2 * Marvell MV88W8618 / Freecom MusicPal emulation.
4 * Copyright (c) 2008 Jan Kiszka
6 * This code is licenced under the GNU GPL v2.
16 #include "qemu-timer.h"
20 #include "audio/audio.h"
23 #define MP_ETH_BASE 0x80008000
24 #define MP_ETH_SIZE 0x00001000
26 #define MP_UART1_BASE 0x8000C840
27 #define MP_UART2_BASE 0x8000C940
29 #define MP_FLASHCFG_BASE 0x90006000
30 #define MP_FLASHCFG_SIZE 0x00001000
32 #define MP_AUDIO_BASE 0x90007000
33 #define MP_AUDIO_SIZE 0x00001000
35 #define MP_PIC_BASE 0x90008000
36 #define MP_PIC_SIZE 0x00001000
38 #define MP_PIT_BASE 0x90009000
39 #define MP_PIT_SIZE 0x00001000
41 #define MP_LCD_BASE 0x9000c000
42 #define MP_LCD_SIZE 0x00001000
44 #define MP_SRAM_BASE 0xC0000000
45 #define MP_SRAM_SIZE 0x00020000
47 #define MP_RAM_DEFAULT_SIZE 32*1024*1024
48 #define MP_FLASH_SIZE_MAX 32*1024*1024
50 #define MP_TIMER1_IRQ 4
52 #define MP_TIMER4_IRQ 7
55 #define MP_UART1_IRQ 11
56 #define MP_UART2_IRQ 11
57 #define MP_GPIO_IRQ 12
59 #define MP_AUDIO_IRQ 30
61 static uint32_t gpio_in_state
= 0xffffffff;
62 static uint32_t gpio_isr
;
63 static uint32_t gpio_out_state
;
64 static ram_addr_t sram_off
;
66 /* Address conversion helpers */
67 static void *target2host_addr(uint32_t addr
)
69 if (addr
< MP_SRAM_BASE
) {
70 if (addr
>= MP_RAM_DEFAULT_SIZE
)
72 return (void *)(phys_ram_base
+ addr
);
74 if (addr
>= MP_SRAM_BASE
+ MP_SRAM_SIZE
)
76 return (void *)(phys_ram_base
+ sram_off
+ addr
- MP_SRAM_BASE
);
80 static uint32_t host2target_addr(void *addr
)
82 if (addr
< ((void *)phys_ram_base
) + sram_off
)
83 return (unsigned long)addr
- (unsigned long)phys_ram_base
;
85 return (unsigned long)addr
- (unsigned long)phys_ram_base
-
86 sram_off
+ MP_SRAM_BASE
;
90 typedef enum i2c_state
{
113 typedef struct i2c_interface
{
122 static void i2c_enter_stop(i2c_interface
*i2c
)
124 if (i2c
->current_addr
>= 0)
125 i2c_end_transfer(i2c
->bus
);
126 i2c
->current_addr
= -1;
127 i2c
->state
= STOPPED
;
130 static void i2c_state_update(i2c_interface
*i2c
, int data
, int clock
)
135 switch (i2c
->state
) {
137 if (data
== 0 && i2c
->last_data
== 1 && clock
== 1)
138 i2c
->state
= INITIALIZING
;
142 if (clock
== 0 && i2c
->last_clock
== 1 && data
== 0)
143 i2c
->state
= SENDING_BIT7
;
148 case SENDING_BIT7
... SENDING_BIT0
:
149 if (clock
== 0 && i2c
->last_clock
== 1) {
150 i2c
->buffer
= (i2c
->buffer
<< 1) | data
;
151 i2c
->state
++; /* will end up in WAITING_FOR_ACK */
152 } else if (data
== 1 && i2c
->last_data
== 0 && clock
== 1)
156 case WAITING_FOR_ACK
:
157 if (clock
== 0 && i2c
->last_clock
== 1) {
158 if (i2c
->current_addr
< 0) {
159 i2c
->current_addr
= i2c
->buffer
;
160 i2c_start_transfer(i2c
->bus
, i2c
->current_addr
& 0xfe,
163 i2c_send(i2c
->bus
, i2c
->buffer
);
164 if (i2c
->current_addr
& 1) {
165 i2c
->state
= RECEIVING_BIT7
;
166 i2c
->buffer
= i2c_recv(i2c
->bus
);
168 i2c
->state
= SENDING_BIT7
;
169 } else if (data
== 1 && i2c
->last_data
== 0 && clock
== 1)
173 case RECEIVING_BIT7
... RECEIVING_BIT0
:
174 if (clock
== 0 && i2c
->last_clock
== 1) {
175 i2c
->state
++; /* will end up in SENDING_ACK */
177 } else if (data
== 1 && i2c
->last_data
== 0 && clock
== 1)
182 if (clock
== 0 && i2c
->last_clock
== 1) {
183 i2c
->state
= RECEIVING_BIT7
;
185 i2c
->buffer
= i2c_recv(i2c
->bus
);
188 } else if (data
== 1 && i2c
->last_data
== 0 && clock
== 1)
193 i2c
->last_data
= data
;
194 i2c
->last_clock
= clock
;
197 static int i2c_get_data(i2c_interface
*i2c
)
202 switch (i2c
->state
) {
203 case RECEIVING_BIT7
... RECEIVING_BIT0
:
204 return (i2c
->buffer
>> 7);
206 case WAITING_FOR_ACK
:
212 static i2c_interface
*mixer_i2c
;
216 /* Audio register offsets */
217 #define MP_AUDIO_PLAYBACK_MODE 0x00
218 #define MP_AUDIO_CLOCK_DIV 0x18
219 #define MP_AUDIO_IRQ_STATUS 0x20
220 #define MP_AUDIO_IRQ_ENABLE 0x24
221 #define MP_AUDIO_TX_START_LO 0x28
222 #define MP_AUDIO_TX_THRESHOLD 0x2C
223 #define MP_AUDIO_TX_STATUS 0x38
224 #define MP_AUDIO_TX_START_HI 0x40
226 /* Status register and IRQ enable bits */
227 #define MP_AUDIO_TX_HALF (1 << 6)
228 #define MP_AUDIO_TX_FULL (1 << 7)
230 /* Playback mode bits */
231 #define MP_AUDIO_16BIT_SAMPLE (1 << 0)
232 #define MP_AUDIO_PLAYBACK_EN (1 << 7)
233 #define MP_AUDIO_CLOCK_24MHZ (1 << 9)
234 #define MP_AUDIO_MONO (1 << 14)
236 /* Wolfson 8750 I2C address */
237 #define MP_WM_ADDR 0x34
239 static const char audio_name
[] = "mv88w8618";
241 typedef struct musicpal_audio_state
{
243 uint32_t playback_mode
;
246 unsigned long phys_buf
;
247 int8_t *target_buffer
;
248 unsigned int threshold
;
249 unsigned int play_pos
;
250 unsigned int last_free
;
253 } musicpal_audio_state
;
255 static void audio_callback(void *opaque
, int free_out
, int free_in
)
257 musicpal_audio_state
*s
= opaque
;
258 int16_t *codec_buffer
;
262 if (!(s
->playback_mode
& MP_AUDIO_PLAYBACK_EN
))
265 if (s
->playback_mode
& MP_AUDIO_16BIT_SAMPLE
)
268 if (!(s
->playback_mode
& MP_AUDIO_MONO
))
271 block_size
= s
->threshold
/2;
272 if (free_out
- s
->last_free
< block_size
)
275 mem_buffer
= s
->target_buffer
+ s
->play_pos
;
276 if (s
->playback_mode
& MP_AUDIO_16BIT_SAMPLE
) {
277 if (s
->playback_mode
& MP_AUDIO_MONO
) {
278 codec_buffer
= wm8750_dac_buffer(s
->wm
, block_size
>> 1);
279 for (pos
= 0; pos
< block_size
; pos
+= 2) {
280 *codec_buffer
++ = *(int16_t *)mem_buffer
;
281 *codec_buffer
++ = *(int16_t *)mem_buffer
;
285 memcpy(wm8750_dac_buffer(s
->wm
, block_size
>> 2),
286 (uint32_t *)mem_buffer
, block_size
);
288 if (s
->playback_mode
& MP_AUDIO_MONO
) {
289 codec_buffer
= wm8750_dac_buffer(s
->wm
, block_size
);
290 for (pos
= 0; pos
< block_size
; pos
++) {
291 *codec_buffer
++ = cpu_to_le16(256 * *mem_buffer
);
292 *codec_buffer
++ = cpu_to_le16(256 * *mem_buffer
++);
295 codec_buffer
= wm8750_dac_buffer(s
->wm
, block_size
>> 1);
296 for (pos
= 0; pos
< block_size
; pos
+= 2) {
297 *codec_buffer
++ = cpu_to_le16(256 * *mem_buffer
++);
298 *codec_buffer
++ = cpu_to_le16(256 * *mem_buffer
++);
302 wm8750_dac_commit(s
->wm
);
304 s
->last_free
= free_out
- block_size
;
306 if (s
->play_pos
== 0) {
307 s
->status
|= MP_AUDIO_TX_HALF
;
308 s
->play_pos
= block_size
;
310 s
->status
|= MP_AUDIO_TX_FULL
;
314 if (s
->status
& s
->irq_enable
)
315 qemu_irq_raise(s
->irq
);
318 static void musicpal_audio_clock_update(musicpal_audio_state
*s
)
322 if (s
->playback_mode
& MP_AUDIO_CLOCK_24MHZ
)
323 rate
= 24576000 / 64; /* 24.576MHz */
325 rate
= 11289600 / 64; /* 11.2896MHz */
327 rate
/= ((s
->clock_div
>> 8) & 0xff) + 1;
329 wm8750_set_bclk_in(s
->wm
, rate
);
332 static uint32_t musicpal_audio_read(void *opaque
, target_phys_addr_t offset
)
334 musicpal_audio_state
*s
= opaque
;
337 case MP_AUDIO_PLAYBACK_MODE
:
338 return s
->playback_mode
;
340 case MP_AUDIO_CLOCK_DIV
:
343 case MP_AUDIO_IRQ_STATUS
:
346 case MP_AUDIO_IRQ_ENABLE
:
347 return s
->irq_enable
;
349 case MP_AUDIO_TX_STATUS
:
350 return s
->play_pos
>> 2;
357 static void musicpal_audio_write(void *opaque
, target_phys_addr_t offset
,
360 musicpal_audio_state
*s
= opaque
;
363 case MP_AUDIO_PLAYBACK_MODE
:
364 if (value
& MP_AUDIO_PLAYBACK_EN
&&
365 !(s
->playback_mode
& MP_AUDIO_PLAYBACK_EN
)) {
370 s
->playback_mode
= value
;
371 musicpal_audio_clock_update(s
);
374 case MP_AUDIO_CLOCK_DIV
:
375 s
->clock_div
= value
;
378 musicpal_audio_clock_update(s
);
381 case MP_AUDIO_IRQ_STATUS
:
385 case MP_AUDIO_IRQ_ENABLE
:
386 s
->irq_enable
= value
;
387 if (s
->status
& s
->irq_enable
)
388 qemu_irq_raise(s
->irq
);
391 case MP_AUDIO_TX_START_LO
:
392 s
->phys_buf
= (s
->phys_buf
& 0xFFFF0000) | (value
& 0xFFFF);
393 s
->target_buffer
= target2host_addr(s
->phys_buf
);
398 case MP_AUDIO_TX_THRESHOLD
:
399 s
->threshold
= (value
+ 1) * 4;
402 case MP_AUDIO_TX_START_HI
:
403 s
->phys_buf
= (s
->phys_buf
& 0xFFFF) | (value
<< 16);
404 s
->target_buffer
= target2host_addr(s
->phys_buf
);
411 static void musicpal_audio_reset(void *opaque
)
413 musicpal_audio_state
*s
= opaque
;
415 s
->playback_mode
= 0;
420 static CPUReadMemoryFunc
*musicpal_audio_readfn
[] = {
426 static CPUWriteMemoryFunc
*musicpal_audio_writefn
[] = {
427 musicpal_audio_write
,
428 musicpal_audio_write
,
432 static i2c_interface
*musicpal_audio_init(uint32_t base
, qemu_irq irq
)
435 musicpal_audio_state
*s
;
441 AUD_log(audio_name
, "No audio state\n");
445 s
= qemu_mallocz(sizeof(musicpal_audio_state
));
448 i2c
= qemu_mallocz(sizeof(i2c_interface
));
449 i2c
->bus
= i2c_init_bus();
450 i2c
->current_addr
= -1;
452 s
->wm
= wm8750_init(i2c
->bus
, audio
);
455 i2c_set_slave_address(s
->wm
, MP_WM_ADDR
);
456 wm8750_data_req_set(s
->wm
, audio_callback
, s
);
458 iomemtype
= cpu_register_io_memory(0, musicpal_audio_readfn
,
459 musicpal_audio_writefn
, s
);
460 cpu_register_physical_memory(base
, MP_AUDIO_SIZE
, iomemtype
);
462 qemu_register_reset(musicpal_audio_reset
, s
);
466 #else /* !HAS_AUDIO */
467 static i2c_interface
*musicpal_audio_init(uint32_t base
, qemu_irq irq
)
471 #endif /* !HAS_AUDIO */
473 /* Ethernet register offsets */
474 #define MP_ETH_SMIR 0x010
475 #define MP_ETH_PCXR 0x408
476 #define MP_ETH_SDCMR 0x448
477 #define MP_ETH_ICR 0x450
478 #define MP_ETH_IMR 0x458
479 #define MP_ETH_FRDP0 0x480
480 #define MP_ETH_FRDP1 0x484
481 #define MP_ETH_FRDP2 0x488
482 #define MP_ETH_FRDP3 0x48C
483 #define MP_ETH_CRDP0 0x4A0
484 #define MP_ETH_CRDP1 0x4A4
485 #define MP_ETH_CRDP2 0x4A8
486 #define MP_ETH_CRDP3 0x4AC
487 #define MP_ETH_CTDP0 0x4E0
488 #define MP_ETH_CTDP1 0x4E4
489 #define MP_ETH_CTDP2 0x4E8
490 #define MP_ETH_CTDP3 0x4EC
493 #define MP_ETH_SMIR_DATA 0x0000FFFF
494 #define MP_ETH_SMIR_ADDR 0x03FF0000
495 #define MP_ETH_SMIR_OPCODE (1 << 26) /* Read value */
496 #define MP_ETH_SMIR_RDVALID (1 << 27)
499 #define MP_ETH_PHY1_BMSR 0x00210000
500 #define MP_ETH_PHY1_PHYSID1 0x00410000
501 #define MP_ETH_PHY1_PHYSID2 0x00610000
503 #define MP_PHY_BMSR_LINK 0x0004
504 #define MP_PHY_BMSR_AUTONEG 0x0008
506 #define MP_PHY_88E3015 0x01410E20
508 /* TX descriptor status */
509 #define MP_ETH_TX_OWN (1 << 31)
511 /* RX descriptor status */
512 #define MP_ETH_RX_OWN (1 << 31)
514 /* Interrupt cause/mask bits */
515 #define MP_ETH_IRQ_RX_BIT 0
516 #define MP_ETH_IRQ_RX (1 << MP_ETH_IRQ_RX_BIT)
517 #define MP_ETH_IRQ_TXHI_BIT 2
518 #define MP_ETH_IRQ_TXLO_BIT 3
520 /* Port config bits */
521 #define MP_ETH_PCXR_2BSM_BIT 28 /* 2-byte incoming suffix */
523 /* SDMA command bits */
524 #define MP_ETH_CMD_TXHI (1 << 23)
525 #define MP_ETH_CMD_TXLO (1 << 22)
527 typedef struct mv88w8618_tx_desc
{
535 typedef struct mv88w8618_rx_desc
{
538 uint16_t buffer_size
;
543 typedef struct mv88w8618_eth_state
{
550 mv88w8618_tx_desc
*tx_queue
[2];
551 mv88w8618_rx_desc
*rx_queue
[4];
552 mv88w8618_rx_desc
*frx_queue
[4];
553 mv88w8618_rx_desc
*cur_rx
[4];
555 } mv88w8618_eth_state
;
557 static int eth_can_receive(void *opaque
)
562 static void eth_receive(void *opaque
, const uint8_t *buf
, int size
)
564 mv88w8618_eth_state
*s
= opaque
;
565 mv88w8618_rx_desc
*desc
;
568 for (i
= 0; i
< 4; i
++) {
573 if (le32_to_cpu(desc
->cmdstat
) & MP_ETH_RX_OWN
&&
574 le16_to_cpu(desc
->buffer_size
) >= size
) {
575 memcpy(target2host_addr(le32_to_cpu(desc
->buffer
) +
578 desc
->bytes
= cpu_to_le16(size
+ s
->vlan_header
);
579 desc
->cmdstat
&= cpu_to_le32(~MP_ETH_RX_OWN
);
580 s
->cur_rx
[i
] = target2host_addr(le32_to_cpu(desc
->next
));
582 s
->icr
|= MP_ETH_IRQ_RX
;
584 qemu_irq_raise(s
->irq
);
587 desc
= target2host_addr(le32_to_cpu(desc
->next
));
588 } while (desc
!= s
->rx_queue
[i
]);
592 static void eth_send(mv88w8618_eth_state
*s
, int queue_index
)
594 mv88w8618_tx_desc
*desc
= s
->tx_queue
[queue_index
];
597 if (le32_to_cpu(desc
->cmdstat
) & MP_ETH_TX_OWN
) {
598 qemu_send_packet(s
->vc
,
599 target2host_addr(le32_to_cpu(desc
->buffer
)),
600 le16_to_cpu(desc
->bytes
));
601 desc
->cmdstat
&= cpu_to_le32(~MP_ETH_TX_OWN
);
602 s
->icr
|= 1 << (MP_ETH_IRQ_TXLO_BIT
- queue_index
);
604 desc
= target2host_addr(le32_to_cpu(desc
->next
));
605 } while (desc
!= s
->tx_queue
[queue_index
]);
608 static uint32_t mv88w8618_eth_read(void *opaque
, target_phys_addr_t offset
)
610 mv88w8618_eth_state
*s
= opaque
;
614 if (s
->smir
& MP_ETH_SMIR_OPCODE
) {
615 switch (s
->smir
& MP_ETH_SMIR_ADDR
) {
616 case MP_ETH_PHY1_BMSR
:
617 return MP_PHY_BMSR_LINK
| MP_PHY_BMSR_AUTONEG
|
619 case MP_ETH_PHY1_PHYSID1
:
620 return (MP_PHY_88E3015
>> 16) | MP_ETH_SMIR_RDVALID
;
621 case MP_ETH_PHY1_PHYSID2
:
622 return (MP_PHY_88E3015
& 0xFFFF) | MP_ETH_SMIR_RDVALID
;
624 return MP_ETH_SMIR_RDVALID
;
635 case MP_ETH_FRDP0
... MP_ETH_FRDP3
:
636 return host2target_addr(s
->frx_queue
[(offset
- MP_ETH_FRDP0
)/4]);
638 case MP_ETH_CRDP0
... MP_ETH_CRDP3
:
639 return host2target_addr(s
->rx_queue
[(offset
- MP_ETH_CRDP0
)/4]);
641 case MP_ETH_CTDP0
... MP_ETH_CTDP3
:
642 return host2target_addr(s
->tx_queue
[(offset
- MP_ETH_CTDP0
)/4]);
649 static void mv88w8618_eth_write(void *opaque
, target_phys_addr_t offset
,
652 mv88w8618_eth_state
*s
= opaque
;
660 s
->vlan_header
= ((value
>> MP_ETH_PCXR_2BSM_BIT
) & 1) * 2;
664 if (value
& MP_ETH_CMD_TXHI
)
666 if (value
& MP_ETH_CMD_TXLO
)
668 if (value
& (MP_ETH_CMD_TXHI
| MP_ETH_CMD_TXLO
) && s
->icr
& s
->imr
)
669 qemu_irq_raise(s
->irq
);
679 qemu_irq_raise(s
->irq
);
682 case MP_ETH_FRDP0
... MP_ETH_FRDP3
:
683 s
->frx_queue
[(offset
- MP_ETH_FRDP0
)/4] = target2host_addr(value
);
686 case MP_ETH_CRDP0
... MP_ETH_CRDP3
:
687 s
->rx_queue
[(offset
- MP_ETH_CRDP0
)/4] =
688 s
->cur_rx
[(offset
- MP_ETH_CRDP0
)/4] = target2host_addr(value
);
691 case MP_ETH_CTDP0
... MP_ETH_CTDP3
:
692 s
->tx_queue
[(offset
- MP_ETH_CTDP0
)/4] = target2host_addr(value
);
697 static CPUReadMemoryFunc
*mv88w8618_eth_readfn
[] = {
703 static CPUWriteMemoryFunc
*mv88w8618_eth_writefn
[] = {
709 static void eth_cleanup(VLANClientState
*vc
)
711 mv88w8618_eth_state
*s
= vc
->opaque
;
713 cpu_unregister_io_memory(s
->mmio_index
);
718 static void mv88w8618_eth_init(NICInfo
*nd
, uint32_t base
, qemu_irq irq
)
720 mv88w8618_eth_state
*s
;
722 qemu_check_nic_model(nd
, "mv88w8618");
724 s
= qemu_mallocz(sizeof(mv88w8618_eth_state
));
726 s
->vc
= qemu_new_vlan_client(nd
->vlan
, nd
->model
, nd
->name
,
727 eth_receive
, eth_can_receive
,
729 s
->mmio_index
= cpu_register_io_memory(0, mv88w8618_eth_readfn
,
730 mv88w8618_eth_writefn
, s
);
731 cpu_register_physical_memory(base
, MP_ETH_SIZE
, s
->mmio_index
);
734 /* LCD register offsets */
735 #define MP_LCD_IRQCTRL 0x180
736 #define MP_LCD_IRQSTAT 0x184
737 #define MP_LCD_SPICTRL 0x1ac
738 #define MP_LCD_INST 0x1bc
739 #define MP_LCD_DATA 0x1c0
742 #define MP_LCD_SPI_DATA 0x00100011
743 #define MP_LCD_SPI_CMD 0x00104011
744 #define MP_LCD_SPI_INVALID 0x00000000
747 #define MP_LCD_INST_SETPAGE0 0xB0
749 #define MP_LCD_INST_SETPAGE7 0xB7
751 #define MP_LCD_TEXTCOLOR 0xe0e0ff /* RRGGBB */
753 typedef struct musicpal_lcd_state
{
759 uint8_t video_ram
[128*64/8];
760 } musicpal_lcd_state
;
762 static uint32_t lcd_brightness
;
764 static uint8_t scale_lcd_color(uint8_t col
)
768 switch (lcd_brightness
) {
769 case 0x00000007: /* 0 */
772 case 0x00020000: /* 1 */
773 return (tmp
* 1) / 7;
775 case 0x00020001: /* 2 */
776 return (tmp
* 2) / 7;
778 case 0x00040000: /* 3 */
779 return (tmp
* 3) / 7;
781 case 0x00010006: /* 4 */
782 return (tmp
* 4) / 7;
784 case 0x00020005: /* 5 */
785 return (tmp
* 5) / 7;
787 case 0x00040003: /* 6 */
788 return (tmp
* 6) / 7;
790 case 0x00030004: /* 7 */
796 #define SET_LCD_PIXEL(depth, type) \
797 static inline void glue(set_lcd_pixel, depth) \
798 (musicpal_lcd_state *s, int x, int y, type col) \
801 type *pixel = &((type *) ds_get_data(s->ds))[(y * 128 * 3 + x) * 3]; \
803 for (dy = 0; dy < 3; dy++, pixel += 127 * 3) \
804 for (dx = 0; dx < 3; dx++, pixel++) \
807 SET_LCD_PIXEL(8, uint8_t)
808 SET_LCD_PIXEL(16, uint16_t)
809 SET_LCD_PIXEL(32, uint32_t)
811 #include "pixel_ops.h"
813 static void lcd_refresh(void *opaque
)
815 musicpal_lcd_state
*s
= opaque
;
818 switch (ds_get_bits_per_pixel(s
->ds
)) {
821 #define LCD_REFRESH(depth, func) \
823 col = func(scale_lcd_color((MP_LCD_TEXTCOLOR >> 16) & 0xff), \
824 scale_lcd_color((MP_LCD_TEXTCOLOR >> 8) & 0xff), \
825 scale_lcd_color(MP_LCD_TEXTCOLOR & 0xff)); \
826 for (x = 0; x < 128; x++) \
827 for (y = 0; y < 64; y++) \
828 if (s->video_ram[x + (y/8)*128] & (1 << (y % 8))) \
829 glue(set_lcd_pixel, depth)(s, x, y, col); \
831 glue(set_lcd_pixel, depth)(s, x, y, 0); \
833 LCD_REFRESH(8, rgb_to_pixel8
)
834 LCD_REFRESH(16, rgb_to_pixel16
)
835 LCD_REFRESH(32, rgb_to_pixel32
)
837 cpu_abort(cpu_single_env
, "unsupported colour depth %i\n",
838 ds_get_bits_per_pixel(s
->ds
));
841 dpy_update(s
->ds
, 0, 0, 128*3, 64*3);
844 static void lcd_invalidate(void *opaque
)
848 static uint32_t musicpal_lcd_read(void *opaque
, target_phys_addr_t offset
)
850 musicpal_lcd_state
*s
= opaque
;
861 static void musicpal_lcd_write(void *opaque
, target_phys_addr_t offset
,
864 musicpal_lcd_state
*s
= opaque
;
872 if (value
== MP_LCD_SPI_DATA
|| value
== MP_LCD_SPI_CMD
)
875 s
->mode
= MP_LCD_SPI_INVALID
;
879 if (value
>= MP_LCD_INST_SETPAGE0
&& value
<= MP_LCD_INST_SETPAGE7
) {
880 s
->page
= value
- MP_LCD_INST_SETPAGE0
;
886 if (s
->mode
== MP_LCD_SPI_CMD
) {
887 if (value
>= MP_LCD_INST_SETPAGE0
&&
888 value
<= MP_LCD_INST_SETPAGE7
) {
889 s
->page
= value
- MP_LCD_INST_SETPAGE0
;
892 } else if (s
->mode
== MP_LCD_SPI_DATA
) {
893 s
->video_ram
[s
->page
*128 + s
->page_off
] = value
;
894 s
->page_off
= (s
->page_off
+ 1) & 127;
900 static CPUReadMemoryFunc
*musicpal_lcd_readfn
[] = {
906 static CPUWriteMemoryFunc
*musicpal_lcd_writefn
[] = {
912 static void musicpal_lcd_init(uint32_t base
)
914 musicpal_lcd_state
*s
;
917 s
= qemu_mallocz(sizeof(musicpal_lcd_state
));
918 iomemtype
= cpu_register_io_memory(0, musicpal_lcd_readfn
,
919 musicpal_lcd_writefn
, s
);
920 cpu_register_physical_memory(base
, MP_LCD_SIZE
, iomemtype
);
922 s
->ds
= graphic_console_init(lcd_refresh
, lcd_invalidate
,
924 qemu_console_resize(s
->ds
, 128*3, 64*3);
927 /* PIC register offsets */
928 #define MP_PIC_STATUS 0x00
929 #define MP_PIC_ENABLE_SET 0x08
930 #define MP_PIC_ENABLE_CLR 0x0C
932 typedef struct mv88w8618_pic_state
937 } mv88w8618_pic_state
;
939 static void mv88w8618_pic_update(mv88w8618_pic_state
*s
)
941 qemu_set_irq(s
->parent_irq
, (s
->level
& s
->enabled
));
944 static void mv88w8618_pic_set_irq(void *opaque
, int irq
, int level
)
946 mv88w8618_pic_state
*s
= opaque
;
949 s
->level
|= 1 << irq
;
951 s
->level
&= ~(1 << irq
);
952 mv88w8618_pic_update(s
);
955 static uint32_t mv88w8618_pic_read(void *opaque
, target_phys_addr_t offset
)
957 mv88w8618_pic_state
*s
= opaque
;
961 return s
->level
& s
->enabled
;
968 static void mv88w8618_pic_write(void *opaque
, target_phys_addr_t offset
,
971 mv88w8618_pic_state
*s
= opaque
;
974 case MP_PIC_ENABLE_SET
:
978 case MP_PIC_ENABLE_CLR
:
979 s
->enabled
&= ~value
;
983 mv88w8618_pic_update(s
);
986 static void mv88w8618_pic_reset(void *opaque
)
988 mv88w8618_pic_state
*s
= opaque
;
994 static CPUReadMemoryFunc
*mv88w8618_pic_readfn
[] = {
1000 static CPUWriteMemoryFunc
*mv88w8618_pic_writefn
[] = {
1001 mv88w8618_pic_write
,
1002 mv88w8618_pic_write
,
1006 static qemu_irq
*mv88w8618_pic_init(uint32_t base
, qemu_irq parent_irq
)
1008 mv88w8618_pic_state
*s
;
1012 s
= qemu_mallocz(sizeof(mv88w8618_pic_state
));
1013 qi
= qemu_allocate_irqs(mv88w8618_pic_set_irq
, s
, 32);
1014 s
->parent_irq
= parent_irq
;
1015 iomemtype
= cpu_register_io_memory(0, mv88w8618_pic_readfn
,
1016 mv88w8618_pic_writefn
, s
);
1017 cpu_register_physical_memory(base
, MP_PIC_SIZE
, iomemtype
);
1019 qemu_register_reset(mv88w8618_pic_reset
, s
);
1024 /* PIT register offsets */
1025 #define MP_PIT_TIMER1_LENGTH 0x00
1027 #define MP_PIT_TIMER4_LENGTH 0x0C
1028 #define MP_PIT_CONTROL 0x10
1029 #define MP_PIT_TIMER1_VALUE 0x14
1031 #define MP_PIT_TIMER4_VALUE 0x20
1032 #define MP_BOARD_RESET 0x34
1034 /* Magic board reset value (probably some watchdog behind it) */
1035 #define MP_BOARD_RESET_MAGIC 0x10000
1037 typedef struct mv88w8618_timer_state
{
1038 ptimer_state
*timer
;
1042 } mv88w8618_timer_state
;
1044 typedef struct mv88w8618_pit_state
{
1047 } mv88w8618_pit_state
;
1049 static void mv88w8618_timer_tick(void *opaque
)
1051 mv88w8618_timer_state
*s
= opaque
;
1053 qemu_irq_raise(s
->irq
);
1056 static void *mv88w8618_timer_init(uint32_t freq
, qemu_irq irq
)
1058 mv88w8618_timer_state
*s
;
1061 s
= qemu_mallocz(sizeof(mv88w8618_timer_state
));
1065 bh
= qemu_bh_new(mv88w8618_timer_tick
, s
);
1066 s
->timer
= ptimer_init(bh
);
1071 static uint32_t mv88w8618_pit_read(void *opaque
, target_phys_addr_t offset
)
1073 mv88w8618_pit_state
*s
= opaque
;
1074 mv88w8618_timer_state
*t
;
1077 case MP_PIT_TIMER1_VALUE
... MP_PIT_TIMER4_VALUE
:
1078 t
= s
->timer
[(offset
-MP_PIT_TIMER1_VALUE
) >> 2];
1079 return ptimer_get_count(t
->timer
);
1086 static void mv88w8618_pit_write(void *opaque
, target_phys_addr_t offset
,
1089 mv88w8618_pit_state
*s
= opaque
;
1090 mv88w8618_timer_state
*t
;
1094 case MP_PIT_TIMER1_LENGTH
... MP_PIT_TIMER4_LENGTH
:
1095 t
= s
->timer
[offset
>> 2];
1097 ptimer_set_limit(t
->timer
, t
->limit
, 1);
1100 case MP_PIT_CONTROL
:
1101 for (i
= 0; i
< 4; i
++) {
1104 ptimer_set_limit(t
->timer
, t
->limit
, 0);
1105 ptimer_set_freq(t
->timer
, t
->freq
);
1106 ptimer_run(t
->timer
, 0);
1112 case MP_BOARD_RESET
:
1113 if (value
== MP_BOARD_RESET_MAGIC
)
1114 qemu_system_reset_request();
1119 static CPUReadMemoryFunc
*mv88w8618_pit_readfn
[] = {
1125 static CPUWriteMemoryFunc
*mv88w8618_pit_writefn
[] = {
1126 mv88w8618_pit_write
,
1127 mv88w8618_pit_write
,
1131 static void mv88w8618_pit_init(uint32_t base
, qemu_irq
*pic
, int irq
)
1134 mv88w8618_pit_state
*s
;
1136 s
= qemu_mallocz(sizeof(mv88w8618_pit_state
));
1138 /* Letting them all run at 1 MHz is likely just a pragmatic
1139 * simplification. */
1140 s
->timer
[0] = mv88w8618_timer_init(1000000, pic
[irq
]);
1141 s
->timer
[1] = mv88w8618_timer_init(1000000, pic
[irq
+ 1]);
1142 s
->timer
[2] = mv88w8618_timer_init(1000000, pic
[irq
+ 2]);
1143 s
->timer
[3] = mv88w8618_timer_init(1000000, pic
[irq
+ 3]);
1145 iomemtype
= cpu_register_io_memory(0, mv88w8618_pit_readfn
,
1146 mv88w8618_pit_writefn
, s
);
1147 cpu_register_physical_memory(base
, MP_PIT_SIZE
, iomemtype
);
1150 /* Flash config register offsets */
1151 #define MP_FLASHCFG_CFGR0 0x04
1153 typedef struct mv88w8618_flashcfg_state
{
1155 } mv88w8618_flashcfg_state
;
1157 static uint32_t mv88w8618_flashcfg_read(void *opaque
,
1158 target_phys_addr_t offset
)
1160 mv88w8618_flashcfg_state
*s
= opaque
;
1163 case MP_FLASHCFG_CFGR0
:
1171 static void mv88w8618_flashcfg_write(void *opaque
, target_phys_addr_t offset
,
1174 mv88w8618_flashcfg_state
*s
= opaque
;
1177 case MP_FLASHCFG_CFGR0
:
1183 static CPUReadMemoryFunc
*mv88w8618_flashcfg_readfn
[] = {
1184 mv88w8618_flashcfg_read
,
1185 mv88w8618_flashcfg_read
,
1186 mv88w8618_flashcfg_read
1189 static CPUWriteMemoryFunc
*mv88w8618_flashcfg_writefn
[] = {
1190 mv88w8618_flashcfg_write
,
1191 mv88w8618_flashcfg_write
,
1192 mv88w8618_flashcfg_write
1195 static void mv88w8618_flashcfg_init(uint32_t base
)
1198 mv88w8618_flashcfg_state
*s
;
1200 s
= qemu_mallocz(sizeof(mv88w8618_flashcfg_state
));
1202 s
->cfgr0
= 0xfffe4285; /* Default as set by U-Boot for 8 MB flash */
1203 iomemtype
= cpu_register_io_memory(0, mv88w8618_flashcfg_readfn
,
1204 mv88w8618_flashcfg_writefn
, s
);
1205 cpu_register_physical_memory(base
, MP_FLASHCFG_SIZE
, iomemtype
);
1208 /* Various registers in the 0x80000000 domain */
1209 #define MP_BOARD_REVISION 0x2018
1211 #define MP_WLAN_MAGIC1 0xc11c
1212 #define MP_WLAN_MAGIC2 0xc124
1214 #define MP_GPIO_OE_LO 0xd008
1215 #define MP_GPIO_OUT_LO 0xd00c
1216 #define MP_GPIO_IN_LO 0xd010
1217 #define MP_GPIO_ISR_LO 0xd020
1218 #define MP_GPIO_OE_HI 0xd508
1219 #define MP_GPIO_OUT_HI 0xd50c
1220 #define MP_GPIO_IN_HI 0xd510
1221 #define MP_GPIO_ISR_HI 0xd520
1223 /* GPIO bits & masks */
1224 #define MP_GPIO_WHEEL_VOL (1 << 8)
1225 #define MP_GPIO_WHEEL_VOL_INV (1 << 9)
1226 #define MP_GPIO_WHEEL_NAV (1 << 10)
1227 #define MP_GPIO_WHEEL_NAV_INV (1 << 11)
1228 #define MP_GPIO_LCD_BRIGHTNESS 0x00070000
1229 #define MP_GPIO_BTN_FAVORITS (1 << 19)
1230 #define MP_GPIO_BTN_MENU (1 << 20)
1231 #define MP_GPIO_BTN_VOLUME (1 << 21)
1232 #define MP_GPIO_BTN_NAVIGATION (1 << 22)
1233 #define MP_GPIO_I2C_DATA_BIT 29
1234 #define MP_GPIO_I2C_DATA (1 << MP_GPIO_I2C_DATA_BIT)
1235 #define MP_GPIO_I2C_CLOCK_BIT 30
1237 /* LCD brightness bits in GPIO_OE_HI */
1238 #define MP_OE_LCD_BRIGHTNESS 0x0007
1240 static uint32_t musicpal_read(void *opaque
, target_phys_addr_t offset
)
1243 case MP_BOARD_REVISION
:
1246 case MP_GPIO_OE_HI
: /* used for LCD brightness control */
1247 return lcd_brightness
& MP_OE_LCD_BRIGHTNESS
;
1249 case MP_GPIO_OUT_LO
:
1250 return gpio_out_state
& 0xFFFF;
1251 case MP_GPIO_OUT_HI
:
1252 return gpio_out_state
>> 16;
1255 return gpio_in_state
& 0xFFFF;
1257 /* Update received I2C data */
1258 gpio_in_state
= (gpio_in_state
& ~MP_GPIO_I2C_DATA
) |
1259 (i2c_get_data(mixer_i2c
) << MP_GPIO_I2C_DATA_BIT
);
1260 return gpio_in_state
>> 16;
1262 case MP_GPIO_ISR_LO
:
1263 return gpio_isr
& 0xFFFF;
1264 case MP_GPIO_ISR_HI
:
1265 return gpio_isr
>> 16;
1267 /* Workaround to allow loading the binary-only wlandrv.ko crap
1268 * from the original Freecom firmware. */
1269 case MP_WLAN_MAGIC1
:
1271 case MP_WLAN_MAGIC2
:
1279 static void musicpal_write(void *opaque
, target_phys_addr_t offset
,
1283 case MP_GPIO_OE_HI
: /* used for LCD brightness control */
1284 lcd_brightness
= (lcd_brightness
& MP_GPIO_LCD_BRIGHTNESS
) |
1285 (value
& MP_OE_LCD_BRIGHTNESS
);
1288 case MP_GPIO_OUT_LO
:
1289 gpio_out_state
= (gpio_out_state
& 0xFFFF0000) | (value
& 0xFFFF);
1291 case MP_GPIO_OUT_HI
:
1292 gpio_out_state
= (gpio_out_state
& 0xFFFF) | (value
<< 16);
1293 lcd_brightness
= (lcd_brightness
& 0xFFFF) |
1294 (gpio_out_state
& MP_GPIO_LCD_BRIGHTNESS
);
1295 i2c_state_update(mixer_i2c
,
1296 (gpio_out_state
>> MP_GPIO_I2C_DATA_BIT
) & 1,
1297 (gpio_out_state
>> MP_GPIO_I2C_CLOCK_BIT
) & 1);
1303 /* Keyboard codes & masks */
1304 #define KEY_RELEASED 0x80
1305 #define KEY_CODE 0x7f
1307 #define KEYCODE_TAB 0x0f
1308 #define KEYCODE_ENTER 0x1c
1309 #define KEYCODE_F 0x21
1310 #define KEYCODE_M 0x32
1312 #define KEYCODE_EXTENDED 0xe0
1313 #define KEYCODE_UP 0x48
1314 #define KEYCODE_DOWN 0x50
1315 #define KEYCODE_LEFT 0x4b
1316 #define KEYCODE_RIGHT 0x4d
1318 static void musicpal_key_event(void *opaque
, int keycode
)
1320 qemu_irq irq
= opaque
;
1322 static int kbd_extended
;
1324 if (keycode
== KEYCODE_EXTENDED
) {
1330 switch (keycode
& KEY_CODE
) {
1332 event
= MP_GPIO_WHEEL_NAV
| MP_GPIO_WHEEL_NAV_INV
;
1336 event
= MP_GPIO_WHEEL_NAV
;
1340 event
= MP_GPIO_WHEEL_VOL
| MP_GPIO_WHEEL_VOL_INV
;
1344 event
= MP_GPIO_WHEEL_VOL
;
1348 switch (keycode
& KEY_CODE
) {
1350 event
= MP_GPIO_BTN_FAVORITS
;
1354 event
= MP_GPIO_BTN_VOLUME
;
1358 event
= MP_GPIO_BTN_NAVIGATION
;
1362 event
= MP_GPIO_BTN_MENU
;
1365 /* Do not repeat already pressed buttons */
1366 if (!(keycode
& KEY_RELEASED
) && !(gpio_in_state
& event
))
1371 if (keycode
& KEY_RELEASED
) {
1372 gpio_in_state
|= event
;
1374 gpio_in_state
&= ~event
;
1376 qemu_irq_raise(irq
);
1383 static CPUReadMemoryFunc
*musicpal_readfn
[] = {
1389 static CPUWriteMemoryFunc
*musicpal_writefn
[] = {
1395 static struct arm_boot_info musicpal_binfo
= {
1396 .loader_start
= 0x0,
1400 static void musicpal_init(ram_addr_t ram_size
, int vga_ram_size
,
1401 const char *boot_device
,
1402 const char *kernel_filename
, const char *kernel_cmdline
,
1403 const char *initrd_filename
, const char *cpu_model
)
1409 unsigned long flash_size
;
1412 cpu_model
= "arm926";
1414 env
= cpu_init(cpu_model
);
1416 fprintf(stderr
, "Unable to find CPU definition\n");
1419 pic
= arm_pic_init_cpu(env
);
1421 /* For now we use a fixed - the original - RAM size */
1422 cpu_register_physical_memory(0, MP_RAM_DEFAULT_SIZE
,
1423 qemu_ram_alloc(MP_RAM_DEFAULT_SIZE
));
1425 sram_off
= qemu_ram_alloc(MP_SRAM_SIZE
);
1426 cpu_register_physical_memory(MP_SRAM_BASE
, MP_SRAM_SIZE
, sram_off
);
1428 /* Catch various stuff not handled by separate subsystems */
1429 iomemtype
= cpu_register_io_memory(0, musicpal_readfn
,
1430 musicpal_writefn
, env
);
1431 cpu_register_physical_memory(0x80000000, 0x10000, iomemtype
);
1433 pic
= mv88w8618_pic_init(MP_PIC_BASE
, pic
[ARM_PIC_CPU_IRQ
]);
1434 mv88w8618_pit_init(MP_PIT_BASE
, pic
, MP_TIMER1_IRQ
);
1437 serial_mm_init(MP_UART1_BASE
, 2, pic
[MP_UART1_IRQ
], 1825000,
1440 serial_mm_init(MP_UART2_BASE
, 2, pic
[MP_UART2_IRQ
], 1825000,
1443 /* Register flash */
1444 index
= drive_get_index(IF_PFLASH
, 0, 0);
1446 flash_size
= bdrv_getlength(drives_table
[index
].bdrv
);
1447 if (flash_size
!= 8*1024*1024 && flash_size
!= 16*1024*1024 &&
1448 flash_size
!= 32*1024*1024) {
1449 fprintf(stderr
, "Invalid flash image size\n");
1454 * The original U-Boot accesses the flash at 0xFE000000 instead of
1455 * 0xFF800000 (if there is 8 MB flash). So remap flash access if the
1456 * image is smaller than 32 MB.
1458 pflash_cfi02_register(0-MP_FLASH_SIZE_MAX
, qemu_ram_alloc(flash_size
),
1459 drives_table
[index
].bdrv
, 0x10000,
1460 (flash_size
+ 0xffff) >> 16,
1461 MP_FLASH_SIZE_MAX
/ flash_size
,
1462 2, 0x00BF, 0x236D, 0x0000, 0x0000,
1465 mv88w8618_flashcfg_init(MP_FLASHCFG_BASE
);
1467 musicpal_lcd_init(MP_LCD_BASE
);
1469 qemu_add_kbd_event_handler(musicpal_key_event
, pic
[MP_GPIO_IRQ
]);
1471 mv88w8618_eth_init(&nd_table
[0], MP_ETH_BASE
, pic
[MP_ETH_IRQ
]);
1473 mixer_i2c
= musicpal_audio_init(MP_AUDIO_BASE
, pic
[MP_AUDIO_IRQ
]);
1475 musicpal_binfo
.ram_size
= MP_RAM_DEFAULT_SIZE
;
1476 musicpal_binfo
.kernel_filename
= kernel_filename
;
1477 musicpal_binfo
.kernel_cmdline
= kernel_cmdline
;
1478 musicpal_binfo
.initrd_filename
= initrd_filename
;
1479 arm_load_kernel(env
, &musicpal_binfo
);
1482 QEMUMachine musicpal_machine
= {
1484 .desc
= "Marvell 88w8618 / MusicPal (ARM926EJ-S)",
1485 .init
= musicpal_init
,
1486 .ram_require
= MP_RAM_DEFAULT_SIZE
+ MP_SRAM_SIZE
+
1487 MP_FLASH_SIZE_MAX
+ RAMSIZE_FIXED
,