xref: /openbmc/qemu/hw/arm/nseries.c (revision ad1a706f)
1 /*
2  * Nokia N-series internet tablets.
3  *
4  * Copyright (C) 2007 Nokia Corporation
5  * Written by Andrzej Zaborowski <andrew@openedhand.com>
6  *
7  * This program is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU General Public License as
9  * published by the Free Software Foundation; either version 2 or
10  * (at your option) version 3 of the License.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License along
18  * with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "cpu.h"
24 #include "chardev/char.h"
25 #include "qemu/cutils.h"
26 #include "qemu/bswap.h"
27 #include "sysemu/reset.h"
28 #include "sysemu/runstate.h"
29 #include "sysemu/sysemu.h"
30 #include "hw/arm/omap.h"
31 #include "hw/arm/boot.h"
32 #include "hw/irq.h"
33 #include "ui/console.h"
34 #include "hw/boards.h"
35 #include "hw/i2c/i2c.h"
36 #include "hw/display/blizzard.h"
37 #include "hw/input/tsc2xxx.h"
38 #include "hw/misc/cbus.h"
39 #include "hw/misc/tmp105.h"
40 #include "hw/qdev-properties.h"
41 #include "hw/block/flash.h"
42 #include "hw/hw.h"
43 #include "hw/loader.h"
44 #include "hw/sysbus.h"
45 #include "qemu/log.h"
46 
47 /* Nokia N8x0 support */
48 struct n800_s {
49     struct omap_mpu_state_s *mpu;
50 
51     struct rfbi_chip_s blizzard;
52     struct {
53         void *opaque;
54         uint32_t (*txrx)(void *opaque, uint32_t value, int len);
55         uWireSlave *chip;
56     } ts;
57 
58     int keymap[0x80];
59     DeviceState *kbd;
60 
61     DeviceState *usb;
62     void *retu;
63     void *tahvo;
64     DeviceState *nand;
65 };
66 
67 /* GPIO pins */
68 #define N8X0_TUSB_ENABLE_GPIO		0
69 #define N800_MMC2_WP_GPIO		8
70 #define N800_UNKNOWN_GPIO0		9	/* out */
71 #define N810_MMC2_VIOSD_GPIO		9
72 #define N810_HEADSET_AMP_GPIO		10
73 #define N800_CAM_TURN_GPIO		12
74 #define N810_GPS_RESET_GPIO		12
75 #define N800_BLIZZARD_POWERDOWN_GPIO	15
76 #define N800_MMC1_WP_GPIO		23
77 #define N810_MMC2_VSD_GPIO		23
78 #define N8X0_ONENAND_GPIO		26
79 #define N810_BLIZZARD_RESET_GPIO	30
80 #define N800_UNKNOWN_GPIO2		53	/* out */
81 #define N8X0_TUSB_INT_GPIO		58
82 #define N8X0_BT_WKUP_GPIO		61
83 #define N8X0_STI_GPIO			62
84 #define N8X0_CBUS_SEL_GPIO		64
85 #define N8X0_CBUS_DAT_GPIO		65
86 #define N8X0_CBUS_CLK_GPIO		66
87 #define N8X0_WLAN_IRQ_GPIO		87
88 #define N8X0_BT_RESET_GPIO		92
89 #define N8X0_TEA5761_CS_GPIO		93
90 #define N800_UNKNOWN_GPIO		94
91 #define N810_TSC_RESET_GPIO		94
92 #define N800_CAM_ACT_GPIO		95
93 #define N810_GPS_WAKEUP_GPIO		95
94 #define N8X0_MMC_CS_GPIO		96
95 #define N8X0_WLAN_PWR_GPIO		97
96 #define N8X0_BT_HOST_WKUP_GPIO		98
97 #define N810_SPEAKER_AMP_GPIO		101
98 #define N810_KB_LOCK_GPIO		102
99 #define N800_TSC_TS_GPIO		103
100 #define N810_TSC_TS_GPIO		106
101 #define N8X0_HEADPHONE_GPIO		107
102 #define N8X0_RETU_GPIO			108
103 #define N800_TSC_KP_IRQ_GPIO		109
104 #define N810_KEYBOARD_GPIO		109
105 #define N800_BAT_COVER_GPIO		110
106 #define N810_SLIDE_GPIO			110
107 #define N8X0_TAHVO_GPIO			111
108 #define N800_UNKNOWN_GPIO4		112	/* out */
109 #define N810_SLEEPX_LED_GPIO		112
110 #define N800_TSC_RESET_GPIO		118	/* ? */
111 #define N810_AIC33_RESET_GPIO		118
112 #define N800_TSC_UNKNOWN_GPIO		119	/* out */
113 #define N8X0_TMP105_GPIO		125
114 
115 /* Config */
116 #define BT_UART				0
117 #define XLDR_LL_UART			1
118 
119 /* Addresses on the I2C bus 0 */
120 #define N810_TLV320AIC33_ADDR		0x18	/* Audio CODEC */
121 #define N8X0_TCM825x_ADDR		0x29	/* Camera */
122 #define N810_LP5521_ADDR		0x32	/* LEDs */
123 #define N810_TSL2563_ADDR		0x3d	/* Light sensor */
124 #define N810_LM8323_ADDR		0x45	/* Keyboard */
125 /* Addresses on the I2C bus 1 */
126 #define N8X0_TMP105_ADDR		0x48	/* Temperature sensor */
127 #define N8X0_MENELAUS_ADDR		0x72	/* Power management */
128 
129 /* Chipselects on GPMC NOR interface */
130 #define N8X0_ONENAND_CS			0
131 #define N8X0_USB_ASYNC_CS		1
132 #define N8X0_USB_SYNC_CS		4
133 
134 #define N8X0_BD_ADDR			0x00, 0x1a, 0x89, 0x9e, 0x3e, 0x81
135 
136 static void n800_mmc_cs_cb(void *opaque, int line, int level)
137 {
138     /* TODO: this seems to actually be connected to the menelaus, to
139      * which also both MMC slots connect.  */
140     omap_mmc_enable((struct omap_mmc_s *) opaque, !level);
141 }
142 
143 static void n8x0_gpio_setup(struct n800_s *s)
144 {
145     qdev_connect_gpio_out(s->mpu->gpio, N8X0_MMC_CS_GPIO,
146                           qemu_allocate_irq(n800_mmc_cs_cb, s->mpu->mmc, 0));
147     qemu_irq_lower(qdev_get_gpio_in(s->mpu->gpio, N800_BAT_COVER_GPIO));
148 }
149 
150 #define MAEMO_CAL_HEADER(...)				\
151     'C',  'o',  'n',  'F',  0x02, 0x00, 0x04, 0x00,	\
152     __VA_ARGS__,					\
153     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
154 
155 static const uint8_t n8x0_cal_wlan_mac[] = {
156     MAEMO_CAL_HEADER('w', 'l', 'a', 'n', '-', 'm', 'a', 'c')
157     0x1c, 0x00, 0x00, 0x00, 0x47, 0xd6, 0x69, 0xb3,
158     0x30, 0x08, 0xa0, 0x83, 0x00, 0x00, 0x00, 0x00,
159     0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x00, 0x00,
160     0x89, 0x00, 0x00, 0x00, 0x9e, 0x00, 0x00, 0x00,
161     0x5d, 0x00, 0x00, 0x00, 0xc1, 0x00, 0x00, 0x00,
162 };
163 
164 static const uint8_t n8x0_cal_bt_id[] = {
165     MAEMO_CAL_HEADER('b', 't', '-', 'i', 'd', 0, 0, 0)
166     0x0a, 0x00, 0x00, 0x00, 0xa3, 0x4b, 0xf6, 0x96,
167     0xa8, 0xeb, 0xb2, 0x41, 0x00, 0x00, 0x00, 0x00,
168     N8X0_BD_ADDR,
169 };
170 
171 static void n8x0_nand_setup(struct n800_s *s)
172 {
173     char *otp_region;
174     DriveInfo *dinfo;
175 
176     s->nand = qdev_new("onenand");
177     qdev_prop_set_uint16(s->nand, "manufacturer_id", NAND_MFR_SAMSUNG);
178     /* Either 0x40 or 0x48 are OK for the device ID */
179     qdev_prop_set_uint16(s->nand, "device_id", 0x48);
180     qdev_prop_set_uint16(s->nand, "version_id", 0);
181     qdev_prop_set_int32(s->nand, "shift", 1);
182     dinfo = drive_get(IF_MTD, 0, 0);
183     if (dinfo) {
184         qdev_prop_set_drive_err(s->nand, "drive", blk_by_legacy_dinfo(dinfo),
185                                 &error_fatal);
186     }
187     sysbus_realize_and_unref(SYS_BUS_DEVICE(s->nand), &error_fatal);
188     sysbus_connect_irq(SYS_BUS_DEVICE(s->nand), 0,
189                        qdev_get_gpio_in(s->mpu->gpio, N8X0_ONENAND_GPIO));
190     omap_gpmc_attach(s->mpu->gpmc, N8X0_ONENAND_CS,
191                      sysbus_mmio_get_region(SYS_BUS_DEVICE(s->nand), 0));
192     otp_region = onenand_raw_otp(s->nand);
193 
194     memcpy(otp_region + 0x000, n8x0_cal_wlan_mac, sizeof(n8x0_cal_wlan_mac));
195     memcpy(otp_region + 0x800, n8x0_cal_bt_id, sizeof(n8x0_cal_bt_id));
196     /* XXX: in theory should also update the OOB for both pages */
197 }
198 
199 static qemu_irq n8x0_system_powerdown;
200 
201 static void n8x0_powerdown_req(Notifier *n, void *opaque)
202 {
203     qemu_irq_raise(n8x0_system_powerdown);
204 }
205 
206 static Notifier n8x0_system_powerdown_notifier = {
207     .notify = n8x0_powerdown_req
208 };
209 
210 static void n8x0_i2c_setup(struct n800_s *s)
211 {
212     DeviceState *dev;
213     qemu_irq tmp_irq = qdev_get_gpio_in(s->mpu->gpio, N8X0_TMP105_GPIO);
214     I2CBus *i2c = omap_i2c_bus(s->mpu->i2c[0]);
215 
216     /* Attach a menelaus PM chip */
217     dev = DEVICE(i2c_slave_create_simple(i2c, "twl92230", N8X0_MENELAUS_ADDR));
218     qdev_connect_gpio_out(dev, 3,
219                           qdev_get_gpio_in(s->mpu->ih[0],
220                                            OMAP_INT_24XX_SYS_NIRQ));
221 
222     n8x0_system_powerdown = qdev_get_gpio_in(dev, 3);
223     qemu_register_powerdown_notifier(&n8x0_system_powerdown_notifier);
224 
225     /* Attach a TMP105 PM chip (A0 wired to ground) */
226     dev = DEVICE(i2c_slave_create_simple(i2c, TYPE_TMP105, N8X0_TMP105_ADDR));
227     qdev_connect_gpio_out(dev, 0, tmp_irq);
228 }
229 
230 /* Touchscreen and keypad controller */
231 static MouseTransformInfo n800_pointercal = {
232     .x = 800,
233     .y = 480,
234     .a = { 14560, -68, -3455208, -39, -9621, 35152972, 65536 },
235 };
236 
237 static MouseTransformInfo n810_pointercal = {
238     .x = 800,
239     .y = 480,
240     .a = { 15041, 148, -4731056, 171, -10238, 35933380, 65536 },
241 };
242 
243 #define RETU_KEYCODE	61	/* F3 */
244 
245 static void n800_key_event(void *opaque, int keycode)
246 {
247     struct n800_s *s = (struct n800_s *) opaque;
248     int code = s->keymap[keycode & 0x7f];
249 
250     if (code == -1) {
251         if ((keycode & 0x7f) == RETU_KEYCODE) {
252             retu_key_event(s->retu, !(keycode & 0x80));
253         }
254         return;
255     }
256 
257     tsc210x_key_event(s->ts.chip, code, !(keycode & 0x80));
258 }
259 
260 static const int n800_keys[16] = {
261     -1,
262     72,	/* Up */
263     63,	/* Home (F5) */
264     -1,
265     75,	/* Left */
266     28,	/* Enter */
267     77,	/* Right */
268     -1,
269      1,	/* Cycle (ESC) */
270     80,	/* Down */
271     62,	/* Menu (F4) */
272     -1,
273     66,	/* Zoom- (F8) */
274     64,	/* FullScreen (F6) */
275     65,	/* Zoom+ (F7) */
276     -1,
277 };
278 
279 static void n800_tsc_kbd_setup(struct n800_s *s)
280 {
281     int i;
282 
283     /* XXX: are the three pins inverted inside the chip between the
284      * tsc and the cpu (N4111)?  */
285     qemu_irq penirq = NULL;	/* NC */
286     qemu_irq kbirq = qdev_get_gpio_in(s->mpu->gpio, N800_TSC_KP_IRQ_GPIO);
287     qemu_irq dav = qdev_get_gpio_in(s->mpu->gpio, N800_TSC_TS_GPIO);
288 
289     s->ts.chip = tsc2301_init(penirq, kbirq, dav);
290     s->ts.opaque = s->ts.chip->opaque;
291     s->ts.txrx = tsc210x_txrx;
292 
293     for (i = 0; i < 0x80; i++) {
294         s->keymap[i] = -1;
295     }
296     for (i = 0; i < 0x10; i++) {
297         if (n800_keys[i] >= 0) {
298             s->keymap[n800_keys[i]] = i;
299         }
300     }
301 
302     qemu_add_kbd_event_handler(n800_key_event, s);
303 
304     tsc210x_set_transform(s->ts.chip, &n800_pointercal);
305 }
306 
307 static void n810_tsc_setup(struct n800_s *s)
308 {
309     qemu_irq pintdav = qdev_get_gpio_in(s->mpu->gpio, N810_TSC_TS_GPIO);
310 
311     s->ts.opaque = tsc2005_init(pintdav);
312     s->ts.txrx = tsc2005_txrx;
313 
314     tsc2005_set_transform(s->ts.opaque, &n810_pointercal);
315 }
316 
317 /* N810 Keyboard controller */
318 static void n810_key_event(void *opaque, int keycode)
319 {
320     struct n800_s *s = (struct n800_s *) opaque;
321     int code = s->keymap[keycode & 0x7f];
322 
323     if (code == -1) {
324         if ((keycode & 0x7f) == RETU_KEYCODE) {
325             retu_key_event(s->retu, !(keycode & 0x80));
326         }
327         return;
328     }
329 
330     lm832x_key_event(s->kbd, code, !(keycode & 0x80));
331 }
332 
333 #define M	0
334 
335 static int n810_keys[0x80] = {
336     [0x01] = 16,	/* Q */
337     [0x02] = 37,	/* K */
338     [0x03] = 24,	/* O */
339     [0x04] = 25,	/* P */
340     [0x05] = 14,	/* Backspace */
341     [0x06] = 30,	/* A */
342     [0x07] = 31,	/* S */
343     [0x08] = 32,	/* D */
344     [0x09] = 33,	/* F */
345     [0x0a] = 34,	/* G */
346     [0x0b] = 35,	/* H */
347     [0x0c] = 36,	/* J */
348 
349     [0x11] = 17,	/* W */
350     [0x12] = 62,	/* Menu (F4) */
351     [0x13] = 38,	/* L */
352     [0x14] = 40,	/* ' (Apostrophe) */
353     [0x16] = 44,	/* Z */
354     [0x17] = 45,	/* X */
355     [0x18] = 46,	/* C */
356     [0x19] = 47,	/* V */
357     [0x1a] = 48,	/* B */
358     [0x1b] = 49,	/* N */
359     [0x1c] = 42,	/* Shift (Left shift) */
360     [0x1f] = 65,	/* Zoom+ (F7) */
361 
362     [0x21] = 18,	/* E */
363     [0x22] = 39,	/* ; (Semicolon) */
364     [0x23] = 12,	/* - (Minus) */
365     [0x24] = 13,	/* = (Equal) */
366     [0x2b] = 56,	/* Fn (Left Alt) */
367     [0x2c] = 50,	/* M */
368     [0x2f] = 66,	/* Zoom- (F8) */
369 
370     [0x31] = 19,	/* R */
371     [0x32] = 29 | M,	/* Right Ctrl */
372     [0x34] = 57,	/* Space */
373     [0x35] = 51,	/* , (Comma) */
374     [0x37] = 72 | M,	/* Up */
375     [0x3c] = 82 | M,	/* Compose (Insert) */
376     [0x3f] = 64,	/* FullScreen (F6) */
377 
378     [0x41] = 20,	/* T */
379     [0x44] = 52,	/* . (Dot) */
380     [0x46] = 77 | M,	/* Right */
381     [0x4f] = 63,	/* Home (F5) */
382     [0x51] = 21,	/* Y */
383     [0x53] = 80 | M,	/* Down */
384     [0x55] = 28,	/* Enter */
385     [0x5f] =  1,	/* Cycle (ESC) */
386 
387     [0x61] = 22,	/* U */
388     [0x64] = 75 | M,	/* Left */
389 
390     [0x71] = 23,	/* I */
391 #if 0
392     [0x75] = 28 | M,	/* KP Enter (KP Enter) */
393 #else
394     [0x75] = 15,	/* KP Enter (Tab) */
395 #endif
396 };
397 
398 #undef M
399 
400 static void n810_kbd_setup(struct n800_s *s)
401 {
402     qemu_irq kbd_irq = qdev_get_gpio_in(s->mpu->gpio, N810_KEYBOARD_GPIO);
403     int i;
404 
405     for (i = 0; i < 0x80; i++) {
406         s->keymap[i] = -1;
407     }
408     for (i = 0; i < 0x80; i++) {
409         if (n810_keys[i] > 0) {
410             s->keymap[n810_keys[i]] = i;
411         }
412     }
413 
414     qemu_add_kbd_event_handler(n810_key_event, s);
415 
416     /* Attach the LM8322 keyboard to the I2C bus,
417      * should happen in n8x0_i2c_setup and s->kbd be initialised here.  */
418     s->kbd = DEVICE(i2c_slave_create_simple(omap_i2c_bus(s->mpu->i2c[0]),
419                                             "lm8323", N810_LM8323_ADDR));
420     qdev_connect_gpio_out(s->kbd, 0, kbd_irq);
421 }
422 
423 /* LCD MIPI DBI-C controller (URAL) */
424 struct mipid_s {
425     int resp[4];
426     int param[4];
427     int p;
428     int pm;
429     int cmd;
430 
431     int sleep;
432     int booster;
433     int te;
434     int selfcheck;
435     int partial;
436     int normal;
437     int vscr;
438     int invert;
439     int onoff;
440     int gamma;
441     uint32_t id;
442 };
443 
444 static void mipid_reset(struct mipid_s *s)
445 {
446     s->pm = 0;
447     s->cmd = 0;
448 
449     s->sleep = 1;
450     s->booster = 0;
451     s->selfcheck =
452             (1 << 7) |	/* Register loading OK.  */
453             (1 << 5) |	/* The chip is attached.  */
454             (1 << 4);	/* Display glass still in one piece.  */
455     s->te = 0;
456     s->partial = 0;
457     s->normal = 1;
458     s->vscr = 0;
459     s->invert = 0;
460     s->onoff = 1;
461     s->gamma = 0;
462 }
463 
464 static uint32_t mipid_txrx(void *opaque, uint32_t cmd, int len)
465 {
466     struct mipid_s *s = (struct mipid_s *) opaque;
467     uint8_t ret;
468 
469     if (len > 9) {
470         hw_error("%s: FIXME: bad SPI word width %i\n", __func__, len);
471     }
472 
473     if (s->p >= ARRAY_SIZE(s->resp)) {
474         ret = 0;
475     } else {
476         ret = s->resp[s->p++];
477     }
478     if (s->pm-- > 0) {
479         s->param[s->pm] = cmd;
480     } else {
481         s->cmd = cmd;
482     }
483 
484     switch (s->cmd) {
485     case 0x00:	/* NOP */
486         break;
487 
488     case 0x01:	/* SWRESET */
489         mipid_reset(s);
490         break;
491 
492     case 0x02:	/* BSTROFF */
493         s->booster = 0;
494         break;
495     case 0x03:	/* BSTRON */
496         s->booster = 1;
497         break;
498 
499     case 0x04:	/* RDDID */
500         s->p = 0;
501         s->resp[0] = (s->id >> 16) & 0xff;
502         s->resp[1] = (s->id >>  8) & 0xff;
503         s->resp[2] = (s->id >>  0) & 0xff;
504         break;
505 
506     case 0x06:	/* RD_RED */
507     case 0x07:	/* RD_GREEN */
508         /* XXX the bootloader sometimes issues RD_BLUE meaning RDDID so
509          * for the bootloader one needs to change this.  */
510     case 0x08:	/* RD_BLUE */
511         s->p = 0;
512         /* TODO: return first pixel components */
513         s->resp[0] = 0x01;
514         break;
515 
516     case 0x09:	/* RDDST */
517         s->p = 0;
518         s->resp[0] = s->booster << 7;
519         s->resp[1] = (5 << 4) | (s->partial << 2) |
520                 (s->sleep << 1) | s->normal;
521         s->resp[2] = (s->vscr << 7) | (s->invert << 5) |
522                 (s->onoff << 2) | (s->te << 1) | (s->gamma >> 2);
523         s->resp[3] = s->gamma << 6;
524         break;
525 
526     case 0x0a:	/* RDDPM */
527         s->p = 0;
528         s->resp[0] = (s->onoff << 2) | (s->normal << 3) | (s->sleep << 4) |
529                 (s->partial << 5) | (s->sleep << 6) | (s->booster << 7);
530         break;
531     case 0x0b:	/* RDDMADCTR */
532         s->p = 0;
533         s->resp[0] = 0;
534         break;
535     case 0x0c:	/* RDDCOLMOD */
536         s->p = 0;
537         s->resp[0] = 5;	/* 65K colours */
538         break;
539     case 0x0d:	/* RDDIM */
540         s->p = 0;
541         s->resp[0] = (s->invert << 5) | (s->vscr << 7) | s->gamma;
542         break;
543     case 0x0e:	/* RDDSM */
544         s->p = 0;
545         s->resp[0] = s->te << 7;
546         break;
547     case 0x0f:	/* RDDSDR */
548         s->p = 0;
549         s->resp[0] = s->selfcheck;
550         break;
551 
552     case 0x10:	/* SLPIN */
553         s->sleep = 1;
554         break;
555     case 0x11:	/* SLPOUT */
556         s->sleep = 0;
557         s->selfcheck ^= 1 << 6;	/* POFF self-diagnosis Ok */
558         break;
559 
560     case 0x12:	/* PTLON */
561         s->partial = 1;
562         s->normal = 0;
563         s->vscr = 0;
564         break;
565     case 0x13:	/* NORON */
566         s->partial = 0;
567         s->normal = 1;
568         s->vscr = 0;
569         break;
570 
571     case 0x20:	/* INVOFF */
572         s->invert = 0;
573         break;
574     case 0x21:	/* INVON */
575         s->invert = 1;
576         break;
577 
578     case 0x22:	/* APOFF */
579     case 0x23:	/* APON */
580         goto bad_cmd;
581 
582     case 0x25:	/* WRCNTR */
583         if (s->pm < 0) {
584             s->pm = 1;
585         }
586         goto bad_cmd;
587 
588     case 0x26:	/* GAMSET */
589         if (!s->pm) {
590             s->gamma = ctz32(s->param[0] & 0xf);
591             if (s->gamma == 32) {
592                 s->gamma = -1; /* XXX: should this be 0? */
593             }
594         } else if (s->pm < 0) {
595             s->pm = 1;
596         }
597         break;
598 
599     case 0x28:	/* DISPOFF */
600         s->onoff = 0;
601         break;
602     case 0x29:	/* DISPON */
603         s->onoff = 1;
604         break;
605 
606     case 0x2a:	/* CASET */
607     case 0x2b:	/* RASET */
608     case 0x2c:	/* RAMWR */
609     case 0x2d:	/* RGBSET */
610     case 0x2e:	/* RAMRD */
611     case 0x30:	/* PTLAR */
612     case 0x33:	/* SCRLAR */
613         goto bad_cmd;
614 
615     case 0x34:	/* TEOFF */
616         s->te = 0;
617         break;
618     case 0x35:	/* TEON */
619         if (!s->pm) {
620             s->te = 1;
621         } else if (s->pm < 0) {
622             s->pm = 1;
623         }
624         break;
625 
626     case 0x36:	/* MADCTR */
627         goto bad_cmd;
628 
629     case 0x37:	/* VSCSAD */
630         s->partial = 0;
631         s->normal = 0;
632         s->vscr = 1;
633         break;
634 
635     case 0x38:	/* IDMOFF */
636     case 0x39:	/* IDMON */
637     case 0x3a:	/* COLMOD */
638         goto bad_cmd;
639 
640     case 0xb0:	/* CLKINT / DISCTL */
641     case 0xb1:	/* CLKEXT */
642         if (s->pm < 0) {
643             s->pm = 2;
644         }
645         break;
646 
647     case 0xb4:	/* FRMSEL */
648         break;
649 
650     case 0xb5:	/* FRM8SEL */
651     case 0xb6:	/* TMPRNG / INIESC */
652     case 0xb7:	/* TMPHIS / NOP2 */
653     case 0xb8:	/* TMPREAD / MADCTL */
654     case 0xba:	/* DISTCTR */
655     case 0xbb:	/* EPVOL */
656         goto bad_cmd;
657 
658     case 0xbd:	/* Unknown */
659         s->p = 0;
660         s->resp[0] = 0;
661         s->resp[1] = 1;
662         break;
663 
664     case 0xc2:	/* IFMOD */
665         if (s->pm < 0) {
666             s->pm = 2;
667         }
668         break;
669 
670     case 0xc6:	/* PWRCTL */
671     case 0xc7:	/* PPWRCTL */
672     case 0xd0:	/* EPWROUT */
673     case 0xd1:	/* EPWRIN */
674     case 0xd4:	/* RDEV */
675     case 0xd5:	/* RDRR */
676         goto bad_cmd;
677 
678     case 0xda:	/* RDID1 */
679         s->p = 0;
680         s->resp[0] = (s->id >> 16) & 0xff;
681         break;
682     case 0xdb:	/* RDID2 */
683         s->p = 0;
684         s->resp[0] = (s->id >>  8) & 0xff;
685         break;
686     case 0xdc:	/* RDID3 */
687         s->p = 0;
688         s->resp[0] = (s->id >>  0) & 0xff;
689         break;
690 
691     default:
692     bad_cmd:
693         qemu_log_mask(LOG_GUEST_ERROR,
694                       "%s: unknown command %02x\n", __func__, s->cmd);
695         break;
696     }
697 
698     return ret;
699 }
700 
701 static void *mipid_init(void)
702 {
703     struct mipid_s *s = (struct mipid_s *) g_malloc0(sizeof(*s));
704 
705     s->id = 0x838f03;
706     mipid_reset(s);
707 
708     return s;
709 }
710 
711 static void n8x0_spi_setup(struct n800_s *s)
712 {
713     void *tsc = s->ts.opaque;
714     void *mipid = mipid_init();
715 
716     omap_mcspi_attach(s->mpu->mcspi[0], s->ts.txrx, tsc, 0);
717     omap_mcspi_attach(s->mpu->mcspi[0], mipid_txrx, mipid, 1);
718 }
719 
720 /* This task is normally performed by the bootloader.  If we're loading
721  * a kernel directly, we need to enable the Blizzard ourselves.  */
722 static void n800_dss_init(struct rfbi_chip_s *chip)
723 {
724     uint8_t *fb_blank;
725 
726     chip->write(chip->opaque, 0, 0x2a);		/* LCD Width register */
727     chip->write(chip->opaque, 1, 0x64);
728     chip->write(chip->opaque, 0, 0x2c);		/* LCD HNDP register */
729     chip->write(chip->opaque, 1, 0x1e);
730     chip->write(chip->opaque, 0, 0x2e);		/* LCD Height 0 register */
731     chip->write(chip->opaque, 1, 0xe0);
732     chip->write(chip->opaque, 0, 0x30);		/* LCD Height 1 register */
733     chip->write(chip->opaque, 1, 0x01);
734     chip->write(chip->opaque, 0, 0x32);		/* LCD VNDP register */
735     chip->write(chip->opaque, 1, 0x06);
736     chip->write(chip->opaque, 0, 0x68);		/* Display Mode register */
737     chip->write(chip->opaque, 1, 1);		/* Enable bit */
738 
739     chip->write(chip->opaque, 0, 0x6c);
740     chip->write(chip->opaque, 1, 0x00);		/* Input X Start Position */
741     chip->write(chip->opaque, 1, 0x00);		/* Input X Start Position */
742     chip->write(chip->opaque, 1, 0x00);		/* Input Y Start Position */
743     chip->write(chip->opaque, 1, 0x00);		/* Input Y Start Position */
744     chip->write(chip->opaque, 1, 0x1f);		/* Input X End Position */
745     chip->write(chip->opaque, 1, 0x03);		/* Input X End Position */
746     chip->write(chip->opaque, 1, 0xdf);		/* Input Y End Position */
747     chip->write(chip->opaque, 1, 0x01);		/* Input Y End Position */
748     chip->write(chip->opaque, 1, 0x00);		/* Output X Start Position */
749     chip->write(chip->opaque, 1, 0x00);		/* Output X Start Position */
750     chip->write(chip->opaque, 1, 0x00);		/* Output Y Start Position */
751     chip->write(chip->opaque, 1, 0x00);		/* Output Y Start Position */
752     chip->write(chip->opaque, 1, 0x1f);		/* Output X End Position */
753     chip->write(chip->opaque, 1, 0x03);		/* Output X End Position */
754     chip->write(chip->opaque, 1, 0xdf);		/* Output Y End Position */
755     chip->write(chip->opaque, 1, 0x01);		/* Output Y End Position */
756     chip->write(chip->opaque, 1, 0x01);		/* Input Data Format */
757     chip->write(chip->opaque, 1, 0x01);		/* Data Source Select */
758 
759     fb_blank = memset(g_malloc(800 * 480 * 2), 0xff, 800 * 480 * 2);
760     /* Display Memory Data Port */
761     chip->block(chip->opaque, 1, fb_blank, 800 * 480 * 2, 800);
762     g_free(fb_blank);
763 }
764 
765 static void n8x0_dss_setup(struct n800_s *s)
766 {
767     s->blizzard.opaque = s1d13745_init(NULL);
768     s->blizzard.block = s1d13745_write_block;
769     s->blizzard.write = s1d13745_write;
770     s->blizzard.read = s1d13745_read;
771 
772     omap_rfbi_attach(s->mpu->dss, 0, &s->blizzard);
773 }
774 
775 static void n8x0_cbus_setup(struct n800_s *s)
776 {
777     qemu_irq dat_out = qdev_get_gpio_in(s->mpu->gpio, N8X0_CBUS_DAT_GPIO);
778     qemu_irq retu_irq = qdev_get_gpio_in(s->mpu->gpio, N8X0_RETU_GPIO);
779     qemu_irq tahvo_irq = qdev_get_gpio_in(s->mpu->gpio, N8X0_TAHVO_GPIO);
780 
781     CBus *cbus = cbus_init(dat_out);
782 
783     qdev_connect_gpio_out(s->mpu->gpio, N8X0_CBUS_CLK_GPIO, cbus->clk);
784     qdev_connect_gpio_out(s->mpu->gpio, N8X0_CBUS_DAT_GPIO, cbus->dat);
785     qdev_connect_gpio_out(s->mpu->gpio, N8X0_CBUS_SEL_GPIO, cbus->sel);
786 
787     cbus_attach(cbus, s->retu = retu_init(retu_irq, 1));
788     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
789 }
790 
791 static void n8x0_usb_setup(struct n800_s *s)
792 {
793     SysBusDevice *dev;
794     s->usb = qdev_new("tusb6010");
795     dev = SYS_BUS_DEVICE(s->usb);
796     sysbus_realize_and_unref(dev, &error_fatal);
797     sysbus_connect_irq(dev, 0,
798                        qdev_get_gpio_in(s->mpu->gpio, N8X0_TUSB_INT_GPIO));
799     /* Using the NOR interface */
800     omap_gpmc_attach(s->mpu->gpmc, N8X0_USB_ASYNC_CS,
801                      sysbus_mmio_get_region(dev, 0));
802     omap_gpmc_attach(s->mpu->gpmc, N8X0_USB_SYNC_CS,
803                      sysbus_mmio_get_region(dev, 1));
804     qdev_connect_gpio_out(s->mpu->gpio, N8X0_TUSB_ENABLE_GPIO,
805                           qdev_get_gpio_in(s->usb, 0)); /* tusb_pwr */
806 }
807 
808 /* Setup done before the main bootloader starts by some early setup code
809  * - used when we want to run the main bootloader in emulation.  This
810  * isn't documented.  */
811 static uint32_t n800_pinout[104] = {
812     0x080f00d8, 0x00d40808, 0x03080808, 0x080800d0,
813     0x00dc0808, 0x0b0f0f00, 0x080800b4, 0x00c00808,
814     0x08080808, 0x180800c4, 0x00b80000, 0x08080808,
815     0x080800bc, 0x00cc0808, 0x08081818, 0x18180128,
816     0x01241800, 0x18181818, 0x000000f0, 0x01300000,
817     0x00001b0b, 0x1b0f0138, 0x00e0181b, 0x1b031b0b,
818     0x180f0078, 0x00740018, 0x0f0f0f1a, 0x00000080,
819     0x007c0000, 0x00000000, 0x00000088, 0x00840000,
820     0x00000000, 0x00000094, 0x00980300, 0x0f180003,
821     0x0000008c, 0x00900f0f, 0x0f0f1b00, 0x0f00009c,
822     0x01140000, 0x1b1b0f18, 0x0818013c, 0x01400008,
823     0x00001818, 0x000b0110, 0x010c1800, 0x0b030b0f,
824     0x181800f4, 0x00f81818, 0x00000018, 0x000000fc,
825     0x00401808, 0x00000000, 0x0f1b0030, 0x003c0008,
826     0x00000000, 0x00000038, 0x00340000, 0x00000000,
827     0x1a080070, 0x00641a1a, 0x08080808, 0x08080060,
828     0x005c0808, 0x08080808, 0x08080058, 0x00540808,
829     0x08080808, 0x0808006c, 0x00680808, 0x08080808,
830     0x000000a8, 0x00b00000, 0x08080808, 0x000000a0,
831     0x00a40000, 0x00000000, 0x08ff0050, 0x004c0808,
832     0xffffffff, 0xffff0048, 0x0044ffff, 0xffffffff,
833     0x000000ac, 0x01040800, 0x08080b0f, 0x18180100,
834     0x01081818, 0x0b0b1808, 0x1a0300e4, 0x012c0b1a,
835     0x02020018, 0x0b000134, 0x011c0800, 0x0b1b1b00,
836     0x0f0000c8, 0x00ec181b, 0x000f0f02, 0x00180118,
837     0x01200000, 0x0f0b1b1b, 0x0f0200e8, 0x0000020b,
838 };
839 
840 static void n800_setup_nolo_tags(void *sram_base)
841 {
842     int i;
843     uint32_t *p = sram_base + 0x8000;
844     uint32_t *v = sram_base + 0xa000;
845 
846     memset(p, 0, 0x3000);
847 
848     strcpy((void *) (p + 0), "QEMU N800");
849 
850     strcpy((void *) (p + 8), "F5");
851 
852     stl_p(p + 10, 0x04f70000);
853     strcpy((void *) (p + 9), "RX-34");
854 
855     /* RAM size in MB? */
856     stl_p(p + 12, 0x80);
857 
858     /* Pointer to the list of tags */
859     stl_p(p + 13, OMAP2_SRAM_BASE + 0x9000);
860 
861     /* The NOLO tags start here */
862     p = sram_base + 0x9000;
863 #define ADD_TAG(tag, len)				\
864     stw_p((uint16_t *) p + 0, tag);			\
865     stw_p((uint16_t *) p + 1, len); p++;		\
866     stl_p(p++, OMAP2_SRAM_BASE | (((void *) v - sram_base) & 0xffff));
867 
868     /* OMAP STI console? Pin out settings? */
869     ADD_TAG(0x6e01, 414);
870     for (i = 0; i < ARRAY_SIZE(n800_pinout); i++) {
871         stl_p(v++, n800_pinout[i]);
872     }
873 
874     /* Kernel memsize? */
875     ADD_TAG(0x6e05, 1);
876     stl_p(v++, 2);
877 
878     /* NOLO serial console */
879     ADD_TAG(0x6e02, 4);
880     stl_p(v++, XLDR_LL_UART);		/* UART number (1 - 3) */
881 
882 #if 0
883     /* CBUS settings (Retu/AVilma) */
884     ADD_TAG(0x6e03, 6);
885     stw_p((uint16_t *) v + 0, 65);	/* CBUS GPIO0 */
886     stw_p((uint16_t *) v + 1, 66);	/* CBUS GPIO1 */
887     stw_p((uint16_t *) v + 2, 64);	/* CBUS GPIO2 */
888     v += 2;
889 #endif
890 
891     /* Nokia ASIC BB5 (Retu/Tahvo) */
892     ADD_TAG(0x6e0a, 4);
893     stw_p((uint16_t *) v + 0, 111);	/* "Retu" interrupt GPIO */
894     stw_p((uint16_t *) v + 1, 108);	/* "Tahvo" interrupt GPIO */
895     v++;
896 
897     /* LCD console? */
898     ADD_TAG(0x6e04, 4);
899     stw_p((uint16_t *) v + 0, 30);	/* ??? */
900     stw_p((uint16_t *) v + 1, 24);	/* ??? */
901     v++;
902 
903 #if 0
904     /* LCD settings */
905     ADD_TAG(0x6e06, 2);
906     stw_p((uint16_t *) (v++), 15);	/* ??? */
907 #endif
908 
909     /* I^2C (Menelaus) */
910     ADD_TAG(0x6e07, 4);
911     stl_p(v++, 0x00720000);		/* ??? */
912 
913     /* Unknown */
914     ADD_TAG(0x6e0b, 6);
915     stw_p((uint16_t *) v + 0, 94);	/* ??? */
916     stw_p((uint16_t *) v + 1, 23);	/* ??? */
917     stw_p((uint16_t *) v + 2, 0);	/* ??? */
918     v += 2;
919 
920     /* OMAP gpio switch info */
921     ADD_TAG(0x6e0c, 80);
922     strcpy((void *) v, "bat_cover");	v += 3;
923     stw_p((uint16_t *) v + 0, 110);	/* GPIO num ??? */
924     stw_p((uint16_t *) v + 1, 1);	/* GPIO num ??? */
925     v += 2;
926     strcpy((void *) v, "cam_act");	v += 3;
927     stw_p((uint16_t *) v + 0, 95);	/* GPIO num ??? */
928     stw_p((uint16_t *) v + 1, 32);	/* GPIO num ??? */
929     v += 2;
930     strcpy((void *) v, "cam_turn");	v += 3;
931     stw_p((uint16_t *) v + 0, 12);	/* GPIO num ??? */
932     stw_p((uint16_t *) v + 1, 33);	/* GPIO num ??? */
933     v += 2;
934     strcpy((void *) v, "headphone");	v += 3;
935     stw_p((uint16_t *) v + 0, 107);	/* GPIO num ??? */
936     stw_p((uint16_t *) v + 1, 17);	/* GPIO num ??? */
937     v += 2;
938 
939     /* Bluetooth */
940     ADD_TAG(0x6e0e, 12);
941     stl_p(v++, 0x5c623d01);		/* ??? */
942     stl_p(v++, 0x00000201);		/* ??? */
943     stl_p(v++, 0x00000000);		/* ??? */
944 
945     /* CX3110x WLAN settings */
946     ADD_TAG(0x6e0f, 8);
947     stl_p(v++, 0x00610025);		/* ??? */
948     stl_p(v++, 0xffff0057);		/* ??? */
949 
950     /* MMC host settings */
951     ADD_TAG(0x6e10, 12);
952     stl_p(v++, 0xffff000f);		/* ??? */
953     stl_p(v++, 0xffffffff);		/* ??? */
954     stl_p(v++, 0x00000060);		/* ??? */
955 
956     /* OneNAND chip select */
957     ADD_TAG(0x6e11, 10);
958     stl_p(v++, 0x00000401);		/* ??? */
959     stl_p(v++, 0x0002003a);		/* ??? */
960     stl_p(v++, 0x00000002);		/* ??? */
961 
962     /* TEA5761 sensor settings */
963     ADD_TAG(0x6e12, 2);
964     stl_p(v++, 93);			/* GPIO num ??? */
965 
966 #if 0
967     /* Unknown tag */
968     ADD_TAG(6e09, 0);
969 
970     /* Kernel UART / console */
971     ADD_TAG(6e12, 0);
972 #endif
973 
974     /* End of the list */
975     stl_p(p++, 0x00000000);
976     stl_p(p++, 0x00000000);
977 }
978 
979 /* This task is normally performed by the bootloader.  If we're loading
980  * a kernel directly, we need to set up GPMC mappings ourselves.  */
981 static void n800_gpmc_init(struct n800_s *s)
982 {
983     uint32_t config7 =
984             (0xf << 8) |	/* MASKADDRESS */
985             (1 << 6) |		/* CSVALID */
986             (4 << 0);		/* BASEADDRESS */
987 
988     cpu_physical_memory_write(0x6800a078,		/* GPMC_CONFIG7_0 */
989                               &config7, sizeof(config7));
990 }
991 
992 /* Setup sequence done by the bootloader */
993 static void n8x0_boot_init(void *opaque)
994 {
995     struct n800_s *s = (struct n800_s *) opaque;
996     uint32_t buf;
997 
998     /* PRCM setup */
999 #define omap_writel(addr, val)	\
1000     buf = (val);			\
1001     cpu_physical_memory_write(addr, &buf, sizeof(buf))
1002 
1003     omap_writel(0x48008060, 0x41);		/* PRCM_CLKSRC_CTRL */
1004     omap_writel(0x48008070, 1);			/* PRCM_CLKOUT_CTRL */
1005     omap_writel(0x48008078, 0);			/* PRCM_CLKEMUL_CTRL */
1006     omap_writel(0x48008090, 0);			/* PRCM_VOLTSETUP */
1007     omap_writel(0x48008094, 0);			/* PRCM_CLKSSETUP */
1008     omap_writel(0x48008098, 0);			/* PRCM_POLCTRL */
1009     omap_writel(0x48008140, 2);			/* CM_CLKSEL_MPU */
1010     omap_writel(0x48008148, 0);			/* CM_CLKSTCTRL_MPU */
1011     omap_writel(0x48008158, 1);			/* RM_RSTST_MPU */
1012     omap_writel(0x480081c8, 0x15);		/* PM_WKDEP_MPU */
1013     omap_writel(0x480081d4, 0x1d4);		/* PM_EVGENCTRL_MPU */
1014     omap_writel(0x480081d8, 0);			/* PM_EVEGENONTIM_MPU */
1015     omap_writel(0x480081dc, 0);			/* PM_EVEGENOFFTIM_MPU */
1016     omap_writel(0x480081e0, 0xc);		/* PM_PWSTCTRL_MPU */
1017     omap_writel(0x48008200, 0x047e7ff7);	/* CM_FCLKEN1_CORE */
1018     omap_writel(0x48008204, 0x00000004);	/* CM_FCLKEN2_CORE */
1019     omap_writel(0x48008210, 0x047e7ff1);	/* CM_ICLKEN1_CORE */
1020     omap_writel(0x48008214, 0x00000004);	/* CM_ICLKEN2_CORE */
1021     omap_writel(0x4800821c, 0x00000000);	/* CM_ICLKEN4_CORE */
1022     omap_writel(0x48008230, 0);			/* CM_AUTOIDLE1_CORE */
1023     omap_writel(0x48008234, 0);			/* CM_AUTOIDLE2_CORE */
1024     omap_writel(0x48008238, 7);			/* CM_AUTOIDLE3_CORE */
1025     omap_writel(0x4800823c, 0);			/* CM_AUTOIDLE4_CORE */
1026     omap_writel(0x48008240, 0x04360626);	/* CM_CLKSEL1_CORE */
1027     omap_writel(0x48008244, 0x00000014);	/* CM_CLKSEL2_CORE */
1028     omap_writel(0x48008248, 0);			/* CM_CLKSTCTRL_CORE */
1029     omap_writel(0x48008300, 0x00000000);	/* CM_FCLKEN_GFX */
1030     omap_writel(0x48008310, 0x00000000);	/* CM_ICLKEN_GFX */
1031     omap_writel(0x48008340, 0x00000001);	/* CM_CLKSEL_GFX */
1032     omap_writel(0x48008400, 0x00000004);	/* CM_FCLKEN_WKUP */
1033     omap_writel(0x48008410, 0x00000004);	/* CM_ICLKEN_WKUP */
1034     omap_writel(0x48008440, 0x00000000);	/* CM_CLKSEL_WKUP */
1035     omap_writel(0x48008500, 0x000000cf);	/* CM_CLKEN_PLL */
1036     omap_writel(0x48008530, 0x0000000c);	/* CM_AUTOIDLE_PLL */
1037     omap_writel(0x48008540,			/* CM_CLKSEL1_PLL */
1038                     (0x78 << 12) | (6 << 8));
1039     omap_writel(0x48008544, 2);			/* CM_CLKSEL2_PLL */
1040 
1041     /* GPMC setup */
1042     n800_gpmc_init(s);
1043 
1044     /* Video setup */
1045     n800_dss_init(&s->blizzard);
1046 
1047     /* CPU setup */
1048     s->mpu->cpu->env.GE = 0x5;
1049 
1050     /* If the machine has a slided keyboard, open it */
1051     if (s->kbd) {
1052         qemu_irq_raise(qdev_get_gpio_in(s->mpu->gpio, N810_SLIDE_GPIO));
1053     }
1054 }
1055 
1056 #define OMAP_TAG_NOKIA_BT	0x4e01
1057 #define OMAP_TAG_WLAN_CX3110X	0x4e02
1058 #define OMAP_TAG_CBUS		0x4e03
1059 #define OMAP_TAG_EM_ASIC_BB5	0x4e04
1060 
1061 static struct omap_gpiosw_info_s {
1062     const char *name;
1063     int line;
1064     int type;
1065 } n800_gpiosw_info[] = {
1066     {
1067         "bat_cover", N800_BAT_COVER_GPIO,
1068         OMAP_GPIOSW_TYPE_COVER | OMAP_GPIOSW_INVERTED,
1069     }, {
1070         "cam_act", N800_CAM_ACT_GPIO,
1071         OMAP_GPIOSW_TYPE_ACTIVITY,
1072     }, {
1073         "cam_turn", N800_CAM_TURN_GPIO,
1074         OMAP_GPIOSW_TYPE_ACTIVITY | OMAP_GPIOSW_INVERTED,
1075     }, {
1076         "headphone", N8X0_HEADPHONE_GPIO,
1077         OMAP_GPIOSW_TYPE_CONNECTION | OMAP_GPIOSW_INVERTED,
1078     },
1079     { NULL }
1080 }, n810_gpiosw_info[] = {
1081     {
1082         "gps_reset", N810_GPS_RESET_GPIO,
1083         OMAP_GPIOSW_TYPE_ACTIVITY | OMAP_GPIOSW_OUTPUT,
1084     }, {
1085         "gps_wakeup", N810_GPS_WAKEUP_GPIO,
1086         OMAP_GPIOSW_TYPE_ACTIVITY | OMAP_GPIOSW_OUTPUT,
1087     }, {
1088         "headphone", N8X0_HEADPHONE_GPIO,
1089         OMAP_GPIOSW_TYPE_CONNECTION | OMAP_GPIOSW_INVERTED,
1090     }, {
1091         "kb_lock", N810_KB_LOCK_GPIO,
1092         OMAP_GPIOSW_TYPE_COVER | OMAP_GPIOSW_INVERTED,
1093     }, {
1094         "sleepx_led", N810_SLEEPX_LED_GPIO,
1095         OMAP_GPIOSW_TYPE_ACTIVITY | OMAP_GPIOSW_INVERTED | OMAP_GPIOSW_OUTPUT,
1096     }, {
1097         "slide", N810_SLIDE_GPIO,
1098         OMAP_GPIOSW_TYPE_COVER | OMAP_GPIOSW_INVERTED,
1099     },
1100     { NULL }
1101 };
1102 
1103 static struct omap_partition_info_s {
1104     uint32_t offset;
1105     uint32_t size;
1106     int mask;
1107     const char *name;
1108 } n800_part_info[] = {
1109     { 0x00000000, 0x00020000, 0x3, "bootloader" },
1110     { 0x00020000, 0x00060000, 0x0, "config" },
1111     { 0x00080000, 0x00200000, 0x0, "kernel" },
1112     { 0x00280000, 0x00200000, 0x3, "initfs" },
1113     { 0x00480000, 0x0fb80000, 0x3, "rootfs" },
1114 
1115     { 0, 0, 0, NULL }
1116 }, n810_part_info[] = {
1117     { 0x00000000, 0x00020000, 0x3, "bootloader" },
1118     { 0x00020000, 0x00060000, 0x0, "config" },
1119     { 0x00080000, 0x00220000, 0x0, "kernel" },
1120     { 0x002a0000, 0x00400000, 0x0, "initfs" },
1121     { 0x006a0000, 0x0f960000, 0x0, "rootfs" },
1122 
1123     { 0, 0, 0, NULL }
1124 };
1125 
1126 static uint8_t n8x0_bd_addr[6] = { N8X0_BD_ADDR };
1127 
1128 static int n8x0_atag_setup(void *p, int model)
1129 {
1130     uint8_t *b;
1131     uint16_t *w;
1132     uint32_t *l;
1133     struct omap_gpiosw_info_s *gpiosw;
1134     struct omap_partition_info_s *partition;
1135     const char *tag;
1136 
1137     w = p;
1138 
1139     stw_p(w++, OMAP_TAG_UART);			/* u16 tag */
1140     stw_p(w++, 4);				/* u16 len */
1141     stw_p(w++, (1 << 2) | (1 << 1) | (1 << 0)); /* uint enabled_uarts */
1142     w++;
1143 
1144 #if 0
1145     stw_p(w++, OMAP_TAG_SERIAL_CONSOLE);	/* u16 tag */
1146     stw_p(w++, 4);				/* u16 len */
1147     stw_p(w++, XLDR_LL_UART + 1);		/* u8 console_uart */
1148     stw_p(w++, 115200);				/* u32 console_speed */
1149 #endif
1150 
1151     stw_p(w++, OMAP_TAG_LCD);			/* u16 tag */
1152     stw_p(w++, 36);				/* u16 len */
1153     strcpy((void *) w, "QEMU LCD panel");	/* char panel_name[16] */
1154     w += 8;
1155     strcpy((void *) w, "blizzard");		/* char ctrl_name[16] */
1156     w += 8;
1157     stw_p(w++, N810_BLIZZARD_RESET_GPIO);	/* TODO: n800 s16 nreset_gpio */
1158     stw_p(w++, 24);				/* u8 data_lines */
1159 
1160     stw_p(w++, OMAP_TAG_CBUS);			/* u16 tag */
1161     stw_p(w++, 8);				/* u16 len */
1162     stw_p(w++, N8X0_CBUS_CLK_GPIO);		/* s16 clk_gpio */
1163     stw_p(w++, N8X0_CBUS_DAT_GPIO);		/* s16 dat_gpio */
1164     stw_p(w++, N8X0_CBUS_SEL_GPIO);		/* s16 sel_gpio */
1165     w++;
1166 
1167     stw_p(w++, OMAP_TAG_EM_ASIC_BB5);		/* u16 tag */
1168     stw_p(w++, 4);				/* u16 len */
1169     stw_p(w++, N8X0_RETU_GPIO);			/* s16 retu_irq_gpio */
1170     stw_p(w++, N8X0_TAHVO_GPIO);		/* s16 tahvo_irq_gpio */
1171 
1172     gpiosw = (model == 810) ? n810_gpiosw_info : n800_gpiosw_info;
1173     for (; gpiosw->name; gpiosw++) {
1174         stw_p(w++, OMAP_TAG_GPIO_SWITCH);	/* u16 tag */
1175         stw_p(w++, 20);				/* u16 len */
1176         strcpy((void *) w, gpiosw->name);	/* char name[12] */
1177         w += 6;
1178         stw_p(w++, gpiosw->line);		/* u16 gpio */
1179         stw_p(w++, gpiosw->type);
1180         stw_p(w++, 0);
1181         stw_p(w++, 0);
1182     }
1183 
1184     stw_p(w++, OMAP_TAG_NOKIA_BT);		/* u16 tag */
1185     stw_p(w++, 12);				/* u16 len */
1186     b = (void *) w;
1187     stb_p(b++, 0x01);				/* u8 chip_type	(CSR) */
1188     stb_p(b++, N8X0_BT_WKUP_GPIO);		/* u8 bt_wakeup_gpio */
1189     stb_p(b++, N8X0_BT_HOST_WKUP_GPIO);		/* u8 host_wakeup_gpio */
1190     stb_p(b++, N8X0_BT_RESET_GPIO);		/* u8 reset_gpio */
1191     stb_p(b++, BT_UART + 1);			/* u8 bt_uart */
1192     memcpy(b, &n8x0_bd_addr, 6);		/* u8 bd_addr[6] */
1193     b += 6;
1194     stb_p(b++, 0x02);				/* u8 bt_sysclk (38.4) */
1195     w = (void *) b;
1196 
1197     stw_p(w++, OMAP_TAG_WLAN_CX3110X);		/* u16 tag */
1198     stw_p(w++, 8);				/* u16 len */
1199     stw_p(w++, 0x25);				/* u8 chip_type */
1200     stw_p(w++, N8X0_WLAN_PWR_GPIO);		/* s16 power_gpio */
1201     stw_p(w++, N8X0_WLAN_IRQ_GPIO);		/* s16 irq_gpio */
1202     stw_p(w++, -1);				/* s16 spi_cs_gpio */
1203 
1204     stw_p(w++, OMAP_TAG_MMC);			/* u16 tag */
1205     stw_p(w++, 16);				/* u16 len */
1206     if (model == 810) {
1207         stw_p(w++, 0x23f);			/* unsigned flags */
1208         stw_p(w++, -1);				/* s16 power_pin */
1209         stw_p(w++, -1);				/* s16 switch_pin */
1210         stw_p(w++, -1);				/* s16 wp_pin */
1211         stw_p(w++, 0x240);			/* unsigned flags */
1212         stw_p(w++, 0xc000);			/* s16 power_pin */
1213         stw_p(w++, 0x0248);			/* s16 switch_pin */
1214         stw_p(w++, 0xc000);			/* s16 wp_pin */
1215     } else {
1216         stw_p(w++, 0xf);			/* unsigned flags */
1217         stw_p(w++, -1);				/* s16 power_pin */
1218         stw_p(w++, -1);				/* s16 switch_pin */
1219         stw_p(w++, -1);				/* s16 wp_pin */
1220         stw_p(w++, 0);				/* unsigned flags */
1221         stw_p(w++, 0);				/* s16 power_pin */
1222         stw_p(w++, 0);				/* s16 switch_pin */
1223         stw_p(w++, 0);				/* s16 wp_pin */
1224     }
1225 
1226     stw_p(w++, OMAP_TAG_TEA5761);		/* u16 tag */
1227     stw_p(w++, 4);				/* u16 len */
1228     stw_p(w++, N8X0_TEA5761_CS_GPIO);		/* u16 enable_gpio */
1229     w++;
1230 
1231     partition = (model == 810) ? n810_part_info : n800_part_info;
1232     for (; partition->name; partition++) {
1233         stw_p(w++, OMAP_TAG_PARTITION);		/* u16 tag */
1234         stw_p(w++, 28);				/* u16 len */
1235         strcpy((void *) w, partition->name);	/* char name[16] */
1236         l = (void *) (w + 8);
1237         stl_p(l++, partition->size);		/* unsigned int size */
1238         stl_p(l++, partition->offset);		/* unsigned int offset */
1239         stl_p(l++, partition->mask);		/* unsigned int mask_flags */
1240         w = (void *) l;
1241     }
1242 
1243     stw_p(w++, OMAP_TAG_BOOT_REASON);		/* u16 tag */
1244     stw_p(w++, 12);				/* u16 len */
1245 #if 0
1246     strcpy((void *) w, "por");			/* char reason_str[12] */
1247     strcpy((void *) w, "charger");		/* char reason_str[12] */
1248     strcpy((void *) w, "32wd_to");		/* char reason_str[12] */
1249     strcpy((void *) w, "sw_rst");		/* char reason_str[12] */
1250     strcpy((void *) w, "mbus");			/* char reason_str[12] */
1251     strcpy((void *) w, "unknown");		/* char reason_str[12] */
1252     strcpy((void *) w, "swdg_to");		/* char reason_str[12] */
1253     strcpy((void *) w, "sec_vio");		/* char reason_str[12] */
1254     strcpy((void *) w, "pwr_key");		/* char reason_str[12] */
1255     strcpy((void *) w, "rtc_alarm");		/* char reason_str[12] */
1256 #else
1257     strcpy((void *) w, "pwr_key");		/* char reason_str[12] */
1258 #endif
1259     w += 6;
1260 
1261     tag = (model == 810) ? "RX-44" : "RX-34";
1262     stw_p(w++, OMAP_TAG_VERSION_STR);		/* u16 tag */
1263     stw_p(w++, 24);				/* u16 len */
1264     strcpy((void *) w, "product");		/* char component[12] */
1265     w += 6;
1266     strcpy((void *) w, tag);			/* char version[12] */
1267     w += 6;
1268 
1269     stw_p(w++, OMAP_TAG_VERSION_STR);		/* u16 tag */
1270     stw_p(w++, 24);				/* u16 len */
1271     strcpy((void *) w, "hw-build");		/* char component[12] */
1272     w += 6;
1273     strcpy((void *) w, "QEMU ");
1274     pstrcat((void *) w, 12, qemu_hw_version()); /* char version[12] */
1275     w += 6;
1276 
1277     tag = (model == 810) ? "1.1.10-qemu" : "1.1.6-qemu";
1278     stw_p(w++, OMAP_TAG_VERSION_STR);		/* u16 tag */
1279     stw_p(w++, 24);				/* u16 len */
1280     strcpy((void *) w, "nolo");			/* char component[12] */
1281     w += 6;
1282     strcpy((void *) w, tag);			/* char version[12] */
1283     w += 6;
1284 
1285     return (void *) w - p;
1286 }
1287 
1288 static int n800_atag_setup(const struct arm_boot_info *info, void *p)
1289 {
1290     return n8x0_atag_setup(p, 800);
1291 }
1292 
1293 static int n810_atag_setup(const struct arm_boot_info *info, void *p)
1294 {
1295     return n8x0_atag_setup(p, 810);
1296 }
1297 
1298 static void n8x0_init(MachineState *machine,
1299                       struct arm_boot_info *binfo, int model)
1300 {
1301     struct n800_s *s = (struct n800_s *) g_malloc0(sizeof(*s));
1302     MachineClass *mc = MACHINE_GET_CLASS(machine);
1303 
1304     if (machine->ram_size != mc->default_ram_size) {
1305         char *sz = size_to_str(mc->default_ram_size);
1306         error_report("Invalid RAM size, should be %s", sz);
1307         g_free(sz);
1308         exit(EXIT_FAILURE);
1309     }
1310     binfo->ram_size = machine->ram_size;
1311 
1312     memory_region_add_subregion(get_system_memory(), OMAP2_Q2_BASE,
1313                                 machine->ram);
1314 
1315     s->mpu = omap2420_mpu_init(machine->ram, machine->cpu_type);
1316 
1317     /* Setup peripherals
1318      *
1319      * Believed external peripherals layout in the N810:
1320      * (spi bus 1)
1321      *   tsc2005
1322      *   lcd_mipid
1323      * (spi bus 2)
1324      *   Conexant cx3110x (WLAN)
1325      *   optional: pc2400m (WiMAX)
1326      * (i2c bus 0)
1327      *   TLV320AIC33 (audio codec)
1328      *   TCM825x (camera by Toshiba)
1329      *   lp5521 (clever LEDs)
1330      *   tsl2563 (light sensor, hwmon, model 7, rev. 0)
1331      *   lm8323 (keypad, manf 00, rev 04)
1332      * (i2c bus 1)
1333      *   tmp105 (temperature sensor, hwmon)
1334      *   menelaus (pm)
1335      * (somewhere on i2c - maybe N800-only)
1336      *   tea5761 (FM tuner)
1337      * (serial 0)
1338      *   GPS
1339      * (some serial port)
1340      *   csr41814 (Bluetooth)
1341      */
1342     n8x0_gpio_setup(s);
1343     n8x0_nand_setup(s);
1344     n8x0_i2c_setup(s);
1345     if (model == 800) {
1346         n800_tsc_kbd_setup(s);
1347     } else if (model == 810) {
1348         n810_tsc_setup(s);
1349         n810_kbd_setup(s);
1350     }
1351     n8x0_spi_setup(s);
1352     n8x0_dss_setup(s);
1353     n8x0_cbus_setup(s);
1354     if (machine_usb(machine)) {
1355         n8x0_usb_setup(s);
1356     }
1357 
1358     if (machine->kernel_filename) {
1359         /* Or at the linux loader.  */
1360         arm_load_kernel(s->mpu->cpu, machine, binfo);
1361 
1362         qemu_register_reset(n8x0_boot_init, s);
1363     }
1364 
1365     if (option_rom[0].name &&
1366         (machine->boot_order[0] == 'n' || !machine->kernel_filename)) {
1367         uint8_t *nolo_tags = g_new(uint8_t, 0x10000);
1368         /* No, wait, better start at the ROM.  */
1369         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
1370 
1371         /*
1372          * This is intended for loading the `secondary.bin' program from
1373          * Nokia images (the NOLO bootloader).  The entry point seems
1374          * to be at OMAP2_Q2_BASE + 0x400000.
1375          *
1376          * The `2nd.bin' files contain some kind of earlier boot code and
1377          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
1378          *
1379          * The code above is for loading the `zImage' file from Nokia
1380          * images.
1381          */
1382         if (load_image_targphys(option_rom[0].name,
1383                                 OMAP2_Q2_BASE + 0x400000,
1384                                 machine->ram_size - 0x400000) < 0) {
1385             error_report("Failed to load secondary bootloader %s",
1386                          option_rom[0].name);
1387             exit(EXIT_FAILURE);
1388         }
1389 
1390         n800_setup_nolo_tags(nolo_tags);
1391         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
1392         g_free(nolo_tags);
1393     }
1394 }
1395 
1396 static struct arm_boot_info n800_binfo = {
1397     .loader_start = OMAP2_Q2_BASE,
1398     .board_id = 0x4f7,
1399     .atag_board = n800_atag_setup,
1400 };
1401 
1402 static struct arm_boot_info n810_binfo = {
1403     .loader_start = OMAP2_Q2_BASE,
1404     /* 0x60c and 0x6bf (WiMAX Edition) have been assigned but are not
1405      * used by some older versions of the bootloader and 5555 is used
1406      * instead (including versions that shipped with many devices).  */
1407     .board_id = 0x60c,
1408     .atag_board = n810_atag_setup,
1409 };
1410 
1411 static void n800_init(MachineState *machine)
1412 {
1413     n8x0_init(machine, &n800_binfo, 800);
1414 }
1415 
1416 static void n810_init(MachineState *machine)
1417 {
1418     n8x0_init(machine, &n810_binfo, 810);
1419 }
1420 
1421 static void n800_class_init(ObjectClass *oc, void *data)
1422 {
1423     MachineClass *mc = MACHINE_CLASS(oc);
1424 
1425     mc->desc = "Nokia N800 tablet aka. RX-34 (OMAP2420)";
1426     mc->init = n800_init;
1427     mc->default_boot_order = "";
1428     mc->ignore_memory_transaction_failures = true;
1429     mc->default_cpu_type = ARM_CPU_TYPE_NAME("arm1136-r2");
1430     /* Actually two chips of 0x4000000 bytes each */
1431     mc->default_ram_size = 0x08000000;
1432     mc->default_ram_id = "omap2.dram";
1433 }
1434 
1435 static const TypeInfo n800_type = {
1436     .name = MACHINE_TYPE_NAME("n800"),
1437     .parent = TYPE_MACHINE,
1438     .class_init = n800_class_init,
1439 };
1440 
1441 static void n810_class_init(ObjectClass *oc, void *data)
1442 {
1443     MachineClass *mc = MACHINE_CLASS(oc);
1444 
1445     mc->desc = "Nokia N810 tablet aka. RX-44 (OMAP2420)";
1446     mc->init = n810_init;
1447     mc->default_boot_order = "";
1448     mc->ignore_memory_transaction_failures = true;
1449     mc->default_cpu_type = ARM_CPU_TYPE_NAME("arm1136-r2");
1450     /* Actually two chips of 0x4000000 bytes each */
1451     mc->default_ram_size = 0x08000000;
1452     mc->default_ram_id = "omap2.dram";
1453 }
1454 
1455 static const TypeInfo n810_type = {
1456     .name = MACHINE_TYPE_NAME("n810"),
1457     .parent = TYPE_MACHINE,
1458     .class_init = n810_class_init,
1459 };
1460 
1461 static void nseries_machine_init(void)
1462 {
1463     type_register_static(&n800_type);
1464     type_register_static(&n810_type);
1465 }
1466 
1467 type_init(nseries_machine_init)
1468