hw/mips_jz.c

   1 /*
   2  * QEMU JZ Soc emulation
   3  *
   4  * Copyright (c) 2009 yajin (yajin@vm-kernel.org)
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25
  26 /*
  27  * The emulation target is pavo demo board.
  28  *  http://www.ingenic.cn/eng/productServ/kfyd/Hardware/pffaqQuestionContent.aspx?Category=2&Question=3
  29  *
  30  */
  31
  32 #include "hw.h"
  33 #include "mips.h"
  34 #include "sysemu.h"
  35 #include "qemu-timer.h"
  36 #include "qemu-char.h"
  37 #include "flash.h"
  38 #include "soc_dma.h"
  39 #include "audio/audio.h"
  40 #include "pc.h"
  41 #include "osdep.h"
  42 #include "mips_jz.h"
  43 #include "console.h"
  44
  45 #define DEBUG                   /*global debug on/off */
  46
  47 #define DEBUG_CPM                     (1<<0x0)
  48 #define DEBUG_EMC                     (1<<0x1)
  49 #define DEBUG_GPIO                    (1<<0x2)
  50 #define DEBUG_RTC                       (1<<0x3)
  51 #define DEBUG_TCU                       (1<<0x4)
  52 #define DEBUG_LCDC                      (1<<0x5)
  53 #define DEBUG_DMA                      (1<<0x6)
  54 #define  DEBUG_FLAG                  (DEBUG_CPM|DEBUG_EMC|DEBUG_GPIO    \
  55                                                                                                                         | DEBUG_RTC | DEBUG_TCU | DEBUG_LCDC | DEBUG_DMA)
  56                                                                                                                 //DEBUG_TCU// (DEBUG_CPM|DEBUG_EMC|DEBUG_GPIO
  57                                                                                                                 //      | DEBUG_RTC | DEBUG_TCU | DEBUG_LCDC | DEBUG_DMA)
  58
  59
  60 #ifdef DEBUG
  61 FILE *fp;
  62 static void debug_init(void)
  63 {
  64     fp = fopen("jz4740.txt", "w+");
  65     if (fp == NULL)
  66     {
  67         fprintf(stderr, "can not open jz4740.txt \n");
  68         exit(-1);
  69     }
  70 }
  71 static void debug_out(uint32_t flag, const char *format, ...)
  72 {
  73     va_list ap;
  74     if (fp)
  75     {
  76         if (flag & DEBUG_FLAG)
  77         {
  78             va_start(ap, format);
  79             vfprintf(fp, format, ap);
  80             fflush(fp);
  81             va_end(ap);
  82         }
  83     }
  84 }
  85 #else
  86 static void debug_init(void)
  87 {
  88 }
  89 static void debug_out(uint32_t flag, const char *format, ...)
  90 {
  91 }
  92 #endif
  93
  94 uint32_t jz4740_badwidth_read8(void *opaque, target_phys_addr_t addr)
  95 {
  96     uint8_t ret;
  97
  98     JZ4740_8B_REG(addr);
  99     cpu_physical_memory_read(addr, (void *) &ret, 1);
 100     return ret;
 101 }
 102
 103 void jz4740_badwidth_write8(void *opaque, target_phys_addr_t addr,
 104                             uint32_t value)
 105 {
 106     uint8_t val8 = value;
 107
 108     JZ4740_8B_REG(addr);
 109     cpu_physical_memory_write(addr, (void *) &val8, 1);
 110 }
 111
 112 uint32_t jz4740_badwidth_read16(void *opaque, target_phys_addr_t addr)
 113 {
 114     uint16_t ret;
 115     JZ4740_16B_REG(addr);
 116     cpu_physical_memory_read(addr, (void *) &ret, 2);
 117     return ret;
 118 }
 119
 120 void jz4740_badwidth_write16(void *opaque, target_phys_addr_t addr,
 121                              uint32_t value)
 122 {
 123     uint16_t val16 = value;
 124
 125     JZ4740_16B_REG(addr);
 126     cpu_physical_memory_write(addr, (void *) &val16, 2);
 127 }
 128
 129 uint32_t jz4740_badwidth_read32(void *opaque, target_phys_addr_t addr)
 130 {
 131     uint32_t ret;
 132
 133     JZ4740_32B_REG(addr);
 134     cpu_physical_memory_read(addr, (void *) &ret, 4);
 135     return ret;
 136 }
 137
 138 void jz4740_badwidth_write32(void *opaque, target_phys_addr_t addr,
 139                              uint32_t value)
 140 {
 141     JZ4740_32B_REG(addr);
 142     cpu_physical_memory_write(addr, (void *) &value, 4);
 143 }
 144
 145
 146 /*clock reset and power control*/
 147 struct jz4740_cpm_s
 148 {
 149     target_phys_addr_t base;
 150     struct jz_state_s *soc;
 151
 152     uint32_t cpccr;
 153     uint32_t cppcr;
 154     uint32_t i2scdr;
 155     uint32_t lpcdr;
 156     uint32_t msccdr;
 157     uint32_t uhccdr;
 158     uint32_t uhctst;
 159     uint32_t ssicdr;
 160
 161     uint32_t lcr;
 162     uint32_t clkgr;
 163     uint32_t scr;
 164 };
 165
 166 static void jz4740_dump_clocks(jz_clk parent)
 167 {
 168     jz_clk i = parent;
 169
 170     debug_out(DEBUG_CPM, "clock %s rate %d \n", i->name, i->rate);
 171     for (i = i->child1; i; i = i->sibling)
 172         jz4740_dump_clocks(i);
 173 }
 174
 175 static inline void jz4740_cpccr_update(struct jz4740_cpm_s *s,
 176                                        uint32_t new_value)
 177 {
 178     uint32_t ldiv, mdiv, pdiv, hdiv, cdiv, udiv;
 179     uint32_t div_table[10] = {
 180         1, 2, 3, 4, 6, 8, 12, 16, 24, 32
 181     };
 182
 183     if (unlikely(new_value == s->cpccr))
 184         return;
 185
 186     if (new_value & CPM_CPCCR_PCS)
 187         jz_clk_setrate(jz_findclk(s->soc, "pll_divider"), 1, 1);
 188     else
 189         jz_clk_setrate(jz_findclk(s->soc, "pll_divider"), 2, 1);
 190
 191
 192     ldiv = (new_value & CPM_CPCCR_LDIV_MASK) >> CPM_CPCCR_LDIV_BIT;
 193     ldiv++;
 194
 195     mdiv = div_table[(new_value & CPM_CPCCR_MDIV_MASK) >> CPM_CPCCR_MDIV_BIT];
 196     pdiv = div_table[(new_value & CPM_CPCCR_PDIV_MASK) >> CPM_CPCCR_PDIV_BIT];
 197     hdiv = div_table[(new_value & CPM_CPCCR_HDIV_MASK) >> CPM_CPCCR_HDIV_BIT];
 198     cdiv = div_table[(new_value & CPM_CPCCR_CDIV_MASK) >> CPM_CPCCR_CDIV_BIT];
 199     udiv = div_table[(new_value & CPM_CPCCR_UDIV_MASK) >> CPM_CPCCR_UDIV_BIT];
 200
 201     jz_clk_setrate(jz_findclk(s->soc, "ldclk"), ldiv, 1);
 202     jz_clk_setrate(jz_findclk(s->soc, "mclk"), mdiv, 1);
 203     jz_clk_setrate(jz_findclk(s->soc, "pclk"), pdiv, 1);
 204     jz_clk_setrate(jz_findclk(s->soc, "hclk"), hdiv, 1);
 205     jz_clk_setrate(jz_findclk(s->soc, "cclk"), cdiv, 1);
 206     jz_clk_setrate(jz_findclk(s->soc, "usbclk"), udiv, 1);
 207
 208     if (new_value & CPM_CPCCR_UCS)
 209         jz_clk_reparent(jz_findclk(s->soc, "usbclk"),
 210                         jz_findclk(s->soc, "pll_divider"));
 211     else
 212         jz_clk_reparent(jz_findclk(s->soc, "usbclk"),
 213                         jz_findclk(s->soc, "osc_extal"));
 214
 215     if (new_value & CPM_CPCCR_I2CS)
 216         jz_clk_reparent(jz_findclk(s->soc, "i2sclk"),
 217                         jz_findclk(s->soc, "pll_divider"));
 218     else
 219         jz_clk_reparent(jz_findclk(s->soc, "i2sclk"),
 220                         jz_findclk(s->soc, "osc_extal"));
 221
 222     s->cpccr = new_value;
 223
 224     debug_out(DEBUG_CPM, "write to cpccr 0x%x\n", new_value);
 225
 226     jz4740_dump_clocks(jz_findclk(s->soc, "osc_extal"));
 227
 228 }
 229
 230 static inline void jz4740_cppcr_update(struct jz4740_cpm_s *s,
 231                                        uint32_t new_value)
 232 {
 233     uint32_t pllm, plln, pllod, pllbp, pllen;
 234     uint32_t pll0[4] = {
 235         1, 2, 2, 4
 236     };
 237
 238
 239     pllen = new_value & CPM_CPPCR_PLLEN;
 240     pllbp = new_value & CPM_CPPCR_PLLBP;
 241     if ((!pllen) || (pllen && pllbp))
 242     {
 243         jz_clk_setrate(jz_findclk(s->soc, "pll_output"), 1, 1);
 244         debug_out(DEBUG_CPM, "pll is bypassed \n");
 245         s->cppcr = new_value | CPM_CPPCR_PLLS;
 246         return;
 247     }
 248
 249
 250     pllm = (new_value & CPM_CPPCR_PLLM_MASK) >> CPM_CPPCR_PLLM_BIT;
 251     plln = (new_value & CPM_CPPCR_PLLN_MASK) >> CPM_CPPCR_PLLN_BIT;
 252     pllod = (new_value & CPM_CPPCR_PLLOD_MASK) >> CPM_CPPCR_PLLOD_BIT;
 253     jz_clk_setrate(jz_findclk(s->soc, "pll_output"), (plln + 2) * pll0[pllod],
 254                    pllm + 2);
 255
 256     s->cppcr = new_value;
 257
 258     debug_out(DEBUG_CPM, "write to cppcr 0x%x\n", new_value);
 259     jz4740_dump_clocks(jz_findclk(s->soc, "osc_extal"));
 260
 261 }
 262
 263 static inline void jz4740_i2scdr_update(struct jz4740_cpm_s *s,
 264                                         uint32_t new_value)
 265 {
 266     uint32_t i2scdr;
 267
 268     i2scdr = new_value & CPM_I2SCDR_I2SDIV_MASK;
 269     if (unlikely(i2scdr == s->i2scdr))
 270         return;
 271
 272
 273     jz_clk_setrate(jz_findclk(s->soc, "i2sclk"), i2scdr + 1, 1);
 274
 275     s->i2scdr = i2scdr;
 276
 277     debug_out(DEBUG_CPM, "write to i2scdr 0x%x\n", new_value);
 278     jz4740_dump_clocks(jz_findclk(s->soc, "osc_extal"));
 279
 280 }
 281
 282 static inline void jz4740_lpcdr_update(struct jz4740_cpm_s *s,
 283                                        uint32_t new_value)
 284 {
 285     uint32_t ipcdr;
 286
 287     ipcdr = new_value & CPM_LPCDR_PIXDIV_MASK;
 288     /*TODO: */
 289     s->lpcdr = ipcdr;
 290 }
 291
 292 static inline void jz4740_msccdr_update(struct jz4740_cpm_s *s,
 293                                         uint32_t new_value)
 294 {
 295     uint32_t msccdr;
 296
 297     msccdr = new_value & CPM_MSCCDR_MSCDIV_MASK;
 298
 299     if (unlikely(msccdr == s->msccdr))
 300         return;
 301
 302
 303     jz_clk_setrate(jz_findclk(s->soc, "mscclk"), msccdr + 1, 1);
 304
 305     s->msccdr = msccdr;
 306
 307     debug_out(DEBUG_CPM, "write to msccdr 0x%x\n", new_value);
 308     jz4740_dump_clocks(jz_findclk(s->soc, "osc_extal"));
 309
 310 }
 311
 312 static inline void jz4740_uhccdr_update(struct jz4740_cpm_s *s,
 313                                         uint32_t new_value)
 314 {
 315     uint32_t uhccdr;
 316
 317     uhccdr = new_value & 0xf;
 318     /*TODO: */
 319     s->uhccdr = uhccdr;
 320 }
 321
 322 static void jz4740_cpm_write(void *opaque, target_phys_addr_t addr,
 323                              uint32_t value)
 324 {
 325     struct jz4740_cpm_s *s = (struct jz4740_cpm_s *) opaque;
 326
 327          debug_out(DEBUG_CPM, "write to cpm addr %x value 0x%x\n", addr,value);
 328
 329     switch (addr)
 330     {
 331     case 0x0:
 332         jz4740_cpccr_update(s, value);
 333         break;
 334     case 0x4:
 335         s->lcr = value & 0xff;
 336         break;
 337     case 0x20:
 338         s->clkgr = value & 0xffff;
 339         break;
 340     case 0x24:
 341         s->scr = value & 0xffff;
 342         break;
 343     case 0x10:
 344         jz4740_cppcr_update(s, value);
 345         break;
 346     case 0x60:
 347         jz4740_i2scdr_update(s, value);
 348         break;
 349     case 0x64:
 350         jz4740_lpcdr_update(s, value);
 351         break;
 352     case 0x68:
 353         jz4740_msccdr_update(s, value);
 354         break;
 355     case 0x6c:
 356         jz4740_uhccdr_update(s, value);
 357         break;
 358     case 0x70:
 359         s->uhctst = value & 0x3f;
 360         break;
 361     case 0x74:
 362         s->ssicdr = value & 0xf;
 363         break;
 364     default:
 365         cpu_abort(s->soc->env,
 366                   "jz4740_cpm_write undefined addr " JZ_FMT_plx
 367                   "  value %x \n", addr, value);
 368     }
 369
 370 }
 371
 372
 373 static uint32_t jz474_cpm_read(void *opaque, target_phys_addr_t addr)
 374 {
 375     struct jz4740_cpm_s *s = (struct jz4740_cpm_s *) opaque;
 376
 377     switch (addr)
 378     {
 379     case 0x0:
 380         return s->cpccr;
 381     case 0x4:
 382         return s->lcr;
 383     case 0x20:
 384         return s->clkgr;
 385     case 0x24:
 386         return s->scr;
 387     case 0x10:
 388         return s->cppcr;
 389     case 0x60:
 390         return s->i2scdr;
 391     case 0x64:
 392         return s->lpcdr;
 393     case 0x68:
 394         return s->msccdr;
 395     case 0x6c:
 396         return s->uhccdr;
 397     case 0x70:
 398         return s->uhctst;
 399     case 0x74:
 400         return s->ssicdr;
 401     default:
 402         cpu_abort(s->soc->env,
 403                   "jz474_cpm_read undefined addr " JZ_FMT_plx "  \n", addr);
 404     }
 405
 406 }
 407
 408
 409
 410 static CPUReadMemoryFunc *jz4740_cpm_readfn[] = {
 411     jz4740_badwidth_read32, jz4740_badwidth_read32, jz474_cpm_read,
 412 };
 413
 414 static CPUWriteMemoryFunc *jz4740_cpm_writefn[] = {
 415     jz4740_badwidth_write32, jz4740_badwidth_write32, jz4740_cpm_write,
 416 };
 417
 418 static void jz4740_cpm_reset(struct jz4740_cpm_s *s)
 419 {
 420     s->cpccr = 0x42040000;
 421     s->cppcr = 0x28080011;
 422     s->i2scdr = 0x00000004;
 423     s->lpcdr = 0x00000004;
 424     s->msccdr = 0x00000004;
 425     s->uhccdr = 0x00000004;
 426     s->uhctst = 0x0;
 427     s->ssicdr = 0x00000004;
 428
 429     s->lcr = 0xf8;
 430     s->clkgr = 0x0;
 431     s->scr = 0x1500;
 432 }
 433
 434 static struct jz4740_cpm_s *jz4740_cpm_init(struct jz_state_s *soc)
 435 {
 436     int iomemtype;
 437     struct jz4740_cpm_s *s = (struct jz4740_cpm_s *) qemu_mallocz(sizeof(*s));
 438     s->base = JZ4740_PHYS_BASE(JZ4740_CPM_BASE);
 439     s->soc = soc;
 440
 441     jz4740_cpm_reset(s);
 442
 443     iomemtype =
 444         cpu_register_io_memory(0, jz4740_cpm_readfn, jz4740_cpm_writefn, s);
 445     cpu_register_physical_memory(s->base, 0x00001000, iomemtype);
 446     return s;
 447 }
 448
 449
 450 /* JZ4740 interrupt controller
 451   * It issues INT2 to MIPS
 452   */
 453 struct jz4740_intc_s
 454 {
 455     qemu_irq parent_irq;
 456
 457     target_phys_addr_t base;
 458     struct jz_state_s *soc;
 459
 460     uint32_t icsr;
 461     uint32_t icmr;
 462     uint32_t icmsr;
 463     uint32_t icmcr;
 464     uint32_t icpr;
 465 };
 466
 467 static uint32_t jz4740_intc_read(void *opaque, target_phys_addr_t addr)
 468 {
 469     struct jz4740_intc_s *s = (struct jz4740_intc_s *) opaque;
 470
 471     switch (addr)
 472     {
 473     case 0x8:
 474     case 0xc:
 475         JZ4740_WO_REG(addr);
 476         break;
 477     case 0x0:
 478         return s->icsr;
 479     case 0x4:
 480         return s->icmr;
 481     case 0x10:
 482         return s->icpr;
 483     default:
 484         cpu_abort(s->soc->env,
 485                   "jz4740_intc_read undefined addr " JZ_FMT_plx "  \n", addr);
 486
 487     }
 488     return (0);
 489 }
 490
 491 static void jz4740_intc_write(void *opaque, target_phys_addr_t addr,
 492                               uint32_t value)
 493 {
 494     struct jz4740_intc_s *s = (struct jz4740_intc_s *) opaque;
 495
 496     switch (addr)
 497     {
 498     case 0x0:
 499         JZ4740_RO_REG(addr);
 500         break;
 501     case 0x4:
 502         s->icmr = value;
 503         break;
 504     case 0x8:
 505         s->icmr |= value;
 506         break;
 507     case 0xc:
 508         s->icmr &= ~value;
 509         break;
 510     case 0x10:
 511          s->icpr &= ~value;
 512          qemu_set_irq(s->parent_irq, 0);
 513          break;
 514     default:
 515         cpu_abort(s->soc->env,
 516                   "jz4740_intc_write undefined addr " JZ_FMT_plx
 517                   "  value %x \n", addr, value);
 518     }
 519 }
 520
 521
 522 static CPUReadMemoryFunc *jz4740_intc_readfn[] = {
 523     jz4740_badwidth_read32, jz4740_badwidth_read32, jz4740_intc_read,
 524 };
 525
 526 static CPUWriteMemoryFunc *jz4740_intc_writefn[] = {
 527     jz4740_badwidth_write32, jz4740_badwidth_write32, jz4740_intc_write,
 528 };
 529
 530 static void jz4740_intc_reset(struct jz4740_intc_s *s)
 531 {
 532     s->icsr = 0x0;
 533     s->icmr = 0xffffffff;
 534     s->icpr = 0x0;
 535 }
 536
 537 static void jz4740_set_irq(void *opaque, int irq, int level)
 538 {
 539     struct jz4740_intc_s *s = (struct jz4740_intc_s *) opaque;
 540     uint32_t irq_mask = 1 << irq;
 541
 542
 543         if (level)
 544     {
 545         s->icsr |= irq_mask;
 546         s->icpr &= ~irq_mask;
 547         if (!(s->icmr & irq_mask))
 548         {
 549                 s->icpr |= irq_mask;
 550                 qemu_set_irq(s->parent_irq, 1);
 551         }
 552     }
 553
 554 }
 555
 556 static qemu_irq *jz4740_intc_init(struct jz_state_s *soc, qemu_irq parent_irq)
 557 {
 558     int iomemtype;
 559     struct jz4740_intc_s *s = (struct jz4740_intc_s *) qemu_mallocz(sizeof(*s));
 560     s->base = JZ4740_PHYS_BASE(JZ4740_INTC_BASE);
 561     s->parent_irq = parent_irq;
 562     s->soc = soc;
 563
 564     jz4740_intc_reset(s);
 565
 566     iomemtype =
 567         cpu_register_io_memory(0, jz4740_intc_readfn, jz4740_intc_writefn, s);
 568     cpu_register_physical_memory(s->base, 0x00001000, iomemtype);
 569     return qemu_allocate_irqs(jz4740_set_irq, s, 32);
 570 }
 571
 572 /*external memory controller*/
 573 struct jz4740_emc_s
 574 {
 575     qemu_irq irq;
 576     target_phys_addr_t base;
 577     struct jz_state_s *soc;
 578
 579     uint32_t bcr;
 580     uint32_t smcr1;             /*0x13010014 */
 581     uint32_t smcr2;             /*0x13010018 */
 582     uint32_t smcr3;             /*0x1301001c */
 583     uint32_t smcr4;             /*0x13010020 */
 584     uint32_t sacr1;             /*0x13010034 */
 585     uint32_t sacr2;             /*0x13010038 */
 586     uint32_t sacr3;             /*0x1301003c */
 587     uint32_t sacr4;             /*0x13010040 */
 588
 589     uint32_t nfcsr;             /*0x13010050 */
 590     uint32_t nfeccr;            /*0x13010100 */
 591     uint32_t nfecc;             /*0x13010104 */
 592     uint32_t nfpar0;            /*0x13010108 */
 593     uint32_t nfpar1;            /*0x1301010c */
 594     uint32_t nfpar2;            /*0x13010110 */
 595     uint32_t nfints;            /*0x13010114 */
 596     uint32_t nfinte;            /*0x13010118 */
 597     uint32_t nferr0;            /*0x1301011c */
 598     uint32_t nferr1;            /*0x13010120 */
 599     uint32_t nferr2;            /*0x13010124 */
 600     uint32_t nferr3;            /*0x13010128 */
 601
 602     uint32_t dmcr;              /*0x13010080 */
 603     uint32_t rtcsr;             /*0x13010084 */
 604     uint32_t rtcnt;             /*0x13010088 */
 605     uint32_t rtcor;             /*0x1301008c */
 606     uint32_t dmar;              /*0x13010090 */
 607     uint32_t sdmr;              /*0x1301a000 */
 608
 609 };
 610
 611
 612 static void jz4740_emc_reset(struct jz4740_emc_s *s)
 613 {
 614     s->smcr1 = 0xfff7700;
 615     s->smcr2 = 0xfff7700;
 616     s->smcr3 = 0xfff7700;
 617     s->smcr4 = 0xfff7700;
 618     s->sacr1 = 0x18fc;
 619     s->sacr2 = 0x16fe;
 620     s->sacr3 = 0x14fe;
 621     s->sacr4 = 0xcfc;
 622
 623     s->nfcsr = 0x0;
 624     s->nfeccr = 0x0;
 625     s->nfecc = 0x0;
 626     s->nfpar0 = 0x0;
 627     s->nfpar1 = 0x0;
 628     s->nfpar2 = 0x0;
 629     s->nfints = 0x0;
 630     s->nfinte = 0x0;
 631     s->nferr0 = 0x0;
 632     s->nferr1 = 0x0;
 633     s->nferr2 = 0x0;
 634     s->nferr3 = 0x0;
 635
 636     s->dmcr = 0x0;
 637     s->rtcsr = 0x0;
 638     s->rtcnt = 0x0;
 639     s->rtcor = 0x0;
 640     s->dmar = 0x20f8;
 641     s->sdmr = 0x0;
 642
 643 }
 644
 645 static uint32_t jz4740_emc_read8(void *opaque, target_phys_addr_t addr)
 646 {
 647     struct jz4740_emc_s *s = (struct jz4740_emc_s *) opaque;
 648
 649     switch (addr)
 650     {
 651     case 0x108:
 652     case 0x109:
 653     case 0x10a:
 654     case 0x10b:
 655         return (s->nfpar0 >> ((addr - 0x108) * 8)) & 0xff;
 656     case 0x10c:
 657     case 0x10d:
 658     case 0x10e:
 659     case 0x10f:
 660         return (s->nfpar1 >> ((addr - 0x10c) * 8)) & 0xff;
 661     case 0x110:
 662     case 0x111:
 663     case 0x112:
 664     case 0x113:
 665         return (s->nfpar2 >> ((addr - 0x110) * 8)) & 0xff;
 666     case 0xa000:
 667     case 0xa001:
 668     case 0xa002:
 669     case 0xa003:
 670         return (s->sdmr >> ((addr - 0xa000) * 8)) & 0xff;
 671     default:
 672         cpu_abort(s->soc->env,
 673                   "jz4740_emc_read8 undefined addr " JZ_FMT_plx " \n", addr);
 674
 675
 676     }
 677     return (0);
 678 }
 679
 680 static uint32_t jz4740_emc_read16(void *opaque, target_phys_addr_t addr)
 681 {
 682     struct jz4740_emc_s *s = (struct jz4740_emc_s *) opaque;
 683
 684     switch (addr)
 685     {
 686     case 0x108:
 687     case 0x10a:
 688         return (s->nfpar0 >> ((addr - 0x108) * 8)) & 0xffff;
 689     case 0x10c:
 690     case 0x10e:
 691         return (s->nfpar1 >> ((addr - 0x10c) * 8)) & 0xffff;
 692     case 0x110:
 693     case 0x112:
 694         return (s->nfpar2 >> ((addr - 0x110) * 8)) & 0xffff;
 695     case 0x11c:
 696     case 0x11e:
 697         return (s->nferr0 >> ((addr - 0x11c) * 8)) & 0xffff;
 698     case 0x120:
 699     case 0x122:
 700         return (s->nferr1 >> ((addr - 0x120) * 8)) & 0xffff;
 701     case 0x124:
 702     case 0x126:
 703         return (s->nferr2 >> ((addr - 0x124) * 8)) & 0xffff;
 704     case 0x128:
 705     case 0x12a:
 706         return (s->nferr3 >> ((addr - 0x128) * 8)) & 0xffff;
 707     default:
 708         cpu_abort(s->soc->env,
 709                   "jz4740_emc_read16 undefined addr " JZ_FMT_plx " \n", addr);
 710     }
 711     return (0);
 712 }
 713
 714 static uint32_t jz4740_emc_read32(void *opaque, target_phys_addr_t addr)
 715 {
 716     struct jz4740_emc_s *s = (struct jz4740_emc_s *) opaque;
 717
 718     switch (addr)
 719     {
 720     case 0x0:
 721         return s->bcr;
 722     case 0x14:
 723         return s->smcr1;
 724     case 0x18:
 725         return s->smcr2;
 726     case 0x1c:
 727         return s->smcr3;
 728     case 0x20:
 729         return s->smcr4;
 730     case 0x34:
 731         return s->sacr1;
 732     case 0x38:
 733         return s->sacr2;
 734     case 0x3c:
 735         return s->sacr3;
 736     case 0x40:
 737         return s->sacr4;
 738     case 0x50:
 739         return s->nfcsr;
 740     case 0x100:
 741         return s->nfeccr;
 742     case 0x104:
 743         return s->nfecc;
 744     case 0x108:
 745         return s->nfpar0;
 746     case 0x10c:
 747         return s->nfpar1;
 748     case 0x110:
 749         return s->nfpar2;
 750     case 0x114:
 751         return s->nfints;
 752     case 0x118:
 753         return s->nfinte;
 754     case 0x11c:
 755         return s->nferr0;
 756     case 0x120:
 757         return s->nferr1;
 758     case 0x124:
 759         return s->nferr2;
 760     case 0x128:
 761         return s->nferr3;
 762     case 0x80:
 763         return s->dmcr;
 764     case 0x90:
 765         return s->dmar;
 766     default:
 767         cpu_abort(s->soc->env,
 768                   "jz4740_emc_read32 undefined addr " JZ_FMT_plx " \n", addr);
 769     }
 770     return (0);
 771 }
 772
 773 static void jz4740_emc_write8(void *opaque, target_phys_addr_t addr,
 774                               uint32_t value)
 775 {
 776     struct jz4740_emc_s *s = (struct jz4740_emc_s *) opaque;
 777
 778     debug_out(DEBUG_EMC, "jz4740_emc_write8 addr %x value %x\n", addr, value);
 779
 780     switch (addr)
 781     {
 782     case 0x108:
 783     case 0x109:
 784     case 0x10a:
 785     case 0x10b:
 786         s->nfpar0 |= (value & 0xff) << ((addr - 0x108) * 8);
 787         break;
 788     case 0x10c:
 789     case 0x10d:
 790     case 0x10e:
 791     case 0x10f:
 792         s->nfpar1 |= (value & 0xff) << ((addr - 0x10c) * 8);
 793         break;
 794     case 0x110:
 795     case 0x111:
 796     case 0x112:
 797     case 0x113:
 798         s->nfpar2 |= (value & 0xff) << ((addr - 0x110) * 8);
 799         break;
 800     case 0xa000 ... 0xa3ff:
 801         break;
 802     default:
 803         cpu_abort(s->soc->env,
 804                   "jz4740_emc_write8 undefined addr " JZ_FMT_plx
 805                   "  value %x \n", addr, value);
 806     }
 807 }
 808 static void jz4740_emc_write16(void *opaque, target_phys_addr_t addr,
 809                                uint32_t value)
 810 {
 811     struct jz4740_emc_s *s = (struct jz4740_emc_s *) opaque;
 812
 813     debug_out(DEBUG_EMC, "jz4740_emc_write16 addr %x value %x\n", addr, value);
 814     switch (addr)
 815     {
 816     case 0x108:
 817     case 0x10a:
 818         s->nfpar0 |= (value & 0xffff) << ((addr - 0x108) * 8);
 819         break;
 820     case 0x10c:
 821     case 0x10e:
 822         s->nfpar1 |= (value & 0xffff) << ((addr - 0x10c) * 8);
 823         break;
 824     case 0x110:
 825     case 0x112:
 826         s->nfpar2 |= (value & 0xffff) << ((addr - 0x110) * 8);
 827         break;
 828     case 0x84:
 829     case 0x86:
 830         s->rtcsr |= (value & 0xffff) << ((addr - 0x84) * 8);
 831         break;
 832     case 0x88:
 833     case 0x8a:
 834         s->rtcnt |= (value & 0xffff) << ((addr - 0x88) * 8);
 835         break;
 836     case 0x8c:
 837         s->rtcor |= (value & 0xffff) << ((addr - 0x8c) * 8);
 838         break;
 839     default:
 840         cpu_abort(s->soc->env,
 841                   "jz4740_emc_write16 undefined addr " JZ_FMT_plx
 842                   "  value %x \n", addr, value);
 843     }
 844 }
 845
 846 static void jz4740_emc_upate_interrupt(struct jz4740_emc_s *s)
 847 {
 848     qemu_set_irq(s->irq, s->nfints & s->nfinte);
 849 }
 850
 851 static void jz4740_emc_write32(void *opaque, target_phys_addr_t addr,
 852                                uint32_t value)
 853 {
 854     struct jz4740_emc_s *s = (struct jz4740_emc_s *) opaque;
 855
 856     debug_out(DEBUG_EMC, "jz4740_emc_write32 addr %x value %x\n", addr, value);
 857     switch (addr)
 858     {
 859     case 0x104:
 860     case 0x11c:
 861     case 0x120:
 862     case 0x124:
 863     case 0x128:
 864         JZ4740_RO_REG(addr);
 865         break;
 866     case 0x0:
 867         s->bcr = value;
 868         break;
 869     case 0x14:
 870         s->smcr1 = value & 0xfff77cf;
 871         break;
 872     case 0x18:
 873         s->smcr2 = value & 0xfff77cf;
 874         break;
 875     case 0x1c:
 876         s->smcr3 = value & 0xfff77cf;
 877         break;
 878     case 0x20:
 879         s->smcr4 = value & 0xfff77cf;
 880         break;
 881     case 0x34:
 882         s->sacr1 = value & 0xffff;
 883         break;
 884     case 0x38:
 885         s->sacr2 = value & 0xffff;
 886         break;
 887     case 0x3c:
 888         s->sacr3 = value & 0xffff;
 889         break;
 890     case 0x40:
 891         s->sacr4 = value & 0xffff;
 892         break;
 893     case 0x50:
 894         s->nfcsr = value & 0xffff;
 895         break;
 896     case 0x100:
 897         s->nfeccr = value & 0x1f;
 898         if (s->nfeccr & 0x2)
 899         {
 900             s->nfecc = 0x0;
 901             s->nfpar0 = 0x0;
 902             s->nfpar1 = 0x0;
 903             s->nfpar2 = 0x0;
 904             s->nfints = 0x0;
 905             s->nfinte = 0x0;
 906             s->nferr0 = 0x0;
 907             s->nferr1 = 0x0;
 908             s->nferr2 = 0x0;
 909             s->nferr3 = 0x0;
 910         }
 911          /*RS*/
 912             /*TODO: Real RS error correction */
 913             if (s->nfeccr & 0x4)
 914         {
 915             if ((s->nfeccr & 0x10) && (!(s->nfeccr & 0x8)))
 916             {
 917                 /*decode */
 918                 s->nfints = 0x8;
 919                 s->nferr0 = 0x0;
 920                 s->nferr1 = 0x0;
 921                 s->nferr2 = 0x0;
 922             }
 923             if (s->nfeccr & 0x8)
 924             {
 925                 /*encoding */
 926                 s->nfints = 0x4;
 927                 s->nfpar0 = 0xffffffff; /*fake value. for debug */
 928                 s->nfpar1 = 0xffffffff; /*fake value */
 929                 s->nfpar2 = 0xff;       /*fake value */
 930             }
 931         }
 932         else
 933         {
 934             s->nfecc = 0xffffff;
 935         }
 936         jz4740_emc_upate_interrupt(s);
 937         break;
 938     case 0x108:
 939         s->nfpar0 = value;
 940         break;
 941     case 0x10c:
 942         s->nfpar1 = value;
 943         break;
 944     case 0x110:
 945         s->nfpar2 = value & 0xff;
 946         break;
 947     case 0x114:
 948         s->nfints = value & 0x1fffffff;
 949         jz4740_emc_upate_interrupt(s);
 950         break;
 951     case 0x118:
 952         s->nfinte = value & 0x1f;
 953         jz4740_emc_upate_interrupt(s);
 954         break;
 955     case 0x080:
 956         s->dmcr = value & 0x9fbeff7f;
 957         break;
 958     case 0x90:
 959         s->dmar = value & 0xffff;
 960         break;
 961     default:
 962         cpu_abort(s->soc->env,
 963                   "jz4740_emc_write32 undefined addr " JZ_FMT_plx
 964                   "  value %x \n", addr, value);
 965
 966     }
 967
 968 }
 969
 970 static CPUReadMemoryFunc *jz4740_emc_readfn[] = {
 971     jz4740_emc_read8, jz4740_emc_read16, jz4740_emc_read32,
 972 };
 973
 974 static CPUWriteMemoryFunc *jz4740_emc_writefn[] = {
 975     jz4740_emc_write8, jz4740_emc_write16, jz4740_emc_write32,
 976 };
 977
 978
 979 static struct jz4740_emc_s *jz4740_emc_init(struct jz_state_s *soc,
 980                                             qemu_irq irq)
 981 {
 982     int iomemtype;
 983     struct jz4740_emc_s *s = (struct jz4740_emc_s *) qemu_mallocz(sizeof(*s));
 984     s->base = JZ4740_PHYS_BASE(JZ4740_EMC_BASE);
 985     s->soc = soc;
 986     s->irq = irq;
 987
 988     jz4740_emc_reset(s);
 989
 990     iomemtype =
 991         cpu_register_io_memory(0, jz4740_emc_readfn, jz4740_emc_writefn, s);
 992     cpu_register_physical_memory(s->base, 0x00010000, iomemtype);
 993     return s;
 994
 995 }
 996
 997 struct jz4740_gpio_s
 998 {
 999     qemu_irq irq;
1000     target_phys_addr_t base;
1001     struct jz_state_s *soc;
1002
1003     uint32_t papin[4];
1004     uint32_t padat[4];
1005     uint32_t paim[4];
1006     uint32_t pape[4];
1007     uint32_t pafun[4];
1008     uint32_t pasel[4];
1009     uint32_t padir[4];
1010     uint32_t patrg[4];
1011     uint32_t paflg[4];
1012 };
1013
1014 static void jz4740_gpio_reset(struct jz4740_gpio_s *s)
1015 {
1016     memset(s->papin, 0x0, sizeof(s->papin));
1017     memset(s->padat, 0x0, sizeof(s->padat));
1018     memset(s->paim, 0xffffffff, sizeof(s->paim));
1019     memset(s->pape, 0x0, sizeof(s->pape));
1020     memset(s->pafun, 0x0, sizeof(s->pafun));
1021     memset(s->pasel, 0x0, sizeof(s->pasel));
1022     memset(s->padir, 0x0, sizeof(s->padir));
1023     memset(s->patrg, 0x0, sizeof(s->patrg));
1024     memset(s->paflg, 0x0, sizeof(s->paflg));
1025 }
1026
1027 static uint32_t jz4740_gpio_read(void *opaque, target_phys_addr_t addr)
1028 {
1029     struct jz4740_gpio_s *s = (struct jz4740_gpio_s *) opaque;
1030     uint32_t group;
1031     debug_out(DEBUG_GPIO, "jz4740_gpio_read addr %x\n", addr);
1032
1033     switch (addr)
1034     {
1035     case 0x14:
1036     case 0x114:
1037     case 0x214:
1038     case 0x314:
1039     case 0x18:
1040     case 0x118:
1041     case 0x218:
1042     case 0x318:
1043     case 0x24:
1044     case 0x124:
1045     case 0x224:
1046     case 0x324:
1047     case 0x28:
1048     case 0x128:
1049     case 0x228:
1050     case 0x328:
1051     case 0x34:
1052     case 0x134:
1053     case 0x234:
1054     case 0x334:
1055     case 0x38:
1056     case 0x138:
1057     case 0x238:
1058     case 0x338:
1059     case 0x44:
1060     case 0x144:
1061     case 0x244:
1062     case 0x344:
1063     case 0x48:
1064     case 0x148:
1065     case 0x248:
1066     case 0x348:
1067     case 0x54:
1068     case 0x154:
1069     case 0x254:
1070     case 0x354:
1071     case 0x58:
1072     case 0x158:
1073     case 0x258:
1074     case 0x358:
1075     case 0x64:
1076     case 0x164:
1077     case 0x264:
1078     case 0x364:
1079     case 0x68:
1080     case 0x168:
1081     case 0x268:
1082     case 0x368:
1083     case 0x74:
1084     case 0x174:
1085     case 0x274:
1086     case 0x374:
1087     case 0x78:
1088     case 0x178:
1089     case 0x278:
1090     case 0x378:
1091     case 0x84:
1092     case 0x184:
1093     case 0x284:
1094     case 0x384:
1095         JZ4740_WO_REG(addr);
1096         break;
1097
1098     case 0x0:
1099     case 0x100:
1100     case 0x200:
1101     case 0x300:
1102         group = (addr - 0x0) / 0x100;
1103         if (addr == 0x200)
1104         {
1105             /*GPIO(C) PIN 30  -> NAND FLASH R/B. */
1106             /*FOR NAND FLASH.PIN 30 ----|_____|------ */
1107             s->papin[2] &= 0x40000000;
1108             if (s->papin[2])
1109                 s->papin[2] &= ~0x40000000;
1110             else
1111                 s->papin[2] |= 0x40000000;
1112         }
1113         return s->papin[group];
1114     case 0x10:
1115     case 0x110:
1116     case 0x210:
1117     case 0x310:
1118         group = (addr - 0x10) / 0x100;
1119         return s->padat[group];
1120     case 0x20:
1121     case 0x120:
1122     case 0x220:
1123     case 0x320:
1124         group = (addr - 0x20) / 0x100;
1125         return s->paim[group];
1126     case 0x30:
1127     case 0x130:
1128     case 0x230:
1129     case 0x330:
1130         group = (addr - 0x30) / 0x100;
1131         return s->pape[group];
1132     case 0x40:
1133     case 0x140:
1134     case 0x240:
1135     case 0x340:
1136         group = (addr - 0x40) / 0x100;
1137         return s->pafun[group];
1138     case 0x50:
1139     case 0x150:
1140     case 0x250:
1141     case 0x350:
1142         group = (addr - 0x50) / 0x100;
1143         return s->pasel[group];
1144     case 0x60:
1145     case 0x160:
1146     case 0x260:
1147     case 0x360:
1148         group = (addr - 0x60) / 0x100;
1149         return s->padir[group];
1150     case 0x70:
1151     case 0x170:
1152     case 0x270:
1153     case 0x370:
1154         group = (addr - 0x70) / 0x100;
1155         return s->patrg[group];
1156     case 0x80:
1157     case 0x180:
1158     case 0x280:
1159     case 0x380:
1160         group = (addr - 0x80) / 0x100;
1161         return s->paflg[group];
1162     default:
1163         cpu_abort(s->soc->env,
1164                   "jz4740_gpio_read undefined addr " JZ_FMT_plx " \n", addr);
1165     }
1166     return (0);
1167 }
1168
1169 static void jz4740_gpio_write(void *opaque, target_phys_addr_t addr,
1170                               uint32_t value)
1171 {
1172     struct jz4740_gpio_s *s = (struct jz4740_gpio_s *) opaque;
1173     uint32_t group;
1174
1175     debug_out(DEBUG_GPIO, "jz4740_gpio_write addr %x value %x\n", addr, value);
1176
1177     switch (addr)
1178     {
1179     case 0x0:
1180     case 0x100:
1181     case 0x200:
1182     case 0x300:
1183     case 0x10:
1184     case 0x110:
1185     case 0x210:
1186     case 0x310:
1187     case 0x20:
1188     case 0x120:
1189     case 0x220:
1190     case 0x320:
1191     case 0x30:
1192     case 0x130:
1193     case 0x230:
1194     case 0x330:
1195     case 0x40:
1196     case 0x140:
1197     case 0x240:
1198     case 0x340:
1199     case 0x50:
1200     case 0x150:
1201     case 0x250:
1202     case 0x350:
1203     case 0x60:
1204     case 0x160:
1205     case 0x260:
1206     case 0x360:
1207     case 0x70:
1208     case 0x170:
1209     case 0x270:
1210     case 0x370:
1211     case 0x80:
1212     case 0x180:
1213     case 0x280:
1214     case 0x380:
1215         JZ4740_RO_REG(addr);
1216         break;
1217     case 0x14:
1218     case 0x114:
1219     case 0x214:
1220     case 0x314:
1221         group = (addr - 0x14) / 0x100;
1222         s->padat[group] = value;
1223         break;
1224     case 0x18:
1225     case 0x118:
1226     case 0x218:
1227     case 0x318:
1228         group = (addr - 0x18) / 0x100;
1229         s->padat[group] &= ~value;
1230         break;
1231     case 0x24:
1232     case 0x124:
1233     case 0x224:
1234     case 0x324:
1235         group = (addr - 0x24) / 0x100;
1236         s->paim[group] = value;
1237         break;
1238     case 0x28:
1239     case 0x128:
1240     case 0x228:
1241     case 0x328:
1242         group = (addr - 0x28) / 0x100;
1243         s->paim[group] &= ~value;
1244         break;
1245     case 0x34:
1246     case 0x134:
1247     case 0x234:
1248     case 0x334:
1249         group = (addr - 0x34) / 0x100;
1250         s->pape[group] = value;
1251         break;
1252     case 0x38:
1253     case 0x138:
1254     case 0x238:
1255     case 0x338:
1256         group = (addr - 0x38) / 0x100;
1257         s->pape[group] &= ~value;
1258         break;
1259     case 0x44:
1260     case 0x144:
1261     case 0x244:
1262     case 0x344:
1263         group = (addr - 0x44) / 0x100;
1264         s->pafun[group] = value;
1265         break;
1266     case 0x48:
1267     case 0x148:
1268     case 0x248:
1269     case 0x348:
1270         group = (addr - 0x48) / 0x100;
1271         s->pafun[group] &= ~value;
1272         break;
1273     case 0x54:
1274     case 0x154:
1275     case 0x254:
1276     case 0x354:
1277         group = (addr - 0x54) / 0x100;
1278         s->pasel[group] = value;
1279         break;
1280     case 0x58:
1281     case 0x158:
1282     case 0x258:
1283     case 0x358:
1284         group = (addr - 0x58) / 0x100;
1285         s->pasel[group] &= ~value;
1286         break;
1287     case 0x64:
1288     case 0x164:
1289     case 0x264:
1290     case 0x364:
1291         group = (addr - 0x64) / 0x100;
1292         s->padir[group] = value;
1293         break;
1294     case 0x68:
1295     case 0x168:
1296     case 0x268:
1297     case 0x368:
1298         group = (addr - 0x68) / 0x100;
1299         s->padir[group] &= ~value;
1300         break;
1301     case 0x74:
1302     case 0x174:
1303     case 0x274:
1304     case 0x374:
1305         group = (addr - 0x74) / 0x100;
1306         s->patrg[group] = value;
1307         break;
1308     case 0x78:
1309     case 0x178:
1310     case 0x278:
1311     case 0x378:
1312         group = (addr - 0x78) / 0x100;
1313         s->patrg[group] &= ~value;
1314         break;
1315     case 0x84:
1316     case 0x184:
1317     case 0x284:
1318     case 0x384:
1319         group = (addr - 0x74) / 0x100;
1320         s->paflg[group] &= ~value;
1321         break;
1322     default:
1323         cpu_abort(s->soc->env,
1324                   "jz4740_gpio_write undefined addr " JZ_FMT_plx
1325                   "  value %x \n", addr, value);
1326
1327     }
1328
1329
1330 }
1331
1332
1333 static CPUReadMemoryFunc *jz4740_gpio_readfn[] = {
1334     jz4740_badwidth_read32, jz4740_badwidth_read32, jz4740_gpio_read,
1335 };
1336
1337 static CPUWriteMemoryFunc *jz4740_gpio_writefn[] = {
1338     jz4740_badwidth_write32, jz4740_badwidth_write32, jz4740_gpio_write,
1339 };
1340
1341 static struct jz4740_gpio_s *jz4740_gpio_init(struct jz_state_s *soc,
1342                                               qemu_irq irq)
1343 {
1344     int iomemtype;
1345     struct jz4740_gpio_s *s = (struct jz4740_gpio_s *) qemu_mallocz(sizeof(*s));
1346     s->base = JZ4740_PHYS_BASE(JZ4740_GPIO_BASE);
1347     s->soc = soc;
1348     s->irq = irq;
1349
1350     jz4740_gpio_reset(s);
1351
1352     iomemtype =
1353         cpu_register_io_memory(0, jz4740_gpio_readfn, jz4740_gpio_writefn, s);
1354     cpu_register_physical_memory(s->base, 0x00010000, iomemtype);
1355     return s;
1356
1357 }
1358
1359 struct jz4740_rtc_s
1360 {
1361     qemu_irq irq;
1362     target_phys_addr_t base;
1363     struct jz_state_s *soc;
1364
1365     QEMUTimer *hz_tm;
1366     //struct tm tm;
1367     //int sec_offset;
1368     int64_t next;
1369
1370     uint32_t rtccr;
1371     uint32_t rtcsr;
1372     uint32_t rtcsar;
1373     uint32_t rtcgr;
1374
1375     uint32_t hcr;
1376     uint32_t hwfcr;
1377     uint32_t hrcr;
1378     uint32_t hwcr;
1379     uint32_t hwrsr;
1380     uint32_t hspr;
1381
1382 };
1383
1384
1385 static void jz4740_rtc_update_interrupt(struct jz4740_rtc_s *s)
1386 {
1387     if (((s->rtcsr & 0x40) && (s->rtcsr & 0x20))
1388         || ((s->rtcsr & 0x10) && (s->rtcsr & 0x8)))
1389         qemu_set_irq(s->irq, 1);
1390     else
1391         qemu_set_irq(s->irq, 0);
1392 }
1393
1394 static inline void jz4740_rtc_start(struct jz4740_rtc_s *s)
1395 {
1396     s->next = +qemu_get_clock(rt_clock);
1397     qemu_mod_timer(s->hz_tm, s->next);
1398 }
1399
1400 static inline void jz4740_rtc_stop(struct jz4740_rtc_s *s)
1401 {
1402     qemu_del_timer(s->hz_tm);
1403     s->next = -qemu_get_clock(rt_clock);
1404     if (s->next < 1)
1405         s->next = 1;
1406 }
1407
1408 static void jz4740_rtc_hz(void *opaque)
1409 {
1410     struct jz4740_rtc_s *s = (struct jz4740_rtc_s *) opaque;
1411
1412     s->next += 1000;
1413     qemu_mod_timer(s->hz_tm, s->next);
1414     if (s->rtccr & 0x1)
1415     {
1416         s->rtcsr++;
1417         s->rtccr |= 0x40;
1418         if (s->rtcsr & 0x4)
1419         {
1420             if (s->rtcsr == s->rtcsar)
1421                 s->rtccr |= 0x10;
1422         }
1423         jz4740_rtc_update_interrupt(s);
1424     }
1425 }
1426
1427 static void jz4740_rtc_reset(struct jz4740_rtc_s *s)
1428 {
1429     s->rtccr = 0x81;
1430
1431     s->next = 1000;
1432
1433     /*Maybe rtcsr need to be saved to file */
1434     s->rtcsr = 0;
1435     //s->sec_offset = 0;
1436     //qemu_get_timedate(&s->tm, s->sec_offset);
1437     jz4740_rtc_start(s);
1438
1439 }
1440
1441 static uint32_t jz4740_rtc_read(void *opaque, target_phys_addr_t addr)
1442 {
1443     struct jz4740_rtc_s *s = (struct jz4740_rtc_s *) opaque;
1444
1445     debug_out(DEBUG_RTC, "jz4740_rtc_read addr %x\n", addr);
1446     switch (addr)
1447     {
1448     case 0x0:
1449         return s->rtccr | 0x80;
1450     case 0x4:
1451         return s->rtcsr;
1452     case 0x8:
1453         return s->rtcsar;
1454     case 0xc:
1455         return s->rtcgr;
1456     case 0x20:
1457         return s->hcr;
1458     case 0x24:
1459         return s->hwfcr;
1460     case 0x28:
1461         return s->hrcr;
1462     case 0x2c:
1463         return s->hwcr;
1464     case 0x30:
1465         return s->hwrsr;
1466     case 0x34:
1467         return s->hspr;
1468     default:
1469         cpu_abort(s->soc->env,
1470                   "jz4740_rtc_read undefined addr " JZ_FMT_plx "\n", addr);
1471     }
1472
1473     return (0);
1474 }
1475
1476 static void jz4740_rtc_write(void *opaque, target_phys_addr_t addr,
1477                              uint32_t value)
1478 {
1479     struct jz4740_rtc_s *s = (struct jz4740_rtc_s *) opaque;
1480
1481     debug_out(DEBUG_RTC, "jz4740_rtc_write addr %x value %x\n", addr, value);
1482
1483     switch (addr)
1484     {
1485     case 0x0:
1486         s->rtccr = value & 0x2d;
1487         if (!value & 0x40)
1488             s->rtccr &= ~0x40;
1489         if (!value & 0x10)
1490             s->rtccr &= ~0x10;
1491         if (s->rtccr & 0x1)
1492         {
1493             jz4740_rtc_start(s);
1494             jz4740_rtc_update_interrupt(s);
1495         }
1496         break;
1497     case 0x4:
1498         s->rtcsr = value;
1499         //s->sec_offset = qemu_timedate_diff(&s->tm);
1500         break;
1501     case 0x8:
1502         s->rtcsar = value;
1503         break;
1504     case 0xc:
1505         s->rtcgr = value & 0x13ffffff;
1506         break;
1507     case 0x20:
1508         s->hcr = value & 0x1;
1509         break;
1510     case 0x24:
1511         s->hwfcr = value & 0xffe0;
1512         break;
1513     case 0x28:
1514         s->hrcr = value & 0xfe0;
1515         break;
1516     case 0x2c:
1517         s->hwcr = value & 0x1;
1518         break;
1519     case 0x30:
1520         s->hwrsr = value & 0x33;
1521         break;
1522     case 0x34:
1523         s->hspr = value;
1524         break;
1525     default:
1526         cpu_abort(s->soc->env,
1527                   "jz4740_rtc_write undefined addr " JZ_FMT_plx
1528                   "  value %x \n", addr, value);
1529     }
1530
1531 }
1532
1533 static CPUReadMemoryFunc *jz4740_rtc_readfn[] = {
1534     jz4740_badwidth_read32, jz4740_badwidth_read32, jz4740_rtc_read,
1535 };
1536
1537 static CPUWriteMemoryFunc *jz4740_rtc_writefn[] = {
1538     jz4740_badwidth_write32, jz4740_badwidth_write32, jz4740_rtc_write,
1539 };
1540
1541 static struct jz4740_rtc_s *jz4740_rtc_init(struct jz_state_s *soc,
1542                                             qemu_irq irq)
1543 {
1544     int iomemtype;
1545     struct jz4740_rtc_s *s = (struct jz4740_rtc_s *) qemu_mallocz(sizeof(*s));
1546     s->base = JZ4740_PHYS_BASE(JZ4740_RTC_BASE);
1547     s->soc = soc;
1548     s->irq = irq;
1549
1550     s->hz_tm = qemu_new_timer(rt_clock, jz4740_rtc_hz, s);
1551
1552     jz4740_rtc_reset(s);
1553
1554     iomemtype =
1555         cpu_register_io_memory(0, jz4740_rtc_readfn, jz4740_rtc_writefn, s);
1556     cpu_register_physical_memory(s->base, 0x00001000, iomemtype);
1557     return s;
1558 }
1559
1560 struct jz4740_tcu_s
1561 {
1562     qemu_irq tcu_irq0;
1563     qemu_irq tcu_irq1;
1564     qemu_irq tcu_irq2;
1565
1566     target_phys_addr_t base;
1567     struct jz_state_s *soc;
1568
1569
1570     QEMUTimer *half_timer[8];
1571     QEMUTimer *full_timer[8];
1572     int64_t time[8];
1573
1574     uint32_t tsr;
1575     uint32_t ter;
1576     uint32_t tfr;
1577     uint32_t tmr;
1578
1579     uint32_t tdfr[8];
1580     uint32_t tdhr[8];
1581     uint32_t tcnt[8];
1582     uint32_t tcsr[8];
1583
1584     uint32_t prescale[8];
1585     uint32_t freq[8];
1586 };
1587
1588 static void jz4740_tcu_update_interrupt(struct jz4740_tcu_s *s)
1589 {
1590         //printf("s->tfr %x s->tmr %x \n",s->tfr,s->tmr);
1591     if (((s->tfr & 0x1) & (~(s->tmr & 0x1)))
1592         || ((s->tfr & 0x10000) & (~(s->tmr & 0x10000))))
1593     {
1594         qemu_set_irq(s->tcu_irq0, 1);
1595     }
1596     else
1597         qemu_set_irq(s->tcu_irq0, 0);
1598 #if 0
1599     if (((s->tfr & 0x2) & (~(s->tmr & 0x2)))
1600         || ((s->tfr & 0x20000) & (~(s->tmr & 0x20000))))
1601     {
1602         qemu_set_irq(s->tcu_irq1, 1);
1603     }
1604     else
1605         qemu_set_irq(s->tcu_irq1, 0);
1606
1607     if (((s->tfr & 0xfc) & (~(s->tmr & 0xfc)))
1608         || ((s->tfr & 0xfc0000) & (~(s->tmr & 0xfc0000))))
1609     {
1610         qemu_set_irq(s->tcu_irq2, 1);
1611     }
1612     else
1613         qemu_set_irq(s->tcu_irq2, 0);
1614     #endif
1615 }
1616
1617 #undef TCU_INDEX
1618 #define TCU_INDEX   0
1619 #include "mips_jz_glue.h"
1620 #define TCU_INDEX   1
1621 #include "mips_jz_glue.h"
1622 #define TCU_INDEX   2
1623 #include "mips_jz_glue.h"
1624 #define TCU_INDEX   3
1625 #include "mips_jz_glue.h"
1626 #define TCU_INDEX   4
1627 #include "mips_jz_glue.h"
1628 #define TCU_INDEX   5
1629 #include "mips_jz_glue.h"
1630 #define TCU_INDEX   6
1631 #include "mips_jz_glue.h"
1632 #define TCU_INDEX   7
1633 #include "mips_jz_glue.h"
1634 #undef TCU_INDEX
1635
1636 #define  jz4740_tcu_start(s) do {        \
1637         jz4740_tcu_start_half0(s);              \
1638         jz4740_tcu_start_full0(s);    \
1639         jz4740_tcu_start_half1(s); \
1640         jz4740_tcu_start_full1(s); \
1641         jz4740_tcu_start_half2(s); \
1642         jz4740_tcu_start_full2(s); \
1643         jz4740_tcu_start_half3(s); \
1644         jz4740_tcu_start_full3(s); \
1645         jz4740_tcu_start_half4(s); \
1646         jz4740_tcu_start_full4(s); \
1647         jz4740_tcu_start_half5(s); \
1648         jz4740_tcu_start_full5(s); \
1649         jz4740_tcu_start_half6(s); \
1650         jz4740_tcu_start_full6(s); \
1651         jz4740_tcu_start_half7(s); \
1652         jz4740_tcu_start_full7(s); \
1653 }while (0)
1654
1655 static void jz4740_tcu_if_reset(struct jz4740_tcu_s *s)
1656 {
1657     int i;
1658
1659     s->tsr = 0x0;
1660     s->ter = 0x0;
1661     s->tfr = 0x0;
1662     s->tmr = 0x0;
1663     for (i = 0; i < 8; i++)
1664     {
1665         s->tdfr[i] = 0xffff;
1666         s->tdhr[i] = 0x8000;
1667         s->tcnt[i] = 0x0;
1668         s->tcsr[i] = 0x0;
1669         s->half_timer[i] = NULL;
1670         s->full_timer[i] = NULL;
1671     }
1672 }
1673
1674 static void jz4740_tcu_if_write8(void *opaque, target_phys_addr_t addr,
1675                                  uint32_t value)
1676 {
1677     struct jz4740_tcu_s *s = (struct jz4740_tcu_s *) opaque;
1678
1679     debug_out(DEBUG_TCU, "jz4740_tcu_if_write8 addr %x value %x\n", addr,
1680               value);
1681
1682     switch (addr)
1683     {
1684     case 0x14:
1685         s->ter |= (value & 0xff);
1686         jz4740_tcu_start(s);
1687         break;
1688     case 0x18:
1689         s->ter &= ~(value & 0xff);
1690         jz4740_tcu_start(s);
1691         break;
1692     default:
1693         cpu_abort(s->soc->env,
1694                   "jz4740_tcu_if_write8 undefined addr " JZ_FMT_plx
1695                   " value %x \n", addr, value);
1696     }
1697
1698 }
1699
1700 static void jz4740_tcu_if_write32(void *opaque, target_phys_addr_t addr,
1701                                   uint32_t value)
1702 {
1703     struct jz4740_tcu_s *s = (struct jz4740_tcu_s *) opaque;
1704
1705     debug_out(DEBUG_TCU, "jz4740_tcu_if_write32 addr %x value %x\n", addr,
1706               value);
1707
1708         fprintf(fp, "jz4740_tcu_if_write32 addr %x value %x\n", addr,
1709               value);
1710     switch (addr)
1711     {
1712     case 0x2c:
1713         s->tsr |= (value & 0x100ff);
1714         jz4740_tcu_start(s);
1715         break;
1716     case 0x3c:
1717         s->tsr &= ~(value & 0x100ff);
1718         jz4740_tcu_start(s);
1719         break;
1720     case 0x24:
1721         s->tfr |= (value & 0xff00ff);
1722         break;
1723     case 0x28:
1724         s->tfr &= ~(value & 0xff00ff);
1725         break;
1726     case 0x34:
1727         s->tmr |= (value & 0xff00ff);
1728         jz4740_tcu_update_interrupt(s);
1729         break;
1730     case 0x38:
1731         s->tmr &= ~(value & 0xff00ff);
1732         jz4740_tcu_update_interrupt(s);
1733         break;
1734     default:
1735         cpu_abort(s->soc->env,
1736                   "jz4740_tcu_if_write32 undefined addr " JZ_FMT_plx
1737                   " value %x \n", addr, value);
1738
1739     }
1740 }
1741
1742 static uint32_t jz4740_tcu_if_read8(void *opaque, target_phys_addr_t addr)
1743 {
1744     struct jz4740_tcu_s *s = (struct jz4740_tcu_s *) opaque;
1745
1746     debug_out(DEBUG_TCU, "jz4740_tcu_if_read8 addr %x\n", addr);
1747
1748     switch (addr)
1749     {
1750     case 0x10:
1751         return s->ter;
1752     default:
1753         cpu_abort(s->soc->env,
1754                   "jz4740_tcu_if_read8 undefined addr " JZ_FMT_plx "\n", addr);
1755     }
1756     return (0);
1757 }
1758
1759 static uint32_t jz4740_tcu_if_read32(void *opaque, target_phys_addr_t addr)
1760 {
1761     struct jz4740_tcu_s *s = (struct jz4740_tcu_s *) opaque;
1762
1763     debug_out(DEBUG_TCU, "jz4740_tcu_if_read32 addr %x\n", addr);
1764
1765     switch (addr)
1766     {
1767     case 0x1c:
1768         return s->tsr;
1769     case 0x20:
1770         return s->tfr;
1771     case 0x30:
1772         return s->tmr;
1773     default:
1774         cpu_abort(s->soc->env,
1775                   "jz4740_tcu_if_read32 undefined addr " JZ_FMT_plx "\n", addr);
1776
1777     }
1778     return (0);
1779
1780 }
1781
1782 static CPUReadMemoryFunc *jz4740_tcu_if_readfn[] = {
1783     jz4740_tcu_if_read8, jz4740_badwidth_read32, jz4740_tcu_if_read32,
1784 };
1785
1786 static CPUWriteMemoryFunc *jz4740_tcu_if_writefn[] = {
1787     jz4740_tcu_if_write8, jz4740_badwidth_write32, jz4740_tcu_if_write32,
1788 };
1789
1790 static struct jz4740_tcu_s *jz4740_tcu_if_init(struct jz_state_s *soc,
1791                                                qemu_irq tcu_irq0,
1792                                                qemu_irq tcu_irq1,
1793                                                qemu_irq tcu_irq2)
1794 {
1795     int iomemtype;
1796     //int i;
1797
1798     struct jz4740_tcu_s *s = (struct jz4740_tcu_s *) qemu_mallocz(sizeof(*s));
1799     s->base = JZ4740_PHYS_BASE(JZ4740_TCU_BASE);
1800     s->soc = soc;
1801     s->tcu_irq0 = tcu_irq0;
1802     s->tcu_irq1 = tcu_irq1;
1803     s->tcu_irq2 = tcu_irq2;
1804
1805     jz4740_tcu_if_reset(s);
1806
1807     iomemtype =
1808         cpu_register_io_memory(0, jz4740_tcu_if_readfn, jz4740_tcu_if_writefn,
1809                                s);
1810     cpu_register_physical_memory(s->base, 0x00000040, iomemtype);
1811     return s;
1812
1813 }
1814
1815 static void jz4740_tcu_init(struct jz_state_s *soc,
1816                             struct jz4740_tcu_s *s, int timer_index)
1817 {
1818     switch (timer_index)
1819     {
1820     case 0x0:
1821         jz4740_tcu_init0(soc, s);
1822         break;
1823     case 0x1:
1824         jz4740_tcu_init1(soc, s);
1825         break;
1826     case 0x2:
1827         jz4740_tcu_init2(soc, s);
1828         break;
1829     case 0x3:
1830         jz4740_tcu_init3(soc, s);
1831         break;
1832     case 0x4:
1833         jz4740_tcu_init4(soc, s);
1834         break;
1835     case 0x5:
1836         jz4740_tcu_init5(soc, s);
1837         break;
1838     case 0x6:
1839         jz4740_tcu_init6(soc, s);
1840         break;
1841     case 0x7:
1842         jz4740_tcu_init7(soc, s);
1843         break;
1844     default:
1845         cpu_abort(s->soc->env,
1846                   "jz4740_tcu_init undefined timer %x \n", timer_index);
1847     }
1848 }
1849
1850 typedef void (*jz4740_lcd_fn_t) (uint8_t * d, const uint8_t * s, int width,
1851                                  const uint16_t * pal);
1852 struct jz_fb_descriptor
1853 {
1854     uint32_t fdadr;             /* Frame descriptor address register */
1855     uint32_t fsadr;             /* Frame source address register */
1856     uint32_t fidr;              /* Frame ID register */
1857     uint32_t ldcmd;             /* Command register */
1858 };
1859
1860 struct jz4740_lcdc_s
1861 {
1862     qemu_irq irq;
1863
1864     target_phys_addr_t base;
1865     struct jz_state_s *soc;
1866
1867     DisplayState *state;
1868     QEMUConsole *console;
1869     jz4740_lcd_fn_t *line_fn_tab;
1870     jz4740_lcd_fn_t line_fn;
1871
1872
1873     uint32_t lcdcfg;
1874     uint32_t lcdvsync;
1875     uint32_t lcdhsync;
1876     uint32_t lcdvat;
1877     uint32_t lcddah;
1878     uint32_t lcddav;
1879     uint32_t lcdps;
1880     uint32_t lcdcls;
1881     uint32_t lcdspl;
1882     uint32_t lcdrev;
1883     uint32_t lcdctrl;
1884     uint32_t lcdstate;
1885     uint32_t lcdiid;
1886     uint32_t lcdda0;
1887     uint32_t lcdsa0;
1888     uint32_t lcdfid0;
1889     uint32_t lcdcmd0;
1890     uint32_t lcdda1;
1891     uint32_t lcdsa1;
1892     uint32_t lcdfid1;
1893     uint32_t lcdcmd1;
1894
1895     uint32_t ena;
1896     uint32_t dis;
1897     uint32_t width;
1898     uint32_t height;
1899     uint32_t bpp;               /*bit per second */
1900     uint16_t palette[256];
1901     uint32_t invalidate;
1902
1903 };
1904
1905 /*bit per pixel*/
1906 static const int jz4740_lcd_bpp[0x6] = {
1907     1, 2, 4, 8, 16, 32          /*4740 uses 32 bit for 24bpp */
1908 };
1909
1910 static void jz4740_lcdc_reset(struct jz4740_lcdc_s *s)
1911 {
1912
1913 }
1914
1915 static uint32_t jz4740_lcdc_read(void *opaque, target_phys_addr_t addr)
1916 {
1917     struct jz4740_lcdc_s *s = (struct jz4740_lcdc_s *) opaque;
1918
1919     debug_out(DEBUG_LCDC, "jz4740_lcdc_read addr %x \n", addr);
1920     switch (addr)
1921     {
1922     case 0x0:
1923         return s->lcdcfg;
1924     case 0x4:
1925         return s->lcdvsync;
1926     case 0x8:
1927         return s->lcdhsync;
1928     case 0xc:
1929         return s->lcdvat;
1930     case 0x10:
1931         return s->lcddah;
1932     case 0x14:
1933         return s->lcddav;
1934     case 0x18:
1935         return s->lcdps;
1936     case 0x1c:
1937         return s->lcdcls;
1938     case 0x20:
1939         return s->lcdspl;
1940     case 0x24:
1941         return s->lcdrev;
1942     case 0x30:
1943         return s->lcdctrl;
1944     case 0x34:
1945         return s->lcdstate;
1946     case 0x38:
1947         return s->lcdiid;
1948     case 0x40:
1949         return s->lcdda0;
1950     case 0x44:
1951         return s->lcdsa0;
1952     case 0x48:
1953         return s->lcdfid0;
1954     case 0x4c:
1955         return s->lcdcmd0;
1956     case 0x50:
1957         return s->lcdda1;
1958     case 0x54:
1959         return s->lcdsa1;
1960     case 0x58:
1961         return s->lcdfid1;
1962     case 0x5c:
1963         return s->lcdcmd1;
1964     default:
1965         cpu_abort(s->soc->env,
1966                   "jz4740_lcdc_read undefined addr " JZ_FMT_plx " \n", addr);
1967
1968     }
1969
1970 }
1971
1972 static void jz4740_lcdc_write(void *opaque, target_phys_addr_t addr,
1973                               uint32_t value)
1974 {
1975     struct jz4740_lcdc_s *s = (struct jz4740_lcdc_s *) opaque;
1976
1977     debug_out(DEBUG_LCDC, "jz4740_lcdc_write addr %x value %x\n", addr, value);
1978
1979     switch (addr)
1980     {
1981     case 0x44:
1982     case 0x48:
1983     case 0x4c:
1984         JZ4740_RO_REG(addr);
1985         break;
1986     case 0x0:
1987         s->lcdcfg = value & 0x80ffffbf;
1988         break;
1989     case 0x4:
1990         s->lcdvsync = value & 0x7ff07ff;
1991         break;
1992     case 0x8:
1993         s->lcdhsync = value & 0x7ff07ff;
1994         break;
1995     case 0xc:
1996         s->lcdvat = value & 0x7ff07ff;
1997         break;
1998     case 0x10:
1999         s->lcddah = value & 0x7ff07ff;
2000         s->width = (value & 0x7ff) - ((value >> 16) & 0x7ff);
2001         break;
2002     case 0x14:
2003         s->height = (value & 0x7ff) - ((value >> 16) & 0x7ff);
2004         s->lcddav = value & 0x7ff07ff;
2005         break;
2006     case 0x18:
2007         s->lcdps = value & 0x7ff07ff;
2008         break;
2009     case 0x1c:
2010         s->lcdcls = value & 0x7ff07ff;
2011         break;
2012     case 0x20:
2013         s->lcdspl = value & 0x7ff07ff;
2014         break;
2015     case 0x24:
2016         s->lcdrev = value & 0x7ff0000;
2017         break;
2018     case 0x30:
2019         s->lcdctrl = value & 0x3fff3fff;
2020         s->ena = (value & 0x8) >> 3;
2021         s->dis = (value & 0x10) >> 4;
2022         s->bpp = jz4740_lcd_bpp[value & 0x7];
2023         if ((s->bpp == 1))
2024         {
2025             fprintf(stderr, "bpp =1 is not supported\n");
2026             exit(-1);
2027         }
2028         s->line_fn = s->line_fn_tab[value & 0x7];
2029         break;
2030     case 0x34:
2031         s->lcdstate = value & 0xbf;
2032         break;
2033     case 0x38:
2034         s->lcdiid = value;
2035         break;
2036     case 0x40:
2037         s->lcdda0 = value;
2038         break;
2039     case 0x50:
2040         s->lcdda1 = value;
2041         break;
2042     default:
2043         cpu_abort(s->soc->env,
2044                   "jz4740_lcdc_write undefined addr " JZ_FMT_plx " value %x \n",
2045                   addr, value);
2046     }
2047
2048 }
2049
2050 static CPUReadMemoryFunc *jz4740_lcdc_readfn[] = {
2051     jz4740_badwidth_read32, jz4740_badwidth_read32, jz4740_lcdc_read,
2052 };
2053
2054 static CPUWriteMemoryFunc *jz4740_lcdc_writefn[] = {
2055     jz4740_badwidth_write32, jz4740_badwidth_write32, jz4740_lcdc_write,
2056 };
2057
2058 #include "pixel_ops.h"
2059 #define JZ4740_LCD_PANEL
2060 #define DEPTH 8
2061 #include "mips_jz_glue.h"
2062 #define DEPTH 15
2063 #include "mips_jz_glue.h"
2064 #define DEPTH 16
2065 #include "mips_jz_glue.h"
2066 #define DEPTH 24
2067 #include "mips_jz_glue.h"
2068 #define DEPTH 32
2069 #include "mips_jz_glue.h"
2070 #undef JZ4740_LCD_PANEL
2071
2072 static void *jz4740_lcd_get_buffer(struct jz4740_lcdc_s *s,
2073                                    target_phys_addr_t addr)
2074 {
2075     uint32_t pd;
2076
2077     pd = cpu_get_physical_page_desc(addr);
2078     if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM)
2079         /* TODO */
2080         cpu_abort(cpu_single_env, "%s: framebuffer outside RAM!\n",
2081                   __FUNCTION__);
2082     else
2083         return phys_ram_base +
2084             (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
2085 }
2086
2087 static void jz4740_lcd_update_display(void *opaque)
2088 {
2089     struct jz4740_lcdc_s *s = (struct jz4740_lcdc_s *) opaque;
2090
2091     uint8_t *src, *dest;
2092     struct jz_fb_descriptor *fb_des;
2093
2094     int step, linesize;
2095     int y;
2096
2097
2098     if (!s->ena)
2099         return;
2100     if (s->dis)
2101         return;
2102
2103     if (!s->lcdda0)
2104         return;
2105
2106     fb_des = (struct jz_fb_descriptor *) jz4740_lcd_get_buffer(s, s->lcdda0);
2107     s->lcdda0 = fb_des->fdadr;
2108     s->lcdsa0 = fb_des->fsadr;
2109     s->lcdfid0 = fb_des->fidr;
2110     s->lcdcmd0 = fb_des->ldcmd;
2111
2112     src = (uint8_t *) jz4740_lcd_get_buffer(s, fb_des->fsadr);
2113     if (s->lcdcmd0 & (0x1 << 28))
2114     {
2115         /*palette */
2116         memcpy(s->palette, src, sizeof(s->palette));
2117         return;
2118     }
2119
2120     /*frame buffer */
2121
2122     if (s->width != ds_get_width(s->state) ||
2123         s->height != ds_get_height(s->state))
2124     {
2125         qemu_console_resize(s->console, s->width, s->height);
2126         s->invalidate = 1;
2127     }
2128
2129     step = (s->width * s->bpp) >> 3;
2130     dest = ds_get_data(s->state);
2131     linesize = ds_get_linesize(s->state);
2132
2133     //printf("s->width %d s->height  %d s->bpp %d linesize %d \n",s->width,s->height ,s->bpp,linesize);
2134
2135     for (y = 0; y < s->height; y++)
2136     {
2137         s->line_fn(dest, src, s->width, s->palette);
2138         //memcpy(dest,src,step);
2139         src += step;
2140         dest += linesize;
2141     }
2142
2143
2144     dpy_update(s->state, 0, 0, s->width, s->height);
2145     s->lcdstate |= 0x20;
2146     if ((s->lcdcmd0 & 0x40000000) && (!(s->lcdctrl & 0x2000)))
2147         qemu_set_irq(s->irq, 1);
2148 }
2149
2150 static inline void jz4740_lcd_invalidate_display(void *opaque)
2151 {
2152     struct jz4740_lcdc_s *s = (struct jz4740_lcdc_s *) opaque;
2153     s->invalidate = 1;
2154 }
2155
2156 static struct jz4740_lcdc_s *jz4740_lcdc_init(struct jz_state_s *soc,
2157                                               qemu_irq irq, DisplayState * ds)
2158 {
2159     int iomemtype;
2160
2161     struct jz4740_lcdc_s *s = (struct jz4740_lcdc_s *) qemu_mallocz(sizeof(*s));
2162     s->base = JZ4740_PHYS_BASE(JZ4740_LCD_BASE);
2163     s->soc = soc;
2164     s->irq = irq;
2165     s->state = ds;
2166
2167
2168     jz4740_lcdc_reset(s);
2169
2170     iomemtype =
2171         cpu_register_io_memory(0, jz4740_lcdc_readfn, jz4740_lcdc_writefn, s);
2172     cpu_register_physical_memory(s->base, 0x10000, iomemtype);
2173
2174     s->console = graphic_console_init(s->state, jz4740_lcd_update_display,
2175                                       jz4740_lcd_invalidate_display,
2176                                       NULL, NULL, s);
2177     switch (ds_get_bits_per_pixel(s->state))
2178     {
2179     case 0x0:
2180         s->line_fn_tab = qemu_mallocz(sizeof(jz4740_lcd_fn_t) * 6);
2181         break;
2182     case 8:
2183         s->line_fn_tab = jz4740_lcd_draw_fn_8;
2184         break;
2185     case 15:
2186         s->line_fn_tab = jz4740_lcd_draw_fn_15;
2187         break;
2188     case 16:
2189         s->line_fn_tab = jz4740_lcd_draw_fn_16;
2190         break;
2191     case 24:
2192         s->line_fn_tab = jz4740_lcd_draw_fn_24;
2193         break;
2194     case 32:
2195         s->line_fn_tab = jz4740_lcd_draw_fn_32;
2196         break;
2197     default:
2198         fprintf(stderr, "%s: Bad color depth\n", __FUNCTION__);
2199         exit(1);
2200     }
2201
2202     return s;
2203
2204 }
2205
2206 #define JZ4740_DMA_NUM         6
2207 struct jz4740_dma_s
2208 {
2209     qemu_irq irq;
2210
2211     target_phys_addr_t base;
2212     struct jz_state_s *soc;
2213
2214     uint32_t dmac;
2215     uint32_t dirqp;
2216     uint32_t ddr;
2217     uint32_t ddrs;
2218
2219     uint32_t dsa[JZ4740_DMA_NUM];
2220     uint32_t dta[JZ4740_DMA_NUM];
2221     uint32_t dtc[JZ4740_DMA_NUM];
2222     uint32_t drs[JZ4740_DMA_NUM];
2223     uint32_t dcs[JZ4740_DMA_NUM];
2224     uint32_t dcm[JZ4740_DMA_NUM];
2225     uint32_t dda[JZ4740_DMA_NUM];
2226
2227 };
2228
2229 struct jz4740_desc_s
2230 {
2231     uint32_t dcmd;              /* DCMD value for the current transfer */
2232     uint32_t dsadr;             /* DSAR value for the current transfer */
2233     uint32_t dtadr;             /* DTAR value for the current transfer */
2234     uint32_t ddadr;             /* Points to the next descriptor + transfer count */
2235 };
2236
2237 static inline void jz4740_dma_transfer(struct jz4740_dma_s *s,
2238                                        target_phys_addr_t src,
2239                                        target_phys_addr_t dest, uint32_t len)
2240 {
2241     uint32_t pd_src, pd_dest;
2242     uint8_t *sr, *de;
2243
2244     pd_src = cpu_get_physical_page_desc(src);
2245     if ((pd_src & ~TARGET_PAGE_MASK) != IO_MEM_RAM)
2246         /* TODO */
2247         cpu_abort(cpu_single_env, "%s: DMA source address %x outside RAM!\n",
2248                   __FUNCTION__, src);
2249     else
2250         sr = phys_ram_base +
2251             (pd_src & TARGET_PAGE_MASK) + (src & ~TARGET_PAGE_MASK);
2252
2253     pd_dest = cpu_get_physical_page_desc(dest);
2254     if ((pd_dest & ~TARGET_PAGE_MASK) != IO_MEM_RAM)
2255         /* TODO */
2256         cpu_abort(cpu_single_env,
2257                   "%s: DMA destination address %x outside RAM!\n",
2258                   __FUNCTION__, dest);
2259     else
2260         de = phys_ram_base +
2261             (pd_dest & TARGET_PAGE_MASK) + (dest & ~TARGET_PAGE_MASK);
2262
2263     memcpy(de, sr, len);
2264 }
2265
2266 static inline uint32_t jz4740_dma_unit_size(struct jz4740_dma_s *s,
2267                                             uint32_t cmd)
2268 {
2269     switch ((cmd & 0x700) >> 8)
2270     {
2271     case 0x0:
2272         return 4;
2273     case 0x1:
2274         return 1;
2275     case 0x2:
2276         return 2;
2277     case 0x3:
2278         return 16;
2279     case 0x4:
2280         return 32;
2281     }
2282     return (0);
2283 }
2284
2285
2286 /*No-descriptor transfer*/
2287 static inline void jz4740_dma_ndrun(struct jz4740_dma_s *s, int channel)
2288 {
2289     uint32_t len;
2290
2291     len = jz4740_dma_unit_size(s, s->dcs[channel]) * s->dtc[channel];
2292
2293     jz4740_dma_transfer(s, s->dsa[channel], s->dta[channel], len);
2294
2295     /*finish dma transfer */
2296     s->dtc[channel] = 0;
2297     /*set DIR QP */
2298     s->dirqp |= 1 << channel;
2299
2300     /*some cleanup work */
2301     /*clean AR TT GLOBAL AR */
2302     s->dcs[channel] &= 0xffffffe7;
2303     s->dmac &= 0xfffffffb;
2304
2305     if (s->dcm[channel] & 0x2)
2306         qemu_set_irq(s->irq, 1);
2307 }
2308
2309         /*descriptor transfer */
2310 static inline void jz4740_dma_drun(struct jz4740_dma_s *s, int channel)
2311 {
2312     struct jz4740_desc_s *desc;
2313     target_phys_addr_t desc_phy;
2314     uint32_t pd;
2315
2316     desc_phy = s->dda[channel];
2317     if (desc_phy & 0xf)
2318         cpu_abort(s->soc->env,
2319                   "jz4740_dma_drun descriptor address " JZ_FMT_plx
2320                   " must be 4 bytes aligned \n", desc_phy);
2321
2322     pd = cpu_get_physical_page_desc(desc_phy);
2323     if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM)
2324         cpu_abort(cpu_single_env,
2325                   "%s: DMA descriptor address " JZ_FMT_plx " outside RAM!\n",
2326                   __FUNCTION__, desc_phy);
2327     else
2328         desc = (struct jz4740_desc_s *) (phys_ram_base +
2329                                          (pd & TARGET_PAGE_MASK) +
2330                                          (desc_phy & ~TARGET_PAGE_MASK));
2331
2332     if (!desc)
2333         cpu_abort(cpu_single_env,
2334                   "%s: DMA descriptor " JZ_FMT_plx " is NULL!\n", __FUNCTION__,
2335                   (uint32_t) desc);
2336
2337     while (1)
2338     {
2339         if ((desc->dcmd & 0x8) && (!(desc->dcmd & 0x10)))
2340         {
2341             /*Stop DMA and set DCSN.INV=1 */
2342             s->dcs[channel] |= 1 << 6;
2343             return;
2344         }
2345         jz4740_dma_transfer(s, desc->dtadr, desc->dsadr,
2346                             (desc->ddadr & 0xffffff) *
2347                             jz4740_dma_unit_size(s, desc->dcmd));
2348
2349         if ((desc->dcmd) & (1 << 3))
2350             /*clear v */
2351             desc->dcmd &= ~(1 << 4);
2352         if (desc->dcmd & 0x1)
2353             /*set DCSN.CT=1 */
2354             s->dcs[channel] |= 0x2;
2355         else
2356             /*set DCSN.TT=1 */
2357             s->dcs[channel] |= 0x8;
2358
2359         if (desc->dcmd & 0x2)
2360             qemu_set_irq(s->irq, 1);
2361
2362         if ((desc->dcmd) & 0x1)
2363         {
2364             /*fetch next descriptor */
2365             desc_phy = s->dda[channel] & 0xfffff000;
2366             desc_phy += (desc->dtadr & 0xff000000) >> 24;
2367             pd = cpu_get_physical_page_desc(desc_phy);
2368             if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM)
2369                 cpu_abort(cpu_single_env,
2370                           "%s: DMA descriptor address %x outside RAM!\n",
2371                           __FUNCTION__, desc_phy);
2372             else
2373                 desc = (struct jz4740_desc_s *) (phys_ram_base +
2374                                                  (pd & TARGET_PAGE_MASK)
2375                                                  +
2376                                                  (desc_phy &
2377                                                   ~TARGET_PAGE_MASK));
2378             if (!desc)
2379                 cpu_abort(cpu_single_env,
2380                           "%s: DMA descriptor %x is NULL!\n",
2381                           __FUNCTION__, (uint32_t) desc);
2382         }
2383         else
2384             break;
2385     }
2386 }
2387
2388 static void jz4740_dma_en_channel(struct jz4740_dma_s *s, int channel)
2389 {
2390     if (s->dmac & 0x1)
2391     {
2392         if (s->dcs[channel] & (1 << 31))
2393         {
2394             /*NON DESCRIPTOR */
2395             jz4740_dma_ndrun(s, channel);
2396         }
2397     }
2398 }
2399
2400 static inline void jz4740_dma_en_global(struct jz4740_dma_s *s)
2401 {
2402     int channel;
2403     for (channel = 0; channel < JZ4740_DMA_NUM; channel++)
2404     {
2405         jz4740_dma_en_channel(s, channel);
2406     }
2407 }
2408
2409 static inline void jz4740_dma_en_dbn(struct jz4740_dma_s *s, int channel)
2410 {
2411     if ((s->dmac & 0x1) && (s->dcs[channel] & (1 << 31)))
2412     {
2413         jz4740_dma_drun(s, channel);
2414     }
2415 }
2416
2417 static void jz4740_dma_reset(struct jz4740_dma_s *s)
2418 {
2419
2420 }
2421
2422 static uint32_t jz4740_dma_read(void *opaque, target_phys_addr_t addr)
2423 {
2424     struct jz4740_dma_s *s = (struct jz4740_dma_s *) opaque;
2425     int channel;
2426
2427     debug_out(DEBUG_DMA, "jz4740_dma_read addr %x \n", addr);
2428     switch (addr)
2429     {
2430     case 0x300:
2431         return s->dmac;
2432     case 0x304:
2433         return s->dirqp;
2434     case 0x308:
2435         return s->ddr;
2436     case 0x0:
2437     case 0x20:
2438     case 0x40:
2439     case 0x60:
2440     case 0x80:
2441     case 0xa0:
2442         channel = (addr - 0x0) / 0x20;
2443         return s->dsa[channel];
2444     case 0x4:
2445     case 0x24:
2446     case 0x44:
2447     case 0x64:
2448     case 0x84:
2449     case 0xa4:
2450         channel = (addr - 0x4) / 0x20;
2451         return s->dta[channel];
2452     case 0x8:
2453     case 0x28:
2454     case 0x48:
2455     case 0x68:
2456     case 0x88:
2457     case 0xa8:
2458         channel = (addr - 0x8) / 0x20;
2459         return s->dtc[channel];
2460     case 0xc:
2461     case 0x2c:
2462     case 0x4c:
2463     case 0x6c:
2464     case 0x8c:
2465     case 0xac:
2466         channel = (addr - 0xc) / 0x20;
2467         return s->drs[channel];
2468     case 0x10:
2469     case 0x30:
2470     case 0x50:
2471     case 0x70:
2472     case 0x90:
2473     case 0xb0:
2474         channel = (addr - 0x10) / 0x20;
2475         return s->dcs[channel];
2476     case 0x14:
2477     case 0x34:
2478     case 0x54:
2479     case 0x74:
2480     case 0x94:
2481     case 0xb4:
2482         channel = (addr - 0x14) / 0x20;
2483         return s->dcm[channel];
2484     case 0x18:
2485     case 0x38:
2486     case 0x58:
2487     case 0x78:
2488     case 0x98:
2489     case 0xb8:
2490         channel = (addr - 0x18) / 0x20;
2491         return s->dda[channel];
2492     default:
2493         cpu_abort(s->soc->env,
2494                   "jz4740_dma_read undefined addr " JZ_FMT_plx "  \n", addr);
2495     }
2496     return (0);
2497 }
2498
2499 static void jz4740_dma_write(void *opaque, target_phys_addr_t addr,
2500                              uint32_t value)
2501 {
2502     struct jz4740_dma_s *s = (struct jz4740_dma_s *) opaque;
2503     int channel;
2504
2505     debug_out(DEBUG_DMA, "jz4740_dma_write addr %x value %x \n", addr, value);
2506     switch (addr)
2507     {
2508     case 0x304:
2509         JZ4740_RO_REG(addr);
2510         break;
2511     case 0x300:
2512         s->dmac = value & 0x30d;
2513         if (s->dmac & 0x1)
2514             jz4740_dma_en_global(s);
2515         break;
2516     case 0x308:
2517     case 0x30c:
2518         s->ddr = value & 0xff;
2519         for (channel = 0; channel < JZ4740_DMA_NUM; channel++)
2520         {
2521             if (s->ddr & (1 << channel))
2522             {
2523                 jz4740_dma_en_dbn(s, channel);
2524                 break;
2525             }
2526         }
2527         break;
2528     case 0x0:
2529     case 0x20:
2530     case 0x40:
2531     case 0x60:
2532     case 0x80:
2533     case 0xa0:
2534         channel = (addr - 0x0) / 0x20;
2535         s->dsa[channel] = value;
2536         break;
2537     case 0x4:
2538     case 0x24:
2539     case 0x44:
2540     case 0x64:
2541     case 0x84:
2542     case 0xa4:
2543         channel = (addr - 0x4) / 0x20;
2544         s->dta[channel] = value;
2545         break;
2546     case 0x8:
2547     case 0x28:
2548     case 0x48:
2549     case 0x68:
2550     case 0x88:
2551     case 0xa8:
2552         channel = (addr - 0x8) / 0x20;
2553         s->dtc[channel] = value;
2554         break;
2555     case 0xc:
2556     case 0x2c:
2557     case 0x4c:
2558     case 0x6c:
2559     case 0x8c:
2560     case 0xac:
2561         channel = (addr - 0xc) / 0x20;
2562         s->drs[channel] = value & 0x10;
2563         if (s->drs[channel] != 0x8)
2564         {
2565             fprintf(stderr, "Only auto request is supproted \n");
2566         }
2567         break;
2568     case 0x10:
2569     case 0x30:
2570     case 0x50:
2571     case 0x70:
2572     case 0x90:
2573     case 0xb0:
2574         channel = (addr - 0x10) / 0x20;
2575         s->dcs[channel] = value & 0x80ff005f;
2576         if (s->dcs[channel] & 0x1)
2577             jz4740_dma_en_channel(s, channel);
2578         break;
2579     case 0x14:
2580     case 0x34:
2581     case 0x54:
2582     case 0x74:
2583     case 0x94:
2584     case 0xb4:
2585         channel = (addr - 0x14) / 0x20;
2586         s->dcm[channel] = value & 0xcff79f;
2587         break;
2588     case 0x18:
2589     case 0x38:
2590     case 0x58:
2591     case 0x78:
2592     case 0x98:
2593     case 0xb8:
2594         channel = (addr - 0x18) / 0x20;
2595         s->dda[channel] = 0xfffffff0;
2596         break;
2597     default:
2598         cpu_abort(s->soc->env,
2599                   "jz4740_dma_read undefined addr " JZ_FMT_plx "  \n", addr);
2600     }
2601
2602 }
2603
2604 static CPUReadMemoryFunc *jz4740_dma_readfn[] = {
2605     jz4740_badwidth_read32, jz4740_badwidth_read32, jz4740_dma_read,
2606 };
2607
2608 static CPUWriteMemoryFunc *jz4740_dma_writefn[] = {
2609     jz4740_badwidth_write32, jz4740_badwidth_write32, jz4740_dma_write,
2610 };
2611
2612
2613 static struct jz4740_dma_s *jz4740_dma_init(struct jz_state_s *soc,
2614                                             qemu_irq irq)
2615 {
2616     int iomemtype;
2617     struct jz4740_dma_s *s = (struct jz4740_dma_s *) qemu_mallocz(sizeof(*s));
2618     s->base = JZ4740_PHYS_BASE(JZ4740_DMAC_BASE);
2619     s->soc = soc;
2620     s->irq = irq;
2621
2622     jz4740_dma_reset(s);
2623
2624     iomemtype =
2625         cpu_register_io_memory(0, jz4740_dma_readfn, jz4740_dma_writefn, s);
2626     cpu_register_physical_memory(s->base, 0x00010000, iomemtype);
2627     return s;
2628
2629 }
2630
2631 static void jz4740_cpu_reset(void *opaque)
2632 {
2633     fprintf(stderr, "%s: UNIMPLEMENTED!", __FUNCTION__);
2634 }
2635
2636 struct jz_state_s *jz4740_init(unsigned long sdram_size,
2637                                uint32_t osc_extal_freq, DisplayState * ds)
2638 {
2639     struct jz_state_s *s = (struct jz_state_s *)
2640         qemu_mallocz(sizeof(struct jz_state_s));
2641     ram_addr_t sram_base, sdram_base;
2642     qemu_irq *intc;
2643
2644     s->mpu_model = jz4740;
2645     s->env = cpu_init("jz4740");
2646
2647     if (!s->env)
2648     {
2649         fprintf(stderr, "Unable to find CPU definition\n");
2650         exit(1);
2651     }
2652
2653     debug_init();
2654     qemu_register_reset(jz4740_cpu_reset, s->env);
2655
2656     s->sdram_size = sdram_size;
2657     s->sram_size = JZ4740_SRAM_SIZE;
2658
2659     /* Clocks */
2660     jz_clk_init(s, osc_extal_freq);
2661
2662     /*map sram to 0x80000000 and sdram to 0x80004000 */
2663     sram_base = qemu_ram_alloc(s->sram_size);
2664     cpu_register_physical_memory(0x0, s->sram_size, (sram_base | IO_MEM_RAM));
2665     sdram_base = qemu_ram_alloc(s->sdram_size);
2666     cpu_register_physical_memory(JZ4740_SRAM_SIZE, s->sdram_size,
2667                                  (sdram_base | IO_MEM_RAM));
2668
2669     /* Init internal devices */
2670     cpu_mips_irq_init_cpu(s->env);
2671     cpu_mips_clock_init(s->env);
2672
2673
2674     /* Clocks */
2675     jz_clk_init(s, osc_extal_freq);
2676
2677     intc = jz4740_intc_init(s, s->env->irq[2]);
2678     s->cpm = jz4740_cpm_init(s);
2679     s->emc = jz4740_emc_init(s, intc[2]);
2680     s->gpio = jz4740_gpio_init(s, intc[25]);
2681     s->rtc = jz4740_rtc_init(s, intc[15]);
2682     s->tcu = jz4740_tcu_if_init(s, intc[23], intc[22], intc[21]);
2683     jz4740_tcu_init(s, s->tcu, 0);
2684     s->lcdc = jz4740_lcdc_init(s, intc[30], ds);
2685     s->dma = jz4740_dma_init(s, intc[20]);
2686
2687     if (serial_hds[0])
2688         serial_mm_init(0x10030000, 2, intc[9], 57600, serial_hds[0], 1);
2689
2690     return s;
2691 }