2 * Marvell MV88W8618 / Freecom MusicPal emulation.
4 * Copyright (c) 2008 Jan Kiszka
6 * This code is licenced under the GNU GPL v2.
16 #include "qemu-timer.h"
20 #include "audio/audio.h"
23 #define MP_ETH_BASE 0x80008000
24 #define MP_ETH_SIZE 0x00001000
26 #define MP_UART1_BASE 0x8000C840
27 #define MP_UART2_BASE 0x8000C940
29 #define MP_FLASHCFG_BASE 0x90006000
30 #define MP_FLASHCFG_SIZE 0x00001000
32 #define MP_AUDIO_BASE 0x90007000
33 #define MP_AUDIO_SIZE 0x00001000
35 #define MP_PIC_BASE 0x90008000
36 #define MP_PIC_SIZE 0x00001000
38 #define MP_PIT_BASE 0x90009000
39 #define MP_PIT_SIZE 0x00001000
41 #define MP_LCD_BASE 0x9000c000
42 #define MP_LCD_SIZE 0x00001000
44 #define MP_SRAM_BASE 0xC0000000
45 #define MP_SRAM_SIZE 0x00020000
47 #define MP_RAM_DEFAULT_SIZE 32*1024*1024
48 #define MP_FLASH_SIZE_MAX 32*1024*1024
50 #define MP_TIMER1_IRQ 4
52 #define MP_TIMER4_IRQ 7
55 #define MP_UART1_IRQ 11
56 #define MP_UART2_IRQ 11
57 #define MP_GPIO_IRQ 12
59 #define MP_AUDIO_IRQ 30
61 static uint32_t gpio_in_state
= 0xffffffff;
62 static uint32_t gpio_out_state
;
63 static ram_addr_t sram_off
;
65 /* Address conversion helpers */
66 static void *target2host_addr(uint32_t addr
)
68 if (addr
< MP_SRAM_BASE
) {
69 if (addr
>= MP_RAM_DEFAULT_SIZE
)
71 return (void *)(phys_ram_base
+ addr
);
73 if (addr
>= MP_SRAM_BASE
+ MP_SRAM_SIZE
)
75 return (void *)(phys_ram_base
+ sram_off
+ addr
- MP_SRAM_BASE
);
79 static uint32_t host2target_addr(void *addr
)
81 if (addr
< ((void *)phys_ram_base
) + sram_off
)
82 return (unsigned long)addr
- (unsigned long)phys_ram_base
;
84 return (unsigned long)addr
- (unsigned long)phys_ram_base
-
85 sram_off
+ MP_SRAM_BASE
;
89 typedef enum i2c_state
{
112 typedef struct i2c_interface
{
121 static void i2c_enter_stop(i2c_interface
*i2c
)
123 if (i2c
->current_addr
>= 0)
124 i2c_end_transfer(i2c
->bus
);
125 i2c
->current_addr
= -1;
126 i2c
->state
= STOPPED
;
129 static void i2c_state_update(i2c_interface
*i2c
, int data
, int clock
)
134 switch (i2c
->state
) {
136 if (data
== 0 && i2c
->last_data
== 1 && clock
== 1)
137 i2c
->state
= INITIALIZING
;
141 if (clock
== 0 && i2c
->last_clock
== 1 && data
== 0)
142 i2c
->state
= SENDING_BIT7
;
147 case SENDING_BIT7
... SENDING_BIT0
:
148 if (clock
== 0 && i2c
->last_clock
== 1) {
149 i2c
->buffer
= (i2c
->buffer
<< 1) | data
;
150 i2c
->state
++; /* will end up in WAITING_FOR_ACK */
151 } else if (data
== 1 && i2c
->last_data
== 0 && clock
== 1)
155 case WAITING_FOR_ACK
:
156 if (clock
== 0 && i2c
->last_clock
== 1) {
157 if (i2c
->current_addr
< 0) {
158 i2c
->current_addr
= i2c
->buffer
;
159 i2c_start_transfer(i2c
->bus
, i2c
->current_addr
& 0xfe,
162 i2c_send(i2c
->bus
, i2c
->buffer
);
163 if (i2c
->current_addr
& 1) {
164 i2c
->state
= RECEIVING_BIT7
;
165 i2c
->buffer
= i2c_recv(i2c
->bus
);
167 i2c
->state
= SENDING_BIT7
;
168 } else if (data
== 1 && i2c
->last_data
== 0 && clock
== 1)
172 case RECEIVING_BIT7
... RECEIVING_BIT0
:
173 if (clock
== 0 && i2c
->last_clock
== 1) {
174 i2c
->state
++; /* will end up in SENDING_ACK */
176 } else if (data
== 1 && i2c
->last_data
== 0 && clock
== 1)
181 if (clock
== 0 && i2c
->last_clock
== 1) {
182 i2c
->state
= RECEIVING_BIT7
;
184 i2c
->buffer
= i2c_recv(i2c
->bus
);
187 } else if (data
== 1 && i2c
->last_data
== 0 && clock
== 1)
192 i2c
->last_data
= data
;
193 i2c
->last_clock
= clock
;
196 static int i2c_get_data(i2c_interface
*i2c
)
201 switch (i2c
->state
) {
202 case RECEIVING_BIT7
... RECEIVING_BIT0
:
203 return (i2c
->buffer
>> 7);
205 case WAITING_FOR_ACK
:
211 static i2c_interface
*mixer_i2c
;
215 /* Audio register offsets */
216 #define MP_AUDIO_PLAYBACK_MODE 0x00
217 #define MP_AUDIO_CLOCK_DIV 0x18
218 #define MP_AUDIO_IRQ_STATUS 0x20
219 #define MP_AUDIO_IRQ_ENABLE 0x24
220 #define MP_AUDIO_TX_START_LO 0x28
221 #define MP_AUDIO_TX_THRESHOLD 0x2C
222 #define MP_AUDIO_TX_STATUS 0x38
223 #define MP_AUDIO_TX_START_HI 0x40
225 /* Status register and IRQ enable bits */
226 #define MP_AUDIO_TX_HALF (1 << 6)
227 #define MP_AUDIO_TX_FULL (1 << 7)
229 /* Playback mode bits */
230 #define MP_AUDIO_16BIT_SAMPLE (1 << 0)
231 #define MP_AUDIO_PLAYBACK_EN (1 << 7)
232 #define MP_AUDIO_CLOCK_24MHZ (1 << 9)
234 /* Wolfson 8750 I2C address */
235 #define MP_WM_ADDR 0x34
237 const char audio_name
[] = "mv88w8618";
239 typedef struct musicpal_audio_state
{
242 uint32_t playback_mode
;
245 unsigned long phys_buf
;
247 unsigned int threshold
;
248 unsigned int play_pos
;
249 unsigned int last_free
;
252 } musicpal_audio_state
;
254 static void audio_callback(void *opaque
, int free_out
, int free_in
)
256 musicpal_audio_state
*s
= opaque
;
260 if (!(s
->playback_mode
& MP_AUDIO_PLAYBACK_EN
))
263 if (s
->playback_mode
& MP_AUDIO_16BIT_SAMPLE
)
268 block_size
= s
->threshold
/2;
269 if (free_out
- s
->last_free
< block_size
)
272 if (s
->playback_mode
& MP_AUDIO_16BIT_SAMPLE
)
273 for (pos
= 0; pos
< block_size
; pos
+= 4)
274 wm8750_dac_dat(s
->wm
,
275 *(uint32_t *)(s
->target_buffer
+ s
->play_pos
+ pos
));
277 for (pos
= 0; pos
< block_size
; pos
+= 2) {
278 channel
[0] = cpu_to_le16(2 *
279 *(int8_t *)(s
->target_buffer
+ s
->play_pos
+ pos
));
280 channel
[1] = cpu_to_le16(2 *
281 *(int8_t *)(s
->target_buffer
+ s
->play_pos
+ pos
+ 1));
282 wm8750_dac_dat(s
->wm
, channel
[0] | (channel
[1] << 16));
285 s
->last_free
= free_out
- block_size
;
287 if (s
->play_pos
== 0) {
288 s
->status
|= MP_AUDIO_TX_HALF
;
289 s
->play_pos
= block_size
;
291 s
->status
|= MP_AUDIO_TX_FULL
;
295 if (s
->status
& s
->irq_enable
)
296 qemu_irq_raise(s
->irq
);
299 static uint32_t musicpal_audio_read(void *opaque
, target_phys_addr_t offset
)
301 musicpal_audio_state
*s
= opaque
;
305 case MP_AUDIO_PLAYBACK_MODE
:
306 return s
->playback_mode
;
308 case MP_AUDIO_CLOCK_DIV
:
311 case MP_AUDIO_IRQ_STATUS
:
314 case MP_AUDIO_IRQ_ENABLE
:
315 return s
->irq_enable
;
317 case MP_AUDIO_TX_STATUS
:
318 return s
->play_pos
>> 2;
325 static void musicpal_audio_write(void *opaque
, target_phys_addr_t offset
,
328 musicpal_audio_state
*s
= opaque
;
332 case MP_AUDIO_PLAYBACK_MODE
:
333 if (value
& MP_AUDIO_PLAYBACK_EN
&&
334 !(s
->playback_mode
& MP_AUDIO_PLAYBACK_EN
)) {
339 s
->playback_mode
= value
;
342 case MP_AUDIO_CLOCK_DIV
:
343 s
->clock_div
= value
;
348 case MP_AUDIO_IRQ_STATUS
:
352 case MP_AUDIO_IRQ_ENABLE
:
353 s
->irq_enable
= value
;
354 if (s
->status
& s
->irq_enable
)
355 qemu_irq_raise(s
->irq
);
358 case MP_AUDIO_TX_START_LO
:
359 s
->phys_buf
= (s
->phys_buf
& 0xFFFF0000) | (value
& 0xFFFF);
360 s
->target_buffer
= target2host_addr(s
->phys_buf
);
365 case MP_AUDIO_TX_THRESHOLD
:
366 s
->threshold
= (value
+ 1) * 4;
369 case MP_AUDIO_TX_START_HI
:
370 s
->phys_buf
= (s
->phys_buf
& 0xFFFF) | (value
<< 16);
371 s
->target_buffer
= target2host_addr(s
->phys_buf
);
378 static void musicpal_audio_reset(void *opaque
)
380 musicpal_audio_state
*s
= opaque
;
382 s
->playback_mode
= 0;
387 static CPUReadMemoryFunc
*musicpal_audio_readfn
[] = {
393 static CPUWriteMemoryFunc
*musicpal_audio_writefn
[] = {
394 musicpal_audio_write
,
395 musicpal_audio_write
,
399 static i2c_interface
*musicpal_audio_init(uint32_t base
, qemu_irq irq
)
402 musicpal_audio_state
*s
;
408 AUD_log(audio_name
, "No audio state\n");
412 s
= qemu_mallocz(sizeof(musicpal_audio_state
));
418 i2c
= qemu_mallocz(sizeof(i2c_interface
));
421 i2c
->bus
= i2c_init_bus();
422 i2c
->current_addr
= -1;
424 s
->wm
= wm8750_init(i2c
->bus
, audio
);
427 i2c_set_slave_address(s
->wm
, MP_WM_ADDR
);
428 wm8750_data_req_set(s
->wm
, audio_callback
, s
);
430 iomemtype
= cpu_register_io_memory(0, musicpal_audio_readfn
,
431 musicpal_audio_writefn
, s
);
432 cpu_register_physical_memory(base
, MP_AUDIO_SIZE
, iomemtype
);
434 qemu_register_reset(musicpal_audio_reset
, s
);
438 #else /* !HAS_AUDIO */
439 static i2c_interface
*musicpal_audio_init(uint32_t base
, qemu_irq irq
)
443 #endif /* !HAS_AUDIO */
445 /* Ethernet register offsets */
446 #define MP_ETH_SMIR 0x010
447 #define MP_ETH_PCXR 0x408
448 #define MP_ETH_SDCMR 0x448
449 #define MP_ETH_ICR 0x450
450 #define MP_ETH_IMR 0x458
451 #define MP_ETH_FRDP0 0x480
452 #define MP_ETH_FRDP1 0x484
453 #define MP_ETH_FRDP2 0x488
454 #define MP_ETH_FRDP3 0x48C
455 #define MP_ETH_CRDP0 0x4A0
456 #define MP_ETH_CRDP1 0x4A4
457 #define MP_ETH_CRDP2 0x4A8
458 #define MP_ETH_CRDP3 0x4AC
459 #define MP_ETH_CTDP0 0x4E0
460 #define MP_ETH_CTDP1 0x4E4
461 #define MP_ETH_CTDP2 0x4E8
462 #define MP_ETH_CTDP3 0x4EC
465 #define MP_ETH_SMIR_DATA 0x0000FFFF
466 #define MP_ETH_SMIR_ADDR 0x03FF0000
467 #define MP_ETH_SMIR_OPCODE (1 << 26) /* Read value */
468 #define MP_ETH_SMIR_RDVALID (1 << 27)
471 #define MP_ETH_PHY1_BMSR 0x00210000
472 #define MP_ETH_PHY1_PHYSID1 0x00410000
473 #define MP_ETH_PHY1_PHYSID2 0x00610000
475 #define MP_PHY_BMSR_LINK 0x0004
476 #define MP_PHY_BMSR_AUTONEG 0x0008
478 #define MP_PHY_88E3015 0x01410E20
480 /* TX descriptor status */
481 #define MP_ETH_TX_OWN (1 << 31)
483 /* RX descriptor status */
484 #define MP_ETH_RX_OWN (1 << 31)
486 /* Interrupt cause/mask bits */
487 #define MP_ETH_IRQ_RX_BIT 0
488 #define MP_ETH_IRQ_RX (1 << MP_ETH_IRQ_RX_BIT)
489 #define MP_ETH_IRQ_TXHI_BIT 2
490 #define MP_ETH_IRQ_TXLO_BIT 3
492 /* Port config bits */
493 #define MP_ETH_PCXR_2BSM_BIT 28 /* 2-byte incoming suffix */
495 /* SDMA command bits */
496 #define MP_ETH_CMD_TXHI (1 << 23)
497 #define MP_ETH_CMD_TXLO (1 << 22)
499 typedef struct mv88w8618_tx_desc
{
507 typedef struct mv88w8618_rx_desc
{
510 uint16_t buffer_size
;
515 typedef struct mv88w8618_eth_state
{
522 mv88w8618_tx_desc
*tx_queue
[2];
523 mv88w8618_rx_desc
*rx_queue
[4];
524 mv88w8618_rx_desc
*frx_queue
[4];
525 mv88w8618_rx_desc
*cur_rx
[4];
527 } mv88w8618_eth_state
;
529 static int eth_can_receive(void *opaque
)
534 static void eth_receive(void *opaque
, const uint8_t *buf
, int size
)
536 mv88w8618_eth_state
*s
= opaque
;
537 mv88w8618_rx_desc
*desc
;
540 for (i
= 0; i
< 4; i
++) {
545 if (le32_to_cpu(desc
->cmdstat
) & MP_ETH_RX_OWN
&&
546 le16_to_cpu(desc
->buffer_size
) >= size
) {
547 memcpy(target2host_addr(le32_to_cpu(desc
->buffer
) +
550 desc
->bytes
= cpu_to_le16(size
+ s
->vlan_header
);
551 desc
->cmdstat
&= cpu_to_le32(~MP_ETH_RX_OWN
);
552 s
->cur_rx
[i
] = target2host_addr(le32_to_cpu(desc
->next
));
554 s
->icr
|= MP_ETH_IRQ_RX
;
556 qemu_irq_raise(s
->irq
);
559 desc
= target2host_addr(le32_to_cpu(desc
->next
));
560 } while (desc
!= s
->rx_queue
[i
]);
564 static void eth_send(mv88w8618_eth_state
*s
, int queue_index
)
566 mv88w8618_tx_desc
*desc
= s
->tx_queue
[queue_index
];
569 if (le32_to_cpu(desc
->cmdstat
) & MP_ETH_TX_OWN
) {
570 qemu_send_packet(s
->vc
,
571 target2host_addr(le32_to_cpu(desc
->buffer
)),
572 le16_to_cpu(desc
->bytes
));
573 desc
->cmdstat
&= cpu_to_le32(~MP_ETH_TX_OWN
);
574 s
->icr
|= 1 << (MP_ETH_IRQ_TXLO_BIT
- queue_index
);
576 desc
= target2host_addr(le32_to_cpu(desc
->next
));
577 } while (desc
!= s
->tx_queue
[queue_index
]);
580 static uint32_t mv88w8618_eth_read(void *opaque
, target_phys_addr_t offset
)
582 mv88w8618_eth_state
*s
= opaque
;
587 if (s
->smir
& MP_ETH_SMIR_OPCODE
) {
588 switch (s
->smir
& MP_ETH_SMIR_ADDR
) {
589 case MP_ETH_PHY1_BMSR
:
590 return MP_PHY_BMSR_LINK
| MP_PHY_BMSR_AUTONEG
|
592 case MP_ETH_PHY1_PHYSID1
:
593 return (MP_PHY_88E3015
>> 16) | MP_ETH_SMIR_RDVALID
;
594 case MP_ETH_PHY1_PHYSID2
:
595 return (MP_PHY_88E3015
& 0xFFFF) | MP_ETH_SMIR_RDVALID
;
597 return MP_ETH_SMIR_RDVALID
;
608 case MP_ETH_FRDP0
... MP_ETH_FRDP3
:
609 return host2target_addr(s
->frx_queue
[(offset
- MP_ETH_FRDP0
)/4]);
611 case MP_ETH_CRDP0
... MP_ETH_CRDP3
:
612 return host2target_addr(s
->rx_queue
[(offset
- MP_ETH_CRDP0
)/4]);
614 case MP_ETH_CTDP0
... MP_ETH_CTDP3
:
615 return host2target_addr(s
->tx_queue
[(offset
- MP_ETH_CTDP0
)/4]);
622 static void mv88w8618_eth_write(void *opaque
, target_phys_addr_t offset
,
625 mv88w8618_eth_state
*s
= opaque
;
634 s
->vlan_header
= ((value
>> MP_ETH_PCXR_2BSM_BIT
) & 1) * 2;
638 if (value
& MP_ETH_CMD_TXHI
)
640 if (value
& MP_ETH_CMD_TXLO
)
642 if (value
& (MP_ETH_CMD_TXHI
| MP_ETH_CMD_TXLO
) && s
->icr
& s
->imr
)
643 qemu_irq_raise(s
->irq
);
653 qemu_irq_raise(s
->irq
);
656 case MP_ETH_FRDP0
... MP_ETH_FRDP3
:
657 s
->frx_queue
[(offset
- MP_ETH_FRDP0
)/4] = target2host_addr(value
);
660 case MP_ETH_CRDP0
... MP_ETH_CRDP3
:
661 s
->rx_queue
[(offset
- MP_ETH_CRDP0
)/4] =
662 s
->cur_rx
[(offset
- MP_ETH_CRDP0
)/4] = target2host_addr(value
);
665 case MP_ETH_CTDP0
... MP_ETH_CTDP3
:
666 s
->tx_queue
[(offset
- MP_ETH_CTDP0
)/4] = target2host_addr(value
);
671 static CPUReadMemoryFunc
*mv88w8618_eth_readfn
[] = {
677 static CPUWriteMemoryFunc
*mv88w8618_eth_writefn
[] = {
683 static void mv88w8618_eth_init(NICInfo
*nd
, uint32_t base
, qemu_irq irq
)
685 mv88w8618_eth_state
*s
;
688 s
= qemu_mallocz(sizeof(mv88w8618_eth_state
));
693 s
->vc
= qemu_new_vlan_client(nd
->vlan
, eth_receive
, eth_can_receive
, s
);
694 iomemtype
= cpu_register_io_memory(0, mv88w8618_eth_readfn
,
695 mv88w8618_eth_writefn
, s
);
696 cpu_register_physical_memory(base
, MP_ETH_SIZE
, iomemtype
);
699 /* LCD register offsets */
700 #define MP_LCD_IRQCTRL 0x180
701 #define MP_LCD_IRQSTAT 0x184
702 #define MP_LCD_SPICTRL 0x1ac
703 #define MP_LCD_INST 0x1bc
704 #define MP_LCD_DATA 0x1c0
707 #define MP_LCD_SPI_DATA 0x00100011
708 #define MP_LCD_SPI_CMD 0x00104011
709 #define MP_LCD_SPI_INVALID 0x00000000
712 #define MP_LCD_INST_SETPAGE0 0xB0
714 #define MP_LCD_INST_SETPAGE7 0xB7
716 #define MP_LCD_TEXTCOLOR 0xe0e0ff /* RRGGBB */
718 typedef struct musicpal_lcd_state
{
725 uint8_t video_ram
[128*64/8];
726 } musicpal_lcd_state
;
728 static uint32_t lcd_brightness
;
730 static uint8_t scale_lcd_color(uint8_t col
)
734 switch (lcd_brightness
) {
735 case 0x00000007: /* 0 */
738 case 0x00020000: /* 1 */
739 return (tmp
* 1) / 7;
741 case 0x00020001: /* 2 */
742 return (tmp
* 2) / 7;
744 case 0x00040000: /* 3 */
745 return (tmp
* 3) / 7;
747 case 0x00010006: /* 4 */
748 return (tmp
* 4) / 7;
750 case 0x00020005: /* 5 */
751 return (tmp
* 5) / 7;
753 case 0x00040003: /* 6 */
754 return (tmp
* 6) / 7;
756 case 0x00030004: /* 7 */
762 static void set_lcd_pixel(musicpal_lcd_state
*s
, int x
, int y
, int col
)
766 for (dy
= 0; dy
< 3; dy
++)
767 for (dx
= 0; dx
< 3; dx
++) {
768 s
->ds
->data
[(x
*3 + dx
+ (y
*3 + dy
) * 128*3) * 4 + 0] =
769 scale_lcd_color(col
);
770 s
->ds
->data
[(x
*3 + dx
+ (y
*3 + dy
) * 128*3) * 4 + 1] =
771 scale_lcd_color(col
>> 8);
772 s
->ds
->data
[(x
*3 + dx
+ (y
*3 + dy
) * 128*3) * 4 + 2] =
773 scale_lcd_color(col
>> 16);
777 static void lcd_refresh(void *opaque
)
779 musicpal_lcd_state
*s
= opaque
;
782 for (x
= 0; x
< 128; x
++)
783 for (y
= 0; y
< 64; y
++)
784 if (s
->video_ram
[x
+ (y
/8)*128] & (1 << (y
% 8)))
785 set_lcd_pixel(s
, x
, y
, MP_LCD_TEXTCOLOR
);
787 set_lcd_pixel(s
, x
, y
, 0);
789 dpy_update(s
->ds
, 0, 0, 128*3, 64*3);
792 static uint32_t musicpal_lcd_read(void *opaque
, target_phys_addr_t offset
)
794 musicpal_lcd_state
*s
= opaque
;
806 static void musicpal_lcd_write(void *opaque
, target_phys_addr_t offset
,
809 musicpal_lcd_state
*s
= opaque
;
818 if (value
== MP_LCD_SPI_DATA
|| value
== MP_LCD_SPI_CMD
)
821 s
->mode
= MP_LCD_SPI_INVALID
;
825 if (value
>= MP_LCD_INST_SETPAGE0
&& value
<= MP_LCD_INST_SETPAGE7
) {
826 s
->page
= value
- MP_LCD_INST_SETPAGE0
;
832 if (s
->mode
== MP_LCD_SPI_CMD
) {
833 if (value
>= MP_LCD_INST_SETPAGE0
&&
834 value
<= MP_LCD_INST_SETPAGE7
) {
835 s
->page
= value
- MP_LCD_INST_SETPAGE0
;
838 } else if (s
->mode
== MP_LCD_SPI_DATA
) {
839 s
->video_ram
[s
->page
*128 + s
->page_off
] = value
;
840 s
->page_off
= (s
->page_off
+ 1) & 127;
846 static CPUReadMemoryFunc
*musicpal_lcd_readfn
[] = {
852 static CPUWriteMemoryFunc
*musicpal_lcd_writefn
[] = {
858 static void musicpal_lcd_init(DisplayState
*ds
, uint32_t base
)
860 musicpal_lcd_state
*s
;
863 s
= qemu_mallocz(sizeof(musicpal_lcd_state
));
868 iomemtype
= cpu_register_io_memory(0, musicpal_lcd_readfn
,
869 musicpal_lcd_writefn
, s
);
870 cpu_register_physical_memory(base
, MP_LCD_SIZE
, iomemtype
);
872 graphic_console_init(ds
, lcd_refresh
, NULL
, NULL
, NULL
, s
);
873 dpy_resize(ds
, 128*3, 64*3);
876 /* PIC register offsets */
877 #define MP_PIC_STATUS 0x00
878 #define MP_PIC_ENABLE_SET 0x08
879 #define MP_PIC_ENABLE_CLR 0x0C
881 typedef struct mv88w8618_pic_state
887 } mv88w8618_pic_state
;
889 static void mv88w8618_pic_update(mv88w8618_pic_state
*s
)
891 qemu_set_irq(s
->parent_irq
, (s
->level
& s
->enabled
));
894 static void mv88w8618_pic_set_irq(void *opaque
, int irq
, int level
)
896 mv88w8618_pic_state
*s
= opaque
;
899 s
->level
|= 1 << irq
;
901 s
->level
&= ~(1 << irq
);
902 mv88w8618_pic_update(s
);
905 static uint32_t mv88w8618_pic_read(void *opaque
, target_phys_addr_t offset
)
907 mv88w8618_pic_state
*s
= opaque
;
912 return s
->level
& s
->enabled
;
919 static void mv88w8618_pic_write(void *opaque
, target_phys_addr_t offset
,
922 mv88w8618_pic_state
*s
= opaque
;
926 case MP_PIC_ENABLE_SET
:
930 case MP_PIC_ENABLE_CLR
:
931 s
->enabled
&= ~value
;
935 mv88w8618_pic_update(s
);
938 static void mv88w8618_pic_reset(void *opaque
)
940 mv88w8618_pic_state
*s
= opaque
;
946 static CPUReadMemoryFunc
*mv88w8618_pic_readfn
[] = {
952 static CPUWriteMemoryFunc
*mv88w8618_pic_writefn
[] = {
958 static qemu_irq
*mv88w8618_pic_init(uint32_t base
, qemu_irq parent_irq
)
960 mv88w8618_pic_state
*s
;
964 s
= qemu_mallocz(sizeof(mv88w8618_pic_state
));
967 qi
= qemu_allocate_irqs(mv88w8618_pic_set_irq
, s
, 32);
969 s
->parent_irq
= parent_irq
;
970 iomemtype
= cpu_register_io_memory(0, mv88w8618_pic_readfn
,
971 mv88w8618_pic_writefn
, s
);
972 cpu_register_physical_memory(base
, MP_PIC_SIZE
, iomemtype
);
974 qemu_register_reset(mv88w8618_pic_reset
, s
);
979 /* PIT register offsets */
980 #define MP_PIT_TIMER1_LENGTH 0x00
982 #define MP_PIT_TIMER4_LENGTH 0x0C
983 #define MP_PIT_CONTROL 0x10
984 #define MP_PIT_TIMER1_VALUE 0x14
986 #define MP_PIT_TIMER4_VALUE 0x20
987 #define MP_BOARD_RESET 0x34
989 /* Magic board reset value (probably some watchdog behind it) */
990 #define MP_BOARD_RESET_MAGIC 0x10000
992 typedef struct mv88w8618_timer_state
{
997 } mv88w8618_timer_state
;
999 typedef struct mv88w8618_pit_state
{
1003 } mv88w8618_pit_state
;
1005 static void mv88w8618_timer_tick(void *opaque
)
1007 mv88w8618_timer_state
*s
= opaque
;
1009 qemu_irq_raise(s
->irq
);
1012 static void *mv88w8618_timer_init(uint32_t freq
, qemu_irq irq
)
1014 mv88w8618_timer_state
*s
;
1017 s
= qemu_mallocz(sizeof(mv88w8618_timer_state
));
1021 bh
= qemu_bh_new(mv88w8618_timer_tick
, s
);
1022 s
->timer
= ptimer_init(bh
);
1027 static uint32_t mv88w8618_pit_read(void *opaque
, target_phys_addr_t offset
)
1029 mv88w8618_pit_state
*s
= opaque
;
1030 mv88w8618_timer_state
*t
;
1034 case MP_PIT_TIMER1_VALUE
... MP_PIT_TIMER4_VALUE
:
1035 t
= s
->timer
[(offset
-MP_PIT_TIMER1_VALUE
) >> 2];
1036 return ptimer_get_count(t
->timer
);
1043 static void mv88w8618_pit_write(void *opaque
, target_phys_addr_t offset
,
1046 mv88w8618_pit_state
*s
= opaque
;
1047 mv88w8618_timer_state
*t
;
1052 case MP_PIT_TIMER1_LENGTH
... MP_PIT_TIMER4_LENGTH
:
1053 t
= s
->timer
[offset
>> 2];
1055 ptimer_set_limit(t
->timer
, t
->limit
, 1);
1058 case MP_PIT_CONTROL
:
1059 for (i
= 0; i
< 4; i
++) {
1062 ptimer_set_limit(t
->timer
, t
->limit
, 0);
1063 ptimer_set_freq(t
->timer
, t
->freq
);
1064 ptimer_run(t
->timer
, 0);
1070 case MP_BOARD_RESET
:
1071 if (value
== MP_BOARD_RESET_MAGIC
)
1072 qemu_system_reset_request();
1077 static CPUReadMemoryFunc
*mv88w8618_pit_readfn
[] = {
1083 static CPUWriteMemoryFunc
*mv88w8618_pit_writefn
[] = {
1084 mv88w8618_pit_write
,
1085 mv88w8618_pit_write
,
1089 static void mv88w8618_pit_init(uint32_t base
, qemu_irq
*pic
, int irq
)
1092 mv88w8618_pit_state
*s
;
1094 s
= qemu_mallocz(sizeof(mv88w8618_pit_state
));
1099 /* Letting them all run at 1 MHz is likely just a pragmatic
1100 * simplification. */
1101 s
->timer
[0] = mv88w8618_timer_init(1000000, pic
[irq
]);
1102 s
->timer
[1] = mv88w8618_timer_init(1000000, pic
[irq
+ 1]);
1103 s
->timer
[2] = mv88w8618_timer_init(1000000, pic
[irq
+ 2]);
1104 s
->timer
[3] = mv88w8618_timer_init(1000000, pic
[irq
+ 3]);
1106 iomemtype
= cpu_register_io_memory(0, mv88w8618_pit_readfn
,
1107 mv88w8618_pit_writefn
, s
);
1108 cpu_register_physical_memory(base
, MP_PIT_SIZE
, iomemtype
);
1111 /* Flash config register offsets */
1112 #define MP_FLASHCFG_CFGR0 0x04
1114 typedef struct mv88w8618_flashcfg_state
{
1117 } mv88w8618_flashcfg_state
;
1119 static uint32_t mv88w8618_flashcfg_read(void *opaque
,
1120 target_phys_addr_t offset
)
1122 mv88w8618_flashcfg_state
*s
= opaque
;
1126 case MP_FLASHCFG_CFGR0
:
1134 static void mv88w8618_flashcfg_write(void *opaque
, target_phys_addr_t offset
,
1137 mv88w8618_flashcfg_state
*s
= opaque
;
1141 case MP_FLASHCFG_CFGR0
:
1147 static CPUReadMemoryFunc
*mv88w8618_flashcfg_readfn
[] = {
1148 mv88w8618_flashcfg_read
,
1149 mv88w8618_flashcfg_read
,
1150 mv88w8618_flashcfg_read
1153 static CPUWriteMemoryFunc
*mv88w8618_flashcfg_writefn
[] = {
1154 mv88w8618_flashcfg_write
,
1155 mv88w8618_flashcfg_write
,
1156 mv88w8618_flashcfg_write
1159 static void mv88w8618_flashcfg_init(uint32_t base
)
1162 mv88w8618_flashcfg_state
*s
;
1164 s
= qemu_mallocz(sizeof(mv88w8618_flashcfg_state
));
1169 s
->cfgr0
= 0xfffe4285; /* Default as set by U-Boot for 8 MB flash */
1170 iomemtype
= cpu_register_io_memory(0, mv88w8618_flashcfg_readfn
,
1171 mv88w8618_flashcfg_writefn
, s
);
1172 cpu_register_physical_memory(base
, MP_FLASHCFG_SIZE
, iomemtype
);
1175 /* Various registers in the 0x80000000 domain */
1176 #define MP_BOARD_REVISION 0x2018
1178 #define MP_WLAN_MAGIC1 0xc11c
1179 #define MP_WLAN_MAGIC2 0xc124
1181 #define MP_GPIO_OE_LO 0xd008
1182 #define MP_GPIO_OUT_LO 0xd00c
1183 #define MP_GPIO_IN_LO 0xd010
1184 #define MP_GPIO_ISR_LO 0xd020
1185 #define MP_GPIO_OE_HI 0xd508
1186 #define MP_GPIO_OUT_HI 0xd50c
1187 #define MP_GPIO_IN_HI 0xd510
1188 #define MP_GPIO_ISR_HI 0xd520
1190 /* GPIO bits & masks */
1191 #define MP_GPIO_WHEEL_VOL (1 << 8)
1192 #define MP_GPIO_WHEEL_VOL_INV (1 << 9)
1193 #define MP_GPIO_WHEEL_NAV (1 << 10)
1194 #define MP_GPIO_WHEEL_NAV_INV (1 << 11)
1195 #define MP_GPIO_LCD_BRIGHTNESS 0x00070000
1196 #define MP_GPIO_BTN_FAVORITS (1 << 19)
1197 #define MP_GPIO_BTN_MENU (1 << 20)
1198 #define MP_GPIO_BTN_VOLUME (1 << 21)
1199 #define MP_GPIO_BTN_NAVIGATION (1 << 22)
1200 #define MP_GPIO_I2C_DATA_BIT 29
1201 #define MP_GPIO_I2C_DATA (1 << MP_GPIO_I2C_DATA_BIT)
1202 #define MP_GPIO_I2C_CLOCK_BIT 30
1204 /* LCD brightness bits in GPIO_OE_HI */
1205 #define MP_OE_LCD_BRIGHTNESS 0x0007
1207 static uint32_t musicpal_read(void *opaque
, target_phys_addr_t offset
)
1209 offset
-= 0x80000000;
1211 case MP_BOARD_REVISION
:
1214 case MP_GPIO_OE_HI
: /* used for LCD brightness control */
1215 return lcd_brightness
& MP_OE_LCD_BRIGHTNESS
;
1217 case MP_GPIO_OUT_LO
:
1218 return gpio_out_state
& 0xFFFF;
1219 case MP_GPIO_OUT_HI
:
1220 return gpio_out_state
>> 16;
1223 return gpio_in_state
& 0xFFFF;
1225 /* Update received I2C data */
1226 gpio_in_state
= (gpio_in_state
& ~MP_GPIO_I2C_DATA
) |
1227 (i2c_get_data(mixer_i2c
) << MP_GPIO_I2C_DATA_BIT
);
1228 return gpio_in_state
>> 16;
1230 /* This is a simplification of reality */
1231 case MP_GPIO_ISR_LO
:
1232 return ~gpio_in_state
& 0xFFFF;
1233 case MP_GPIO_ISR_HI
:
1234 return ~gpio_in_state
>> 16;
1236 /* Workaround to allow loading the binary-only wlandrv.ko crap
1237 * from the original Freecom firmware. */
1238 case MP_WLAN_MAGIC1
:
1240 case MP_WLAN_MAGIC2
:
1248 static void musicpal_write(void *opaque
, target_phys_addr_t offset
,
1251 offset
-= 0x80000000;
1253 case MP_GPIO_OE_HI
: /* used for LCD brightness control */
1254 lcd_brightness
= (lcd_brightness
& MP_GPIO_LCD_BRIGHTNESS
) |
1255 (value
& MP_OE_LCD_BRIGHTNESS
);
1258 case MP_GPIO_OUT_LO
:
1259 gpio_out_state
= (gpio_out_state
& 0xFFFF0000) | (value
& 0xFFFF);
1261 case MP_GPIO_OUT_HI
:
1262 gpio_out_state
= (gpio_out_state
& 0xFFFF) | (value
<< 16);
1263 lcd_brightness
= (lcd_brightness
& 0xFFFF) |
1264 (gpio_out_state
& MP_GPIO_LCD_BRIGHTNESS
);
1265 i2c_state_update(mixer_i2c
,
1266 (gpio_out_state
>> MP_GPIO_I2C_DATA_BIT
) & 1,
1267 (gpio_out_state
>> MP_GPIO_I2C_CLOCK_BIT
) & 1);
1273 /* Keyboard codes & masks */
1274 #define KEY_PRESSED 0x80
1275 #define KEY_CODE 0x7f
1277 #define KEYCODE_TAB 0x0f
1278 #define KEYCODE_ENTER 0x1c
1279 #define KEYCODE_F 0x21
1280 #define KEYCODE_M 0x32
1282 #define KEYCODE_EXTENDED 0xe0
1283 #define KEYCODE_UP 0x48
1284 #define KEYCODE_DOWN 0x50
1285 #define KEYCODE_LEFT 0x4b
1286 #define KEYCODE_RIGHT 0x4d
1288 static void musicpal_key_event(void *opaque
, int keycode
)
1290 qemu_irq irq
= opaque
;
1292 static int kbd_extended
;
1294 if (keycode
== KEYCODE_EXTENDED
) {
1300 switch (keycode
& KEY_CODE
) {
1302 event
= MP_GPIO_WHEEL_NAV
| MP_GPIO_WHEEL_NAV_INV
;
1306 event
= MP_GPIO_WHEEL_NAV
;
1310 event
= MP_GPIO_WHEEL_VOL
| MP_GPIO_WHEEL_VOL_INV
;
1314 event
= MP_GPIO_WHEEL_VOL
;
1318 switch (keycode
& KEY_CODE
) {
1320 event
= MP_GPIO_BTN_FAVORITS
;
1324 event
= MP_GPIO_BTN_VOLUME
;
1328 event
= MP_GPIO_BTN_NAVIGATION
;
1332 event
= MP_GPIO_BTN_MENU
;
1336 if (keycode
& KEY_PRESSED
)
1337 gpio_in_state
|= event
;
1338 else if (gpio_in_state
& event
) {
1339 gpio_in_state
&= ~event
;
1340 qemu_irq_raise(irq
);
1346 static CPUReadMemoryFunc
*musicpal_readfn
[] = {
1352 static CPUWriteMemoryFunc
*musicpal_writefn
[] = {
1358 static struct arm_boot_info musicpal_binfo
= {
1359 .loader_start
= 0x0,
1363 static void musicpal_init(int ram_size
, int vga_ram_size
,
1364 const char *boot_device
, DisplayState
*ds
,
1365 const char *kernel_filename
, const char *kernel_cmdline
,
1366 const char *initrd_filename
, const char *cpu_model
)
1372 unsigned long flash_size
;
1375 cpu_model
= "arm926";
1377 env
= cpu_init(cpu_model
);
1379 fprintf(stderr
, "Unable to find CPU definition\n");
1382 pic
= arm_pic_init_cpu(env
);
1384 /* For now we use a fixed - the original - RAM size */
1385 cpu_register_physical_memory(0, MP_RAM_DEFAULT_SIZE
,
1386 qemu_ram_alloc(MP_RAM_DEFAULT_SIZE
));
1388 sram_off
= qemu_ram_alloc(MP_SRAM_SIZE
);
1389 cpu_register_physical_memory(MP_SRAM_BASE
, MP_SRAM_SIZE
, sram_off
);
1391 /* Catch various stuff not handled by separate subsystems */
1392 iomemtype
= cpu_register_io_memory(0, musicpal_readfn
,
1393 musicpal_writefn
, first_cpu
);
1394 cpu_register_physical_memory(0x80000000, 0x10000, iomemtype
);
1396 pic
= mv88w8618_pic_init(MP_PIC_BASE
, pic
[ARM_PIC_CPU_IRQ
]);
1397 mv88w8618_pit_init(MP_PIT_BASE
, pic
, MP_TIMER1_IRQ
);
1400 serial_mm_init(MP_UART1_BASE
, 2, pic
[MP_UART1_IRQ
], /*1825000,*/
1403 serial_mm_init(MP_UART2_BASE
, 2, pic
[MP_UART2_IRQ
], /*1825000,*/
1406 /* Register flash */
1407 index
= drive_get_index(IF_PFLASH
, 0, 0);
1409 flash_size
= bdrv_getlength(drives_table
[index
].bdrv
);
1410 if (flash_size
!= 8*1024*1024 && flash_size
!= 16*1024*1024 &&
1411 flash_size
!= 32*1024*1024) {
1412 fprintf(stderr
, "Invalid flash image size\n");
1417 * The original U-Boot accesses the flash at 0xFE000000 instead of
1418 * 0xFF800000 (if there is 8 MB flash). So remap flash access if the
1419 * image is smaller than 32 MB.
1421 pflash_cfi02_register(0-MP_FLASH_SIZE_MAX
, qemu_ram_alloc(flash_size
),
1422 drives_table
[index
].bdrv
, 0x10000,
1423 (flash_size
+ 0xffff) >> 16,
1424 MP_FLASH_SIZE_MAX
/ flash_size
,
1425 2, 0x00BF, 0x236D, 0x0000, 0x0000,
1428 mv88w8618_flashcfg_init(MP_FLASHCFG_BASE
);
1430 musicpal_lcd_init(ds
, MP_LCD_BASE
);
1432 qemu_add_kbd_event_handler(musicpal_key_event
, pic
[MP_GPIO_IRQ
]);
1435 * Wait a bit to catch menu button during U-Boot start-up
1436 * (to trigger emergency update).
1440 mv88w8618_eth_init(&nd_table
[0], MP_ETH_BASE
, pic
[MP_ETH_IRQ
]);
1442 mixer_i2c
= musicpal_audio_init(MP_AUDIO_BASE
, pic
[MP_AUDIO_IRQ
]);
1444 musicpal_binfo
.ram_size
= MP_RAM_DEFAULT_SIZE
;
1445 musicpal_binfo
.kernel_filename
= kernel_filename
;
1446 musicpal_binfo
.kernel_cmdline
= kernel_cmdline
;
1447 musicpal_binfo
.initrd_filename
= initrd_filename
;
1448 arm_load_kernel(first_cpu
, &musicpal_binfo
);
1451 QEMUMachine musicpal_machine
= {
1453 "Marvell 88w8618 / MusicPal (ARM926EJ-S)",
1455 MP_RAM_DEFAULT_SIZE
+ MP_SRAM_SIZE
+ MP_FLASH_SIZE_MAX
+ RAMSIZE_FIXED