hw/timer/hpet.c: Avoid signed integer overflow which results in bugs on OSX
[qemu/ar7.git] / hw / input / lm832x.c
blob530a6e01f5305c2547cffb7ab88cf45e083023f9
1 /*
2 * National Semiconductor LM8322/8323 GPIO keyboard & PWM chips.
4 * Copyright (C) 2008 Nokia Corporation
5 * Written by Andrzej Zaborowski <andrew@openedhand.com>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 or
10 * (at your option) version 3 of the License.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License along
18 * with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "hw/hw.h"
22 #include "hw/i2c/i2c.h"
23 #include "qemu/timer.h"
24 #include "ui/console.h"
26 #define TYPE_LM8323 "lm8323"
27 #define LM8323(obj) OBJECT_CHECK(LM823KbdState, (obj), TYPE_LM8323)
29 typedef struct {
30 I2CSlave parent_obj;
32 uint8_t i2c_dir;
33 uint8_t i2c_cycle;
34 uint8_t reg;
36 qemu_irq nirq;
37 uint16_t model;
39 struct {
40 qemu_irq out[2];
41 int in[2][2];
42 } mux;
44 uint8_t config;
45 uint8_t status;
46 uint8_t acttime;
47 uint8_t error;
48 uint8_t clock;
50 struct {
51 uint16_t pull;
52 uint16_t mask;
53 uint16_t dir;
54 uint16_t level;
55 qemu_irq out[16];
56 } gpio;
58 struct {
59 uint8_t dbnctime;
60 uint8_t size;
61 uint8_t start;
62 uint8_t len;
63 uint8_t fifo[16];
64 } kbd;
66 struct {
67 uint16_t file[256];
68 uint8_t faddr;
69 uint8_t addr[3];
70 QEMUTimer *tm[3];
71 } pwm;
72 } LM823KbdState;
74 #define INT_KEYPAD (1 << 0)
75 #define INT_ERROR (1 << 3)
76 #define INT_NOINIT (1 << 4)
77 #define INT_PWMEND(n) (1 << (5 + n))
79 #define ERR_BADPAR (1 << 0)
80 #define ERR_CMDUNK (1 << 1)
81 #define ERR_KEYOVR (1 << 2)
82 #define ERR_FIFOOVR (1 << 6)
84 static void lm_kbd_irq_update(LM823KbdState *s)
86 qemu_set_irq(s->nirq, !s->status);
89 static void lm_kbd_gpio_update(LM823KbdState *s)
93 static void lm_kbd_reset(LM823KbdState *s)
95 s->config = 0x80;
96 s->status = INT_NOINIT;
97 s->acttime = 125;
98 s->kbd.dbnctime = 3;
99 s->kbd.size = 0x33;
100 s->clock = 0x08;
102 lm_kbd_irq_update(s);
103 lm_kbd_gpio_update(s);
106 static void lm_kbd_error(LM823KbdState *s, int err)
108 s->error |= err;
109 s->status |= INT_ERROR;
110 lm_kbd_irq_update(s);
113 static void lm_kbd_pwm_tick(LM823KbdState *s, int line)
117 static void lm_kbd_pwm_start(LM823KbdState *s, int line)
119 lm_kbd_pwm_tick(s, line);
122 static void lm_kbd_pwm0_tick(void *opaque)
124 lm_kbd_pwm_tick(opaque, 0);
126 static void lm_kbd_pwm1_tick(void *opaque)
128 lm_kbd_pwm_tick(opaque, 1);
130 static void lm_kbd_pwm2_tick(void *opaque)
132 lm_kbd_pwm_tick(opaque, 2);
135 enum {
136 LM832x_CMD_READ_ID = 0x80, /* Read chip ID. */
137 LM832x_CMD_WRITE_CFG = 0x81, /* Set configuration item. */
138 LM832x_CMD_READ_INT = 0x82, /* Get interrupt status. */
139 LM832x_CMD_RESET = 0x83, /* Reset, same as external one */
140 LM823x_CMD_WRITE_PULL_DOWN = 0x84, /* Select GPIO pull-up/down. */
141 LM832x_CMD_WRITE_PORT_SEL = 0x85, /* Select GPIO in/out. */
142 LM832x_CMD_WRITE_PORT_STATE = 0x86, /* Set GPIO pull-up/down. */
143 LM832x_CMD_READ_PORT_SEL = 0x87, /* Get GPIO in/out. */
144 LM832x_CMD_READ_PORT_STATE = 0x88, /* Get GPIO pull-up/down. */
145 LM832x_CMD_READ_FIFO = 0x89, /* Read byte from FIFO. */
146 LM832x_CMD_RPT_READ_FIFO = 0x8a, /* Read FIFO (no increment). */
147 LM832x_CMD_SET_ACTIVE = 0x8b, /* Set active time. */
148 LM832x_CMD_READ_ERROR = 0x8c, /* Get error status. */
149 LM832x_CMD_READ_ROTATOR = 0x8e, /* Read rotator status. */
150 LM832x_CMD_SET_DEBOUNCE = 0x8f, /* Set debouncing time. */
151 LM832x_CMD_SET_KEY_SIZE = 0x90, /* Set keypad size. */
152 LM832x_CMD_READ_KEY_SIZE = 0x91, /* Get keypad size. */
153 LM832x_CMD_READ_CFG = 0x92, /* Get configuration item. */
154 LM832x_CMD_WRITE_CLOCK = 0x93, /* Set clock config. */
155 LM832x_CMD_READ_CLOCK = 0x94, /* Get clock config. */
156 LM832x_CMD_PWM_WRITE = 0x95, /* Write PWM script. */
157 LM832x_CMD_PWM_START = 0x96, /* Start PWM engine. */
158 LM832x_CMD_PWM_STOP = 0x97, /* Stop PWM engine. */
159 LM832x_GENERAL_ERROR = 0xff, /* There was one error.
160 Previously was represented by -1
161 This is not a command */
164 #define LM832x_MAX_KPX 8
165 #define LM832x_MAX_KPY 12
167 static uint8_t lm_kbd_read(LM823KbdState *s, int reg, int byte)
169 int ret;
171 switch (reg) {
172 case LM832x_CMD_READ_ID:
173 ret = 0x0400;
174 break;
176 case LM832x_CMD_READ_INT:
177 ret = s->status;
178 if (!(s->status & INT_NOINIT)) {
179 s->status = 0;
180 lm_kbd_irq_update(s);
182 break;
184 case LM832x_CMD_READ_PORT_SEL:
185 ret = s->gpio.dir;
186 break;
187 case LM832x_CMD_READ_PORT_STATE:
188 ret = s->gpio.mask;
189 break;
191 case LM832x_CMD_READ_FIFO:
192 if (s->kbd.len <= 1)
193 return 0x00;
195 /* Example response from the two commands after a INT_KEYPAD
196 * interrupt caused by the key 0x3c being pressed:
197 * RPT_READ_FIFO: 55 bc 00 4e ff 0a 50 08 00 29 d9 08 01 c9 01
198 * READ_FIFO: bc 00 00 4e ff 0a 50 08 00 29 d9 08 01 c9 01
199 * RPT_READ_FIFO: bc 00 00 4e ff 0a 50 08 00 29 d9 08 01 c9 01
201 * 55 is the code of the key release event serviced in the previous
202 * interrupt handling.
204 * TODO: find out whether the FIFO is advanced a single character
205 * before reading every byte or the whole size of the FIFO at the
206 * last LM832x_CMD_READ_FIFO. This affects LM832x_CMD_RPT_READ_FIFO
207 * output in cases where there are more than one event in the FIFO.
208 * Assume 0xbc and 0x3c events are in the FIFO:
209 * RPT_READ_FIFO: 55 bc 3c 00 4e ff 0a 50 08 00 29 d9 08 01 c9
210 * READ_FIFO: bc 3c 00 00 4e ff 0a 50 08 00 29 d9 08 01 c9
211 * Does RPT_READ_FIFO now return 0xbc and 0x3c or only 0x3c?
213 s->kbd.start ++;
214 s->kbd.start &= sizeof(s->kbd.fifo) - 1;
215 s->kbd.len --;
217 return s->kbd.fifo[s->kbd.start];
218 case LM832x_CMD_RPT_READ_FIFO:
219 if (byte >= s->kbd.len)
220 return 0x00;
222 return s->kbd.fifo[(s->kbd.start + byte) & (sizeof(s->kbd.fifo) - 1)];
224 case LM832x_CMD_READ_ERROR:
225 return s->error;
227 case LM832x_CMD_READ_ROTATOR:
228 return 0;
230 case LM832x_CMD_READ_KEY_SIZE:
231 return s->kbd.size;
233 case LM832x_CMD_READ_CFG:
234 return s->config & 0xf;
236 case LM832x_CMD_READ_CLOCK:
237 return (s->clock & 0xfc) | 2;
239 default:
240 lm_kbd_error(s, ERR_CMDUNK);
241 fprintf(stderr, "%s: unknown command %02x\n", __FUNCTION__, reg);
242 return 0x00;
245 return ret >> (byte << 3);
248 static void lm_kbd_write(LM823KbdState *s, int reg, int byte, uint8_t value)
250 switch (reg) {
251 case LM832x_CMD_WRITE_CFG:
252 s->config = value;
253 /* This must be done whenever s->mux.in is updated (never). */
254 if ((s->config >> 1) & 1) /* MUX1EN */
255 qemu_set_irq(s->mux.out[0], s->mux.in[0][(s->config >> 0) & 1]);
256 if ((s->config >> 3) & 1) /* MUX2EN */
257 qemu_set_irq(s->mux.out[0], s->mux.in[0][(s->config >> 2) & 1]);
258 /* TODO: check that this is issued only following the chip reset
259 * and not in the middle of operation and that it is followed by
260 * the GPIO ports re-resablishing through WRITE_PORT_SEL and
261 * WRITE_PORT_STATE (using a timer perhaps) and otherwise output
262 * warnings. */
263 s->status = 0;
264 lm_kbd_irq_update(s);
265 s->kbd.len = 0;
266 s->kbd.start = 0;
267 s->reg = LM832x_GENERAL_ERROR;
268 break;
270 case LM832x_CMD_RESET:
271 if (value == 0xaa)
272 lm_kbd_reset(s);
273 else
274 lm_kbd_error(s, ERR_BADPAR);
275 s->reg = LM832x_GENERAL_ERROR;
276 break;
278 case LM823x_CMD_WRITE_PULL_DOWN:
279 if (!byte)
280 s->gpio.pull = value;
281 else {
282 s->gpio.pull |= value << 8;
283 lm_kbd_gpio_update(s);
284 s->reg = LM832x_GENERAL_ERROR;
286 break;
287 case LM832x_CMD_WRITE_PORT_SEL:
288 if (!byte)
289 s->gpio.dir = value;
290 else {
291 s->gpio.dir |= value << 8;
292 lm_kbd_gpio_update(s);
293 s->reg = LM832x_GENERAL_ERROR;
295 break;
296 case LM832x_CMD_WRITE_PORT_STATE:
297 if (!byte)
298 s->gpio.mask = value;
299 else {
300 s->gpio.mask |= value << 8;
301 lm_kbd_gpio_update(s);
302 s->reg = LM832x_GENERAL_ERROR;
304 break;
306 case LM832x_CMD_SET_ACTIVE:
307 s->acttime = value;
308 s->reg = LM832x_GENERAL_ERROR;
309 break;
311 case LM832x_CMD_SET_DEBOUNCE:
312 s->kbd.dbnctime = value;
313 s->reg = LM832x_GENERAL_ERROR;
314 if (!value)
315 lm_kbd_error(s, ERR_BADPAR);
316 break;
318 case LM832x_CMD_SET_KEY_SIZE:
319 s->kbd.size = value;
320 s->reg = LM832x_GENERAL_ERROR;
321 if (
322 (value & 0xf) < 3 || (value & 0xf) > LM832x_MAX_KPY ||
323 (value >> 4) < 3 || (value >> 4) > LM832x_MAX_KPX)
324 lm_kbd_error(s, ERR_BADPAR);
325 break;
327 case LM832x_CMD_WRITE_CLOCK:
328 s->clock = value;
329 s->reg = LM832x_GENERAL_ERROR;
330 if ((value & 3) && (value & 3) != 3) {
331 lm_kbd_error(s, ERR_BADPAR);
332 fprintf(stderr, "%s: invalid clock setting in RCPWM\n",
333 __FUNCTION__);
335 /* TODO: Validate that the command is only issued once */
336 break;
338 case LM832x_CMD_PWM_WRITE:
339 if (byte == 0) {
340 if (!(value & 3) || (value >> 2) > 59) {
341 lm_kbd_error(s, ERR_BADPAR);
342 s->reg = LM832x_GENERAL_ERROR;
343 break;
346 s->pwm.faddr = value;
347 s->pwm.file[s->pwm.faddr] = 0;
348 } else if (byte == 1) {
349 s->pwm.file[s->pwm.faddr] |= value << 8;
350 } else if (byte == 2) {
351 s->pwm.file[s->pwm.faddr] |= value << 0;
352 s->reg = LM832x_GENERAL_ERROR;
354 break;
355 case LM832x_CMD_PWM_START:
356 s->reg = LM832x_GENERAL_ERROR;
357 if (!(value & 3) || (value >> 2) > 59) {
358 lm_kbd_error(s, ERR_BADPAR);
359 break;
362 s->pwm.addr[(value & 3) - 1] = value >> 2;
363 lm_kbd_pwm_start(s, (value & 3) - 1);
364 break;
365 case LM832x_CMD_PWM_STOP:
366 s->reg = LM832x_GENERAL_ERROR;
367 if (!(value & 3)) {
368 lm_kbd_error(s, ERR_BADPAR);
369 break;
372 timer_del(s->pwm.tm[(value & 3) - 1]);
373 break;
375 case LM832x_GENERAL_ERROR:
376 lm_kbd_error(s, ERR_BADPAR);
377 break;
378 default:
379 lm_kbd_error(s, ERR_CMDUNK);
380 fprintf(stderr, "%s: unknown command %02x\n", __FUNCTION__, reg);
381 break;
385 static void lm_i2c_event(I2CSlave *i2c, enum i2c_event event)
387 LM823KbdState *s = LM8323(i2c);
389 switch (event) {
390 case I2C_START_RECV:
391 case I2C_START_SEND:
392 s->i2c_cycle = 0;
393 s->i2c_dir = (event == I2C_START_SEND);
394 break;
396 default:
397 break;
401 static int lm_i2c_rx(I2CSlave *i2c)
403 LM823KbdState *s = LM8323(i2c);
405 return lm_kbd_read(s, s->reg, s->i2c_cycle ++);
408 static int lm_i2c_tx(I2CSlave *i2c, uint8_t data)
410 LM823KbdState *s = LM8323(i2c);
412 if (!s->i2c_cycle)
413 s->reg = data;
414 else
415 lm_kbd_write(s, s->reg, s->i2c_cycle - 1, data);
416 s->i2c_cycle ++;
418 return 0;
421 static int lm_kbd_post_load(void *opaque, int version_id)
423 LM823KbdState *s = opaque;
425 lm_kbd_irq_update(s);
426 lm_kbd_gpio_update(s);
428 return 0;
431 static const VMStateDescription vmstate_lm_kbd = {
432 .name = "LM8323",
433 .version_id = 0,
434 .minimum_version_id = 0,
435 .post_load = lm_kbd_post_load,
436 .fields = (VMStateField[]) {
437 VMSTATE_I2C_SLAVE(parent_obj, LM823KbdState),
438 VMSTATE_UINT8(i2c_dir, LM823KbdState),
439 VMSTATE_UINT8(i2c_cycle, LM823KbdState),
440 VMSTATE_UINT8(reg, LM823KbdState),
441 VMSTATE_UINT8(config, LM823KbdState),
442 VMSTATE_UINT8(status, LM823KbdState),
443 VMSTATE_UINT8(acttime, LM823KbdState),
444 VMSTATE_UINT8(error, LM823KbdState),
445 VMSTATE_UINT8(clock, LM823KbdState),
446 VMSTATE_UINT16(gpio.pull, LM823KbdState),
447 VMSTATE_UINT16(gpio.mask, LM823KbdState),
448 VMSTATE_UINT16(gpio.dir, LM823KbdState),
449 VMSTATE_UINT16(gpio.level, LM823KbdState),
450 VMSTATE_UINT8(kbd.dbnctime, LM823KbdState),
451 VMSTATE_UINT8(kbd.size, LM823KbdState),
452 VMSTATE_UINT8(kbd.start, LM823KbdState),
453 VMSTATE_UINT8(kbd.len, LM823KbdState),
454 VMSTATE_BUFFER(kbd.fifo, LM823KbdState),
455 VMSTATE_UINT16_ARRAY(pwm.file, LM823KbdState, 256),
456 VMSTATE_UINT8(pwm.faddr, LM823KbdState),
457 VMSTATE_BUFFER(pwm.addr, LM823KbdState),
458 VMSTATE_TIMER_PTR_ARRAY(pwm.tm, LM823KbdState, 3),
459 VMSTATE_END_OF_LIST()
464 static int lm8323_init(I2CSlave *i2c)
466 LM823KbdState *s = LM8323(i2c);
468 s->model = 0x8323;
469 s->pwm.tm[0] = timer_new_ns(QEMU_CLOCK_VIRTUAL, lm_kbd_pwm0_tick, s);
470 s->pwm.tm[1] = timer_new_ns(QEMU_CLOCK_VIRTUAL, lm_kbd_pwm1_tick, s);
471 s->pwm.tm[2] = timer_new_ns(QEMU_CLOCK_VIRTUAL, lm_kbd_pwm2_tick, s);
472 qdev_init_gpio_out(DEVICE(i2c), &s->nirq, 1);
474 lm_kbd_reset(s);
476 qemu_register_reset((void *) lm_kbd_reset, s);
477 return 0;
480 void lm832x_key_event(DeviceState *dev, int key, int state)
482 LM823KbdState *s = LM8323(dev);
484 if ((s->status & INT_ERROR) && (s->error & ERR_FIFOOVR))
485 return;
487 if (s->kbd.len >= sizeof(s->kbd.fifo)) {
488 lm_kbd_error(s, ERR_FIFOOVR);
489 return;
492 s->kbd.fifo[(s->kbd.start + s->kbd.len ++) & (sizeof(s->kbd.fifo) - 1)] =
493 key | (state << 7);
495 /* We never set ERR_KEYOVR because we support multiple keys fine. */
496 s->status |= INT_KEYPAD;
497 lm_kbd_irq_update(s);
500 static void lm8323_class_init(ObjectClass *klass, void *data)
502 DeviceClass *dc = DEVICE_CLASS(klass);
503 I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
505 k->init = lm8323_init;
506 k->event = lm_i2c_event;
507 k->recv = lm_i2c_rx;
508 k->send = lm_i2c_tx;
509 dc->vmsd = &vmstate_lm_kbd;
512 static const TypeInfo lm8323_info = {
513 .name = TYPE_LM8323,
514 .parent = TYPE_I2C_SLAVE,
515 .instance_size = sizeof(LM823KbdState),
516 .class_init = lm8323_class_init,
519 static void lm832x_register_types(void)
521 type_register_static(&lm8323_info);
524 type_init(lm832x_register_types)