xref: /openbmc/qemu/hw/arm/stellaris.c (revision 354908ce)
1 /*
2  * Luminary Micro Stellaris peripherals
3  *
4  * Copyright (c) 2006 CodeSourcery.
5  * Written by Paul Brook
6  *
7  * This code is licensed under the GPL.
8  */
9 
10 #include "qemu/osdep.h"
11 #include "qapi/error.h"
12 #include "hw/sysbus.h"
13 #include "hw/ssi/ssi.h"
14 #include "hw/arm/boot.h"
15 #include "qemu/timer.h"
16 #include "hw/i2c/i2c.h"
17 #include "net/net.h"
18 #include "hw/boards.h"
19 #include "qemu/log.h"
20 #include "exec/address-spaces.h"
21 #include "sysemu/runstate.h"
22 #include "sysemu/sysemu.h"
23 #include "hw/arm/armv7m.h"
24 #include "hw/char/pl011.h"
25 #include "hw/input/gamepad.h"
26 #include "hw/irq.h"
27 #include "hw/watchdog/cmsdk-apb-watchdog.h"
28 #include "migration/vmstate.h"
29 #include "hw/misc/unimp.h"
30 #include "cpu.h"
31 
32 #define GPIO_A 0
33 #define GPIO_B 1
34 #define GPIO_C 2
35 #define GPIO_D 3
36 #define GPIO_E 4
37 #define GPIO_F 5
38 #define GPIO_G 6
39 
40 #define BP_OLED_I2C  0x01
41 #define BP_OLED_SSI  0x02
42 #define BP_GAMEPAD   0x04
43 
44 #define NUM_IRQ_LINES 64
45 
46 typedef const struct {
47     const char *name;
48     uint32_t did0;
49     uint32_t did1;
50     uint32_t dc0;
51     uint32_t dc1;
52     uint32_t dc2;
53     uint32_t dc3;
54     uint32_t dc4;
55     uint32_t peripherals;
56 } stellaris_board_info;
57 
58 /* General purpose timer module.  */
59 
60 #define TYPE_STELLARIS_GPTM "stellaris-gptm"
61 #define STELLARIS_GPTM(obj) \
62     OBJECT_CHECK(gptm_state, (obj), TYPE_STELLARIS_GPTM)
63 
64 typedef struct gptm_state {
65     SysBusDevice parent_obj;
66 
67     MemoryRegion iomem;
68     uint32_t config;
69     uint32_t mode[2];
70     uint32_t control;
71     uint32_t state;
72     uint32_t mask;
73     uint32_t load[2];
74     uint32_t match[2];
75     uint32_t prescale[2];
76     uint32_t match_prescale[2];
77     uint32_t rtc;
78     int64_t tick[2];
79     struct gptm_state *opaque[2];
80     QEMUTimer *timer[2];
81     /* The timers have an alternate output used to trigger the ADC.  */
82     qemu_irq trigger;
83     qemu_irq irq;
84 } gptm_state;
85 
86 static void gptm_update_irq(gptm_state *s)
87 {
88     int level;
89     level = (s->state & s->mask) != 0;
90     qemu_set_irq(s->irq, level);
91 }
92 
93 static void gptm_stop(gptm_state *s, int n)
94 {
95     timer_del(s->timer[n]);
96 }
97 
98 static void gptm_reload(gptm_state *s, int n, int reset)
99 {
100     int64_t tick;
101     if (reset)
102         tick = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
103     else
104         tick = s->tick[n];
105 
106     if (s->config == 0) {
107         /* 32-bit CountDown.  */
108         uint32_t count;
109         count = s->load[0] | (s->load[1] << 16);
110         tick += (int64_t)count * system_clock_scale;
111     } else if (s->config == 1) {
112         /* 32-bit RTC.  1Hz tick.  */
113         tick += NANOSECONDS_PER_SECOND;
114     } else if (s->mode[n] == 0xa) {
115         /* PWM mode.  Not implemented.  */
116     } else {
117         qemu_log_mask(LOG_UNIMP,
118                       "GPTM: 16-bit timer mode unimplemented: 0x%x\n",
119                       s->mode[n]);
120         return;
121     }
122     s->tick[n] = tick;
123     timer_mod(s->timer[n], tick);
124 }
125 
126 static void gptm_tick(void *opaque)
127 {
128     gptm_state **p = (gptm_state **)opaque;
129     gptm_state *s;
130     int n;
131 
132     s = *p;
133     n = p - s->opaque;
134     if (s->config == 0) {
135         s->state |= 1;
136         if ((s->control & 0x20)) {
137             /* Output trigger.  */
138             qemu_irq_pulse(s->trigger);
139         }
140         if (s->mode[0] & 1) {
141             /* One-shot.  */
142             s->control &= ~1;
143         } else {
144             /* Periodic.  */
145             gptm_reload(s, 0, 0);
146         }
147     } else if (s->config == 1) {
148         /* RTC.  */
149         uint32_t match;
150         s->rtc++;
151         match = s->match[0] | (s->match[1] << 16);
152         if (s->rtc > match)
153             s->rtc = 0;
154         if (s->rtc == 0) {
155             s->state |= 8;
156         }
157         gptm_reload(s, 0, 0);
158     } else if (s->mode[n] == 0xa) {
159         /* PWM mode.  Not implemented.  */
160     } else {
161         qemu_log_mask(LOG_UNIMP,
162                       "GPTM: 16-bit timer mode unimplemented: 0x%x\n",
163                       s->mode[n]);
164     }
165     gptm_update_irq(s);
166 }
167 
168 static uint64_t gptm_read(void *opaque, hwaddr offset,
169                           unsigned size)
170 {
171     gptm_state *s = (gptm_state *)opaque;
172 
173     switch (offset) {
174     case 0x00: /* CFG */
175         return s->config;
176     case 0x04: /* TAMR */
177         return s->mode[0];
178     case 0x08: /* TBMR */
179         return s->mode[1];
180     case 0x0c: /* CTL */
181         return s->control;
182     case 0x18: /* IMR */
183         return s->mask;
184     case 0x1c: /* RIS */
185         return s->state;
186     case 0x20: /* MIS */
187         return s->state & s->mask;
188     case 0x24: /* CR */
189         return 0;
190     case 0x28: /* TAILR */
191         return s->load[0] | ((s->config < 4) ? (s->load[1] << 16) : 0);
192     case 0x2c: /* TBILR */
193         return s->load[1];
194     case 0x30: /* TAMARCHR */
195         return s->match[0] | ((s->config < 4) ? (s->match[1] << 16) : 0);
196     case 0x34: /* TBMATCHR */
197         return s->match[1];
198     case 0x38: /* TAPR */
199         return s->prescale[0];
200     case 0x3c: /* TBPR */
201         return s->prescale[1];
202     case 0x40: /* TAPMR */
203         return s->match_prescale[0];
204     case 0x44: /* TBPMR */
205         return s->match_prescale[1];
206     case 0x48: /* TAR */
207         if (s->config == 1) {
208             return s->rtc;
209         }
210         qemu_log_mask(LOG_UNIMP,
211                       "GPTM: read of TAR but timer read not supported\n");
212         return 0;
213     case 0x4c: /* TBR */
214         qemu_log_mask(LOG_UNIMP,
215                       "GPTM: read of TBR but timer read not supported\n");
216         return 0;
217     default:
218         qemu_log_mask(LOG_GUEST_ERROR,
219                       "GPTM: read at bad offset 0x02%" HWADDR_PRIx "\n",
220                       offset);
221         return 0;
222     }
223 }
224 
225 static void gptm_write(void *opaque, hwaddr offset,
226                        uint64_t value, unsigned size)
227 {
228     gptm_state *s = (gptm_state *)opaque;
229     uint32_t oldval;
230 
231     /* The timers should be disabled before changing the configuration.
232        We take advantage of this and defer everything until the timer
233        is enabled.  */
234     switch (offset) {
235     case 0x00: /* CFG */
236         s->config = value;
237         break;
238     case 0x04: /* TAMR */
239         s->mode[0] = value;
240         break;
241     case 0x08: /* TBMR */
242         s->mode[1] = value;
243         break;
244     case 0x0c: /* CTL */
245         oldval = s->control;
246         s->control = value;
247         /* TODO: Implement pause.  */
248         if ((oldval ^ value) & 1) {
249             if (value & 1) {
250                 gptm_reload(s, 0, 1);
251             } else {
252                 gptm_stop(s, 0);
253             }
254         }
255         if (((oldval ^ value) & 0x100) && s->config >= 4) {
256             if (value & 0x100) {
257                 gptm_reload(s, 1, 1);
258             } else {
259                 gptm_stop(s, 1);
260             }
261         }
262         break;
263     case 0x18: /* IMR */
264         s->mask = value & 0x77;
265         gptm_update_irq(s);
266         break;
267     case 0x24: /* CR */
268         s->state &= ~value;
269         break;
270     case 0x28: /* TAILR */
271         s->load[0] = value & 0xffff;
272         if (s->config < 4) {
273             s->load[1] = value >> 16;
274         }
275         break;
276     case 0x2c: /* TBILR */
277         s->load[1] = value & 0xffff;
278         break;
279     case 0x30: /* TAMARCHR */
280         s->match[0] = value & 0xffff;
281         if (s->config < 4) {
282             s->match[1] = value >> 16;
283         }
284         break;
285     case 0x34: /* TBMATCHR */
286         s->match[1] = value >> 16;
287         break;
288     case 0x38: /* TAPR */
289         s->prescale[0] = value;
290         break;
291     case 0x3c: /* TBPR */
292         s->prescale[1] = value;
293         break;
294     case 0x40: /* TAPMR */
295         s->match_prescale[0] = value;
296         break;
297     case 0x44: /* TBPMR */
298         s->match_prescale[0] = value;
299         break;
300     default:
301         qemu_log_mask(LOG_GUEST_ERROR,
302                       "GPTM: write at bad offset 0x02%" HWADDR_PRIx "\n",
303                       offset);
304     }
305     gptm_update_irq(s);
306 }
307 
308 static const MemoryRegionOps gptm_ops = {
309     .read = gptm_read,
310     .write = gptm_write,
311     .endianness = DEVICE_NATIVE_ENDIAN,
312 };
313 
314 static const VMStateDescription vmstate_stellaris_gptm = {
315     .name = "stellaris_gptm",
316     .version_id = 1,
317     .minimum_version_id = 1,
318     .fields = (VMStateField[]) {
319         VMSTATE_UINT32(config, gptm_state),
320         VMSTATE_UINT32_ARRAY(mode, gptm_state, 2),
321         VMSTATE_UINT32(control, gptm_state),
322         VMSTATE_UINT32(state, gptm_state),
323         VMSTATE_UINT32(mask, gptm_state),
324         VMSTATE_UNUSED(8),
325         VMSTATE_UINT32_ARRAY(load, gptm_state, 2),
326         VMSTATE_UINT32_ARRAY(match, gptm_state, 2),
327         VMSTATE_UINT32_ARRAY(prescale, gptm_state, 2),
328         VMSTATE_UINT32_ARRAY(match_prescale, gptm_state, 2),
329         VMSTATE_UINT32(rtc, gptm_state),
330         VMSTATE_INT64_ARRAY(tick, gptm_state, 2),
331         VMSTATE_TIMER_PTR_ARRAY(timer, gptm_state, 2),
332         VMSTATE_END_OF_LIST()
333     }
334 };
335 
336 static void stellaris_gptm_init(Object *obj)
337 {
338     DeviceState *dev = DEVICE(obj);
339     gptm_state *s = STELLARIS_GPTM(obj);
340     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
341 
342     sysbus_init_irq(sbd, &s->irq);
343     qdev_init_gpio_out(dev, &s->trigger, 1);
344 
345     memory_region_init_io(&s->iomem, obj, &gptm_ops, s,
346                           "gptm", 0x1000);
347     sysbus_init_mmio(sbd, &s->iomem);
348 
349     s->opaque[0] = s->opaque[1] = s;
350 }
351 
352 static void stellaris_gptm_realize(DeviceState *dev, Error **errp)
353 {
354     gptm_state *s = STELLARIS_GPTM(dev);
355     s->timer[0] = timer_new_ns(QEMU_CLOCK_VIRTUAL, gptm_tick, &s->opaque[0]);
356     s->timer[1] = timer_new_ns(QEMU_CLOCK_VIRTUAL, gptm_tick, &s->opaque[1]);
357 }
358 
359 /* System controller.  */
360 
361 typedef struct {
362     MemoryRegion iomem;
363     uint32_t pborctl;
364     uint32_t ldopctl;
365     uint32_t int_status;
366     uint32_t int_mask;
367     uint32_t resc;
368     uint32_t rcc;
369     uint32_t rcc2;
370     uint32_t rcgc[3];
371     uint32_t scgc[3];
372     uint32_t dcgc[3];
373     uint32_t clkvclr;
374     uint32_t ldoarst;
375     uint32_t user0;
376     uint32_t user1;
377     qemu_irq irq;
378     stellaris_board_info *board;
379 } ssys_state;
380 
381 static void ssys_update(ssys_state *s)
382 {
383   qemu_set_irq(s->irq, (s->int_status & s->int_mask) != 0);
384 }
385 
386 static uint32_t pllcfg_sandstorm[16] = {
387     0x31c0, /* 1 Mhz */
388     0x1ae0, /* 1.8432 Mhz */
389     0x18c0, /* 2 Mhz */
390     0xd573, /* 2.4576 Mhz */
391     0x37a6, /* 3.57954 Mhz */
392     0x1ae2, /* 3.6864 Mhz */
393     0x0c40, /* 4 Mhz */
394     0x98bc, /* 4.906 Mhz */
395     0x935b, /* 4.9152 Mhz */
396     0x09c0, /* 5 Mhz */
397     0x4dee, /* 5.12 Mhz */
398     0x0c41, /* 6 Mhz */
399     0x75db, /* 6.144 Mhz */
400     0x1ae6, /* 7.3728 Mhz */
401     0x0600, /* 8 Mhz */
402     0x585b /* 8.192 Mhz */
403 };
404 
405 static uint32_t pllcfg_fury[16] = {
406     0x3200, /* 1 Mhz */
407     0x1b20, /* 1.8432 Mhz */
408     0x1900, /* 2 Mhz */
409     0xf42b, /* 2.4576 Mhz */
410     0x37e3, /* 3.57954 Mhz */
411     0x1b21, /* 3.6864 Mhz */
412     0x0c80, /* 4 Mhz */
413     0x98ee, /* 4.906 Mhz */
414     0xd5b4, /* 4.9152 Mhz */
415     0x0a00, /* 5 Mhz */
416     0x4e27, /* 5.12 Mhz */
417     0x1902, /* 6 Mhz */
418     0xec1c, /* 6.144 Mhz */
419     0x1b23, /* 7.3728 Mhz */
420     0x0640, /* 8 Mhz */
421     0xb11c /* 8.192 Mhz */
422 };
423 
424 #define DID0_VER_MASK        0x70000000
425 #define DID0_VER_0           0x00000000
426 #define DID0_VER_1           0x10000000
427 
428 #define DID0_CLASS_MASK      0x00FF0000
429 #define DID0_CLASS_SANDSTORM 0x00000000
430 #define DID0_CLASS_FURY      0x00010000
431 
432 static int ssys_board_class(const ssys_state *s)
433 {
434     uint32_t did0 = s->board->did0;
435     switch (did0 & DID0_VER_MASK) {
436     case DID0_VER_0:
437         return DID0_CLASS_SANDSTORM;
438     case DID0_VER_1:
439         switch (did0 & DID0_CLASS_MASK) {
440         case DID0_CLASS_SANDSTORM:
441         case DID0_CLASS_FURY:
442             return did0 & DID0_CLASS_MASK;
443         }
444         /* for unknown classes, fall through */
445     default:
446         /* This can only happen if the hardwired constant did0 value
447          * in this board's stellaris_board_info struct is wrong.
448          */
449         g_assert_not_reached();
450     }
451 }
452 
453 static uint64_t ssys_read(void *opaque, hwaddr offset,
454                           unsigned size)
455 {
456     ssys_state *s = (ssys_state *)opaque;
457 
458     switch (offset) {
459     case 0x000: /* DID0 */
460         return s->board->did0;
461     case 0x004: /* DID1 */
462         return s->board->did1;
463     case 0x008: /* DC0 */
464         return s->board->dc0;
465     case 0x010: /* DC1 */
466         return s->board->dc1;
467     case 0x014: /* DC2 */
468         return s->board->dc2;
469     case 0x018: /* DC3 */
470         return s->board->dc3;
471     case 0x01c: /* DC4 */
472         return s->board->dc4;
473     case 0x030: /* PBORCTL */
474         return s->pborctl;
475     case 0x034: /* LDOPCTL */
476         return s->ldopctl;
477     case 0x040: /* SRCR0 */
478         return 0;
479     case 0x044: /* SRCR1 */
480         return 0;
481     case 0x048: /* SRCR2 */
482         return 0;
483     case 0x050: /* RIS */
484         return s->int_status;
485     case 0x054: /* IMC */
486         return s->int_mask;
487     case 0x058: /* MISC */
488         return s->int_status & s->int_mask;
489     case 0x05c: /* RESC */
490         return s->resc;
491     case 0x060: /* RCC */
492         return s->rcc;
493     case 0x064: /* PLLCFG */
494         {
495             int xtal;
496             xtal = (s->rcc >> 6) & 0xf;
497             switch (ssys_board_class(s)) {
498             case DID0_CLASS_FURY:
499                 return pllcfg_fury[xtal];
500             case DID0_CLASS_SANDSTORM:
501                 return pllcfg_sandstorm[xtal];
502             default:
503                 g_assert_not_reached();
504             }
505         }
506     case 0x070: /* RCC2 */
507         return s->rcc2;
508     case 0x100: /* RCGC0 */
509         return s->rcgc[0];
510     case 0x104: /* RCGC1 */
511         return s->rcgc[1];
512     case 0x108: /* RCGC2 */
513         return s->rcgc[2];
514     case 0x110: /* SCGC0 */
515         return s->scgc[0];
516     case 0x114: /* SCGC1 */
517         return s->scgc[1];
518     case 0x118: /* SCGC2 */
519         return s->scgc[2];
520     case 0x120: /* DCGC0 */
521         return s->dcgc[0];
522     case 0x124: /* DCGC1 */
523         return s->dcgc[1];
524     case 0x128: /* DCGC2 */
525         return s->dcgc[2];
526     case 0x150: /* CLKVCLR */
527         return s->clkvclr;
528     case 0x160: /* LDOARST */
529         return s->ldoarst;
530     case 0x1e0: /* USER0 */
531         return s->user0;
532     case 0x1e4: /* USER1 */
533         return s->user1;
534     default:
535         qemu_log_mask(LOG_GUEST_ERROR,
536                       "SSYS: read at bad offset 0x%x\n", (int)offset);
537         return 0;
538     }
539 }
540 
541 static bool ssys_use_rcc2(ssys_state *s)
542 {
543     return (s->rcc2 >> 31) & 0x1;
544 }
545 
546 /*
547  * Caculate the sys. clock period in ms.
548  */
549 static void ssys_calculate_system_clock(ssys_state *s)
550 {
551     if (ssys_use_rcc2(s)) {
552         system_clock_scale = 5 * (((s->rcc2 >> 23) & 0x3f) + 1);
553     } else {
554         system_clock_scale = 5 * (((s->rcc >> 23) & 0xf) + 1);
555     }
556 }
557 
558 static void ssys_write(void *opaque, hwaddr offset,
559                        uint64_t value, unsigned size)
560 {
561     ssys_state *s = (ssys_state *)opaque;
562 
563     switch (offset) {
564     case 0x030: /* PBORCTL */
565         s->pborctl = value & 0xffff;
566         break;
567     case 0x034: /* LDOPCTL */
568         s->ldopctl = value & 0x1f;
569         break;
570     case 0x040: /* SRCR0 */
571     case 0x044: /* SRCR1 */
572     case 0x048: /* SRCR2 */
573         qemu_log_mask(LOG_UNIMP, "Peripheral reset not implemented\n");
574         break;
575     case 0x054: /* IMC */
576         s->int_mask = value & 0x7f;
577         break;
578     case 0x058: /* MISC */
579         s->int_status &= ~value;
580         break;
581     case 0x05c: /* RESC */
582         s->resc = value & 0x3f;
583         break;
584     case 0x060: /* RCC */
585         if ((s->rcc & (1 << 13)) != 0 && (value & (1 << 13)) == 0) {
586             /* PLL enable.  */
587             s->int_status |= (1 << 6);
588         }
589         s->rcc = value;
590         ssys_calculate_system_clock(s);
591         break;
592     case 0x070: /* RCC2 */
593         if (ssys_board_class(s) == DID0_CLASS_SANDSTORM) {
594             break;
595         }
596 
597         if ((s->rcc2 & (1 << 13)) != 0 && (value & (1 << 13)) == 0) {
598             /* PLL enable.  */
599             s->int_status |= (1 << 6);
600         }
601         s->rcc2 = value;
602         ssys_calculate_system_clock(s);
603         break;
604     case 0x100: /* RCGC0 */
605         s->rcgc[0] = value;
606         break;
607     case 0x104: /* RCGC1 */
608         s->rcgc[1] = value;
609         break;
610     case 0x108: /* RCGC2 */
611         s->rcgc[2] = value;
612         break;
613     case 0x110: /* SCGC0 */
614         s->scgc[0] = value;
615         break;
616     case 0x114: /* SCGC1 */
617         s->scgc[1] = value;
618         break;
619     case 0x118: /* SCGC2 */
620         s->scgc[2] = value;
621         break;
622     case 0x120: /* DCGC0 */
623         s->dcgc[0] = value;
624         break;
625     case 0x124: /* DCGC1 */
626         s->dcgc[1] = value;
627         break;
628     case 0x128: /* DCGC2 */
629         s->dcgc[2] = value;
630         break;
631     case 0x150: /* CLKVCLR */
632         s->clkvclr = value;
633         break;
634     case 0x160: /* LDOARST */
635         s->ldoarst = value;
636         break;
637     default:
638         qemu_log_mask(LOG_GUEST_ERROR,
639                       "SSYS: write at bad offset 0x%x\n", (int)offset);
640     }
641     ssys_update(s);
642 }
643 
644 static const MemoryRegionOps ssys_ops = {
645     .read = ssys_read,
646     .write = ssys_write,
647     .endianness = DEVICE_NATIVE_ENDIAN,
648 };
649 
650 static void ssys_reset(void *opaque)
651 {
652     ssys_state *s = (ssys_state *)opaque;
653 
654     s->pborctl = 0x7ffd;
655     s->rcc = 0x078e3ac0;
656 
657     if (ssys_board_class(s) == DID0_CLASS_SANDSTORM) {
658         s->rcc2 = 0;
659     } else {
660         s->rcc2 = 0x07802810;
661     }
662     s->rcgc[0] = 1;
663     s->scgc[0] = 1;
664     s->dcgc[0] = 1;
665     ssys_calculate_system_clock(s);
666 }
667 
668 static int stellaris_sys_post_load(void *opaque, int version_id)
669 {
670     ssys_state *s = opaque;
671 
672     ssys_calculate_system_clock(s);
673 
674     return 0;
675 }
676 
677 static const VMStateDescription vmstate_stellaris_sys = {
678     .name = "stellaris_sys",
679     .version_id = 2,
680     .minimum_version_id = 1,
681     .post_load = stellaris_sys_post_load,
682     .fields = (VMStateField[]) {
683         VMSTATE_UINT32(pborctl, ssys_state),
684         VMSTATE_UINT32(ldopctl, ssys_state),
685         VMSTATE_UINT32(int_mask, ssys_state),
686         VMSTATE_UINT32(int_status, ssys_state),
687         VMSTATE_UINT32(resc, ssys_state),
688         VMSTATE_UINT32(rcc, ssys_state),
689         VMSTATE_UINT32_V(rcc2, ssys_state, 2),
690         VMSTATE_UINT32_ARRAY(rcgc, ssys_state, 3),
691         VMSTATE_UINT32_ARRAY(scgc, ssys_state, 3),
692         VMSTATE_UINT32_ARRAY(dcgc, ssys_state, 3),
693         VMSTATE_UINT32(clkvclr, ssys_state),
694         VMSTATE_UINT32(ldoarst, ssys_state),
695         VMSTATE_END_OF_LIST()
696     }
697 };
698 
699 static int stellaris_sys_init(uint32_t base, qemu_irq irq,
700                               stellaris_board_info * board,
701                               uint8_t *macaddr)
702 {
703     ssys_state *s;
704 
705     s = g_new0(ssys_state, 1);
706     s->irq = irq;
707     s->board = board;
708     /* Most devices come preprogrammed with a MAC address in the user data. */
709     s->user0 = macaddr[0] | (macaddr[1] << 8) | (macaddr[2] << 16);
710     s->user1 = macaddr[3] | (macaddr[4] << 8) | (macaddr[5] << 16);
711 
712     memory_region_init_io(&s->iomem, NULL, &ssys_ops, s, "ssys", 0x00001000);
713     memory_region_add_subregion(get_system_memory(), base, &s->iomem);
714     ssys_reset(s);
715     vmstate_register(NULL, VMSTATE_INSTANCE_ID_ANY, &vmstate_stellaris_sys, s);
716     return 0;
717 }
718 
719 
720 /* I2C controller.  */
721 
722 #define TYPE_STELLARIS_I2C "stellaris-i2c"
723 #define STELLARIS_I2C(obj) \
724     OBJECT_CHECK(stellaris_i2c_state, (obj), TYPE_STELLARIS_I2C)
725 
726 typedef struct {
727     SysBusDevice parent_obj;
728 
729     I2CBus *bus;
730     qemu_irq irq;
731     MemoryRegion iomem;
732     uint32_t msa;
733     uint32_t mcs;
734     uint32_t mdr;
735     uint32_t mtpr;
736     uint32_t mimr;
737     uint32_t mris;
738     uint32_t mcr;
739 } stellaris_i2c_state;
740 
741 #define STELLARIS_I2C_MCS_BUSY    0x01
742 #define STELLARIS_I2C_MCS_ERROR   0x02
743 #define STELLARIS_I2C_MCS_ADRACK  0x04
744 #define STELLARIS_I2C_MCS_DATACK  0x08
745 #define STELLARIS_I2C_MCS_ARBLST  0x10
746 #define STELLARIS_I2C_MCS_IDLE    0x20
747 #define STELLARIS_I2C_MCS_BUSBSY  0x40
748 
749 static uint64_t stellaris_i2c_read(void *opaque, hwaddr offset,
750                                    unsigned size)
751 {
752     stellaris_i2c_state *s = (stellaris_i2c_state *)opaque;
753 
754     switch (offset) {
755     case 0x00: /* MSA */
756         return s->msa;
757     case 0x04: /* MCS */
758         /* We don't emulate timing, so the controller is never busy.  */
759         return s->mcs | STELLARIS_I2C_MCS_IDLE;
760     case 0x08: /* MDR */
761         return s->mdr;
762     case 0x0c: /* MTPR */
763         return s->mtpr;
764     case 0x10: /* MIMR */
765         return s->mimr;
766     case 0x14: /* MRIS */
767         return s->mris;
768     case 0x18: /* MMIS */
769         return s->mris & s->mimr;
770     case 0x20: /* MCR */
771         return s->mcr;
772     default:
773         qemu_log_mask(LOG_GUEST_ERROR,
774                       "stellaris_i2c: read at bad offset 0x%x\n", (int)offset);
775         return 0;
776     }
777 }
778 
779 static void stellaris_i2c_update(stellaris_i2c_state *s)
780 {
781     int level;
782 
783     level = (s->mris & s->mimr) != 0;
784     qemu_set_irq(s->irq, level);
785 }
786 
787 static void stellaris_i2c_write(void *opaque, hwaddr offset,
788                                 uint64_t value, unsigned size)
789 {
790     stellaris_i2c_state *s = (stellaris_i2c_state *)opaque;
791 
792     switch (offset) {
793     case 0x00: /* MSA */
794         s->msa = value & 0xff;
795         break;
796     case 0x04: /* MCS */
797         if ((s->mcr & 0x10) == 0) {
798             /* Disabled.  Do nothing.  */
799             break;
800         }
801         /* Grab the bus if this is starting a transfer.  */
802         if ((value & 2) && (s->mcs & STELLARIS_I2C_MCS_BUSBSY) == 0) {
803             if (i2c_start_transfer(s->bus, s->msa >> 1, s->msa & 1)) {
804                 s->mcs |= STELLARIS_I2C_MCS_ARBLST;
805             } else {
806                 s->mcs &= ~STELLARIS_I2C_MCS_ARBLST;
807                 s->mcs |= STELLARIS_I2C_MCS_BUSBSY;
808             }
809         }
810         /* If we don't have the bus then indicate an error.  */
811         if (!i2c_bus_busy(s->bus)
812                 || (s->mcs & STELLARIS_I2C_MCS_BUSBSY) == 0) {
813             s->mcs |= STELLARIS_I2C_MCS_ERROR;
814             break;
815         }
816         s->mcs &= ~STELLARIS_I2C_MCS_ERROR;
817         if (value & 1) {
818             /* Transfer a byte.  */
819             /* TODO: Handle errors.  */
820             if (s->msa & 1) {
821                 /* Recv */
822                 s->mdr = i2c_recv(s->bus);
823             } else {
824                 /* Send */
825                 i2c_send(s->bus, s->mdr);
826             }
827             /* Raise an interrupt.  */
828             s->mris |= 1;
829         }
830         if (value & 4) {
831             /* Finish transfer.  */
832             i2c_end_transfer(s->bus);
833             s->mcs &= ~STELLARIS_I2C_MCS_BUSBSY;
834         }
835         break;
836     case 0x08: /* MDR */
837         s->mdr = value & 0xff;
838         break;
839     case 0x0c: /* MTPR */
840         s->mtpr = value & 0xff;
841         break;
842     case 0x10: /* MIMR */
843         s->mimr = 1;
844         break;
845     case 0x1c: /* MICR */
846         s->mris &= ~value;
847         break;
848     case 0x20: /* MCR */
849         if (value & 1) {
850             qemu_log_mask(LOG_UNIMP,
851                           "stellaris_i2c: Loopback not implemented\n");
852         }
853         if (value & 0x20) {
854             qemu_log_mask(LOG_UNIMP,
855                           "stellaris_i2c: Slave mode not implemented\n");
856         }
857         s->mcr = value & 0x31;
858         break;
859     default:
860         qemu_log_mask(LOG_GUEST_ERROR,
861                       "stellaris_i2c: write at bad offset 0x%x\n", (int)offset);
862     }
863     stellaris_i2c_update(s);
864 }
865 
866 static void stellaris_i2c_reset(stellaris_i2c_state *s)
867 {
868     if (s->mcs & STELLARIS_I2C_MCS_BUSBSY)
869         i2c_end_transfer(s->bus);
870 
871     s->msa = 0;
872     s->mcs = 0;
873     s->mdr = 0;
874     s->mtpr = 1;
875     s->mimr = 0;
876     s->mris = 0;
877     s->mcr = 0;
878     stellaris_i2c_update(s);
879 }
880 
881 static const MemoryRegionOps stellaris_i2c_ops = {
882     .read = stellaris_i2c_read,
883     .write = stellaris_i2c_write,
884     .endianness = DEVICE_NATIVE_ENDIAN,
885 };
886 
887 static const VMStateDescription vmstate_stellaris_i2c = {
888     .name = "stellaris_i2c",
889     .version_id = 1,
890     .minimum_version_id = 1,
891     .fields = (VMStateField[]) {
892         VMSTATE_UINT32(msa, stellaris_i2c_state),
893         VMSTATE_UINT32(mcs, stellaris_i2c_state),
894         VMSTATE_UINT32(mdr, stellaris_i2c_state),
895         VMSTATE_UINT32(mtpr, stellaris_i2c_state),
896         VMSTATE_UINT32(mimr, stellaris_i2c_state),
897         VMSTATE_UINT32(mris, stellaris_i2c_state),
898         VMSTATE_UINT32(mcr, stellaris_i2c_state),
899         VMSTATE_END_OF_LIST()
900     }
901 };
902 
903 static void stellaris_i2c_init(Object *obj)
904 {
905     DeviceState *dev = DEVICE(obj);
906     stellaris_i2c_state *s = STELLARIS_I2C(obj);
907     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
908     I2CBus *bus;
909 
910     sysbus_init_irq(sbd, &s->irq);
911     bus = i2c_init_bus(dev, "i2c");
912     s->bus = bus;
913 
914     memory_region_init_io(&s->iomem, obj, &stellaris_i2c_ops, s,
915                           "i2c", 0x1000);
916     sysbus_init_mmio(sbd, &s->iomem);
917     /* ??? For now we only implement the master interface.  */
918     stellaris_i2c_reset(s);
919 }
920 
921 /* Analogue to Digital Converter.  This is only partially implemented,
922    enough for applications that use a combined ADC and timer tick.  */
923 
924 #define STELLARIS_ADC_EM_CONTROLLER 0
925 #define STELLARIS_ADC_EM_COMP       1
926 #define STELLARIS_ADC_EM_EXTERNAL   4
927 #define STELLARIS_ADC_EM_TIMER      5
928 #define STELLARIS_ADC_EM_PWM0       6
929 #define STELLARIS_ADC_EM_PWM1       7
930 #define STELLARIS_ADC_EM_PWM2       8
931 
932 #define STELLARIS_ADC_FIFO_EMPTY    0x0100
933 #define STELLARIS_ADC_FIFO_FULL     0x1000
934 
935 #define TYPE_STELLARIS_ADC "stellaris-adc"
936 #define STELLARIS_ADC(obj) \
937     OBJECT_CHECK(stellaris_adc_state, (obj), TYPE_STELLARIS_ADC)
938 
939 typedef struct StellarisADCState {
940     SysBusDevice parent_obj;
941 
942     MemoryRegion iomem;
943     uint32_t actss;
944     uint32_t ris;
945     uint32_t im;
946     uint32_t emux;
947     uint32_t ostat;
948     uint32_t ustat;
949     uint32_t sspri;
950     uint32_t sac;
951     struct {
952         uint32_t state;
953         uint32_t data[16];
954     } fifo[4];
955     uint32_t ssmux[4];
956     uint32_t ssctl[4];
957     uint32_t noise;
958     qemu_irq irq[4];
959 } stellaris_adc_state;
960 
961 static uint32_t stellaris_adc_fifo_read(stellaris_adc_state *s, int n)
962 {
963     int tail;
964 
965     tail = s->fifo[n].state & 0xf;
966     if (s->fifo[n].state & STELLARIS_ADC_FIFO_EMPTY) {
967         s->ustat |= 1 << n;
968     } else {
969         s->fifo[n].state = (s->fifo[n].state & ~0xf) | ((tail + 1) & 0xf);
970         s->fifo[n].state &= ~STELLARIS_ADC_FIFO_FULL;
971         if (tail + 1 == ((s->fifo[n].state >> 4) & 0xf))
972             s->fifo[n].state |= STELLARIS_ADC_FIFO_EMPTY;
973     }
974     return s->fifo[n].data[tail];
975 }
976 
977 static void stellaris_adc_fifo_write(stellaris_adc_state *s, int n,
978                                      uint32_t value)
979 {
980     int head;
981 
982     /* TODO: Real hardware has limited size FIFOs.  We have a full 16 entry
983        FIFO fir each sequencer.  */
984     head = (s->fifo[n].state >> 4) & 0xf;
985     if (s->fifo[n].state & STELLARIS_ADC_FIFO_FULL) {
986         s->ostat |= 1 << n;
987         return;
988     }
989     s->fifo[n].data[head] = value;
990     head = (head + 1) & 0xf;
991     s->fifo[n].state &= ~STELLARIS_ADC_FIFO_EMPTY;
992     s->fifo[n].state = (s->fifo[n].state & ~0xf0) | (head << 4);
993     if ((s->fifo[n].state & 0xf) == head)
994         s->fifo[n].state |= STELLARIS_ADC_FIFO_FULL;
995 }
996 
997 static void stellaris_adc_update(stellaris_adc_state *s)
998 {
999     int level;
1000     int n;
1001 
1002     for (n = 0; n < 4; n++) {
1003         level = (s->ris & s->im & (1 << n)) != 0;
1004         qemu_set_irq(s->irq[n], level);
1005     }
1006 }
1007 
1008 static void stellaris_adc_trigger(void *opaque, int irq, int level)
1009 {
1010     stellaris_adc_state *s = (stellaris_adc_state *)opaque;
1011     int n;
1012 
1013     for (n = 0; n < 4; n++) {
1014         if ((s->actss & (1 << n)) == 0) {
1015             continue;
1016         }
1017 
1018         if (((s->emux >> (n * 4)) & 0xff) != 5) {
1019             continue;
1020         }
1021 
1022         /* Some applications use the ADC as a random number source, so introduce
1023            some variation into the signal.  */
1024         s->noise = s->noise * 314159 + 1;
1025         /* ??? actual inputs not implemented.  Return an arbitrary value.  */
1026         stellaris_adc_fifo_write(s, n, 0x200 + ((s->noise >> 16) & 7));
1027         s->ris |= (1 << n);
1028         stellaris_adc_update(s);
1029     }
1030 }
1031 
1032 static void stellaris_adc_reset(stellaris_adc_state *s)
1033 {
1034     int n;
1035 
1036     for (n = 0; n < 4; n++) {
1037         s->ssmux[n] = 0;
1038         s->ssctl[n] = 0;
1039         s->fifo[n].state = STELLARIS_ADC_FIFO_EMPTY;
1040     }
1041 }
1042 
1043 static uint64_t stellaris_adc_read(void *opaque, hwaddr offset,
1044                                    unsigned size)
1045 {
1046     stellaris_adc_state *s = (stellaris_adc_state *)opaque;
1047 
1048     /* TODO: Implement this.  */
1049     if (offset >= 0x40 && offset < 0xc0) {
1050         int n;
1051         n = (offset - 0x40) >> 5;
1052         switch (offset & 0x1f) {
1053         case 0x00: /* SSMUX */
1054             return s->ssmux[n];
1055         case 0x04: /* SSCTL */
1056             return s->ssctl[n];
1057         case 0x08: /* SSFIFO */
1058             return stellaris_adc_fifo_read(s, n);
1059         case 0x0c: /* SSFSTAT */
1060             return s->fifo[n].state;
1061         default:
1062             break;
1063         }
1064     }
1065     switch (offset) {
1066     case 0x00: /* ACTSS */
1067         return s->actss;
1068     case 0x04: /* RIS */
1069         return s->ris;
1070     case 0x08: /* IM */
1071         return s->im;
1072     case 0x0c: /* ISC */
1073         return s->ris & s->im;
1074     case 0x10: /* OSTAT */
1075         return s->ostat;
1076     case 0x14: /* EMUX */
1077         return s->emux;
1078     case 0x18: /* USTAT */
1079         return s->ustat;
1080     case 0x20: /* SSPRI */
1081         return s->sspri;
1082     case 0x30: /* SAC */
1083         return s->sac;
1084     default:
1085         qemu_log_mask(LOG_GUEST_ERROR,
1086                       "stellaris_adc: read at bad offset 0x%x\n", (int)offset);
1087         return 0;
1088     }
1089 }
1090 
1091 static void stellaris_adc_write(void *opaque, hwaddr offset,
1092                                 uint64_t value, unsigned size)
1093 {
1094     stellaris_adc_state *s = (stellaris_adc_state *)opaque;
1095 
1096     /* TODO: Implement this.  */
1097     if (offset >= 0x40 && offset < 0xc0) {
1098         int n;
1099         n = (offset - 0x40) >> 5;
1100         switch (offset & 0x1f) {
1101         case 0x00: /* SSMUX */
1102             s->ssmux[n] = value & 0x33333333;
1103             return;
1104         case 0x04: /* SSCTL */
1105             if (value != 6) {
1106                 qemu_log_mask(LOG_UNIMP,
1107                               "ADC: Unimplemented sequence %" PRIx64 "\n",
1108                               value);
1109             }
1110             s->ssctl[n] = value;
1111             return;
1112         default:
1113             break;
1114         }
1115     }
1116     switch (offset) {
1117     case 0x00: /* ACTSS */
1118         s->actss = value & 0xf;
1119         break;
1120     case 0x08: /* IM */
1121         s->im = value;
1122         break;
1123     case 0x0c: /* ISC */
1124         s->ris &= ~value;
1125         break;
1126     case 0x10: /* OSTAT */
1127         s->ostat &= ~value;
1128         break;
1129     case 0x14: /* EMUX */
1130         s->emux = value;
1131         break;
1132     case 0x18: /* USTAT */
1133         s->ustat &= ~value;
1134         break;
1135     case 0x20: /* SSPRI */
1136         s->sspri = value;
1137         break;
1138     case 0x28: /* PSSI */
1139         qemu_log_mask(LOG_UNIMP, "ADC: sample initiate unimplemented\n");
1140         break;
1141     case 0x30: /* SAC */
1142         s->sac = value;
1143         break;
1144     default:
1145         qemu_log_mask(LOG_GUEST_ERROR,
1146                       "stellaris_adc: write at bad offset 0x%x\n", (int)offset);
1147     }
1148     stellaris_adc_update(s);
1149 }
1150 
1151 static const MemoryRegionOps stellaris_adc_ops = {
1152     .read = stellaris_adc_read,
1153     .write = stellaris_adc_write,
1154     .endianness = DEVICE_NATIVE_ENDIAN,
1155 };
1156 
1157 static const VMStateDescription vmstate_stellaris_adc = {
1158     .name = "stellaris_adc",
1159     .version_id = 1,
1160     .minimum_version_id = 1,
1161     .fields = (VMStateField[]) {
1162         VMSTATE_UINT32(actss, stellaris_adc_state),
1163         VMSTATE_UINT32(ris, stellaris_adc_state),
1164         VMSTATE_UINT32(im, stellaris_adc_state),
1165         VMSTATE_UINT32(emux, stellaris_adc_state),
1166         VMSTATE_UINT32(ostat, stellaris_adc_state),
1167         VMSTATE_UINT32(ustat, stellaris_adc_state),
1168         VMSTATE_UINT32(sspri, stellaris_adc_state),
1169         VMSTATE_UINT32(sac, stellaris_adc_state),
1170         VMSTATE_UINT32(fifo[0].state, stellaris_adc_state),
1171         VMSTATE_UINT32_ARRAY(fifo[0].data, stellaris_adc_state, 16),
1172         VMSTATE_UINT32(ssmux[0], stellaris_adc_state),
1173         VMSTATE_UINT32(ssctl[0], stellaris_adc_state),
1174         VMSTATE_UINT32(fifo[1].state, stellaris_adc_state),
1175         VMSTATE_UINT32_ARRAY(fifo[1].data, stellaris_adc_state, 16),
1176         VMSTATE_UINT32(ssmux[1], stellaris_adc_state),
1177         VMSTATE_UINT32(ssctl[1], stellaris_adc_state),
1178         VMSTATE_UINT32(fifo[2].state, stellaris_adc_state),
1179         VMSTATE_UINT32_ARRAY(fifo[2].data, stellaris_adc_state, 16),
1180         VMSTATE_UINT32(ssmux[2], stellaris_adc_state),
1181         VMSTATE_UINT32(ssctl[2], stellaris_adc_state),
1182         VMSTATE_UINT32(fifo[3].state, stellaris_adc_state),
1183         VMSTATE_UINT32_ARRAY(fifo[3].data, stellaris_adc_state, 16),
1184         VMSTATE_UINT32(ssmux[3], stellaris_adc_state),
1185         VMSTATE_UINT32(ssctl[3], stellaris_adc_state),
1186         VMSTATE_UINT32(noise, stellaris_adc_state),
1187         VMSTATE_END_OF_LIST()
1188     }
1189 };
1190 
1191 static void stellaris_adc_init(Object *obj)
1192 {
1193     DeviceState *dev = DEVICE(obj);
1194     stellaris_adc_state *s = STELLARIS_ADC(obj);
1195     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
1196     int n;
1197 
1198     for (n = 0; n < 4; n++) {
1199         sysbus_init_irq(sbd, &s->irq[n]);
1200     }
1201 
1202     memory_region_init_io(&s->iomem, obj, &stellaris_adc_ops, s,
1203                           "adc", 0x1000);
1204     sysbus_init_mmio(sbd, &s->iomem);
1205     stellaris_adc_reset(s);
1206     qdev_init_gpio_in(dev, stellaris_adc_trigger, 1);
1207 }
1208 
1209 static
1210 void do_sys_reset(void *opaque, int n, int level)
1211 {
1212     if (level) {
1213         qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
1214     }
1215 }
1216 
1217 /* Board init.  */
1218 static stellaris_board_info stellaris_boards[] = {
1219   { "LM3S811EVB",
1220     0,
1221     0x0032000e,
1222     0x001f001f, /* dc0 */
1223     0x001132bf,
1224     0x01071013,
1225     0x3f0f01ff,
1226     0x0000001f,
1227     BP_OLED_I2C
1228   },
1229   { "LM3S6965EVB",
1230     0x10010002,
1231     0x1073402e,
1232     0x00ff007f, /* dc0 */
1233     0x001133ff,
1234     0x030f5317,
1235     0x0f0f87ff,
1236     0x5000007f,
1237     BP_OLED_SSI | BP_GAMEPAD
1238   }
1239 };
1240 
1241 static void stellaris_init(MachineState *ms, stellaris_board_info *board)
1242 {
1243     static const int uart_irq[] = {5, 6, 33, 34};
1244     static const int timer_irq[] = {19, 21, 23, 35};
1245     static const uint32_t gpio_addr[7] =
1246       { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
1247         0x40024000, 0x40025000, 0x40026000};
1248     static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
1249 
1250     /* Memory map of SoC devices, from
1251      * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
1252      * http://www.ti.com/lit/ds/symlink/lm3s6965.pdf
1253      *
1254      * 40000000 wdtimer
1255      * 40002000 i2c (unimplemented)
1256      * 40004000 GPIO
1257      * 40005000 GPIO
1258      * 40006000 GPIO
1259      * 40007000 GPIO
1260      * 40008000 SSI
1261      * 4000c000 UART
1262      * 4000d000 UART
1263      * 4000e000 UART
1264      * 40020000 i2c
1265      * 40021000 i2c (unimplemented)
1266      * 40024000 GPIO
1267      * 40025000 GPIO
1268      * 40026000 GPIO
1269      * 40028000 PWM (unimplemented)
1270      * 4002c000 QEI (unimplemented)
1271      * 4002d000 QEI (unimplemented)
1272      * 40030000 gptimer
1273      * 40031000 gptimer
1274      * 40032000 gptimer
1275      * 40033000 gptimer
1276      * 40038000 ADC
1277      * 4003c000 analogue comparator (unimplemented)
1278      * 40048000 ethernet
1279      * 400fc000 hibernation module (unimplemented)
1280      * 400fd000 flash memory control (unimplemented)
1281      * 400fe000 system control
1282      */
1283 
1284     DeviceState *gpio_dev[7], *nvic;
1285     qemu_irq gpio_in[7][8];
1286     qemu_irq gpio_out[7][8];
1287     qemu_irq adc;
1288     int sram_size;
1289     int flash_size;
1290     I2CBus *i2c;
1291     DeviceState *dev;
1292     int i;
1293     int j;
1294 
1295     MemoryRegion *sram = g_new(MemoryRegion, 1);
1296     MemoryRegion *flash = g_new(MemoryRegion, 1);
1297     MemoryRegion *system_memory = get_system_memory();
1298 
1299     flash_size = (((board->dc0 & 0xffff) + 1) << 1) * 1024;
1300     sram_size = ((board->dc0 >> 18) + 1) * 1024;
1301 
1302     /* Flash programming is done via the SCU, so pretend it is ROM.  */
1303     memory_region_init_rom(flash, NULL, "stellaris.flash", flash_size,
1304                            &error_fatal);
1305     memory_region_add_subregion(system_memory, 0, flash);
1306 
1307     memory_region_init_ram(sram, NULL, "stellaris.sram", sram_size,
1308                            &error_fatal);
1309     memory_region_add_subregion(system_memory, 0x20000000, sram);
1310 
1311     nvic = qdev_new(TYPE_ARMV7M);
1312     qdev_prop_set_uint32(nvic, "num-irq", NUM_IRQ_LINES);
1313     qdev_prop_set_string(nvic, "cpu-type", ms->cpu_type);
1314     qdev_prop_set_bit(nvic, "enable-bitband", true);
1315     object_property_set_link(OBJECT(nvic), OBJECT(get_system_memory()),
1316                                      "memory", &error_abort);
1317     /* This will exit with an error if the user passed us a bad cpu_type */
1318     sysbus_realize_and_unref(SYS_BUS_DEVICE(nvic), &error_fatal);
1319 
1320     qdev_connect_gpio_out_named(nvic, "SYSRESETREQ", 0,
1321                                 qemu_allocate_irq(&do_sys_reset, NULL, 0));
1322 
1323     if (board->dc1 & (1 << 16)) {
1324         dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
1325                                     qdev_get_gpio_in(nvic, 14),
1326                                     qdev_get_gpio_in(nvic, 15),
1327                                     qdev_get_gpio_in(nvic, 16),
1328                                     qdev_get_gpio_in(nvic, 17),
1329                                     NULL);
1330         adc = qdev_get_gpio_in(dev, 0);
1331     } else {
1332         adc = NULL;
1333     }
1334     for (i = 0; i < 4; i++) {
1335         if (board->dc2 & (0x10000 << i)) {
1336             dev = sysbus_create_simple(TYPE_STELLARIS_GPTM,
1337                                        0x40030000 + i * 0x1000,
1338                                        qdev_get_gpio_in(nvic, timer_irq[i]));
1339             /* TODO: This is incorrect, but we get away with it because
1340                the ADC output is only ever pulsed.  */
1341             qdev_connect_gpio_out(dev, 0, adc);
1342         }
1343     }
1344 
1345     stellaris_sys_init(0x400fe000, qdev_get_gpio_in(nvic, 28),
1346                        board, nd_table[0].macaddr.a);
1347 
1348 
1349     if (board->dc1 & (1 << 3)) { /* watchdog present */
1350         dev = qdev_new(TYPE_LUMINARY_WATCHDOG);
1351 
1352         /* system_clock_scale is valid now */
1353         uint32_t mainclk = NANOSECONDS_PER_SECOND / system_clock_scale;
1354         qdev_prop_set_uint32(dev, "wdogclk-frq", mainclk);
1355 
1356         sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
1357         sysbus_mmio_map(SYS_BUS_DEVICE(dev),
1358                         0,
1359                         0x40000000u);
1360         sysbus_connect_irq(SYS_BUS_DEVICE(dev),
1361                            0,
1362                            qdev_get_gpio_in(nvic, 18));
1363     }
1364 
1365 
1366     for (i = 0; i < 7; i++) {
1367         if (board->dc4 & (1 << i)) {
1368             gpio_dev[i] = sysbus_create_simple("pl061_luminary", gpio_addr[i],
1369                                                qdev_get_gpio_in(nvic,
1370                                                                 gpio_irq[i]));
1371             for (j = 0; j < 8; j++) {
1372                 gpio_in[i][j] = qdev_get_gpio_in(gpio_dev[i], j);
1373                 gpio_out[i][j] = NULL;
1374             }
1375         }
1376     }
1377 
1378     if (board->dc2 & (1 << 12)) {
1379         dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000,
1380                                    qdev_get_gpio_in(nvic, 8));
1381         i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
1382         if (board->peripherals & BP_OLED_I2C) {
1383             i2c_create_slave(i2c, "ssd0303", 0x3d);
1384         }
1385     }
1386 
1387     for (i = 0; i < 4; i++) {
1388         if (board->dc2 & (1 << i)) {
1389             pl011_luminary_create(0x4000c000 + i * 0x1000,
1390                                   qdev_get_gpio_in(nvic, uart_irq[i]),
1391                                   serial_hd(i));
1392         }
1393     }
1394     if (board->dc2 & (1 << 4)) {
1395         dev = sysbus_create_simple("pl022", 0x40008000,
1396                                    qdev_get_gpio_in(nvic, 7));
1397         if (board->peripherals & BP_OLED_SSI) {
1398             void *bus;
1399             DeviceState *sddev;
1400             DeviceState *ssddev;
1401 
1402             /* Some boards have both an OLED controller and SD card connected to
1403              * the same SSI port, with the SD card chip select connected to a
1404              * GPIO pin.  Technically the OLED chip select is connected to the
1405              * SSI Fss pin.  We do not bother emulating that as both devices
1406              * should never be selected simultaneously, and our OLED controller
1407              * ignores stray 0xff commands that occur when deselecting the SD
1408              * card.
1409              */
1410             bus = qdev_get_child_bus(dev, "ssi");
1411 
1412             sddev = ssi_create_slave(bus, "ssi-sd");
1413             ssddev = ssi_create_slave(bus, "ssd0323");
1414             gpio_out[GPIO_D][0] = qemu_irq_split(
1415                     qdev_get_gpio_in_named(sddev, SSI_GPIO_CS, 0),
1416                     qdev_get_gpio_in_named(ssddev, SSI_GPIO_CS, 0));
1417             gpio_out[GPIO_C][7] = qdev_get_gpio_in(ssddev, 0);
1418 
1419             /* Make sure the select pin is high.  */
1420             qemu_irq_raise(gpio_out[GPIO_D][0]);
1421         }
1422     }
1423     if (board->dc4 & (1 << 28)) {
1424         DeviceState *enet;
1425 
1426         qemu_check_nic_model(&nd_table[0], "stellaris");
1427 
1428         enet = qdev_new("stellaris_enet");
1429         qdev_set_nic_properties(enet, &nd_table[0]);
1430         sysbus_realize_and_unref(SYS_BUS_DEVICE(enet), &error_fatal);
1431         sysbus_mmio_map(SYS_BUS_DEVICE(enet), 0, 0x40048000);
1432         sysbus_connect_irq(SYS_BUS_DEVICE(enet), 0, qdev_get_gpio_in(nvic, 42));
1433     }
1434     if (board->peripherals & BP_GAMEPAD) {
1435         qemu_irq gpad_irq[5];
1436         static const int gpad_keycode[5] = { 0xc8, 0xd0, 0xcb, 0xcd, 0x1d };
1437 
1438         gpad_irq[0] = qemu_irq_invert(gpio_in[GPIO_E][0]); /* up */
1439         gpad_irq[1] = qemu_irq_invert(gpio_in[GPIO_E][1]); /* down */
1440         gpad_irq[2] = qemu_irq_invert(gpio_in[GPIO_E][2]); /* left */
1441         gpad_irq[3] = qemu_irq_invert(gpio_in[GPIO_E][3]); /* right */
1442         gpad_irq[4] = qemu_irq_invert(gpio_in[GPIO_F][1]); /* select */
1443 
1444         stellaris_gamepad_init(5, gpad_irq, gpad_keycode);
1445     }
1446     for (i = 0; i < 7; i++) {
1447         if (board->dc4 & (1 << i)) {
1448             for (j = 0; j < 8; j++) {
1449                 if (gpio_out[i][j]) {
1450                     qdev_connect_gpio_out(gpio_dev[i], j, gpio_out[i][j]);
1451                 }
1452             }
1453         }
1454     }
1455 
1456     /* Add dummy regions for the devices we don't implement yet,
1457      * so guest accesses don't cause unlogged crashes.
1458      */
1459     create_unimplemented_device("i2c-0", 0x40002000, 0x1000);
1460     create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
1461     create_unimplemented_device("PWM", 0x40028000, 0x1000);
1462     create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
1463     create_unimplemented_device("QEI-1", 0x4002d000, 0x1000);
1464     create_unimplemented_device("analogue-comparator", 0x4003c000, 0x1000);
1465     create_unimplemented_device("hibernation", 0x400fc000, 0x1000);
1466     create_unimplemented_device("flash-control", 0x400fd000, 0x1000);
1467 
1468     armv7m_load_kernel(ARM_CPU(first_cpu), ms->kernel_filename, flash_size);
1469 }
1470 
1471 /* FIXME: Figure out how to generate these from stellaris_boards.  */
1472 static void lm3s811evb_init(MachineState *machine)
1473 {
1474     stellaris_init(machine, &stellaris_boards[0]);
1475 }
1476 
1477 static void lm3s6965evb_init(MachineState *machine)
1478 {
1479     stellaris_init(machine, &stellaris_boards[1]);
1480 }
1481 
1482 static void lm3s811evb_class_init(ObjectClass *oc, void *data)
1483 {
1484     MachineClass *mc = MACHINE_CLASS(oc);
1485 
1486     mc->desc = "Stellaris LM3S811EVB";
1487     mc->init = lm3s811evb_init;
1488     mc->ignore_memory_transaction_failures = true;
1489     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m3");
1490 }
1491 
1492 static const TypeInfo lm3s811evb_type = {
1493     .name = MACHINE_TYPE_NAME("lm3s811evb"),
1494     .parent = TYPE_MACHINE,
1495     .class_init = lm3s811evb_class_init,
1496 };
1497 
1498 static void lm3s6965evb_class_init(ObjectClass *oc, void *data)
1499 {
1500     MachineClass *mc = MACHINE_CLASS(oc);
1501 
1502     mc->desc = "Stellaris LM3S6965EVB";
1503     mc->init = lm3s6965evb_init;
1504     mc->ignore_memory_transaction_failures = true;
1505     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m3");
1506 }
1507 
1508 static const TypeInfo lm3s6965evb_type = {
1509     .name = MACHINE_TYPE_NAME("lm3s6965evb"),
1510     .parent = TYPE_MACHINE,
1511     .class_init = lm3s6965evb_class_init,
1512 };
1513 
1514 static void stellaris_machine_init(void)
1515 {
1516     type_register_static(&lm3s811evb_type);
1517     type_register_static(&lm3s6965evb_type);
1518 }
1519 
1520 type_init(stellaris_machine_init)
1521 
1522 static void stellaris_i2c_class_init(ObjectClass *klass, void *data)
1523 {
1524     DeviceClass *dc = DEVICE_CLASS(klass);
1525 
1526     dc->vmsd = &vmstate_stellaris_i2c;
1527 }
1528 
1529 static const TypeInfo stellaris_i2c_info = {
1530     .name          = TYPE_STELLARIS_I2C,
1531     .parent        = TYPE_SYS_BUS_DEVICE,
1532     .instance_size = sizeof(stellaris_i2c_state),
1533     .instance_init = stellaris_i2c_init,
1534     .class_init    = stellaris_i2c_class_init,
1535 };
1536 
1537 static void stellaris_gptm_class_init(ObjectClass *klass, void *data)
1538 {
1539     DeviceClass *dc = DEVICE_CLASS(klass);
1540 
1541     dc->vmsd = &vmstate_stellaris_gptm;
1542     dc->realize = stellaris_gptm_realize;
1543 }
1544 
1545 static const TypeInfo stellaris_gptm_info = {
1546     .name          = TYPE_STELLARIS_GPTM,
1547     .parent        = TYPE_SYS_BUS_DEVICE,
1548     .instance_size = sizeof(gptm_state),
1549     .instance_init = stellaris_gptm_init,
1550     .class_init    = stellaris_gptm_class_init,
1551 };
1552 
1553 static void stellaris_adc_class_init(ObjectClass *klass, void *data)
1554 {
1555     DeviceClass *dc = DEVICE_CLASS(klass);
1556 
1557     dc->vmsd = &vmstate_stellaris_adc;
1558 }
1559 
1560 static const TypeInfo stellaris_adc_info = {
1561     .name          = TYPE_STELLARIS_ADC,
1562     .parent        = TYPE_SYS_BUS_DEVICE,
1563     .instance_size = sizeof(stellaris_adc_state),
1564     .instance_init = stellaris_adc_init,
1565     .class_init    = stellaris_adc_class_init,
1566 };
1567 
1568 static void stellaris_register_types(void)
1569 {
1570     type_register_static(&stellaris_i2c_info);
1571     type_register_static(&stellaris_gptm_info);
1572     type_register_static(&stellaris_adc_info);
1573 }
1574 
1575 type_init(stellaris_register_types)
1576