hw/mcf5206.c

   1 /*
   2  * Motorola ColdFire MCF5206 SoC embedded peripheral emulation.
   3  *
   4  * Copyright (c) 2007 CodeSourcery.
   5  *
   6  * This code is licenced under the GPL
   7  */
   8 #include "vl.h"
   9
  10 /* General purpose timer module.  */
  11 typedef struct {
  12     uint16_t tmr;
  13     uint16_t trr;
  14     uint16_t tcr;
  15     uint16_t ter;
  16     ptimer_state *timer;
  17     qemu_irq irq;
  18     int irq_state;
  19 } m5206_timer_state;
  20
  21 #define TMR_RST 0x01
  22 #define TMR_CLK 0x06
  23 #define TMR_FRR 0x08
  24 #define TMR_ORI 0x10
  25 #define TMR_OM  0x20
  26 #define TMR_CE  0xc0
  27
  28 #define TER_CAP 0x01
  29 #define TER_REF 0x02
  30
  31 static void m5206_timer_update(m5206_timer_state *s)
  32 {
  33     if ((s->tmr & TMR_ORI) != 0 && (s->ter & TER_REF))
  34         qemu_irq_raise(s->irq);
  35     else
  36         qemu_irq_lower(s->irq);
  37 }
  38
  39 static void m5206_timer_reset(m5206_timer_state *s)
  40 {
  41     s->tmr = 0;
  42     s->trr = 0;
  43 }
  44
  45 static void m5206_timer_recalibrate(m5206_timer_state *s)
  46 {
  47     int prescale;
  48     int mode;
  49
  50     ptimer_stop(s->timer);
  51
  52     if ((s->tmr & TMR_RST) == 0)
  53         return;
  54
  55     prescale = (s->tmr >> 8) + 1;
  56     mode = (s->tmr >> 1) & 3;
  57     if (mode == 2)
  58         prescale *= 16;
  59
  60     if (mode == 3 || mode == 0)
  61         cpu_abort(cpu_single_env,
  62                   "m5206_timer: mode %d not implemented\n", mode);
  63     if ((s->tmr & TMR_FRR) == 0)
  64         cpu_abort(cpu_single_env,
  65                   "m5206_timer: free running mode not implemented\n");
  66
  67     /* Assume 66MHz system clock.  */
  68     ptimer_set_freq(s->timer, 66000000 / prescale);
  69
  70     ptimer_set_limit(s->timer, s->trr, 0);
  71
  72     ptimer_run(s->timer, 0);
  73 }
  74
  75 static void m5206_timer_trigger(void *opaque)
  76 {
  77     m5206_timer_state *s = (m5206_timer_state *)opaque;
  78     s->ter |= TER_REF;
  79     m5206_timer_update(s);
  80 }
  81
  82 static uint32_t m5206_timer_read(m5206_timer_state *s, uint32_t addr)
  83 {
  84     switch (addr) {
  85     case 0:
  86         return s->tmr;
  87     case 4:
  88         return s->trr;
  89     case 8:
  90         return s->tcr;
  91     case 0xc:
  92         return s->trr - ptimer_get_count(s->timer);
  93     case 0x11:
  94         return s->ter;
  95     default:
  96         return 0;
  97     }
  98 }
  99
 100 static void m5206_timer_write(m5206_timer_state *s, uint32_t addr, uint32_t val)
 101 {
 102     switch (addr) {
 103     case 0:
 104         if ((s->tmr & TMR_RST) != 0 && (val & TMR_RST) == 0) {
 105             m5206_timer_reset(s);
 106         }
 107         s->tmr = val;
 108         m5206_timer_recalibrate(s);
 109         break;
 110     case 4:
 111         s->trr = val;
 112         m5206_timer_recalibrate(s);
 113         break;
 114     case 8:
 115         s->tcr = val;
 116         break;
 117     case 0xc:
 118         ptimer_set_count(s->timer, val);
 119         break;
 120     case 0x11:
 121         s->ter &= ~val;
 122         break;
 123     default:
 124         break;
 125     }
 126     m5206_timer_update(s);
 127 }
 128
 129 static m5206_timer_state *m5206_timer_init(qemu_irq irq)
 130 {
 131     m5206_timer_state *s;
 132     QEMUBH *bh;
 133
 134     s = (m5206_timer_state *)qemu_mallocz(sizeof(m5206_timer_state));
 135     bh = qemu_bh_new(m5206_timer_trigger, s);
 136     s->timer = ptimer_init(bh);
 137     s->irq = irq;
 138     m5206_timer_reset(s);
 139     return s;
 140 }
 141
 142 /* UART */
 143
 144 typedef struct {
 145     uint8_t mr[2];
 146     uint8_t sr;
 147     uint8_t isr;
 148     uint8_t imr;
 149     uint8_t bg1;
 150     uint8_t bg2;
 151     uint8_t fifo[4];
 152     uint8_t tb;
 153     int current_mr;
 154     int fifo_len;
 155     int tx_enabled;
 156     int rx_enabled;
 157     qemu_irq irq;
 158     CharDriverState *chr;
 159 } m5206_uart_state;
 160
 161 /* UART Status Register bits.  */
 162 #define M5206_UART_RxRDY  0x01
 163 #define M5206_UART_FFULL  0x02
 164 #define M5206_UART_TxRDY  0x04
 165 #define M5206_UART_TxEMP  0x08
 166 #define M5206_UART_OE     0x10
 167 #define M5206_UART_PE     0x20
 168 #define M5206_UART_FE     0x40
 169 #define M5206_UART_RB     0x80
 170
 171 /* Interrupt flags.  */
 172 #define M5206_UART_TxINT  0x01
 173 #define M5206_UART_RxINT  0x02
 174 #define M5206_UART_DBINT  0x04
 175 #define M5206_UART_COSINT 0x80
 176
 177 /* UMR1 flags.  */
 178 #define M5206_UART_BC0    0x01
 179 #define M5206_UART_BC1    0x02
 180 #define M5206_UART_PT     0x04
 181 #define M5206_UART_PM0    0x08
 182 #define M5206_UART_PM1    0x10
 183 #define M5206_UART_ERR    0x20
 184 #define M5206_UART_RxIRQ  0x40
 185 #define M5206_UART_RxRTS  0x80
 186
 187 static void m5206_uart_update(m5206_uart_state *s)
 188 {
 189     s->isr &= ~(M5206_UART_TxINT | M5206_UART_RxINT);
 190     if (s->sr & M5206_UART_TxRDY)
 191         s->isr |= M5206_UART_TxINT;
 192     if ((s->sr & ((s->mr[0] & M5206_UART_RxIRQ)
 193                   ? M5206_UART_FFULL : M5206_UART_RxRDY)) != 0)
 194         s->isr |= M5206_UART_RxINT;
 195
 196     qemu_set_irq(s->irq, (s->isr & s->imr) != 0);
 197 }
 198
 199 static uint32_t m5206_uart_read(m5206_uart_state *s, uint32_t addr)
 200 {
 201     switch (addr) {
 202     case 0x00:
 203         return s->mr[s->current_mr];
 204     case 0x04:
 205         return s->sr;
 206     case 0x0c:
 207         {
 208             uint8_t val;
 209             int i;
 210
 211             if (s->fifo_len == 0)
 212                 return 0;
 213
 214             val = s->fifo[0];
 215             s->fifo_len--;
 216             for (i = 0; i < s->fifo_len; i++)
 217                 s->fifo[i] = s->fifo[i + 1];
 218             s->sr &= ~M5206_UART_FFULL;
 219             if (s->fifo_len == 0)
 220                 s->sr &= ~M5206_UART_RxRDY;
 221             m5206_uart_update(s);
 222             return val;
 223         }
 224     case 0x10:
 225         /* TODO: Implement IPCR.  */
 226         return 0;
 227     case 0x14:
 228         return s->isr;
 229     case 0x18:
 230         return s->bg1;
 231     case 0x1c:
 232         return s->bg2;
 233     default:
 234         return 0;
 235     }
 236 }
 237
 238 /* Update TxRDY flag and set data if present and enabled.  */
 239 static void m5206_uart_do_tx(m5206_uart_state *s)
 240 {
 241     if (s->tx_enabled && (s->sr & M5206_UART_TxEMP) == 0) {
 242         if (s->chr)
 243             qemu_chr_write(s->chr, (unsigned char *)&s->tb, 1);
 244         s->sr |= M5206_UART_TxEMP;
 245     }
 246     if (s->tx_enabled) {
 247         s->sr |= M5206_UART_TxRDY;
 248     } else {
 249         s->sr &= ~M5206_UART_TxRDY;
 250     }
 251 }
 252
 253 static void m5206_do_command(m5206_uart_state *s, uint8_t cmd)
 254 {
 255     /* Misc command.  */
 256     switch ((cmd >> 4) & 3) {
 257     case 0: /* No-op.  */
 258         break;
 259     case 1: /* Reset mode register pointer.  */
 260         s->current_mr = 0;
 261         break;
 262     case 2: /* Reset receiver.  */
 263         s->rx_enabled = 0;
 264         s->fifo_len = 0;
 265         s->sr &= ~(M5206_UART_RxRDY | M5206_UART_FFULL);
 266         break;
 267     case 3: /* Reset transmitter.  */
 268         s->tx_enabled = 0;
 269         s->sr |= M5206_UART_TxEMP;
 270         s->sr &= ~M5206_UART_TxRDY;
 271         break;
 272     case 4: /* Reset error status.  */
 273         break;
 274     case 5: /* Reset break-change interrupt.  */
 275         s->isr &= ~M5206_UART_DBINT;
 276         break;
 277     case 6: /* Start break.  */
 278     case 7: /* Stop break.  */
 279         break;
 280     }
 281
 282     /* Transmitter command.  */
 283     switch ((cmd >> 2) & 3) {
 284     case 0: /* No-op.  */
 285         break;
 286     case 1: /* Enable.  */
 287         s->tx_enabled = 1;
 288         m5206_uart_do_tx(s);
 289         break;
 290     case 2: /* Disable.  */
 291         s->tx_enabled = 0;
 292         m5206_uart_do_tx(s);
 293         break;
 294     case 3: /* Reserved.  */
 295         fprintf(stderr, "m5206_uart: Bad TX command\n");
 296         break;
 297     }
 298
 299     /* Receiver command.  */
 300     switch (cmd & 3) {
 301     case 0: /* No-op.  */
 302         break;
 303     case 1: /* Enable.  */
 304         s->rx_enabled = 1;
 305         break;
 306     case 2:
 307         s->rx_enabled = 0;
 308         break;
 309     case 3: /* Reserved.  */
 310         fprintf(stderr, "m5206_uart: Bad RX command\n");
 311         break;
 312     }
 313 }
 314
 315 static void m5206_uart_write(m5206_uart_state *s, uint32_t addr, uint32_t val)
 316 {
 317     switch (addr) {
 318     case 0x00:
 319         s->mr[s->current_mr] = val;
 320         s->current_mr = 1;
 321         break;
 322     case 0x04:
 323         /* CSR is ignored.  */
 324         break;
 325     case 0x08: /* Command Register.  */
 326         m5206_do_command(s, val);
 327         break;
 328     case 0x0c: /* Transmit Buffer.  */
 329         s->sr &= ~M5206_UART_TxEMP;
 330         s->tb = val;
 331         m5206_uart_do_tx(s);
 332         break;
 333     case 0x10:
 334         /* ACR is ignored.  */
 335         break;
 336     case 0x14:
 337         s->imr = val;
 338         break;
 339     default:
 340         break;
 341     }
 342     m5206_uart_update(s);
 343 }
 344
 345 static void m5206_uart_reset(m5206_uart_state *s)
 346 {
 347     s->fifo_len = 0;
 348     s->mr[0] = 0;
 349     s->mr[1] = 0;
 350     s->sr = M5206_UART_TxEMP;
 351     s->tx_enabled = 0;
 352     s->rx_enabled = 0;
 353     s->isr = 0;
 354     s->imr = 0;
 355 }
 356
 357 static void m5206_uart_push_byte(m5206_uart_state *s, uint8_t data)
 358 {
 359     /* Break events overwrite the last byte if the fifo is full.  */
 360     if (s->fifo_len == 4)
 361         s->fifo_len--;
 362
 363     s->fifo[s->fifo_len] = data;
 364     s->fifo_len++;
 365     s->sr |= M5206_UART_RxRDY;
 366     if (s->fifo_len == 4)
 367         s->sr |= M5206_UART_FFULL;
 368
 369     m5206_uart_update(s);
 370 }
 371
 372 static void m5206_uart_event(void *opaque, int event)
 373 {
 374     m5206_uart_state *s = (m5206_uart_state *)opaque;
 375
 376     switch (event) {
 377     case CHR_EVENT_BREAK:
 378         s->isr |= M5206_UART_DBINT;
 379         m5206_uart_push_byte(s, 0);
 380         break;
 381     default:
 382         break;
 383     }
 384 }
 385
 386 static int m5206_uart_can_receive(void *opaque)
 387 {
 388     m5206_uart_state *s = (m5206_uart_state *)opaque;
 389
 390     return s->rx_enabled && (s->sr & M5206_UART_FFULL) == 0;
 391 }
 392
 393 static void m5206_uart_receive(void *opaque, const uint8_t *buf, int size)
 394 {
 395     m5206_uart_state *s = (m5206_uart_state *)opaque;
 396
 397     m5206_uart_push_byte(s, buf[0]);
 398 }
 399
 400 static m5206_uart_state *m5206_uart_init(qemu_irq irq, CharDriverState *chr)
 401 {
 402     m5206_uart_state *s;
 403
 404     s = qemu_mallocz(sizeof(m5206_uart_state));
 405     s->chr = chr;
 406     s->irq = irq;
 407     if (chr) {
 408         qemu_chr_add_handlers(chr, m5206_uart_can_receive, m5206_uart_receive,
 409                               m5206_uart_event, s);
 410     }
 411     m5206_uart_reset(s);
 412     return s;
 413 }
 414
 415 /* System Integration Module.  */
 416
 417 typedef struct {
 418     CPUState *env;
 419     m5206_timer_state *timer[2];
 420     m5206_uart_state *uart[2];
 421     uint8_t scr;
 422     uint8_t icr[14];
 423     uint16_t imr; /* 1 == interrupt is masked.  */
 424     uint16_t ipr;
 425     uint8_t rsr;
 426     uint8_t swivr;
 427     uint8_t par;
 428     /* Include the UART vector registers here.  */
 429     uint8_t uivr[2];
 430 } m5206_mbar_state;
 431
 432 /* Interrupt controller.  */
 433
 434 static int m5206_find_pending_irq(m5206_mbar_state *s)
 435 {
 436     int level;
 437     int vector;
 438     uint16_t active;
 439     int i;
 440
 441     level = 0;
 442     vector = 0;
 443     active = s->ipr & ~s->imr;
 444     if (!active)
 445         return 0;
 446
 447     for (i = 1; i < 14; i++) {
 448         if (active & (1 << i)) {
 449             if ((s->icr[i] & 0x1f) > level) {
 450                 level = s->icr[i] & 0x1f;
 451                 vector = i;
 452             }
 453         }
 454     }
 455
 456     if (level < 4)
 457         vector = 0;
 458
 459     return vector;
 460 }
 461
 462 static void m5206_mbar_update(m5206_mbar_state *s)
 463 {
 464     int irq;
 465     int vector;
 466     int level;
 467
 468     irq = m5206_find_pending_irq(s);
 469     if (irq) {
 470         int tmp;
 471         tmp = s->icr[irq];
 472         level = (tmp >> 2) & 7;
 473         if (tmp & 0x80) {
 474             /* Autovector.  */
 475             vector = 24 + level;
 476         } else {
 477             switch (irq) {
 478             case 8: /* SWT */
 479                 vector = s->swivr;
 480                 break;
 481             case 12: /* UART1 */
 482                 vector = s->uivr[0];
 483                 break;
 484             case 13: /* UART2 */
 485                 vector = s->uivr[1];
 486                 break;
 487             default:
 488                 /* Unknown vector.  */
 489                 fprintf(stderr, "Unhandled vector for IRQ %d\n", irq);
 490                 vector = 0xf;
 491                 break;
 492             }
 493         }
 494     } else {
 495         level = 0;
 496         vector = 0;
 497     }
 498     m68k_set_irq_level(s->env, level, vector);
 499 }
 500
 501 static void m5206_mbar_set_irq(void *opaque, int irq, int level)
 502 {
 503     m5206_mbar_state *s = (m5206_mbar_state *)opaque;
 504     if (level) {
 505         s->ipr |= 1 << irq;
 506     } else {
 507         s->ipr &= ~(1 << irq);
 508     }
 509     m5206_mbar_update(s);
 510 }
 511
 512 /* System Integration Module.  */
 513
 514 static void m5206_mbar_reset(m5206_mbar_state *s)
 515 {
 516     s->scr = 0xc0;
 517     s->icr[1] = 0x04;
 518     s->icr[2] = 0x08;
 519     s->icr[3] = 0x0c;
 520     s->icr[4] = 0x10;
 521     s->icr[5] = 0x14;
 522     s->icr[6] = 0x18;
 523     s->icr[7] = 0x1c;
 524     s->icr[8] = 0x1c;
 525     s->icr[9] = 0x80;
 526     s->icr[10] = 0x80;
 527     s->icr[11] = 0x80;
 528     s->icr[12] = 0x00;
 529     s->icr[13] = 0x00;
 530     s->imr = 0x3ffe;
 531     s->rsr = 0x80;
 532     s->swivr = 0x0f;
 533     s->par = 0;
 534 }
 535
 536 static uint32_t m5206_mbar_read(m5206_mbar_state *s, uint32_t offset)
 537 {
 538     if (offset >= 0x100 && offset < 0x120) {
 539         return m5206_timer_read(s->timer[0], offset - 0x100);
 540     } else if (offset >= 0x120 && offset < 0x140) {
 541         return m5206_timer_read(s->timer[1], offset - 0x120);
 542     } else if (offset >= 0x140 && offset < 0x160) {
 543         return m5206_uart_read(s->uart[0], offset - 0x140);
 544     } else if (offset >= 0x180 && offset < 0x1a0) {
 545         return m5206_uart_read(s->uart[1], offset - 0x180);
 546     }
 547     switch (offset) {
 548     case 0x03: return s->scr;
 549     case 0x14 ... 0x20: return s->icr[offset - 0x13];
 550     case 0x36: return s->imr;
 551     case 0x3a: return s->ipr;
 552     case 0x40: return s->rsr;
 553     case 0x41: return 0;
 554     case 0x42: return s->swivr;
 555     case 0x50:
 556         /* DRAM mask register.  */
 557         /* FIXME: currently hardcoded to 128Mb.  */
 558         {
 559             uint32_t mask = ~0;
 560             while (mask > ram_size)
 561                 mask >>= 1;
 562             return mask & 0x0ffe0000;
 563         }
 564     case 0x5c: return 1; /* DRAM bank 1 empty.  */
 565     case 0xcb: return s->par;
 566     case 0x170: return s->uivr[0];
 567     case 0x1b0: return s->uivr[1];
 568     }
 569     cpu_abort(cpu_single_env, "Bad MBAR read offset 0x%x", (int)offset);
 570     return 0;
 571 }
 572
 573 static void m5206_mbar_write(m5206_mbar_state *s, uint32_t offset,
 574                              uint32_t value)
 575 {
 576     if (offset >= 0x100 && offset < 0x120) {
 577         m5206_timer_write(s->timer[0], offset - 0x100, value);
 578         return;
 579     } else if (offset >= 0x120 && offset < 0x140) {
 580         m5206_timer_write(s->timer[1], offset - 0x120, value);
 581         return;
 582     } else if (offset >= 0x140 && offset < 0x160) {
 583         m5206_uart_write(s->uart[0], offset - 0x140, value);
 584         return;
 585     } else if (offset >= 0x180 && offset < 0x1a0) {
 586         m5206_uart_write(s->uart[1], offset - 0x180, value);
 587         return;
 588     }
 589     switch (offset) {
 590     case 0x03:
 591         s->scr = value;
 592         break;
 593     case 0x14 ... 0x20:
 594         s->icr[offset - 0x13] = value;
 595         m5206_mbar_update(s);
 596         break;
 597     case 0x36:
 598         s->imr = value;
 599         m5206_mbar_update(s);
 600         break;
 601     case 0x40:
 602         s->rsr &= ~value;
 603         break;
 604     case 0x41:
 605         /* TODO: implement watchdog.  */
 606         break;
 607     case 0x42:
 608         s->swivr = value;
 609         break;
 610     case 0xcb:
 611         s->par = value;
 612         break;
 613     case 0x170:
 614         s->uivr[0] = value;
 615         break;
 616     case 0x178: case 0x17c: case 0x1c8: case 0x1bc:
 617         /* Not implemented: UART Output port bits.  */
 618         break;
 619     case 0x1b0:
 620         s->uivr[1] = value;
 621         break;
 622     default:
 623         cpu_abort(cpu_single_env, "Bad MBAR write offset 0x%x", (int)offset);
 624         break;
 625     }
 626 }
 627
 628 /* Internal peripherals use a variety of register widths.
 629    This lookup table allows a single routine to handle all of them.  */
 630 static const int m5206_mbar_width[] =
 631 {
 632   /* 000-040 */ 1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1,  2, 2, 2, 2,
 633   /* 040-080 */ 1, 2, 2, 2,  4, 1, 2, 4,  1, 2, 4, 2,  2, 4, 2, 2,
 634   /* 080-0c0 */ 4, 2, 2, 4,  2, 2, 4, 2,  2, 4, 2, 2,  4, 2, 2, 4,
 635   /* 0c0-100 */ 2, 2, 1, 0,  0, 0, 0, 0,  0, 0, 0, 0,  0, 0, 0, 0,
 636   /* 100-140 */ 2, 2, 2, 2,  1, 0, 0, 0,  2, 2, 2, 2,  1, 0, 0, 0,
 637   /* 140-180 */ 1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1,
 638   /* 180-1c0 */ 1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1,
 639   /* 1c0-200 */ 1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1,
 640 };
 641
 642 static uint32_t m5206_mbar_readw(void *opaque, target_phys_addr_t offset);
 643 static uint32_t m5206_mbar_readl(void *opaque, target_phys_addr_t offset);
 644
 645 static uint32_t m5206_mbar_readb(void *opaque, target_phys_addr_t offset)
 646 {
 647     m5206_mbar_state *s = (m5206_mbar_state *)opaque;
 648     offset &= 0x3ff;
 649     if (offset > 0x200) {
 650         cpu_abort(cpu_single_env, "Bad MBAR read offset 0x%x", (int)offset);
 651     }
 652     if (m5206_mbar_width[offset >> 2] > 1) {
 653         uint16_t val;
 654         val = m5206_mbar_readw(opaque, offset & ~1);
 655         if ((offset & 1) == 0) {
 656             val >>= 8;
 657         }
 658         return val & 0xff;
 659     }
 660     return m5206_mbar_read(s, offset);
 661 }
 662
 663 static uint32_t m5206_mbar_readw(void *opaque, target_phys_addr_t offset)
 664 {
 665     m5206_mbar_state *s = (m5206_mbar_state *)opaque;
 666     int width;
 667     offset &= 0x3ff;
 668     if (offset > 0x200) {
 669         cpu_abort(cpu_single_env, "Bad MBAR read offset 0x%x", (int)offset);
 670     }
 671     width = m5206_mbar_width[offset >> 2];
 672     if (width > 2) {
 673         uint32_t val;
 674         val = m5206_mbar_readl(opaque, offset & ~3);
 675         if ((offset & 3) == 0)
 676             val >>= 16;
 677         return val & 0xffff;
 678     } else if (width < 2) {
 679         uint16_t val;
 680         val = m5206_mbar_readb(opaque, offset) << 8;
 681         val |= m5206_mbar_readb(opaque, offset + 1);
 682         return val;
 683     }
 684     return m5206_mbar_read(s, offset);
 685 }
 686
 687 static uint32_t m5206_mbar_readl(void *opaque, target_phys_addr_t offset)
 688 {
 689     m5206_mbar_state *s = (m5206_mbar_state *)opaque;
 690     int width;
 691     offset &= 0x3ff;
 692     if (offset > 0x200) {
 693         cpu_abort(cpu_single_env, "Bad MBAR read offset 0x%x", (int)offset);
 694     }
 695     width = m5206_mbar_width[offset >> 2];
 696     if (width < 4) {
 697         uint32_t val;
 698         val = m5206_mbar_readw(opaque, offset) << 16;
 699         val |= m5206_mbar_readw(opaque, offset + 2);
 700         return val;
 701     }
 702     return m5206_mbar_read(s, offset);
 703 }
 704
 705 static void m5206_mbar_writew(void *opaque, target_phys_addr_t offset,
 706                               uint32_t value);
 707 static void m5206_mbar_writel(void *opaque, target_phys_addr_t offset,
 708                               uint32_t value);
 709
 710 static void m5206_mbar_writeb(void *opaque, target_phys_addr_t offset,
 711                               uint32_t value)
 712 {
 713     m5206_mbar_state *s = (m5206_mbar_state *)opaque;
 714     int width;
 715     offset &= 0x3ff;
 716     if (offset > 0x200) {
 717         cpu_abort(cpu_single_env, "Bad MBAR write offset 0x%x", (int)offset);
 718     }
 719     width = m5206_mbar_width[offset >> 2];
 720     if (width > 1) {
 721         uint32_t tmp;
 722         tmp = m5206_mbar_readw(opaque, offset & ~1);
 723         if (offset & 1) {
 724             tmp = (tmp & 0xff00) | value;
 725         } else {
 726             tmp = (tmp & 0x00ff) | (value << 8);
 727         }
 728         m5206_mbar_writew(opaque, offset & ~1, tmp);
 729         return;
 730     }
 731     m5206_mbar_write(s, offset, value);
 732 }
 733
 734 static void m5206_mbar_writew(void *opaque, target_phys_addr_t offset,
 735                               uint32_t value)
 736 {
 737     m5206_mbar_state *s = (m5206_mbar_state *)opaque;
 738     int width;
 739     offset &= 0x3ff;
 740     if (offset > 0x200) {
 741         cpu_abort(cpu_single_env, "Bad MBAR write offset 0x%x", (int)offset);
 742     }
 743     width = m5206_mbar_width[offset >> 2];
 744     if (width > 2) {
 745         uint32_t tmp;
 746         tmp = m5206_mbar_readl(opaque, offset & ~3);
 747         if (offset & 3) {
 748             tmp = (tmp & 0xffff0000) | value;
 749         } else {
 750             tmp = (tmp & 0x0000ffff) | (value << 16);
 751         }
 752         m5206_mbar_writel(opaque, offset & ~3, tmp);
 753         return;
 754     } else if (width < 2) {
 755         m5206_mbar_writeb(opaque, offset, value >> 8);
 756         m5206_mbar_writeb(opaque, offset + 1, value & 0xff);
 757         return;
 758     }
 759     m5206_mbar_write(s, offset, value);
 760 }
 761
 762 static void m5206_mbar_writel(void *opaque, target_phys_addr_t offset,
 763                               uint32_t value)
 764 {
 765     m5206_mbar_state *s = (m5206_mbar_state *)opaque;
 766     int width;
 767     offset &= 0x3ff;
 768     if (offset > 0x200) {
 769         cpu_abort(cpu_single_env, "Bad MBAR write offset 0x%x", (int)offset);
 770     }
 771     width = m5206_mbar_width[offset >> 2];
 772     if (width < 4) {
 773         m5206_mbar_writew(opaque, offset, value >> 16);
 774         m5206_mbar_writew(opaque, offset + 2, value & 0xffff);
 775         return;
 776     }
 777     m5206_mbar_write(s, offset, value);
 778 }
 779
 780 static CPUReadMemoryFunc *m5206_mbar_readfn[] = {
 781    m5206_mbar_readb,
 782    m5206_mbar_readw,
 783    m5206_mbar_readl
 784 };
 785
 786 static CPUWriteMemoryFunc *m5206_mbar_writefn[] = {
 787    m5206_mbar_writeb,
 788    m5206_mbar_writew,
 789    m5206_mbar_writel
 790 };
 791
 792 qemu_irq *mcf5206_init(uint32_t base, CPUState *env)
 793 {
 794     m5206_mbar_state *s;
 795     qemu_irq *pic;
 796     int iomemtype;
 797
 798     s = (m5206_mbar_state *)qemu_mallocz(sizeof(m5206_mbar_state));
 799     iomemtype = cpu_register_io_memory(0, m5206_mbar_readfn,
 800                                        m5206_mbar_writefn, s);
 801     cpu_register_physical_memory(base, 0x00000fff, iomemtype);
 802
 803     pic = qemu_allocate_irqs(m5206_mbar_set_irq, s, 14);
 804     s->timer[0] = m5206_timer_init(pic[9]);
 805     s->timer[1] = m5206_timer_init(pic[10]);
 806     s->uart[0] = m5206_uart_init(pic[12], serial_hds[0]);
 807     s->uart[1] = m5206_uart_init(pic[13], serial_hds[1]);
 808     s->env = env;
 809
 810     m5206_mbar_reset(s);
 811     return pic;
 812 }
 813