2 * Marvell MV88W8618 / Freecom MusicPal emulation.
4 * Copyright (c) 2008 Jan Kiszka
6 * This code is licenced under the GNU GPL v2.
16 #include "qemu-timer.h"
22 #define MP_MISC_BASE 0x80002000
23 #define MP_MISC_SIZE 0x00001000
25 #define MP_ETH_BASE 0x80008000
26 #define MP_ETH_SIZE 0x00001000
28 #define MP_WLAN_BASE 0x8000C000
29 #define MP_WLAN_SIZE 0x00000800
31 #define MP_UART1_BASE 0x8000C840
32 #define MP_UART2_BASE 0x8000C940
34 #define MP_GPIO_BASE 0x8000D000
35 #define MP_GPIO_SIZE 0x00001000
37 #define MP_FLASHCFG_BASE 0x90006000
38 #define MP_FLASHCFG_SIZE 0x00001000
40 #define MP_AUDIO_BASE 0x90007000
42 #define MP_PIC_BASE 0x90008000
43 #define MP_PIC_SIZE 0x00001000
45 #define MP_PIT_BASE 0x90009000
46 #define MP_PIT_SIZE 0x00001000
48 #define MP_LCD_BASE 0x9000c000
49 #define MP_LCD_SIZE 0x00001000
51 #define MP_SRAM_BASE 0xC0000000
52 #define MP_SRAM_SIZE 0x00020000
54 #define MP_RAM_DEFAULT_SIZE 32*1024*1024
55 #define MP_FLASH_SIZE_MAX 32*1024*1024
57 #define MP_TIMER1_IRQ 4
58 #define MP_TIMER2_IRQ 5
59 #define MP_TIMER3_IRQ 6
60 #define MP_TIMER4_IRQ 7
63 #define MP_UART1_IRQ 11
64 #define MP_UART2_IRQ 11
65 #define MP_GPIO_IRQ 12
67 #define MP_AUDIO_IRQ 30
69 /* Wolfson 8750 I2C address */
70 #define MP_WM_ADDR 0x34
72 /* Ethernet register offsets */
73 #define MP_ETH_SMIR 0x010
74 #define MP_ETH_PCXR 0x408
75 #define MP_ETH_SDCMR 0x448
76 #define MP_ETH_ICR 0x450
77 #define MP_ETH_IMR 0x458
78 #define MP_ETH_FRDP0 0x480
79 #define MP_ETH_FRDP1 0x484
80 #define MP_ETH_FRDP2 0x488
81 #define MP_ETH_FRDP3 0x48C
82 #define MP_ETH_CRDP0 0x4A0
83 #define MP_ETH_CRDP1 0x4A4
84 #define MP_ETH_CRDP2 0x4A8
85 #define MP_ETH_CRDP3 0x4AC
86 #define MP_ETH_CTDP0 0x4E0
87 #define MP_ETH_CTDP1 0x4E4
88 #define MP_ETH_CTDP2 0x4E8
89 #define MP_ETH_CTDP3 0x4EC
92 #define MP_ETH_SMIR_DATA 0x0000FFFF
93 #define MP_ETH_SMIR_ADDR 0x03FF0000
94 #define MP_ETH_SMIR_OPCODE (1 << 26) /* Read value */
95 #define MP_ETH_SMIR_RDVALID (1 << 27)
98 #define MP_ETH_PHY1_BMSR 0x00210000
99 #define MP_ETH_PHY1_PHYSID1 0x00410000
100 #define MP_ETH_PHY1_PHYSID2 0x00610000
102 #define MP_PHY_BMSR_LINK 0x0004
103 #define MP_PHY_BMSR_AUTONEG 0x0008
105 #define MP_PHY_88E3015 0x01410E20
107 /* TX descriptor status */
108 #define MP_ETH_TX_OWN (1 << 31)
110 /* RX descriptor status */
111 #define MP_ETH_RX_OWN (1 << 31)
113 /* Interrupt cause/mask bits */
114 #define MP_ETH_IRQ_RX_BIT 0
115 #define MP_ETH_IRQ_RX (1 << MP_ETH_IRQ_RX_BIT)
116 #define MP_ETH_IRQ_TXHI_BIT 2
117 #define MP_ETH_IRQ_TXLO_BIT 3
119 /* Port config bits */
120 #define MP_ETH_PCXR_2BSM_BIT 28 /* 2-byte incoming suffix */
122 /* SDMA command bits */
123 #define MP_ETH_CMD_TXHI (1 << 23)
124 #define MP_ETH_CMD_TXLO (1 << 22)
126 typedef struct mv88w8618_tx_desc
{
134 typedef struct mv88w8618_rx_desc
{
137 uint16_t buffer_size
;
142 typedef struct mv88w8618_eth_state
{
150 uint32_t tx_queue
[2];
151 uint32_t rx_queue
[4];
152 uint32_t frx_queue
[4];
155 } mv88w8618_eth_state
;
157 static void eth_rx_desc_put(uint32_t addr
, mv88w8618_rx_desc
*desc
)
159 cpu_to_le32s(&desc
->cmdstat
);
160 cpu_to_le16s(&desc
->bytes
);
161 cpu_to_le16s(&desc
->buffer_size
);
162 cpu_to_le32s(&desc
->buffer
);
163 cpu_to_le32s(&desc
->next
);
164 cpu_physical_memory_write(addr
, (void *)desc
, sizeof(*desc
));
167 static void eth_rx_desc_get(uint32_t addr
, mv88w8618_rx_desc
*desc
)
169 cpu_physical_memory_read(addr
, (void *)desc
, sizeof(*desc
));
170 le32_to_cpus(&desc
->cmdstat
);
171 le16_to_cpus(&desc
->bytes
);
172 le16_to_cpus(&desc
->buffer_size
);
173 le32_to_cpus(&desc
->buffer
);
174 le32_to_cpus(&desc
->next
);
177 static int eth_can_receive(VLANClientState
*vc
)
182 static ssize_t
eth_receive(VLANClientState
*vc
, const uint8_t *buf
, size_t size
)
184 mv88w8618_eth_state
*s
= vc
->opaque
;
186 mv88w8618_rx_desc desc
;
189 for (i
= 0; i
< 4; i
++) {
190 desc_addr
= s
->cur_rx
[i
];
195 eth_rx_desc_get(desc_addr
, &desc
);
196 if ((desc
.cmdstat
& MP_ETH_RX_OWN
) && desc
.buffer_size
>= size
) {
197 cpu_physical_memory_write(desc
.buffer
+ s
->vlan_header
,
199 desc
.bytes
= size
+ s
->vlan_header
;
200 desc
.cmdstat
&= ~MP_ETH_RX_OWN
;
201 s
->cur_rx
[i
] = desc
.next
;
203 s
->icr
|= MP_ETH_IRQ_RX
;
204 if (s
->icr
& s
->imr
) {
205 qemu_irq_raise(s
->irq
);
207 eth_rx_desc_put(desc_addr
, &desc
);
210 desc_addr
= desc
.next
;
211 } while (desc_addr
!= s
->rx_queue
[i
]);
216 static void eth_tx_desc_put(uint32_t addr
, mv88w8618_tx_desc
*desc
)
218 cpu_to_le32s(&desc
->cmdstat
);
219 cpu_to_le16s(&desc
->res
);
220 cpu_to_le16s(&desc
->bytes
);
221 cpu_to_le32s(&desc
->buffer
);
222 cpu_to_le32s(&desc
->next
);
223 cpu_physical_memory_write(addr
, (void *)desc
, sizeof(*desc
));
226 static void eth_tx_desc_get(uint32_t addr
, mv88w8618_tx_desc
*desc
)
228 cpu_physical_memory_read(addr
, (void *)desc
, sizeof(*desc
));
229 le32_to_cpus(&desc
->cmdstat
);
230 le16_to_cpus(&desc
->res
);
231 le16_to_cpus(&desc
->bytes
);
232 le32_to_cpus(&desc
->buffer
);
233 le32_to_cpus(&desc
->next
);
236 static void eth_send(mv88w8618_eth_state
*s
, int queue_index
)
238 uint32_t desc_addr
= s
->tx_queue
[queue_index
];
239 mv88w8618_tx_desc desc
;
247 eth_tx_desc_get(desc_addr
, &desc
);
248 if (desc
.cmdstat
& MP_ETH_TX_OWN
) {
251 cpu_physical_memory_read(desc
.buffer
, buf
, len
);
252 qemu_send_packet(s
->vc
, buf
, len
);
254 desc
.cmdstat
&= ~MP_ETH_TX_OWN
;
255 s
->icr
|= 1 << (MP_ETH_IRQ_TXLO_BIT
- queue_index
);
256 eth_tx_desc_put(desc_addr
, &desc
);
258 desc_addr
= desc
.next
;
259 } while (desc_addr
!= s
->tx_queue
[queue_index
]);
262 static uint32_t mv88w8618_eth_read(void *opaque
, target_phys_addr_t offset
)
264 mv88w8618_eth_state
*s
= opaque
;
268 if (s
->smir
& MP_ETH_SMIR_OPCODE
) {
269 switch (s
->smir
& MP_ETH_SMIR_ADDR
) {
270 case MP_ETH_PHY1_BMSR
:
271 return MP_PHY_BMSR_LINK
| MP_PHY_BMSR_AUTONEG
|
273 case MP_ETH_PHY1_PHYSID1
:
274 return (MP_PHY_88E3015
>> 16) | MP_ETH_SMIR_RDVALID
;
275 case MP_ETH_PHY1_PHYSID2
:
276 return (MP_PHY_88E3015
& 0xFFFF) | MP_ETH_SMIR_RDVALID
;
278 return MP_ETH_SMIR_RDVALID
;
289 case MP_ETH_FRDP0
... MP_ETH_FRDP3
:
290 return s
->frx_queue
[(offset
- MP_ETH_FRDP0
)/4];
292 case MP_ETH_CRDP0
... MP_ETH_CRDP3
:
293 return s
->rx_queue
[(offset
- MP_ETH_CRDP0
)/4];
295 case MP_ETH_CTDP0
... MP_ETH_CTDP3
:
296 return s
->tx_queue
[(offset
- MP_ETH_CTDP0
)/4];
303 static void mv88w8618_eth_write(void *opaque
, target_phys_addr_t offset
,
306 mv88w8618_eth_state
*s
= opaque
;
314 s
->vlan_header
= ((value
>> MP_ETH_PCXR_2BSM_BIT
) & 1) * 2;
318 if (value
& MP_ETH_CMD_TXHI
) {
321 if (value
& MP_ETH_CMD_TXLO
) {
324 if (value
& (MP_ETH_CMD_TXHI
| MP_ETH_CMD_TXLO
) && s
->icr
& s
->imr
) {
325 qemu_irq_raise(s
->irq
);
335 if (s
->icr
& s
->imr
) {
336 qemu_irq_raise(s
->irq
);
340 case MP_ETH_FRDP0
... MP_ETH_FRDP3
:
341 s
->frx_queue
[(offset
- MP_ETH_FRDP0
)/4] = value
;
344 case MP_ETH_CRDP0
... MP_ETH_CRDP3
:
345 s
->rx_queue
[(offset
- MP_ETH_CRDP0
)/4] =
346 s
->cur_rx
[(offset
- MP_ETH_CRDP0
)/4] = value
;
349 case MP_ETH_CTDP0
... MP_ETH_CTDP3
:
350 s
->tx_queue
[(offset
- MP_ETH_CTDP0
)/4] = value
;
355 static CPUReadMemoryFunc
* const mv88w8618_eth_readfn
[] = {
361 static CPUWriteMemoryFunc
* const mv88w8618_eth_writefn
[] = {
367 static void eth_cleanup(VLANClientState
*vc
)
369 mv88w8618_eth_state
*s
= vc
->opaque
;
371 cpu_unregister_io_memory(s
->mmio_index
);
376 static int mv88w8618_eth_init(SysBusDevice
*dev
)
378 mv88w8618_eth_state
*s
= FROM_SYSBUS(mv88w8618_eth_state
, dev
);
380 sysbus_init_irq(dev
, &s
->irq
);
381 s
->vc
= qdev_get_vlan_client(&dev
->qdev
,
382 eth_can_receive
, eth_receive
, NULL
,
384 s
->mmio_index
= cpu_register_io_memory(mv88w8618_eth_readfn
,
385 mv88w8618_eth_writefn
, s
);
386 sysbus_init_mmio(dev
, MP_ETH_SIZE
, s
->mmio_index
);
390 /* LCD register offsets */
391 #define MP_LCD_IRQCTRL 0x180
392 #define MP_LCD_IRQSTAT 0x184
393 #define MP_LCD_SPICTRL 0x1ac
394 #define MP_LCD_INST 0x1bc
395 #define MP_LCD_DATA 0x1c0
398 #define MP_LCD_SPI_DATA 0x00100011
399 #define MP_LCD_SPI_CMD 0x00104011
400 #define MP_LCD_SPI_INVALID 0x00000000
403 #define MP_LCD_INST_SETPAGE0 0xB0
405 #define MP_LCD_INST_SETPAGE7 0xB7
407 #define MP_LCD_TEXTCOLOR 0xe0e0ff /* RRGGBB */
409 typedef struct musicpal_lcd_state
{
417 uint8_t video_ram
[128*64/8];
418 } musicpal_lcd_state
;
420 static uint8_t scale_lcd_color(musicpal_lcd_state
*s
, uint8_t col
)
422 switch (s
->brightness
) {
428 return (col
* s
->brightness
) / 7;
432 #define SET_LCD_PIXEL(depth, type) \
433 static inline void glue(set_lcd_pixel, depth) \
434 (musicpal_lcd_state *s, int x, int y, type col) \
437 type *pixel = &((type *) ds_get_data(s->ds))[(y * 128 * 3 + x) * 3]; \
439 for (dy = 0; dy < 3; dy++, pixel += 127 * 3) \
440 for (dx = 0; dx < 3; dx++, pixel++) \
443 SET_LCD_PIXEL(8, uint8_t)
444 SET_LCD_PIXEL(16, uint16_t)
445 SET_LCD_PIXEL(32, uint32_t)
447 #include "pixel_ops.h"
449 static void lcd_refresh(void *opaque
)
451 musicpal_lcd_state
*s
= opaque
;
454 switch (ds_get_bits_per_pixel(s
->ds
)) {
457 #define LCD_REFRESH(depth, func) \
459 col = func(scale_lcd_color(s, (MP_LCD_TEXTCOLOR >> 16) & 0xff), \
460 scale_lcd_color(s, (MP_LCD_TEXTCOLOR >> 8) & 0xff), \
461 scale_lcd_color(s, MP_LCD_TEXTCOLOR & 0xff)); \
462 for (x = 0; x < 128; x++) { \
463 for (y = 0; y < 64; y++) { \
464 if (s->video_ram[x + (y/8)*128] & (1 << (y % 8))) { \
465 glue(set_lcd_pixel, depth)(s, x, y, col); \
467 glue(set_lcd_pixel, depth)(s, x, y, 0); \
472 LCD_REFRESH(8, rgb_to_pixel8
)
473 LCD_REFRESH(16, rgb_to_pixel16
)
474 LCD_REFRESH(32, (is_surface_bgr(s
->ds
->surface
) ?
475 rgb_to_pixel32bgr
: rgb_to_pixel32
))
477 hw_error("unsupported colour depth %i\n",
478 ds_get_bits_per_pixel(s
->ds
));
481 dpy_update(s
->ds
, 0, 0, 128*3, 64*3);
484 static void lcd_invalidate(void *opaque
)
488 static void musicpal_lcd_gpio_brigthness_in(void *opaque
, int irq
, int level
)
490 musicpal_lcd_state
*s
= opaque
;
491 s
->brightness
&= ~(1 << irq
);
492 s
->brightness
|= level
<< irq
;
495 static uint32_t musicpal_lcd_read(void *opaque
, target_phys_addr_t offset
)
497 musicpal_lcd_state
*s
= opaque
;
508 static void musicpal_lcd_write(void *opaque
, target_phys_addr_t offset
,
511 musicpal_lcd_state
*s
= opaque
;
519 if (value
== MP_LCD_SPI_DATA
|| value
== MP_LCD_SPI_CMD
) {
522 s
->mode
= MP_LCD_SPI_INVALID
;
527 if (value
>= MP_LCD_INST_SETPAGE0
&& value
<= MP_LCD_INST_SETPAGE7
) {
528 s
->page
= value
- MP_LCD_INST_SETPAGE0
;
534 if (s
->mode
== MP_LCD_SPI_CMD
) {
535 if (value
>= MP_LCD_INST_SETPAGE0
&&
536 value
<= MP_LCD_INST_SETPAGE7
) {
537 s
->page
= value
- MP_LCD_INST_SETPAGE0
;
540 } else if (s
->mode
== MP_LCD_SPI_DATA
) {
541 s
->video_ram
[s
->page
*128 + s
->page_off
] = value
;
542 s
->page_off
= (s
->page_off
+ 1) & 127;
548 static CPUReadMemoryFunc
* const musicpal_lcd_readfn
[] = {
554 static CPUWriteMemoryFunc
* const musicpal_lcd_writefn
[] = {
560 static int musicpal_lcd_init(SysBusDevice
*dev
)
562 musicpal_lcd_state
*s
= FROM_SYSBUS(musicpal_lcd_state
, dev
);
567 iomemtype
= cpu_register_io_memory(musicpal_lcd_readfn
,
568 musicpal_lcd_writefn
, s
);
569 sysbus_init_mmio(dev
, MP_LCD_SIZE
, iomemtype
);
571 s
->ds
= graphic_console_init(lcd_refresh
, lcd_invalidate
,
573 qemu_console_resize(s
->ds
, 128*3, 64*3);
575 qdev_init_gpio_in(&dev
->qdev
, musicpal_lcd_gpio_brigthness_in
, 3);
580 /* PIC register offsets */
581 #define MP_PIC_STATUS 0x00
582 #define MP_PIC_ENABLE_SET 0x08
583 #define MP_PIC_ENABLE_CLR 0x0C
585 typedef struct mv88w8618_pic_state
591 } mv88w8618_pic_state
;
593 static void mv88w8618_pic_update(mv88w8618_pic_state
*s
)
595 qemu_set_irq(s
->parent_irq
, (s
->level
& s
->enabled
));
598 static void mv88w8618_pic_set_irq(void *opaque
, int irq
, int level
)
600 mv88w8618_pic_state
*s
= opaque
;
603 s
->level
|= 1 << irq
;
605 s
->level
&= ~(1 << irq
);
607 mv88w8618_pic_update(s
);
610 static uint32_t mv88w8618_pic_read(void *opaque
, target_phys_addr_t offset
)
612 mv88w8618_pic_state
*s
= opaque
;
616 return s
->level
& s
->enabled
;
623 static void mv88w8618_pic_write(void *opaque
, target_phys_addr_t offset
,
626 mv88w8618_pic_state
*s
= opaque
;
629 case MP_PIC_ENABLE_SET
:
633 case MP_PIC_ENABLE_CLR
:
634 s
->enabled
&= ~value
;
638 mv88w8618_pic_update(s
);
641 static void mv88w8618_pic_reset(void *opaque
)
643 mv88w8618_pic_state
*s
= opaque
;
649 static CPUReadMemoryFunc
* const mv88w8618_pic_readfn
[] = {
655 static CPUWriteMemoryFunc
* const mv88w8618_pic_writefn
[] = {
661 static int mv88w8618_pic_init(SysBusDevice
*dev
)
663 mv88w8618_pic_state
*s
= FROM_SYSBUS(mv88w8618_pic_state
, dev
);
666 qdev_init_gpio_in(&dev
->qdev
, mv88w8618_pic_set_irq
, 32);
667 sysbus_init_irq(dev
, &s
->parent_irq
);
668 iomemtype
= cpu_register_io_memory(mv88w8618_pic_readfn
,
669 mv88w8618_pic_writefn
, s
);
670 sysbus_init_mmio(dev
, MP_PIC_SIZE
, iomemtype
);
672 qemu_register_reset(mv88w8618_pic_reset
, s
);
676 /* PIT register offsets */
677 #define MP_PIT_TIMER1_LENGTH 0x00
679 #define MP_PIT_TIMER4_LENGTH 0x0C
680 #define MP_PIT_CONTROL 0x10
681 #define MP_PIT_TIMER1_VALUE 0x14
683 #define MP_PIT_TIMER4_VALUE 0x20
684 #define MP_BOARD_RESET 0x34
686 /* Magic board reset value (probably some watchdog behind it) */
687 #define MP_BOARD_RESET_MAGIC 0x10000
689 typedef struct mv88w8618_timer_state
{
690 ptimer_state
*ptimer
;
694 } mv88w8618_timer_state
;
696 typedef struct mv88w8618_pit_state
{
698 mv88w8618_timer_state timer
[4];
699 } mv88w8618_pit_state
;
701 static void mv88w8618_timer_tick(void *opaque
)
703 mv88w8618_timer_state
*s
= opaque
;
705 qemu_irq_raise(s
->irq
);
708 static void mv88w8618_timer_init(SysBusDevice
*dev
, mv88w8618_timer_state
*s
,
713 sysbus_init_irq(dev
, &s
->irq
);
716 bh
= qemu_bh_new(mv88w8618_timer_tick
, s
);
717 s
->ptimer
= ptimer_init(bh
);
720 static uint32_t mv88w8618_pit_read(void *opaque
, target_phys_addr_t offset
)
722 mv88w8618_pit_state
*s
= opaque
;
723 mv88w8618_timer_state
*t
;
726 case MP_PIT_TIMER1_VALUE
... MP_PIT_TIMER4_VALUE
:
727 t
= &s
->timer
[(offset
-MP_PIT_TIMER1_VALUE
) >> 2];
728 return ptimer_get_count(t
->ptimer
);
735 static void mv88w8618_pit_write(void *opaque
, target_phys_addr_t offset
,
738 mv88w8618_pit_state
*s
= opaque
;
739 mv88w8618_timer_state
*t
;
743 case MP_PIT_TIMER1_LENGTH
... MP_PIT_TIMER4_LENGTH
:
744 t
= &s
->timer
[offset
>> 2];
747 ptimer_set_limit(t
->ptimer
, t
->limit
, 1);
749 ptimer_stop(t
->ptimer
);
754 for (i
= 0; i
< 4; i
++) {
756 if (value
& 0xf && t
->limit
> 0) {
757 ptimer_set_limit(t
->ptimer
, t
->limit
, 0);
758 ptimer_set_freq(t
->ptimer
, t
->freq
);
759 ptimer_run(t
->ptimer
, 0);
761 ptimer_stop(t
->ptimer
);
768 if (value
== MP_BOARD_RESET_MAGIC
) {
769 qemu_system_reset_request();
775 static void mv88w8618_pit_reset(void *opaque
)
777 mv88w8618_pit_state
*s
= opaque
;
780 for (i
= 0; i
< 4; i
++) {
781 ptimer_stop(s
->timer
[i
].ptimer
);
782 s
->timer
[i
].limit
= 0;
786 static CPUReadMemoryFunc
* const mv88w8618_pit_readfn
[] = {
792 static CPUWriteMemoryFunc
* const mv88w8618_pit_writefn
[] = {
798 static int mv88w8618_pit_init(SysBusDevice
*dev
)
801 mv88w8618_pit_state
*s
= FROM_SYSBUS(mv88w8618_pit_state
, dev
);
804 /* Letting them all run at 1 MHz is likely just a pragmatic
806 for (i
= 0; i
< 4; i
++) {
807 mv88w8618_timer_init(dev
, &s
->timer
[i
], 1000000);
810 iomemtype
= cpu_register_io_memory(mv88w8618_pit_readfn
,
811 mv88w8618_pit_writefn
, s
);
812 sysbus_init_mmio(dev
, MP_PIT_SIZE
, iomemtype
);
816 static SysBusDeviceInfo mv88w8618_pit_info
= {
817 .init
= mv88w8618_pit_init
,
818 .qdev
.name
= "mv88w8618_pit",
819 .qdev
.size
= sizeof(mv88w8618_pit_state
),
820 .qdev
.reset
= mv88w8618_pit_reset
,
823 /* Flash config register offsets */
824 #define MP_FLASHCFG_CFGR0 0x04
826 typedef struct mv88w8618_flashcfg_state
{
829 } mv88w8618_flashcfg_state
;
831 static uint32_t mv88w8618_flashcfg_read(void *opaque
,
832 target_phys_addr_t offset
)
834 mv88w8618_flashcfg_state
*s
= opaque
;
837 case MP_FLASHCFG_CFGR0
:
845 static void mv88w8618_flashcfg_write(void *opaque
, target_phys_addr_t offset
,
848 mv88w8618_flashcfg_state
*s
= opaque
;
851 case MP_FLASHCFG_CFGR0
:
857 static CPUReadMemoryFunc
* const mv88w8618_flashcfg_readfn
[] = {
858 mv88w8618_flashcfg_read
,
859 mv88w8618_flashcfg_read
,
860 mv88w8618_flashcfg_read
863 static CPUWriteMemoryFunc
* const mv88w8618_flashcfg_writefn
[] = {
864 mv88w8618_flashcfg_write
,
865 mv88w8618_flashcfg_write
,
866 mv88w8618_flashcfg_write
869 static int mv88w8618_flashcfg_init(SysBusDevice
*dev
)
872 mv88w8618_flashcfg_state
*s
= FROM_SYSBUS(mv88w8618_flashcfg_state
, dev
);
874 s
->cfgr0
= 0xfffe4285; /* Default as set by U-Boot for 8 MB flash */
875 iomemtype
= cpu_register_io_memory(mv88w8618_flashcfg_readfn
,
876 mv88w8618_flashcfg_writefn
, s
);
877 sysbus_init_mmio(dev
, MP_FLASHCFG_SIZE
, iomemtype
);
881 /* Misc register offsets */
882 #define MP_MISC_BOARD_REVISION 0x18
884 #define MP_BOARD_REVISION 0x31
886 static uint32_t musicpal_misc_read(void *opaque
, target_phys_addr_t offset
)
889 case MP_MISC_BOARD_REVISION
:
890 return MP_BOARD_REVISION
;
897 static void musicpal_misc_write(void *opaque
, target_phys_addr_t offset
,
902 static CPUReadMemoryFunc
* const musicpal_misc_readfn
[] = {
908 static CPUWriteMemoryFunc
* const musicpal_misc_writefn
[] = {
914 static void musicpal_misc_init(void)
918 iomemtype
= cpu_register_io_memory(musicpal_misc_readfn
,
919 musicpal_misc_writefn
, NULL
);
920 cpu_register_physical_memory(MP_MISC_BASE
, MP_MISC_SIZE
, iomemtype
);
923 /* WLAN register offsets */
924 #define MP_WLAN_MAGIC1 0x11c
925 #define MP_WLAN_MAGIC2 0x124
927 static uint32_t mv88w8618_wlan_read(void *opaque
, target_phys_addr_t offset
)
930 /* Workaround to allow loading the binary-only wlandrv.ko crap
931 * from the original Freecom firmware. */
942 static void mv88w8618_wlan_write(void *opaque
, target_phys_addr_t offset
,
947 static CPUReadMemoryFunc
* const mv88w8618_wlan_readfn
[] = {
953 static CPUWriteMemoryFunc
* const mv88w8618_wlan_writefn
[] = {
954 mv88w8618_wlan_write
,
955 mv88w8618_wlan_write
,
956 mv88w8618_wlan_write
,
959 static int mv88w8618_wlan_init(SysBusDevice
*dev
)
963 iomemtype
= cpu_register_io_memory(mv88w8618_wlan_readfn
,
964 mv88w8618_wlan_writefn
, NULL
);
965 sysbus_init_mmio(dev
, MP_WLAN_SIZE
, iomemtype
);
969 /* GPIO register offsets */
970 #define MP_GPIO_OE_LO 0x008
971 #define MP_GPIO_OUT_LO 0x00c
972 #define MP_GPIO_IN_LO 0x010
973 #define MP_GPIO_IER_LO 0x014
974 #define MP_GPIO_IMR_LO 0x018
975 #define MP_GPIO_ISR_LO 0x020
976 #define MP_GPIO_OE_HI 0x508
977 #define MP_GPIO_OUT_HI 0x50c
978 #define MP_GPIO_IN_HI 0x510
979 #define MP_GPIO_IER_HI 0x514
980 #define MP_GPIO_IMR_HI 0x518
981 #define MP_GPIO_ISR_HI 0x520
983 /* GPIO bits & masks */
984 #define MP_GPIO_LCD_BRIGHTNESS 0x00070000
985 #define MP_GPIO_I2C_DATA_BIT 29
986 #define MP_GPIO_I2C_CLOCK_BIT 30
988 /* LCD brightness bits in GPIO_OE_HI */
989 #define MP_OE_LCD_BRIGHTNESS 0x0007
991 typedef struct musicpal_gpio_state
{
993 uint32_t lcd_brightness
;
1000 qemu_irq out
[5]; /* 3 brightness out + 2 lcd (data and clock ) */
1001 } musicpal_gpio_state
;
1003 static void musicpal_gpio_brightness_update(musicpal_gpio_state
*s
) {
1005 uint32_t brightness
;
1007 /* compute brightness ratio */
1008 switch (s
->lcd_brightness
) {
1042 /* set lcd brightness GPIOs */
1043 for (i
= 0; i
<= 2; i
++) {
1044 qemu_set_irq(s
->out
[i
], (brightness
>> i
) & 1);
1048 static void musicpal_gpio_pin_event(void *opaque
, int pin
, int level
)
1050 musicpal_gpio_state
*s
= opaque
;
1051 uint32_t mask
= 1 << pin
;
1052 uint32_t delta
= level
<< pin
;
1053 uint32_t old
= s
->in_state
& mask
;
1055 s
->in_state
&= ~mask
;
1056 s
->in_state
|= delta
;
1058 if ((old
^ delta
) &&
1059 ((level
&& (s
->imr
& mask
)) || (!level
&& (s
->ier
& mask
)))) {
1061 qemu_irq_raise(s
->irq
);
1065 static uint32_t musicpal_gpio_read(void *opaque
, target_phys_addr_t offset
)
1067 musicpal_gpio_state
*s
= opaque
;
1070 case MP_GPIO_OE_HI
: /* used for LCD brightness control */
1071 return s
->lcd_brightness
& MP_OE_LCD_BRIGHTNESS
;
1073 case MP_GPIO_OUT_LO
:
1074 return s
->out_state
& 0xFFFF;
1075 case MP_GPIO_OUT_HI
:
1076 return s
->out_state
>> 16;
1079 return s
->in_state
& 0xFFFF;
1081 return s
->in_state
>> 16;
1083 case MP_GPIO_IER_LO
:
1084 return s
->ier
& 0xFFFF;
1085 case MP_GPIO_IER_HI
:
1086 return s
->ier
>> 16;
1088 case MP_GPIO_IMR_LO
:
1089 return s
->imr
& 0xFFFF;
1090 case MP_GPIO_IMR_HI
:
1091 return s
->imr
>> 16;
1093 case MP_GPIO_ISR_LO
:
1094 return s
->isr
& 0xFFFF;
1095 case MP_GPIO_ISR_HI
:
1096 return s
->isr
>> 16;
1103 static void musicpal_gpio_write(void *opaque
, target_phys_addr_t offset
,
1106 musicpal_gpio_state
*s
= opaque
;
1108 case MP_GPIO_OE_HI
: /* used for LCD brightness control */
1109 s
->lcd_brightness
= (s
->lcd_brightness
& MP_GPIO_LCD_BRIGHTNESS
) |
1110 (value
& MP_OE_LCD_BRIGHTNESS
);
1111 musicpal_gpio_brightness_update(s
);
1114 case MP_GPIO_OUT_LO
:
1115 s
->out_state
= (s
->out_state
& 0xFFFF0000) | (value
& 0xFFFF);
1117 case MP_GPIO_OUT_HI
:
1118 s
->out_state
= (s
->out_state
& 0xFFFF) | (value
<< 16);
1119 s
->lcd_brightness
= (s
->lcd_brightness
& 0xFFFF) |
1120 (s
->out_state
& MP_GPIO_LCD_BRIGHTNESS
);
1121 musicpal_gpio_brightness_update(s
);
1122 qemu_set_irq(s
->out
[3], (s
->out_state
>> MP_GPIO_I2C_DATA_BIT
) & 1);
1123 qemu_set_irq(s
->out
[4], (s
->out_state
>> MP_GPIO_I2C_CLOCK_BIT
) & 1);
1126 case MP_GPIO_IER_LO
:
1127 s
->ier
= (s
->ier
& 0xFFFF0000) | (value
& 0xFFFF);
1129 case MP_GPIO_IER_HI
:
1130 s
->ier
= (s
->ier
& 0xFFFF) | (value
<< 16);
1133 case MP_GPIO_IMR_LO
:
1134 s
->imr
= (s
->imr
& 0xFFFF0000) | (value
& 0xFFFF);
1136 case MP_GPIO_IMR_HI
:
1137 s
->imr
= (s
->imr
& 0xFFFF) | (value
<< 16);
1142 static CPUReadMemoryFunc
* const musicpal_gpio_readfn
[] = {
1148 static CPUWriteMemoryFunc
* const musicpal_gpio_writefn
[] = {
1149 musicpal_gpio_write
,
1150 musicpal_gpio_write
,
1151 musicpal_gpio_write
,
1154 static void musicpal_gpio_reset(void *opaque
)
1156 musicpal_gpio_state
*s
= opaque
;
1158 s
->lcd_brightness
= 0;
1160 s
->in_state
= 0xffffffff;
1166 static int musicpal_gpio_init(SysBusDevice
*dev
)
1168 musicpal_gpio_state
*s
= FROM_SYSBUS(musicpal_gpio_state
, dev
);
1171 sysbus_init_irq(dev
, &s
->irq
);
1173 iomemtype
= cpu_register_io_memory(musicpal_gpio_readfn
,
1174 musicpal_gpio_writefn
, s
);
1175 sysbus_init_mmio(dev
, MP_GPIO_SIZE
, iomemtype
);
1177 qemu_register_reset(musicpal_gpio_reset
, s
);
1178 musicpal_gpio_reset(s
);
1180 qdev_init_gpio_out(&dev
->qdev
, s
->out
, ARRAY_SIZE(s
->out
));
1182 qdev_init_gpio_in(&dev
->qdev
, musicpal_gpio_pin_event
, 32);
1187 static SysBusDeviceInfo musicpal_gpio_info
= {
1188 .init
= musicpal_gpio_init
,
1189 .qdev
.name
= "musicpal_gpio",
1190 .qdev
.size
= sizeof(musicpal_gpio_state
),
1191 .qdev
.reset
= musicpal_gpio_reset
,
1194 /* Keyboard codes & masks */
1195 #define KEY_RELEASED 0x80
1196 #define KEY_CODE 0x7f
1198 #define KEYCODE_TAB 0x0f
1199 #define KEYCODE_ENTER 0x1c
1200 #define KEYCODE_F 0x21
1201 #define KEYCODE_M 0x32
1203 #define KEYCODE_EXTENDED 0xe0
1204 #define KEYCODE_UP 0x48
1205 #define KEYCODE_DOWN 0x50
1206 #define KEYCODE_LEFT 0x4b
1207 #define KEYCODE_RIGHT 0x4d
1209 #define MP_KEY_WHEEL_VOL (1 << 0)
1210 #define MP_KEY_WHEEL_VOL_INV (1 << 1)
1211 #define MP_KEY_WHEEL_NAV (1 << 2)
1212 #define MP_KEY_WHEEL_NAV_INV (1 << 3)
1213 #define MP_KEY_BTN_FAVORITS (1 << 4)
1214 #define MP_KEY_BTN_MENU (1 << 5)
1215 #define MP_KEY_BTN_VOLUME (1 << 6)
1216 #define MP_KEY_BTN_NAVIGATION (1 << 7)
1218 typedef struct musicpal_key_state
{
1219 SysBusDevice busdev
;
1220 uint32_t kbd_extended
;
1221 uint32_t pressed_keys
;
1223 } musicpal_key_state
;
1225 static void musicpal_key_event(void *opaque
, int keycode
)
1227 musicpal_key_state
*s
= opaque
;
1231 if (keycode
== KEYCODE_EXTENDED
) {
1232 s
->kbd_extended
= 1;
1236 if (s
->kbd_extended
) {
1237 switch (keycode
& KEY_CODE
) {
1239 event
= MP_KEY_WHEEL_NAV
| MP_KEY_WHEEL_NAV_INV
;
1243 event
= MP_KEY_WHEEL_NAV
;
1247 event
= MP_KEY_WHEEL_VOL
| MP_KEY_WHEEL_VOL_INV
;
1251 event
= MP_KEY_WHEEL_VOL
;
1255 switch (keycode
& KEY_CODE
) {
1257 event
= MP_KEY_BTN_FAVORITS
;
1261 event
= MP_KEY_BTN_VOLUME
;
1265 event
= MP_KEY_BTN_NAVIGATION
;
1269 event
= MP_KEY_BTN_MENU
;
1272 /* Do not repeat already pressed buttons */
1273 if (!(keycode
& KEY_RELEASED
) && (s
->pressed_keys
& event
)) {
1279 /* Raise GPIO pin first if repeating a key */
1280 if (!(keycode
& KEY_RELEASED
) && (s
->pressed_keys
& event
)) {
1281 for (i
= 0; i
<= 7; i
++) {
1282 if (event
& (1 << i
)) {
1283 qemu_set_irq(s
->out
[i
], 1);
1287 for (i
= 0; i
<= 7; i
++) {
1288 if (event
& (1 << i
)) {
1289 qemu_set_irq(s
->out
[i
], !!(keycode
& KEY_RELEASED
));
1292 if (keycode
& KEY_RELEASED
) {
1293 s
->pressed_keys
&= ~event
;
1295 s
->pressed_keys
|= event
;
1299 s
->kbd_extended
= 0;
1302 static int musicpal_key_init(SysBusDevice
*dev
)
1304 musicpal_key_state
*s
= FROM_SYSBUS(musicpal_key_state
, dev
);
1306 sysbus_init_mmio(dev
, 0x0, 0);
1308 s
->kbd_extended
= 0;
1309 s
->pressed_keys
= 0;
1311 qdev_init_gpio_out(&dev
->qdev
, s
->out
, ARRAY_SIZE(s
->out
));
1313 qemu_add_kbd_event_handler(musicpal_key_event
, s
);
1318 static struct arm_boot_info musicpal_binfo
= {
1319 .loader_start
= 0x0,
1323 static void musicpal_init(ram_addr_t ram_size
,
1324 const char *boot_device
,
1325 const char *kernel_filename
, const char *kernel_cmdline
,
1326 const char *initrd_filename
, const char *cpu_model
)
1332 DeviceState
*i2c_dev
;
1333 DeviceState
*lcd_dev
;
1334 DeviceState
*key_dev
;
1336 DeviceState
*wm8750_dev
;
1341 unsigned long flash_size
;
1343 ram_addr_t sram_off
;
1346 cpu_model
= "arm926";
1348 env
= cpu_init(cpu_model
);
1350 fprintf(stderr
, "Unable to find CPU definition\n");
1353 cpu_pic
= arm_pic_init_cpu(env
);
1355 /* For now we use a fixed - the original - RAM size */
1356 cpu_register_physical_memory(0, MP_RAM_DEFAULT_SIZE
,
1357 qemu_ram_alloc(MP_RAM_DEFAULT_SIZE
));
1359 sram_off
= qemu_ram_alloc(MP_SRAM_SIZE
);
1360 cpu_register_physical_memory(MP_SRAM_BASE
, MP_SRAM_SIZE
, sram_off
);
1362 dev
= sysbus_create_simple("mv88w8618_pic", MP_PIC_BASE
,
1363 cpu_pic
[ARM_PIC_CPU_IRQ
]);
1364 for (i
= 0; i
< 32; i
++) {
1365 pic
[i
] = qdev_get_gpio_in(dev
, i
);
1367 sysbus_create_varargs("mv88w8618_pit", MP_PIT_BASE
, pic
[MP_TIMER1_IRQ
],
1368 pic
[MP_TIMER2_IRQ
], pic
[MP_TIMER3_IRQ
],
1369 pic
[MP_TIMER4_IRQ
], NULL
);
1371 if (serial_hds
[0]) {
1372 serial_mm_init(MP_UART1_BASE
, 2, pic
[MP_UART1_IRQ
], 1825000,
1375 if (serial_hds
[1]) {
1376 serial_mm_init(MP_UART2_BASE
, 2, pic
[MP_UART2_IRQ
], 1825000,
1380 /* Register flash */
1381 dinfo
= drive_get(IF_PFLASH
, 0, 0);
1383 flash_size
= bdrv_getlength(dinfo
->bdrv
);
1384 if (flash_size
!= 8*1024*1024 && flash_size
!= 16*1024*1024 &&
1385 flash_size
!= 32*1024*1024) {
1386 fprintf(stderr
, "Invalid flash image size\n");
1391 * The original U-Boot accesses the flash at 0xFE000000 instead of
1392 * 0xFF800000 (if there is 8 MB flash). So remap flash access if the
1393 * image is smaller than 32 MB.
1395 pflash_cfi02_register(0-MP_FLASH_SIZE_MAX
, qemu_ram_alloc(flash_size
),
1396 dinfo
->bdrv
, 0x10000,
1397 (flash_size
+ 0xffff) >> 16,
1398 MP_FLASH_SIZE_MAX
/ flash_size
,
1399 2, 0x00BF, 0x236D, 0x0000, 0x0000,
1402 sysbus_create_simple("mv88w8618_flashcfg", MP_FLASHCFG_BASE
, NULL
);
1404 qemu_check_nic_model(&nd_table
[0], "mv88w8618");
1405 dev
= qdev_create(NULL
, "mv88w8618_eth");
1406 dev
->nd
= &nd_table
[0];
1408 sysbus_mmio_map(sysbus_from_qdev(dev
), 0, MP_ETH_BASE
);
1409 sysbus_connect_irq(sysbus_from_qdev(dev
), 0, pic
[MP_ETH_IRQ
]);
1411 sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE
, NULL
);
1413 musicpal_misc_init();
1415 dev
= sysbus_create_simple("musicpal_gpio", MP_GPIO_BASE
, pic
[MP_GPIO_IRQ
]);
1416 i2c_dev
= sysbus_create_simple("bitbang_i2c", 0, NULL
);
1417 i2c
= (i2c_bus
*)qdev_get_child_bus(i2c_dev
, "i2c");
1419 lcd_dev
= sysbus_create_simple("musicpal_lcd", MP_LCD_BASE
, NULL
);
1420 key_dev
= sysbus_create_simple("musicpal_key", 0, NULL
);
1423 qdev_connect_gpio_out(i2c_dev
, 0,
1424 qdev_get_gpio_in(dev
, MP_GPIO_I2C_DATA_BIT
));
1426 qdev_connect_gpio_out(dev
, 3, qdev_get_gpio_in(i2c_dev
, 0));
1428 qdev_connect_gpio_out(dev
, 4, qdev_get_gpio_in(i2c_dev
, 1));
1430 for (i
= 0; i
< 3; i
++) {
1431 qdev_connect_gpio_out(dev
, i
, qdev_get_gpio_in(lcd_dev
, i
));
1433 for (i
= 0; i
< 4; i
++) {
1434 qdev_connect_gpio_out(key_dev
, i
, qdev_get_gpio_in(dev
, i
+ 8));
1436 for (i
= 4; i
< 8; i
++) {
1437 qdev_connect_gpio_out(key_dev
, i
, qdev_get_gpio_in(dev
, i
+ 15));
1441 wm8750_dev
= i2c_create_slave(i2c
, "wm8750", MP_WM_ADDR
);
1442 dev
= qdev_create(NULL
, "mv88w8618_audio");
1443 s
= sysbus_from_qdev(dev
);
1444 qdev_prop_set_ptr(dev
, "wm8750", wm8750_dev
);
1446 sysbus_mmio_map(s
, 0, MP_AUDIO_BASE
);
1447 sysbus_connect_irq(s
, 0, pic
[MP_AUDIO_IRQ
]);
1450 musicpal_binfo
.ram_size
= MP_RAM_DEFAULT_SIZE
;
1451 musicpal_binfo
.kernel_filename
= kernel_filename
;
1452 musicpal_binfo
.kernel_cmdline
= kernel_cmdline
;
1453 musicpal_binfo
.initrd_filename
= initrd_filename
;
1454 arm_load_kernel(env
, &musicpal_binfo
);
1457 static QEMUMachine musicpal_machine
= {
1459 .desc
= "Marvell 88w8618 / MusicPal (ARM926EJ-S)",
1460 .init
= musicpal_init
,
1463 static void musicpal_machine_init(void)
1465 qemu_register_machine(&musicpal_machine
);
1468 machine_init(musicpal_machine_init
);
1470 static void musicpal_register_devices(void)
1472 sysbus_register_dev("mv88w8618_pic", sizeof(mv88w8618_pic_state
),
1473 mv88w8618_pic_init
);
1474 sysbus_register_withprop(&mv88w8618_pit_info
);
1475 sysbus_register_dev("mv88w8618_flashcfg", sizeof(mv88w8618_flashcfg_state
),
1476 mv88w8618_flashcfg_init
);
1477 sysbus_register_dev("mv88w8618_eth", sizeof(mv88w8618_eth_state
),
1478 mv88w8618_eth_init
);
1479 sysbus_register_dev("mv88w8618_wlan", sizeof(SysBusDevice
),
1480 mv88w8618_wlan_init
);
1481 sysbus_register_dev("musicpal_lcd", sizeof(musicpal_lcd_state
),
1483 sysbus_register_withprop(&musicpal_gpio_info
);
1484 sysbus_register_dev("musicpal_key", sizeof(musicpal_key_state
),
1488 device_init(musicpal_register_devices
)