xref: /openbmc/qemu/hw/arm/musicpal.c (revision 6832189f)
1 /*
2  * Marvell MV88W8618 / Freecom MusicPal emulation.
3  *
4  * Copyright (c) 2008 Jan Kiszka
5  *
6  * This code is licensed under the GNU GPL v2.
7  *
8  * Contributions after 2012-01-13 are licensed under the terms of the
9  * GNU GPL, version 2 or (at your option) any later version.
10  */
11 
12 #include "qemu/osdep.h"
13 #include "qemu/units.h"
14 #include "qapi/error.h"
15 #include "cpu.h"
16 #include "hw/sysbus.h"
17 #include "migration/vmstate.h"
18 #include "hw/arm/boot.h"
19 #include "net/net.h"
20 #include "sysemu/sysemu.h"
21 #include "hw/boards.h"
22 #include "hw/char/serial.h"
23 #include "qemu/timer.h"
24 #include "hw/ptimer.h"
25 #include "hw/qdev-properties.h"
26 #include "hw/block/flash.h"
27 #include "ui/console.h"
28 #include "hw/i2c/i2c.h"
29 #include "hw/i2c/bitbang_i2c.h"
30 #include "hw/irq.h"
31 #include "hw/or-irq.h"
32 #include "hw/audio/wm8750.h"
33 #include "sysemu/block-backend.h"
34 #include "sysemu/runstate.h"
35 #include "sysemu/dma.h"
36 #include "ui/pixel_ops.h"
37 #include "qemu/cutils.h"
38 #include "qom/object.h"
39 #include "hw/net/mv88w8618_eth.h"
40 
41 #define MP_MISC_BASE            0x80002000
42 #define MP_MISC_SIZE            0x00001000
43 
44 #define MP_ETH_BASE             0x80008000
45 
46 #define MP_WLAN_BASE            0x8000C000
47 #define MP_WLAN_SIZE            0x00000800
48 
49 #define MP_UART1_BASE           0x8000C840
50 #define MP_UART2_BASE           0x8000C940
51 
52 #define MP_GPIO_BASE            0x8000D000
53 #define MP_GPIO_SIZE            0x00001000
54 
55 #define MP_FLASHCFG_BASE        0x90006000
56 #define MP_FLASHCFG_SIZE        0x00001000
57 
58 #define MP_AUDIO_BASE           0x90007000
59 
60 #define MP_PIC_BASE             0x90008000
61 #define MP_PIC_SIZE             0x00001000
62 
63 #define MP_PIT_BASE             0x90009000
64 #define MP_PIT_SIZE             0x00001000
65 
66 #define MP_LCD_BASE             0x9000c000
67 #define MP_LCD_SIZE             0x00001000
68 
69 #define MP_SRAM_BASE            0xC0000000
70 #define MP_SRAM_SIZE            0x00020000
71 
72 #define MP_RAM_DEFAULT_SIZE     32*1024*1024
73 #define MP_FLASH_SIZE_MAX       32*1024*1024
74 
75 #define MP_TIMER1_IRQ           4
76 #define MP_TIMER2_IRQ           5
77 #define MP_TIMER3_IRQ           6
78 #define MP_TIMER4_IRQ           7
79 #define MP_EHCI_IRQ             8
80 #define MP_ETH_IRQ              9
81 #define MP_UART_SHARED_IRQ      11
82 #define MP_GPIO_IRQ             12
83 #define MP_RTC_IRQ              28
84 #define MP_AUDIO_IRQ            30
85 
86 /* Wolfson 8750 I2C address */
87 #define MP_WM_ADDR              0x1A
88 
89 /* LCD register offsets */
90 #define MP_LCD_IRQCTRL          0x180
91 #define MP_LCD_IRQSTAT          0x184
92 #define MP_LCD_SPICTRL          0x1ac
93 #define MP_LCD_INST             0x1bc
94 #define MP_LCD_DATA             0x1c0
95 
96 /* Mode magics */
97 #define MP_LCD_SPI_DATA         0x00100011
98 #define MP_LCD_SPI_CMD          0x00104011
99 #define MP_LCD_SPI_INVALID      0x00000000
100 
101 /* Commmands */
102 #define MP_LCD_INST_SETPAGE0    0xB0
103 /* ... */
104 #define MP_LCD_INST_SETPAGE7    0xB7
105 
106 #define MP_LCD_TEXTCOLOR        0xe0e0ff /* RRGGBB */
107 
108 #define TYPE_MUSICPAL_LCD "musicpal_lcd"
109 OBJECT_DECLARE_SIMPLE_TYPE(musicpal_lcd_state, MUSICPAL_LCD)
110 
111 struct musicpal_lcd_state {
112     /*< private >*/
113     SysBusDevice parent_obj;
114     /*< public >*/
115 
116     MemoryRegion iomem;
117     uint32_t brightness;
118     uint32_t mode;
119     uint32_t irqctrl;
120     uint32_t page;
121     uint32_t page_off;
122     QemuConsole *con;
123     uint8_t video_ram[128*64/8];
124 };
125 
126 static uint8_t scale_lcd_color(musicpal_lcd_state *s, uint8_t col)
127 {
128     switch (s->brightness) {
129     case 7:
130         return col;
131     case 0:
132         return 0;
133     default:
134         return (col * s->brightness) / 7;
135     }
136 }
137 
138 static inline void set_lcd_pixel32(musicpal_lcd_state *s,
139                                    int x, int y, uint32_t col)
140 {
141     int dx, dy;
142     DisplaySurface *surface = qemu_console_surface(s->con);
143     uint32_t *pixel =
144         &((uint32_t *) surface_data(surface))[(y * 128 * 3 + x) * 3];
145 
146     for (dy = 0; dy < 3; dy++, pixel += 127 * 3) {
147         for (dx = 0; dx < 3; dx++, pixel++) {
148             *pixel = col;
149         }
150     }
151 }
152 
153 static void lcd_refresh(void *opaque)
154 {
155     musicpal_lcd_state *s = opaque;
156     int x, y, col;
157 
158     col = rgb_to_pixel32(scale_lcd_color(s, (MP_LCD_TEXTCOLOR >> 16) & 0xff),
159                          scale_lcd_color(s, (MP_LCD_TEXTCOLOR >> 8) & 0xff),
160                          scale_lcd_color(s, MP_LCD_TEXTCOLOR & 0xff));
161     for (x = 0; x < 128; x++) {
162         for (y = 0; y < 64; y++) {
163             if (s->video_ram[x + (y / 8) * 128] & (1 << (y % 8))) {
164                 set_lcd_pixel32(s, x, y, col);
165             } else {
166                 set_lcd_pixel32(s, x, y, 0);
167             }
168         }
169     }
170 
171     dpy_gfx_update(s->con, 0, 0, 128*3, 64*3);
172 }
173 
174 static void lcd_invalidate(void *opaque)
175 {
176 }
177 
178 static void musicpal_lcd_gpio_brightness_in(void *opaque, int irq, int level)
179 {
180     musicpal_lcd_state *s = opaque;
181     s->brightness &= ~(1 << irq);
182     s->brightness |= level << irq;
183 }
184 
185 static uint64_t musicpal_lcd_read(void *opaque, hwaddr offset,
186                                   unsigned size)
187 {
188     musicpal_lcd_state *s = opaque;
189 
190     switch (offset) {
191     case MP_LCD_IRQCTRL:
192         return s->irqctrl;
193 
194     default:
195         return 0;
196     }
197 }
198 
199 static void musicpal_lcd_write(void *opaque, hwaddr offset,
200                                uint64_t value, unsigned size)
201 {
202     musicpal_lcd_state *s = opaque;
203 
204     switch (offset) {
205     case MP_LCD_IRQCTRL:
206         s->irqctrl = value;
207         break;
208 
209     case MP_LCD_SPICTRL:
210         if (value == MP_LCD_SPI_DATA || value == MP_LCD_SPI_CMD) {
211             s->mode = value;
212         } else {
213             s->mode = MP_LCD_SPI_INVALID;
214         }
215         break;
216 
217     case MP_LCD_INST:
218         if (value >= MP_LCD_INST_SETPAGE0 && value <= MP_LCD_INST_SETPAGE7) {
219             s->page = value - MP_LCD_INST_SETPAGE0;
220             s->page_off = 0;
221         }
222         break;
223 
224     case MP_LCD_DATA:
225         if (s->mode == MP_LCD_SPI_CMD) {
226             if (value >= MP_LCD_INST_SETPAGE0 &&
227                 value <= MP_LCD_INST_SETPAGE7) {
228                 s->page = value - MP_LCD_INST_SETPAGE0;
229                 s->page_off = 0;
230             }
231         } else if (s->mode == MP_LCD_SPI_DATA) {
232             s->video_ram[s->page*128 + s->page_off] = value;
233             s->page_off = (s->page_off + 1) & 127;
234         }
235         break;
236     }
237 }
238 
239 static const MemoryRegionOps musicpal_lcd_ops = {
240     .read = musicpal_lcd_read,
241     .write = musicpal_lcd_write,
242     .endianness = DEVICE_NATIVE_ENDIAN,
243 };
244 
245 static const GraphicHwOps musicpal_gfx_ops = {
246     .invalidate  = lcd_invalidate,
247     .gfx_update  = lcd_refresh,
248 };
249 
250 static void musicpal_lcd_realize(DeviceState *dev, Error **errp)
251 {
252     musicpal_lcd_state *s = MUSICPAL_LCD(dev);
253     s->con = graphic_console_init(dev, 0, &musicpal_gfx_ops, s);
254     qemu_console_resize(s->con, 128 * 3, 64 * 3);
255 }
256 
257 static void musicpal_lcd_init(Object *obj)
258 {
259     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
260     DeviceState *dev = DEVICE(sbd);
261     musicpal_lcd_state *s = MUSICPAL_LCD(dev);
262 
263     s->brightness = 7;
264 
265     memory_region_init_io(&s->iomem, obj, &musicpal_lcd_ops, s,
266                           "musicpal-lcd", MP_LCD_SIZE);
267     sysbus_init_mmio(sbd, &s->iomem);
268 
269     qdev_init_gpio_in(dev, musicpal_lcd_gpio_brightness_in, 3);
270 }
271 
272 static const VMStateDescription musicpal_lcd_vmsd = {
273     .name = "musicpal_lcd",
274     .version_id = 1,
275     .minimum_version_id = 1,
276     .fields = (VMStateField[]) {
277         VMSTATE_UINT32(brightness, musicpal_lcd_state),
278         VMSTATE_UINT32(mode, musicpal_lcd_state),
279         VMSTATE_UINT32(irqctrl, musicpal_lcd_state),
280         VMSTATE_UINT32(page, musicpal_lcd_state),
281         VMSTATE_UINT32(page_off, musicpal_lcd_state),
282         VMSTATE_BUFFER(video_ram, musicpal_lcd_state),
283         VMSTATE_END_OF_LIST()
284     }
285 };
286 
287 static void musicpal_lcd_class_init(ObjectClass *klass, void *data)
288 {
289     DeviceClass *dc = DEVICE_CLASS(klass);
290 
291     dc->vmsd = &musicpal_lcd_vmsd;
292     dc->realize = musicpal_lcd_realize;
293 }
294 
295 static const TypeInfo musicpal_lcd_info = {
296     .name          = TYPE_MUSICPAL_LCD,
297     .parent        = TYPE_SYS_BUS_DEVICE,
298     .instance_size = sizeof(musicpal_lcd_state),
299     .instance_init = musicpal_lcd_init,
300     .class_init    = musicpal_lcd_class_init,
301 };
302 
303 /* PIC register offsets */
304 #define MP_PIC_STATUS           0x00
305 #define MP_PIC_ENABLE_SET       0x08
306 #define MP_PIC_ENABLE_CLR       0x0C
307 
308 #define TYPE_MV88W8618_PIC "mv88w8618_pic"
309 OBJECT_DECLARE_SIMPLE_TYPE(mv88w8618_pic_state, MV88W8618_PIC)
310 
311 struct mv88w8618_pic_state {
312     /*< private >*/
313     SysBusDevice parent_obj;
314     /*< public >*/
315 
316     MemoryRegion iomem;
317     uint32_t level;
318     uint32_t enabled;
319     qemu_irq parent_irq;
320 };
321 
322 static void mv88w8618_pic_update(mv88w8618_pic_state *s)
323 {
324     qemu_set_irq(s->parent_irq, (s->level & s->enabled));
325 }
326 
327 static void mv88w8618_pic_set_irq(void *opaque, int irq, int level)
328 {
329     mv88w8618_pic_state *s = opaque;
330 
331     if (level) {
332         s->level |= 1 << irq;
333     } else {
334         s->level &= ~(1 << irq);
335     }
336     mv88w8618_pic_update(s);
337 }
338 
339 static uint64_t mv88w8618_pic_read(void *opaque, hwaddr offset,
340                                    unsigned size)
341 {
342     mv88w8618_pic_state *s = opaque;
343 
344     switch (offset) {
345     case MP_PIC_STATUS:
346         return s->level & s->enabled;
347 
348     default:
349         return 0;
350     }
351 }
352 
353 static void mv88w8618_pic_write(void *opaque, hwaddr offset,
354                                 uint64_t value, unsigned size)
355 {
356     mv88w8618_pic_state *s = opaque;
357 
358     switch (offset) {
359     case MP_PIC_ENABLE_SET:
360         s->enabled |= value;
361         break;
362 
363     case MP_PIC_ENABLE_CLR:
364         s->enabled &= ~value;
365         s->level &= ~value;
366         break;
367     }
368     mv88w8618_pic_update(s);
369 }
370 
371 static void mv88w8618_pic_reset(DeviceState *d)
372 {
373     mv88w8618_pic_state *s = MV88W8618_PIC(d);
374 
375     s->level = 0;
376     s->enabled = 0;
377 }
378 
379 static const MemoryRegionOps mv88w8618_pic_ops = {
380     .read = mv88w8618_pic_read,
381     .write = mv88w8618_pic_write,
382     .endianness = DEVICE_NATIVE_ENDIAN,
383 };
384 
385 static void mv88w8618_pic_init(Object *obj)
386 {
387     SysBusDevice *dev = SYS_BUS_DEVICE(obj);
388     mv88w8618_pic_state *s = MV88W8618_PIC(dev);
389 
390     qdev_init_gpio_in(DEVICE(dev), mv88w8618_pic_set_irq, 32);
391     sysbus_init_irq(dev, &s->parent_irq);
392     memory_region_init_io(&s->iomem, obj, &mv88w8618_pic_ops, s,
393                           "musicpal-pic", MP_PIC_SIZE);
394     sysbus_init_mmio(dev, &s->iomem);
395 }
396 
397 static const VMStateDescription mv88w8618_pic_vmsd = {
398     .name = "mv88w8618_pic",
399     .version_id = 1,
400     .minimum_version_id = 1,
401     .fields = (VMStateField[]) {
402         VMSTATE_UINT32(level, mv88w8618_pic_state),
403         VMSTATE_UINT32(enabled, mv88w8618_pic_state),
404         VMSTATE_END_OF_LIST()
405     }
406 };
407 
408 static void mv88w8618_pic_class_init(ObjectClass *klass, void *data)
409 {
410     DeviceClass *dc = DEVICE_CLASS(klass);
411 
412     dc->reset = mv88w8618_pic_reset;
413     dc->vmsd = &mv88w8618_pic_vmsd;
414 }
415 
416 static const TypeInfo mv88w8618_pic_info = {
417     .name          = TYPE_MV88W8618_PIC,
418     .parent        = TYPE_SYS_BUS_DEVICE,
419     .instance_size = sizeof(mv88w8618_pic_state),
420     .instance_init = mv88w8618_pic_init,
421     .class_init    = mv88w8618_pic_class_init,
422 };
423 
424 /* PIT register offsets */
425 #define MP_PIT_TIMER1_LENGTH    0x00
426 /* ... */
427 #define MP_PIT_TIMER4_LENGTH    0x0C
428 #define MP_PIT_CONTROL          0x10
429 #define MP_PIT_TIMER1_VALUE     0x14
430 /* ... */
431 #define MP_PIT_TIMER4_VALUE     0x20
432 #define MP_BOARD_RESET          0x34
433 
434 /* Magic board reset value (probably some watchdog behind it) */
435 #define MP_BOARD_RESET_MAGIC    0x10000
436 
437 typedef struct mv88w8618_timer_state {
438     ptimer_state *ptimer;
439     uint32_t limit;
440     int freq;
441     qemu_irq irq;
442 } mv88w8618_timer_state;
443 
444 #define TYPE_MV88W8618_PIT "mv88w8618_pit"
445 OBJECT_DECLARE_SIMPLE_TYPE(mv88w8618_pit_state, MV88W8618_PIT)
446 
447 struct mv88w8618_pit_state {
448     /*< private >*/
449     SysBusDevice parent_obj;
450     /*< public >*/
451 
452     MemoryRegion iomem;
453     mv88w8618_timer_state timer[4];
454 };
455 
456 static void mv88w8618_timer_tick(void *opaque)
457 {
458     mv88w8618_timer_state *s = opaque;
459 
460     qemu_irq_raise(s->irq);
461 }
462 
463 static void mv88w8618_timer_init(SysBusDevice *dev, mv88w8618_timer_state *s,
464                                  uint32_t freq)
465 {
466     sysbus_init_irq(dev, &s->irq);
467     s->freq = freq;
468 
469     s->ptimer = ptimer_init(mv88w8618_timer_tick, s, PTIMER_POLICY_LEGACY);
470 }
471 
472 static uint64_t mv88w8618_pit_read(void *opaque, hwaddr offset,
473                                    unsigned size)
474 {
475     mv88w8618_pit_state *s = opaque;
476     mv88w8618_timer_state *t;
477 
478     switch (offset) {
479     case MP_PIT_TIMER1_VALUE ... MP_PIT_TIMER4_VALUE:
480         t = &s->timer[(offset-MP_PIT_TIMER1_VALUE) >> 2];
481         return ptimer_get_count(t->ptimer);
482 
483     default:
484         return 0;
485     }
486 }
487 
488 static void mv88w8618_pit_write(void *opaque, hwaddr offset,
489                                 uint64_t value, unsigned size)
490 {
491     mv88w8618_pit_state *s = opaque;
492     mv88w8618_timer_state *t;
493     int i;
494 
495     switch (offset) {
496     case MP_PIT_TIMER1_LENGTH ... MP_PIT_TIMER4_LENGTH:
497         t = &s->timer[offset >> 2];
498         t->limit = value;
499         ptimer_transaction_begin(t->ptimer);
500         if (t->limit > 0) {
501             ptimer_set_limit(t->ptimer, t->limit, 1);
502         } else {
503             ptimer_stop(t->ptimer);
504         }
505         ptimer_transaction_commit(t->ptimer);
506         break;
507 
508     case MP_PIT_CONTROL:
509         for (i = 0; i < 4; i++) {
510             t = &s->timer[i];
511             ptimer_transaction_begin(t->ptimer);
512             if (value & 0xf && t->limit > 0) {
513                 ptimer_set_limit(t->ptimer, t->limit, 0);
514                 ptimer_set_freq(t->ptimer, t->freq);
515                 ptimer_run(t->ptimer, 0);
516             } else {
517                 ptimer_stop(t->ptimer);
518             }
519             ptimer_transaction_commit(t->ptimer);
520             value >>= 4;
521         }
522         break;
523 
524     case MP_BOARD_RESET:
525         if (value == MP_BOARD_RESET_MAGIC) {
526             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
527         }
528         break;
529     }
530 }
531 
532 static void mv88w8618_pit_reset(DeviceState *d)
533 {
534     mv88w8618_pit_state *s = MV88W8618_PIT(d);
535     int i;
536 
537     for (i = 0; i < 4; i++) {
538         mv88w8618_timer_state *t = &s->timer[i];
539         ptimer_transaction_begin(t->ptimer);
540         ptimer_stop(t->ptimer);
541         ptimer_transaction_commit(t->ptimer);
542         t->limit = 0;
543     }
544 }
545 
546 static const MemoryRegionOps mv88w8618_pit_ops = {
547     .read = mv88w8618_pit_read,
548     .write = mv88w8618_pit_write,
549     .endianness = DEVICE_NATIVE_ENDIAN,
550 };
551 
552 static void mv88w8618_pit_init(Object *obj)
553 {
554     SysBusDevice *dev = SYS_BUS_DEVICE(obj);
555     mv88w8618_pit_state *s = MV88W8618_PIT(dev);
556     int i;
557 
558     /* Letting them all run at 1 MHz is likely just a pragmatic
559      * simplification. */
560     for (i = 0; i < 4; i++) {
561         mv88w8618_timer_init(dev, &s->timer[i], 1000000);
562     }
563 
564     memory_region_init_io(&s->iomem, obj, &mv88w8618_pit_ops, s,
565                           "musicpal-pit", MP_PIT_SIZE);
566     sysbus_init_mmio(dev, &s->iomem);
567 }
568 
569 static void mv88w8618_pit_finalize(Object *obj)
570 {
571     SysBusDevice *dev = SYS_BUS_DEVICE(obj);
572     mv88w8618_pit_state *s = MV88W8618_PIT(dev);
573     int i;
574 
575     for (i = 0; i < 4; i++) {
576         ptimer_free(s->timer[i].ptimer);
577     }
578 }
579 
580 static const VMStateDescription mv88w8618_timer_vmsd = {
581     .name = "timer",
582     .version_id = 1,
583     .minimum_version_id = 1,
584     .fields = (VMStateField[]) {
585         VMSTATE_PTIMER(ptimer, mv88w8618_timer_state),
586         VMSTATE_UINT32(limit, mv88w8618_timer_state),
587         VMSTATE_END_OF_LIST()
588     }
589 };
590 
591 static const VMStateDescription mv88w8618_pit_vmsd = {
592     .name = "mv88w8618_pit",
593     .version_id = 1,
594     .minimum_version_id = 1,
595     .fields = (VMStateField[]) {
596         VMSTATE_STRUCT_ARRAY(timer, mv88w8618_pit_state, 4, 1,
597                              mv88w8618_timer_vmsd, mv88w8618_timer_state),
598         VMSTATE_END_OF_LIST()
599     }
600 };
601 
602 static void mv88w8618_pit_class_init(ObjectClass *klass, void *data)
603 {
604     DeviceClass *dc = DEVICE_CLASS(klass);
605 
606     dc->reset = mv88w8618_pit_reset;
607     dc->vmsd = &mv88w8618_pit_vmsd;
608 }
609 
610 static const TypeInfo mv88w8618_pit_info = {
611     .name          = TYPE_MV88W8618_PIT,
612     .parent        = TYPE_SYS_BUS_DEVICE,
613     .instance_size = sizeof(mv88w8618_pit_state),
614     .instance_init = mv88w8618_pit_init,
615     .instance_finalize = mv88w8618_pit_finalize,
616     .class_init    = mv88w8618_pit_class_init,
617 };
618 
619 /* Flash config register offsets */
620 #define MP_FLASHCFG_CFGR0    0x04
621 
622 #define TYPE_MV88W8618_FLASHCFG "mv88w8618_flashcfg"
623 OBJECT_DECLARE_SIMPLE_TYPE(mv88w8618_flashcfg_state, MV88W8618_FLASHCFG)
624 
625 struct mv88w8618_flashcfg_state {
626     /*< private >*/
627     SysBusDevice parent_obj;
628     /*< public >*/
629 
630     MemoryRegion iomem;
631     uint32_t cfgr0;
632 };
633 
634 static uint64_t mv88w8618_flashcfg_read(void *opaque,
635                                         hwaddr offset,
636                                         unsigned size)
637 {
638     mv88w8618_flashcfg_state *s = opaque;
639 
640     switch (offset) {
641     case MP_FLASHCFG_CFGR0:
642         return s->cfgr0;
643 
644     default:
645         return 0;
646     }
647 }
648 
649 static void mv88w8618_flashcfg_write(void *opaque, hwaddr offset,
650                                      uint64_t value, unsigned size)
651 {
652     mv88w8618_flashcfg_state *s = opaque;
653 
654     switch (offset) {
655     case MP_FLASHCFG_CFGR0:
656         s->cfgr0 = value;
657         break;
658     }
659 }
660 
661 static const MemoryRegionOps mv88w8618_flashcfg_ops = {
662     .read = mv88w8618_flashcfg_read,
663     .write = mv88w8618_flashcfg_write,
664     .endianness = DEVICE_NATIVE_ENDIAN,
665 };
666 
667 static void mv88w8618_flashcfg_init(Object *obj)
668 {
669     SysBusDevice *dev = SYS_BUS_DEVICE(obj);
670     mv88w8618_flashcfg_state *s = MV88W8618_FLASHCFG(dev);
671 
672     s->cfgr0 = 0xfffe4285; /* Default as set by U-Boot for 8 MB flash */
673     memory_region_init_io(&s->iomem, obj, &mv88w8618_flashcfg_ops, s,
674                           "musicpal-flashcfg", MP_FLASHCFG_SIZE);
675     sysbus_init_mmio(dev, &s->iomem);
676 }
677 
678 static const VMStateDescription mv88w8618_flashcfg_vmsd = {
679     .name = "mv88w8618_flashcfg",
680     .version_id = 1,
681     .minimum_version_id = 1,
682     .fields = (VMStateField[]) {
683         VMSTATE_UINT32(cfgr0, mv88w8618_flashcfg_state),
684         VMSTATE_END_OF_LIST()
685     }
686 };
687 
688 static void mv88w8618_flashcfg_class_init(ObjectClass *klass, void *data)
689 {
690     DeviceClass *dc = DEVICE_CLASS(klass);
691 
692     dc->vmsd = &mv88w8618_flashcfg_vmsd;
693 }
694 
695 static const TypeInfo mv88w8618_flashcfg_info = {
696     .name          = TYPE_MV88W8618_FLASHCFG,
697     .parent        = TYPE_SYS_BUS_DEVICE,
698     .instance_size = sizeof(mv88w8618_flashcfg_state),
699     .instance_init = mv88w8618_flashcfg_init,
700     .class_init    = mv88w8618_flashcfg_class_init,
701 };
702 
703 /* Misc register offsets */
704 #define MP_MISC_BOARD_REVISION  0x18
705 
706 #define MP_BOARD_REVISION       0x31
707 
708 struct MusicPalMiscState {
709     SysBusDevice parent_obj;
710     MemoryRegion iomem;
711 };
712 
713 #define TYPE_MUSICPAL_MISC "musicpal-misc"
714 OBJECT_DECLARE_SIMPLE_TYPE(MusicPalMiscState, MUSICPAL_MISC)
715 
716 static uint64_t musicpal_misc_read(void *opaque, hwaddr offset,
717                                    unsigned size)
718 {
719     switch (offset) {
720     case MP_MISC_BOARD_REVISION:
721         return MP_BOARD_REVISION;
722 
723     default:
724         return 0;
725     }
726 }
727 
728 static void musicpal_misc_write(void *opaque, hwaddr offset,
729                                 uint64_t value, unsigned size)
730 {
731 }
732 
733 static const MemoryRegionOps musicpal_misc_ops = {
734     .read = musicpal_misc_read,
735     .write = musicpal_misc_write,
736     .endianness = DEVICE_NATIVE_ENDIAN,
737 };
738 
739 static void musicpal_misc_init(Object *obj)
740 {
741     SysBusDevice *sd = SYS_BUS_DEVICE(obj);
742     MusicPalMiscState *s = MUSICPAL_MISC(obj);
743 
744     memory_region_init_io(&s->iomem, OBJECT(s), &musicpal_misc_ops, NULL,
745                           "musicpal-misc", MP_MISC_SIZE);
746     sysbus_init_mmio(sd, &s->iomem);
747 }
748 
749 static const TypeInfo musicpal_misc_info = {
750     .name = TYPE_MUSICPAL_MISC,
751     .parent = TYPE_SYS_BUS_DEVICE,
752     .instance_init = musicpal_misc_init,
753     .instance_size = sizeof(MusicPalMiscState),
754 };
755 
756 /* WLAN register offsets */
757 #define MP_WLAN_MAGIC1          0x11c
758 #define MP_WLAN_MAGIC2          0x124
759 
760 static uint64_t mv88w8618_wlan_read(void *opaque, hwaddr offset,
761                                     unsigned size)
762 {
763     switch (offset) {
764     /* Workaround to allow loading the binary-only wlandrv.ko crap
765      * from the original Freecom firmware. */
766     case MP_WLAN_MAGIC1:
767         return ~3;
768     case MP_WLAN_MAGIC2:
769         return -1;
770 
771     default:
772         return 0;
773     }
774 }
775 
776 static void mv88w8618_wlan_write(void *opaque, hwaddr offset,
777                                  uint64_t value, unsigned size)
778 {
779 }
780 
781 static const MemoryRegionOps mv88w8618_wlan_ops = {
782     .read = mv88w8618_wlan_read,
783     .write =mv88w8618_wlan_write,
784     .endianness = DEVICE_NATIVE_ENDIAN,
785 };
786 
787 static void mv88w8618_wlan_realize(DeviceState *dev, Error **errp)
788 {
789     MemoryRegion *iomem = g_new(MemoryRegion, 1);
790 
791     memory_region_init_io(iomem, OBJECT(dev), &mv88w8618_wlan_ops, NULL,
792                           "musicpal-wlan", MP_WLAN_SIZE);
793     sysbus_init_mmio(SYS_BUS_DEVICE(dev), iomem);
794 }
795 
796 /* GPIO register offsets */
797 #define MP_GPIO_OE_LO           0x008
798 #define MP_GPIO_OUT_LO          0x00c
799 #define MP_GPIO_IN_LO           0x010
800 #define MP_GPIO_IER_LO          0x014
801 #define MP_GPIO_IMR_LO          0x018
802 #define MP_GPIO_ISR_LO          0x020
803 #define MP_GPIO_OE_HI           0x508
804 #define MP_GPIO_OUT_HI          0x50c
805 #define MP_GPIO_IN_HI           0x510
806 #define MP_GPIO_IER_HI          0x514
807 #define MP_GPIO_IMR_HI          0x518
808 #define MP_GPIO_ISR_HI          0x520
809 
810 /* GPIO bits & masks */
811 #define MP_GPIO_LCD_BRIGHTNESS  0x00070000
812 #define MP_GPIO_I2C_DATA_BIT    29
813 #define MP_GPIO_I2C_CLOCK_BIT   30
814 
815 /* LCD brightness bits in GPIO_OE_HI */
816 #define MP_OE_LCD_BRIGHTNESS    0x0007
817 
818 #define TYPE_MUSICPAL_GPIO "musicpal_gpio"
819 OBJECT_DECLARE_SIMPLE_TYPE(musicpal_gpio_state, MUSICPAL_GPIO)
820 
821 struct musicpal_gpio_state {
822     /*< private >*/
823     SysBusDevice parent_obj;
824     /*< public >*/
825 
826     MemoryRegion iomem;
827     uint32_t lcd_brightness;
828     uint32_t out_state;
829     uint32_t in_state;
830     uint32_t ier;
831     uint32_t imr;
832     uint32_t isr;
833     qemu_irq irq;
834     qemu_irq out[5]; /* 3 brightness out + 2 lcd (data and clock ) */
835 };
836 
837 static void musicpal_gpio_brightness_update(musicpal_gpio_state *s) {
838     int i;
839     uint32_t brightness;
840 
841     /* compute brightness ratio */
842     switch (s->lcd_brightness) {
843     case 0x00000007:
844         brightness = 0;
845         break;
846 
847     case 0x00020000:
848         brightness = 1;
849         break;
850 
851     case 0x00020001:
852         brightness = 2;
853         break;
854 
855     case 0x00040000:
856         brightness = 3;
857         break;
858 
859     case 0x00010006:
860         brightness = 4;
861         break;
862 
863     case 0x00020005:
864         brightness = 5;
865         break;
866 
867     case 0x00040003:
868         brightness = 6;
869         break;
870 
871     case 0x00030004:
872     default:
873         brightness = 7;
874     }
875 
876     /* set lcd brightness GPIOs  */
877     for (i = 0; i <= 2; i++) {
878         qemu_set_irq(s->out[i], (brightness >> i) & 1);
879     }
880 }
881 
882 static void musicpal_gpio_pin_event(void *opaque, int pin, int level)
883 {
884     musicpal_gpio_state *s = opaque;
885     uint32_t mask = 1 << pin;
886     uint32_t delta = level << pin;
887     uint32_t old = s->in_state & mask;
888 
889     s->in_state &= ~mask;
890     s->in_state |= delta;
891 
892     if ((old ^ delta) &&
893         ((level && (s->imr & mask)) || (!level && (s->ier & mask)))) {
894         s->isr = mask;
895         qemu_irq_raise(s->irq);
896     }
897 }
898 
899 static uint64_t musicpal_gpio_read(void *opaque, hwaddr offset,
900                                    unsigned size)
901 {
902     musicpal_gpio_state *s = opaque;
903 
904     switch (offset) {
905     case MP_GPIO_OE_HI: /* used for LCD brightness control */
906         return s->lcd_brightness & MP_OE_LCD_BRIGHTNESS;
907 
908     case MP_GPIO_OUT_LO:
909         return s->out_state & 0xFFFF;
910     case MP_GPIO_OUT_HI:
911         return s->out_state >> 16;
912 
913     case MP_GPIO_IN_LO:
914         return s->in_state & 0xFFFF;
915     case MP_GPIO_IN_HI:
916         return s->in_state >> 16;
917 
918     case MP_GPIO_IER_LO:
919         return s->ier & 0xFFFF;
920     case MP_GPIO_IER_HI:
921         return s->ier >> 16;
922 
923     case MP_GPIO_IMR_LO:
924         return s->imr & 0xFFFF;
925     case MP_GPIO_IMR_HI:
926         return s->imr >> 16;
927 
928     case MP_GPIO_ISR_LO:
929         return s->isr & 0xFFFF;
930     case MP_GPIO_ISR_HI:
931         return s->isr >> 16;
932 
933     default:
934         return 0;
935     }
936 }
937 
938 static void musicpal_gpio_write(void *opaque, hwaddr offset,
939                                 uint64_t value, unsigned size)
940 {
941     musicpal_gpio_state *s = opaque;
942     switch (offset) {
943     case MP_GPIO_OE_HI: /* used for LCD brightness control */
944         s->lcd_brightness = (s->lcd_brightness & MP_GPIO_LCD_BRIGHTNESS) |
945                          (value & MP_OE_LCD_BRIGHTNESS);
946         musicpal_gpio_brightness_update(s);
947         break;
948 
949     case MP_GPIO_OUT_LO:
950         s->out_state = (s->out_state & 0xFFFF0000) | (value & 0xFFFF);
951         break;
952     case MP_GPIO_OUT_HI:
953         s->out_state = (s->out_state & 0xFFFF) | (value << 16);
954         s->lcd_brightness = (s->lcd_brightness & 0xFFFF) |
955                             (s->out_state & MP_GPIO_LCD_BRIGHTNESS);
956         musicpal_gpio_brightness_update(s);
957         qemu_set_irq(s->out[3], (s->out_state >> MP_GPIO_I2C_DATA_BIT) & 1);
958         qemu_set_irq(s->out[4], (s->out_state >> MP_GPIO_I2C_CLOCK_BIT) & 1);
959         break;
960 
961     case MP_GPIO_IER_LO:
962         s->ier = (s->ier & 0xFFFF0000) | (value & 0xFFFF);
963         break;
964     case MP_GPIO_IER_HI:
965         s->ier = (s->ier & 0xFFFF) | (value << 16);
966         break;
967 
968     case MP_GPIO_IMR_LO:
969         s->imr = (s->imr & 0xFFFF0000) | (value & 0xFFFF);
970         break;
971     case MP_GPIO_IMR_HI:
972         s->imr = (s->imr & 0xFFFF) | (value << 16);
973         break;
974     }
975 }
976 
977 static const MemoryRegionOps musicpal_gpio_ops = {
978     .read = musicpal_gpio_read,
979     .write = musicpal_gpio_write,
980     .endianness = DEVICE_NATIVE_ENDIAN,
981 };
982 
983 static void musicpal_gpio_reset(DeviceState *d)
984 {
985     musicpal_gpio_state *s = MUSICPAL_GPIO(d);
986 
987     s->lcd_brightness = 0;
988     s->out_state = 0;
989     s->in_state = 0xffffffff;
990     s->ier = 0;
991     s->imr = 0;
992     s->isr = 0;
993 }
994 
995 static void musicpal_gpio_init(Object *obj)
996 {
997     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
998     DeviceState *dev = DEVICE(sbd);
999     musicpal_gpio_state *s = MUSICPAL_GPIO(dev);
1000 
1001     sysbus_init_irq(sbd, &s->irq);
1002 
1003     memory_region_init_io(&s->iomem, obj, &musicpal_gpio_ops, s,
1004                           "musicpal-gpio", MP_GPIO_SIZE);
1005     sysbus_init_mmio(sbd, &s->iomem);
1006 
1007     qdev_init_gpio_out(dev, s->out, ARRAY_SIZE(s->out));
1008 
1009     qdev_init_gpio_in(dev, musicpal_gpio_pin_event, 32);
1010 }
1011 
1012 static const VMStateDescription musicpal_gpio_vmsd = {
1013     .name = "musicpal_gpio",
1014     .version_id = 1,
1015     .minimum_version_id = 1,
1016     .fields = (VMStateField[]) {
1017         VMSTATE_UINT32(lcd_brightness, musicpal_gpio_state),
1018         VMSTATE_UINT32(out_state, musicpal_gpio_state),
1019         VMSTATE_UINT32(in_state, musicpal_gpio_state),
1020         VMSTATE_UINT32(ier, musicpal_gpio_state),
1021         VMSTATE_UINT32(imr, musicpal_gpio_state),
1022         VMSTATE_UINT32(isr, musicpal_gpio_state),
1023         VMSTATE_END_OF_LIST()
1024     }
1025 };
1026 
1027 static void musicpal_gpio_class_init(ObjectClass *klass, void *data)
1028 {
1029     DeviceClass *dc = DEVICE_CLASS(klass);
1030 
1031     dc->reset = musicpal_gpio_reset;
1032     dc->vmsd = &musicpal_gpio_vmsd;
1033 }
1034 
1035 static const TypeInfo musicpal_gpio_info = {
1036     .name          = TYPE_MUSICPAL_GPIO,
1037     .parent        = TYPE_SYS_BUS_DEVICE,
1038     .instance_size = sizeof(musicpal_gpio_state),
1039     .instance_init = musicpal_gpio_init,
1040     .class_init    = musicpal_gpio_class_init,
1041 };
1042 
1043 /* Keyboard codes & masks */
1044 #define KEY_RELEASED            0x80
1045 #define KEY_CODE                0x7f
1046 
1047 #define KEYCODE_TAB             0x0f
1048 #define KEYCODE_ENTER           0x1c
1049 #define KEYCODE_F               0x21
1050 #define KEYCODE_M               0x32
1051 
1052 #define KEYCODE_EXTENDED        0xe0
1053 #define KEYCODE_UP              0x48
1054 #define KEYCODE_DOWN            0x50
1055 #define KEYCODE_LEFT            0x4b
1056 #define KEYCODE_RIGHT           0x4d
1057 
1058 #define MP_KEY_WHEEL_VOL       (1 << 0)
1059 #define MP_KEY_WHEEL_VOL_INV   (1 << 1)
1060 #define MP_KEY_WHEEL_NAV       (1 << 2)
1061 #define MP_KEY_WHEEL_NAV_INV   (1 << 3)
1062 #define MP_KEY_BTN_FAVORITS    (1 << 4)
1063 #define MP_KEY_BTN_MENU        (1 << 5)
1064 #define MP_KEY_BTN_VOLUME      (1 << 6)
1065 #define MP_KEY_BTN_NAVIGATION  (1 << 7)
1066 
1067 #define TYPE_MUSICPAL_KEY "musicpal_key"
1068 OBJECT_DECLARE_SIMPLE_TYPE(musicpal_key_state, MUSICPAL_KEY)
1069 
1070 struct musicpal_key_state {
1071     /*< private >*/
1072     SysBusDevice parent_obj;
1073     /*< public >*/
1074 
1075     MemoryRegion iomem;
1076     uint32_t kbd_extended;
1077     uint32_t pressed_keys;
1078     qemu_irq out[8];
1079 };
1080 
1081 static void musicpal_key_event(void *opaque, int keycode)
1082 {
1083     musicpal_key_state *s = opaque;
1084     uint32_t event = 0;
1085     int i;
1086 
1087     if (keycode == KEYCODE_EXTENDED) {
1088         s->kbd_extended = 1;
1089         return;
1090     }
1091 
1092     if (s->kbd_extended) {
1093         switch (keycode & KEY_CODE) {
1094         case KEYCODE_UP:
1095             event = MP_KEY_WHEEL_NAV | MP_KEY_WHEEL_NAV_INV;
1096             break;
1097 
1098         case KEYCODE_DOWN:
1099             event = MP_KEY_WHEEL_NAV;
1100             break;
1101 
1102         case KEYCODE_LEFT:
1103             event = MP_KEY_WHEEL_VOL | MP_KEY_WHEEL_VOL_INV;
1104             break;
1105 
1106         case KEYCODE_RIGHT:
1107             event = MP_KEY_WHEEL_VOL;
1108             break;
1109         }
1110     } else {
1111         switch (keycode & KEY_CODE) {
1112         case KEYCODE_F:
1113             event = MP_KEY_BTN_FAVORITS;
1114             break;
1115 
1116         case KEYCODE_TAB:
1117             event = MP_KEY_BTN_VOLUME;
1118             break;
1119 
1120         case KEYCODE_ENTER:
1121             event = MP_KEY_BTN_NAVIGATION;
1122             break;
1123 
1124         case KEYCODE_M:
1125             event = MP_KEY_BTN_MENU;
1126             break;
1127         }
1128         /* Do not repeat already pressed buttons */
1129         if (!(keycode & KEY_RELEASED) && (s->pressed_keys & event)) {
1130             event = 0;
1131         }
1132     }
1133 
1134     if (event) {
1135         /* Raise GPIO pin first if repeating a key */
1136         if (!(keycode & KEY_RELEASED) && (s->pressed_keys & event)) {
1137             for (i = 0; i <= 7; i++) {
1138                 if (event & (1 << i)) {
1139                     qemu_set_irq(s->out[i], 1);
1140                 }
1141             }
1142         }
1143         for (i = 0; i <= 7; i++) {
1144             if (event & (1 << i)) {
1145                 qemu_set_irq(s->out[i], !!(keycode & KEY_RELEASED));
1146             }
1147         }
1148         if (keycode & KEY_RELEASED) {
1149             s->pressed_keys &= ~event;
1150         } else {
1151             s->pressed_keys |= event;
1152         }
1153     }
1154 
1155     s->kbd_extended = 0;
1156 }
1157 
1158 static void musicpal_key_init(Object *obj)
1159 {
1160     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
1161     DeviceState *dev = DEVICE(sbd);
1162     musicpal_key_state *s = MUSICPAL_KEY(dev);
1163 
1164     memory_region_init(&s->iomem, obj, "dummy", 0);
1165     sysbus_init_mmio(sbd, &s->iomem);
1166 
1167     s->kbd_extended = 0;
1168     s->pressed_keys = 0;
1169 
1170     qdev_init_gpio_out(dev, s->out, ARRAY_SIZE(s->out));
1171 
1172     qemu_add_kbd_event_handler(musicpal_key_event, s);
1173 }
1174 
1175 static const VMStateDescription musicpal_key_vmsd = {
1176     .name = "musicpal_key",
1177     .version_id = 1,
1178     .minimum_version_id = 1,
1179     .fields = (VMStateField[]) {
1180         VMSTATE_UINT32(kbd_extended, musicpal_key_state),
1181         VMSTATE_UINT32(pressed_keys, musicpal_key_state),
1182         VMSTATE_END_OF_LIST()
1183     }
1184 };
1185 
1186 static void musicpal_key_class_init(ObjectClass *klass, void *data)
1187 {
1188     DeviceClass *dc = DEVICE_CLASS(klass);
1189 
1190     dc->vmsd = &musicpal_key_vmsd;
1191 }
1192 
1193 static const TypeInfo musicpal_key_info = {
1194     .name          = TYPE_MUSICPAL_KEY,
1195     .parent        = TYPE_SYS_BUS_DEVICE,
1196     .instance_size = sizeof(musicpal_key_state),
1197     .instance_init = musicpal_key_init,
1198     .class_init    = musicpal_key_class_init,
1199 };
1200 
1201 #define FLASH_SECTOR_SIZE   (64 * KiB)
1202 
1203 static struct arm_boot_info musicpal_binfo = {
1204     .loader_start = 0x0,
1205     .board_id = 0x20e,
1206 };
1207 
1208 static void musicpal_init(MachineState *machine)
1209 {
1210     ARMCPU *cpu;
1211     DeviceState *dev;
1212     DeviceState *pic;
1213     DeviceState *uart_orgate;
1214     DeviceState *i2c_dev;
1215     DeviceState *lcd_dev;
1216     DeviceState *key_dev;
1217     I2CSlave *wm8750_dev;
1218     SysBusDevice *s;
1219     I2CBus *i2c;
1220     int i;
1221     unsigned long flash_size;
1222     DriveInfo *dinfo;
1223     MachineClass *mc = MACHINE_GET_CLASS(machine);
1224     MemoryRegion *address_space_mem = get_system_memory();
1225     MemoryRegion *sram = g_new(MemoryRegion, 1);
1226 
1227     /* For now we use a fixed - the original - RAM size */
1228     if (machine->ram_size != mc->default_ram_size) {
1229         char *sz = size_to_str(mc->default_ram_size);
1230         error_report("Invalid RAM size, should be %s", sz);
1231         g_free(sz);
1232         exit(EXIT_FAILURE);
1233     }
1234 
1235     cpu = ARM_CPU(cpu_create(machine->cpu_type));
1236 
1237     memory_region_add_subregion(address_space_mem, 0, machine->ram);
1238 
1239     memory_region_init_ram(sram, NULL, "musicpal.sram", MP_SRAM_SIZE,
1240                            &error_fatal);
1241     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
1242 
1243     pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
1244                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
1245     sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
1246                           qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
1247                           qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
1248                           qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
1249                           qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
1250 
1251     /* Logically OR both UART IRQs together */
1252     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
1253     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
1254     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
1255     qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
1256                           qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
1257 
1258     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
1259                    qdev_get_gpio_in(uart_orgate, 0),
1260                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
1261     serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
1262                    qdev_get_gpio_in(uart_orgate, 1),
1263                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
1264 
1265     /* Register flash */
1266     dinfo = drive_get(IF_PFLASH, 0, 0);
1267     if (dinfo) {
1268         BlockBackend *blk = blk_by_legacy_dinfo(dinfo);
1269 
1270         flash_size = blk_getlength(blk);
1271         if (flash_size != 8 * MiB && flash_size != 16 * MiB &&
1272             flash_size != 32 * MiB) {
1273             error_report("Invalid flash image size");
1274             exit(1);
1275         }
1276 
1277         /*
1278          * The original U-Boot accesses the flash at 0xFE000000 instead of
1279          * 0xFF800000 (if there is 8 MB flash). So remap flash access if the
1280          * image is smaller than 32 MB.
1281          */
1282         pflash_cfi02_register(0x100000000ULL - MP_FLASH_SIZE_MAX,
1283                               "musicpal.flash", flash_size,
1284                               blk, FLASH_SECTOR_SIZE,
1285                               MP_FLASH_SIZE_MAX / flash_size,
1286                               2, 0x00BF, 0x236D, 0x0000, 0x0000,
1287                               0x5555, 0x2AAA, 0);
1288     }
1289     sysbus_create_simple(TYPE_MV88W8618_FLASHCFG, MP_FLASHCFG_BASE, NULL);
1290 
1291     qemu_check_nic_model(&nd_table[0], "mv88w8618");
1292     dev = qdev_new(TYPE_MV88W8618_ETH);
1293     qdev_set_nic_properties(dev, &nd_table[0]);
1294     object_property_set_link(OBJECT(dev), "dma-memory",
1295                              OBJECT(get_system_memory()), &error_fatal);
1296     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
1297     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
1298     sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
1299                        qdev_get_gpio_in(pic, MP_ETH_IRQ));
1300 
1301     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
1302 
1303     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
1304 
1305     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
1306                                qdev_get_gpio_in(pic, MP_GPIO_IRQ));
1307     i2c_dev = sysbus_create_simple(TYPE_GPIO_I2C, -1, NULL);
1308     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
1309 
1310     lcd_dev = sysbus_create_simple(TYPE_MUSICPAL_LCD, MP_LCD_BASE, NULL);
1311     key_dev = sysbus_create_simple(TYPE_MUSICPAL_KEY, -1, NULL);
1312 
1313     /* I2C read data */
1314     qdev_connect_gpio_out(i2c_dev, 0,
1315                           qdev_get_gpio_in(dev, MP_GPIO_I2C_DATA_BIT));
1316     /* I2C data */
1317     qdev_connect_gpio_out(dev, 3, qdev_get_gpio_in(i2c_dev, 0));
1318     /* I2C clock */
1319     qdev_connect_gpio_out(dev, 4, qdev_get_gpio_in(i2c_dev, 1));
1320 
1321     for (i = 0; i < 3; i++) {
1322         qdev_connect_gpio_out(dev, i, qdev_get_gpio_in(lcd_dev, i));
1323     }
1324     for (i = 0; i < 4; i++) {
1325         qdev_connect_gpio_out(key_dev, i, qdev_get_gpio_in(dev, i + 8));
1326     }
1327     for (i = 4; i < 8; i++) {
1328         qdev_connect_gpio_out(key_dev, i, qdev_get_gpio_in(dev, i + 15));
1329     }
1330 
1331     wm8750_dev = i2c_slave_create_simple(i2c, TYPE_WM8750, MP_WM_ADDR);
1332     dev = qdev_new(TYPE_MV88W8618_AUDIO);
1333     s = SYS_BUS_DEVICE(dev);
1334     object_property_set_link(OBJECT(dev), "wm8750", OBJECT(wm8750_dev),
1335                              NULL);
1336     sysbus_realize_and_unref(s, &error_fatal);
1337     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
1338     sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
1339 
1340     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
1341     arm_load_kernel(cpu, machine, &musicpal_binfo);
1342 }
1343 
1344 static void musicpal_machine_init(MachineClass *mc)
1345 {
1346     mc->desc = "Marvell 88w8618 / MusicPal (ARM926EJ-S)";
1347     mc->init = musicpal_init;
1348     mc->ignore_memory_transaction_failures = true;
1349     mc->default_cpu_type = ARM_CPU_TYPE_NAME("arm926");
1350     mc->default_ram_size = MP_RAM_DEFAULT_SIZE;
1351     mc->default_ram_id = "musicpal.ram";
1352 }
1353 
1354 DEFINE_MACHINE("musicpal", musicpal_machine_init)
1355 
1356 static void mv88w8618_wlan_class_init(ObjectClass *klass, void *data)
1357 {
1358     DeviceClass *dc = DEVICE_CLASS(klass);
1359 
1360     dc->realize = mv88w8618_wlan_realize;
1361 }
1362 
1363 static const TypeInfo mv88w8618_wlan_info = {
1364     .name          = "mv88w8618_wlan",
1365     .parent        = TYPE_SYS_BUS_DEVICE,
1366     .instance_size = sizeof(SysBusDevice),
1367     .class_init    = mv88w8618_wlan_class_init,
1368 };
1369 
1370 static void musicpal_register_types(void)
1371 {
1372     type_register_static(&mv88w8618_pic_info);
1373     type_register_static(&mv88w8618_pit_info);
1374     type_register_static(&mv88w8618_flashcfg_info);
1375     type_register_static(&mv88w8618_wlan_info);
1376     type_register_static(&musicpal_lcd_info);
1377     type_register_static(&musicpal_gpio_info);
1378     type_register_static(&musicpal_key_info);
1379     type_register_static(&musicpal_misc_info);
1380 }
1381 
1382 type_init(musicpal_register_types)
1383