].bdrv, 0x10000,
1576 (flash_size + 0xffff) >> 16,
1577 MP_FLASH_SIZE_MAX / flash_size,
1578 2, 0x00BF, 0x236D, 0x0000, 0x0000,
1579 0x5555, 0x2AAA);
1580 }
1581 mv88w8618_flashcfg_init(MP_FLASHCFG_BASE);
1582
718ec0be 1583 musicpal_lcd_init();
24859b68
AZ		 1584
1585 qemu_add_kbd_event_handler(musicpal_key_event, pic[MP_GPIO_IRQ]);
1586
24859b68
AZ		 1587 mv88w8618_eth_init(&nd_table[0], MP_ETH_BASE, pic[MP_ETH_IRQ]);
1588
718ec0be 1589 mixer_i2c = musicpal_audio_init(pic[MP_AUDIO_IRQ]);
1590
1591 mv88w8618_wlan_init(MP_WLAN_BASE);
1592
1593 musicpal_misc_init();
1594 musicpal_gpio_init();
24859b68
AZ		 1595
1596 musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
1597 musicpal_binfo.kernel_filename = kernel_filename;
1598 musicpal_binfo.kernel_cmdline = kernel_cmdline;
1599 musicpal_binfo.initrd_filename = initrd_filename;
b0f6edb1 1600 arm_load_kernel(env, &musicpal_binfo);
24859b68
AZ		 1601}
1602
1603QEMUMachine musicpal_machine = {
4b32e168
AL		 1604 .name = "musicpal",
1605 .desc = "Marvell 88w8618 / MusicPal (ARM926EJ-S)",
1606 .init = musicpal_init,
24859b68 1607};
QEMU mirror