xref: /openbmc/qemu/hw/arm/pxa2xx.c (revision 37677d7d)
1 /*
2  * Intel XScale PXA255/270 processor support.
3  *
4  * Copyright (c) 2006 Openedhand Ltd.
5  * Written by Andrzej Zaborowski <balrog@zabor.org>
6  *
7  * This code is licensed under the GPL.
8  */
9 
10 #include "qemu/osdep.h"
11 #include "qemu-common.h"
12 #include "qemu/error-report.h"
13 #include "qemu/module.h"
14 #include "qapi/error.h"
15 #include "cpu.h"
16 #include "hw/sysbus.h"
17 #include "hw/arm/pxa.h"
18 #include "sysemu/sysemu.h"
19 #include "hw/char/serial.h"
20 #include "hw/i2c/i2c.h"
21 #include "hw/ssi/ssi.h"
22 #include "chardev/char-fe.h"
23 #include "sysemu/blockdev.h"
24 #include "sysemu/qtest.h"
25 #include "qemu/cutils.h"
26 
27 static struct {
28     hwaddr io_base;
29     int irqn;
30 } pxa255_serial[] = {
31     { 0x40100000, PXA2XX_PIC_FFUART },
32     { 0x40200000, PXA2XX_PIC_BTUART },
33     { 0x40700000, PXA2XX_PIC_STUART },
34     { 0x41600000, PXA25X_PIC_HWUART },
35     { 0, 0 }
36 }, pxa270_serial[] = {
37     { 0x40100000, PXA2XX_PIC_FFUART },
38     { 0x40200000, PXA2XX_PIC_BTUART },
39     { 0x40700000, PXA2XX_PIC_STUART },
40     { 0, 0 }
41 };
42 
43 typedef struct PXASSPDef {
44     hwaddr io_base;
45     int irqn;
46 } PXASSPDef;
47 
48 #if 0
49 static PXASSPDef pxa250_ssp[] = {
50     { 0x41000000, PXA2XX_PIC_SSP },
51     { 0, 0 }
52 };
53 #endif
54 
55 static PXASSPDef pxa255_ssp[] = {
56     { 0x41000000, PXA2XX_PIC_SSP },
57     { 0x41400000, PXA25X_PIC_NSSP },
58     { 0, 0 }
59 };
60 
61 #if 0
62 static PXASSPDef pxa26x_ssp[] = {
63     { 0x41000000, PXA2XX_PIC_SSP },
64     { 0x41400000, PXA25X_PIC_NSSP },
65     { 0x41500000, PXA26X_PIC_ASSP },
66     { 0, 0 }
67 };
68 #endif
69 
70 static PXASSPDef pxa27x_ssp[] = {
71     { 0x41000000, PXA2XX_PIC_SSP },
72     { 0x41700000, PXA27X_PIC_SSP2 },
73     { 0x41900000, PXA2XX_PIC_SSP3 },
74     { 0, 0 }
75 };
76 
77 #define PMCR	0x00	/* Power Manager Control register */
78 #define PSSR	0x04	/* Power Manager Sleep Status register */
79 #define PSPR	0x08	/* Power Manager Scratch-Pad register */
80 #define PWER	0x0c	/* Power Manager Wake-Up Enable register */
81 #define PRER	0x10	/* Power Manager Rising-Edge Detect Enable register */
82 #define PFER	0x14	/* Power Manager Falling-Edge Detect Enable register */
83 #define PEDR	0x18	/* Power Manager Edge-Detect Status register */
84 #define PCFR	0x1c	/* Power Manager General Configuration register */
85 #define PGSR0	0x20	/* Power Manager GPIO Sleep-State register 0 */
86 #define PGSR1	0x24	/* Power Manager GPIO Sleep-State register 1 */
87 #define PGSR2	0x28	/* Power Manager GPIO Sleep-State register 2 */
88 #define PGSR3	0x2c	/* Power Manager GPIO Sleep-State register 3 */
89 #define RCSR	0x30	/* Reset Controller Status register */
90 #define PSLR	0x34	/* Power Manager Sleep Configuration register */
91 #define PTSR	0x38	/* Power Manager Standby Configuration register */
92 #define PVCR	0x40	/* Power Manager Voltage Change Control register */
93 #define PUCR	0x4c	/* Power Manager USIM Card Control/Status register */
94 #define PKWR	0x50	/* Power Manager Keyboard Wake-Up Enable register */
95 #define PKSR	0x54	/* Power Manager Keyboard Level-Detect Status */
96 #define PCMD0	0x80	/* Power Manager I2C Command register File 0 */
97 #define PCMD31	0xfc	/* Power Manager I2C Command register File 31 */
98 
99 static uint64_t pxa2xx_pm_read(void *opaque, hwaddr addr,
100                                unsigned size)
101 {
102     PXA2xxState *s = (PXA2xxState *) opaque;
103 
104     switch (addr) {
105     case PMCR ... PCMD31:
106         if (addr & 3)
107             goto fail;
108 
109         return s->pm_regs[addr >> 2];
110     default:
111     fail:
112         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
113         break;
114     }
115     return 0;
116 }
117 
118 static void pxa2xx_pm_write(void *opaque, hwaddr addr,
119                             uint64_t value, unsigned size)
120 {
121     PXA2xxState *s = (PXA2xxState *) opaque;
122 
123     switch (addr) {
124     case PMCR:
125         /* Clear the write-one-to-clear bits... */
126         s->pm_regs[addr >> 2] &= ~(value & 0x2a);
127         /* ...and set the plain r/w bits */
128         s->pm_regs[addr >> 2] &= ~0x15;
129         s->pm_regs[addr >> 2] |= value & 0x15;
130         break;
131 
132     case PSSR:	/* Read-clean registers */
133     case RCSR:
134     case PKSR:
135         s->pm_regs[addr >> 2] &= ~value;
136         break;
137 
138     default:	/* Read-write registers */
139         if (!(addr & 3)) {
140             s->pm_regs[addr >> 2] = value;
141             break;
142         }
143 
144         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
145         break;
146     }
147 }
148 
149 static const MemoryRegionOps pxa2xx_pm_ops = {
150     .read = pxa2xx_pm_read,
151     .write = pxa2xx_pm_write,
152     .endianness = DEVICE_NATIVE_ENDIAN,
153 };
154 
155 static const VMStateDescription vmstate_pxa2xx_pm = {
156     .name = "pxa2xx_pm",
157     .version_id = 0,
158     .minimum_version_id = 0,
159     .fields = (VMStateField[]) {
160         VMSTATE_UINT32_ARRAY(pm_regs, PXA2xxState, 0x40),
161         VMSTATE_END_OF_LIST()
162     }
163 };
164 
165 #define CCCR	0x00	/* Core Clock Configuration register */
166 #define CKEN	0x04	/* Clock Enable register */
167 #define OSCC	0x08	/* Oscillator Configuration register */
168 #define CCSR	0x0c	/* Core Clock Status register */
169 
170 static uint64_t pxa2xx_cm_read(void *opaque, hwaddr addr,
171                                unsigned size)
172 {
173     PXA2xxState *s = (PXA2xxState *) opaque;
174 
175     switch (addr) {
176     case CCCR:
177     case CKEN:
178     case OSCC:
179         return s->cm_regs[addr >> 2];
180 
181     case CCSR:
182         return s->cm_regs[CCCR >> 2] | (3 << 28);
183 
184     default:
185         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
186         break;
187     }
188     return 0;
189 }
190 
191 static void pxa2xx_cm_write(void *opaque, hwaddr addr,
192                             uint64_t value, unsigned size)
193 {
194     PXA2xxState *s = (PXA2xxState *) opaque;
195 
196     switch (addr) {
197     case CCCR:
198     case CKEN:
199         s->cm_regs[addr >> 2] = value;
200         break;
201 
202     case OSCC:
203         s->cm_regs[addr >> 2] &= ~0x6c;
204         s->cm_regs[addr >> 2] |= value & 0x6e;
205         if ((value >> 1) & 1)			/* OON */
206             s->cm_regs[addr >> 2] |= 1 << 0;	/* Oscillator is now stable */
207         break;
208 
209     default:
210         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
211         break;
212     }
213 }
214 
215 static const MemoryRegionOps pxa2xx_cm_ops = {
216     .read = pxa2xx_cm_read,
217     .write = pxa2xx_cm_write,
218     .endianness = DEVICE_NATIVE_ENDIAN,
219 };
220 
221 static const VMStateDescription vmstate_pxa2xx_cm = {
222     .name = "pxa2xx_cm",
223     .version_id = 0,
224     .minimum_version_id = 0,
225     .fields = (VMStateField[]) {
226         VMSTATE_UINT32_ARRAY(cm_regs, PXA2xxState, 4),
227         VMSTATE_UINT32(clkcfg, PXA2xxState),
228         VMSTATE_UINT32(pmnc, PXA2xxState),
229         VMSTATE_END_OF_LIST()
230     }
231 };
232 
233 static uint64_t pxa2xx_clkcfg_read(CPUARMState *env, const ARMCPRegInfo *ri)
234 {
235     PXA2xxState *s = (PXA2xxState *)ri->opaque;
236     return s->clkcfg;
237 }
238 
239 static void pxa2xx_clkcfg_write(CPUARMState *env, const ARMCPRegInfo *ri,
240                                 uint64_t value)
241 {
242     PXA2xxState *s = (PXA2xxState *)ri->opaque;
243     s->clkcfg = value & 0xf;
244     if (value & 2) {
245         printf("%s: CPU frequency change attempt\n", __func__);
246     }
247 }
248 
249 static void pxa2xx_pwrmode_write(CPUARMState *env, const ARMCPRegInfo *ri,
250                                  uint64_t value)
251 {
252     PXA2xxState *s = (PXA2xxState *)ri->opaque;
253     static const char *pwrmode[8] = {
254         "Normal", "Idle", "Deep-idle", "Standby",
255         "Sleep", "reserved (!)", "reserved (!)", "Deep-sleep",
256     };
257 
258     if (value & 8) {
259         printf("%s: CPU voltage change attempt\n", __func__);
260     }
261     switch (value & 7) {
262     case 0:
263         /* Do nothing */
264         break;
265 
266     case 1:
267         /* Idle */
268         if (!(s->cm_regs[CCCR >> 2] & (1U << 31))) { /* CPDIS */
269             cpu_interrupt(CPU(s->cpu), CPU_INTERRUPT_HALT);
270             break;
271         }
272         /* Fall through.  */
273 
274     case 2:
275         /* Deep-Idle */
276         cpu_interrupt(CPU(s->cpu), CPU_INTERRUPT_HALT);
277         s->pm_regs[RCSR >> 2] |= 0x8; /* Set GPR */
278         goto message;
279 
280     case 3:
281         s->cpu->env.uncached_cpsr = ARM_CPU_MODE_SVC;
282         s->cpu->env.daif = PSTATE_A | PSTATE_F | PSTATE_I;
283         s->cpu->env.cp15.sctlr_ns = 0;
284         s->cpu->env.cp15.cpacr_el1 = 0;
285         s->cpu->env.cp15.ttbr0_el[1] = 0;
286         s->cpu->env.cp15.dacr_ns = 0;
287         s->pm_regs[PSSR >> 2] |= 0x8; /* Set STS */
288         s->pm_regs[RCSR >> 2] |= 0x8; /* Set GPR */
289 
290         /*
291          * The scratch-pad register is almost universally used
292          * for storing the return address on suspend.  For the
293          * lack of a resuming bootloader, perform a jump
294          * directly to that address.
295          */
296         memset(s->cpu->env.regs, 0, 4 * 15);
297         s->cpu->env.regs[15] = s->pm_regs[PSPR >> 2];
298 
299 #if 0
300         buffer = 0xe59ff000; /* ldr     pc, [pc, #0] */
301         cpu_physical_memory_write(0, &buffer, 4);
302         buffer = s->pm_regs[PSPR >> 2];
303         cpu_physical_memory_write(8, &buffer, 4);
304 #endif
305 
306         /* Suspend */
307         cpu_interrupt(current_cpu, CPU_INTERRUPT_HALT);
308 
309         goto message;
310 
311     default:
312     message:
313         printf("%s: machine entered %s mode\n", __func__,
314                pwrmode[value & 7]);
315     }
316 }
317 
318 static uint64_t pxa2xx_cppmnc_read(CPUARMState *env, const ARMCPRegInfo *ri)
319 {
320     PXA2xxState *s = (PXA2xxState *)ri->opaque;
321     return s->pmnc;
322 }
323 
324 static void pxa2xx_cppmnc_write(CPUARMState *env, const ARMCPRegInfo *ri,
325                                 uint64_t value)
326 {
327     PXA2xxState *s = (PXA2xxState *)ri->opaque;
328     s->pmnc = value;
329 }
330 
331 static uint64_t pxa2xx_cpccnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
332 {
333     PXA2xxState *s = (PXA2xxState *)ri->opaque;
334     if (s->pmnc & 1) {
335         return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
336     } else {
337         return 0;
338     }
339 }
340 
341 static const ARMCPRegInfo pxa_cp_reginfo[] = {
342     /* cp14 crm==1: perf registers */
343     { .name = "CPPMNC", .cp = 14, .crn = 0, .crm = 1, .opc1 = 0, .opc2 = 0,
344       .access = PL1_RW, .type = ARM_CP_IO,
345       .readfn = pxa2xx_cppmnc_read, .writefn = pxa2xx_cppmnc_write },
346     { .name = "CPCCNT", .cp = 14, .crn = 1, .crm = 1, .opc1 = 0, .opc2 = 0,
347       .access = PL1_RW, .type = ARM_CP_IO,
348       .readfn = pxa2xx_cpccnt_read, .writefn = arm_cp_write_ignore },
349     { .name = "CPINTEN", .cp = 14, .crn = 4, .crm = 1, .opc1 = 0, .opc2 = 0,
350       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
351     { .name = "CPFLAG", .cp = 14, .crn = 5, .crm = 1, .opc1 = 0, .opc2 = 0,
352       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
353     { .name = "CPEVTSEL", .cp = 14, .crn = 8, .crm = 1, .opc1 = 0, .opc2 = 0,
354       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
355     /* cp14 crm==2: performance count registers */
356     { .name = "CPPMN0", .cp = 14, .crn = 0, .crm = 2, .opc1 = 0, .opc2 = 0,
357       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
358     { .name = "CPPMN1", .cp = 14, .crn = 1, .crm = 2, .opc1 = 0, .opc2 = 0,
359       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
360     { .name = "CPPMN2", .cp = 14, .crn = 2, .crm = 2, .opc1 = 0, .opc2 = 0,
361       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
362     { .name = "CPPMN3", .cp = 14, .crn = 2, .crm = 3, .opc1 = 0, .opc2 = 0,
363       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
364     /* cp14 crn==6: CLKCFG */
365     { .name = "CLKCFG", .cp = 14, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
366       .access = PL1_RW, .type = ARM_CP_IO,
367       .readfn = pxa2xx_clkcfg_read, .writefn = pxa2xx_clkcfg_write },
368     /* cp14 crn==7: PWRMODE */
369     { .name = "PWRMODE", .cp = 14, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 0,
370       .access = PL1_RW, .type = ARM_CP_IO,
371       .readfn = arm_cp_read_zero, .writefn = pxa2xx_pwrmode_write },
372     REGINFO_SENTINEL
373 };
374 
375 static void pxa2xx_setup_cp14(PXA2xxState *s)
376 {
377     define_arm_cp_regs_with_opaque(s->cpu, pxa_cp_reginfo, s);
378 }
379 
380 #define MDCNFG		0x00	/* SDRAM Configuration register */
381 #define MDREFR		0x04	/* SDRAM Refresh Control register */
382 #define MSC0		0x08	/* Static Memory Control register 0 */
383 #define MSC1		0x0c	/* Static Memory Control register 1 */
384 #define MSC2		0x10	/* Static Memory Control register 2 */
385 #define MECR		0x14	/* Expansion Memory Bus Config register */
386 #define SXCNFG		0x1c	/* Synchronous Static Memory Config register */
387 #define MCMEM0		0x28	/* PC Card Memory Socket 0 Timing register */
388 #define MCMEM1		0x2c	/* PC Card Memory Socket 1 Timing register */
389 #define MCATT0		0x30	/* PC Card Attribute Socket 0 register */
390 #define MCATT1		0x34	/* PC Card Attribute Socket 1 register */
391 #define MCIO0		0x38	/* PC Card I/O Socket 0 Timing register */
392 #define MCIO1		0x3c	/* PC Card I/O Socket 1 Timing register */
393 #define MDMRS		0x40	/* SDRAM Mode Register Set Config register */
394 #define BOOT_DEF	0x44	/* Boot-time Default Configuration register */
395 #define ARB_CNTL	0x48	/* Arbiter Control register */
396 #define BSCNTR0		0x4c	/* Memory Buffer Strength Control register 0 */
397 #define BSCNTR1		0x50	/* Memory Buffer Strength Control register 1 */
398 #define LCDBSCNTR	0x54	/* LCD Buffer Strength Control register */
399 #define MDMRSLP		0x58	/* Low Power SDRAM Mode Set Config register */
400 #define BSCNTR2		0x5c	/* Memory Buffer Strength Control register 2 */
401 #define BSCNTR3		0x60	/* Memory Buffer Strength Control register 3 */
402 #define SA1110		0x64	/* SA-1110 Memory Compatibility register */
403 
404 static uint64_t pxa2xx_mm_read(void *opaque, hwaddr addr,
405                                unsigned size)
406 {
407     PXA2xxState *s = (PXA2xxState *) opaque;
408 
409     switch (addr) {
410     case MDCNFG ... SA1110:
411         if ((addr & 3) == 0)
412             return s->mm_regs[addr >> 2];
413         /* fall through */
414     default:
415         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
416         break;
417     }
418     return 0;
419 }
420 
421 static void pxa2xx_mm_write(void *opaque, hwaddr addr,
422                             uint64_t value, unsigned size)
423 {
424     PXA2xxState *s = (PXA2xxState *) opaque;
425 
426     switch (addr) {
427     case MDCNFG ... SA1110:
428         if ((addr & 3) == 0) {
429             s->mm_regs[addr >> 2] = value;
430             break;
431         }
432 
433     default:
434         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
435         break;
436     }
437 }
438 
439 static const MemoryRegionOps pxa2xx_mm_ops = {
440     .read = pxa2xx_mm_read,
441     .write = pxa2xx_mm_write,
442     .endianness = DEVICE_NATIVE_ENDIAN,
443 };
444 
445 static const VMStateDescription vmstate_pxa2xx_mm = {
446     .name = "pxa2xx_mm",
447     .version_id = 0,
448     .minimum_version_id = 0,
449     .fields = (VMStateField[]) {
450         VMSTATE_UINT32_ARRAY(mm_regs, PXA2xxState, 0x1a),
451         VMSTATE_END_OF_LIST()
452     }
453 };
454 
455 #define TYPE_PXA2XX_SSP "pxa2xx-ssp"
456 #define PXA2XX_SSP(obj) \
457     OBJECT_CHECK(PXA2xxSSPState, (obj), TYPE_PXA2XX_SSP)
458 
459 /* Synchronous Serial Ports */
460 typedef struct {
461     /*< private >*/
462     SysBusDevice parent_obj;
463     /*< public >*/
464 
465     MemoryRegion iomem;
466     qemu_irq irq;
467     uint32_t enable;
468     SSIBus *bus;
469 
470     uint32_t sscr[2];
471     uint32_t sspsp;
472     uint32_t ssto;
473     uint32_t ssitr;
474     uint32_t sssr;
475     uint8_t sstsa;
476     uint8_t ssrsa;
477     uint8_t ssacd;
478 
479     uint32_t rx_fifo[16];
480     uint32_t rx_level;
481     uint32_t rx_start;
482 } PXA2xxSSPState;
483 
484 static bool pxa2xx_ssp_vmstate_validate(void *opaque, int version_id)
485 {
486     PXA2xxSSPState *s = opaque;
487 
488     return s->rx_start < sizeof(s->rx_fifo);
489 }
490 
491 static const VMStateDescription vmstate_pxa2xx_ssp = {
492     .name = "pxa2xx-ssp",
493     .version_id = 1,
494     .minimum_version_id = 1,
495     .fields = (VMStateField[]) {
496         VMSTATE_UINT32(enable, PXA2xxSSPState),
497         VMSTATE_UINT32_ARRAY(sscr, PXA2xxSSPState, 2),
498         VMSTATE_UINT32(sspsp, PXA2xxSSPState),
499         VMSTATE_UINT32(ssto, PXA2xxSSPState),
500         VMSTATE_UINT32(ssitr, PXA2xxSSPState),
501         VMSTATE_UINT32(sssr, PXA2xxSSPState),
502         VMSTATE_UINT8(sstsa, PXA2xxSSPState),
503         VMSTATE_UINT8(ssrsa, PXA2xxSSPState),
504         VMSTATE_UINT8(ssacd, PXA2xxSSPState),
505         VMSTATE_UINT32(rx_level, PXA2xxSSPState),
506         VMSTATE_UINT32(rx_start, PXA2xxSSPState),
507         VMSTATE_VALIDATE("fifo is 16 bytes", pxa2xx_ssp_vmstate_validate),
508         VMSTATE_UINT32_ARRAY(rx_fifo, PXA2xxSSPState, 16),
509         VMSTATE_END_OF_LIST()
510     }
511 };
512 
513 #define SSCR0	0x00	/* SSP Control register 0 */
514 #define SSCR1	0x04	/* SSP Control register 1 */
515 #define SSSR	0x08	/* SSP Status register */
516 #define SSITR	0x0c	/* SSP Interrupt Test register */
517 #define SSDR	0x10	/* SSP Data register */
518 #define SSTO	0x28	/* SSP Time-Out register */
519 #define SSPSP	0x2c	/* SSP Programmable Serial Protocol register */
520 #define SSTSA	0x30	/* SSP TX Time Slot Active register */
521 #define SSRSA	0x34	/* SSP RX Time Slot Active register */
522 #define SSTSS	0x38	/* SSP Time Slot Status register */
523 #define SSACD	0x3c	/* SSP Audio Clock Divider register */
524 
525 /* Bitfields for above registers */
526 #define SSCR0_SPI(x)	(((x) & 0x30) == 0x00)
527 #define SSCR0_SSP(x)	(((x) & 0x30) == 0x10)
528 #define SSCR0_UWIRE(x)	(((x) & 0x30) == 0x20)
529 #define SSCR0_PSP(x)	(((x) & 0x30) == 0x30)
530 #define SSCR0_SSE	(1 << 7)
531 #define SSCR0_RIM	(1 << 22)
532 #define SSCR0_TIM	(1 << 23)
533 #define SSCR0_MOD       (1U << 31)
534 #define SSCR0_DSS(x)	(((((x) >> 16) & 0x10) | ((x) & 0xf)) + 1)
535 #define SSCR1_RIE	(1 << 0)
536 #define SSCR1_TIE	(1 << 1)
537 #define SSCR1_LBM	(1 << 2)
538 #define SSCR1_MWDS	(1 << 5)
539 #define SSCR1_TFT(x)	((((x) >> 6) & 0xf) + 1)
540 #define SSCR1_RFT(x)	((((x) >> 10) & 0xf) + 1)
541 #define SSCR1_EFWR	(1 << 14)
542 #define SSCR1_PINTE	(1 << 18)
543 #define SSCR1_TINTE	(1 << 19)
544 #define SSCR1_RSRE	(1 << 20)
545 #define SSCR1_TSRE	(1 << 21)
546 #define SSCR1_EBCEI	(1 << 29)
547 #define SSITR_INT	(7 << 5)
548 #define SSSR_TNF	(1 << 2)
549 #define SSSR_RNE	(1 << 3)
550 #define SSSR_TFS	(1 << 5)
551 #define SSSR_RFS	(1 << 6)
552 #define SSSR_ROR	(1 << 7)
553 #define SSSR_PINT	(1 << 18)
554 #define SSSR_TINT	(1 << 19)
555 #define SSSR_EOC	(1 << 20)
556 #define SSSR_TUR	(1 << 21)
557 #define SSSR_BCE	(1 << 23)
558 #define SSSR_RW		0x00bc0080
559 
560 static void pxa2xx_ssp_int_update(PXA2xxSSPState *s)
561 {
562     int level = 0;
563 
564     level |= s->ssitr & SSITR_INT;
565     level |= (s->sssr & SSSR_BCE)  &&  (s->sscr[1] & SSCR1_EBCEI);
566     level |= (s->sssr & SSSR_TUR)  && !(s->sscr[0] & SSCR0_TIM);
567     level |= (s->sssr & SSSR_EOC)  &&  (s->sssr & (SSSR_TINT | SSSR_PINT));
568     level |= (s->sssr & SSSR_TINT) &&  (s->sscr[1] & SSCR1_TINTE);
569     level |= (s->sssr & SSSR_PINT) &&  (s->sscr[1] & SSCR1_PINTE);
570     level |= (s->sssr & SSSR_ROR)  && !(s->sscr[0] & SSCR0_RIM);
571     level |= (s->sssr & SSSR_RFS)  &&  (s->sscr[1] & SSCR1_RIE);
572     level |= (s->sssr & SSSR_TFS)  &&  (s->sscr[1] & SSCR1_TIE);
573     qemu_set_irq(s->irq, !!level);
574 }
575 
576 static void pxa2xx_ssp_fifo_update(PXA2xxSSPState *s)
577 {
578     s->sssr &= ~(0xf << 12);	/* Clear RFL */
579     s->sssr &= ~(0xf << 8);	/* Clear TFL */
580     s->sssr &= ~SSSR_TFS;
581     s->sssr &= ~SSSR_TNF;
582     if (s->enable) {
583         s->sssr |= ((s->rx_level - 1) & 0xf) << 12;
584         if (s->rx_level >= SSCR1_RFT(s->sscr[1]))
585             s->sssr |= SSSR_RFS;
586         else
587             s->sssr &= ~SSSR_RFS;
588         if (s->rx_level)
589             s->sssr |= SSSR_RNE;
590         else
591             s->sssr &= ~SSSR_RNE;
592         /* TX FIFO is never filled, so it is always in underrun
593            condition if SSP is enabled */
594         s->sssr |= SSSR_TFS;
595         s->sssr |= SSSR_TNF;
596     }
597 
598     pxa2xx_ssp_int_update(s);
599 }
600 
601 static uint64_t pxa2xx_ssp_read(void *opaque, hwaddr addr,
602                                 unsigned size)
603 {
604     PXA2xxSSPState *s = (PXA2xxSSPState *) opaque;
605     uint32_t retval;
606 
607     switch (addr) {
608     case SSCR0:
609         return s->sscr[0];
610     case SSCR1:
611         return s->sscr[1];
612     case SSPSP:
613         return s->sspsp;
614     case SSTO:
615         return s->ssto;
616     case SSITR:
617         return s->ssitr;
618     case SSSR:
619         return s->sssr | s->ssitr;
620     case SSDR:
621         if (!s->enable)
622             return 0xffffffff;
623         if (s->rx_level < 1) {
624             printf("%s: SSP Rx Underrun\n", __func__);
625             return 0xffffffff;
626         }
627         s->rx_level --;
628         retval = s->rx_fifo[s->rx_start ++];
629         s->rx_start &= 0xf;
630         pxa2xx_ssp_fifo_update(s);
631         return retval;
632     case SSTSA:
633         return s->sstsa;
634     case SSRSA:
635         return s->ssrsa;
636     case SSTSS:
637         return 0;
638     case SSACD:
639         return s->ssacd;
640     default:
641         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
642         break;
643     }
644     return 0;
645 }
646 
647 static void pxa2xx_ssp_write(void *opaque, hwaddr addr,
648                              uint64_t value64, unsigned size)
649 {
650     PXA2xxSSPState *s = (PXA2xxSSPState *) opaque;
651     uint32_t value = value64;
652 
653     switch (addr) {
654     case SSCR0:
655         s->sscr[0] = value & 0xc7ffffff;
656         s->enable = value & SSCR0_SSE;
657         if (value & SSCR0_MOD)
658             printf("%s: Attempt to use network mode\n", __func__);
659         if (s->enable && SSCR0_DSS(value) < 4)
660             printf("%s: Wrong data size: %i bits\n", __func__,
661                             SSCR0_DSS(value));
662         if (!(value & SSCR0_SSE)) {
663             s->sssr = 0;
664             s->ssitr = 0;
665             s->rx_level = 0;
666         }
667         pxa2xx_ssp_fifo_update(s);
668         break;
669 
670     case SSCR1:
671         s->sscr[1] = value;
672         if (value & (SSCR1_LBM | SSCR1_EFWR))
673             printf("%s: Attempt to use SSP test mode\n", __func__);
674         pxa2xx_ssp_fifo_update(s);
675         break;
676 
677     case SSPSP:
678         s->sspsp = value;
679         break;
680 
681     case SSTO:
682         s->ssto = value;
683         break;
684 
685     case SSITR:
686         s->ssitr = value & SSITR_INT;
687         pxa2xx_ssp_int_update(s);
688         break;
689 
690     case SSSR:
691         s->sssr &= ~(value & SSSR_RW);
692         pxa2xx_ssp_int_update(s);
693         break;
694 
695     case SSDR:
696         if (SSCR0_UWIRE(s->sscr[0])) {
697             if (s->sscr[1] & SSCR1_MWDS)
698                 value &= 0xffff;
699             else
700                 value &= 0xff;
701         } else
702             /* Note how 32bits overflow does no harm here */
703             value &= (1 << SSCR0_DSS(s->sscr[0])) - 1;
704 
705         /* Data goes from here to the Tx FIFO and is shifted out from
706          * there directly to the slave, no need to buffer it.
707          */
708         if (s->enable) {
709             uint32_t readval;
710             readval = ssi_transfer(s->bus, value);
711             if (s->rx_level < 0x10) {
712                 s->rx_fifo[(s->rx_start + s->rx_level ++) & 0xf] = readval;
713             } else {
714                 s->sssr |= SSSR_ROR;
715             }
716         }
717         pxa2xx_ssp_fifo_update(s);
718         break;
719 
720     case SSTSA:
721         s->sstsa = value;
722         break;
723 
724     case SSRSA:
725         s->ssrsa = value;
726         break;
727 
728     case SSACD:
729         s->ssacd = value;
730         break;
731 
732     default:
733         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
734         break;
735     }
736 }
737 
738 static const MemoryRegionOps pxa2xx_ssp_ops = {
739     .read = pxa2xx_ssp_read,
740     .write = pxa2xx_ssp_write,
741     .endianness = DEVICE_NATIVE_ENDIAN,
742 };
743 
744 static void pxa2xx_ssp_reset(DeviceState *d)
745 {
746     PXA2xxSSPState *s = PXA2XX_SSP(d);
747 
748     s->enable = 0;
749     s->sscr[0] = s->sscr[1] = 0;
750     s->sspsp = 0;
751     s->ssto = 0;
752     s->ssitr = 0;
753     s->sssr = 0;
754     s->sstsa = 0;
755     s->ssrsa = 0;
756     s->ssacd = 0;
757     s->rx_start = s->rx_level = 0;
758 }
759 
760 static void pxa2xx_ssp_init(Object *obj)
761 {
762     DeviceState *dev = DEVICE(obj);
763     PXA2xxSSPState *s = PXA2XX_SSP(obj);
764     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
765     sysbus_init_irq(sbd, &s->irq);
766 
767     memory_region_init_io(&s->iomem, obj, &pxa2xx_ssp_ops, s,
768                           "pxa2xx-ssp", 0x1000);
769     sysbus_init_mmio(sbd, &s->iomem);
770 
771     s->bus = ssi_create_bus(dev, "ssi");
772 }
773 
774 /* Real-Time Clock */
775 #define RCNR		0x00	/* RTC Counter register */
776 #define RTAR		0x04	/* RTC Alarm register */
777 #define RTSR		0x08	/* RTC Status register */
778 #define RTTR		0x0c	/* RTC Timer Trim register */
779 #define RDCR		0x10	/* RTC Day Counter register */
780 #define RYCR		0x14	/* RTC Year Counter register */
781 #define RDAR1		0x18	/* RTC Wristwatch Day Alarm register 1 */
782 #define RYAR1		0x1c	/* RTC Wristwatch Year Alarm register 1 */
783 #define RDAR2		0x20	/* RTC Wristwatch Day Alarm register 2 */
784 #define RYAR2		0x24	/* RTC Wristwatch Year Alarm register 2 */
785 #define SWCR		0x28	/* RTC Stopwatch Counter register */
786 #define SWAR1		0x2c	/* RTC Stopwatch Alarm register 1 */
787 #define SWAR2		0x30	/* RTC Stopwatch Alarm register 2 */
788 #define RTCPICR		0x34	/* RTC Periodic Interrupt Counter register */
789 #define PIAR		0x38	/* RTC Periodic Interrupt Alarm register */
790 
791 #define TYPE_PXA2XX_RTC "pxa2xx_rtc"
792 #define PXA2XX_RTC(obj) \
793     OBJECT_CHECK(PXA2xxRTCState, (obj), TYPE_PXA2XX_RTC)
794 
795 typedef struct {
796     /*< private >*/
797     SysBusDevice parent_obj;
798     /*< public >*/
799 
800     MemoryRegion iomem;
801     uint32_t rttr;
802     uint32_t rtsr;
803     uint32_t rtar;
804     uint32_t rdar1;
805     uint32_t rdar2;
806     uint32_t ryar1;
807     uint32_t ryar2;
808     uint32_t swar1;
809     uint32_t swar2;
810     uint32_t piar;
811     uint32_t last_rcnr;
812     uint32_t last_rdcr;
813     uint32_t last_rycr;
814     uint32_t last_swcr;
815     uint32_t last_rtcpicr;
816     int64_t last_hz;
817     int64_t last_sw;
818     int64_t last_pi;
819     QEMUTimer *rtc_hz;
820     QEMUTimer *rtc_rdal1;
821     QEMUTimer *rtc_rdal2;
822     QEMUTimer *rtc_swal1;
823     QEMUTimer *rtc_swal2;
824     QEMUTimer *rtc_pi;
825     qemu_irq rtc_irq;
826 } PXA2xxRTCState;
827 
828 static inline void pxa2xx_rtc_int_update(PXA2xxRTCState *s)
829 {
830     qemu_set_irq(s->rtc_irq, !!(s->rtsr & 0x2553));
831 }
832 
833 static void pxa2xx_rtc_hzupdate(PXA2xxRTCState *s)
834 {
835     int64_t rt = qemu_clock_get_ms(rtc_clock);
836     s->last_rcnr += ((rt - s->last_hz) << 15) /
837             (1000 * ((s->rttr & 0xffff) + 1));
838     s->last_rdcr += ((rt - s->last_hz) << 15) /
839             (1000 * ((s->rttr & 0xffff) + 1));
840     s->last_hz = rt;
841 }
842 
843 static void pxa2xx_rtc_swupdate(PXA2xxRTCState *s)
844 {
845     int64_t rt = qemu_clock_get_ms(rtc_clock);
846     if (s->rtsr & (1 << 12))
847         s->last_swcr += (rt - s->last_sw) / 10;
848     s->last_sw = rt;
849 }
850 
851 static void pxa2xx_rtc_piupdate(PXA2xxRTCState *s)
852 {
853     int64_t rt = qemu_clock_get_ms(rtc_clock);
854     if (s->rtsr & (1 << 15))
855         s->last_swcr += rt - s->last_pi;
856     s->last_pi = rt;
857 }
858 
859 static inline void pxa2xx_rtc_alarm_update(PXA2xxRTCState *s,
860                 uint32_t rtsr)
861 {
862     if ((rtsr & (1 << 2)) && !(rtsr & (1 << 0)))
863         timer_mod(s->rtc_hz, s->last_hz +
864                 (((s->rtar - s->last_rcnr) * 1000 *
865                   ((s->rttr & 0xffff) + 1)) >> 15));
866     else
867         timer_del(s->rtc_hz);
868 
869     if ((rtsr & (1 << 5)) && !(rtsr & (1 << 4)))
870         timer_mod(s->rtc_rdal1, s->last_hz +
871                 (((s->rdar1 - s->last_rdcr) * 1000 *
872                   ((s->rttr & 0xffff) + 1)) >> 15)); /* TODO: fixup */
873     else
874         timer_del(s->rtc_rdal1);
875 
876     if ((rtsr & (1 << 7)) && !(rtsr & (1 << 6)))
877         timer_mod(s->rtc_rdal2, s->last_hz +
878                 (((s->rdar2 - s->last_rdcr) * 1000 *
879                   ((s->rttr & 0xffff) + 1)) >> 15)); /* TODO: fixup */
880     else
881         timer_del(s->rtc_rdal2);
882 
883     if ((rtsr & 0x1200) == 0x1200 && !(rtsr & (1 << 8)))
884         timer_mod(s->rtc_swal1, s->last_sw +
885                         (s->swar1 - s->last_swcr) * 10); /* TODO: fixup */
886     else
887         timer_del(s->rtc_swal1);
888 
889     if ((rtsr & 0x1800) == 0x1800 && !(rtsr & (1 << 10)))
890         timer_mod(s->rtc_swal2, s->last_sw +
891                         (s->swar2 - s->last_swcr) * 10); /* TODO: fixup */
892     else
893         timer_del(s->rtc_swal2);
894 
895     if ((rtsr & 0xc000) == 0xc000 && !(rtsr & (1 << 13)))
896         timer_mod(s->rtc_pi, s->last_pi +
897                         (s->piar & 0xffff) - s->last_rtcpicr);
898     else
899         timer_del(s->rtc_pi);
900 }
901 
902 static inline void pxa2xx_rtc_hz_tick(void *opaque)
903 {
904     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
905     s->rtsr |= (1 << 0);
906     pxa2xx_rtc_alarm_update(s, s->rtsr);
907     pxa2xx_rtc_int_update(s);
908 }
909 
910 static inline void pxa2xx_rtc_rdal1_tick(void *opaque)
911 {
912     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
913     s->rtsr |= (1 << 4);
914     pxa2xx_rtc_alarm_update(s, s->rtsr);
915     pxa2xx_rtc_int_update(s);
916 }
917 
918 static inline void pxa2xx_rtc_rdal2_tick(void *opaque)
919 {
920     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
921     s->rtsr |= (1 << 6);
922     pxa2xx_rtc_alarm_update(s, s->rtsr);
923     pxa2xx_rtc_int_update(s);
924 }
925 
926 static inline void pxa2xx_rtc_swal1_tick(void *opaque)
927 {
928     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
929     s->rtsr |= (1 << 8);
930     pxa2xx_rtc_alarm_update(s, s->rtsr);
931     pxa2xx_rtc_int_update(s);
932 }
933 
934 static inline void pxa2xx_rtc_swal2_tick(void *opaque)
935 {
936     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
937     s->rtsr |= (1 << 10);
938     pxa2xx_rtc_alarm_update(s, s->rtsr);
939     pxa2xx_rtc_int_update(s);
940 }
941 
942 static inline void pxa2xx_rtc_pi_tick(void *opaque)
943 {
944     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
945     s->rtsr |= (1 << 13);
946     pxa2xx_rtc_piupdate(s);
947     s->last_rtcpicr = 0;
948     pxa2xx_rtc_alarm_update(s, s->rtsr);
949     pxa2xx_rtc_int_update(s);
950 }
951 
952 static uint64_t pxa2xx_rtc_read(void *opaque, hwaddr addr,
953                                 unsigned size)
954 {
955     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
956 
957     switch (addr) {
958     case RTTR:
959         return s->rttr;
960     case RTSR:
961         return s->rtsr;
962     case RTAR:
963         return s->rtar;
964     case RDAR1:
965         return s->rdar1;
966     case RDAR2:
967         return s->rdar2;
968     case RYAR1:
969         return s->ryar1;
970     case RYAR2:
971         return s->ryar2;
972     case SWAR1:
973         return s->swar1;
974     case SWAR2:
975         return s->swar2;
976     case PIAR:
977         return s->piar;
978     case RCNR:
979         return s->last_rcnr +
980             ((qemu_clock_get_ms(rtc_clock) - s->last_hz) << 15) /
981             (1000 * ((s->rttr & 0xffff) + 1));
982     case RDCR:
983         return s->last_rdcr +
984             ((qemu_clock_get_ms(rtc_clock) - s->last_hz) << 15) /
985             (1000 * ((s->rttr & 0xffff) + 1));
986     case RYCR:
987         return s->last_rycr;
988     case SWCR:
989         if (s->rtsr & (1 << 12))
990             return s->last_swcr +
991                 (qemu_clock_get_ms(rtc_clock) - s->last_sw) / 10;
992         else
993             return s->last_swcr;
994     default:
995         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
996         break;
997     }
998     return 0;
999 }
1000 
1001 static void pxa2xx_rtc_write(void *opaque, hwaddr addr,
1002                              uint64_t value64, unsigned size)
1003 {
1004     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
1005     uint32_t value = value64;
1006 
1007     switch (addr) {
1008     case RTTR:
1009         if (!(s->rttr & (1U << 31))) {
1010             pxa2xx_rtc_hzupdate(s);
1011             s->rttr = value;
1012             pxa2xx_rtc_alarm_update(s, s->rtsr);
1013         }
1014         break;
1015 
1016     case RTSR:
1017         if ((s->rtsr ^ value) & (1 << 15))
1018             pxa2xx_rtc_piupdate(s);
1019 
1020         if ((s->rtsr ^ value) & (1 << 12))
1021             pxa2xx_rtc_swupdate(s);
1022 
1023         if (((s->rtsr ^ value) & 0x4aac) | (value & ~0xdaac))
1024             pxa2xx_rtc_alarm_update(s, value);
1025 
1026         s->rtsr = (value & 0xdaac) | (s->rtsr & ~(value & ~0xdaac));
1027         pxa2xx_rtc_int_update(s);
1028         break;
1029 
1030     case RTAR:
1031         s->rtar = value;
1032         pxa2xx_rtc_alarm_update(s, s->rtsr);
1033         break;
1034 
1035     case RDAR1:
1036         s->rdar1 = value;
1037         pxa2xx_rtc_alarm_update(s, s->rtsr);
1038         break;
1039 
1040     case RDAR2:
1041         s->rdar2 = value;
1042         pxa2xx_rtc_alarm_update(s, s->rtsr);
1043         break;
1044 
1045     case RYAR1:
1046         s->ryar1 = value;
1047         pxa2xx_rtc_alarm_update(s, s->rtsr);
1048         break;
1049 
1050     case RYAR2:
1051         s->ryar2 = value;
1052         pxa2xx_rtc_alarm_update(s, s->rtsr);
1053         break;
1054 
1055     case SWAR1:
1056         pxa2xx_rtc_swupdate(s);
1057         s->swar1 = value;
1058         s->last_swcr = 0;
1059         pxa2xx_rtc_alarm_update(s, s->rtsr);
1060         break;
1061 
1062     case SWAR2:
1063         s->swar2 = value;
1064         pxa2xx_rtc_alarm_update(s, s->rtsr);
1065         break;
1066 
1067     case PIAR:
1068         s->piar = value;
1069         pxa2xx_rtc_alarm_update(s, s->rtsr);
1070         break;
1071 
1072     case RCNR:
1073         pxa2xx_rtc_hzupdate(s);
1074         s->last_rcnr = value;
1075         pxa2xx_rtc_alarm_update(s, s->rtsr);
1076         break;
1077 
1078     case RDCR:
1079         pxa2xx_rtc_hzupdate(s);
1080         s->last_rdcr = value;
1081         pxa2xx_rtc_alarm_update(s, s->rtsr);
1082         break;
1083 
1084     case RYCR:
1085         s->last_rycr = value;
1086         break;
1087 
1088     case SWCR:
1089         pxa2xx_rtc_swupdate(s);
1090         s->last_swcr = value;
1091         pxa2xx_rtc_alarm_update(s, s->rtsr);
1092         break;
1093 
1094     case RTCPICR:
1095         pxa2xx_rtc_piupdate(s);
1096         s->last_rtcpicr = value & 0xffff;
1097         pxa2xx_rtc_alarm_update(s, s->rtsr);
1098         break;
1099 
1100     default:
1101         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
1102     }
1103 }
1104 
1105 static const MemoryRegionOps pxa2xx_rtc_ops = {
1106     .read = pxa2xx_rtc_read,
1107     .write = pxa2xx_rtc_write,
1108     .endianness = DEVICE_NATIVE_ENDIAN,
1109 };
1110 
1111 static void pxa2xx_rtc_init(Object *obj)
1112 {
1113     PXA2xxRTCState *s = PXA2XX_RTC(obj);
1114     SysBusDevice *dev = SYS_BUS_DEVICE(obj);
1115     struct tm tm;
1116     int wom;
1117 
1118     s->rttr = 0x7fff;
1119     s->rtsr = 0;
1120 
1121     qemu_get_timedate(&tm, 0);
1122     wom = ((tm.tm_mday - 1) / 7) + 1;
1123 
1124     s->last_rcnr = (uint32_t) mktimegm(&tm);
1125     s->last_rdcr = (wom << 20) | ((tm.tm_wday + 1) << 17) |
1126             (tm.tm_hour << 12) | (tm.tm_min << 6) | tm.tm_sec;
1127     s->last_rycr = ((tm.tm_year + 1900) << 9) |
1128             ((tm.tm_mon + 1) << 5) | tm.tm_mday;
1129     s->last_swcr = (tm.tm_hour << 19) |
1130             (tm.tm_min << 13) | (tm.tm_sec << 7);
1131     s->last_rtcpicr = 0;
1132     s->last_hz = s->last_sw = s->last_pi = qemu_clock_get_ms(rtc_clock);
1133 
1134     s->rtc_hz    = timer_new_ms(rtc_clock, pxa2xx_rtc_hz_tick,    s);
1135     s->rtc_rdal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal1_tick, s);
1136     s->rtc_rdal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal2_tick, s);
1137     s->rtc_swal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal1_tick, s);
1138     s->rtc_swal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal2_tick, s);
1139     s->rtc_pi    = timer_new_ms(rtc_clock, pxa2xx_rtc_pi_tick,    s);
1140 
1141     sysbus_init_irq(dev, &s->rtc_irq);
1142 
1143     memory_region_init_io(&s->iomem, obj, &pxa2xx_rtc_ops, s,
1144                           "pxa2xx-rtc", 0x10000);
1145     sysbus_init_mmio(dev, &s->iomem);
1146 }
1147 
1148 static int pxa2xx_rtc_pre_save(void *opaque)
1149 {
1150     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
1151 
1152     pxa2xx_rtc_hzupdate(s);
1153     pxa2xx_rtc_piupdate(s);
1154     pxa2xx_rtc_swupdate(s);
1155 
1156     return 0;
1157 }
1158 
1159 static int pxa2xx_rtc_post_load(void *opaque, int version_id)
1160 {
1161     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
1162 
1163     pxa2xx_rtc_alarm_update(s, s->rtsr);
1164 
1165     return 0;
1166 }
1167 
1168 static const VMStateDescription vmstate_pxa2xx_rtc_regs = {
1169     .name = "pxa2xx_rtc",
1170     .version_id = 0,
1171     .minimum_version_id = 0,
1172     .pre_save = pxa2xx_rtc_pre_save,
1173     .post_load = pxa2xx_rtc_post_load,
1174     .fields = (VMStateField[]) {
1175         VMSTATE_UINT32(rttr, PXA2xxRTCState),
1176         VMSTATE_UINT32(rtsr, PXA2xxRTCState),
1177         VMSTATE_UINT32(rtar, PXA2xxRTCState),
1178         VMSTATE_UINT32(rdar1, PXA2xxRTCState),
1179         VMSTATE_UINT32(rdar2, PXA2xxRTCState),
1180         VMSTATE_UINT32(ryar1, PXA2xxRTCState),
1181         VMSTATE_UINT32(ryar2, PXA2xxRTCState),
1182         VMSTATE_UINT32(swar1, PXA2xxRTCState),
1183         VMSTATE_UINT32(swar2, PXA2xxRTCState),
1184         VMSTATE_UINT32(piar, PXA2xxRTCState),
1185         VMSTATE_UINT32(last_rcnr, PXA2xxRTCState),
1186         VMSTATE_UINT32(last_rdcr, PXA2xxRTCState),
1187         VMSTATE_UINT32(last_rycr, PXA2xxRTCState),
1188         VMSTATE_UINT32(last_swcr, PXA2xxRTCState),
1189         VMSTATE_UINT32(last_rtcpicr, PXA2xxRTCState),
1190         VMSTATE_INT64(last_hz, PXA2xxRTCState),
1191         VMSTATE_INT64(last_sw, PXA2xxRTCState),
1192         VMSTATE_INT64(last_pi, PXA2xxRTCState),
1193         VMSTATE_END_OF_LIST(),
1194     },
1195 };
1196 
1197 static void pxa2xx_rtc_sysbus_class_init(ObjectClass *klass, void *data)
1198 {
1199     DeviceClass *dc = DEVICE_CLASS(klass);
1200 
1201     dc->desc = "PXA2xx RTC Controller";
1202     dc->vmsd = &vmstate_pxa2xx_rtc_regs;
1203 }
1204 
1205 static const TypeInfo pxa2xx_rtc_sysbus_info = {
1206     .name          = TYPE_PXA2XX_RTC,
1207     .parent        = TYPE_SYS_BUS_DEVICE,
1208     .instance_size = sizeof(PXA2xxRTCState),
1209     .instance_init = pxa2xx_rtc_init,
1210     .class_init    = pxa2xx_rtc_sysbus_class_init,
1211 };
1212 
1213 /* I2C Interface */
1214 
1215 #define TYPE_PXA2XX_I2C_SLAVE "pxa2xx-i2c-slave"
1216 #define PXA2XX_I2C_SLAVE(obj) \
1217     OBJECT_CHECK(PXA2xxI2CSlaveState, (obj), TYPE_PXA2XX_I2C_SLAVE)
1218 
1219 typedef struct PXA2xxI2CSlaveState {
1220     I2CSlave parent_obj;
1221 
1222     PXA2xxI2CState *host;
1223 } PXA2xxI2CSlaveState;
1224 
1225 #define TYPE_PXA2XX_I2C "pxa2xx_i2c"
1226 #define PXA2XX_I2C(obj) \
1227     OBJECT_CHECK(PXA2xxI2CState, (obj), TYPE_PXA2XX_I2C)
1228 
1229 struct PXA2xxI2CState {
1230     /*< private >*/
1231     SysBusDevice parent_obj;
1232     /*< public >*/
1233 
1234     MemoryRegion iomem;
1235     PXA2xxI2CSlaveState *slave;
1236     I2CBus *bus;
1237     qemu_irq irq;
1238     uint32_t offset;
1239     uint32_t region_size;
1240 
1241     uint16_t control;
1242     uint16_t status;
1243     uint8_t ibmr;
1244     uint8_t data;
1245 };
1246 
1247 #define IBMR	0x80	/* I2C Bus Monitor register */
1248 #define IDBR	0x88	/* I2C Data Buffer register */
1249 #define ICR	0x90	/* I2C Control register */
1250 #define ISR	0x98	/* I2C Status register */
1251 #define ISAR	0xa0	/* I2C Slave Address register */
1252 
1253 static void pxa2xx_i2c_update(PXA2xxI2CState *s)
1254 {
1255     uint16_t level = 0;
1256     level |= s->status & s->control & (1 << 10);		/* BED */
1257     level |= (s->status & (1 << 7)) && (s->control & (1 << 9));	/* IRF */
1258     level |= (s->status & (1 << 6)) && (s->control & (1 << 8));	/* ITE */
1259     level |= s->status & (1 << 9);				/* SAD */
1260     qemu_set_irq(s->irq, !!level);
1261 }
1262 
1263 /* These are only stubs now.  */
1264 static int pxa2xx_i2c_event(I2CSlave *i2c, enum i2c_event event)
1265 {
1266     PXA2xxI2CSlaveState *slave = PXA2XX_I2C_SLAVE(i2c);
1267     PXA2xxI2CState *s = slave->host;
1268 
1269     switch (event) {
1270     case I2C_START_SEND:
1271         s->status |= (1 << 9);				/* set SAD */
1272         s->status &= ~(1 << 0);				/* clear RWM */
1273         break;
1274     case I2C_START_RECV:
1275         s->status |= (1 << 9);				/* set SAD */
1276         s->status |= 1 << 0;				/* set RWM */
1277         break;
1278     case I2C_FINISH:
1279         s->status |= (1 << 4);				/* set SSD */
1280         break;
1281     case I2C_NACK:
1282         s->status |= 1 << 1;				/* set ACKNAK */
1283         break;
1284     }
1285     pxa2xx_i2c_update(s);
1286 
1287     return 0;
1288 }
1289 
1290 static uint8_t pxa2xx_i2c_rx(I2CSlave *i2c)
1291 {
1292     PXA2xxI2CSlaveState *slave = PXA2XX_I2C_SLAVE(i2c);
1293     PXA2xxI2CState *s = slave->host;
1294 
1295     if ((s->control & (1 << 14)) || !(s->control & (1 << 6))) {
1296         return 0;
1297     }
1298 
1299     if (s->status & (1 << 0)) {			/* RWM */
1300         s->status |= 1 << 6;			/* set ITE */
1301     }
1302     pxa2xx_i2c_update(s);
1303 
1304     return s->data;
1305 }
1306 
1307 static int pxa2xx_i2c_tx(I2CSlave *i2c, uint8_t data)
1308 {
1309     PXA2xxI2CSlaveState *slave = PXA2XX_I2C_SLAVE(i2c);
1310     PXA2xxI2CState *s = slave->host;
1311 
1312     if ((s->control & (1 << 14)) || !(s->control & (1 << 6))) {
1313         return 1;
1314     }
1315 
1316     if (!(s->status & (1 << 0))) {		/* RWM */
1317         s->status |= 1 << 7;			/* set IRF */
1318         s->data = data;
1319     }
1320     pxa2xx_i2c_update(s);
1321 
1322     return 1;
1323 }
1324 
1325 static uint64_t pxa2xx_i2c_read(void *opaque, hwaddr addr,
1326                                 unsigned size)
1327 {
1328     PXA2xxI2CState *s = (PXA2xxI2CState *) opaque;
1329     I2CSlave *slave;
1330 
1331     addr -= s->offset;
1332     switch (addr) {
1333     case ICR:
1334         return s->control;
1335     case ISR:
1336         return s->status | (i2c_bus_busy(s->bus) << 2);
1337     case ISAR:
1338         slave = I2C_SLAVE(s->slave);
1339         return slave->address;
1340     case IDBR:
1341         return s->data;
1342     case IBMR:
1343         if (s->status & (1 << 2))
1344             s->ibmr ^= 3;	/* Fake SCL and SDA pin changes */
1345         else
1346             s->ibmr = 0;
1347         return s->ibmr;
1348     default:
1349         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
1350         break;
1351     }
1352     return 0;
1353 }
1354 
1355 static void pxa2xx_i2c_write(void *opaque, hwaddr addr,
1356                              uint64_t value64, unsigned size)
1357 {
1358     PXA2xxI2CState *s = (PXA2xxI2CState *) opaque;
1359     uint32_t value = value64;
1360     int ack;
1361 
1362     addr -= s->offset;
1363     switch (addr) {
1364     case ICR:
1365         s->control = value & 0xfff7;
1366         if ((value & (1 << 3)) && (value & (1 << 6))) {	/* TB and IUE */
1367             /* TODO: slave mode */
1368             if (value & (1 << 0)) {			/* START condition */
1369                 if (s->data & 1)
1370                     s->status |= 1 << 0;		/* set RWM */
1371                 else
1372                     s->status &= ~(1 << 0);		/* clear RWM */
1373                 ack = !i2c_start_transfer(s->bus, s->data >> 1, s->data & 1);
1374             } else {
1375                 if (s->status & (1 << 0)) {		/* RWM */
1376                     s->data = i2c_recv(s->bus);
1377                     if (value & (1 << 2))		/* ACKNAK */
1378                         i2c_nack(s->bus);
1379                     ack = 1;
1380                 } else
1381                     ack = !i2c_send(s->bus, s->data);
1382             }
1383 
1384             if (value & (1 << 1))			/* STOP condition */
1385                 i2c_end_transfer(s->bus);
1386 
1387             if (ack) {
1388                 if (value & (1 << 0))			/* START condition */
1389                     s->status |= 1 << 6;		/* set ITE */
1390                 else
1391                     if (s->status & (1 << 0))		/* RWM */
1392                         s->status |= 1 << 7;		/* set IRF */
1393                     else
1394                         s->status |= 1 << 6;		/* set ITE */
1395                 s->status &= ~(1 << 1);			/* clear ACKNAK */
1396             } else {
1397                 s->status |= 1 << 6;			/* set ITE */
1398                 s->status |= 1 << 10;			/* set BED */
1399                 s->status |= 1 << 1;			/* set ACKNAK */
1400             }
1401         }
1402         if (!(value & (1 << 3)) && (value & (1 << 6)))	/* !TB and IUE */
1403             if (value & (1 << 4))			/* MA */
1404                 i2c_end_transfer(s->bus);
1405         pxa2xx_i2c_update(s);
1406         break;
1407 
1408     case ISR:
1409         s->status &= ~(value & 0x07f0);
1410         pxa2xx_i2c_update(s);
1411         break;
1412 
1413     case ISAR:
1414         i2c_set_slave_address(I2C_SLAVE(s->slave), value & 0x7f);
1415         break;
1416 
1417     case IDBR:
1418         s->data = value & 0xff;
1419         break;
1420 
1421     default:
1422         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
1423     }
1424 }
1425 
1426 static const MemoryRegionOps pxa2xx_i2c_ops = {
1427     .read = pxa2xx_i2c_read,
1428     .write = pxa2xx_i2c_write,
1429     .endianness = DEVICE_NATIVE_ENDIAN,
1430 };
1431 
1432 static const VMStateDescription vmstate_pxa2xx_i2c_slave = {
1433     .name = "pxa2xx_i2c_slave",
1434     .version_id = 1,
1435     .minimum_version_id = 1,
1436     .fields = (VMStateField[]) {
1437         VMSTATE_I2C_SLAVE(parent_obj, PXA2xxI2CSlaveState),
1438         VMSTATE_END_OF_LIST()
1439     }
1440 };
1441 
1442 static const VMStateDescription vmstate_pxa2xx_i2c = {
1443     .name = "pxa2xx_i2c",
1444     .version_id = 1,
1445     .minimum_version_id = 1,
1446     .fields = (VMStateField[]) {
1447         VMSTATE_UINT16(control, PXA2xxI2CState),
1448         VMSTATE_UINT16(status, PXA2xxI2CState),
1449         VMSTATE_UINT8(ibmr, PXA2xxI2CState),
1450         VMSTATE_UINT8(data, PXA2xxI2CState),
1451         VMSTATE_STRUCT_POINTER(slave, PXA2xxI2CState,
1452                                vmstate_pxa2xx_i2c_slave, PXA2xxI2CSlaveState),
1453         VMSTATE_END_OF_LIST()
1454     }
1455 };
1456 
1457 static void pxa2xx_i2c_slave_class_init(ObjectClass *klass, void *data)
1458 {
1459     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
1460 
1461     k->event = pxa2xx_i2c_event;
1462     k->recv = pxa2xx_i2c_rx;
1463     k->send = pxa2xx_i2c_tx;
1464 }
1465 
1466 static const TypeInfo pxa2xx_i2c_slave_info = {
1467     .name          = TYPE_PXA2XX_I2C_SLAVE,
1468     .parent        = TYPE_I2C_SLAVE,
1469     .instance_size = sizeof(PXA2xxI2CSlaveState),
1470     .class_init    = pxa2xx_i2c_slave_class_init,
1471 };
1472 
1473 PXA2xxI2CState *pxa2xx_i2c_init(hwaddr base,
1474                 qemu_irq irq, uint32_t region_size)
1475 {
1476     DeviceState *dev;
1477     SysBusDevice *i2c_dev;
1478     PXA2xxI2CState *s;
1479     I2CBus *i2cbus;
1480 
1481     dev = qdev_create(NULL, TYPE_PXA2XX_I2C);
1482     qdev_prop_set_uint32(dev, "size", region_size + 1);
1483     qdev_prop_set_uint32(dev, "offset", base & region_size);
1484     qdev_init_nofail(dev);
1485 
1486     i2c_dev = SYS_BUS_DEVICE(dev);
1487     sysbus_mmio_map(i2c_dev, 0, base & ~region_size);
1488     sysbus_connect_irq(i2c_dev, 0, irq);
1489 
1490     s = PXA2XX_I2C(i2c_dev);
1491     /* FIXME: Should the slave device really be on a separate bus?  */
1492     i2cbus = i2c_init_bus(dev, "dummy");
1493     dev = i2c_create_slave(i2cbus, TYPE_PXA2XX_I2C_SLAVE, 0);
1494     s->slave = PXA2XX_I2C_SLAVE(dev);
1495     s->slave->host = s;
1496 
1497     return s;
1498 }
1499 
1500 static void pxa2xx_i2c_initfn(Object *obj)
1501 {
1502     DeviceState *dev = DEVICE(obj);
1503     PXA2xxI2CState *s = PXA2XX_I2C(obj);
1504     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
1505 
1506     s->bus = i2c_init_bus(dev, NULL);
1507 
1508     memory_region_init_io(&s->iomem, obj, &pxa2xx_i2c_ops, s,
1509                           "pxa2xx-i2c", s->region_size);
1510     sysbus_init_mmio(sbd, &s->iomem);
1511     sysbus_init_irq(sbd, &s->irq);
1512 }
1513 
1514 I2CBus *pxa2xx_i2c_bus(PXA2xxI2CState *s)
1515 {
1516     return s->bus;
1517 }
1518 
1519 static Property pxa2xx_i2c_properties[] = {
1520     DEFINE_PROP_UINT32("size", PXA2xxI2CState, region_size, 0x10000),
1521     DEFINE_PROP_UINT32("offset", PXA2xxI2CState, offset, 0),
1522     DEFINE_PROP_END_OF_LIST(),
1523 };
1524 
1525 static void pxa2xx_i2c_class_init(ObjectClass *klass, void *data)
1526 {
1527     DeviceClass *dc = DEVICE_CLASS(klass);
1528 
1529     dc->desc = "PXA2xx I2C Bus Controller";
1530     dc->vmsd = &vmstate_pxa2xx_i2c;
1531     dc->props = pxa2xx_i2c_properties;
1532 }
1533 
1534 static const TypeInfo pxa2xx_i2c_info = {
1535     .name          = TYPE_PXA2XX_I2C,
1536     .parent        = TYPE_SYS_BUS_DEVICE,
1537     .instance_size = sizeof(PXA2xxI2CState),
1538     .instance_init = pxa2xx_i2c_initfn,
1539     .class_init    = pxa2xx_i2c_class_init,
1540 };
1541 
1542 /* PXA Inter-IC Sound Controller */
1543 static void pxa2xx_i2s_reset(PXA2xxI2SState *i2s)
1544 {
1545     i2s->rx_len = 0;
1546     i2s->tx_len = 0;
1547     i2s->fifo_len = 0;
1548     i2s->clk = 0x1a;
1549     i2s->control[0] = 0x00;
1550     i2s->control[1] = 0x00;
1551     i2s->status = 0x00;
1552     i2s->mask = 0x00;
1553 }
1554 
1555 #define SACR_TFTH(val)	((val >> 8) & 0xf)
1556 #define SACR_RFTH(val)	((val >> 12) & 0xf)
1557 #define SACR_DREC(val)	(val & (1 << 3))
1558 #define SACR_DPRL(val)	(val & (1 << 4))
1559 
1560 static inline void pxa2xx_i2s_update(PXA2xxI2SState *i2s)
1561 {
1562     int rfs, tfs;
1563     rfs = SACR_RFTH(i2s->control[0]) < i2s->rx_len &&
1564             !SACR_DREC(i2s->control[1]);
1565     tfs = (i2s->tx_len || i2s->fifo_len < SACR_TFTH(i2s->control[0])) &&
1566             i2s->enable && !SACR_DPRL(i2s->control[1]);
1567 
1568     qemu_set_irq(i2s->rx_dma, rfs);
1569     qemu_set_irq(i2s->tx_dma, tfs);
1570 
1571     i2s->status &= 0xe0;
1572     if (i2s->fifo_len < 16 || !i2s->enable)
1573         i2s->status |= 1 << 0;			/* TNF */
1574     if (i2s->rx_len)
1575         i2s->status |= 1 << 1;			/* RNE */
1576     if (i2s->enable)
1577         i2s->status |= 1 << 2;			/* BSY */
1578     if (tfs)
1579         i2s->status |= 1 << 3;			/* TFS */
1580     if (rfs)
1581         i2s->status |= 1 << 4;			/* RFS */
1582     if (!(i2s->tx_len && i2s->enable))
1583         i2s->status |= i2s->fifo_len << 8;	/* TFL */
1584     i2s->status |= MAX(i2s->rx_len, 0xf) << 12;	/* RFL */
1585 
1586     qemu_set_irq(i2s->irq, i2s->status & i2s->mask);
1587 }
1588 
1589 #define SACR0	0x00	/* Serial Audio Global Control register */
1590 #define SACR1	0x04	/* Serial Audio I2S/MSB-Justified Control register */
1591 #define SASR0	0x0c	/* Serial Audio Interface and FIFO Status register */
1592 #define SAIMR	0x14	/* Serial Audio Interrupt Mask register */
1593 #define SAICR	0x18	/* Serial Audio Interrupt Clear register */
1594 #define SADIV	0x60	/* Serial Audio Clock Divider register */
1595 #define SADR	0x80	/* Serial Audio Data register */
1596 
1597 static uint64_t pxa2xx_i2s_read(void *opaque, hwaddr addr,
1598                                 unsigned size)
1599 {
1600     PXA2xxI2SState *s = (PXA2xxI2SState *) opaque;
1601 
1602     switch (addr) {
1603     case SACR0:
1604         return s->control[0];
1605     case SACR1:
1606         return s->control[1];
1607     case SASR0:
1608         return s->status;
1609     case SAIMR:
1610         return s->mask;
1611     case SAICR:
1612         return 0;
1613     case SADIV:
1614         return s->clk;
1615     case SADR:
1616         if (s->rx_len > 0) {
1617             s->rx_len --;
1618             pxa2xx_i2s_update(s);
1619             return s->codec_in(s->opaque);
1620         }
1621         return 0;
1622     default:
1623         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
1624         break;
1625     }
1626     return 0;
1627 }
1628 
1629 static void pxa2xx_i2s_write(void *opaque, hwaddr addr,
1630                              uint64_t value, unsigned size)
1631 {
1632     PXA2xxI2SState *s = (PXA2xxI2SState *) opaque;
1633     uint32_t *sample;
1634 
1635     switch (addr) {
1636     case SACR0:
1637         if (value & (1 << 3))				/* RST */
1638             pxa2xx_i2s_reset(s);
1639         s->control[0] = value & 0xff3d;
1640         if (!s->enable && (value & 1) && s->tx_len) {	/* ENB */
1641             for (sample = s->fifo; s->fifo_len > 0; s->fifo_len --, sample ++)
1642                 s->codec_out(s->opaque, *sample);
1643             s->status &= ~(1 << 7);			/* I2SOFF */
1644         }
1645         if (value & (1 << 4))				/* EFWR */
1646             printf("%s: Attempt to use special function\n", __func__);
1647         s->enable = (value & 9) == 1;			/* ENB && !RST*/
1648         pxa2xx_i2s_update(s);
1649         break;
1650     case SACR1:
1651         s->control[1] = value & 0x0039;
1652         if (value & (1 << 5))				/* ENLBF */
1653             printf("%s: Attempt to use loopback function\n", __func__);
1654         if (value & (1 << 4))				/* DPRL */
1655             s->fifo_len = 0;
1656         pxa2xx_i2s_update(s);
1657         break;
1658     case SAIMR:
1659         s->mask = value & 0x0078;
1660         pxa2xx_i2s_update(s);
1661         break;
1662     case SAICR:
1663         s->status &= ~(value & (3 << 5));
1664         pxa2xx_i2s_update(s);
1665         break;
1666     case SADIV:
1667         s->clk = value & 0x007f;
1668         break;
1669     case SADR:
1670         if (s->tx_len && s->enable) {
1671             s->tx_len --;
1672             pxa2xx_i2s_update(s);
1673             s->codec_out(s->opaque, value);
1674         } else if (s->fifo_len < 16) {
1675             s->fifo[s->fifo_len ++] = value;
1676             pxa2xx_i2s_update(s);
1677         }
1678         break;
1679     default:
1680         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
1681     }
1682 }
1683 
1684 static const MemoryRegionOps pxa2xx_i2s_ops = {
1685     .read = pxa2xx_i2s_read,
1686     .write = pxa2xx_i2s_write,
1687     .endianness = DEVICE_NATIVE_ENDIAN,
1688 };
1689 
1690 static const VMStateDescription vmstate_pxa2xx_i2s = {
1691     .name = "pxa2xx_i2s",
1692     .version_id = 0,
1693     .minimum_version_id = 0,
1694     .fields = (VMStateField[]) {
1695         VMSTATE_UINT32_ARRAY(control, PXA2xxI2SState, 2),
1696         VMSTATE_UINT32(status, PXA2xxI2SState),
1697         VMSTATE_UINT32(mask, PXA2xxI2SState),
1698         VMSTATE_UINT32(clk, PXA2xxI2SState),
1699         VMSTATE_INT32(enable, PXA2xxI2SState),
1700         VMSTATE_INT32(rx_len, PXA2xxI2SState),
1701         VMSTATE_INT32(tx_len, PXA2xxI2SState),
1702         VMSTATE_INT32(fifo_len, PXA2xxI2SState),
1703         VMSTATE_END_OF_LIST()
1704     }
1705 };
1706 
1707 static void pxa2xx_i2s_data_req(void *opaque, int tx, int rx)
1708 {
1709     PXA2xxI2SState *s = (PXA2xxI2SState *) opaque;
1710     uint32_t *sample;
1711 
1712     /* Signal FIFO errors */
1713     if (s->enable && s->tx_len)
1714         s->status |= 1 << 5;		/* TUR */
1715     if (s->enable && s->rx_len)
1716         s->status |= 1 << 6;		/* ROR */
1717 
1718     /* Should be tx - MIN(tx, s->fifo_len) but we don't really need to
1719      * handle the cases where it makes a difference.  */
1720     s->tx_len = tx - s->fifo_len;
1721     s->rx_len = rx;
1722     /* Note that is s->codec_out wasn't set, we wouldn't get called.  */
1723     if (s->enable)
1724         for (sample = s->fifo; s->fifo_len; s->fifo_len --, sample ++)
1725             s->codec_out(s->opaque, *sample);
1726     pxa2xx_i2s_update(s);
1727 }
1728 
1729 static PXA2xxI2SState *pxa2xx_i2s_init(MemoryRegion *sysmem,
1730                 hwaddr base,
1731                 qemu_irq irq, qemu_irq rx_dma, qemu_irq tx_dma)
1732 {
1733     PXA2xxI2SState *s = g_new0(PXA2xxI2SState, 1);
1734 
1735     s->irq = irq;
1736     s->rx_dma = rx_dma;
1737     s->tx_dma = tx_dma;
1738     s->data_req = pxa2xx_i2s_data_req;
1739 
1740     pxa2xx_i2s_reset(s);
1741 
1742     memory_region_init_io(&s->iomem, NULL, &pxa2xx_i2s_ops, s,
1743                           "pxa2xx-i2s", 0x100000);
1744     memory_region_add_subregion(sysmem, base, &s->iomem);
1745 
1746     vmstate_register(NULL, base, &vmstate_pxa2xx_i2s, s);
1747 
1748     return s;
1749 }
1750 
1751 /* PXA Fast Infra-red Communications Port */
1752 #define TYPE_PXA2XX_FIR "pxa2xx-fir"
1753 #define PXA2XX_FIR(obj) OBJECT_CHECK(PXA2xxFIrState, (obj), TYPE_PXA2XX_FIR)
1754 
1755 struct PXA2xxFIrState {
1756     /*< private >*/
1757     SysBusDevice parent_obj;
1758     /*< public >*/
1759 
1760     MemoryRegion iomem;
1761     qemu_irq irq;
1762     qemu_irq rx_dma;
1763     qemu_irq tx_dma;
1764     uint32_t enable;
1765     CharBackend chr;
1766 
1767     uint8_t control[3];
1768     uint8_t status[2];
1769 
1770     uint32_t rx_len;
1771     uint32_t rx_start;
1772     uint8_t rx_fifo[64];
1773 };
1774 
1775 static void pxa2xx_fir_reset(DeviceState *d)
1776 {
1777     PXA2xxFIrState *s = PXA2XX_FIR(d);
1778 
1779     s->control[0] = 0x00;
1780     s->control[1] = 0x00;
1781     s->control[2] = 0x00;
1782     s->status[0] = 0x00;
1783     s->status[1] = 0x00;
1784     s->enable = 0;
1785 }
1786 
1787 static inline void pxa2xx_fir_update(PXA2xxFIrState *s)
1788 {
1789     static const int tresh[4] = { 8, 16, 32, 0 };
1790     int intr = 0;
1791     if ((s->control[0] & (1 << 4)) &&			/* RXE */
1792                     s->rx_len >= tresh[s->control[2] & 3])	/* TRIG */
1793         s->status[0] |= 1 << 4;				/* RFS */
1794     else
1795         s->status[0] &= ~(1 << 4);			/* RFS */
1796     if (s->control[0] & (1 << 3))			/* TXE */
1797         s->status[0] |= 1 << 3;				/* TFS */
1798     else
1799         s->status[0] &= ~(1 << 3);			/* TFS */
1800     if (s->rx_len)
1801         s->status[1] |= 1 << 2;				/* RNE */
1802     else
1803         s->status[1] &= ~(1 << 2);			/* RNE */
1804     if (s->control[0] & (1 << 4))			/* RXE */
1805         s->status[1] |= 1 << 0;				/* RSY */
1806     else
1807         s->status[1] &= ~(1 << 0);			/* RSY */
1808 
1809     intr |= (s->control[0] & (1 << 5)) &&		/* RIE */
1810             (s->status[0] & (1 << 4));			/* RFS */
1811     intr |= (s->control[0] & (1 << 6)) &&		/* TIE */
1812             (s->status[0] & (1 << 3));			/* TFS */
1813     intr |= (s->control[2] & (1 << 4)) &&		/* TRAIL */
1814             (s->status[0] & (1 << 6));			/* EOC */
1815     intr |= (s->control[0] & (1 << 2)) &&		/* TUS */
1816             (s->status[0] & (1 << 1));			/* TUR */
1817     intr |= s->status[0] & 0x25;			/* FRE, RAB, EIF */
1818 
1819     qemu_set_irq(s->rx_dma, (s->status[0] >> 4) & 1);
1820     qemu_set_irq(s->tx_dma, (s->status[0] >> 3) & 1);
1821 
1822     qemu_set_irq(s->irq, intr && s->enable);
1823 }
1824 
1825 #define ICCR0	0x00	/* FICP Control register 0 */
1826 #define ICCR1	0x04	/* FICP Control register 1 */
1827 #define ICCR2	0x08	/* FICP Control register 2 */
1828 #define ICDR	0x0c	/* FICP Data register */
1829 #define ICSR0	0x14	/* FICP Status register 0 */
1830 #define ICSR1	0x18	/* FICP Status register 1 */
1831 #define ICFOR	0x1c	/* FICP FIFO Occupancy Status register */
1832 
1833 static uint64_t pxa2xx_fir_read(void *opaque, hwaddr addr,
1834                                 unsigned size)
1835 {
1836     PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1837     uint8_t ret;
1838 
1839     switch (addr) {
1840     case ICCR0:
1841         return s->control[0];
1842     case ICCR1:
1843         return s->control[1];
1844     case ICCR2:
1845         return s->control[2];
1846     case ICDR:
1847         s->status[0] &= ~0x01;
1848         s->status[1] &= ~0x72;
1849         if (s->rx_len) {
1850             s->rx_len --;
1851             ret = s->rx_fifo[s->rx_start ++];
1852             s->rx_start &= 63;
1853             pxa2xx_fir_update(s);
1854             return ret;
1855         }
1856         printf("%s: Rx FIFO underrun.\n", __func__);
1857         break;
1858     case ICSR0:
1859         return s->status[0];
1860     case ICSR1:
1861         return s->status[1] | (1 << 3);			/* TNF */
1862     case ICFOR:
1863         return s->rx_len;
1864     default:
1865         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
1866         break;
1867     }
1868     return 0;
1869 }
1870 
1871 static void pxa2xx_fir_write(void *opaque, hwaddr addr,
1872                              uint64_t value64, unsigned size)
1873 {
1874     PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1875     uint32_t value = value64;
1876     uint8_t ch;
1877 
1878     switch (addr) {
1879     case ICCR0:
1880         s->control[0] = value;
1881         if (!(value & (1 << 4)))			/* RXE */
1882             s->rx_len = s->rx_start = 0;
1883         if (!(value & (1 << 3))) {                      /* TXE */
1884             /* Nop */
1885         }
1886         s->enable = value & 1;				/* ITR */
1887         if (!s->enable)
1888             s->status[0] = 0;
1889         pxa2xx_fir_update(s);
1890         break;
1891     case ICCR1:
1892         s->control[1] = value;
1893         break;
1894     case ICCR2:
1895         s->control[2] = value & 0x3f;
1896         pxa2xx_fir_update(s);
1897         break;
1898     case ICDR:
1899         if (s->control[2] & (1 << 2)) { /* TXP */
1900             ch = value;
1901         } else {
1902             ch = ~value;
1903         }
1904         if (s->enable && (s->control[0] & (1 << 3))) { /* TXE */
1905             /* XXX this blocks entire thread. Rewrite to use
1906              * qemu_chr_fe_write and background I/O callbacks */
1907             qemu_chr_fe_write_all(&s->chr, &ch, 1);
1908         }
1909         break;
1910     case ICSR0:
1911         s->status[0] &= ~(value & 0x66);
1912         pxa2xx_fir_update(s);
1913         break;
1914     case ICFOR:
1915         break;
1916     default:
1917         printf("%s: Bad register " REG_FMT "\n", __func__, addr);
1918     }
1919 }
1920 
1921 static const MemoryRegionOps pxa2xx_fir_ops = {
1922     .read = pxa2xx_fir_read,
1923     .write = pxa2xx_fir_write,
1924     .endianness = DEVICE_NATIVE_ENDIAN,
1925 };
1926 
1927 static int pxa2xx_fir_is_empty(void *opaque)
1928 {
1929     PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1930     return (s->rx_len < 64);
1931 }
1932 
1933 static void pxa2xx_fir_rx(void *opaque, const uint8_t *buf, int size)
1934 {
1935     PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1936     if (!(s->control[0] & (1 << 4)))			/* RXE */
1937         return;
1938 
1939     while (size --) {
1940         s->status[1] |= 1 << 4;				/* EOF */
1941         if (s->rx_len >= 64) {
1942             s->status[1] |= 1 << 6;			/* ROR */
1943             break;
1944         }
1945 
1946         if (s->control[2] & (1 << 3))			/* RXP */
1947             s->rx_fifo[(s->rx_start + s->rx_len ++) & 63] = *(buf ++);
1948         else
1949             s->rx_fifo[(s->rx_start + s->rx_len ++) & 63] = ~*(buf ++);
1950     }
1951 
1952     pxa2xx_fir_update(s);
1953 }
1954 
1955 static void pxa2xx_fir_event(void *opaque, int event)
1956 {
1957 }
1958 
1959 static void pxa2xx_fir_instance_init(Object *obj)
1960 {
1961     PXA2xxFIrState *s = PXA2XX_FIR(obj);
1962     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
1963 
1964     memory_region_init_io(&s->iomem, obj, &pxa2xx_fir_ops, s,
1965                           "pxa2xx-fir", 0x1000);
1966     sysbus_init_mmio(sbd, &s->iomem);
1967     sysbus_init_irq(sbd, &s->irq);
1968     sysbus_init_irq(sbd, &s->rx_dma);
1969     sysbus_init_irq(sbd, &s->tx_dma);
1970 }
1971 
1972 static void pxa2xx_fir_realize(DeviceState *dev, Error **errp)
1973 {
1974     PXA2xxFIrState *s = PXA2XX_FIR(dev);
1975 
1976     qemu_chr_fe_set_handlers(&s->chr, pxa2xx_fir_is_empty,
1977                              pxa2xx_fir_rx, pxa2xx_fir_event, NULL, s, NULL,
1978                              true);
1979 }
1980 
1981 static bool pxa2xx_fir_vmstate_validate(void *opaque, int version_id)
1982 {
1983     PXA2xxFIrState *s = opaque;
1984 
1985     return s->rx_start < ARRAY_SIZE(s->rx_fifo);
1986 }
1987 
1988 static const VMStateDescription pxa2xx_fir_vmsd = {
1989     .name = "pxa2xx-fir",
1990     .version_id = 1,
1991     .minimum_version_id = 1,
1992     .fields = (VMStateField[]) {
1993         VMSTATE_UINT32(enable, PXA2xxFIrState),
1994         VMSTATE_UINT8_ARRAY(control, PXA2xxFIrState, 3),
1995         VMSTATE_UINT8_ARRAY(status, PXA2xxFIrState, 2),
1996         VMSTATE_UINT32(rx_len, PXA2xxFIrState),
1997         VMSTATE_UINT32(rx_start, PXA2xxFIrState),
1998         VMSTATE_VALIDATE("fifo is 64 bytes", pxa2xx_fir_vmstate_validate),
1999         VMSTATE_UINT8_ARRAY(rx_fifo, PXA2xxFIrState, 64),
2000         VMSTATE_END_OF_LIST()
2001     }
2002 };
2003 
2004 static Property pxa2xx_fir_properties[] = {
2005     DEFINE_PROP_CHR("chardev", PXA2xxFIrState, chr),
2006     DEFINE_PROP_END_OF_LIST(),
2007 };
2008 
2009 static void pxa2xx_fir_class_init(ObjectClass *klass, void *data)
2010 {
2011     DeviceClass *dc = DEVICE_CLASS(klass);
2012 
2013     dc->realize = pxa2xx_fir_realize;
2014     dc->vmsd = &pxa2xx_fir_vmsd;
2015     dc->props = pxa2xx_fir_properties;
2016     dc->reset = pxa2xx_fir_reset;
2017 }
2018 
2019 static const TypeInfo pxa2xx_fir_info = {
2020     .name = TYPE_PXA2XX_FIR,
2021     .parent = TYPE_SYS_BUS_DEVICE,
2022     .instance_size = sizeof(PXA2xxFIrState),
2023     .class_init = pxa2xx_fir_class_init,
2024     .instance_init = pxa2xx_fir_instance_init,
2025 };
2026 
2027 static PXA2xxFIrState *pxa2xx_fir_init(MemoryRegion *sysmem,
2028                                        hwaddr base,
2029                                        qemu_irq irq, qemu_irq rx_dma,
2030                                        qemu_irq tx_dma,
2031                                        Chardev *chr)
2032 {
2033     DeviceState *dev;
2034     SysBusDevice *sbd;
2035 
2036     dev = qdev_create(NULL, TYPE_PXA2XX_FIR);
2037     qdev_prop_set_chr(dev, "chardev", chr);
2038     qdev_init_nofail(dev);
2039     sbd = SYS_BUS_DEVICE(dev);
2040     sysbus_mmio_map(sbd, 0, base);
2041     sysbus_connect_irq(sbd, 0, irq);
2042     sysbus_connect_irq(sbd, 1, rx_dma);
2043     sysbus_connect_irq(sbd, 2, tx_dma);
2044     return PXA2XX_FIR(dev);
2045 }
2046 
2047 static void pxa2xx_reset(void *opaque, int line, int level)
2048 {
2049     PXA2xxState *s = (PXA2xxState *) opaque;
2050 
2051     if (level && (s->pm_regs[PCFR >> 2] & 0x10)) {	/* GPR_EN */
2052         cpu_reset(CPU(s->cpu));
2053         /* TODO: reset peripherals */
2054     }
2055 }
2056 
2057 /* Initialise a PXA270 integrated chip (ARM based core).  */
2058 PXA2xxState *pxa270_init(MemoryRegion *address_space,
2059                          unsigned int sdram_size, const char *cpu_type)
2060 {
2061     PXA2xxState *s;
2062     int i;
2063     DriveInfo *dinfo;
2064     s = g_new0(PXA2xxState, 1);
2065 
2066     if (strncmp(cpu_type, "pxa27", 5)) {
2067         error_report("Machine requires a PXA27x processor");
2068         exit(1);
2069     }
2070 
2071     s->cpu = ARM_CPU(cpu_create(cpu_type));
2072     s->reset = qemu_allocate_irq(pxa2xx_reset, s, 0);
2073 
2074     /* SDRAM & Internal Memory Storage */
2075     memory_region_init_ram(&s->sdram, NULL, "pxa270.sdram", sdram_size,
2076                            &error_fatal);
2077     memory_region_add_subregion(address_space, PXA2XX_SDRAM_BASE, &s->sdram);
2078     memory_region_init_ram(&s->internal, NULL, "pxa270.internal", 0x40000,
2079                            &error_fatal);
2080     memory_region_add_subregion(address_space, PXA2XX_INTERNAL_BASE,
2081                                 &s->internal);
2082 
2083     s->pic = pxa2xx_pic_init(0x40d00000, s->cpu);
2084 
2085     s->dma = pxa27x_dma_init(0x40000000,
2086                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_DMA));
2087 
2088     sysbus_create_varargs("pxa27x-timer", 0x40a00000,
2089                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 0),
2090                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 1),
2091                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 2),
2092                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 3),
2093                     qdev_get_gpio_in(s->pic, PXA27X_PIC_OST_4_11),
2094                     NULL);
2095 
2096     s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 121);
2097 
2098     dinfo = drive_get(IF_SD, 0, 0);
2099     if (!dinfo && !qtest_enabled()) {
2100         warn_report("missing SecureDigital device");
2101     }
2102     s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
2103                     dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
2104                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
2105                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
2106                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
2107 
2108     for (i = 0; pxa270_serial[i].io_base; i++) {
2109         if (serial_hd(i)) {
2110             serial_mm_init(address_space, pxa270_serial[i].io_base, 2,
2111                            qdev_get_gpio_in(s->pic, pxa270_serial[i].irqn),
2112                            14857000 / 16, serial_hd(i),
2113                            DEVICE_NATIVE_ENDIAN);
2114         } else {
2115             break;
2116         }
2117     }
2118     if (serial_hd(i))
2119         s->fir = pxa2xx_fir_init(address_space, 0x40800000,
2120                         qdev_get_gpio_in(s->pic, PXA2XX_PIC_ICP),
2121                         qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_ICP),
2122                         qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_ICP),
2123                         serial_hd(i));
2124 
2125     s->lcd = pxa2xx_lcdc_init(address_space, 0x44000000,
2126                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_LCD));
2127 
2128     s->cm_base = 0x41300000;
2129     s->cm_regs[CCCR >> 2] = 0x02000210;	/* 416.0 MHz */
2130     s->clkcfg = 0x00000009;		/* Turbo mode active */
2131     memory_region_init_io(&s->cm_iomem, NULL, &pxa2xx_cm_ops, s, "pxa2xx-cm", 0x1000);
2132     memory_region_add_subregion(address_space, s->cm_base, &s->cm_iomem);
2133     vmstate_register(NULL, 0, &vmstate_pxa2xx_cm, s);
2134 
2135     pxa2xx_setup_cp14(s);
2136 
2137     s->mm_base = 0x48000000;
2138     s->mm_regs[MDMRS >> 2] = 0x00020002;
2139     s->mm_regs[MDREFR >> 2] = 0x03ca4000;
2140     s->mm_regs[MECR >> 2] = 0x00000001;	/* Two PC Card sockets */
2141     memory_region_init_io(&s->mm_iomem, NULL, &pxa2xx_mm_ops, s, "pxa2xx-mm", 0x1000);
2142     memory_region_add_subregion(address_space, s->mm_base, &s->mm_iomem);
2143     vmstate_register(NULL, 0, &vmstate_pxa2xx_mm, s);
2144 
2145     s->pm_base = 0x40f00000;
2146     memory_region_init_io(&s->pm_iomem, NULL, &pxa2xx_pm_ops, s, "pxa2xx-pm", 0x100);
2147     memory_region_add_subregion(address_space, s->pm_base, &s->pm_iomem);
2148     vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
2149 
2150     for (i = 0; pxa27x_ssp[i].io_base; i ++);
2151     s->ssp = g_new0(SSIBus *, i);
2152     for (i = 0; pxa27x_ssp[i].io_base; i ++) {
2153         DeviceState *dev;
2154         dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa27x_ssp[i].io_base,
2155                         qdev_get_gpio_in(s->pic, pxa27x_ssp[i].irqn));
2156         s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
2157     }
2158 
2159     sysbus_create_simple("sysbus-ohci", 0x4c000000,
2160                          qdev_get_gpio_in(s->pic, PXA2XX_PIC_USBH1));
2161 
2162     s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
2163     s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
2164 
2165     sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000,
2166                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM));
2167 
2168     s->i2c[0] = pxa2xx_i2c_init(0x40301600,
2169                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2C), 0xffff);
2170     s->i2c[1] = pxa2xx_i2c_init(0x40f00100,
2171                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_PWRI2C), 0xff);
2172 
2173     s->i2s = pxa2xx_i2s_init(address_space, 0x40400000,
2174                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2S),
2175                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_I2S),
2176                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_I2S));
2177 
2178     s->kp = pxa27x_keypad_init(address_space, 0x41500000,
2179                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_KEYPAD));
2180 
2181     /* GPIO1 resets the processor */
2182     /* The handler can be overridden by board-specific code */
2183     qdev_connect_gpio_out(s->gpio, 1, s->reset);
2184     return s;
2185 }
2186 
2187 /* Initialise a PXA255 integrated chip (ARM based core).  */
2188 PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
2189 {
2190     PXA2xxState *s;
2191     int i;
2192     DriveInfo *dinfo;
2193 
2194     s = g_new0(PXA2xxState, 1);
2195 
2196     s->cpu = ARM_CPU(cpu_create(ARM_CPU_TYPE_NAME("pxa255")));
2197     s->reset = qemu_allocate_irq(pxa2xx_reset, s, 0);
2198 
2199     /* SDRAM & Internal Memory Storage */
2200     memory_region_init_ram(&s->sdram, NULL, "pxa255.sdram", sdram_size,
2201                            &error_fatal);
2202     memory_region_add_subregion(address_space, PXA2XX_SDRAM_BASE, &s->sdram);
2203     memory_region_init_ram(&s->internal, NULL, "pxa255.internal",
2204                            PXA2XX_INTERNAL_SIZE, &error_fatal);
2205     memory_region_add_subregion(address_space, PXA2XX_INTERNAL_BASE,
2206                                 &s->internal);
2207 
2208     s->pic = pxa2xx_pic_init(0x40d00000, s->cpu);
2209 
2210     s->dma = pxa255_dma_init(0x40000000,
2211                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_DMA));
2212 
2213     sysbus_create_varargs("pxa25x-timer", 0x40a00000,
2214                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 0),
2215                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 1),
2216                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 2),
2217                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 3),
2218                     NULL);
2219 
2220     s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 85);
2221 
2222     dinfo = drive_get(IF_SD, 0, 0);
2223     if (!dinfo && !qtest_enabled()) {
2224         warn_report("missing SecureDigital device");
2225     }
2226     s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
2227                     dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
2228                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
2229                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
2230                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
2231 
2232     for (i = 0; pxa255_serial[i].io_base; i++) {
2233         if (serial_hd(i)) {
2234             serial_mm_init(address_space, pxa255_serial[i].io_base, 2,
2235                            qdev_get_gpio_in(s->pic, pxa255_serial[i].irqn),
2236                            14745600 / 16, serial_hd(i),
2237                            DEVICE_NATIVE_ENDIAN);
2238         } else {
2239             break;
2240         }
2241     }
2242     if (serial_hd(i))
2243         s->fir = pxa2xx_fir_init(address_space, 0x40800000,
2244                         qdev_get_gpio_in(s->pic, PXA2XX_PIC_ICP),
2245                         qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_ICP),
2246                         qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_ICP),
2247                         serial_hd(i));
2248 
2249     s->lcd = pxa2xx_lcdc_init(address_space, 0x44000000,
2250                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_LCD));
2251 
2252     s->cm_base = 0x41300000;
2253     s->cm_regs[CCCR >> 2] = 0x00000121;         /* from datasheet */
2254     s->cm_regs[CKEN >> 2] = 0x00017def;         /* from datasheet */
2255 
2256     s->clkcfg = 0x00000009;		/* Turbo mode active */
2257     memory_region_init_io(&s->cm_iomem, NULL, &pxa2xx_cm_ops, s, "pxa2xx-cm", 0x1000);
2258     memory_region_add_subregion(address_space, s->cm_base, &s->cm_iomem);
2259     vmstate_register(NULL, 0, &vmstate_pxa2xx_cm, s);
2260 
2261     pxa2xx_setup_cp14(s);
2262 
2263     s->mm_base = 0x48000000;
2264     s->mm_regs[MDMRS >> 2] = 0x00020002;
2265     s->mm_regs[MDREFR >> 2] = 0x03ca4000;
2266     s->mm_regs[MECR >> 2] = 0x00000001;	/* Two PC Card sockets */
2267     memory_region_init_io(&s->mm_iomem, NULL, &pxa2xx_mm_ops, s, "pxa2xx-mm", 0x1000);
2268     memory_region_add_subregion(address_space, s->mm_base, &s->mm_iomem);
2269     vmstate_register(NULL, 0, &vmstate_pxa2xx_mm, s);
2270 
2271     s->pm_base = 0x40f00000;
2272     memory_region_init_io(&s->pm_iomem, NULL, &pxa2xx_pm_ops, s, "pxa2xx-pm", 0x100);
2273     memory_region_add_subregion(address_space, s->pm_base, &s->pm_iomem);
2274     vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
2275 
2276     for (i = 0; pxa255_ssp[i].io_base; i ++);
2277     s->ssp = g_new0(SSIBus *, i);
2278     for (i = 0; pxa255_ssp[i].io_base; i ++) {
2279         DeviceState *dev;
2280         dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa255_ssp[i].io_base,
2281                         qdev_get_gpio_in(s->pic, pxa255_ssp[i].irqn));
2282         s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
2283     }
2284 
2285     sysbus_create_simple("sysbus-ohci", 0x4c000000,
2286                          qdev_get_gpio_in(s->pic, PXA2XX_PIC_USBH1));
2287 
2288     s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
2289     s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
2290 
2291     sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000,
2292                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM));
2293 
2294     s->i2c[0] = pxa2xx_i2c_init(0x40301600,
2295                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2C), 0xffff);
2296     s->i2c[1] = pxa2xx_i2c_init(0x40f00100,
2297                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_PWRI2C), 0xff);
2298 
2299     s->i2s = pxa2xx_i2s_init(address_space, 0x40400000,
2300                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2S),
2301                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_I2S),
2302                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_I2S));
2303 
2304     /* GPIO1 resets the processor */
2305     /* The handler can be overridden by board-specific code */
2306     qdev_connect_gpio_out(s->gpio, 1, s->reset);
2307     return s;
2308 }
2309 
2310 static void pxa2xx_ssp_class_init(ObjectClass *klass, void *data)
2311 {
2312     DeviceClass *dc = DEVICE_CLASS(klass);
2313 
2314     dc->reset = pxa2xx_ssp_reset;
2315     dc->vmsd = &vmstate_pxa2xx_ssp;
2316 }
2317 
2318 static const TypeInfo pxa2xx_ssp_info = {
2319     .name          = TYPE_PXA2XX_SSP,
2320     .parent        = TYPE_SYS_BUS_DEVICE,
2321     .instance_size = sizeof(PXA2xxSSPState),
2322     .instance_init = pxa2xx_ssp_init,
2323     .class_init    = pxa2xx_ssp_class_init,
2324 };
2325 
2326 static void pxa2xx_register_types(void)
2327 {
2328     type_register_static(&pxa2xx_i2c_slave_info);
2329     type_register_static(&pxa2xx_ssp_info);
2330     type_register_static(&pxa2xx_i2c_info);
2331     type_register_static(&pxa2xx_rtc_sysbus_info);
2332     type_register_static(&pxa2xx_fir_info);
2333 }
2334 
2335 type_init(pxa2xx_register_types)
2336