xref: /openbmc/qemu/hw/arm/stellaris.c (revision a68694cd)
1 /*
2  * Luminary Micro Stellaris peripherals
3  *
4  * Copyright (c) 2006 CodeSourcery.
5  * Written by Paul Brook
6  *
7  * This code is licensed under the GPL.
8  */
9 
10 #include "qemu/osdep.h"
11 #include "qapi/error.h"
12 #include "hw/sysbus.h"
13 #include "hw/ssi/ssi.h"
14 #include "hw/arm/boot.h"
15 #include "qemu/timer.h"
16 #include "hw/i2c/i2c.h"
17 #include "net/net.h"
18 #include "hw/boards.h"
19 #include "qemu/log.h"
20 #include "exec/address-spaces.h"
21 #include "sysemu/sysemu.h"
22 #include "hw/arm/armv7m.h"
23 #include "hw/char/pl011.h"
24 #include "hw/input/gamepad.h"
25 #include "hw/irq.h"
26 #include "hw/watchdog/cmsdk-apb-watchdog.h"
27 #include "migration/vmstate.h"
28 #include "hw/misc/unimp.h"
29 #include "cpu.h"
30 #include "qom/object.h"
31 
32 #define GPIO_A 0
33 #define GPIO_B 1
34 #define GPIO_C 2
35 #define GPIO_D 3
36 #define GPIO_E 4
37 #define GPIO_F 5
38 #define GPIO_G 6
39 
40 #define BP_OLED_I2C  0x01
41 #define BP_OLED_SSI  0x02
42 #define BP_GAMEPAD   0x04
43 
44 #define NUM_IRQ_LINES 64
45 
46 typedef const struct {
47     const char *name;
48     uint32_t did0;
49     uint32_t did1;
50     uint32_t dc0;
51     uint32_t dc1;
52     uint32_t dc2;
53     uint32_t dc3;
54     uint32_t dc4;
55     uint32_t peripherals;
56 } stellaris_board_info;
57 
58 /* General purpose timer module.  */
59 
60 #define TYPE_STELLARIS_GPTM "stellaris-gptm"
61 typedef struct gptm_state gptm_state;
62 DECLARE_INSTANCE_CHECKER(gptm_state, STELLARIS_GPTM,
63                          TYPE_STELLARIS_GPTM)
64 
65 struct gptm_state {
66     SysBusDevice parent_obj;
67 
68     MemoryRegion iomem;
69     uint32_t config;
70     uint32_t mode[2];
71     uint32_t control;
72     uint32_t state;
73     uint32_t mask;
74     uint32_t load[2];
75     uint32_t match[2];
76     uint32_t prescale[2];
77     uint32_t match_prescale[2];
78     uint32_t rtc;
79     int64_t tick[2];
80     struct gptm_state *opaque[2];
81     QEMUTimer *timer[2];
82     /* The timers have an alternate output used to trigger the ADC.  */
83     qemu_irq trigger;
84     qemu_irq irq;
85 };
86 
87 static void gptm_update_irq(gptm_state *s)
88 {
89     int level;
90     level = (s->state & s->mask) != 0;
91     qemu_set_irq(s->irq, level);
92 }
93 
94 static void gptm_stop(gptm_state *s, int n)
95 {
96     timer_del(s->timer[n]);
97 }
98 
99 static void gptm_reload(gptm_state *s, int n, int reset)
100 {
101     int64_t tick;
102     if (reset)
103         tick = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
104     else
105         tick = s->tick[n];
106 
107     if (s->config == 0) {
108         /* 32-bit CountDown.  */
109         uint32_t count;
110         count = s->load[0] | (s->load[1] << 16);
111         tick += (int64_t)count * system_clock_scale;
112     } else if (s->config == 1) {
113         /* 32-bit RTC.  1Hz tick.  */
114         tick += NANOSECONDS_PER_SECOND;
115     } else if (s->mode[n] == 0xa) {
116         /* PWM mode.  Not implemented.  */
117     } else {
118         qemu_log_mask(LOG_UNIMP,
119                       "GPTM: 16-bit timer mode unimplemented: 0x%x\n",
120                       s->mode[n]);
121         return;
122     }
123     s->tick[n] = tick;
124     timer_mod(s->timer[n], tick);
125 }
126 
127 static void gptm_tick(void *opaque)
128 {
129     gptm_state **p = (gptm_state **)opaque;
130     gptm_state *s;
131     int n;
132 
133     s = *p;
134     n = p - s->opaque;
135     if (s->config == 0) {
136         s->state |= 1;
137         if ((s->control & 0x20)) {
138             /* Output trigger.  */
139             qemu_irq_pulse(s->trigger);
140         }
141         if (s->mode[0] & 1) {
142             /* One-shot.  */
143             s->control &= ~1;
144         } else {
145             /* Periodic.  */
146             gptm_reload(s, 0, 0);
147         }
148     } else if (s->config == 1) {
149         /* RTC.  */
150         uint32_t match;
151         s->rtc++;
152         match = s->match[0] | (s->match[1] << 16);
153         if (s->rtc > match)
154             s->rtc = 0;
155         if (s->rtc == 0) {
156             s->state |= 8;
157         }
158         gptm_reload(s, 0, 0);
159     } else if (s->mode[n] == 0xa) {
160         /* PWM mode.  Not implemented.  */
161     } else {
162         qemu_log_mask(LOG_UNIMP,
163                       "GPTM: 16-bit timer mode unimplemented: 0x%x\n",
164                       s->mode[n]);
165     }
166     gptm_update_irq(s);
167 }
168 
169 static uint64_t gptm_read(void *opaque, hwaddr offset,
170                           unsigned size)
171 {
172     gptm_state *s = (gptm_state *)opaque;
173 
174     switch (offset) {
175     case 0x00: /* CFG */
176         return s->config;
177     case 0x04: /* TAMR */
178         return s->mode[0];
179     case 0x08: /* TBMR */
180         return s->mode[1];
181     case 0x0c: /* CTL */
182         return s->control;
183     case 0x18: /* IMR */
184         return s->mask;
185     case 0x1c: /* RIS */
186         return s->state;
187     case 0x20: /* MIS */
188         return s->state & s->mask;
189     case 0x24: /* CR */
190         return 0;
191     case 0x28: /* TAILR */
192         return s->load[0] | ((s->config < 4) ? (s->load[1] << 16) : 0);
193     case 0x2c: /* TBILR */
194         return s->load[1];
195     case 0x30: /* TAMARCHR */
196         return s->match[0] | ((s->config < 4) ? (s->match[1] << 16) : 0);
197     case 0x34: /* TBMATCHR */
198         return s->match[1];
199     case 0x38: /* TAPR */
200         return s->prescale[0];
201     case 0x3c: /* TBPR */
202         return s->prescale[1];
203     case 0x40: /* TAPMR */
204         return s->match_prescale[0];
205     case 0x44: /* TBPMR */
206         return s->match_prescale[1];
207     case 0x48: /* TAR */
208         if (s->config == 1) {
209             return s->rtc;
210         }
211         qemu_log_mask(LOG_UNIMP,
212                       "GPTM: read of TAR but timer read not supported\n");
213         return 0;
214     case 0x4c: /* TBR */
215         qemu_log_mask(LOG_UNIMP,
216                       "GPTM: read of TBR but timer read not supported\n");
217         return 0;
218     default:
219         qemu_log_mask(LOG_GUEST_ERROR,
220                       "GPTM: read at bad offset 0x02%" HWADDR_PRIx "\n",
221                       offset);
222         return 0;
223     }
224 }
225 
226 static void gptm_write(void *opaque, hwaddr offset,
227                        uint64_t value, unsigned size)
228 {
229     gptm_state *s = (gptm_state *)opaque;
230     uint32_t oldval;
231 
232     /* The timers should be disabled before changing the configuration.
233        We take advantage of this and defer everything until the timer
234        is enabled.  */
235     switch (offset) {
236     case 0x00: /* CFG */
237         s->config = value;
238         break;
239     case 0x04: /* TAMR */
240         s->mode[0] = value;
241         break;
242     case 0x08: /* TBMR */
243         s->mode[1] = value;
244         break;
245     case 0x0c: /* CTL */
246         oldval = s->control;
247         s->control = value;
248         /* TODO: Implement pause.  */
249         if ((oldval ^ value) & 1) {
250             if (value & 1) {
251                 gptm_reload(s, 0, 1);
252             } else {
253                 gptm_stop(s, 0);
254             }
255         }
256         if (((oldval ^ value) & 0x100) && s->config >= 4) {
257             if (value & 0x100) {
258                 gptm_reload(s, 1, 1);
259             } else {
260                 gptm_stop(s, 1);
261             }
262         }
263         break;
264     case 0x18: /* IMR */
265         s->mask = value & 0x77;
266         gptm_update_irq(s);
267         break;
268     case 0x24: /* CR */
269         s->state &= ~value;
270         break;
271     case 0x28: /* TAILR */
272         s->load[0] = value & 0xffff;
273         if (s->config < 4) {
274             s->load[1] = value >> 16;
275         }
276         break;
277     case 0x2c: /* TBILR */
278         s->load[1] = value & 0xffff;
279         break;
280     case 0x30: /* TAMARCHR */
281         s->match[0] = value & 0xffff;
282         if (s->config < 4) {
283             s->match[1] = value >> 16;
284         }
285         break;
286     case 0x34: /* TBMATCHR */
287         s->match[1] = value >> 16;
288         break;
289     case 0x38: /* TAPR */
290         s->prescale[0] = value;
291         break;
292     case 0x3c: /* TBPR */
293         s->prescale[1] = value;
294         break;
295     case 0x40: /* TAPMR */
296         s->match_prescale[0] = value;
297         break;
298     case 0x44: /* TBPMR */
299         s->match_prescale[0] = value;
300         break;
301     default:
302         qemu_log_mask(LOG_GUEST_ERROR,
303                       "GPTM: write at bad offset 0x02%" HWADDR_PRIx "\n",
304                       offset);
305     }
306     gptm_update_irq(s);
307 }
308 
309 static const MemoryRegionOps gptm_ops = {
310     .read = gptm_read,
311     .write = gptm_write,
312     .endianness = DEVICE_NATIVE_ENDIAN,
313 };
314 
315 static const VMStateDescription vmstate_stellaris_gptm = {
316     .name = "stellaris_gptm",
317     .version_id = 1,
318     .minimum_version_id = 1,
319     .fields = (VMStateField[]) {
320         VMSTATE_UINT32(config, gptm_state),
321         VMSTATE_UINT32_ARRAY(mode, gptm_state, 2),
322         VMSTATE_UINT32(control, gptm_state),
323         VMSTATE_UINT32(state, gptm_state),
324         VMSTATE_UINT32(mask, gptm_state),
325         VMSTATE_UNUSED(8),
326         VMSTATE_UINT32_ARRAY(load, gptm_state, 2),
327         VMSTATE_UINT32_ARRAY(match, gptm_state, 2),
328         VMSTATE_UINT32_ARRAY(prescale, gptm_state, 2),
329         VMSTATE_UINT32_ARRAY(match_prescale, gptm_state, 2),
330         VMSTATE_UINT32(rtc, gptm_state),
331         VMSTATE_INT64_ARRAY(tick, gptm_state, 2),
332         VMSTATE_TIMER_PTR_ARRAY(timer, gptm_state, 2),
333         VMSTATE_END_OF_LIST()
334     }
335 };
336 
337 static void stellaris_gptm_init(Object *obj)
338 {
339     DeviceState *dev = DEVICE(obj);
340     gptm_state *s = STELLARIS_GPTM(obj);
341     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
342 
343     sysbus_init_irq(sbd, &s->irq);
344     qdev_init_gpio_out(dev, &s->trigger, 1);
345 
346     memory_region_init_io(&s->iomem, obj, &gptm_ops, s,
347                           "gptm", 0x1000);
348     sysbus_init_mmio(sbd, &s->iomem);
349 
350     s->opaque[0] = s->opaque[1] = s;
351 }
352 
353 static void stellaris_gptm_realize(DeviceState *dev, Error **errp)
354 {
355     gptm_state *s = STELLARIS_GPTM(dev);
356     s->timer[0] = timer_new_ns(QEMU_CLOCK_VIRTUAL, gptm_tick, &s->opaque[0]);
357     s->timer[1] = timer_new_ns(QEMU_CLOCK_VIRTUAL, gptm_tick, &s->opaque[1]);
358 }
359 
360 /* System controller.  */
361 
362 typedef struct {
363     MemoryRegion iomem;
364     uint32_t pborctl;
365     uint32_t ldopctl;
366     uint32_t int_status;
367     uint32_t int_mask;
368     uint32_t resc;
369     uint32_t rcc;
370     uint32_t rcc2;
371     uint32_t rcgc[3];
372     uint32_t scgc[3];
373     uint32_t dcgc[3];
374     uint32_t clkvclr;
375     uint32_t ldoarst;
376     uint32_t user0;
377     uint32_t user1;
378     qemu_irq irq;
379     stellaris_board_info *board;
380 } ssys_state;
381 
382 static void ssys_update(ssys_state *s)
383 {
384   qemu_set_irq(s->irq, (s->int_status & s->int_mask) != 0);
385 }
386 
387 static uint32_t pllcfg_sandstorm[16] = {
388     0x31c0, /* 1 Mhz */
389     0x1ae0, /* 1.8432 Mhz */
390     0x18c0, /* 2 Mhz */
391     0xd573, /* 2.4576 Mhz */
392     0x37a6, /* 3.57954 Mhz */
393     0x1ae2, /* 3.6864 Mhz */
394     0x0c40, /* 4 Mhz */
395     0x98bc, /* 4.906 Mhz */
396     0x935b, /* 4.9152 Mhz */
397     0x09c0, /* 5 Mhz */
398     0x4dee, /* 5.12 Mhz */
399     0x0c41, /* 6 Mhz */
400     0x75db, /* 6.144 Mhz */
401     0x1ae6, /* 7.3728 Mhz */
402     0x0600, /* 8 Mhz */
403     0x585b /* 8.192 Mhz */
404 };
405 
406 static uint32_t pllcfg_fury[16] = {
407     0x3200, /* 1 Mhz */
408     0x1b20, /* 1.8432 Mhz */
409     0x1900, /* 2 Mhz */
410     0xf42b, /* 2.4576 Mhz */
411     0x37e3, /* 3.57954 Mhz */
412     0x1b21, /* 3.6864 Mhz */
413     0x0c80, /* 4 Mhz */
414     0x98ee, /* 4.906 Mhz */
415     0xd5b4, /* 4.9152 Mhz */
416     0x0a00, /* 5 Mhz */
417     0x4e27, /* 5.12 Mhz */
418     0x1902, /* 6 Mhz */
419     0xec1c, /* 6.144 Mhz */
420     0x1b23, /* 7.3728 Mhz */
421     0x0640, /* 8 Mhz */
422     0xb11c /* 8.192 Mhz */
423 };
424 
425 #define DID0_VER_MASK        0x70000000
426 #define DID0_VER_0           0x00000000
427 #define DID0_VER_1           0x10000000
428 
429 #define DID0_CLASS_MASK      0x00FF0000
430 #define DID0_CLASS_SANDSTORM 0x00000000
431 #define DID0_CLASS_FURY      0x00010000
432 
433 static int ssys_board_class(const ssys_state *s)
434 {
435     uint32_t did0 = s->board->did0;
436     switch (did0 & DID0_VER_MASK) {
437     case DID0_VER_0:
438         return DID0_CLASS_SANDSTORM;
439     case DID0_VER_1:
440         switch (did0 & DID0_CLASS_MASK) {
441         case DID0_CLASS_SANDSTORM:
442         case DID0_CLASS_FURY:
443             return did0 & DID0_CLASS_MASK;
444         }
445         /* for unknown classes, fall through */
446     default:
447         /* This can only happen if the hardwired constant did0 value
448          * in this board's stellaris_board_info struct is wrong.
449          */
450         g_assert_not_reached();
451     }
452 }
453 
454 static uint64_t ssys_read(void *opaque, hwaddr offset,
455                           unsigned size)
456 {
457     ssys_state *s = (ssys_state *)opaque;
458 
459     switch (offset) {
460     case 0x000: /* DID0 */
461         return s->board->did0;
462     case 0x004: /* DID1 */
463         return s->board->did1;
464     case 0x008: /* DC0 */
465         return s->board->dc0;
466     case 0x010: /* DC1 */
467         return s->board->dc1;
468     case 0x014: /* DC2 */
469         return s->board->dc2;
470     case 0x018: /* DC3 */
471         return s->board->dc3;
472     case 0x01c: /* DC4 */
473         return s->board->dc4;
474     case 0x030: /* PBORCTL */
475         return s->pborctl;
476     case 0x034: /* LDOPCTL */
477         return s->ldopctl;
478     case 0x040: /* SRCR0 */
479         return 0;
480     case 0x044: /* SRCR1 */
481         return 0;
482     case 0x048: /* SRCR2 */
483         return 0;
484     case 0x050: /* RIS */
485         return s->int_status;
486     case 0x054: /* IMC */
487         return s->int_mask;
488     case 0x058: /* MISC */
489         return s->int_status & s->int_mask;
490     case 0x05c: /* RESC */
491         return s->resc;
492     case 0x060: /* RCC */
493         return s->rcc;
494     case 0x064: /* PLLCFG */
495         {
496             int xtal;
497             xtal = (s->rcc >> 6) & 0xf;
498             switch (ssys_board_class(s)) {
499             case DID0_CLASS_FURY:
500                 return pllcfg_fury[xtal];
501             case DID0_CLASS_SANDSTORM:
502                 return pllcfg_sandstorm[xtal];
503             default:
504                 g_assert_not_reached();
505             }
506         }
507     case 0x070: /* RCC2 */
508         return s->rcc2;
509     case 0x100: /* RCGC0 */
510         return s->rcgc[0];
511     case 0x104: /* RCGC1 */
512         return s->rcgc[1];
513     case 0x108: /* RCGC2 */
514         return s->rcgc[2];
515     case 0x110: /* SCGC0 */
516         return s->scgc[0];
517     case 0x114: /* SCGC1 */
518         return s->scgc[1];
519     case 0x118: /* SCGC2 */
520         return s->scgc[2];
521     case 0x120: /* DCGC0 */
522         return s->dcgc[0];
523     case 0x124: /* DCGC1 */
524         return s->dcgc[1];
525     case 0x128: /* DCGC2 */
526         return s->dcgc[2];
527     case 0x150: /* CLKVCLR */
528         return s->clkvclr;
529     case 0x160: /* LDOARST */
530         return s->ldoarst;
531     case 0x1e0: /* USER0 */
532         return s->user0;
533     case 0x1e4: /* USER1 */
534         return s->user1;
535     default:
536         qemu_log_mask(LOG_GUEST_ERROR,
537                       "SSYS: read at bad offset 0x%x\n", (int)offset);
538         return 0;
539     }
540 }
541 
542 static bool ssys_use_rcc2(ssys_state *s)
543 {
544     return (s->rcc2 >> 31) & 0x1;
545 }
546 
547 /*
548  * Caculate the sys. clock period in ms.
549  */
550 static void ssys_calculate_system_clock(ssys_state *s)
551 {
552     if (ssys_use_rcc2(s)) {
553         system_clock_scale = 5 * (((s->rcc2 >> 23) & 0x3f) + 1);
554     } else {
555         system_clock_scale = 5 * (((s->rcc >> 23) & 0xf) + 1);
556     }
557 }
558 
559 static void ssys_write(void *opaque, hwaddr offset,
560                        uint64_t value, unsigned size)
561 {
562     ssys_state *s = (ssys_state *)opaque;
563 
564     switch (offset) {
565     case 0x030: /* PBORCTL */
566         s->pborctl = value & 0xffff;
567         break;
568     case 0x034: /* LDOPCTL */
569         s->ldopctl = value & 0x1f;
570         break;
571     case 0x040: /* SRCR0 */
572     case 0x044: /* SRCR1 */
573     case 0x048: /* SRCR2 */
574         qemu_log_mask(LOG_UNIMP, "Peripheral reset not implemented\n");
575         break;
576     case 0x054: /* IMC */
577         s->int_mask = value & 0x7f;
578         break;
579     case 0x058: /* MISC */
580         s->int_status &= ~value;
581         break;
582     case 0x05c: /* RESC */
583         s->resc = value & 0x3f;
584         break;
585     case 0x060: /* RCC */
586         if ((s->rcc & (1 << 13)) != 0 && (value & (1 << 13)) == 0) {
587             /* PLL enable.  */
588             s->int_status |= (1 << 6);
589         }
590         s->rcc = value;
591         ssys_calculate_system_clock(s);
592         break;
593     case 0x070: /* RCC2 */
594         if (ssys_board_class(s) == DID0_CLASS_SANDSTORM) {
595             break;
596         }
597 
598         if ((s->rcc2 & (1 << 13)) != 0 && (value & (1 << 13)) == 0) {
599             /* PLL enable.  */
600             s->int_status |= (1 << 6);
601         }
602         s->rcc2 = value;
603         ssys_calculate_system_clock(s);
604         break;
605     case 0x100: /* RCGC0 */
606         s->rcgc[0] = value;
607         break;
608     case 0x104: /* RCGC1 */
609         s->rcgc[1] = value;
610         break;
611     case 0x108: /* RCGC2 */
612         s->rcgc[2] = value;
613         break;
614     case 0x110: /* SCGC0 */
615         s->scgc[0] = value;
616         break;
617     case 0x114: /* SCGC1 */
618         s->scgc[1] = value;
619         break;
620     case 0x118: /* SCGC2 */
621         s->scgc[2] = value;
622         break;
623     case 0x120: /* DCGC0 */
624         s->dcgc[0] = value;
625         break;
626     case 0x124: /* DCGC1 */
627         s->dcgc[1] = value;
628         break;
629     case 0x128: /* DCGC2 */
630         s->dcgc[2] = value;
631         break;
632     case 0x150: /* CLKVCLR */
633         s->clkvclr = value;
634         break;
635     case 0x160: /* LDOARST */
636         s->ldoarst = value;
637         break;
638     default:
639         qemu_log_mask(LOG_GUEST_ERROR,
640                       "SSYS: write at bad offset 0x%x\n", (int)offset);
641     }
642     ssys_update(s);
643 }
644 
645 static const MemoryRegionOps ssys_ops = {
646     .read = ssys_read,
647     .write = ssys_write,
648     .endianness = DEVICE_NATIVE_ENDIAN,
649 };
650 
651 static void ssys_reset(void *opaque)
652 {
653     ssys_state *s = (ssys_state *)opaque;
654 
655     s->pborctl = 0x7ffd;
656     s->rcc = 0x078e3ac0;
657 
658     if (ssys_board_class(s) == DID0_CLASS_SANDSTORM) {
659         s->rcc2 = 0;
660     } else {
661         s->rcc2 = 0x07802810;
662     }
663     s->rcgc[0] = 1;
664     s->scgc[0] = 1;
665     s->dcgc[0] = 1;
666     ssys_calculate_system_clock(s);
667 }
668 
669 static int stellaris_sys_post_load(void *opaque, int version_id)
670 {
671     ssys_state *s = opaque;
672 
673     ssys_calculate_system_clock(s);
674 
675     return 0;
676 }
677 
678 static const VMStateDescription vmstate_stellaris_sys = {
679     .name = "stellaris_sys",
680     .version_id = 2,
681     .minimum_version_id = 1,
682     .post_load = stellaris_sys_post_load,
683     .fields = (VMStateField[]) {
684         VMSTATE_UINT32(pborctl, ssys_state),
685         VMSTATE_UINT32(ldopctl, ssys_state),
686         VMSTATE_UINT32(int_mask, ssys_state),
687         VMSTATE_UINT32(int_status, ssys_state),
688         VMSTATE_UINT32(resc, ssys_state),
689         VMSTATE_UINT32(rcc, ssys_state),
690         VMSTATE_UINT32_V(rcc2, ssys_state, 2),
691         VMSTATE_UINT32_ARRAY(rcgc, ssys_state, 3),
692         VMSTATE_UINT32_ARRAY(scgc, ssys_state, 3),
693         VMSTATE_UINT32_ARRAY(dcgc, ssys_state, 3),
694         VMSTATE_UINT32(clkvclr, ssys_state),
695         VMSTATE_UINT32(ldoarst, ssys_state),
696         VMSTATE_END_OF_LIST()
697     }
698 };
699 
700 static int stellaris_sys_init(uint32_t base, qemu_irq irq,
701                               stellaris_board_info * board,
702                               uint8_t *macaddr)
703 {
704     ssys_state *s;
705 
706     s = g_new0(ssys_state, 1);
707     s->irq = irq;
708     s->board = board;
709     /* Most devices come preprogrammed with a MAC address in the user data. */
710     s->user0 = macaddr[0] | (macaddr[1] << 8) | (macaddr[2] << 16);
711     s->user1 = macaddr[3] | (macaddr[4] << 8) | (macaddr[5] << 16);
712 
713     memory_region_init_io(&s->iomem, NULL, &ssys_ops, s, "ssys", 0x00001000);
714     memory_region_add_subregion(get_system_memory(), base, &s->iomem);
715     ssys_reset(s);
716     vmstate_register(NULL, VMSTATE_INSTANCE_ID_ANY, &vmstate_stellaris_sys, s);
717     return 0;
718 }
719 
720 
721 /* I2C controller.  */
722 
723 #define TYPE_STELLARIS_I2C "stellaris-i2c"
724 typedef struct stellaris_i2c_state stellaris_i2c_state;
725 DECLARE_INSTANCE_CHECKER(stellaris_i2c_state, STELLARIS_I2C,
726                          TYPE_STELLARIS_I2C)
727 
728 struct stellaris_i2c_state {
729     SysBusDevice parent_obj;
730 
731     I2CBus *bus;
732     qemu_irq irq;
733     MemoryRegion iomem;
734     uint32_t msa;
735     uint32_t mcs;
736     uint32_t mdr;
737     uint32_t mtpr;
738     uint32_t mimr;
739     uint32_t mris;
740     uint32_t mcr;
741 };
742 
743 #define STELLARIS_I2C_MCS_BUSY    0x01
744 #define STELLARIS_I2C_MCS_ERROR   0x02
745 #define STELLARIS_I2C_MCS_ADRACK  0x04
746 #define STELLARIS_I2C_MCS_DATACK  0x08
747 #define STELLARIS_I2C_MCS_ARBLST  0x10
748 #define STELLARIS_I2C_MCS_IDLE    0x20
749 #define STELLARIS_I2C_MCS_BUSBSY  0x40
750 
751 static uint64_t stellaris_i2c_read(void *opaque, hwaddr offset,
752                                    unsigned size)
753 {
754     stellaris_i2c_state *s = (stellaris_i2c_state *)opaque;
755 
756     switch (offset) {
757     case 0x00: /* MSA */
758         return s->msa;
759     case 0x04: /* MCS */
760         /* We don't emulate timing, so the controller is never busy.  */
761         return s->mcs | STELLARIS_I2C_MCS_IDLE;
762     case 0x08: /* MDR */
763         return s->mdr;
764     case 0x0c: /* MTPR */
765         return s->mtpr;
766     case 0x10: /* MIMR */
767         return s->mimr;
768     case 0x14: /* MRIS */
769         return s->mris;
770     case 0x18: /* MMIS */
771         return s->mris & s->mimr;
772     case 0x20: /* MCR */
773         return s->mcr;
774     default:
775         qemu_log_mask(LOG_GUEST_ERROR,
776                       "stellaris_i2c: read at bad offset 0x%x\n", (int)offset);
777         return 0;
778     }
779 }
780 
781 static void stellaris_i2c_update(stellaris_i2c_state *s)
782 {
783     int level;
784 
785     level = (s->mris & s->mimr) != 0;
786     qemu_set_irq(s->irq, level);
787 }
788 
789 static void stellaris_i2c_write(void *opaque, hwaddr offset,
790                                 uint64_t value, unsigned size)
791 {
792     stellaris_i2c_state *s = (stellaris_i2c_state *)opaque;
793 
794     switch (offset) {
795     case 0x00: /* MSA */
796         s->msa = value & 0xff;
797         break;
798     case 0x04: /* MCS */
799         if ((s->mcr & 0x10) == 0) {
800             /* Disabled.  Do nothing.  */
801             break;
802         }
803         /* Grab the bus if this is starting a transfer.  */
804         if ((value & 2) && (s->mcs & STELLARIS_I2C_MCS_BUSBSY) == 0) {
805             if (i2c_start_transfer(s->bus, s->msa >> 1, s->msa & 1)) {
806                 s->mcs |= STELLARIS_I2C_MCS_ARBLST;
807             } else {
808                 s->mcs &= ~STELLARIS_I2C_MCS_ARBLST;
809                 s->mcs |= STELLARIS_I2C_MCS_BUSBSY;
810             }
811         }
812         /* If we don't have the bus then indicate an error.  */
813         if (!i2c_bus_busy(s->bus)
814                 || (s->mcs & STELLARIS_I2C_MCS_BUSBSY) == 0) {
815             s->mcs |= STELLARIS_I2C_MCS_ERROR;
816             break;
817         }
818         s->mcs &= ~STELLARIS_I2C_MCS_ERROR;
819         if (value & 1) {
820             /* Transfer a byte.  */
821             /* TODO: Handle errors.  */
822             if (s->msa & 1) {
823                 /* Recv */
824                 s->mdr = i2c_recv(s->bus);
825             } else {
826                 /* Send */
827                 i2c_send(s->bus, s->mdr);
828             }
829             /* Raise an interrupt.  */
830             s->mris |= 1;
831         }
832         if (value & 4) {
833             /* Finish transfer.  */
834             i2c_end_transfer(s->bus);
835             s->mcs &= ~STELLARIS_I2C_MCS_BUSBSY;
836         }
837         break;
838     case 0x08: /* MDR */
839         s->mdr = value & 0xff;
840         break;
841     case 0x0c: /* MTPR */
842         s->mtpr = value & 0xff;
843         break;
844     case 0x10: /* MIMR */
845         s->mimr = 1;
846         break;
847     case 0x1c: /* MICR */
848         s->mris &= ~value;
849         break;
850     case 0x20: /* MCR */
851         if (value & 1) {
852             qemu_log_mask(LOG_UNIMP,
853                           "stellaris_i2c: Loopback not implemented\n");
854         }
855         if (value & 0x20) {
856             qemu_log_mask(LOG_UNIMP,
857                           "stellaris_i2c: Slave mode not implemented\n");
858         }
859         s->mcr = value & 0x31;
860         break;
861     default:
862         qemu_log_mask(LOG_GUEST_ERROR,
863                       "stellaris_i2c: write at bad offset 0x%x\n", (int)offset);
864     }
865     stellaris_i2c_update(s);
866 }
867 
868 static void stellaris_i2c_reset(stellaris_i2c_state *s)
869 {
870     if (s->mcs & STELLARIS_I2C_MCS_BUSBSY)
871         i2c_end_transfer(s->bus);
872 
873     s->msa = 0;
874     s->mcs = 0;
875     s->mdr = 0;
876     s->mtpr = 1;
877     s->mimr = 0;
878     s->mris = 0;
879     s->mcr = 0;
880     stellaris_i2c_update(s);
881 }
882 
883 static const MemoryRegionOps stellaris_i2c_ops = {
884     .read = stellaris_i2c_read,
885     .write = stellaris_i2c_write,
886     .endianness = DEVICE_NATIVE_ENDIAN,
887 };
888 
889 static const VMStateDescription vmstate_stellaris_i2c = {
890     .name = "stellaris_i2c",
891     .version_id = 1,
892     .minimum_version_id = 1,
893     .fields = (VMStateField[]) {
894         VMSTATE_UINT32(msa, stellaris_i2c_state),
895         VMSTATE_UINT32(mcs, stellaris_i2c_state),
896         VMSTATE_UINT32(mdr, stellaris_i2c_state),
897         VMSTATE_UINT32(mtpr, stellaris_i2c_state),
898         VMSTATE_UINT32(mimr, stellaris_i2c_state),
899         VMSTATE_UINT32(mris, stellaris_i2c_state),
900         VMSTATE_UINT32(mcr, stellaris_i2c_state),
901         VMSTATE_END_OF_LIST()
902     }
903 };
904 
905 static void stellaris_i2c_init(Object *obj)
906 {
907     DeviceState *dev = DEVICE(obj);
908     stellaris_i2c_state *s = STELLARIS_I2C(obj);
909     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
910     I2CBus *bus;
911 
912     sysbus_init_irq(sbd, &s->irq);
913     bus = i2c_init_bus(dev, "i2c");
914     s->bus = bus;
915 
916     memory_region_init_io(&s->iomem, obj, &stellaris_i2c_ops, s,
917                           "i2c", 0x1000);
918     sysbus_init_mmio(sbd, &s->iomem);
919     /* ??? For now we only implement the master interface.  */
920     stellaris_i2c_reset(s);
921 }
922 
923 /* Analogue to Digital Converter.  This is only partially implemented,
924    enough for applications that use a combined ADC and timer tick.  */
925 
926 #define STELLARIS_ADC_EM_CONTROLLER 0
927 #define STELLARIS_ADC_EM_COMP       1
928 #define STELLARIS_ADC_EM_EXTERNAL   4
929 #define STELLARIS_ADC_EM_TIMER      5
930 #define STELLARIS_ADC_EM_PWM0       6
931 #define STELLARIS_ADC_EM_PWM1       7
932 #define STELLARIS_ADC_EM_PWM2       8
933 
934 #define STELLARIS_ADC_FIFO_EMPTY    0x0100
935 #define STELLARIS_ADC_FIFO_FULL     0x1000
936 
937 #define TYPE_STELLARIS_ADC "stellaris-adc"
938 typedef struct StellarisADCState stellaris_adc_state;
939 DECLARE_INSTANCE_CHECKER(stellaris_adc_state, STELLARIS_ADC,
940                          TYPE_STELLARIS_ADC)
941 
942 struct StellarisADCState {
943     SysBusDevice parent_obj;
944 
945     MemoryRegion iomem;
946     uint32_t actss;
947     uint32_t ris;
948     uint32_t im;
949     uint32_t emux;
950     uint32_t ostat;
951     uint32_t ustat;
952     uint32_t sspri;
953     uint32_t sac;
954     struct {
955         uint32_t state;
956         uint32_t data[16];
957     } fifo[4];
958     uint32_t ssmux[4];
959     uint32_t ssctl[4];
960     uint32_t noise;
961     qemu_irq irq[4];
962 };
963 
964 static uint32_t stellaris_adc_fifo_read(stellaris_adc_state *s, int n)
965 {
966     int tail;
967 
968     tail = s->fifo[n].state & 0xf;
969     if (s->fifo[n].state & STELLARIS_ADC_FIFO_EMPTY) {
970         s->ustat |= 1 << n;
971     } else {
972         s->fifo[n].state = (s->fifo[n].state & ~0xf) | ((tail + 1) & 0xf);
973         s->fifo[n].state &= ~STELLARIS_ADC_FIFO_FULL;
974         if (tail + 1 == ((s->fifo[n].state >> 4) & 0xf))
975             s->fifo[n].state |= STELLARIS_ADC_FIFO_EMPTY;
976     }
977     return s->fifo[n].data[tail];
978 }
979 
980 static void stellaris_adc_fifo_write(stellaris_adc_state *s, int n,
981                                      uint32_t value)
982 {
983     int head;
984 
985     /* TODO: Real hardware has limited size FIFOs.  We have a full 16 entry
986        FIFO fir each sequencer.  */
987     head = (s->fifo[n].state >> 4) & 0xf;
988     if (s->fifo[n].state & STELLARIS_ADC_FIFO_FULL) {
989         s->ostat |= 1 << n;
990         return;
991     }
992     s->fifo[n].data[head] = value;
993     head = (head + 1) & 0xf;
994     s->fifo[n].state &= ~STELLARIS_ADC_FIFO_EMPTY;
995     s->fifo[n].state = (s->fifo[n].state & ~0xf0) | (head << 4);
996     if ((s->fifo[n].state & 0xf) == head)
997         s->fifo[n].state |= STELLARIS_ADC_FIFO_FULL;
998 }
999 
1000 static void stellaris_adc_update(stellaris_adc_state *s)
1001 {
1002     int level;
1003     int n;
1004 
1005     for (n = 0; n < 4; n++) {
1006         level = (s->ris & s->im & (1 << n)) != 0;
1007         qemu_set_irq(s->irq[n], level);
1008     }
1009 }
1010 
1011 static void stellaris_adc_trigger(void *opaque, int irq, int level)
1012 {
1013     stellaris_adc_state *s = (stellaris_adc_state *)opaque;
1014     int n;
1015 
1016     for (n = 0; n < 4; n++) {
1017         if ((s->actss & (1 << n)) == 0) {
1018             continue;
1019         }
1020 
1021         if (((s->emux >> (n * 4)) & 0xff) != 5) {
1022             continue;
1023         }
1024 
1025         /* Some applications use the ADC as a random number source, so introduce
1026            some variation into the signal.  */
1027         s->noise = s->noise * 314159 + 1;
1028         /* ??? actual inputs not implemented.  Return an arbitrary value.  */
1029         stellaris_adc_fifo_write(s, n, 0x200 + ((s->noise >> 16) & 7));
1030         s->ris |= (1 << n);
1031         stellaris_adc_update(s);
1032     }
1033 }
1034 
1035 static void stellaris_adc_reset(stellaris_adc_state *s)
1036 {
1037     int n;
1038 
1039     for (n = 0; n < 4; n++) {
1040         s->ssmux[n] = 0;
1041         s->ssctl[n] = 0;
1042         s->fifo[n].state = STELLARIS_ADC_FIFO_EMPTY;
1043     }
1044 }
1045 
1046 static uint64_t stellaris_adc_read(void *opaque, hwaddr offset,
1047                                    unsigned size)
1048 {
1049     stellaris_adc_state *s = (stellaris_adc_state *)opaque;
1050 
1051     /* TODO: Implement this.  */
1052     if (offset >= 0x40 && offset < 0xc0) {
1053         int n;
1054         n = (offset - 0x40) >> 5;
1055         switch (offset & 0x1f) {
1056         case 0x00: /* SSMUX */
1057             return s->ssmux[n];
1058         case 0x04: /* SSCTL */
1059             return s->ssctl[n];
1060         case 0x08: /* SSFIFO */
1061             return stellaris_adc_fifo_read(s, n);
1062         case 0x0c: /* SSFSTAT */
1063             return s->fifo[n].state;
1064         default:
1065             break;
1066         }
1067     }
1068     switch (offset) {
1069     case 0x00: /* ACTSS */
1070         return s->actss;
1071     case 0x04: /* RIS */
1072         return s->ris;
1073     case 0x08: /* IM */
1074         return s->im;
1075     case 0x0c: /* ISC */
1076         return s->ris & s->im;
1077     case 0x10: /* OSTAT */
1078         return s->ostat;
1079     case 0x14: /* EMUX */
1080         return s->emux;
1081     case 0x18: /* USTAT */
1082         return s->ustat;
1083     case 0x20: /* SSPRI */
1084         return s->sspri;
1085     case 0x30: /* SAC */
1086         return s->sac;
1087     default:
1088         qemu_log_mask(LOG_GUEST_ERROR,
1089                       "stellaris_adc: read at bad offset 0x%x\n", (int)offset);
1090         return 0;
1091     }
1092 }
1093 
1094 static void stellaris_adc_write(void *opaque, hwaddr offset,
1095                                 uint64_t value, unsigned size)
1096 {
1097     stellaris_adc_state *s = (stellaris_adc_state *)opaque;
1098 
1099     /* TODO: Implement this.  */
1100     if (offset >= 0x40 && offset < 0xc0) {
1101         int n;
1102         n = (offset - 0x40) >> 5;
1103         switch (offset & 0x1f) {
1104         case 0x00: /* SSMUX */
1105             s->ssmux[n] = value & 0x33333333;
1106             return;
1107         case 0x04: /* SSCTL */
1108             if (value != 6) {
1109                 qemu_log_mask(LOG_UNIMP,
1110                               "ADC: Unimplemented sequence %" PRIx64 "\n",
1111                               value);
1112             }
1113             s->ssctl[n] = value;
1114             return;
1115         default:
1116             break;
1117         }
1118     }
1119     switch (offset) {
1120     case 0x00: /* ACTSS */
1121         s->actss = value & 0xf;
1122         break;
1123     case 0x08: /* IM */
1124         s->im = value;
1125         break;
1126     case 0x0c: /* ISC */
1127         s->ris &= ~value;
1128         break;
1129     case 0x10: /* OSTAT */
1130         s->ostat &= ~value;
1131         break;
1132     case 0x14: /* EMUX */
1133         s->emux = value;
1134         break;
1135     case 0x18: /* USTAT */
1136         s->ustat &= ~value;
1137         break;
1138     case 0x20: /* SSPRI */
1139         s->sspri = value;
1140         break;
1141     case 0x28: /* PSSI */
1142         qemu_log_mask(LOG_UNIMP, "ADC: sample initiate unimplemented\n");
1143         break;
1144     case 0x30: /* SAC */
1145         s->sac = value;
1146         break;
1147     default:
1148         qemu_log_mask(LOG_GUEST_ERROR,
1149                       "stellaris_adc: write at bad offset 0x%x\n", (int)offset);
1150     }
1151     stellaris_adc_update(s);
1152 }
1153 
1154 static const MemoryRegionOps stellaris_adc_ops = {
1155     .read = stellaris_adc_read,
1156     .write = stellaris_adc_write,
1157     .endianness = DEVICE_NATIVE_ENDIAN,
1158 };
1159 
1160 static const VMStateDescription vmstate_stellaris_adc = {
1161     .name = "stellaris_adc",
1162     .version_id = 1,
1163     .minimum_version_id = 1,
1164     .fields = (VMStateField[]) {
1165         VMSTATE_UINT32(actss, stellaris_adc_state),
1166         VMSTATE_UINT32(ris, stellaris_adc_state),
1167         VMSTATE_UINT32(im, stellaris_adc_state),
1168         VMSTATE_UINT32(emux, stellaris_adc_state),
1169         VMSTATE_UINT32(ostat, stellaris_adc_state),
1170         VMSTATE_UINT32(ustat, stellaris_adc_state),
1171         VMSTATE_UINT32(sspri, stellaris_adc_state),
1172         VMSTATE_UINT32(sac, stellaris_adc_state),
1173         VMSTATE_UINT32(fifo[0].state, stellaris_adc_state),
1174         VMSTATE_UINT32_ARRAY(fifo[0].data, stellaris_adc_state, 16),
1175         VMSTATE_UINT32(ssmux[0], stellaris_adc_state),
1176         VMSTATE_UINT32(ssctl[0], stellaris_adc_state),
1177         VMSTATE_UINT32(fifo[1].state, stellaris_adc_state),
1178         VMSTATE_UINT32_ARRAY(fifo[1].data, stellaris_adc_state, 16),
1179         VMSTATE_UINT32(ssmux[1], stellaris_adc_state),
1180         VMSTATE_UINT32(ssctl[1], stellaris_adc_state),
1181         VMSTATE_UINT32(fifo[2].state, stellaris_adc_state),
1182         VMSTATE_UINT32_ARRAY(fifo[2].data, stellaris_adc_state, 16),
1183         VMSTATE_UINT32(ssmux[2], stellaris_adc_state),
1184         VMSTATE_UINT32(ssctl[2], stellaris_adc_state),
1185         VMSTATE_UINT32(fifo[3].state, stellaris_adc_state),
1186         VMSTATE_UINT32_ARRAY(fifo[3].data, stellaris_adc_state, 16),
1187         VMSTATE_UINT32(ssmux[3], stellaris_adc_state),
1188         VMSTATE_UINT32(ssctl[3], stellaris_adc_state),
1189         VMSTATE_UINT32(noise, stellaris_adc_state),
1190         VMSTATE_END_OF_LIST()
1191     }
1192 };
1193 
1194 static void stellaris_adc_init(Object *obj)
1195 {
1196     DeviceState *dev = DEVICE(obj);
1197     stellaris_adc_state *s = STELLARIS_ADC(obj);
1198     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
1199     int n;
1200 
1201     for (n = 0; n < 4; n++) {
1202         sysbus_init_irq(sbd, &s->irq[n]);
1203     }
1204 
1205     memory_region_init_io(&s->iomem, obj, &stellaris_adc_ops, s,
1206                           "adc", 0x1000);
1207     sysbus_init_mmio(sbd, &s->iomem);
1208     stellaris_adc_reset(s);
1209     qdev_init_gpio_in(dev, stellaris_adc_trigger, 1);
1210 }
1211 
1212 /* Board init.  */
1213 static stellaris_board_info stellaris_boards[] = {
1214   { "LM3S811EVB",
1215     0,
1216     0x0032000e,
1217     0x001f001f, /* dc0 */
1218     0x001132bf,
1219     0x01071013,
1220     0x3f0f01ff,
1221     0x0000001f,
1222     BP_OLED_I2C
1223   },
1224   { "LM3S6965EVB",
1225     0x10010002,
1226     0x1073402e,
1227     0x00ff007f, /* dc0 */
1228     0x001133ff,
1229     0x030f5317,
1230     0x0f0f87ff,
1231     0x5000007f,
1232     BP_OLED_SSI | BP_GAMEPAD
1233   }
1234 };
1235 
1236 static void stellaris_init(MachineState *ms, stellaris_board_info *board)
1237 {
1238     static const int uart_irq[] = {5, 6, 33, 34};
1239     static const int timer_irq[] = {19, 21, 23, 35};
1240     static const uint32_t gpio_addr[7] =
1241       { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
1242         0x40024000, 0x40025000, 0x40026000};
1243     static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
1244 
1245     /* Memory map of SoC devices, from
1246      * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
1247      * http://www.ti.com/lit/ds/symlink/lm3s6965.pdf
1248      *
1249      * 40000000 wdtimer
1250      * 40002000 i2c (unimplemented)
1251      * 40004000 GPIO
1252      * 40005000 GPIO
1253      * 40006000 GPIO
1254      * 40007000 GPIO
1255      * 40008000 SSI
1256      * 4000c000 UART
1257      * 4000d000 UART
1258      * 4000e000 UART
1259      * 40020000 i2c
1260      * 40021000 i2c (unimplemented)
1261      * 40024000 GPIO
1262      * 40025000 GPIO
1263      * 40026000 GPIO
1264      * 40028000 PWM (unimplemented)
1265      * 4002c000 QEI (unimplemented)
1266      * 4002d000 QEI (unimplemented)
1267      * 40030000 gptimer
1268      * 40031000 gptimer
1269      * 40032000 gptimer
1270      * 40033000 gptimer
1271      * 40038000 ADC
1272      * 4003c000 analogue comparator (unimplemented)
1273      * 40048000 ethernet
1274      * 400fc000 hibernation module (unimplemented)
1275      * 400fd000 flash memory control (unimplemented)
1276      * 400fe000 system control
1277      */
1278 
1279     DeviceState *gpio_dev[7], *nvic;
1280     qemu_irq gpio_in[7][8];
1281     qemu_irq gpio_out[7][8];
1282     qemu_irq adc;
1283     int sram_size;
1284     int flash_size;
1285     I2CBus *i2c;
1286     DeviceState *dev;
1287     int i;
1288     int j;
1289 
1290     MemoryRegion *sram = g_new(MemoryRegion, 1);
1291     MemoryRegion *flash = g_new(MemoryRegion, 1);
1292     MemoryRegion *system_memory = get_system_memory();
1293 
1294     flash_size = (((board->dc0 & 0xffff) + 1) << 1) * 1024;
1295     sram_size = ((board->dc0 >> 18) + 1) * 1024;
1296 
1297     /* Flash programming is done via the SCU, so pretend it is ROM.  */
1298     memory_region_init_rom(flash, NULL, "stellaris.flash", flash_size,
1299                            &error_fatal);
1300     memory_region_add_subregion(system_memory, 0, flash);
1301 
1302     memory_region_init_ram(sram, NULL, "stellaris.sram", sram_size,
1303                            &error_fatal);
1304     memory_region_add_subregion(system_memory, 0x20000000, sram);
1305 
1306     nvic = qdev_new(TYPE_ARMV7M);
1307     qdev_prop_set_uint32(nvic, "num-irq", NUM_IRQ_LINES);
1308     qdev_prop_set_string(nvic, "cpu-type", ms->cpu_type);
1309     qdev_prop_set_bit(nvic, "enable-bitband", true);
1310     object_property_set_link(OBJECT(nvic), "memory",
1311                              OBJECT(get_system_memory()), &error_abort);
1312     /* This will exit with an error if the user passed us a bad cpu_type */
1313     sysbus_realize_and_unref(SYS_BUS_DEVICE(nvic), &error_fatal);
1314 
1315     if (board->dc1 & (1 << 16)) {
1316         dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
1317                                     qdev_get_gpio_in(nvic, 14),
1318                                     qdev_get_gpio_in(nvic, 15),
1319                                     qdev_get_gpio_in(nvic, 16),
1320                                     qdev_get_gpio_in(nvic, 17),
1321                                     NULL);
1322         adc = qdev_get_gpio_in(dev, 0);
1323     } else {
1324         adc = NULL;
1325     }
1326     for (i = 0; i < 4; i++) {
1327         if (board->dc2 & (0x10000 << i)) {
1328             dev = sysbus_create_simple(TYPE_STELLARIS_GPTM,
1329                                        0x40030000 + i * 0x1000,
1330                                        qdev_get_gpio_in(nvic, timer_irq[i]));
1331             /* TODO: This is incorrect, but we get away with it because
1332                the ADC output is only ever pulsed.  */
1333             qdev_connect_gpio_out(dev, 0, adc);
1334         }
1335     }
1336 
1337     stellaris_sys_init(0x400fe000, qdev_get_gpio_in(nvic, 28),
1338                        board, nd_table[0].macaddr.a);
1339 
1340 
1341     if (board->dc1 & (1 << 3)) { /* watchdog present */
1342         dev = qdev_new(TYPE_LUMINARY_WATCHDOG);
1343 
1344         /* system_clock_scale is valid now */
1345         uint32_t mainclk = NANOSECONDS_PER_SECOND / system_clock_scale;
1346         qdev_prop_set_uint32(dev, "wdogclk-frq", mainclk);
1347 
1348         sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
1349         sysbus_mmio_map(SYS_BUS_DEVICE(dev),
1350                         0,
1351                         0x40000000u);
1352         sysbus_connect_irq(SYS_BUS_DEVICE(dev),
1353                            0,
1354                            qdev_get_gpio_in(nvic, 18));
1355     }
1356 
1357 
1358     for (i = 0; i < 7; i++) {
1359         if (board->dc4 & (1 << i)) {
1360             gpio_dev[i] = sysbus_create_simple("pl061_luminary", gpio_addr[i],
1361                                                qdev_get_gpio_in(nvic,
1362                                                                 gpio_irq[i]));
1363             for (j = 0; j < 8; j++) {
1364                 gpio_in[i][j] = qdev_get_gpio_in(gpio_dev[i], j);
1365                 gpio_out[i][j] = NULL;
1366             }
1367         }
1368     }
1369 
1370     if (board->dc2 & (1 << 12)) {
1371         dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000,
1372                                    qdev_get_gpio_in(nvic, 8));
1373         i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
1374         if (board->peripherals & BP_OLED_I2C) {
1375             i2c_slave_create_simple(i2c, "ssd0303", 0x3d);
1376         }
1377     }
1378 
1379     for (i = 0; i < 4; i++) {
1380         if (board->dc2 & (1 << i)) {
1381             pl011_luminary_create(0x4000c000 + i * 0x1000,
1382                                   qdev_get_gpio_in(nvic, uart_irq[i]),
1383                                   serial_hd(i));
1384         }
1385     }
1386     if (board->dc2 & (1 << 4)) {
1387         dev = sysbus_create_simple("pl022", 0x40008000,
1388                                    qdev_get_gpio_in(nvic, 7));
1389         if (board->peripherals & BP_OLED_SSI) {
1390             void *bus;
1391             DeviceState *sddev;
1392             DeviceState *ssddev;
1393 
1394             /* Some boards have both an OLED controller and SD card connected to
1395              * the same SSI port, with the SD card chip select connected to a
1396              * GPIO pin.  Technically the OLED chip select is connected to the
1397              * SSI Fss pin.  We do not bother emulating that as both devices
1398              * should never be selected simultaneously, and our OLED controller
1399              * ignores stray 0xff commands that occur when deselecting the SD
1400              * card.
1401              */
1402             bus = qdev_get_child_bus(dev, "ssi");
1403 
1404             sddev = ssi_create_slave(bus, "ssi-sd");
1405             ssddev = ssi_create_slave(bus, "ssd0323");
1406             gpio_out[GPIO_D][0] = qemu_irq_split(
1407                     qdev_get_gpio_in_named(sddev, SSI_GPIO_CS, 0),
1408                     qdev_get_gpio_in_named(ssddev, SSI_GPIO_CS, 0));
1409             gpio_out[GPIO_C][7] = qdev_get_gpio_in(ssddev, 0);
1410 
1411             /* Make sure the select pin is high.  */
1412             qemu_irq_raise(gpio_out[GPIO_D][0]);
1413         }
1414     }
1415     if (board->dc4 & (1 << 28)) {
1416         DeviceState *enet;
1417 
1418         qemu_check_nic_model(&nd_table[0], "stellaris");
1419 
1420         enet = qdev_new("stellaris_enet");
1421         qdev_set_nic_properties(enet, &nd_table[0]);
1422         sysbus_realize_and_unref(SYS_BUS_DEVICE(enet), &error_fatal);
1423         sysbus_mmio_map(SYS_BUS_DEVICE(enet), 0, 0x40048000);
1424         sysbus_connect_irq(SYS_BUS_DEVICE(enet), 0, qdev_get_gpio_in(nvic, 42));
1425     }
1426     if (board->peripherals & BP_GAMEPAD) {
1427         qemu_irq gpad_irq[5];
1428         static const int gpad_keycode[5] = { 0xc8, 0xd0, 0xcb, 0xcd, 0x1d };
1429 
1430         gpad_irq[0] = qemu_irq_invert(gpio_in[GPIO_E][0]); /* up */
1431         gpad_irq[1] = qemu_irq_invert(gpio_in[GPIO_E][1]); /* down */
1432         gpad_irq[2] = qemu_irq_invert(gpio_in[GPIO_E][2]); /* left */
1433         gpad_irq[3] = qemu_irq_invert(gpio_in[GPIO_E][3]); /* right */
1434         gpad_irq[4] = qemu_irq_invert(gpio_in[GPIO_F][1]); /* select */
1435 
1436         stellaris_gamepad_init(5, gpad_irq, gpad_keycode);
1437     }
1438     for (i = 0; i < 7; i++) {
1439         if (board->dc4 & (1 << i)) {
1440             for (j = 0; j < 8; j++) {
1441                 if (gpio_out[i][j]) {
1442                     qdev_connect_gpio_out(gpio_dev[i], j, gpio_out[i][j]);
1443                 }
1444             }
1445         }
1446     }
1447 
1448     /* Add dummy regions for the devices we don't implement yet,
1449      * so guest accesses don't cause unlogged crashes.
1450      */
1451     create_unimplemented_device("i2c-0", 0x40002000, 0x1000);
1452     create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
1453     create_unimplemented_device("PWM", 0x40028000, 0x1000);
1454     create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
1455     create_unimplemented_device("QEI-1", 0x4002d000, 0x1000);
1456     create_unimplemented_device("analogue-comparator", 0x4003c000, 0x1000);
1457     create_unimplemented_device("hibernation", 0x400fc000, 0x1000);
1458     create_unimplemented_device("flash-control", 0x400fd000, 0x1000);
1459 
1460     armv7m_load_kernel(ARM_CPU(first_cpu), ms->kernel_filename, flash_size);
1461 }
1462 
1463 /* FIXME: Figure out how to generate these from stellaris_boards.  */
1464 static void lm3s811evb_init(MachineState *machine)
1465 {
1466     stellaris_init(machine, &stellaris_boards[0]);
1467 }
1468 
1469 static void lm3s6965evb_init(MachineState *machine)
1470 {
1471     stellaris_init(machine, &stellaris_boards[1]);
1472 }
1473 
1474 static void lm3s811evb_class_init(ObjectClass *oc, void *data)
1475 {
1476     MachineClass *mc = MACHINE_CLASS(oc);
1477 
1478     mc->desc = "Stellaris LM3S811EVB";
1479     mc->init = lm3s811evb_init;
1480     mc->ignore_memory_transaction_failures = true;
1481     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m3");
1482 }
1483 
1484 static const TypeInfo lm3s811evb_type = {
1485     .name = MACHINE_TYPE_NAME("lm3s811evb"),
1486     .parent = TYPE_MACHINE,
1487     .class_init = lm3s811evb_class_init,
1488 };
1489 
1490 static void lm3s6965evb_class_init(ObjectClass *oc, void *data)
1491 {
1492     MachineClass *mc = MACHINE_CLASS(oc);
1493 
1494     mc->desc = "Stellaris LM3S6965EVB";
1495     mc->init = lm3s6965evb_init;
1496     mc->ignore_memory_transaction_failures = true;
1497     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m3");
1498 }
1499 
1500 static const TypeInfo lm3s6965evb_type = {
1501     .name = MACHINE_TYPE_NAME("lm3s6965evb"),
1502     .parent = TYPE_MACHINE,
1503     .class_init = lm3s6965evb_class_init,
1504 };
1505 
1506 static void stellaris_machine_init(void)
1507 {
1508     type_register_static(&lm3s811evb_type);
1509     type_register_static(&lm3s6965evb_type);
1510 }
1511 
1512 type_init(stellaris_machine_init)
1513 
1514 static void stellaris_i2c_class_init(ObjectClass *klass, void *data)
1515 {
1516     DeviceClass *dc = DEVICE_CLASS(klass);
1517 
1518     dc->vmsd = &vmstate_stellaris_i2c;
1519 }
1520 
1521 static const TypeInfo stellaris_i2c_info = {
1522     .name          = TYPE_STELLARIS_I2C,
1523     .parent        = TYPE_SYS_BUS_DEVICE,
1524     .instance_size = sizeof(stellaris_i2c_state),
1525     .instance_init = stellaris_i2c_init,
1526     .class_init    = stellaris_i2c_class_init,
1527 };
1528 
1529 static void stellaris_gptm_class_init(ObjectClass *klass, void *data)
1530 {
1531     DeviceClass *dc = DEVICE_CLASS(klass);
1532 
1533     dc->vmsd = &vmstate_stellaris_gptm;
1534     dc->realize = stellaris_gptm_realize;
1535 }
1536 
1537 static const TypeInfo stellaris_gptm_info = {
1538     .name          = TYPE_STELLARIS_GPTM,
1539     .parent        = TYPE_SYS_BUS_DEVICE,
1540     .instance_size = sizeof(gptm_state),
1541     .instance_init = stellaris_gptm_init,
1542     .class_init    = stellaris_gptm_class_init,
1543 };
1544 
1545 static void stellaris_adc_class_init(ObjectClass *klass, void *data)
1546 {
1547     DeviceClass *dc = DEVICE_CLASS(klass);
1548 
1549     dc->vmsd = &vmstate_stellaris_adc;
1550 }
1551 
1552 static const TypeInfo stellaris_adc_info = {
1553     .name          = TYPE_STELLARIS_ADC,
1554     .parent        = TYPE_SYS_BUS_DEVICE,
1555     .instance_size = sizeof(stellaris_adc_state),
1556     .instance_init = stellaris_adc_init,
1557     .class_init    = stellaris_adc_class_init,
1558 };
1559 
1560 static void stellaris_register_types(void)
1561 {
1562     type_register_static(&stellaris_i2c_info);
1563     type_register_static(&stellaris_gptm_info);
1564     type_register_static(&stellaris_adc_info);
1565 }
1566 
1567 type_init(stellaris_register_types)
1568