xref: /openbmc/qemu/hw/arm/pxa2xx.c (revision bf957284)
1 /*
2  * Intel XScale PXA255/270 processor support.
3  *
4  * Copyright (c) 2006 Openedhand Ltd.
5  * Written by Andrzej Zaborowski <balrog@zabor.org>
6  *
7  * This code is licensed under the GPL.
8  */
9 
10 #include "hw/sysbus.h"
11 #include "hw/arm/pxa.h"
12 #include "sysemu/sysemu.h"
13 #include "hw/char/serial.h"
14 #include "hw/i2c/i2c.h"
15 #include "hw/ssi.h"
16 #include "sysemu/char.h"
17 #include "sysemu/block-backend.h"
18 #include "sysemu/blockdev.h"
19 
20 static struct {
21     hwaddr io_base;
22     int irqn;
23 } pxa255_serial[] = {
24     { 0x40100000, PXA2XX_PIC_FFUART },
25     { 0x40200000, PXA2XX_PIC_BTUART },
26     { 0x40700000, PXA2XX_PIC_STUART },
27     { 0x41600000, PXA25X_PIC_HWUART },
28     { 0, 0 }
29 }, pxa270_serial[] = {
30     { 0x40100000, PXA2XX_PIC_FFUART },
31     { 0x40200000, PXA2XX_PIC_BTUART },
32     { 0x40700000, PXA2XX_PIC_STUART },
33     { 0, 0 }
34 };
35 
36 typedef struct PXASSPDef {
37     hwaddr io_base;
38     int irqn;
39 } PXASSPDef;
40 
41 #if 0
42 static PXASSPDef pxa250_ssp[] = {
43     { 0x41000000, PXA2XX_PIC_SSP },
44     { 0, 0 }
45 };
46 #endif
47 
48 static PXASSPDef pxa255_ssp[] = {
49     { 0x41000000, PXA2XX_PIC_SSP },
50     { 0x41400000, PXA25X_PIC_NSSP },
51     { 0, 0 }
52 };
53 
54 #if 0
55 static PXASSPDef pxa26x_ssp[] = {
56     { 0x41000000, PXA2XX_PIC_SSP },
57     { 0x41400000, PXA25X_PIC_NSSP },
58     { 0x41500000, PXA26X_PIC_ASSP },
59     { 0, 0 }
60 };
61 #endif
62 
63 static PXASSPDef pxa27x_ssp[] = {
64     { 0x41000000, PXA2XX_PIC_SSP },
65     { 0x41700000, PXA27X_PIC_SSP2 },
66     { 0x41900000, PXA2XX_PIC_SSP3 },
67     { 0, 0 }
68 };
69 
70 #define PMCR	0x00	/* Power Manager Control register */
71 #define PSSR	0x04	/* Power Manager Sleep Status register */
72 #define PSPR	0x08	/* Power Manager Scratch-Pad register */
73 #define PWER	0x0c	/* Power Manager Wake-Up Enable register */
74 #define PRER	0x10	/* Power Manager Rising-Edge Detect Enable register */
75 #define PFER	0x14	/* Power Manager Falling-Edge Detect Enable register */
76 #define PEDR	0x18	/* Power Manager Edge-Detect Status register */
77 #define PCFR	0x1c	/* Power Manager General Configuration register */
78 #define PGSR0	0x20	/* Power Manager GPIO Sleep-State register 0 */
79 #define PGSR1	0x24	/* Power Manager GPIO Sleep-State register 1 */
80 #define PGSR2	0x28	/* Power Manager GPIO Sleep-State register 2 */
81 #define PGSR3	0x2c	/* Power Manager GPIO Sleep-State register 3 */
82 #define RCSR	0x30	/* Reset Controller Status register */
83 #define PSLR	0x34	/* Power Manager Sleep Configuration register */
84 #define PTSR	0x38	/* Power Manager Standby Configuration register */
85 #define PVCR	0x40	/* Power Manager Voltage Change Control register */
86 #define PUCR	0x4c	/* Power Manager USIM Card Control/Status register */
87 #define PKWR	0x50	/* Power Manager Keyboard Wake-Up Enable register */
88 #define PKSR	0x54	/* Power Manager Keyboard Level-Detect Status */
89 #define PCMD0	0x80	/* Power Manager I2C Command register File 0 */
90 #define PCMD31	0xfc	/* Power Manager I2C Command register File 31 */
91 
92 static uint64_t pxa2xx_pm_read(void *opaque, hwaddr addr,
93                                unsigned size)
94 {
95     PXA2xxState *s = (PXA2xxState *) opaque;
96 
97     switch (addr) {
98     case PMCR ... PCMD31:
99         if (addr & 3)
100             goto fail;
101 
102         return s->pm_regs[addr >> 2];
103     default:
104     fail:
105         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
106         break;
107     }
108     return 0;
109 }
110 
111 static void pxa2xx_pm_write(void *opaque, hwaddr addr,
112                             uint64_t value, unsigned size)
113 {
114     PXA2xxState *s = (PXA2xxState *) opaque;
115 
116     switch (addr) {
117     case PMCR:
118         /* Clear the write-one-to-clear bits... */
119         s->pm_regs[addr >> 2] &= ~(value & 0x2a);
120         /* ...and set the plain r/w bits */
121         s->pm_regs[addr >> 2] &= ~0x15;
122         s->pm_regs[addr >> 2] |= value & 0x15;
123         break;
124 
125     case PSSR:	/* Read-clean registers */
126     case RCSR:
127     case PKSR:
128         s->pm_regs[addr >> 2] &= ~value;
129         break;
130 
131     default:	/* Read-write registers */
132         if (!(addr & 3)) {
133             s->pm_regs[addr >> 2] = value;
134             break;
135         }
136 
137         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
138         break;
139     }
140 }
141 
142 static const MemoryRegionOps pxa2xx_pm_ops = {
143     .read = pxa2xx_pm_read,
144     .write = pxa2xx_pm_write,
145     .endianness = DEVICE_NATIVE_ENDIAN,
146 };
147 
148 static const VMStateDescription vmstate_pxa2xx_pm = {
149     .name = "pxa2xx_pm",
150     .version_id = 0,
151     .minimum_version_id = 0,
152     .fields = (VMStateField[]) {
153         VMSTATE_UINT32_ARRAY(pm_regs, PXA2xxState, 0x40),
154         VMSTATE_END_OF_LIST()
155     }
156 };
157 
158 #define CCCR	0x00	/* Core Clock Configuration register */
159 #define CKEN	0x04	/* Clock Enable register */
160 #define OSCC	0x08	/* Oscillator Configuration register */
161 #define CCSR	0x0c	/* Core Clock Status register */
162 
163 static uint64_t pxa2xx_cm_read(void *opaque, hwaddr addr,
164                                unsigned size)
165 {
166     PXA2xxState *s = (PXA2xxState *) opaque;
167 
168     switch (addr) {
169     case CCCR:
170     case CKEN:
171     case OSCC:
172         return s->cm_regs[addr >> 2];
173 
174     case CCSR:
175         return s->cm_regs[CCCR >> 2] | (3 << 28);
176 
177     default:
178         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
179         break;
180     }
181     return 0;
182 }
183 
184 static void pxa2xx_cm_write(void *opaque, hwaddr addr,
185                             uint64_t value, unsigned size)
186 {
187     PXA2xxState *s = (PXA2xxState *) opaque;
188 
189     switch (addr) {
190     case CCCR:
191     case CKEN:
192         s->cm_regs[addr >> 2] = value;
193         break;
194 
195     case OSCC:
196         s->cm_regs[addr >> 2] &= ~0x6c;
197         s->cm_regs[addr >> 2] |= value & 0x6e;
198         if ((value >> 1) & 1)			/* OON */
199             s->cm_regs[addr >> 2] |= 1 << 0;	/* Oscillator is now stable */
200         break;
201 
202     default:
203         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
204         break;
205     }
206 }
207 
208 static const MemoryRegionOps pxa2xx_cm_ops = {
209     .read = pxa2xx_cm_read,
210     .write = pxa2xx_cm_write,
211     .endianness = DEVICE_NATIVE_ENDIAN,
212 };
213 
214 static const VMStateDescription vmstate_pxa2xx_cm = {
215     .name = "pxa2xx_cm",
216     .version_id = 0,
217     .minimum_version_id = 0,
218     .fields = (VMStateField[]) {
219         VMSTATE_UINT32_ARRAY(cm_regs, PXA2xxState, 4),
220         VMSTATE_UINT32(clkcfg, PXA2xxState),
221         VMSTATE_UINT32(pmnc, PXA2xxState),
222         VMSTATE_END_OF_LIST()
223     }
224 };
225 
226 static uint64_t pxa2xx_clkcfg_read(CPUARMState *env, const ARMCPRegInfo *ri)
227 {
228     PXA2xxState *s = (PXA2xxState *)ri->opaque;
229     return s->clkcfg;
230 }
231 
232 static void pxa2xx_clkcfg_write(CPUARMState *env, const ARMCPRegInfo *ri,
233                                 uint64_t value)
234 {
235     PXA2xxState *s = (PXA2xxState *)ri->opaque;
236     s->clkcfg = value & 0xf;
237     if (value & 2) {
238         printf("%s: CPU frequency change attempt\n", __func__);
239     }
240 }
241 
242 static void pxa2xx_pwrmode_write(CPUARMState *env, const ARMCPRegInfo *ri,
243                                  uint64_t value)
244 {
245     PXA2xxState *s = (PXA2xxState *)ri->opaque;
246     static const char *pwrmode[8] = {
247         "Normal", "Idle", "Deep-idle", "Standby",
248         "Sleep", "reserved (!)", "reserved (!)", "Deep-sleep",
249     };
250 
251     if (value & 8) {
252         printf("%s: CPU voltage change attempt\n", __func__);
253     }
254     switch (value & 7) {
255     case 0:
256         /* Do nothing */
257         break;
258 
259     case 1:
260         /* Idle */
261         if (!(s->cm_regs[CCCR >> 2] & (1U << 31))) { /* CPDIS */
262             cpu_interrupt(CPU(s->cpu), CPU_INTERRUPT_HALT);
263             break;
264         }
265         /* Fall through.  */
266 
267     case 2:
268         /* Deep-Idle */
269         cpu_interrupt(CPU(s->cpu), CPU_INTERRUPT_HALT);
270         s->pm_regs[RCSR >> 2] |= 0x8; /* Set GPR */
271         goto message;
272 
273     case 3:
274         s->cpu->env.uncached_cpsr = ARM_CPU_MODE_SVC;
275         s->cpu->env.daif = PSTATE_A | PSTATE_F | PSTATE_I;
276         s->cpu->env.cp15.sctlr_ns = 0;
277         s->cpu->env.cp15.cpacr_el1 = 0;
278         s->cpu->env.cp15.ttbr0_el[1] = 0;
279         s->cpu->env.cp15.dacr_ns = 0;
280         s->pm_regs[PSSR >> 2] |= 0x8; /* Set STS */
281         s->pm_regs[RCSR >> 2] |= 0x8; /* Set GPR */
282 
283         /*
284          * The scratch-pad register is almost universally used
285          * for storing the return address on suspend.  For the
286          * lack of a resuming bootloader, perform a jump
287          * directly to that address.
288          */
289         memset(s->cpu->env.regs, 0, 4 * 15);
290         s->cpu->env.regs[15] = s->pm_regs[PSPR >> 2];
291 
292 #if 0
293         buffer = 0xe59ff000; /* ldr     pc, [pc, #0] */
294         cpu_physical_memory_write(0, &buffer, 4);
295         buffer = s->pm_regs[PSPR >> 2];
296         cpu_physical_memory_write(8, &buffer, 4);
297 #endif
298 
299         /* Suspend */
300         cpu_interrupt(current_cpu, CPU_INTERRUPT_HALT);
301 
302         goto message;
303 
304     default:
305     message:
306         printf("%s: machine entered %s mode\n", __func__,
307                pwrmode[value & 7]);
308     }
309 }
310 
311 static uint64_t pxa2xx_cppmnc_read(CPUARMState *env, const ARMCPRegInfo *ri)
312 {
313     PXA2xxState *s = (PXA2xxState *)ri->opaque;
314     return s->pmnc;
315 }
316 
317 static void pxa2xx_cppmnc_write(CPUARMState *env, const ARMCPRegInfo *ri,
318                                 uint64_t value)
319 {
320     PXA2xxState *s = (PXA2xxState *)ri->opaque;
321     s->pmnc = value;
322 }
323 
324 static uint64_t pxa2xx_cpccnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
325 {
326     PXA2xxState *s = (PXA2xxState *)ri->opaque;
327     if (s->pmnc & 1) {
328         return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
329     } else {
330         return 0;
331     }
332 }
333 
334 static const ARMCPRegInfo pxa_cp_reginfo[] = {
335     /* cp14 crm==1: perf registers */
336     { .name = "CPPMNC", .cp = 14, .crn = 0, .crm = 1, .opc1 = 0, .opc2 = 0,
337       .access = PL1_RW, .type = ARM_CP_IO,
338       .readfn = pxa2xx_cppmnc_read, .writefn = pxa2xx_cppmnc_write },
339     { .name = "CPCCNT", .cp = 14, .crn = 1, .crm = 1, .opc1 = 0, .opc2 = 0,
340       .access = PL1_RW, .type = ARM_CP_IO,
341       .readfn = pxa2xx_cpccnt_read, .writefn = arm_cp_write_ignore },
342     { .name = "CPINTEN", .cp = 14, .crn = 4, .crm = 1, .opc1 = 0, .opc2 = 0,
343       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
344     { .name = "CPFLAG", .cp = 14, .crn = 5, .crm = 1, .opc1 = 0, .opc2 = 0,
345       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
346     { .name = "CPEVTSEL", .cp = 14, .crn = 8, .crm = 1, .opc1 = 0, .opc2 = 0,
347       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
348     /* cp14 crm==2: performance count registers */
349     { .name = "CPPMN0", .cp = 14, .crn = 0, .crm = 2, .opc1 = 0, .opc2 = 0,
350       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
351     { .name = "CPPMN1", .cp = 14, .crn = 1, .crm = 2, .opc1 = 0, .opc2 = 0,
352       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
353     { .name = "CPPMN2", .cp = 14, .crn = 2, .crm = 2, .opc1 = 0, .opc2 = 0,
354       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
355     { .name = "CPPMN3", .cp = 14, .crn = 2, .crm = 3, .opc1 = 0, .opc2 = 0,
356       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
357     /* cp14 crn==6: CLKCFG */
358     { .name = "CLKCFG", .cp = 14, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
359       .access = PL1_RW, .type = ARM_CP_IO,
360       .readfn = pxa2xx_clkcfg_read, .writefn = pxa2xx_clkcfg_write },
361     /* cp14 crn==7: PWRMODE */
362     { .name = "PWRMODE", .cp = 14, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 0,
363       .access = PL1_RW, .type = ARM_CP_IO,
364       .readfn = arm_cp_read_zero, .writefn = pxa2xx_pwrmode_write },
365     REGINFO_SENTINEL
366 };
367 
368 static void pxa2xx_setup_cp14(PXA2xxState *s)
369 {
370     define_arm_cp_regs_with_opaque(s->cpu, pxa_cp_reginfo, s);
371 }
372 
373 #define MDCNFG		0x00	/* SDRAM Configuration register */
374 #define MDREFR		0x04	/* SDRAM Refresh Control register */
375 #define MSC0		0x08	/* Static Memory Control register 0 */
376 #define MSC1		0x0c	/* Static Memory Control register 1 */
377 #define MSC2		0x10	/* Static Memory Control register 2 */
378 #define MECR		0x14	/* Expansion Memory Bus Config register */
379 #define SXCNFG		0x1c	/* Synchronous Static Memory Config register */
380 #define MCMEM0		0x28	/* PC Card Memory Socket 0 Timing register */
381 #define MCMEM1		0x2c	/* PC Card Memory Socket 1 Timing register */
382 #define MCATT0		0x30	/* PC Card Attribute Socket 0 register */
383 #define MCATT1		0x34	/* PC Card Attribute Socket 1 register */
384 #define MCIO0		0x38	/* PC Card I/O Socket 0 Timing register */
385 #define MCIO1		0x3c	/* PC Card I/O Socket 1 Timing register */
386 #define MDMRS		0x40	/* SDRAM Mode Register Set Config register */
387 #define BOOT_DEF	0x44	/* Boot-time Default Configuration register */
388 #define ARB_CNTL	0x48	/* Arbiter Control register */
389 #define BSCNTR0		0x4c	/* Memory Buffer Strength Control register 0 */
390 #define BSCNTR1		0x50	/* Memory Buffer Strength Control register 1 */
391 #define LCDBSCNTR	0x54	/* LCD Buffer Strength Control register */
392 #define MDMRSLP		0x58	/* Low Power SDRAM Mode Set Config register */
393 #define BSCNTR2		0x5c	/* Memory Buffer Strength Control register 2 */
394 #define BSCNTR3		0x60	/* Memory Buffer Strength Control register 3 */
395 #define SA1110		0x64	/* SA-1110 Memory Compatibility register */
396 
397 static uint64_t pxa2xx_mm_read(void *opaque, hwaddr addr,
398                                unsigned size)
399 {
400     PXA2xxState *s = (PXA2xxState *) opaque;
401 
402     switch (addr) {
403     case MDCNFG ... SA1110:
404         if ((addr & 3) == 0)
405             return s->mm_regs[addr >> 2];
406 
407     default:
408         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
409         break;
410     }
411     return 0;
412 }
413 
414 static void pxa2xx_mm_write(void *opaque, hwaddr addr,
415                             uint64_t value, unsigned size)
416 {
417     PXA2xxState *s = (PXA2xxState *) opaque;
418 
419     switch (addr) {
420     case MDCNFG ... SA1110:
421         if ((addr & 3) == 0) {
422             s->mm_regs[addr >> 2] = value;
423             break;
424         }
425 
426     default:
427         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
428         break;
429     }
430 }
431 
432 static const MemoryRegionOps pxa2xx_mm_ops = {
433     .read = pxa2xx_mm_read,
434     .write = pxa2xx_mm_write,
435     .endianness = DEVICE_NATIVE_ENDIAN,
436 };
437 
438 static const VMStateDescription vmstate_pxa2xx_mm = {
439     .name = "pxa2xx_mm",
440     .version_id = 0,
441     .minimum_version_id = 0,
442     .fields = (VMStateField[]) {
443         VMSTATE_UINT32_ARRAY(mm_regs, PXA2xxState, 0x1a),
444         VMSTATE_END_OF_LIST()
445     }
446 };
447 
448 #define TYPE_PXA2XX_SSP "pxa2xx-ssp"
449 #define PXA2XX_SSP(obj) \
450     OBJECT_CHECK(PXA2xxSSPState, (obj), TYPE_PXA2XX_SSP)
451 
452 /* Synchronous Serial Ports */
453 typedef struct {
454     /*< private >*/
455     SysBusDevice parent_obj;
456     /*< public >*/
457 
458     MemoryRegion iomem;
459     qemu_irq irq;
460     uint32_t enable;
461     SSIBus *bus;
462 
463     uint32_t sscr[2];
464     uint32_t sspsp;
465     uint32_t ssto;
466     uint32_t ssitr;
467     uint32_t sssr;
468     uint8_t sstsa;
469     uint8_t ssrsa;
470     uint8_t ssacd;
471 
472     uint32_t rx_fifo[16];
473     uint32_t rx_level;
474     uint32_t rx_start;
475 } PXA2xxSSPState;
476 
477 static bool pxa2xx_ssp_vmstate_validate(void *opaque, int version_id)
478 {
479     PXA2xxSSPState *s = opaque;
480 
481     return s->rx_start < sizeof(s->rx_fifo);
482 }
483 
484 static const VMStateDescription vmstate_pxa2xx_ssp = {
485     .name = "pxa2xx-ssp",
486     .version_id = 1,
487     .minimum_version_id = 1,
488     .fields = (VMStateField[]) {
489         VMSTATE_UINT32(enable, PXA2xxSSPState),
490         VMSTATE_UINT32_ARRAY(sscr, PXA2xxSSPState, 2),
491         VMSTATE_UINT32(sspsp, PXA2xxSSPState),
492         VMSTATE_UINT32(ssto, PXA2xxSSPState),
493         VMSTATE_UINT32(ssitr, PXA2xxSSPState),
494         VMSTATE_UINT32(sssr, PXA2xxSSPState),
495         VMSTATE_UINT8(sstsa, PXA2xxSSPState),
496         VMSTATE_UINT8(ssrsa, PXA2xxSSPState),
497         VMSTATE_UINT8(ssacd, PXA2xxSSPState),
498         VMSTATE_UINT32(rx_level, PXA2xxSSPState),
499         VMSTATE_UINT32(rx_start, PXA2xxSSPState),
500         VMSTATE_VALIDATE("fifo is 16 bytes", pxa2xx_ssp_vmstate_validate),
501         VMSTATE_UINT32_ARRAY(rx_fifo, PXA2xxSSPState, 16),
502         VMSTATE_END_OF_LIST()
503     }
504 };
505 
506 #define SSCR0	0x00	/* SSP Control register 0 */
507 #define SSCR1	0x04	/* SSP Control register 1 */
508 #define SSSR	0x08	/* SSP Status register */
509 #define SSITR	0x0c	/* SSP Interrupt Test register */
510 #define SSDR	0x10	/* SSP Data register */
511 #define SSTO	0x28	/* SSP Time-Out register */
512 #define SSPSP	0x2c	/* SSP Programmable Serial Protocol register */
513 #define SSTSA	0x30	/* SSP TX Time Slot Active register */
514 #define SSRSA	0x34	/* SSP RX Time Slot Active register */
515 #define SSTSS	0x38	/* SSP Time Slot Status register */
516 #define SSACD	0x3c	/* SSP Audio Clock Divider register */
517 
518 /* Bitfields for above registers */
519 #define SSCR0_SPI(x)	(((x) & 0x30) == 0x00)
520 #define SSCR0_SSP(x)	(((x) & 0x30) == 0x10)
521 #define SSCR0_UWIRE(x)	(((x) & 0x30) == 0x20)
522 #define SSCR0_PSP(x)	(((x) & 0x30) == 0x30)
523 #define SSCR0_SSE	(1 << 7)
524 #define SSCR0_RIM	(1 << 22)
525 #define SSCR0_TIM	(1 << 23)
526 #define SSCR0_MOD       (1U << 31)
527 #define SSCR0_DSS(x)	(((((x) >> 16) & 0x10) | ((x) & 0xf)) + 1)
528 #define SSCR1_RIE	(1 << 0)
529 #define SSCR1_TIE	(1 << 1)
530 #define SSCR1_LBM	(1 << 2)
531 #define SSCR1_MWDS	(1 << 5)
532 #define SSCR1_TFT(x)	((((x) >> 6) & 0xf) + 1)
533 #define SSCR1_RFT(x)	((((x) >> 10) & 0xf) + 1)
534 #define SSCR1_EFWR	(1 << 14)
535 #define SSCR1_PINTE	(1 << 18)
536 #define SSCR1_TINTE	(1 << 19)
537 #define SSCR1_RSRE	(1 << 20)
538 #define SSCR1_TSRE	(1 << 21)
539 #define SSCR1_EBCEI	(1 << 29)
540 #define SSITR_INT	(7 << 5)
541 #define SSSR_TNF	(1 << 2)
542 #define SSSR_RNE	(1 << 3)
543 #define SSSR_TFS	(1 << 5)
544 #define SSSR_RFS	(1 << 6)
545 #define SSSR_ROR	(1 << 7)
546 #define SSSR_PINT	(1 << 18)
547 #define SSSR_TINT	(1 << 19)
548 #define SSSR_EOC	(1 << 20)
549 #define SSSR_TUR	(1 << 21)
550 #define SSSR_BCE	(1 << 23)
551 #define SSSR_RW		0x00bc0080
552 
553 static void pxa2xx_ssp_int_update(PXA2xxSSPState *s)
554 {
555     int level = 0;
556 
557     level |= s->ssitr & SSITR_INT;
558     level |= (s->sssr & SSSR_BCE)  &&  (s->sscr[1] & SSCR1_EBCEI);
559     level |= (s->sssr & SSSR_TUR)  && !(s->sscr[0] & SSCR0_TIM);
560     level |= (s->sssr & SSSR_EOC)  &&  (s->sssr & (SSSR_TINT | SSSR_PINT));
561     level |= (s->sssr & SSSR_TINT) &&  (s->sscr[1] & SSCR1_TINTE);
562     level |= (s->sssr & SSSR_PINT) &&  (s->sscr[1] & SSCR1_PINTE);
563     level |= (s->sssr & SSSR_ROR)  && !(s->sscr[0] & SSCR0_RIM);
564     level |= (s->sssr & SSSR_RFS)  &&  (s->sscr[1] & SSCR1_RIE);
565     level |= (s->sssr & SSSR_TFS)  &&  (s->sscr[1] & SSCR1_TIE);
566     qemu_set_irq(s->irq, !!level);
567 }
568 
569 static void pxa2xx_ssp_fifo_update(PXA2xxSSPState *s)
570 {
571     s->sssr &= ~(0xf << 12);	/* Clear RFL */
572     s->sssr &= ~(0xf << 8);	/* Clear TFL */
573     s->sssr &= ~SSSR_TFS;
574     s->sssr &= ~SSSR_TNF;
575     if (s->enable) {
576         s->sssr |= ((s->rx_level - 1) & 0xf) << 12;
577         if (s->rx_level >= SSCR1_RFT(s->sscr[1]))
578             s->sssr |= SSSR_RFS;
579         else
580             s->sssr &= ~SSSR_RFS;
581         if (s->rx_level)
582             s->sssr |= SSSR_RNE;
583         else
584             s->sssr &= ~SSSR_RNE;
585         /* TX FIFO is never filled, so it is always in underrun
586            condition if SSP is enabled */
587         s->sssr |= SSSR_TFS;
588         s->sssr |= SSSR_TNF;
589     }
590 
591     pxa2xx_ssp_int_update(s);
592 }
593 
594 static uint64_t pxa2xx_ssp_read(void *opaque, hwaddr addr,
595                                 unsigned size)
596 {
597     PXA2xxSSPState *s = (PXA2xxSSPState *) opaque;
598     uint32_t retval;
599 
600     switch (addr) {
601     case SSCR0:
602         return s->sscr[0];
603     case SSCR1:
604         return s->sscr[1];
605     case SSPSP:
606         return s->sspsp;
607     case SSTO:
608         return s->ssto;
609     case SSITR:
610         return s->ssitr;
611     case SSSR:
612         return s->sssr | s->ssitr;
613     case SSDR:
614         if (!s->enable)
615             return 0xffffffff;
616         if (s->rx_level < 1) {
617             printf("%s: SSP Rx Underrun\n", __FUNCTION__);
618             return 0xffffffff;
619         }
620         s->rx_level --;
621         retval = s->rx_fifo[s->rx_start ++];
622         s->rx_start &= 0xf;
623         pxa2xx_ssp_fifo_update(s);
624         return retval;
625     case SSTSA:
626         return s->sstsa;
627     case SSRSA:
628         return s->ssrsa;
629     case SSTSS:
630         return 0;
631     case SSACD:
632         return s->ssacd;
633     default:
634         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
635         break;
636     }
637     return 0;
638 }
639 
640 static void pxa2xx_ssp_write(void *opaque, hwaddr addr,
641                              uint64_t value64, unsigned size)
642 {
643     PXA2xxSSPState *s = (PXA2xxSSPState *) opaque;
644     uint32_t value = value64;
645 
646     switch (addr) {
647     case SSCR0:
648         s->sscr[0] = value & 0xc7ffffff;
649         s->enable = value & SSCR0_SSE;
650         if (value & SSCR0_MOD)
651             printf("%s: Attempt to use network mode\n", __FUNCTION__);
652         if (s->enable && SSCR0_DSS(value) < 4)
653             printf("%s: Wrong data size: %i bits\n", __FUNCTION__,
654                             SSCR0_DSS(value));
655         if (!(value & SSCR0_SSE)) {
656             s->sssr = 0;
657             s->ssitr = 0;
658             s->rx_level = 0;
659         }
660         pxa2xx_ssp_fifo_update(s);
661         break;
662 
663     case SSCR1:
664         s->sscr[1] = value;
665         if (value & (SSCR1_LBM | SSCR1_EFWR))
666             printf("%s: Attempt to use SSP test mode\n", __FUNCTION__);
667         pxa2xx_ssp_fifo_update(s);
668         break;
669 
670     case SSPSP:
671         s->sspsp = value;
672         break;
673 
674     case SSTO:
675         s->ssto = value;
676         break;
677 
678     case SSITR:
679         s->ssitr = value & SSITR_INT;
680         pxa2xx_ssp_int_update(s);
681         break;
682 
683     case SSSR:
684         s->sssr &= ~(value & SSSR_RW);
685         pxa2xx_ssp_int_update(s);
686         break;
687 
688     case SSDR:
689         if (SSCR0_UWIRE(s->sscr[0])) {
690             if (s->sscr[1] & SSCR1_MWDS)
691                 value &= 0xffff;
692             else
693                 value &= 0xff;
694         } else
695             /* Note how 32bits overflow does no harm here */
696             value &= (1 << SSCR0_DSS(s->sscr[0])) - 1;
697 
698         /* Data goes from here to the Tx FIFO and is shifted out from
699          * there directly to the slave, no need to buffer it.
700          */
701         if (s->enable) {
702             uint32_t readval;
703             readval = ssi_transfer(s->bus, value);
704             if (s->rx_level < 0x10) {
705                 s->rx_fifo[(s->rx_start + s->rx_level ++) & 0xf] = readval;
706             } else {
707                 s->sssr |= SSSR_ROR;
708             }
709         }
710         pxa2xx_ssp_fifo_update(s);
711         break;
712 
713     case SSTSA:
714         s->sstsa = value;
715         break;
716 
717     case SSRSA:
718         s->ssrsa = value;
719         break;
720 
721     case SSACD:
722         s->ssacd = value;
723         break;
724 
725     default:
726         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
727         break;
728     }
729 }
730 
731 static const MemoryRegionOps pxa2xx_ssp_ops = {
732     .read = pxa2xx_ssp_read,
733     .write = pxa2xx_ssp_write,
734     .endianness = DEVICE_NATIVE_ENDIAN,
735 };
736 
737 static void pxa2xx_ssp_reset(DeviceState *d)
738 {
739     PXA2xxSSPState *s = PXA2XX_SSP(d);
740 
741     s->enable = 0;
742     s->sscr[0] = s->sscr[1] = 0;
743     s->sspsp = 0;
744     s->ssto = 0;
745     s->ssitr = 0;
746     s->sssr = 0;
747     s->sstsa = 0;
748     s->ssrsa = 0;
749     s->ssacd = 0;
750     s->rx_start = s->rx_level = 0;
751 }
752 
753 static int pxa2xx_ssp_init(SysBusDevice *sbd)
754 {
755     DeviceState *dev = DEVICE(sbd);
756     PXA2xxSSPState *s = PXA2XX_SSP(dev);
757 
758     sysbus_init_irq(sbd, &s->irq);
759 
760     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_ssp_ops, s,
761                           "pxa2xx-ssp", 0x1000);
762     sysbus_init_mmio(sbd, &s->iomem);
763 
764     s->bus = ssi_create_bus(dev, "ssi");
765     return 0;
766 }
767 
768 /* Real-Time Clock */
769 #define RCNR		0x00	/* RTC Counter register */
770 #define RTAR		0x04	/* RTC Alarm register */
771 #define RTSR		0x08	/* RTC Status register */
772 #define RTTR		0x0c	/* RTC Timer Trim register */
773 #define RDCR		0x10	/* RTC Day Counter register */
774 #define RYCR		0x14	/* RTC Year Counter register */
775 #define RDAR1		0x18	/* RTC Wristwatch Day Alarm register 1 */
776 #define RYAR1		0x1c	/* RTC Wristwatch Year Alarm register 1 */
777 #define RDAR2		0x20	/* RTC Wristwatch Day Alarm register 2 */
778 #define RYAR2		0x24	/* RTC Wristwatch Year Alarm register 2 */
779 #define SWCR		0x28	/* RTC Stopwatch Counter register */
780 #define SWAR1		0x2c	/* RTC Stopwatch Alarm register 1 */
781 #define SWAR2		0x30	/* RTC Stopwatch Alarm register 2 */
782 #define RTCPICR		0x34	/* RTC Periodic Interrupt Counter register */
783 #define PIAR		0x38	/* RTC Periodic Interrupt Alarm register */
784 
785 #define TYPE_PXA2XX_RTC "pxa2xx_rtc"
786 #define PXA2XX_RTC(obj) \
787     OBJECT_CHECK(PXA2xxRTCState, (obj), TYPE_PXA2XX_RTC)
788 
789 typedef struct {
790     /*< private >*/
791     SysBusDevice parent_obj;
792     /*< public >*/
793 
794     MemoryRegion iomem;
795     uint32_t rttr;
796     uint32_t rtsr;
797     uint32_t rtar;
798     uint32_t rdar1;
799     uint32_t rdar2;
800     uint32_t ryar1;
801     uint32_t ryar2;
802     uint32_t swar1;
803     uint32_t swar2;
804     uint32_t piar;
805     uint32_t last_rcnr;
806     uint32_t last_rdcr;
807     uint32_t last_rycr;
808     uint32_t last_swcr;
809     uint32_t last_rtcpicr;
810     int64_t last_hz;
811     int64_t last_sw;
812     int64_t last_pi;
813     QEMUTimer *rtc_hz;
814     QEMUTimer *rtc_rdal1;
815     QEMUTimer *rtc_rdal2;
816     QEMUTimer *rtc_swal1;
817     QEMUTimer *rtc_swal2;
818     QEMUTimer *rtc_pi;
819     qemu_irq rtc_irq;
820 } PXA2xxRTCState;
821 
822 static inline void pxa2xx_rtc_int_update(PXA2xxRTCState *s)
823 {
824     qemu_set_irq(s->rtc_irq, !!(s->rtsr & 0x2553));
825 }
826 
827 static void pxa2xx_rtc_hzupdate(PXA2xxRTCState *s)
828 {
829     int64_t rt = qemu_clock_get_ms(rtc_clock);
830     s->last_rcnr += ((rt - s->last_hz) << 15) /
831             (1000 * ((s->rttr & 0xffff) + 1));
832     s->last_rdcr += ((rt - s->last_hz) << 15) /
833             (1000 * ((s->rttr & 0xffff) + 1));
834     s->last_hz = rt;
835 }
836 
837 static void pxa2xx_rtc_swupdate(PXA2xxRTCState *s)
838 {
839     int64_t rt = qemu_clock_get_ms(rtc_clock);
840     if (s->rtsr & (1 << 12))
841         s->last_swcr += (rt - s->last_sw) / 10;
842     s->last_sw = rt;
843 }
844 
845 static void pxa2xx_rtc_piupdate(PXA2xxRTCState *s)
846 {
847     int64_t rt = qemu_clock_get_ms(rtc_clock);
848     if (s->rtsr & (1 << 15))
849         s->last_swcr += rt - s->last_pi;
850     s->last_pi = rt;
851 }
852 
853 static inline void pxa2xx_rtc_alarm_update(PXA2xxRTCState *s,
854                 uint32_t rtsr)
855 {
856     if ((rtsr & (1 << 2)) && !(rtsr & (1 << 0)))
857         timer_mod(s->rtc_hz, s->last_hz +
858                 (((s->rtar - s->last_rcnr) * 1000 *
859                   ((s->rttr & 0xffff) + 1)) >> 15));
860     else
861         timer_del(s->rtc_hz);
862 
863     if ((rtsr & (1 << 5)) && !(rtsr & (1 << 4)))
864         timer_mod(s->rtc_rdal1, s->last_hz +
865                 (((s->rdar1 - s->last_rdcr) * 1000 *
866                   ((s->rttr & 0xffff) + 1)) >> 15)); /* TODO: fixup */
867     else
868         timer_del(s->rtc_rdal1);
869 
870     if ((rtsr & (1 << 7)) && !(rtsr & (1 << 6)))
871         timer_mod(s->rtc_rdal2, s->last_hz +
872                 (((s->rdar2 - s->last_rdcr) * 1000 *
873                   ((s->rttr & 0xffff) + 1)) >> 15)); /* TODO: fixup */
874     else
875         timer_del(s->rtc_rdal2);
876 
877     if ((rtsr & 0x1200) == 0x1200 && !(rtsr & (1 << 8)))
878         timer_mod(s->rtc_swal1, s->last_sw +
879                         (s->swar1 - s->last_swcr) * 10); /* TODO: fixup */
880     else
881         timer_del(s->rtc_swal1);
882 
883     if ((rtsr & 0x1800) == 0x1800 && !(rtsr & (1 << 10)))
884         timer_mod(s->rtc_swal2, s->last_sw +
885                         (s->swar2 - s->last_swcr) * 10); /* TODO: fixup */
886     else
887         timer_del(s->rtc_swal2);
888 
889     if ((rtsr & 0xc000) == 0xc000 && !(rtsr & (1 << 13)))
890         timer_mod(s->rtc_pi, s->last_pi +
891                         (s->piar & 0xffff) - s->last_rtcpicr);
892     else
893         timer_del(s->rtc_pi);
894 }
895 
896 static inline void pxa2xx_rtc_hz_tick(void *opaque)
897 {
898     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
899     s->rtsr |= (1 << 0);
900     pxa2xx_rtc_alarm_update(s, s->rtsr);
901     pxa2xx_rtc_int_update(s);
902 }
903 
904 static inline void pxa2xx_rtc_rdal1_tick(void *opaque)
905 {
906     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
907     s->rtsr |= (1 << 4);
908     pxa2xx_rtc_alarm_update(s, s->rtsr);
909     pxa2xx_rtc_int_update(s);
910 }
911 
912 static inline void pxa2xx_rtc_rdal2_tick(void *opaque)
913 {
914     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
915     s->rtsr |= (1 << 6);
916     pxa2xx_rtc_alarm_update(s, s->rtsr);
917     pxa2xx_rtc_int_update(s);
918 }
919 
920 static inline void pxa2xx_rtc_swal1_tick(void *opaque)
921 {
922     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
923     s->rtsr |= (1 << 8);
924     pxa2xx_rtc_alarm_update(s, s->rtsr);
925     pxa2xx_rtc_int_update(s);
926 }
927 
928 static inline void pxa2xx_rtc_swal2_tick(void *opaque)
929 {
930     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
931     s->rtsr |= (1 << 10);
932     pxa2xx_rtc_alarm_update(s, s->rtsr);
933     pxa2xx_rtc_int_update(s);
934 }
935 
936 static inline void pxa2xx_rtc_pi_tick(void *opaque)
937 {
938     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
939     s->rtsr |= (1 << 13);
940     pxa2xx_rtc_piupdate(s);
941     s->last_rtcpicr = 0;
942     pxa2xx_rtc_alarm_update(s, s->rtsr);
943     pxa2xx_rtc_int_update(s);
944 }
945 
946 static uint64_t pxa2xx_rtc_read(void *opaque, hwaddr addr,
947                                 unsigned size)
948 {
949     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
950 
951     switch (addr) {
952     case RTTR:
953         return s->rttr;
954     case RTSR:
955         return s->rtsr;
956     case RTAR:
957         return s->rtar;
958     case RDAR1:
959         return s->rdar1;
960     case RDAR2:
961         return s->rdar2;
962     case RYAR1:
963         return s->ryar1;
964     case RYAR2:
965         return s->ryar2;
966     case SWAR1:
967         return s->swar1;
968     case SWAR2:
969         return s->swar2;
970     case PIAR:
971         return s->piar;
972     case RCNR:
973         return s->last_rcnr +
974             ((qemu_clock_get_ms(rtc_clock) - s->last_hz) << 15) /
975             (1000 * ((s->rttr & 0xffff) + 1));
976     case RDCR:
977         return s->last_rdcr +
978             ((qemu_clock_get_ms(rtc_clock) - s->last_hz) << 15) /
979             (1000 * ((s->rttr & 0xffff) + 1));
980     case RYCR:
981         return s->last_rycr;
982     case SWCR:
983         if (s->rtsr & (1 << 12))
984             return s->last_swcr +
985                 (qemu_clock_get_ms(rtc_clock) - s->last_sw) / 10;
986         else
987             return s->last_swcr;
988     default:
989         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
990         break;
991     }
992     return 0;
993 }
994 
995 static void pxa2xx_rtc_write(void *opaque, hwaddr addr,
996                              uint64_t value64, unsigned size)
997 {
998     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
999     uint32_t value = value64;
1000 
1001     switch (addr) {
1002     case RTTR:
1003         if (!(s->rttr & (1U << 31))) {
1004             pxa2xx_rtc_hzupdate(s);
1005             s->rttr = value;
1006             pxa2xx_rtc_alarm_update(s, s->rtsr);
1007         }
1008         break;
1009 
1010     case RTSR:
1011         if ((s->rtsr ^ value) & (1 << 15))
1012             pxa2xx_rtc_piupdate(s);
1013 
1014         if ((s->rtsr ^ value) & (1 << 12))
1015             pxa2xx_rtc_swupdate(s);
1016 
1017         if (((s->rtsr ^ value) & 0x4aac) | (value & ~0xdaac))
1018             pxa2xx_rtc_alarm_update(s, value);
1019 
1020         s->rtsr = (value & 0xdaac) | (s->rtsr & ~(value & ~0xdaac));
1021         pxa2xx_rtc_int_update(s);
1022         break;
1023 
1024     case RTAR:
1025         s->rtar = value;
1026         pxa2xx_rtc_alarm_update(s, s->rtsr);
1027         break;
1028 
1029     case RDAR1:
1030         s->rdar1 = value;
1031         pxa2xx_rtc_alarm_update(s, s->rtsr);
1032         break;
1033 
1034     case RDAR2:
1035         s->rdar2 = value;
1036         pxa2xx_rtc_alarm_update(s, s->rtsr);
1037         break;
1038 
1039     case RYAR1:
1040         s->ryar1 = value;
1041         pxa2xx_rtc_alarm_update(s, s->rtsr);
1042         break;
1043 
1044     case RYAR2:
1045         s->ryar2 = value;
1046         pxa2xx_rtc_alarm_update(s, s->rtsr);
1047         break;
1048 
1049     case SWAR1:
1050         pxa2xx_rtc_swupdate(s);
1051         s->swar1 = value;
1052         s->last_swcr = 0;
1053         pxa2xx_rtc_alarm_update(s, s->rtsr);
1054         break;
1055 
1056     case SWAR2:
1057         s->swar2 = value;
1058         pxa2xx_rtc_alarm_update(s, s->rtsr);
1059         break;
1060 
1061     case PIAR:
1062         s->piar = value;
1063         pxa2xx_rtc_alarm_update(s, s->rtsr);
1064         break;
1065 
1066     case RCNR:
1067         pxa2xx_rtc_hzupdate(s);
1068         s->last_rcnr = value;
1069         pxa2xx_rtc_alarm_update(s, s->rtsr);
1070         break;
1071 
1072     case RDCR:
1073         pxa2xx_rtc_hzupdate(s);
1074         s->last_rdcr = value;
1075         pxa2xx_rtc_alarm_update(s, s->rtsr);
1076         break;
1077 
1078     case RYCR:
1079         s->last_rycr = value;
1080         break;
1081 
1082     case SWCR:
1083         pxa2xx_rtc_swupdate(s);
1084         s->last_swcr = value;
1085         pxa2xx_rtc_alarm_update(s, s->rtsr);
1086         break;
1087 
1088     case RTCPICR:
1089         pxa2xx_rtc_piupdate(s);
1090         s->last_rtcpicr = value & 0xffff;
1091         pxa2xx_rtc_alarm_update(s, s->rtsr);
1092         break;
1093 
1094     default:
1095         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1096     }
1097 }
1098 
1099 static const MemoryRegionOps pxa2xx_rtc_ops = {
1100     .read = pxa2xx_rtc_read,
1101     .write = pxa2xx_rtc_write,
1102     .endianness = DEVICE_NATIVE_ENDIAN,
1103 };
1104 
1105 static int pxa2xx_rtc_init(SysBusDevice *dev)
1106 {
1107     PXA2xxRTCState *s = PXA2XX_RTC(dev);
1108     struct tm tm;
1109     int wom;
1110 
1111     s->rttr = 0x7fff;
1112     s->rtsr = 0;
1113 
1114     qemu_get_timedate(&tm, 0);
1115     wom = ((tm.tm_mday - 1) / 7) + 1;
1116 
1117     s->last_rcnr = (uint32_t) mktimegm(&tm);
1118     s->last_rdcr = (wom << 20) | ((tm.tm_wday + 1) << 17) |
1119             (tm.tm_hour << 12) | (tm.tm_min << 6) | tm.tm_sec;
1120     s->last_rycr = ((tm.tm_year + 1900) << 9) |
1121             ((tm.tm_mon + 1) << 5) | tm.tm_mday;
1122     s->last_swcr = (tm.tm_hour << 19) |
1123             (tm.tm_min << 13) | (tm.tm_sec << 7);
1124     s->last_rtcpicr = 0;
1125     s->last_hz = s->last_sw = s->last_pi = qemu_clock_get_ms(rtc_clock);
1126 
1127     s->rtc_hz    = timer_new_ms(rtc_clock, pxa2xx_rtc_hz_tick,    s);
1128     s->rtc_rdal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal1_tick, s);
1129     s->rtc_rdal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal2_tick, s);
1130     s->rtc_swal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal1_tick, s);
1131     s->rtc_swal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal2_tick, s);
1132     s->rtc_pi    = timer_new_ms(rtc_clock, pxa2xx_rtc_pi_tick,    s);
1133 
1134     sysbus_init_irq(dev, &s->rtc_irq);
1135 
1136     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_rtc_ops, s,
1137                           "pxa2xx-rtc", 0x10000);
1138     sysbus_init_mmio(dev, &s->iomem);
1139 
1140     return 0;
1141 }
1142 
1143 static void pxa2xx_rtc_pre_save(void *opaque)
1144 {
1145     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
1146 
1147     pxa2xx_rtc_hzupdate(s);
1148     pxa2xx_rtc_piupdate(s);
1149     pxa2xx_rtc_swupdate(s);
1150 }
1151 
1152 static int pxa2xx_rtc_post_load(void *opaque, int version_id)
1153 {
1154     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
1155 
1156     pxa2xx_rtc_alarm_update(s, s->rtsr);
1157 
1158     return 0;
1159 }
1160 
1161 static const VMStateDescription vmstate_pxa2xx_rtc_regs = {
1162     .name = "pxa2xx_rtc",
1163     .version_id = 0,
1164     .minimum_version_id = 0,
1165     .pre_save = pxa2xx_rtc_pre_save,
1166     .post_load = pxa2xx_rtc_post_load,
1167     .fields = (VMStateField[]) {
1168         VMSTATE_UINT32(rttr, PXA2xxRTCState),
1169         VMSTATE_UINT32(rtsr, PXA2xxRTCState),
1170         VMSTATE_UINT32(rtar, PXA2xxRTCState),
1171         VMSTATE_UINT32(rdar1, PXA2xxRTCState),
1172         VMSTATE_UINT32(rdar2, PXA2xxRTCState),
1173         VMSTATE_UINT32(ryar1, PXA2xxRTCState),
1174         VMSTATE_UINT32(ryar2, PXA2xxRTCState),
1175         VMSTATE_UINT32(swar1, PXA2xxRTCState),
1176         VMSTATE_UINT32(swar2, PXA2xxRTCState),
1177         VMSTATE_UINT32(piar, PXA2xxRTCState),
1178         VMSTATE_UINT32(last_rcnr, PXA2xxRTCState),
1179         VMSTATE_UINT32(last_rdcr, PXA2xxRTCState),
1180         VMSTATE_UINT32(last_rycr, PXA2xxRTCState),
1181         VMSTATE_UINT32(last_swcr, PXA2xxRTCState),
1182         VMSTATE_UINT32(last_rtcpicr, PXA2xxRTCState),
1183         VMSTATE_INT64(last_hz, PXA2xxRTCState),
1184         VMSTATE_INT64(last_sw, PXA2xxRTCState),
1185         VMSTATE_INT64(last_pi, PXA2xxRTCState),
1186         VMSTATE_END_OF_LIST(),
1187     },
1188 };
1189 
1190 static void pxa2xx_rtc_sysbus_class_init(ObjectClass *klass, void *data)
1191 {
1192     DeviceClass *dc = DEVICE_CLASS(klass);
1193     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
1194 
1195     k->init = pxa2xx_rtc_init;
1196     dc->desc = "PXA2xx RTC Controller";
1197     dc->vmsd = &vmstate_pxa2xx_rtc_regs;
1198 }
1199 
1200 static const TypeInfo pxa2xx_rtc_sysbus_info = {
1201     .name          = TYPE_PXA2XX_RTC,
1202     .parent        = TYPE_SYS_BUS_DEVICE,
1203     .instance_size = sizeof(PXA2xxRTCState),
1204     .class_init    = pxa2xx_rtc_sysbus_class_init,
1205 };
1206 
1207 /* I2C Interface */
1208 
1209 #define TYPE_PXA2XX_I2C_SLAVE "pxa2xx-i2c-slave"
1210 #define PXA2XX_I2C_SLAVE(obj) \
1211     OBJECT_CHECK(PXA2xxI2CSlaveState, (obj), TYPE_PXA2XX_I2C_SLAVE)
1212 
1213 typedef struct PXA2xxI2CSlaveState {
1214     I2CSlave parent_obj;
1215 
1216     PXA2xxI2CState *host;
1217 } PXA2xxI2CSlaveState;
1218 
1219 #define TYPE_PXA2XX_I2C "pxa2xx_i2c"
1220 #define PXA2XX_I2C(obj) \
1221     OBJECT_CHECK(PXA2xxI2CState, (obj), TYPE_PXA2XX_I2C)
1222 
1223 struct PXA2xxI2CState {
1224     /*< private >*/
1225     SysBusDevice parent_obj;
1226     /*< public >*/
1227 
1228     MemoryRegion iomem;
1229     PXA2xxI2CSlaveState *slave;
1230     I2CBus *bus;
1231     qemu_irq irq;
1232     uint32_t offset;
1233     uint32_t region_size;
1234 
1235     uint16_t control;
1236     uint16_t status;
1237     uint8_t ibmr;
1238     uint8_t data;
1239 };
1240 
1241 #define IBMR	0x80	/* I2C Bus Monitor register */
1242 #define IDBR	0x88	/* I2C Data Buffer register */
1243 #define ICR	0x90	/* I2C Control register */
1244 #define ISR	0x98	/* I2C Status register */
1245 #define ISAR	0xa0	/* I2C Slave Address register */
1246 
1247 static void pxa2xx_i2c_update(PXA2xxI2CState *s)
1248 {
1249     uint16_t level = 0;
1250     level |= s->status & s->control & (1 << 10);		/* BED */
1251     level |= (s->status & (1 << 7)) && (s->control & (1 << 9));	/* IRF */
1252     level |= (s->status & (1 << 6)) && (s->control & (1 << 8));	/* ITE */
1253     level |= s->status & (1 << 9);				/* SAD */
1254     qemu_set_irq(s->irq, !!level);
1255 }
1256 
1257 /* These are only stubs now.  */
1258 static void pxa2xx_i2c_event(I2CSlave *i2c, enum i2c_event event)
1259 {
1260     PXA2xxI2CSlaveState *slave = PXA2XX_I2C_SLAVE(i2c);
1261     PXA2xxI2CState *s = slave->host;
1262 
1263     switch (event) {
1264     case I2C_START_SEND:
1265         s->status |= (1 << 9);				/* set SAD */
1266         s->status &= ~(1 << 0);				/* clear RWM */
1267         break;
1268     case I2C_START_RECV:
1269         s->status |= (1 << 9);				/* set SAD */
1270         s->status |= 1 << 0;				/* set RWM */
1271         break;
1272     case I2C_FINISH:
1273         s->status |= (1 << 4);				/* set SSD */
1274         break;
1275     case I2C_NACK:
1276         s->status |= 1 << 1;				/* set ACKNAK */
1277         break;
1278     }
1279     pxa2xx_i2c_update(s);
1280 }
1281 
1282 static int pxa2xx_i2c_rx(I2CSlave *i2c)
1283 {
1284     PXA2xxI2CSlaveState *slave = PXA2XX_I2C_SLAVE(i2c);
1285     PXA2xxI2CState *s = slave->host;
1286 
1287     if ((s->control & (1 << 14)) || !(s->control & (1 << 6))) {
1288         return 0;
1289     }
1290 
1291     if (s->status & (1 << 0)) {			/* RWM */
1292         s->status |= 1 << 6;			/* set ITE */
1293     }
1294     pxa2xx_i2c_update(s);
1295 
1296     return s->data;
1297 }
1298 
1299 static int pxa2xx_i2c_tx(I2CSlave *i2c, uint8_t data)
1300 {
1301     PXA2xxI2CSlaveState *slave = PXA2XX_I2C_SLAVE(i2c);
1302     PXA2xxI2CState *s = slave->host;
1303 
1304     if ((s->control & (1 << 14)) || !(s->control & (1 << 6))) {
1305         return 1;
1306     }
1307 
1308     if (!(s->status & (1 << 0))) {		/* RWM */
1309         s->status |= 1 << 7;			/* set IRF */
1310         s->data = data;
1311     }
1312     pxa2xx_i2c_update(s);
1313 
1314     return 1;
1315 }
1316 
1317 static uint64_t pxa2xx_i2c_read(void *opaque, hwaddr addr,
1318                                 unsigned size)
1319 {
1320     PXA2xxI2CState *s = (PXA2xxI2CState *) opaque;
1321     I2CSlave *slave;
1322 
1323     addr -= s->offset;
1324     switch (addr) {
1325     case ICR:
1326         return s->control;
1327     case ISR:
1328         return s->status | (i2c_bus_busy(s->bus) << 2);
1329     case ISAR:
1330         slave = I2C_SLAVE(s->slave);
1331         return slave->address;
1332     case IDBR:
1333         return s->data;
1334     case IBMR:
1335         if (s->status & (1 << 2))
1336             s->ibmr ^= 3;	/* Fake SCL and SDA pin changes */
1337         else
1338             s->ibmr = 0;
1339         return s->ibmr;
1340     default:
1341         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1342         break;
1343     }
1344     return 0;
1345 }
1346 
1347 static void pxa2xx_i2c_write(void *opaque, hwaddr addr,
1348                              uint64_t value64, unsigned size)
1349 {
1350     PXA2xxI2CState *s = (PXA2xxI2CState *) opaque;
1351     uint32_t value = value64;
1352     int ack;
1353 
1354     addr -= s->offset;
1355     switch (addr) {
1356     case ICR:
1357         s->control = value & 0xfff7;
1358         if ((value & (1 << 3)) && (value & (1 << 6))) {	/* TB and IUE */
1359             /* TODO: slave mode */
1360             if (value & (1 << 0)) {			/* START condition */
1361                 if (s->data & 1)
1362                     s->status |= 1 << 0;		/* set RWM */
1363                 else
1364                     s->status &= ~(1 << 0);		/* clear RWM */
1365                 ack = !i2c_start_transfer(s->bus, s->data >> 1, s->data & 1);
1366             } else {
1367                 if (s->status & (1 << 0)) {		/* RWM */
1368                     s->data = i2c_recv(s->bus);
1369                     if (value & (1 << 2))		/* ACKNAK */
1370                         i2c_nack(s->bus);
1371                     ack = 1;
1372                 } else
1373                     ack = !i2c_send(s->bus, s->data);
1374             }
1375 
1376             if (value & (1 << 1))			/* STOP condition */
1377                 i2c_end_transfer(s->bus);
1378 
1379             if (ack) {
1380                 if (value & (1 << 0))			/* START condition */
1381                     s->status |= 1 << 6;		/* set ITE */
1382                 else
1383                     if (s->status & (1 << 0))		/* RWM */
1384                         s->status |= 1 << 7;		/* set IRF */
1385                     else
1386                         s->status |= 1 << 6;		/* set ITE */
1387                 s->status &= ~(1 << 1);			/* clear ACKNAK */
1388             } else {
1389                 s->status |= 1 << 6;			/* set ITE */
1390                 s->status |= 1 << 10;			/* set BED */
1391                 s->status |= 1 << 1;			/* set ACKNAK */
1392             }
1393         }
1394         if (!(value & (1 << 3)) && (value & (1 << 6)))	/* !TB and IUE */
1395             if (value & (1 << 4))			/* MA */
1396                 i2c_end_transfer(s->bus);
1397         pxa2xx_i2c_update(s);
1398         break;
1399 
1400     case ISR:
1401         s->status &= ~(value & 0x07f0);
1402         pxa2xx_i2c_update(s);
1403         break;
1404 
1405     case ISAR:
1406         i2c_set_slave_address(I2C_SLAVE(s->slave), value & 0x7f);
1407         break;
1408 
1409     case IDBR:
1410         s->data = value & 0xff;
1411         break;
1412 
1413     default:
1414         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1415     }
1416 }
1417 
1418 static const MemoryRegionOps pxa2xx_i2c_ops = {
1419     .read = pxa2xx_i2c_read,
1420     .write = pxa2xx_i2c_write,
1421     .endianness = DEVICE_NATIVE_ENDIAN,
1422 };
1423 
1424 static const VMStateDescription vmstate_pxa2xx_i2c_slave = {
1425     .name = "pxa2xx_i2c_slave",
1426     .version_id = 1,
1427     .minimum_version_id = 1,
1428     .fields = (VMStateField[]) {
1429         VMSTATE_I2C_SLAVE(parent_obj, PXA2xxI2CSlaveState),
1430         VMSTATE_END_OF_LIST()
1431     }
1432 };
1433 
1434 static const VMStateDescription vmstate_pxa2xx_i2c = {
1435     .name = "pxa2xx_i2c",
1436     .version_id = 1,
1437     .minimum_version_id = 1,
1438     .fields = (VMStateField[]) {
1439         VMSTATE_UINT16(control, PXA2xxI2CState),
1440         VMSTATE_UINT16(status, PXA2xxI2CState),
1441         VMSTATE_UINT8(ibmr, PXA2xxI2CState),
1442         VMSTATE_UINT8(data, PXA2xxI2CState),
1443         VMSTATE_STRUCT_POINTER(slave, PXA2xxI2CState,
1444                                vmstate_pxa2xx_i2c_slave, PXA2xxI2CSlaveState),
1445         VMSTATE_END_OF_LIST()
1446     }
1447 };
1448 
1449 static int pxa2xx_i2c_slave_init(I2CSlave *i2c)
1450 {
1451     /* Nothing to do.  */
1452     return 0;
1453 }
1454 
1455 static void pxa2xx_i2c_slave_class_init(ObjectClass *klass, void *data)
1456 {
1457     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
1458 
1459     k->init = pxa2xx_i2c_slave_init;
1460     k->event = pxa2xx_i2c_event;
1461     k->recv = pxa2xx_i2c_rx;
1462     k->send = pxa2xx_i2c_tx;
1463 }
1464 
1465 static const TypeInfo pxa2xx_i2c_slave_info = {
1466     .name          = TYPE_PXA2XX_I2C_SLAVE,
1467     .parent        = TYPE_I2C_SLAVE,
1468     .instance_size = sizeof(PXA2xxI2CSlaveState),
1469     .class_init    = pxa2xx_i2c_slave_class_init,
1470 };
1471 
1472 PXA2xxI2CState *pxa2xx_i2c_init(hwaddr base,
1473                 qemu_irq irq, uint32_t region_size)
1474 {
1475     DeviceState *dev;
1476     SysBusDevice *i2c_dev;
1477     PXA2xxI2CState *s;
1478     I2CBus *i2cbus;
1479 
1480     dev = qdev_create(NULL, TYPE_PXA2XX_I2C);
1481     qdev_prop_set_uint32(dev, "size", region_size + 1);
1482     qdev_prop_set_uint32(dev, "offset", base & region_size);
1483     qdev_init_nofail(dev);
1484 
1485     i2c_dev = SYS_BUS_DEVICE(dev);
1486     sysbus_mmio_map(i2c_dev, 0, base & ~region_size);
1487     sysbus_connect_irq(i2c_dev, 0, irq);
1488 
1489     s = PXA2XX_I2C(i2c_dev);
1490     /* FIXME: Should the slave device really be on a separate bus?  */
1491     i2cbus = i2c_init_bus(dev, "dummy");
1492     dev = i2c_create_slave(i2cbus, TYPE_PXA2XX_I2C_SLAVE, 0);
1493     s->slave = PXA2XX_I2C_SLAVE(dev);
1494     s->slave->host = s;
1495 
1496     return s;
1497 }
1498 
1499 static int pxa2xx_i2c_initfn(SysBusDevice *sbd)
1500 {
1501     DeviceState *dev = DEVICE(sbd);
1502     PXA2xxI2CState *s = PXA2XX_I2C(dev);
1503 
1504     s->bus = i2c_init_bus(dev, "i2c");
1505 
1506     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_i2c_ops, s,
1507                           "pxa2xx-i2c", s->region_size);
1508     sysbus_init_mmio(sbd, &s->iomem);
1509     sysbus_init_irq(sbd, &s->irq);
1510 
1511     return 0;
1512 }
1513 
1514 I2CBus *pxa2xx_i2c_bus(PXA2xxI2CState *s)
1515 {
1516     return s->bus;
1517 }
1518 
1519 static Property pxa2xx_i2c_properties[] = {
1520     DEFINE_PROP_UINT32("size", PXA2xxI2CState, region_size, 0x10000),
1521     DEFINE_PROP_UINT32("offset", PXA2xxI2CState, offset, 0),
1522     DEFINE_PROP_END_OF_LIST(),
1523 };
1524 
1525 static void pxa2xx_i2c_class_init(ObjectClass *klass, void *data)
1526 {
1527     DeviceClass *dc = DEVICE_CLASS(klass);
1528     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
1529 
1530     k->init = pxa2xx_i2c_initfn;
1531     dc->desc = "PXA2xx I2C Bus Controller";
1532     dc->vmsd = &vmstate_pxa2xx_i2c;
1533     dc->props = pxa2xx_i2c_properties;
1534 }
1535 
1536 static const TypeInfo pxa2xx_i2c_info = {
1537     .name          = TYPE_PXA2XX_I2C,
1538     .parent        = TYPE_SYS_BUS_DEVICE,
1539     .instance_size = sizeof(PXA2xxI2CState),
1540     .class_init    = pxa2xx_i2c_class_init,
1541 };
1542 
1543 /* PXA Inter-IC Sound Controller */
1544 static void pxa2xx_i2s_reset(PXA2xxI2SState *i2s)
1545 {
1546     i2s->rx_len = 0;
1547     i2s->tx_len = 0;
1548     i2s->fifo_len = 0;
1549     i2s->clk = 0x1a;
1550     i2s->control[0] = 0x00;
1551     i2s->control[1] = 0x00;
1552     i2s->status = 0x00;
1553     i2s->mask = 0x00;
1554 }
1555 
1556 #define SACR_TFTH(val)	((val >> 8) & 0xf)
1557 #define SACR_RFTH(val)	((val >> 12) & 0xf)
1558 #define SACR_DREC(val)	(val & (1 << 3))
1559 #define SACR_DPRL(val)	(val & (1 << 4))
1560 
1561 static inline void pxa2xx_i2s_update(PXA2xxI2SState *i2s)
1562 {
1563     int rfs, tfs;
1564     rfs = SACR_RFTH(i2s->control[0]) < i2s->rx_len &&
1565             !SACR_DREC(i2s->control[1]);
1566     tfs = (i2s->tx_len || i2s->fifo_len < SACR_TFTH(i2s->control[0])) &&
1567             i2s->enable && !SACR_DPRL(i2s->control[1]);
1568 
1569     qemu_set_irq(i2s->rx_dma, rfs);
1570     qemu_set_irq(i2s->tx_dma, tfs);
1571 
1572     i2s->status &= 0xe0;
1573     if (i2s->fifo_len < 16 || !i2s->enable)
1574         i2s->status |= 1 << 0;			/* TNF */
1575     if (i2s->rx_len)
1576         i2s->status |= 1 << 1;			/* RNE */
1577     if (i2s->enable)
1578         i2s->status |= 1 << 2;			/* BSY */
1579     if (tfs)
1580         i2s->status |= 1 << 3;			/* TFS */
1581     if (rfs)
1582         i2s->status |= 1 << 4;			/* RFS */
1583     if (!(i2s->tx_len && i2s->enable))
1584         i2s->status |= i2s->fifo_len << 8;	/* TFL */
1585     i2s->status |= MAX(i2s->rx_len, 0xf) << 12;	/* RFL */
1586 
1587     qemu_set_irq(i2s->irq, i2s->status & i2s->mask);
1588 }
1589 
1590 #define SACR0	0x00	/* Serial Audio Global Control register */
1591 #define SACR1	0x04	/* Serial Audio I2S/MSB-Justified Control register */
1592 #define SASR0	0x0c	/* Serial Audio Interface and FIFO Status register */
1593 #define SAIMR	0x14	/* Serial Audio Interrupt Mask register */
1594 #define SAICR	0x18	/* Serial Audio Interrupt Clear register */
1595 #define SADIV	0x60	/* Serial Audio Clock Divider register */
1596 #define SADR	0x80	/* Serial Audio Data register */
1597 
1598 static uint64_t pxa2xx_i2s_read(void *opaque, hwaddr addr,
1599                                 unsigned size)
1600 {
1601     PXA2xxI2SState *s = (PXA2xxI2SState *) opaque;
1602 
1603     switch (addr) {
1604     case SACR0:
1605         return s->control[0];
1606     case SACR1:
1607         return s->control[1];
1608     case SASR0:
1609         return s->status;
1610     case SAIMR:
1611         return s->mask;
1612     case SAICR:
1613         return 0;
1614     case SADIV:
1615         return s->clk;
1616     case SADR:
1617         if (s->rx_len > 0) {
1618             s->rx_len --;
1619             pxa2xx_i2s_update(s);
1620             return s->codec_in(s->opaque);
1621         }
1622         return 0;
1623     default:
1624         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1625         break;
1626     }
1627     return 0;
1628 }
1629 
1630 static void pxa2xx_i2s_write(void *opaque, hwaddr addr,
1631                              uint64_t value, unsigned size)
1632 {
1633     PXA2xxI2SState *s = (PXA2xxI2SState *) opaque;
1634     uint32_t *sample;
1635 
1636     switch (addr) {
1637     case SACR0:
1638         if (value & (1 << 3))				/* RST */
1639             pxa2xx_i2s_reset(s);
1640         s->control[0] = value & 0xff3d;
1641         if (!s->enable && (value & 1) && s->tx_len) {	/* ENB */
1642             for (sample = s->fifo; s->fifo_len > 0; s->fifo_len --, sample ++)
1643                 s->codec_out(s->opaque, *sample);
1644             s->status &= ~(1 << 7);			/* I2SOFF */
1645         }
1646         if (value & (1 << 4))				/* EFWR */
1647             printf("%s: Attempt to use special function\n", __FUNCTION__);
1648         s->enable = (value & 9) == 1;			/* ENB && !RST*/
1649         pxa2xx_i2s_update(s);
1650         break;
1651     case SACR1:
1652         s->control[1] = value & 0x0039;
1653         if (value & (1 << 5))				/* ENLBF */
1654             printf("%s: Attempt to use loopback function\n", __FUNCTION__);
1655         if (value & (1 << 4))				/* DPRL */
1656             s->fifo_len = 0;
1657         pxa2xx_i2s_update(s);
1658         break;
1659     case SAIMR:
1660         s->mask = value & 0x0078;
1661         pxa2xx_i2s_update(s);
1662         break;
1663     case SAICR:
1664         s->status &= ~(value & (3 << 5));
1665         pxa2xx_i2s_update(s);
1666         break;
1667     case SADIV:
1668         s->clk = value & 0x007f;
1669         break;
1670     case SADR:
1671         if (s->tx_len && s->enable) {
1672             s->tx_len --;
1673             pxa2xx_i2s_update(s);
1674             s->codec_out(s->opaque, value);
1675         } else if (s->fifo_len < 16) {
1676             s->fifo[s->fifo_len ++] = value;
1677             pxa2xx_i2s_update(s);
1678         }
1679         break;
1680     default:
1681         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1682     }
1683 }
1684 
1685 static const MemoryRegionOps pxa2xx_i2s_ops = {
1686     .read = pxa2xx_i2s_read,
1687     .write = pxa2xx_i2s_write,
1688     .endianness = DEVICE_NATIVE_ENDIAN,
1689 };
1690 
1691 static const VMStateDescription vmstate_pxa2xx_i2s = {
1692     .name = "pxa2xx_i2s",
1693     .version_id = 0,
1694     .minimum_version_id = 0,
1695     .fields = (VMStateField[]) {
1696         VMSTATE_UINT32_ARRAY(control, PXA2xxI2SState, 2),
1697         VMSTATE_UINT32(status, PXA2xxI2SState),
1698         VMSTATE_UINT32(mask, PXA2xxI2SState),
1699         VMSTATE_UINT32(clk, PXA2xxI2SState),
1700         VMSTATE_INT32(enable, PXA2xxI2SState),
1701         VMSTATE_INT32(rx_len, PXA2xxI2SState),
1702         VMSTATE_INT32(tx_len, PXA2xxI2SState),
1703         VMSTATE_INT32(fifo_len, PXA2xxI2SState),
1704         VMSTATE_END_OF_LIST()
1705     }
1706 };
1707 
1708 static void pxa2xx_i2s_data_req(void *opaque, int tx, int rx)
1709 {
1710     PXA2xxI2SState *s = (PXA2xxI2SState *) opaque;
1711     uint32_t *sample;
1712 
1713     /* Signal FIFO errors */
1714     if (s->enable && s->tx_len)
1715         s->status |= 1 << 5;		/* TUR */
1716     if (s->enable && s->rx_len)
1717         s->status |= 1 << 6;		/* ROR */
1718 
1719     /* Should be tx - MIN(tx, s->fifo_len) but we don't really need to
1720      * handle the cases where it makes a difference.  */
1721     s->tx_len = tx - s->fifo_len;
1722     s->rx_len = rx;
1723     /* Note that is s->codec_out wasn't set, we wouldn't get called.  */
1724     if (s->enable)
1725         for (sample = s->fifo; s->fifo_len; s->fifo_len --, sample ++)
1726             s->codec_out(s->opaque, *sample);
1727     pxa2xx_i2s_update(s);
1728 }
1729 
1730 static PXA2xxI2SState *pxa2xx_i2s_init(MemoryRegion *sysmem,
1731                 hwaddr base,
1732                 qemu_irq irq, qemu_irq rx_dma, qemu_irq tx_dma)
1733 {
1734     PXA2xxI2SState *s = g_new0(PXA2xxI2SState, 1);
1735 
1736     s->irq = irq;
1737     s->rx_dma = rx_dma;
1738     s->tx_dma = tx_dma;
1739     s->data_req = pxa2xx_i2s_data_req;
1740 
1741     pxa2xx_i2s_reset(s);
1742 
1743     memory_region_init_io(&s->iomem, NULL, &pxa2xx_i2s_ops, s,
1744                           "pxa2xx-i2s", 0x100000);
1745     memory_region_add_subregion(sysmem, base, &s->iomem);
1746 
1747     vmstate_register(NULL, base, &vmstate_pxa2xx_i2s, s);
1748 
1749     return s;
1750 }
1751 
1752 /* PXA Fast Infra-red Communications Port */
1753 #define TYPE_PXA2XX_FIR "pxa2xx-fir"
1754 #define PXA2XX_FIR(obj) OBJECT_CHECK(PXA2xxFIrState, (obj), TYPE_PXA2XX_FIR)
1755 
1756 struct PXA2xxFIrState {
1757     /*< private >*/
1758     SysBusDevice parent_obj;
1759     /*< public >*/
1760 
1761     MemoryRegion iomem;
1762     qemu_irq irq;
1763     qemu_irq rx_dma;
1764     qemu_irq tx_dma;
1765     uint32_t enable;
1766     CharDriverState *chr;
1767 
1768     uint8_t control[3];
1769     uint8_t status[2];
1770 
1771     uint32_t rx_len;
1772     uint32_t rx_start;
1773     uint8_t rx_fifo[64];
1774 };
1775 
1776 static void pxa2xx_fir_reset(DeviceState *d)
1777 {
1778     PXA2xxFIrState *s = PXA2XX_FIR(d);
1779 
1780     s->control[0] = 0x00;
1781     s->control[1] = 0x00;
1782     s->control[2] = 0x00;
1783     s->status[0] = 0x00;
1784     s->status[1] = 0x00;
1785     s->enable = 0;
1786 }
1787 
1788 static inline void pxa2xx_fir_update(PXA2xxFIrState *s)
1789 {
1790     static const int tresh[4] = { 8, 16, 32, 0 };
1791     int intr = 0;
1792     if ((s->control[0] & (1 << 4)) &&			/* RXE */
1793                     s->rx_len >= tresh[s->control[2] & 3])	/* TRIG */
1794         s->status[0] |= 1 << 4;				/* RFS */
1795     else
1796         s->status[0] &= ~(1 << 4);			/* RFS */
1797     if (s->control[0] & (1 << 3))			/* TXE */
1798         s->status[0] |= 1 << 3;				/* TFS */
1799     else
1800         s->status[0] &= ~(1 << 3);			/* TFS */
1801     if (s->rx_len)
1802         s->status[1] |= 1 << 2;				/* RNE */
1803     else
1804         s->status[1] &= ~(1 << 2);			/* RNE */
1805     if (s->control[0] & (1 << 4))			/* RXE */
1806         s->status[1] |= 1 << 0;				/* RSY */
1807     else
1808         s->status[1] &= ~(1 << 0);			/* RSY */
1809 
1810     intr |= (s->control[0] & (1 << 5)) &&		/* RIE */
1811             (s->status[0] & (1 << 4));			/* RFS */
1812     intr |= (s->control[0] & (1 << 6)) &&		/* TIE */
1813             (s->status[0] & (1 << 3));			/* TFS */
1814     intr |= (s->control[2] & (1 << 4)) &&		/* TRAIL */
1815             (s->status[0] & (1 << 6));			/* EOC */
1816     intr |= (s->control[0] & (1 << 2)) &&		/* TUS */
1817             (s->status[0] & (1 << 1));			/* TUR */
1818     intr |= s->status[0] & 0x25;			/* FRE, RAB, EIF */
1819 
1820     qemu_set_irq(s->rx_dma, (s->status[0] >> 4) & 1);
1821     qemu_set_irq(s->tx_dma, (s->status[0] >> 3) & 1);
1822 
1823     qemu_set_irq(s->irq, intr && s->enable);
1824 }
1825 
1826 #define ICCR0	0x00	/* FICP Control register 0 */
1827 #define ICCR1	0x04	/* FICP Control register 1 */
1828 #define ICCR2	0x08	/* FICP Control register 2 */
1829 #define ICDR	0x0c	/* FICP Data register */
1830 #define ICSR0	0x14	/* FICP Status register 0 */
1831 #define ICSR1	0x18	/* FICP Status register 1 */
1832 #define ICFOR	0x1c	/* FICP FIFO Occupancy Status register */
1833 
1834 static uint64_t pxa2xx_fir_read(void *opaque, hwaddr addr,
1835                                 unsigned size)
1836 {
1837     PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1838     uint8_t ret;
1839 
1840     switch (addr) {
1841     case ICCR0:
1842         return s->control[0];
1843     case ICCR1:
1844         return s->control[1];
1845     case ICCR2:
1846         return s->control[2];
1847     case ICDR:
1848         s->status[0] &= ~0x01;
1849         s->status[1] &= ~0x72;
1850         if (s->rx_len) {
1851             s->rx_len --;
1852             ret = s->rx_fifo[s->rx_start ++];
1853             s->rx_start &= 63;
1854             pxa2xx_fir_update(s);
1855             return ret;
1856         }
1857         printf("%s: Rx FIFO underrun.\n", __FUNCTION__);
1858         break;
1859     case ICSR0:
1860         return s->status[0];
1861     case ICSR1:
1862         return s->status[1] | (1 << 3);			/* TNF */
1863     case ICFOR:
1864         return s->rx_len;
1865     default:
1866         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1867         break;
1868     }
1869     return 0;
1870 }
1871 
1872 static void pxa2xx_fir_write(void *opaque, hwaddr addr,
1873                              uint64_t value64, unsigned size)
1874 {
1875     PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1876     uint32_t value = value64;
1877     uint8_t ch;
1878 
1879     switch (addr) {
1880     case ICCR0:
1881         s->control[0] = value;
1882         if (!(value & (1 << 4)))			/* RXE */
1883             s->rx_len = s->rx_start = 0;
1884         if (!(value & (1 << 3))) {                      /* TXE */
1885             /* Nop */
1886         }
1887         s->enable = value & 1;				/* ITR */
1888         if (!s->enable)
1889             s->status[0] = 0;
1890         pxa2xx_fir_update(s);
1891         break;
1892     case ICCR1:
1893         s->control[1] = value;
1894         break;
1895     case ICCR2:
1896         s->control[2] = value & 0x3f;
1897         pxa2xx_fir_update(s);
1898         break;
1899     case ICDR:
1900         if (s->control[2] & (1 << 2))			/* TXP */
1901             ch = value;
1902         else
1903             ch = ~value;
1904         if (s->chr && s->enable && (s->control[0] & (1 << 3)))	/* TXE */
1905             qemu_chr_fe_write(s->chr, &ch, 1);
1906         break;
1907     case ICSR0:
1908         s->status[0] &= ~(value & 0x66);
1909         pxa2xx_fir_update(s);
1910         break;
1911     case ICFOR:
1912         break;
1913     default:
1914         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1915     }
1916 }
1917 
1918 static const MemoryRegionOps pxa2xx_fir_ops = {
1919     .read = pxa2xx_fir_read,
1920     .write = pxa2xx_fir_write,
1921     .endianness = DEVICE_NATIVE_ENDIAN,
1922 };
1923 
1924 static int pxa2xx_fir_is_empty(void *opaque)
1925 {
1926     PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1927     return (s->rx_len < 64);
1928 }
1929 
1930 static void pxa2xx_fir_rx(void *opaque, const uint8_t *buf, int size)
1931 {
1932     PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1933     if (!(s->control[0] & (1 << 4)))			/* RXE */
1934         return;
1935 
1936     while (size --) {
1937         s->status[1] |= 1 << 4;				/* EOF */
1938         if (s->rx_len >= 64) {
1939             s->status[1] |= 1 << 6;			/* ROR */
1940             break;
1941         }
1942 
1943         if (s->control[2] & (1 << 3))			/* RXP */
1944             s->rx_fifo[(s->rx_start + s->rx_len ++) & 63] = *(buf ++);
1945         else
1946             s->rx_fifo[(s->rx_start + s->rx_len ++) & 63] = ~*(buf ++);
1947     }
1948 
1949     pxa2xx_fir_update(s);
1950 }
1951 
1952 static void pxa2xx_fir_event(void *opaque, int event)
1953 {
1954 }
1955 
1956 static void pxa2xx_fir_instance_init(Object *obj)
1957 {
1958     PXA2xxFIrState *s = PXA2XX_FIR(obj);
1959     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
1960 
1961     memory_region_init_io(&s->iomem, NULL, &pxa2xx_fir_ops, s,
1962                           "pxa2xx-fir", 0x1000);
1963     sysbus_init_mmio(sbd, &s->iomem);
1964     sysbus_init_irq(sbd, &s->irq);
1965     sysbus_init_irq(sbd, &s->rx_dma);
1966     sysbus_init_irq(sbd, &s->tx_dma);
1967 }
1968 
1969 static void pxa2xx_fir_realize(DeviceState *dev, Error **errp)
1970 {
1971     PXA2xxFIrState *s = PXA2XX_FIR(dev);
1972 
1973     if (s->chr) {
1974         qemu_chr_fe_claim_no_fail(s->chr);
1975         qemu_chr_add_handlers(s->chr, pxa2xx_fir_is_empty,
1976                         pxa2xx_fir_rx, pxa2xx_fir_event, s);
1977     }
1978 }
1979 
1980 static bool pxa2xx_fir_vmstate_validate(void *opaque, int version_id)
1981 {
1982     PXA2xxFIrState *s = opaque;
1983 
1984     return s->rx_start < ARRAY_SIZE(s->rx_fifo);
1985 }
1986 
1987 static const VMStateDescription pxa2xx_fir_vmsd = {
1988     .name = "pxa2xx-fir",
1989     .version_id = 1,
1990     .minimum_version_id = 1,
1991     .fields = (VMStateField[]) {
1992         VMSTATE_UINT32(enable, PXA2xxFIrState),
1993         VMSTATE_UINT8_ARRAY(control, PXA2xxFIrState, 3),
1994         VMSTATE_UINT8_ARRAY(status, PXA2xxFIrState, 2),
1995         VMSTATE_UINT32(rx_len, PXA2xxFIrState),
1996         VMSTATE_UINT32(rx_start, PXA2xxFIrState),
1997         VMSTATE_VALIDATE("fifo is 64 bytes", pxa2xx_fir_vmstate_validate),
1998         VMSTATE_UINT8_ARRAY(rx_fifo, PXA2xxFIrState, 64),
1999         VMSTATE_END_OF_LIST()
2000     }
2001 };
2002 
2003 static Property pxa2xx_fir_properties[] = {
2004     DEFINE_PROP_CHR("chardev", PXA2xxFIrState, chr),
2005     DEFINE_PROP_END_OF_LIST(),
2006 };
2007 
2008 static void pxa2xx_fir_class_init(ObjectClass *klass, void *data)
2009 {
2010     DeviceClass *dc = DEVICE_CLASS(klass);
2011 
2012     dc->realize = pxa2xx_fir_realize;
2013     dc->vmsd = &pxa2xx_fir_vmsd;
2014     dc->props = pxa2xx_fir_properties;
2015     dc->reset = pxa2xx_fir_reset;
2016 }
2017 
2018 static const TypeInfo pxa2xx_fir_info = {
2019     .name = TYPE_PXA2XX_FIR,
2020     .parent = TYPE_SYS_BUS_DEVICE,
2021     .instance_size = sizeof(PXA2xxFIrState),
2022     .class_init = pxa2xx_fir_class_init,
2023     .instance_init = pxa2xx_fir_instance_init,
2024 };
2025 
2026 static PXA2xxFIrState *pxa2xx_fir_init(MemoryRegion *sysmem,
2027                                        hwaddr base,
2028                                        qemu_irq irq, qemu_irq rx_dma,
2029                                        qemu_irq tx_dma,
2030                                        CharDriverState *chr)
2031 {
2032     DeviceState *dev;
2033     SysBusDevice *sbd;
2034 
2035     dev = qdev_create(NULL, TYPE_PXA2XX_FIR);
2036     qdev_prop_set_chr(dev, "chardev", chr);
2037     qdev_init_nofail(dev);
2038     sbd = SYS_BUS_DEVICE(dev);
2039     sysbus_mmio_map(sbd, 0, base);
2040     sysbus_connect_irq(sbd, 0, irq);
2041     sysbus_connect_irq(sbd, 1, rx_dma);
2042     sysbus_connect_irq(sbd, 2, tx_dma);
2043     return PXA2XX_FIR(dev);
2044 }
2045 
2046 static void pxa2xx_reset(void *opaque, int line, int level)
2047 {
2048     PXA2xxState *s = (PXA2xxState *) opaque;
2049 
2050     if (level && (s->pm_regs[PCFR >> 2] & 0x10)) {	/* GPR_EN */
2051         cpu_reset(CPU(s->cpu));
2052         /* TODO: reset peripherals */
2053     }
2054 }
2055 
2056 /* Initialise a PXA270 integrated chip (ARM based core).  */
2057 PXA2xxState *pxa270_init(MemoryRegion *address_space,
2058                          unsigned int sdram_size, const char *revision)
2059 {
2060     PXA2xxState *s;
2061     int i;
2062     DriveInfo *dinfo;
2063     s = g_new0(PXA2xxState, 1);
2064 
2065     if (revision && strncmp(revision, "pxa27", 5)) {
2066         fprintf(stderr, "Machine requires a PXA27x processor.\n");
2067         exit(1);
2068     }
2069     if (!revision)
2070         revision = "pxa270";
2071 
2072     s->cpu = cpu_arm_init(revision);
2073     if (s->cpu == NULL) {
2074         fprintf(stderr, "Unable to find CPU definition\n");
2075         exit(1);
2076     }
2077     s->reset = qemu_allocate_irq(pxa2xx_reset, s, 0);
2078 
2079     /* SDRAM & Internal Memory Storage */
2080     memory_region_init_ram(&s->sdram, NULL, "pxa270.sdram", sdram_size,
2081                            &error_abort);
2082     vmstate_register_ram_global(&s->sdram);
2083     memory_region_add_subregion(address_space, PXA2XX_SDRAM_BASE, &s->sdram);
2084     memory_region_init_ram(&s->internal, NULL, "pxa270.internal", 0x40000,
2085                            &error_abort);
2086     vmstate_register_ram_global(&s->internal);
2087     memory_region_add_subregion(address_space, PXA2XX_INTERNAL_BASE,
2088                                 &s->internal);
2089 
2090     s->pic = pxa2xx_pic_init(0x40d00000, s->cpu);
2091 
2092     s->dma = pxa27x_dma_init(0x40000000,
2093                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_DMA));
2094 
2095     sysbus_create_varargs("pxa27x-timer", 0x40a00000,
2096                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 0),
2097                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 1),
2098                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 2),
2099                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 3),
2100                     qdev_get_gpio_in(s->pic, PXA27X_PIC_OST_4_11),
2101                     NULL);
2102 
2103     s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 121);
2104 
2105     dinfo = drive_get(IF_SD, 0, 0);
2106     if (!dinfo) {
2107         fprintf(stderr, "qemu: missing SecureDigital device\n");
2108         exit(1);
2109     }
2110     s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
2111                     blk_by_legacy_dinfo(dinfo),
2112                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
2113                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
2114                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
2115 
2116     for (i = 0; pxa270_serial[i].io_base; i++) {
2117         if (serial_hds[i]) {
2118             serial_mm_init(address_space, pxa270_serial[i].io_base, 2,
2119                            qdev_get_gpio_in(s->pic, pxa270_serial[i].irqn),
2120                            14857000 / 16, serial_hds[i],
2121                            DEVICE_NATIVE_ENDIAN);
2122         } else {
2123             break;
2124         }
2125     }
2126     if (serial_hds[i])
2127         s->fir = pxa2xx_fir_init(address_space, 0x40800000,
2128                         qdev_get_gpio_in(s->pic, PXA2XX_PIC_ICP),
2129                         qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_ICP),
2130                         qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_ICP),
2131                         serial_hds[i]);
2132 
2133     s->lcd = pxa2xx_lcdc_init(address_space, 0x44000000,
2134                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_LCD));
2135 
2136     s->cm_base = 0x41300000;
2137     s->cm_regs[CCCR >> 2] = 0x02000210;	/* 416.0 MHz */
2138     s->clkcfg = 0x00000009;		/* Turbo mode active */
2139     memory_region_init_io(&s->cm_iomem, NULL, &pxa2xx_cm_ops, s, "pxa2xx-cm", 0x1000);
2140     memory_region_add_subregion(address_space, s->cm_base, &s->cm_iomem);
2141     vmstate_register(NULL, 0, &vmstate_pxa2xx_cm, s);
2142 
2143     pxa2xx_setup_cp14(s);
2144 
2145     s->mm_base = 0x48000000;
2146     s->mm_regs[MDMRS >> 2] = 0x00020002;
2147     s->mm_regs[MDREFR >> 2] = 0x03ca4000;
2148     s->mm_regs[MECR >> 2] = 0x00000001;	/* Two PC Card sockets */
2149     memory_region_init_io(&s->mm_iomem, NULL, &pxa2xx_mm_ops, s, "pxa2xx-mm", 0x1000);
2150     memory_region_add_subregion(address_space, s->mm_base, &s->mm_iomem);
2151     vmstate_register(NULL, 0, &vmstate_pxa2xx_mm, s);
2152 
2153     s->pm_base = 0x40f00000;
2154     memory_region_init_io(&s->pm_iomem, NULL, &pxa2xx_pm_ops, s, "pxa2xx-pm", 0x100);
2155     memory_region_add_subregion(address_space, s->pm_base, &s->pm_iomem);
2156     vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
2157 
2158     for (i = 0; pxa27x_ssp[i].io_base; i ++);
2159     s->ssp = g_new0(SSIBus *, i);
2160     for (i = 0; pxa27x_ssp[i].io_base; i ++) {
2161         DeviceState *dev;
2162         dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa27x_ssp[i].io_base,
2163                         qdev_get_gpio_in(s->pic, pxa27x_ssp[i].irqn));
2164         s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
2165     }
2166 
2167     if (usb_enabled()) {
2168         sysbus_create_simple("sysbus-ohci", 0x4c000000,
2169                         qdev_get_gpio_in(s->pic, PXA2XX_PIC_USBH1));
2170     }
2171 
2172     s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
2173     s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
2174 
2175     sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000,
2176                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM));
2177 
2178     s->i2c[0] = pxa2xx_i2c_init(0x40301600,
2179                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2C), 0xffff);
2180     s->i2c[1] = pxa2xx_i2c_init(0x40f00100,
2181                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_PWRI2C), 0xff);
2182 
2183     s->i2s = pxa2xx_i2s_init(address_space, 0x40400000,
2184                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2S),
2185                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_I2S),
2186                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_I2S));
2187 
2188     s->kp = pxa27x_keypad_init(address_space, 0x41500000,
2189                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_KEYPAD));
2190 
2191     /* GPIO1 resets the processor */
2192     /* The handler can be overridden by board-specific code */
2193     qdev_connect_gpio_out(s->gpio, 1, s->reset);
2194     return s;
2195 }
2196 
2197 /* Initialise a PXA255 integrated chip (ARM based core).  */
2198 PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
2199 {
2200     PXA2xxState *s;
2201     int i;
2202     DriveInfo *dinfo;
2203 
2204     s = g_new0(PXA2xxState, 1);
2205 
2206     s->cpu = cpu_arm_init("pxa255");
2207     if (s->cpu == NULL) {
2208         fprintf(stderr, "Unable to find CPU definition\n");
2209         exit(1);
2210     }
2211     s->reset = qemu_allocate_irq(pxa2xx_reset, s, 0);
2212 
2213     /* SDRAM & Internal Memory Storage */
2214     memory_region_init_ram(&s->sdram, NULL, "pxa255.sdram", sdram_size,
2215                            &error_abort);
2216     vmstate_register_ram_global(&s->sdram);
2217     memory_region_add_subregion(address_space, PXA2XX_SDRAM_BASE, &s->sdram);
2218     memory_region_init_ram(&s->internal, NULL, "pxa255.internal",
2219                            PXA2XX_INTERNAL_SIZE, &error_abort);
2220     vmstate_register_ram_global(&s->internal);
2221     memory_region_add_subregion(address_space, PXA2XX_INTERNAL_BASE,
2222                                 &s->internal);
2223 
2224     s->pic = pxa2xx_pic_init(0x40d00000, s->cpu);
2225 
2226     s->dma = pxa255_dma_init(0x40000000,
2227                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_DMA));
2228 
2229     sysbus_create_varargs("pxa25x-timer", 0x40a00000,
2230                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 0),
2231                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 1),
2232                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 2),
2233                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 3),
2234                     NULL);
2235 
2236     s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 85);
2237 
2238     dinfo = drive_get(IF_SD, 0, 0);
2239     if (!dinfo) {
2240         fprintf(stderr, "qemu: missing SecureDigital device\n");
2241         exit(1);
2242     }
2243     s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
2244                     blk_by_legacy_dinfo(dinfo),
2245                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
2246                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
2247                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
2248 
2249     for (i = 0; pxa255_serial[i].io_base; i++) {
2250         if (serial_hds[i]) {
2251             serial_mm_init(address_space, pxa255_serial[i].io_base, 2,
2252                            qdev_get_gpio_in(s->pic, pxa255_serial[i].irqn),
2253                            14745600 / 16, serial_hds[i],
2254                            DEVICE_NATIVE_ENDIAN);
2255         } else {
2256             break;
2257         }
2258     }
2259     if (serial_hds[i])
2260         s->fir = pxa2xx_fir_init(address_space, 0x40800000,
2261                         qdev_get_gpio_in(s->pic, PXA2XX_PIC_ICP),
2262                         qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_ICP),
2263                         qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_ICP),
2264                         serial_hds[i]);
2265 
2266     s->lcd = pxa2xx_lcdc_init(address_space, 0x44000000,
2267                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_LCD));
2268 
2269     s->cm_base = 0x41300000;
2270     s->cm_regs[CCCR >> 2] = 0x02000210;	/* 416.0 MHz */
2271     s->clkcfg = 0x00000009;		/* Turbo mode active */
2272     memory_region_init_io(&s->cm_iomem, NULL, &pxa2xx_cm_ops, s, "pxa2xx-cm", 0x1000);
2273     memory_region_add_subregion(address_space, s->cm_base, &s->cm_iomem);
2274     vmstate_register(NULL, 0, &vmstate_pxa2xx_cm, s);
2275 
2276     pxa2xx_setup_cp14(s);
2277 
2278     s->mm_base = 0x48000000;
2279     s->mm_regs[MDMRS >> 2] = 0x00020002;
2280     s->mm_regs[MDREFR >> 2] = 0x03ca4000;
2281     s->mm_regs[MECR >> 2] = 0x00000001;	/* Two PC Card sockets */
2282     memory_region_init_io(&s->mm_iomem, NULL, &pxa2xx_mm_ops, s, "pxa2xx-mm", 0x1000);
2283     memory_region_add_subregion(address_space, s->mm_base, &s->mm_iomem);
2284     vmstate_register(NULL, 0, &vmstate_pxa2xx_mm, s);
2285 
2286     s->pm_base = 0x40f00000;
2287     memory_region_init_io(&s->pm_iomem, NULL, &pxa2xx_pm_ops, s, "pxa2xx-pm", 0x100);
2288     memory_region_add_subregion(address_space, s->pm_base, &s->pm_iomem);
2289     vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
2290 
2291     for (i = 0; pxa255_ssp[i].io_base; i ++);
2292     s->ssp = g_new0(SSIBus *, i);
2293     for (i = 0; pxa255_ssp[i].io_base; i ++) {
2294         DeviceState *dev;
2295         dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa255_ssp[i].io_base,
2296                         qdev_get_gpio_in(s->pic, pxa255_ssp[i].irqn));
2297         s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
2298     }
2299 
2300     if (usb_enabled()) {
2301         sysbus_create_simple("sysbus-ohci", 0x4c000000,
2302                         qdev_get_gpio_in(s->pic, PXA2XX_PIC_USBH1));
2303     }
2304 
2305     s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
2306     s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
2307 
2308     sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000,
2309                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM));
2310 
2311     s->i2c[0] = pxa2xx_i2c_init(0x40301600,
2312                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2C), 0xffff);
2313     s->i2c[1] = pxa2xx_i2c_init(0x40f00100,
2314                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_PWRI2C), 0xff);
2315 
2316     s->i2s = pxa2xx_i2s_init(address_space, 0x40400000,
2317                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2S),
2318                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_I2S),
2319                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_I2S));
2320 
2321     /* GPIO1 resets the processor */
2322     /* The handler can be overridden by board-specific code */
2323     qdev_connect_gpio_out(s->gpio, 1, s->reset);
2324     return s;
2325 }
2326 
2327 static void pxa2xx_ssp_class_init(ObjectClass *klass, void *data)
2328 {
2329     SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
2330     DeviceClass *dc = DEVICE_CLASS(klass);
2331 
2332     sdc->init = pxa2xx_ssp_init;
2333     dc->reset = pxa2xx_ssp_reset;
2334     dc->vmsd = &vmstate_pxa2xx_ssp;
2335 }
2336 
2337 static const TypeInfo pxa2xx_ssp_info = {
2338     .name          = TYPE_PXA2XX_SSP,
2339     .parent        = TYPE_SYS_BUS_DEVICE,
2340     .instance_size = sizeof(PXA2xxSSPState),
2341     .class_init    = pxa2xx_ssp_class_init,
2342 };
2343 
2344 static void pxa2xx_register_types(void)
2345 {
2346     type_register_static(&pxa2xx_i2c_slave_info);
2347     type_register_static(&pxa2xx_ssp_info);
2348     type_register_static(&pxa2xx_i2c_info);
2349     type_register_static(&pxa2xx_rtc_sysbus_info);
2350     type_register_static(&pxa2xx_fir_info);
2351 }
2352 
2353 type_init(pxa2xx_register_types)
2354