xref: /qemu/hw/arm/pxa2xx.c (revision 7a4e543d)
1 /*
2  * Intel XScale PXA255/270 processor support.
3  *
4  * Copyright (c) 2006 Openedhand Ltd.
5  * Written by Andrzej Zaborowski <balrog@zabor.org>
6  *
7  * This code is licensed under the GPL.
8  */
9 
10 #include "qemu/osdep.h"
11 #include "hw/sysbus.h"
12 #include "hw/arm/pxa.h"
13 #include "sysemu/sysemu.h"
14 #include "hw/char/serial.h"
15 #include "hw/i2c/i2c.h"
16 #include "hw/ssi/ssi.h"
17 #include "sysemu/char.h"
18 #include "sysemu/block-backend.h"
19 #include "sysemu/blockdev.h"
20 
21 static struct {
22     hwaddr io_base;
23     int irqn;
24 } pxa255_serial[] = {
25     { 0x40100000, PXA2XX_PIC_FFUART },
26     { 0x40200000, PXA2XX_PIC_BTUART },
27     { 0x40700000, PXA2XX_PIC_STUART },
28     { 0x41600000, PXA25X_PIC_HWUART },
29     { 0, 0 }
30 }, pxa270_serial[] = {
31     { 0x40100000, PXA2XX_PIC_FFUART },
32     { 0x40200000, PXA2XX_PIC_BTUART },
33     { 0x40700000, PXA2XX_PIC_STUART },
34     { 0, 0 }
35 };
36 
37 typedef struct PXASSPDef {
38     hwaddr io_base;
39     int irqn;
40 } PXASSPDef;
41 
42 #if 0
43 static PXASSPDef pxa250_ssp[] = {
44     { 0x41000000, PXA2XX_PIC_SSP },
45     { 0, 0 }
46 };
47 #endif
48 
49 static PXASSPDef pxa255_ssp[] = {
50     { 0x41000000, PXA2XX_PIC_SSP },
51     { 0x41400000, PXA25X_PIC_NSSP },
52     { 0, 0 }
53 };
54 
55 #if 0
56 static PXASSPDef pxa26x_ssp[] = {
57     { 0x41000000, PXA2XX_PIC_SSP },
58     { 0x41400000, PXA25X_PIC_NSSP },
59     { 0x41500000, PXA26X_PIC_ASSP },
60     { 0, 0 }
61 };
62 #endif
63 
64 static PXASSPDef pxa27x_ssp[] = {
65     { 0x41000000, PXA2XX_PIC_SSP },
66     { 0x41700000, PXA27X_PIC_SSP2 },
67     { 0x41900000, PXA2XX_PIC_SSP3 },
68     { 0, 0 }
69 };
70 
71 #define PMCR	0x00	/* Power Manager Control register */
72 #define PSSR	0x04	/* Power Manager Sleep Status register */
73 #define PSPR	0x08	/* Power Manager Scratch-Pad register */
74 #define PWER	0x0c	/* Power Manager Wake-Up Enable register */
75 #define PRER	0x10	/* Power Manager Rising-Edge Detect Enable register */
76 #define PFER	0x14	/* Power Manager Falling-Edge Detect Enable register */
77 #define PEDR	0x18	/* Power Manager Edge-Detect Status register */
78 #define PCFR	0x1c	/* Power Manager General Configuration register */
79 #define PGSR0	0x20	/* Power Manager GPIO Sleep-State register 0 */
80 #define PGSR1	0x24	/* Power Manager GPIO Sleep-State register 1 */
81 #define PGSR2	0x28	/* Power Manager GPIO Sleep-State register 2 */
82 #define PGSR3	0x2c	/* Power Manager GPIO Sleep-State register 3 */
83 #define RCSR	0x30	/* Reset Controller Status register */
84 #define PSLR	0x34	/* Power Manager Sleep Configuration register */
85 #define PTSR	0x38	/* Power Manager Standby Configuration register */
86 #define PVCR	0x40	/* Power Manager Voltage Change Control register */
87 #define PUCR	0x4c	/* Power Manager USIM Card Control/Status register */
88 #define PKWR	0x50	/* Power Manager Keyboard Wake-Up Enable register */
89 #define PKSR	0x54	/* Power Manager Keyboard Level-Detect Status */
90 #define PCMD0	0x80	/* Power Manager I2C Command register File 0 */
91 #define PCMD31	0xfc	/* Power Manager I2C Command register File 31 */
92 
93 static uint64_t pxa2xx_pm_read(void *opaque, hwaddr addr,
94                                unsigned size)
95 {
96     PXA2xxState *s = (PXA2xxState *) opaque;
97 
98     switch (addr) {
99     case PMCR ... PCMD31:
100         if (addr & 3)
101             goto fail;
102 
103         return s->pm_regs[addr >> 2];
104     default:
105     fail:
106         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
107         break;
108     }
109     return 0;
110 }
111 
112 static void pxa2xx_pm_write(void *opaque, hwaddr addr,
113                             uint64_t value, unsigned size)
114 {
115     PXA2xxState *s = (PXA2xxState *) opaque;
116 
117     switch (addr) {
118     case PMCR:
119         /* Clear the write-one-to-clear bits... */
120         s->pm_regs[addr >> 2] &= ~(value & 0x2a);
121         /* ...and set the plain r/w bits */
122         s->pm_regs[addr >> 2] &= ~0x15;
123         s->pm_regs[addr >> 2] |= value & 0x15;
124         break;
125 
126     case PSSR:	/* Read-clean registers */
127     case RCSR:
128     case PKSR:
129         s->pm_regs[addr >> 2] &= ~value;
130         break;
131 
132     default:	/* Read-write registers */
133         if (!(addr & 3)) {
134             s->pm_regs[addr >> 2] = value;
135             break;
136         }
137 
138         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
139         break;
140     }
141 }
142 
143 static const MemoryRegionOps pxa2xx_pm_ops = {
144     .read = pxa2xx_pm_read,
145     .write = pxa2xx_pm_write,
146     .endianness = DEVICE_NATIVE_ENDIAN,
147 };
148 
149 static const VMStateDescription vmstate_pxa2xx_pm = {
150     .name = "pxa2xx_pm",
151     .version_id = 0,
152     .minimum_version_id = 0,
153     .fields = (VMStateField[]) {
154         VMSTATE_UINT32_ARRAY(pm_regs, PXA2xxState, 0x40),
155         VMSTATE_END_OF_LIST()
156     }
157 };
158 
159 #define CCCR	0x00	/* Core Clock Configuration register */
160 #define CKEN	0x04	/* Clock Enable register */
161 #define OSCC	0x08	/* Oscillator Configuration register */
162 #define CCSR	0x0c	/* Core Clock Status register */
163 
164 static uint64_t pxa2xx_cm_read(void *opaque, hwaddr addr,
165                                unsigned size)
166 {
167     PXA2xxState *s = (PXA2xxState *) opaque;
168 
169     switch (addr) {
170     case CCCR:
171     case CKEN:
172     case OSCC:
173         return s->cm_regs[addr >> 2];
174 
175     case CCSR:
176         return s->cm_regs[CCCR >> 2] | (3 << 28);
177 
178     default:
179         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
180         break;
181     }
182     return 0;
183 }
184 
185 static void pxa2xx_cm_write(void *opaque, hwaddr addr,
186                             uint64_t value, unsigned size)
187 {
188     PXA2xxState *s = (PXA2xxState *) opaque;
189 
190     switch (addr) {
191     case CCCR:
192     case CKEN:
193         s->cm_regs[addr >> 2] = value;
194         break;
195 
196     case OSCC:
197         s->cm_regs[addr >> 2] &= ~0x6c;
198         s->cm_regs[addr >> 2] |= value & 0x6e;
199         if ((value >> 1) & 1)			/* OON */
200             s->cm_regs[addr >> 2] |= 1 << 0;	/* Oscillator is now stable */
201         break;
202 
203     default:
204         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
205         break;
206     }
207 }
208 
209 static const MemoryRegionOps pxa2xx_cm_ops = {
210     .read = pxa2xx_cm_read,
211     .write = pxa2xx_cm_write,
212     .endianness = DEVICE_NATIVE_ENDIAN,
213 };
214 
215 static const VMStateDescription vmstate_pxa2xx_cm = {
216     .name = "pxa2xx_cm",
217     .version_id = 0,
218     .minimum_version_id = 0,
219     .fields = (VMStateField[]) {
220         VMSTATE_UINT32_ARRAY(cm_regs, PXA2xxState, 4),
221         VMSTATE_UINT32(clkcfg, PXA2xxState),
222         VMSTATE_UINT32(pmnc, PXA2xxState),
223         VMSTATE_END_OF_LIST()
224     }
225 };
226 
227 static uint64_t pxa2xx_clkcfg_read(CPUARMState *env, const ARMCPRegInfo *ri)
228 {
229     PXA2xxState *s = (PXA2xxState *)ri->opaque;
230     return s->clkcfg;
231 }
232 
233 static void pxa2xx_clkcfg_write(CPUARMState *env, const ARMCPRegInfo *ri,
234                                 uint64_t value)
235 {
236     PXA2xxState *s = (PXA2xxState *)ri->opaque;
237     s->clkcfg = value & 0xf;
238     if (value & 2) {
239         printf("%s: CPU frequency change attempt\n", __func__);
240     }
241 }
242 
243 static void pxa2xx_pwrmode_write(CPUARMState *env, const ARMCPRegInfo *ri,
244                                  uint64_t value)
245 {
246     PXA2xxState *s = (PXA2xxState *)ri->opaque;
247     static const char *pwrmode[8] = {
248         "Normal", "Idle", "Deep-idle", "Standby",
249         "Sleep", "reserved (!)", "reserved (!)", "Deep-sleep",
250     };
251 
252     if (value & 8) {
253         printf("%s: CPU voltage change attempt\n", __func__);
254     }
255     switch (value & 7) {
256     case 0:
257         /* Do nothing */
258         break;
259 
260     case 1:
261         /* Idle */
262         if (!(s->cm_regs[CCCR >> 2] & (1U << 31))) { /* CPDIS */
263             cpu_interrupt(CPU(s->cpu), CPU_INTERRUPT_HALT);
264             break;
265         }
266         /* Fall through.  */
267 
268     case 2:
269         /* Deep-Idle */
270         cpu_interrupt(CPU(s->cpu), CPU_INTERRUPT_HALT);
271         s->pm_regs[RCSR >> 2] |= 0x8; /* Set GPR */
272         goto message;
273 
274     case 3:
275         s->cpu->env.uncached_cpsr = ARM_CPU_MODE_SVC;
276         s->cpu->env.daif = PSTATE_A | PSTATE_F | PSTATE_I;
277         s->cpu->env.cp15.sctlr_ns = 0;
278         s->cpu->env.cp15.cpacr_el1 = 0;
279         s->cpu->env.cp15.ttbr0_el[1] = 0;
280         s->cpu->env.cp15.dacr_ns = 0;
281         s->pm_regs[PSSR >> 2] |= 0x8; /* Set STS */
282         s->pm_regs[RCSR >> 2] |= 0x8; /* Set GPR */
283 
284         /*
285          * The scratch-pad register is almost universally used
286          * for storing the return address on suspend.  For the
287          * lack of a resuming bootloader, perform a jump
288          * directly to that address.
289          */
290         memset(s->cpu->env.regs, 0, 4 * 15);
291         s->cpu->env.regs[15] = s->pm_regs[PSPR >> 2];
292 
293 #if 0
294         buffer = 0xe59ff000; /* ldr     pc, [pc, #0] */
295         cpu_physical_memory_write(0, &buffer, 4);
296         buffer = s->pm_regs[PSPR >> 2];
297         cpu_physical_memory_write(8, &buffer, 4);
298 #endif
299 
300         /* Suspend */
301         cpu_interrupt(current_cpu, CPU_INTERRUPT_HALT);
302 
303         goto message;
304 
305     default:
306     message:
307         printf("%s: machine entered %s mode\n", __func__,
308                pwrmode[value & 7]);
309     }
310 }
311 
312 static uint64_t pxa2xx_cppmnc_read(CPUARMState *env, const ARMCPRegInfo *ri)
313 {
314     PXA2xxState *s = (PXA2xxState *)ri->opaque;
315     return s->pmnc;
316 }
317 
318 static void pxa2xx_cppmnc_write(CPUARMState *env, const ARMCPRegInfo *ri,
319                                 uint64_t value)
320 {
321     PXA2xxState *s = (PXA2xxState *)ri->opaque;
322     s->pmnc = value;
323 }
324 
325 static uint64_t pxa2xx_cpccnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
326 {
327     PXA2xxState *s = (PXA2xxState *)ri->opaque;
328     if (s->pmnc & 1) {
329         return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
330     } else {
331         return 0;
332     }
333 }
334 
335 static const ARMCPRegInfo pxa_cp_reginfo[] = {
336     /* cp14 crm==1: perf registers */
337     { .name = "CPPMNC", .cp = 14, .crn = 0, .crm = 1, .opc1 = 0, .opc2 = 0,
338       .access = PL1_RW, .type = ARM_CP_IO,
339       .readfn = pxa2xx_cppmnc_read, .writefn = pxa2xx_cppmnc_write },
340     { .name = "CPCCNT", .cp = 14, .crn = 1, .crm = 1, .opc1 = 0, .opc2 = 0,
341       .access = PL1_RW, .type = ARM_CP_IO,
342       .readfn = pxa2xx_cpccnt_read, .writefn = arm_cp_write_ignore },
343     { .name = "CPINTEN", .cp = 14, .crn = 4, .crm = 1, .opc1 = 0, .opc2 = 0,
344       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
345     { .name = "CPFLAG", .cp = 14, .crn = 5, .crm = 1, .opc1 = 0, .opc2 = 0,
346       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
347     { .name = "CPEVTSEL", .cp = 14, .crn = 8, .crm = 1, .opc1 = 0, .opc2 = 0,
348       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
349     /* cp14 crm==2: performance count registers */
350     { .name = "CPPMN0", .cp = 14, .crn = 0, .crm = 2, .opc1 = 0, .opc2 = 0,
351       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
352     { .name = "CPPMN1", .cp = 14, .crn = 1, .crm = 2, .opc1 = 0, .opc2 = 0,
353       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
354     { .name = "CPPMN2", .cp = 14, .crn = 2, .crm = 2, .opc1 = 0, .opc2 = 0,
355       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
356     { .name = "CPPMN3", .cp = 14, .crn = 2, .crm = 3, .opc1 = 0, .opc2 = 0,
357       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
358     /* cp14 crn==6: CLKCFG */
359     { .name = "CLKCFG", .cp = 14, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
360       .access = PL1_RW, .type = ARM_CP_IO,
361       .readfn = pxa2xx_clkcfg_read, .writefn = pxa2xx_clkcfg_write },
362     /* cp14 crn==7: PWRMODE */
363     { .name = "PWRMODE", .cp = 14, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 0,
364       .access = PL1_RW, .type = ARM_CP_IO,
365       .readfn = arm_cp_read_zero, .writefn = pxa2xx_pwrmode_write },
366     REGINFO_SENTINEL
367 };
368 
369 static void pxa2xx_setup_cp14(PXA2xxState *s)
370 {
371     define_arm_cp_regs_with_opaque(s->cpu, pxa_cp_reginfo, s);
372 }
373 
374 #define MDCNFG		0x00	/* SDRAM Configuration register */
375 #define MDREFR		0x04	/* SDRAM Refresh Control register */
376 #define MSC0		0x08	/* Static Memory Control register 0 */
377 #define MSC1		0x0c	/* Static Memory Control register 1 */
378 #define MSC2		0x10	/* Static Memory Control register 2 */
379 #define MECR		0x14	/* Expansion Memory Bus Config register */
380 #define SXCNFG		0x1c	/* Synchronous Static Memory Config register */
381 #define MCMEM0		0x28	/* PC Card Memory Socket 0 Timing register */
382 #define MCMEM1		0x2c	/* PC Card Memory Socket 1 Timing register */
383 #define MCATT0		0x30	/* PC Card Attribute Socket 0 register */
384 #define MCATT1		0x34	/* PC Card Attribute Socket 1 register */
385 #define MCIO0		0x38	/* PC Card I/O Socket 0 Timing register */
386 #define MCIO1		0x3c	/* PC Card I/O Socket 1 Timing register */
387 #define MDMRS		0x40	/* SDRAM Mode Register Set Config register */
388 #define BOOT_DEF	0x44	/* Boot-time Default Configuration register */
389 #define ARB_CNTL	0x48	/* Arbiter Control register */
390 #define BSCNTR0		0x4c	/* Memory Buffer Strength Control register 0 */
391 #define BSCNTR1		0x50	/* Memory Buffer Strength Control register 1 */
392 #define LCDBSCNTR	0x54	/* LCD Buffer Strength Control register */
393 #define MDMRSLP		0x58	/* Low Power SDRAM Mode Set Config register */
394 #define BSCNTR2		0x5c	/* Memory Buffer Strength Control register 2 */
395 #define BSCNTR3		0x60	/* Memory Buffer Strength Control register 3 */
396 #define SA1110		0x64	/* SA-1110 Memory Compatibility register */
397 
398 static uint64_t pxa2xx_mm_read(void *opaque, hwaddr addr,
399                                unsigned size)
400 {
401     PXA2xxState *s = (PXA2xxState *) opaque;
402 
403     switch (addr) {
404     case MDCNFG ... SA1110:
405         if ((addr & 3) == 0)
406             return s->mm_regs[addr >> 2];
407 
408     default:
409         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
410         break;
411     }
412     return 0;
413 }
414 
415 static void pxa2xx_mm_write(void *opaque, hwaddr addr,
416                             uint64_t value, unsigned size)
417 {
418     PXA2xxState *s = (PXA2xxState *) opaque;
419 
420     switch (addr) {
421     case MDCNFG ... SA1110:
422         if ((addr & 3) == 0) {
423             s->mm_regs[addr >> 2] = value;
424             break;
425         }
426 
427     default:
428         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
429         break;
430     }
431 }
432 
433 static const MemoryRegionOps pxa2xx_mm_ops = {
434     .read = pxa2xx_mm_read,
435     .write = pxa2xx_mm_write,
436     .endianness = DEVICE_NATIVE_ENDIAN,
437 };
438 
439 static const VMStateDescription vmstate_pxa2xx_mm = {
440     .name = "pxa2xx_mm",
441     .version_id = 0,
442     .minimum_version_id = 0,
443     .fields = (VMStateField[]) {
444         VMSTATE_UINT32_ARRAY(mm_regs, PXA2xxState, 0x1a),
445         VMSTATE_END_OF_LIST()
446     }
447 };
448 
449 #define TYPE_PXA2XX_SSP "pxa2xx-ssp"
450 #define PXA2XX_SSP(obj) \
451     OBJECT_CHECK(PXA2xxSSPState, (obj), TYPE_PXA2XX_SSP)
452 
453 /* Synchronous Serial Ports */
454 typedef struct {
455     /*< private >*/
456     SysBusDevice parent_obj;
457     /*< public >*/
458 
459     MemoryRegion iomem;
460     qemu_irq irq;
461     uint32_t enable;
462     SSIBus *bus;
463 
464     uint32_t sscr[2];
465     uint32_t sspsp;
466     uint32_t ssto;
467     uint32_t ssitr;
468     uint32_t sssr;
469     uint8_t sstsa;
470     uint8_t ssrsa;
471     uint8_t ssacd;
472 
473     uint32_t rx_fifo[16];
474     uint32_t rx_level;
475     uint32_t rx_start;
476 } PXA2xxSSPState;
477 
478 static bool pxa2xx_ssp_vmstate_validate(void *opaque, int version_id)
479 {
480     PXA2xxSSPState *s = opaque;
481 
482     return s->rx_start < sizeof(s->rx_fifo);
483 }
484 
485 static const VMStateDescription vmstate_pxa2xx_ssp = {
486     .name = "pxa2xx-ssp",
487     .version_id = 1,
488     .minimum_version_id = 1,
489     .fields = (VMStateField[]) {
490         VMSTATE_UINT32(enable, PXA2xxSSPState),
491         VMSTATE_UINT32_ARRAY(sscr, PXA2xxSSPState, 2),
492         VMSTATE_UINT32(sspsp, PXA2xxSSPState),
493         VMSTATE_UINT32(ssto, PXA2xxSSPState),
494         VMSTATE_UINT32(ssitr, PXA2xxSSPState),
495         VMSTATE_UINT32(sssr, PXA2xxSSPState),
496         VMSTATE_UINT8(sstsa, PXA2xxSSPState),
497         VMSTATE_UINT8(ssrsa, PXA2xxSSPState),
498         VMSTATE_UINT8(ssacd, PXA2xxSSPState),
499         VMSTATE_UINT32(rx_level, PXA2xxSSPState),
500         VMSTATE_UINT32(rx_start, PXA2xxSSPState),
501         VMSTATE_VALIDATE("fifo is 16 bytes", pxa2xx_ssp_vmstate_validate),
502         VMSTATE_UINT32_ARRAY(rx_fifo, PXA2xxSSPState, 16),
503         VMSTATE_END_OF_LIST()
504     }
505 };
506 
507 #define SSCR0	0x00	/* SSP Control register 0 */
508 #define SSCR1	0x04	/* SSP Control register 1 */
509 #define SSSR	0x08	/* SSP Status register */
510 #define SSITR	0x0c	/* SSP Interrupt Test register */
511 #define SSDR	0x10	/* SSP Data register */
512 #define SSTO	0x28	/* SSP Time-Out register */
513 #define SSPSP	0x2c	/* SSP Programmable Serial Protocol register */
514 #define SSTSA	0x30	/* SSP TX Time Slot Active register */
515 #define SSRSA	0x34	/* SSP RX Time Slot Active register */
516 #define SSTSS	0x38	/* SSP Time Slot Status register */
517 #define SSACD	0x3c	/* SSP Audio Clock Divider register */
518 
519 /* Bitfields for above registers */
520 #define SSCR0_SPI(x)	(((x) & 0x30) == 0x00)
521 #define SSCR0_SSP(x)	(((x) & 0x30) == 0x10)
522 #define SSCR0_UWIRE(x)	(((x) & 0x30) == 0x20)
523 #define SSCR0_PSP(x)	(((x) & 0x30) == 0x30)
524 #define SSCR0_SSE	(1 << 7)
525 #define SSCR0_RIM	(1 << 22)
526 #define SSCR0_TIM	(1 << 23)
527 #define SSCR0_MOD       (1U << 31)
528 #define SSCR0_DSS(x)	(((((x) >> 16) & 0x10) | ((x) & 0xf)) + 1)
529 #define SSCR1_RIE	(1 << 0)
530 #define SSCR1_TIE	(1 << 1)
531 #define SSCR1_LBM	(1 << 2)
532 #define SSCR1_MWDS	(1 << 5)
533 #define SSCR1_TFT(x)	((((x) >> 6) & 0xf) + 1)
534 #define SSCR1_RFT(x)	((((x) >> 10) & 0xf) + 1)
535 #define SSCR1_EFWR	(1 << 14)
536 #define SSCR1_PINTE	(1 << 18)
537 #define SSCR1_TINTE	(1 << 19)
538 #define SSCR1_RSRE	(1 << 20)
539 #define SSCR1_TSRE	(1 << 21)
540 #define SSCR1_EBCEI	(1 << 29)
541 #define SSITR_INT	(7 << 5)
542 #define SSSR_TNF	(1 << 2)
543 #define SSSR_RNE	(1 << 3)
544 #define SSSR_TFS	(1 << 5)
545 #define SSSR_RFS	(1 << 6)
546 #define SSSR_ROR	(1 << 7)
547 #define SSSR_PINT	(1 << 18)
548 #define SSSR_TINT	(1 << 19)
549 #define SSSR_EOC	(1 << 20)
550 #define SSSR_TUR	(1 << 21)
551 #define SSSR_BCE	(1 << 23)
552 #define SSSR_RW		0x00bc0080
553 
554 static void pxa2xx_ssp_int_update(PXA2xxSSPState *s)
555 {
556     int level = 0;
557 
558     level |= s->ssitr & SSITR_INT;
559     level |= (s->sssr & SSSR_BCE)  &&  (s->sscr[1] & SSCR1_EBCEI);
560     level |= (s->sssr & SSSR_TUR)  && !(s->sscr[0] & SSCR0_TIM);
561     level |= (s->sssr & SSSR_EOC)  &&  (s->sssr & (SSSR_TINT | SSSR_PINT));
562     level |= (s->sssr & SSSR_TINT) &&  (s->sscr[1] & SSCR1_TINTE);
563     level |= (s->sssr & SSSR_PINT) &&  (s->sscr[1] & SSCR1_PINTE);
564     level |= (s->sssr & SSSR_ROR)  && !(s->sscr[0] & SSCR0_RIM);
565     level |= (s->sssr & SSSR_RFS)  &&  (s->sscr[1] & SSCR1_RIE);
566     level |= (s->sssr & SSSR_TFS)  &&  (s->sscr[1] & SSCR1_TIE);
567     qemu_set_irq(s->irq, !!level);
568 }
569 
570 static void pxa2xx_ssp_fifo_update(PXA2xxSSPState *s)
571 {
572     s->sssr &= ~(0xf << 12);	/* Clear RFL */
573     s->sssr &= ~(0xf << 8);	/* Clear TFL */
574     s->sssr &= ~SSSR_TFS;
575     s->sssr &= ~SSSR_TNF;
576     if (s->enable) {
577         s->sssr |= ((s->rx_level - 1) & 0xf) << 12;
578         if (s->rx_level >= SSCR1_RFT(s->sscr[1]))
579             s->sssr |= SSSR_RFS;
580         else
581             s->sssr &= ~SSSR_RFS;
582         if (s->rx_level)
583             s->sssr |= SSSR_RNE;
584         else
585             s->sssr &= ~SSSR_RNE;
586         /* TX FIFO is never filled, so it is always in underrun
587            condition if SSP is enabled */
588         s->sssr |= SSSR_TFS;
589         s->sssr |= SSSR_TNF;
590     }
591 
592     pxa2xx_ssp_int_update(s);
593 }
594 
595 static uint64_t pxa2xx_ssp_read(void *opaque, hwaddr addr,
596                                 unsigned size)
597 {
598     PXA2xxSSPState *s = (PXA2xxSSPState *) opaque;
599     uint32_t retval;
600 
601     switch (addr) {
602     case SSCR0:
603         return s->sscr[0];
604     case SSCR1:
605         return s->sscr[1];
606     case SSPSP:
607         return s->sspsp;
608     case SSTO:
609         return s->ssto;
610     case SSITR:
611         return s->ssitr;
612     case SSSR:
613         return s->sssr | s->ssitr;
614     case SSDR:
615         if (!s->enable)
616             return 0xffffffff;
617         if (s->rx_level < 1) {
618             printf("%s: SSP Rx Underrun\n", __FUNCTION__);
619             return 0xffffffff;
620         }
621         s->rx_level --;
622         retval = s->rx_fifo[s->rx_start ++];
623         s->rx_start &= 0xf;
624         pxa2xx_ssp_fifo_update(s);
625         return retval;
626     case SSTSA:
627         return s->sstsa;
628     case SSRSA:
629         return s->ssrsa;
630     case SSTSS:
631         return 0;
632     case SSACD:
633         return s->ssacd;
634     default:
635         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
636         break;
637     }
638     return 0;
639 }
640 
641 static void pxa2xx_ssp_write(void *opaque, hwaddr addr,
642                              uint64_t value64, unsigned size)
643 {
644     PXA2xxSSPState *s = (PXA2xxSSPState *) opaque;
645     uint32_t value = value64;
646 
647     switch (addr) {
648     case SSCR0:
649         s->sscr[0] = value & 0xc7ffffff;
650         s->enable = value & SSCR0_SSE;
651         if (value & SSCR0_MOD)
652             printf("%s: Attempt to use network mode\n", __FUNCTION__);
653         if (s->enable && SSCR0_DSS(value) < 4)
654             printf("%s: Wrong data size: %i bits\n", __FUNCTION__,
655                             SSCR0_DSS(value));
656         if (!(value & SSCR0_SSE)) {
657             s->sssr = 0;
658             s->ssitr = 0;
659             s->rx_level = 0;
660         }
661         pxa2xx_ssp_fifo_update(s);
662         break;
663 
664     case SSCR1:
665         s->sscr[1] = value;
666         if (value & (SSCR1_LBM | SSCR1_EFWR))
667             printf("%s: Attempt to use SSP test mode\n", __FUNCTION__);
668         pxa2xx_ssp_fifo_update(s);
669         break;
670 
671     case SSPSP:
672         s->sspsp = value;
673         break;
674 
675     case SSTO:
676         s->ssto = value;
677         break;
678 
679     case SSITR:
680         s->ssitr = value & SSITR_INT;
681         pxa2xx_ssp_int_update(s);
682         break;
683 
684     case SSSR:
685         s->sssr &= ~(value & SSSR_RW);
686         pxa2xx_ssp_int_update(s);
687         break;
688 
689     case SSDR:
690         if (SSCR0_UWIRE(s->sscr[0])) {
691             if (s->sscr[1] & SSCR1_MWDS)
692                 value &= 0xffff;
693             else
694                 value &= 0xff;
695         } else
696             /* Note how 32bits overflow does no harm here */
697             value &= (1 << SSCR0_DSS(s->sscr[0])) - 1;
698 
699         /* Data goes from here to the Tx FIFO and is shifted out from
700          * there directly to the slave, no need to buffer it.
701          */
702         if (s->enable) {
703             uint32_t readval;
704             readval = ssi_transfer(s->bus, value);
705             if (s->rx_level < 0x10) {
706                 s->rx_fifo[(s->rx_start + s->rx_level ++) & 0xf] = readval;
707             } else {
708                 s->sssr |= SSSR_ROR;
709             }
710         }
711         pxa2xx_ssp_fifo_update(s);
712         break;
713 
714     case SSTSA:
715         s->sstsa = value;
716         break;
717 
718     case SSRSA:
719         s->ssrsa = value;
720         break;
721 
722     case SSACD:
723         s->ssacd = value;
724         break;
725 
726     default:
727         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
728         break;
729     }
730 }
731 
732 static const MemoryRegionOps pxa2xx_ssp_ops = {
733     .read = pxa2xx_ssp_read,
734     .write = pxa2xx_ssp_write,
735     .endianness = DEVICE_NATIVE_ENDIAN,
736 };
737 
738 static void pxa2xx_ssp_reset(DeviceState *d)
739 {
740     PXA2xxSSPState *s = PXA2XX_SSP(d);
741 
742     s->enable = 0;
743     s->sscr[0] = s->sscr[1] = 0;
744     s->sspsp = 0;
745     s->ssto = 0;
746     s->ssitr = 0;
747     s->sssr = 0;
748     s->sstsa = 0;
749     s->ssrsa = 0;
750     s->ssacd = 0;
751     s->rx_start = s->rx_level = 0;
752 }
753 
754 static int pxa2xx_ssp_init(SysBusDevice *sbd)
755 {
756     DeviceState *dev = DEVICE(sbd);
757     PXA2xxSSPState *s = PXA2XX_SSP(dev);
758 
759     sysbus_init_irq(sbd, &s->irq);
760 
761     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_ssp_ops, s,
762                           "pxa2xx-ssp", 0x1000);
763     sysbus_init_mmio(sbd, &s->iomem);
764 
765     s->bus = ssi_create_bus(dev, "ssi");
766     return 0;
767 }
768 
769 /* Real-Time Clock */
770 #define RCNR		0x00	/* RTC Counter register */
771 #define RTAR		0x04	/* RTC Alarm register */
772 #define RTSR		0x08	/* RTC Status register */
773 #define RTTR		0x0c	/* RTC Timer Trim register */
774 #define RDCR		0x10	/* RTC Day Counter register */
775 #define RYCR		0x14	/* RTC Year Counter register */
776 #define RDAR1		0x18	/* RTC Wristwatch Day Alarm register 1 */
777 #define RYAR1		0x1c	/* RTC Wristwatch Year Alarm register 1 */
778 #define RDAR2		0x20	/* RTC Wristwatch Day Alarm register 2 */
779 #define RYAR2		0x24	/* RTC Wristwatch Year Alarm register 2 */
780 #define SWCR		0x28	/* RTC Stopwatch Counter register */
781 #define SWAR1		0x2c	/* RTC Stopwatch Alarm register 1 */
782 #define SWAR2		0x30	/* RTC Stopwatch Alarm register 2 */
783 #define RTCPICR		0x34	/* RTC Periodic Interrupt Counter register */
784 #define PIAR		0x38	/* RTC Periodic Interrupt Alarm register */
785 
786 #define TYPE_PXA2XX_RTC "pxa2xx_rtc"
787 #define PXA2XX_RTC(obj) \
788     OBJECT_CHECK(PXA2xxRTCState, (obj), TYPE_PXA2XX_RTC)
789 
790 typedef struct {
791     /*< private >*/
792     SysBusDevice parent_obj;
793     /*< public >*/
794 
795     MemoryRegion iomem;
796     uint32_t rttr;
797     uint32_t rtsr;
798     uint32_t rtar;
799     uint32_t rdar1;
800     uint32_t rdar2;
801     uint32_t ryar1;
802     uint32_t ryar2;
803     uint32_t swar1;
804     uint32_t swar2;
805     uint32_t piar;
806     uint32_t last_rcnr;
807     uint32_t last_rdcr;
808     uint32_t last_rycr;
809     uint32_t last_swcr;
810     uint32_t last_rtcpicr;
811     int64_t last_hz;
812     int64_t last_sw;
813     int64_t last_pi;
814     QEMUTimer *rtc_hz;
815     QEMUTimer *rtc_rdal1;
816     QEMUTimer *rtc_rdal2;
817     QEMUTimer *rtc_swal1;
818     QEMUTimer *rtc_swal2;
819     QEMUTimer *rtc_pi;
820     qemu_irq rtc_irq;
821 } PXA2xxRTCState;
822 
823 static inline void pxa2xx_rtc_int_update(PXA2xxRTCState *s)
824 {
825     qemu_set_irq(s->rtc_irq, !!(s->rtsr & 0x2553));
826 }
827 
828 static void pxa2xx_rtc_hzupdate(PXA2xxRTCState *s)
829 {
830     int64_t rt = qemu_clock_get_ms(rtc_clock);
831     s->last_rcnr += ((rt - s->last_hz) << 15) /
832             (1000 * ((s->rttr & 0xffff) + 1));
833     s->last_rdcr += ((rt - s->last_hz) << 15) /
834             (1000 * ((s->rttr & 0xffff) + 1));
835     s->last_hz = rt;
836 }
837 
838 static void pxa2xx_rtc_swupdate(PXA2xxRTCState *s)
839 {
840     int64_t rt = qemu_clock_get_ms(rtc_clock);
841     if (s->rtsr & (1 << 12))
842         s->last_swcr += (rt - s->last_sw) / 10;
843     s->last_sw = rt;
844 }
845 
846 static void pxa2xx_rtc_piupdate(PXA2xxRTCState *s)
847 {
848     int64_t rt = qemu_clock_get_ms(rtc_clock);
849     if (s->rtsr & (1 << 15))
850         s->last_swcr += rt - s->last_pi;
851     s->last_pi = rt;
852 }
853 
854 static inline void pxa2xx_rtc_alarm_update(PXA2xxRTCState *s,
855                 uint32_t rtsr)
856 {
857     if ((rtsr & (1 << 2)) && !(rtsr & (1 << 0)))
858         timer_mod(s->rtc_hz, s->last_hz +
859                 (((s->rtar - s->last_rcnr) * 1000 *
860                   ((s->rttr & 0xffff) + 1)) >> 15));
861     else
862         timer_del(s->rtc_hz);
863 
864     if ((rtsr & (1 << 5)) && !(rtsr & (1 << 4)))
865         timer_mod(s->rtc_rdal1, s->last_hz +
866                 (((s->rdar1 - s->last_rdcr) * 1000 *
867                   ((s->rttr & 0xffff) + 1)) >> 15)); /* TODO: fixup */
868     else
869         timer_del(s->rtc_rdal1);
870 
871     if ((rtsr & (1 << 7)) && !(rtsr & (1 << 6)))
872         timer_mod(s->rtc_rdal2, s->last_hz +
873                 (((s->rdar2 - s->last_rdcr) * 1000 *
874                   ((s->rttr & 0xffff) + 1)) >> 15)); /* TODO: fixup */
875     else
876         timer_del(s->rtc_rdal2);
877 
878     if ((rtsr & 0x1200) == 0x1200 && !(rtsr & (1 << 8)))
879         timer_mod(s->rtc_swal1, s->last_sw +
880                         (s->swar1 - s->last_swcr) * 10); /* TODO: fixup */
881     else
882         timer_del(s->rtc_swal1);
883 
884     if ((rtsr & 0x1800) == 0x1800 && !(rtsr & (1 << 10)))
885         timer_mod(s->rtc_swal2, s->last_sw +
886                         (s->swar2 - s->last_swcr) * 10); /* TODO: fixup */
887     else
888         timer_del(s->rtc_swal2);
889 
890     if ((rtsr & 0xc000) == 0xc000 && !(rtsr & (1 << 13)))
891         timer_mod(s->rtc_pi, s->last_pi +
892                         (s->piar & 0xffff) - s->last_rtcpicr);
893     else
894         timer_del(s->rtc_pi);
895 }
896 
897 static inline void pxa2xx_rtc_hz_tick(void *opaque)
898 {
899     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
900     s->rtsr |= (1 << 0);
901     pxa2xx_rtc_alarm_update(s, s->rtsr);
902     pxa2xx_rtc_int_update(s);
903 }
904 
905 static inline void pxa2xx_rtc_rdal1_tick(void *opaque)
906 {
907     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
908     s->rtsr |= (1 << 4);
909     pxa2xx_rtc_alarm_update(s, s->rtsr);
910     pxa2xx_rtc_int_update(s);
911 }
912 
913 static inline void pxa2xx_rtc_rdal2_tick(void *opaque)
914 {
915     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
916     s->rtsr |= (1 << 6);
917     pxa2xx_rtc_alarm_update(s, s->rtsr);
918     pxa2xx_rtc_int_update(s);
919 }
920 
921 static inline void pxa2xx_rtc_swal1_tick(void *opaque)
922 {
923     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
924     s->rtsr |= (1 << 8);
925     pxa2xx_rtc_alarm_update(s, s->rtsr);
926     pxa2xx_rtc_int_update(s);
927 }
928 
929 static inline void pxa2xx_rtc_swal2_tick(void *opaque)
930 {
931     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
932     s->rtsr |= (1 << 10);
933     pxa2xx_rtc_alarm_update(s, s->rtsr);
934     pxa2xx_rtc_int_update(s);
935 }
936 
937 static inline void pxa2xx_rtc_pi_tick(void *opaque)
938 {
939     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
940     s->rtsr |= (1 << 13);
941     pxa2xx_rtc_piupdate(s);
942     s->last_rtcpicr = 0;
943     pxa2xx_rtc_alarm_update(s, s->rtsr);
944     pxa2xx_rtc_int_update(s);
945 }
946 
947 static uint64_t pxa2xx_rtc_read(void *opaque, hwaddr addr,
948                                 unsigned size)
949 {
950     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
951 
952     switch (addr) {
953     case RTTR:
954         return s->rttr;
955     case RTSR:
956         return s->rtsr;
957     case RTAR:
958         return s->rtar;
959     case RDAR1:
960         return s->rdar1;
961     case RDAR2:
962         return s->rdar2;
963     case RYAR1:
964         return s->ryar1;
965     case RYAR2:
966         return s->ryar2;
967     case SWAR1:
968         return s->swar1;
969     case SWAR2:
970         return s->swar2;
971     case PIAR:
972         return s->piar;
973     case RCNR:
974         return s->last_rcnr +
975             ((qemu_clock_get_ms(rtc_clock) - s->last_hz) << 15) /
976             (1000 * ((s->rttr & 0xffff) + 1));
977     case RDCR:
978         return s->last_rdcr +
979             ((qemu_clock_get_ms(rtc_clock) - s->last_hz) << 15) /
980             (1000 * ((s->rttr & 0xffff) + 1));
981     case RYCR:
982         return s->last_rycr;
983     case SWCR:
984         if (s->rtsr & (1 << 12))
985             return s->last_swcr +
986                 (qemu_clock_get_ms(rtc_clock) - s->last_sw) / 10;
987         else
988             return s->last_swcr;
989     default:
990         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
991         break;
992     }
993     return 0;
994 }
995 
996 static void pxa2xx_rtc_write(void *opaque, hwaddr addr,
997                              uint64_t value64, unsigned size)
998 {
999     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
1000     uint32_t value = value64;
1001 
1002     switch (addr) {
1003     case RTTR:
1004         if (!(s->rttr & (1U << 31))) {
1005             pxa2xx_rtc_hzupdate(s);
1006             s->rttr = value;
1007             pxa2xx_rtc_alarm_update(s, s->rtsr);
1008         }
1009         break;
1010 
1011     case RTSR:
1012         if ((s->rtsr ^ value) & (1 << 15))
1013             pxa2xx_rtc_piupdate(s);
1014 
1015         if ((s->rtsr ^ value) & (1 << 12))
1016             pxa2xx_rtc_swupdate(s);
1017 
1018         if (((s->rtsr ^ value) & 0x4aac) | (value & ~0xdaac))
1019             pxa2xx_rtc_alarm_update(s, value);
1020 
1021         s->rtsr = (value & 0xdaac) | (s->rtsr & ~(value & ~0xdaac));
1022         pxa2xx_rtc_int_update(s);
1023         break;
1024 
1025     case RTAR:
1026         s->rtar = value;
1027         pxa2xx_rtc_alarm_update(s, s->rtsr);
1028         break;
1029 
1030     case RDAR1:
1031         s->rdar1 = value;
1032         pxa2xx_rtc_alarm_update(s, s->rtsr);
1033         break;
1034 
1035     case RDAR2:
1036         s->rdar2 = value;
1037         pxa2xx_rtc_alarm_update(s, s->rtsr);
1038         break;
1039 
1040     case RYAR1:
1041         s->ryar1 = value;
1042         pxa2xx_rtc_alarm_update(s, s->rtsr);
1043         break;
1044 
1045     case RYAR2:
1046         s->ryar2 = value;
1047         pxa2xx_rtc_alarm_update(s, s->rtsr);
1048         break;
1049 
1050     case SWAR1:
1051         pxa2xx_rtc_swupdate(s);
1052         s->swar1 = value;
1053         s->last_swcr = 0;
1054         pxa2xx_rtc_alarm_update(s, s->rtsr);
1055         break;
1056 
1057     case SWAR2:
1058         s->swar2 = value;
1059         pxa2xx_rtc_alarm_update(s, s->rtsr);
1060         break;
1061 
1062     case PIAR:
1063         s->piar = value;
1064         pxa2xx_rtc_alarm_update(s, s->rtsr);
1065         break;
1066 
1067     case RCNR:
1068         pxa2xx_rtc_hzupdate(s);
1069         s->last_rcnr = value;
1070         pxa2xx_rtc_alarm_update(s, s->rtsr);
1071         break;
1072 
1073     case RDCR:
1074         pxa2xx_rtc_hzupdate(s);
1075         s->last_rdcr = value;
1076         pxa2xx_rtc_alarm_update(s, s->rtsr);
1077         break;
1078 
1079     case RYCR:
1080         s->last_rycr = value;
1081         break;
1082 
1083     case SWCR:
1084         pxa2xx_rtc_swupdate(s);
1085         s->last_swcr = value;
1086         pxa2xx_rtc_alarm_update(s, s->rtsr);
1087         break;
1088 
1089     case RTCPICR:
1090         pxa2xx_rtc_piupdate(s);
1091         s->last_rtcpicr = value & 0xffff;
1092         pxa2xx_rtc_alarm_update(s, s->rtsr);
1093         break;
1094 
1095     default:
1096         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1097     }
1098 }
1099 
1100 static const MemoryRegionOps pxa2xx_rtc_ops = {
1101     .read = pxa2xx_rtc_read,
1102     .write = pxa2xx_rtc_write,
1103     .endianness = DEVICE_NATIVE_ENDIAN,
1104 };
1105 
1106 static int pxa2xx_rtc_init(SysBusDevice *dev)
1107 {
1108     PXA2xxRTCState *s = PXA2XX_RTC(dev);
1109     struct tm tm;
1110     int wom;
1111 
1112     s->rttr = 0x7fff;
1113     s->rtsr = 0;
1114 
1115     qemu_get_timedate(&tm, 0);
1116     wom = ((tm.tm_mday - 1) / 7) + 1;
1117 
1118     s->last_rcnr = (uint32_t) mktimegm(&tm);
1119     s->last_rdcr = (wom << 20) | ((tm.tm_wday + 1) << 17) |
1120             (tm.tm_hour << 12) | (tm.tm_min << 6) | tm.tm_sec;
1121     s->last_rycr = ((tm.tm_year + 1900) << 9) |
1122             ((tm.tm_mon + 1) << 5) | tm.tm_mday;
1123     s->last_swcr = (tm.tm_hour << 19) |
1124             (tm.tm_min << 13) | (tm.tm_sec << 7);
1125     s->last_rtcpicr = 0;
1126     s->last_hz = s->last_sw = s->last_pi = qemu_clock_get_ms(rtc_clock);
1127 
1128     s->rtc_hz    = timer_new_ms(rtc_clock, pxa2xx_rtc_hz_tick,    s);
1129     s->rtc_rdal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal1_tick, s);
1130     s->rtc_rdal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal2_tick, s);
1131     s->rtc_swal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal1_tick, s);
1132     s->rtc_swal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal2_tick, s);
1133     s->rtc_pi    = timer_new_ms(rtc_clock, pxa2xx_rtc_pi_tick,    s);
1134 
1135     sysbus_init_irq(dev, &s->rtc_irq);
1136 
1137     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_rtc_ops, s,
1138                           "pxa2xx-rtc", 0x10000);
1139     sysbus_init_mmio(dev, &s->iomem);
1140 
1141     return 0;
1142 }
1143 
1144 static void pxa2xx_rtc_pre_save(void *opaque)
1145 {
1146     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
1147 
1148     pxa2xx_rtc_hzupdate(s);
1149     pxa2xx_rtc_piupdate(s);
1150     pxa2xx_rtc_swupdate(s);
1151 }
1152 
1153 static int pxa2xx_rtc_post_load(void *opaque, int version_id)
1154 {
1155     PXA2xxRTCState *s = (PXA2xxRTCState *) opaque;
1156 
1157     pxa2xx_rtc_alarm_update(s, s->rtsr);
1158 
1159     return 0;
1160 }
1161 
1162 static const VMStateDescription vmstate_pxa2xx_rtc_regs = {
1163     .name = "pxa2xx_rtc",
1164     .version_id = 0,
1165     .minimum_version_id = 0,
1166     .pre_save = pxa2xx_rtc_pre_save,
1167     .post_load = pxa2xx_rtc_post_load,
1168     .fields = (VMStateField[]) {
1169         VMSTATE_UINT32(rttr, PXA2xxRTCState),
1170         VMSTATE_UINT32(rtsr, PXA2xxRTCState),
1171         VMSTATE_UINT32(rtar, PXA2xxRTCState),
1172         VMSTATE_UINT32(rdar1, PXA2xxRTCState),
1173         VMSTATE_UINT32(rdar2, PXA2xxRTCState),
1174         VMSTATE_UINT32(ryar1, PXA2xxRTCState),
1175         VMSTATE_UINT32(ryar2, PXA2xxRTCState),
1176         VMSTATE_UINT32(swar1, PXA2xxRTCState),
1177         VMSTATE_UINT32(swar2, PXA2xxRTCState),
1178         VMSTATE_UINT32(piar, PXA2xxRTCState),
1179         VMSTATE_UINT32(last_rcnr, PXA2xxRTCState),
1180         VMSTATE_UINT32(last_rdcr, PXA2xxRTCState),
1181         VMSTATE_UINT32(last_rycr, PXA2xxRTCState),
1182         VMSTATE_UINT32(last_swcr, PXA2xxRTCState),
1183         VMSTATE_UINT32(last_rtcpicr, PXA2xxRTCState),
1184         VMSTATE_INT64(last_hz, PXA2xxRTCState),
1185         VMSTATE_INT64(last_sw, PXA2xxRTCState),
1186         VMSTATE_INT64(last_pi, PXA2xxRTCState),
1187         VMSTATE_END_OF_LIST(),
1188     },
1189 };
1190 
1191 static void pxa2xx_rtc_sysbus_class_init(ObjectClass *klass, void *data)
1192 {
1193     DeviceClass *dc = DEVICE_CLASS(klass);
1194     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
1195 
1196     k->init = pxa2xx_rtc_init;
1197     dc->desc = "PXA2xx RTC Controller";
1198     dc->vmsd = &vmstate_pxa2xx_rtc_regs;
1199 }
1200 
1201 static const TypeInfo pxa2xx_rtc_sysbus_info = {
1202     .name          = TYPE_PXA2XX_RTC,
1203     .parent        = TYPE_SYS_BUS_DEVICE,
1204     .instance_size = sizeof(PXA2xxRTCState),
1205     .class_init    = pxa2xx_rtc_sysbus_class_init,
1206 };
1207 
1208 /* I2C Interface */
1209 
1210 #define TYPE_PXA2XX_I2C_SLAVE "pxa2xx-i2c-slave"
1211 #define PXA2XX_I2C_SLAVE(obj) \
1212     OBJECT_CHECK(PXA2xxI2CSlaveState, (obj), TYPE_PXA2XX_I2C_SLAVE)
1213 
1214 typedef struct PXA2xxI2CSlaveState {
1215     I2CSlave parent_obj;
1216 
1217     PXA2xxI2CState *host;
1218 } PXA2xxI2CSlaveState;
1219 
1220 #define TYPE_PXA2XX_I2C "pxa2xx_i2c"
1221 #define PXA2XX_I2C(obj) \
1222     OBJECT_CHECK(PXA2xxI2CState, (obj), TYPE_PXA2XX_I2C)
1223 
1224 struct PXA2xxI2CState {
1225     /*< private >*/
1226     SysBusDevice parent_obj;
1227     /*< public >*/
1228 
1229     MemoryRegion iomem;
1230     PXA2xxI2CSlaveState *slave;
1231     I2CBus *bus;
1232     qemu_irq irq;
1233     uint32_t offset;
1234     uint32_t region_size;
1235 
1236     uint16_t control;
1237     uint16_t status;
1238     uint8_t ibmr;
1239     uint8_t data;
1240 };
1241 
1242 #define IBMR	0x80	/* I2C Bus Monitor register */
1243 #define IDBR	0x88	/* I2C Data Buffer register */
1244 #define ICR	0x90	/* I2C Control register */
1245 #define ISR	0x98	/* I2C Status register */
1246 #define ISAR	0xa0	/* I2C Slave Address register */
1247 
1248 static void pxa2xx_i2c_update(PXA2xxI2CState *s)
1249 {
1250     uint16_t level = 0;
1251     level |= s->status & s->control & (1 << 10);		/* BED */
1252     level |= (s->status & (1 << 7)) && (s->control & (1 << 9));	/* IRF */
1253     level |= (s->status & (1 << 6)) && (s->control & (1 << 8));	/* ITE */
1254     level |= s->status & (1 << 9);				/* SAD */
1255     qemu_set_irq(s->irq, !!level);
1256 }
1257 
1258 /* These are only stubs now.  */
1259 static void pxa2xx_i2c_event(I2CSlave *i2c, enum i2c_event event)
1260 {
1261     PXA2xxI2CSlaveState *slave = PXA2XX_I2C_SLAVE(i2c);
1262     PXA2xxI2CState *s = slave->host;
1263 
1264     switch (event) {
1265     case I2C_START_SEND:
1266         s->status |= (1 << 9);				/* set SAD */
1267         s->status &= ~(1 << 0);				/* clear RWM */
1268         break;
1269     case I2C_START_RECV:
1270         s->status |= (1 << 9);				/* set SAD */
1271         s->status |= 1 << 0;				/* set RWM */
1272         break;
1273     case I2C_FINISH:
1274         s->status |= (1 << 4);				/* set SSD */
1275         break;
1276     case I2C_NACK:
1277         s->status |= 1 << 1;				/* set ACKNAK */
1278         break;
1279     }
1280     pxa2xx_i2c_update(s);
1281 }
1282 
1283 static int pxa2xx_i2c_rx(I2CSlave *i2c)
1284 {
1285     PXA2xxI2CSlaveState *slave = PXA2XX_I2C_SLAVE(i2c);
1286     PXA2xxI2CState *s = slave->host;
1287 
1288     if ((s->control & (1 << 14)) || !(s->control & (1 << 6))) {
1289         return 0;
1290     }
1291 
1292     if (s->status & (1 << 0)) {			/* RWM */
1293         s->status |= 1 << 6;			/* set ITE */
1294     }
1295     pxa2xx_i2c_update(s);
1296 
1297     return s->data;
1298 }
1299 
1300 static int pxa2xx_i2c_tx(I2CSlave *i2c, uint8_t data)
1301 {
1302     PXA2xxI2CSlaveState *slave = PXA2XX_I2C_SLAVE(i2c);
1303     PXA2xxI2CState *s = slave->host;
1304 
1305     if ((s->control & (1 << 14)) || !(s->control & (1 << 6))) {
1306         return 1;
1307     }
1308 
1309     if (!(s->status & (1 << 0))) {		/* RWM */
1310         s->status |= 1 << 7;			/* set IRF */
1311         s->data = data;
1312     }
1313     pxa2xx_i2c_update(s);
1314 
1315     return 1;
1316 }
1317 
1318 static uint64_t pxa2xx_i2c_read(void *opaque, hwaddr addr,
1319                                 unsigned size)
1320 {
1321     PXA2xxI2CState *s = (PXA2xxI2CState *) opaque;
1322     I2CSlave *slave;
1323 
1324     addr -= s->offset;
1325     switch (addr) {
1326     case ICR:
1327         return s->control;
1328     case ISR:
1329         return s->status | (i2c_bus_busy(s->bus) << 2);
1330     case ISAR:
1331         slave = I2C_SLAVE(s->slave);
1332         return slave->address;
1333     case IDBR:
1334         return s->data;
1335     case IBMR:
1336         if (s->status & (1 << 2))
1337             s->ibmr ^= 3;	/* Fake SCL and SDA pin changes */
1338         else
1339             s->ibmr = 0;
1340         return s->ibmr;
1341     default:
1342         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1343         break;
1344     }
1345     return 0;
1346 }
1347 
1348 static void pxa2xx_i2c_write(void *opaque, hwaddr addr,
1349                              uint64_t value64, unsigned size)
1350 {
1351     PXA2xxI2CState *s = (PXA2xxI2CState *) opaque;
1352     uint32_t value = value64;
1353     int ack;
1354 
1355     addr -= s->offset;
1356     switch (addr) {
1357     case ICR:
1358         s->control = value & 0xfff7;
1359         if ((value & (1 << 3)) && (value & (1 << 6))) {	/* TB and IUE */
1360             /* TODO: slave mode */
1361             if (value & (1 << 0)) {			/* START condition */
1362                 if (s->data & 1)
1363                     s->status |= 1 << 0;		/* set RWM */
1364                 else
1365                     s->status &= ~(1 << 0);		/* clear RWM */
1366                 ack = !i2c_start_transfer(s->bus, s->data >> 1, s->data & 1);
1367             } else {
1368                 if (s->status & (1 << 0)) {		/* RWM */
1369                     s->data = i2c_recv(s->bus);
1370                     if (value & (1 << 2))		/* ACKNAK */
1371                         i2c_nack(s->bus);
1372                     ack = 1;
1373                 } else
1374                     ack = !i2c_send(s->bus, s->data);
1375             }
1376 
1377             if (value & (1 << 1))			/* STOP condition */
1378                 i2c_end_transfer(s->bus);
1379 
1380             if (ack) {
1381                 if (value & (1 << 0))			/* START condition */
1382                     s->status |= 1 << 6;		/* set ITE */
1383                 else
1384                     if (s->status & (1 << 0))		/* RWM */
1385                         s->status |= 1 << 7;		/* set IRF */
1386                     else
1387                         s->status |= 1 << 6;		/* set ITE */
1388                 s->status &= ~(1 << 1);			/* clear ACKNAK */
1389             } else {
1390                 s->status |= 1 << 6;			/* set ITE */
1391                 s->status |= 1 << 10;			/* set BED */
1392                 s->status |= 1 << 1;			/* set ACKNAK */
1393             }
1394         }
1395         if (!(value & (1 << 3)) && (value & (1 << 6)))	/* !TB and IUE */
1396             if (value & (1 << 4))			/* MA */
1397                 i2c_end_transfer(s->bus);
1398         pxa2xx_i2c_update(s);
1399         break;
1400 
1401     case ISR:
1402         s->status &= ~(value & 0x07f0);
1403         pxa2xx_i2c_update(s);
1404         break;
1405 
1406     case ISAR:
1407         i2c_set_slave_address(I2C_SLAVE(s->slave), value & 0x7f);
1408         break;
1409 
1410     case IDBR:
1411         s->data = value & 0xff;
1412         break;
1413 
1414     default:
1415         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1416     }
1417 }
1418 
1419 static const MemoryRegionOps pxa2xx_i2c_ops = {
1420     .read = pxa2xx_i2c_read,
1421     .write = pxa2xx_i2c_write,
1422     .endianness = DEVICE_NATIVE_ENDIAN,
1423 };
1424 
1425 static const VMStateDescription vmstate_pxa2xx_i2c_slave = {
1426     .name = "pxa2xx_i2c_slave",
1427     .version_id = 1,
1428     .minimum_version_id = 1,
1429     .fields = (VMStateField[]) {
1430         VMSTATE_I2C_SLAVE(parent_obj, PXA2xxI2CSlaveState),
1431         VMSTATE_END_OF_LIST()
1432     }
1433 };
1434 
1435 static const VMStateDescription vmstate_pxa2xx_i2c = {
1436     .name = "pxa2xx_i2c",
1437     .version_id = 1,
1438     .minimum_version_id = 1,
1439     .fields = (VMStateField[]) {
1440         VMSTATE_UINT16(control, PXA2xxI2CState),
1441         VMSTATE_UINT16(status, PXA2xxI2CState),
1442         VMSTATE_UINT8(ibmr, PXA2xxI2CState),
1443         VMSTATE_UINT8(data, PXA2xxI2CState),
1444         VMSTATE_STRUCT_POINTER(slave, PXA2xxI2CState,
1445                                vmstate_pxa2xx_i2c_slave, PXA2xxI2CSlaveState),
1446         VMSTATE_END_OF_LIST()
1447     }
1448 };
1449 
1450 static int pxa2xx_i2c_slave_init(I2CSlave *i2c)
1451 {
1452     /* Nothing to do.  */
1453     return 0;
1454 }
1455 
1456 static void pxa2xx_i2c_slave_class_init(ObjectClass *klass, void *data)
1457 {
1458     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
1459 
1460     k->init = pxa2xx_i2c_slave_init;
1461     k->event = pxa2xx_i2c_event;
1462     k->recv = pxa2xx_i2c_rx;
1463     k->send = pxa2xx_i2c_tx;
1464 }
1465 
1466 static const TypeInfo pxa2xx_i2c_slave_info = {
1467     .name          = TYPE_PXA2XX_I2C_SLAVE,
1468     .parent        = TYPE_I2C_SLAVE,
1469     .instance_size = sizeof(PXA2xxI2CSlaveState),
1470     .class_init    = pxa2xx_i2c_slave_class_init,
1471 };
1472 
1473 PXA2xxI2CState *pxa2xx_i2c_init(hwaddr base,
1474                 qemu_irq irq, uint32_t region_size)
1475 {
1476     DeviceState *dev;
1477     SysBusDevice *i2c_dev;
1478     PXA2xxI2CState *s;
1479     I2CBus *i2cbus;
1480 
1481     dev = qdev_create(NULL, TYPE_PXA2XX_I2C);
1482     qdev_prop_set_uint32(dev, "size", region_size + 1);
1483     qdev_prop_set_uint32(dev, "offset", base & region_size);
1484     qdev_init_nofail(dev);
1485 
1486     i2c_dev = SYS_BUS_DEVICE(dev);
1487     sysbus_mmio_map(i2c_dev, 0, base & ~region_size);
1488     sysbus_connect_irq(i2c_dev, 0, irq);
1489 
1490     s = PXA2XX_I2C(i2c_dev);
1491     /* FIXME: Should the slave device really be on a separate bus?  */
1492     i2cbus = i2c_init_bus(dev, "dummy");
1493     dev = i2c_create_slave(i2cbus, TYPE_PXA2XX_I2C_SLAVE, 0);
1494     s->slave = PXA2XX_I2C_SLAVE(dev);
1495     s->slave->host = s;
1496 
1497     return s;
1498 }
1499 
1500 static int pxa2xx_i2c_initfn(SysBusDevice *sbd)
1501 {
1502     DeviceState *dev = DEVICE(sbd);
1503     PXA2xxI2CState *s = PXA2XX_I2C(dev);
1504 
1505     s->bus = i2c_init_bus(dev, "i2c");
1506 
1507     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_i2c_ops, s,
1508                           "pxa2xx-i2c", s->region_size);
1509     sysbus_init_mmio(sbd, &s->iomem);
1510     sysbus_init_irq(sbd, &s->irq);
1511 
1512     return 0;
1513 }
1514 
1515 I2CBus *pxa2xx_i2c_bus(PXA2xxI2CState *s)
1516 {
1517     return s->bus;
1518 }
1519 
1520 static Property pxa2xx_i2c_properties[] = {
1521     DEFINE_PROP_UINT32("size", PXA2xxI2CState, region_size, 0x10000),
1522     DEFINE_PROP_UINT32("offset", PXA2xxI2CState, offset, 0),
1523     DEFINE_PROP_END_OF_LIST(),
1524 };
1525 
1526 static void pxa2xx_i2c_class_init(ObjectClass *klass, void *data)
1527 {
1528     DeviceClass *dc = DEVICE_CLASS(klass);
1529     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
1530 
1531     k->init = pxa2xx_i2c_initfn;
1532     dc->desc = "PXA2xx I2C Bus Controller";
1533     dc->vmsd = &vmstate_pxa2xx_i2c;
1534     dc->props = pxa2xx_i2c_properties;
1535 }
1536 
1537 static const TypeInfo pxa2xx_i2c_info = {
1538     .name          = TYPE_PXA2XX_I2C,
1539     .parent        = TYPE_SYS_BUS_DEVICE,
1540     .instance_size = sizeof(PXA2xxI2CState),
1541     .class_init    = pxa2xx_i2c_class_init,
1542 };
1543 
1544 /* PXA Inter-IC Sound Controller */
1545 static void pxa2xx_i2s_reset(PXA2xxI2SState *i2s)
1546 {
1547     i2s->rx_len = 0;
1548     i2s->tx_len = 0;
1549     i2s->fifo_len = 0;
1550     i2s->clk = 0x1a;
1551     i2s->control[0] = 0x00;
1552     i2s->control[1] = 0x00;
1553     i2s->status = 0x00;
1554     i2s->mask = 0x00;
1555 }
1556 
1557 #define SACR_TFTH(val)	((val >> 8) & 0xf)
1558 #define SACR_RFTH(val)	((val >> 12) & 0xf)
1559 #define SACR_DREC(val)	(val & (1 << 3))
1560 #define SACR_DPRL(val)	(val & (1 << 4))
1561 
1562 static inline void pxa2xx_i2s_update(PXA2xxI2SState *i2s)
1563 {
1564     int rfs, tfs;
1565     rfs = SACR_RFTH(i2s->control[0]) < i2s->rx_len &&
1566             !SACR_DREC(i2s->control[1]);
1567     tfs = (i2s->tx_len || i2s->fifo_len < SACR_TFTH(i2s->control[0])) &&
1568             i2s->enable && !SACR_DPRL(i2s->control[1]);
1569 
1570     qemu_set_irq(i2s->rx_dma, rfs);
1571     qemu_set_irq(i2s->tx_dma, tfs);
1572 
1573     i2s->status &= 0xe0;
1574     if (i2s->fifo_len < 16 || !i2s->enable)
1575         i2s->status |= 1 << 0;			/* TNF */
1576     if (i2s->rx_len)
1577         i2s->status |= 1 << 1;			/* RNE */
1578     if (i2s->enable)
1579         i2s->status |= 1 << 2;			/* BSY */
1580     if (tfs)
1581         i2s->status |= 1 << 3;			/* TFS */
1582     if (rfs)
1583         i2s->status |= 1 << 4;			/* RFS */
1584     if (!(i2s->tx_len && i2s->enable))
1585         i2s->status |= i2s->fifo_len << 8;	/* TFL */
1586     i2s->status |= MAX(i2s->rx_len, 0xf) << 12;	/* RFL */
1587 
1588     qemu_set_irq(i2s->irq, i2s->status & i2s->mask);
1589 }
1590 
1591 #define SACR0	0x00	/* Serial Audio Global Control register */
1592 #define SACR1	0x04	/* Serial Audio I2S/MSB-Justified Control register */
1593 #define SASR0	0x0c	/* Serial Audio Interface and FIFO Status register */
1594 #define SAIMR	0x14	/* Serial Audio Interrupt Mask register */
1595 #define SAICR	0x18	/* Serial Audio Interrupt Clear register */
1596 #define SADIV	0x60	/* Serial Audio Clock Divider register */
1597 #define SADR	0x80	/* Serial Audio Data register */
1598 
1599 static uint64_t pxa2xx_i2s_read(void *opaque, hwaddr addr,
1600                                 unsigned size)
1601 {
1602     PXA2xxI2SState *s = (PXA2xxI2SState *) opaque;
1603 
1604     switch (addr) {
1605     case SACR0:
1606         return s->control[0];
1607     case SACR1:
1608         return s->control[1];
1609     case SASR0:
1610         return s->status;
1611     case SAIMR:
1612         return s->mask;
1613     case SAICR:
1614         return 0;
1615     case SADIV:
1616         return s->clk;
1617     case SADR:
1618         if (s->rx_len > 0) {
1619             s->rx_len --;
1620             pxa2xx_i2s_update(s);
1621             return s->codec_in(s->opaque);
1622         }
1623         return 0;
1624     default:
1625         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1626         break;
1627     }
1628     return 0;
1629 }
1630 
1631 static void pxa2xx_i2s_write(void *opaque, hwaddr addr,
1632                              uint64_t value, unsigned size)
1633 {
1634     PXA2xxI2SState *s = (PXA2xxI2SState *) opaque;
1635     uint32_t *sample;
1636 
1637     switch (addr) {
1638     case SACR0:
1639         if (value & (1 << 3))				/* RST */
1640             pxa2xx_i2s_reset(s);
1641         s->control[0] = value & 0xff3d;
1642         if (!s->enable && (value & 1) && s->tx_len) {	/* ENB */
1643             for (sample = s->fifo; s->fifo_len > 0; s->fifo_len --, sample ++)
1644                 s->codec_out(s->opaque, *sample);
1645             s->status &= ~(1 << 7);			/* I2SOFF */
1646         }
1647         if (value & (1 << 4))				/* EFWR */
1648             printf("%s: Attempt to use special function\n", __FUNCTION__);
1649         s->enable = (value & 9) == 1;			/* ENB && !RST*/
1650         pxa2xx_i2s_update(s);
1651         break;
1652     case SACR1:
1653         s->control[1] = value & 0x0039;
1654         if (value & (1 << 5))				/* ENLBF */
1655             printf("%s: Attempt to use loopback function\n", __FUNCTION__);
1656         if (value & (1 << 4))				/* DPRL */
1657             s->fifo_len = 0;
1658         pxa2xx_i2s_update(s);
1659         break;
1660     case SAIMR:
1661         s->mask = value & 0x0078;
1662         pxa2xx_i2s_update(s);
1663         break;
1664     case SAICR:
1665         s->status &= ~(value & (3 << 5));
1666         pxa2xx_i2s_update(s);
1667         break;
1668     case SADIV:
1669         s->clk = value & 0x007f;
1670         break;
1671     case SADR:
1672         if (s->tx_len && s->enable) {
1673             s->tx_len --;
1674             pxa2xx_i2s_update(s);
1675             s->codec_out(s->opaque, value);
1676         } else if (s->fifo_len < 16) {
1677             s->fifo[s->fifo_len ++] = value;
1678             pxa2xx_i2s_update(s);
1679         }
1680         break;
1681     default:
1682         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1683     }
1684 }
1685 
1686 static const MemoryRegionOps pxa2xx_i2s_ops = {
1687     .read = pxa2xx_i2s_read,
1688     .write = pxa2xx_i2s_write,
1689     .endianness = DEVICE_NATIVE_ENDIAN,
1690 };
1691 
1692 static const VMStateDescription vmstate_pxa2xx_i2s = {
1693     .name = "pxa2xx_i2s",
1694     .version_id = 0,
1695     .minimum_version_id = 0,
1696     .fields = (VMStateField[]) {
1697         VMSTATE_UINT32_ARRAY(control, PXA2xxI2SState, 2),
1698         VMSTATE_UINT32(status, PXA2xxI2SState),
1699         VMSTATE_UINT32(mask, PXA2xxI2SState),
1700         VMSTATE_UINT32(clk, PXA2xxI2SState),
1701         VMSTATE_INT32(enable, PXA2xxI2SState),
1702         VMSTATE_INT32(rx_len, PXA2xxI2SState),
1703         VMSTATE_INT32(tx_len, PXA2xxI2SState),
1704         VMSTATE_INT32(fifo_len, PXA2xxI2SState),
1705         VMSTATE_END_OF_LIST()
1706     }
1707 };
1708 
1709 static void pxa2xx_i2s_data_req(void *opaque, int tx, int rx)
1710 {
1711     PXA2xxI2SState *s = (PXA2xxI2SState *) opaque;
1712     uint32_t *sample;
1713 
1714     /* Signal FIFO errors */
1715     if (s->enable && s->tx_len)
1716         s->status |= 1 << 5;		/* TUR */
1717     if (s->enable && s->rx_len)
1718         s->status |= 1 << 6;		/* ROR */
1719 
1720     /* Should be tx - MIN(tx, s->fifo_len) but we don't really need to
1721      * handle the cases where it makes a difference.  */
1722     s->tx_len = tx - s->fifo_len;
1723     s->rx_len = rx;
1724     /* Note that is s->codec_out wasn't set, we wouldn't get called.  */
1725     if (s->enable)
1726         for (sample = s->fifo; s->fifo_len; s->fifo_len --, sample ++)
1727             s->codec_out(s->opaque, *sample);
1728     pxa2xx_i2s_update(s);
1729 }
1730 
1731 static PXA2xxI2SState *pxa2xx_i2s_init(MemoryRegion *sysmem,
1732                 hwaddr base,
1733                 qemu_irq irq, qemu_irq rx_dma, qemu_irq tx_dma)
1734 {
1735     PXA2xxI2SState *s = g_new0(PXA2xxI2SState, 1);
1736 
1737     s->irq = irq;
1738     s->rx_dma = rx_dma;
1739     s->tx_dma = tx_dma;
1740     s->data_req = pxa2xx_i2s_data_req;
1741 
1742     pxa2xx_i2s_reset(s);
1743 
1744     memory_region_init_io(&s->iomem, NULL, &pxa2xx_i2s_ops, s,
1745                           "pxa2xx-i2s", 0x100000);
1746     memory_region_add_subregion(sysmem, base, &s->iomem);
1747 
1748     vmstate_register(NULL, base, &vmstate_pxa2xx_i2s, s);
1749 
1750     return s;
1751 }
1752 
1753 /* PXA Fast Infra-red Communications Port */
1754 #define TYPE_PXA2XX_FIR "pxa2xx-fir"
1755 #define PXA2XX_FIR(obj) OBJECT_CHECK(PXA2xxFIrState, (obj), TYPE_PXA2XX_FIR)
1756 
1757 struct PXA2xxFIrState {
1758     /*< private >*/
1759     SysBusDevice parent_obj;
1760     /*< public >*/
1761 
1762     MemoryRegion iomem;
1763     qemu_irq irq;
1764     qemu_irq rx_dma;
1765     qemu_irq tx_dma;
1766     uint32_t enable;
1767     CharDriverState *chr;
1768 
1769     uint8_t control[3];
1770     uint8_t status[2];
1771 
1772     uint32_t rx_len;
1773     uint32_t rx_start;
1774     uint8_t rx_fifo[64];
1775 };
1776 
1777 static void pxa2xx_fir_reset(DeviceState *d)
1778 {
1779     PXA2xxFIrState *s = PXA2XX_FIR(d);
1780 
1781     s->control[0] = 0x00;
1782     s->control[1] = 0x00;
1783     s->control[2] = 0x00;
1784     s->status[0] = 0x00;
1785     s->status[1] = 0x00;
1786     s->enable = 0;
1787 }
1788 
1789 static inline void pxa2xx_fir_update(PXA2xxFIrState *s)
1790 {
1791     static const int tresh[4] = { 8, 16, 32, 0 };
1792     int intr = 0;
1793     if ((s->control[0] & (1 << 4)) &&			/* RXE */
1794                     s->rx_len >= tresh[s->control[2] & 3])	/* TRIG */
1795         s->status[0] |= 1 << 4;				/* RFS */
1796     else
1797         s->status[0] &= ~(1 << 4);			/* RFS */
1798     if (s->control[0] & (1 << 3))			/* TXE */
1799         s->status[0] |= 1 << 3;				/* TFS */
1800     else
1801         s->status[0] &= ~(1 << 3);			/* TFS */
1802     if (s->rx_len)
1803         s->status[1] |= 1 << 2;				/* RNE */
1804     else
1805         s->status[1] &= ~(1 << 2);			/* RNE */
1806     if (s->control[0] & (1 << 4))			/* RXE */
1807         s->status[1] |= 1 << 0;				/* RSY */
1808     else
1809         s->status[1] &= ~(1 << 0);			/* RSY */
1810 
1811     intr |= (s->control[0] & (1 << 5)) &&		/* RIE */
1812             (s->status[0] & (1 << 4));			/* RFS */
1813     intr |= (s->control[0] & (1 << 6)) &&		/* TIE */
1814             (s->status[0] & (1 << 3));			/* TFS */
1815     intr |= (s->control[2] & (1 << 4)) &&		/* TRAIL */
1816             (s->status[0] & (1 << 6));			/* EOC */
1817     intr |= (s->control[0] & (1 << 2)) &&		/* TUS */
1818             (s->status[0] & (1 << 1));			/* TUR */
1819     intr |= s->status[0] & 0x25;			/* FRE, RAB, EIF */
1820 
1821     qemu_set_irq(s->rx_dma, (s->status[0] >> 4) & 1);
1822     qemu_set_irq(s->tx_dma, (s->status[0] >> 3) & 1);
1823 
1824     qemu_set_irq(s->irq, intr && s->enable);
1825 }
1826 
1827 #define ICCR0	0x00	/* FICP Control register 0 */
1828 #define ICCR1	0x04	/* FICP Control register 1 */
1829 #define ICCR2	0x08	/* FICP Control register 2 */
1830 #define ICDR	0x0c	/* FICP Data register */
1831 #define ICSR0	0x14	/* FICP Status register 0 */
1832 #define ICSR1	0x18	/* FICP Status register 1 */
1833 #define ICFOR	0x1c	/* FICP FIFO Occupancy Status register */
1834 
1835 static uint64_t pxa2xx_fir_read(void *opaque, hwaddr addr,
1836                                 unsigned size)
1837 {
1838     PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1839     uint8_t ret;
1840 
1841     switch (addr) {
1842     case ICCR0:
1843         return s->control[0];
1844     case ICCR1:
1845         return s->control[1];
1846     case ICCR2:
1847         return s->control[2];
1848     case ICDR:
1849         s->status[0] &= ~0x01;
1850         s->status[1] &= ~0x72;
1851         if (s->rx_len) {
1852             s->rx_len --;
1853             ret = s->rx_fifo[s->rx_start ++];
1854             s->rx_start &= 63;
1855             pxa2xx_fir_update(s);
1856             return ret;
1857         }
1858         printf("%s: Rx FIFO underrun.\n", __FUNCTION__);
1859         break;
1860     case ICSR0:
1861         return s->status[0];
1862     case ICSR1:
1863         return s->status[1] | (1 << 3);			/* TNF */
1864     case ICFOR:
1865         return s->rx_len;
1866     default:
1867         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1868         break;
1869     }
1870     return 0;
1871 }
1872 
1873 static void pxa2xx_fir_write(void *opaque, hwaddr addr,
1874                              uint64_t value64, unsigned size)
1875 {
1876     PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1877     uint32_t value = value64;
1878     uint8_t ch;
1879 
1880     switch (addr) {
1881     case ICCR0:
1882         s->control[0] = value;
1883         if (!(value & (1 << 4)))			/* RXE */
1884             s->rx_len = s->rx_start = 0;
1885         if (!(value & (1 << 3))) {                      /* TXE */
1886             /* Nop */
1887         }
1888         s->enable = value & 1;				/* ITR */
1889         if (!s->enable)
1890             s->status[0] = 0;
1891         pxa2xx_fir_update(s);
1892         break;
1893     case ICCR1:
1894         s->control[1] = value;
1895         break;
1896     case ICCR2:
1897         s->control[2] = value & 0x3f;
1898         pxa2xx_fir_update(s);
1899         break;
1900     case ICDR:
1901         if (s->control[2] & (1 << 2))			/* TXP */
1902             ch = value;
1903         else
1904             ch = ~value;
1905         if (s->chr && s->enable && (s->control[0] & (1 << 3)))	/* TXE */
1906             qemu_chr_fe_write(s->chr, &ch, 1);
1907         break;
1908     case ICSR0:
1909         s->status[0] &= ~(value & 0x66);
1910         pxa2xx_fir_update(s);
1911         break;
1912     case ICFOR:
1913         break;
1914     default:
1915         printf("%s: Bad register " REG_FMT "\n", __FUNCTION__, addr);
1916     }
1917 }
1918 
1919 static const MemoryRegionOps pxa2xx_fir_ops = {
1920     .read = pxa2xx_fir_read,
1921     .write = pxa2xx_fir_write,
1922     .endianness = DEVICE_NATIVE_ENDIAN,
1923 };
1924 
1925 static int pxa2xx_fir_is_empty(void *opaque)
1926 {
1927     PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1928     return (s->rx_len < 64);
1929 }
1930 
1931 static void pxa2xx_fir_rx(void *opaque, const uint8_t *buf, int size)
1932 {
1933     PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
1934     if (!(s->control[0] & (1 << 4)))			/* RXE */
1935         return;
1936 
1937     while (size --) {
1938         s->status[1] |= 1 << 4;				/* EOF */
1939         if (s->rx_len >= 64) {
1940             s->status[1] |= 1 << 6;			/* ROR */
1941             break;
1942         }
1943 
1944         if (s->control[2] & (1 << 3))			/* RXP */
1945             s->rx_fifo[(s->rx_start + s->rx_len ++) & 63] = *(buf ++);
1946         else
1947             s->rx_fifo[(s->rx_start + s->rx_len ++) & 63] = ~*(buf ++);
1948     }
1949 
1950     pxa2xx_fir_update(s);
1951 }
1952 
1953 static void pxa2xx_fir_event(void *opaque, int event)
1954 {
1955 }
1956 
1957 static void pxa2xx_fir_instance_init(Object *obj)
1958 {
1959     PXA2xxFIrState *s = PXA2XX_FIR(obj);
1960     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
1961 
1962     memory_region_init_io(&s->iomem, obj, &pxa2xx_fir_ops, s,
1963                           "pxa2xx-fir", 0x1000);
1964     sysbus_init_mmio(sbd, &s->iomem);
1965     sysbus_init_irq(sbd, &s->irq);
1966     sysbus_init_irq(sbd, &s->rx_dma);
1967     sysbus_init_irq(sbd, &s->tx_dma);
1968 }
1969 
1970 static void pxa2xx_fir_realize(DeviceState *dev, Error **errp)
1971 {
1972     PXA2xxFIrState *s = PXA2XX_FIR(dev);
1973 
1974     if (s->chr) {
1975         qemu_chr_fe_claim_no_fail(s->chr);
1976         qemu_chr_add_handlers(s->chr, pxa2xx_fir_is_empty,
1977                         pxa2xx_fir_rx, pxa2xx_fir_event, s);
1978     }
1979 }
1980 
1981 static bool pxa2xx_fir_vmstate_validate(void *opaque, int version_id)
1982 {
1983     PXA2xxFIrState *s = opaque;
1984 
1985     return s->rx_start < ARRAY_SIZE(s->rx_fifo);
1986 }
1987 
1988 static const VMStateDescription pxa2xx_fir_vmsd = {
1989     .name = "pxa2xx-fir",
1990     .version_id = 1,
1991     .minimum_version_id = 1,
1992     .fields = (VMStateField[]) {
1993         VMSTATE_UINT32(enable, PXA2xxFIrState),
1994         VMSTATE_UINT8_ARRAY(control, PXA2xxFIrState, 3),
1995         VMSTATE_UINT8_ARRAY(status, PXA2xxFIrState, 2),
1996         VMSTATE_UINT32(rx_len, PXA2xxFIrState),
1997         VMSTATE_UINT32(rx_start, PXA2xxFIrState),
1998         VMSTATE_VALIDATE("fifo is 64 bytes", pxa2xx_fir_vmstate_validate),
1999         VMSTATE_UINT8_ARRAY(rx_fifo, PXA2xxFIrState, 64),
2000         VMSTATE_END_OF_LIST()
2001     }
2002 };
2003 
2004 static Property pxa2xx_fir_properties[] = {
2005     DEFINE_PROP_CHR("chardev", PXA2xxFIrState, chr),
2006     DEFINE_PROP_END_OF_LIST(),
2007 };
2008 
2009 static void pxa2xx_fir_class_init(ObjectClass *klass, void *data)
2010 {
2011     DeviceClass *dc = DEVICE_CLASS(klass);
2012 
2013     dc->realize = pxa2xx_fir_realize;
2014     dc->vmsd = &pxa2xx_fir_vmsd;
2015     dc->props = pxa2xx_fir_properties;
2016     dc->reset = pxa2xx_fir_reset;
2017 }
2018 
2019 static const TypeInfo pxa2xx_fir_info = {
2020     .name = TYPE_PXA2XX_FIR,
2021     .parent = TYPE_SYS_BUS_DEVICE,
2022     .instance_size = sizeof(PXA2xxFIrState),
2023     .class_init = pxa2xx_fir_class_init,
2024     .instance_init = pxa2xx_fir_instance_init,
2025 };
2026 
2027 static PXA2xxFIrState *pxa2xx_fir_init(MemoryRegion *sysmem,
2028                                        hwaddr base,
2029                                        qemu_irq irq, qemu_irq rx_dma,
2030                                        qemu_irq tx_dma,
2031                                        CharDriverState *chr)
2032 {
2033     DeviceState *dev;
2034     SysBusDevice *sbd;
2035 
2036     dev = qdev_create(NULL, TYPE_PXA2XX_FIR);
2037     qdev_prop_set_chr(dev, "chardev", chr);
2038     qdev_init_nofail(dev);
2039     sbd = SYS_BUS_DEVICE(dev);
2040     sysbus_mmio_map(sbd, 0, base);
2041     sysbus_connect_irq(sbd, 0, irq);
2042     sysbus_connect_irq(sbd, 1, rx_dma);
2043     sysbus_connect_irq(sbd, 2, tx_dma);
2044     return PXA2XX_FIR(dev);
2045 }
2046 
2047 static void pxa2xx_reset(void *opaque, int line, int level)
2048 {
2049     PXA2xxState *s = (PXA2xxState *) opaque;
2050 
2051     if (level && (s->pm_regs[PCFR >> 2] & 0x10)) {	/* GPR_EN */
2052         cpu_reset(CPU(s->cpu));
2053         /* TODO: reset peripherals */
2054     }
2055 }
2056 
2057 /* Initialise a PXA270 integrated chip (ARM based core).  */
2058 PXA2xxState *pxa270_init(MemoryRegion *address_space,
2059                          unsigned int sdram_size, const char *revision)
2060 {
2061     PXA2xxState *s;
2062     int i;
2063     DriveInfo *dinfo;
2064     s = g_new0(PXA2xxState, 1);
2065 
2066     if (revision && strncmp(revision, "pxa27", 5)) {
2067         fprintf(stderr, "Machine requires a PXA27x processor.\n");
2068         exit(1);
2069     }
2070     if (!revision)
2071         revision = "pxa270";
2072 
2073     s->cpu = cpu_arm_init(revision);
2074     if (s->cpu == NULL) {
2075         fprintf(stderr, "Unable to find CPU definition\n");
2076         exit(1);
2077     }
2078     s->reset = qemu_allocate_irq(pxa2xx_reset, s, 0);
2079 
2080     /* SDRAM & Internal Memory Storage */
2081     memory_region_init_ram(&s->sdram, NULL, "pxa270.sdram", sdram_size,
2082                            &error_fatal);
2083     vmstate_register_ram_global(&s->sdram);
2084     memory_region_add_subregion(address_space, PXA2XX_SDRAM_BASE, &s->sdram);
2085     memory_region_init_ram(&s->internal, NULL, "pxa270.internal", 0x40000,
2086                            &error_fatal);
2087     vmstate_register_ram_global(&s->internal);
2088     memory_region_add_subregion(address_space, PXA2XX_INTERNAL_BASE,
2089                                 &s->internal);
2090 
2091     s->pic = pxa2xx_pic_init(0x40d00000, s->cpu);
2092 
2093     s->dma = pxa27x_dma_init(0x40000000,
2094                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_DMA));
2095 
2096     sysbus_create_varargs("pxa27x-timer", 0x40a00000,
2097                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 0),
2098                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 1),
2099                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 2),
2100                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 3),
2101                     qdev_get_gpio_in(s->pic, PXA27X_PIC_OST_4_11),
2102                     NULL);
2103 
2104     s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 121);
2105 
2106     dinfo = drive_get(IF_SD, 0, 0);
2107     if (!dinfo) {
2108         fprintf(stderr, "qemu: missing SecureDigital device\n");
2109         exit(1);
2110     }
2111     s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
2112                     blk_by_legacy_dinfo(dinfo),
2113                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
2114                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
2115                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
2116 
2117     for (i = 0; pxa270_serial[i].io_base; i++) {
2118         if (serial_hds[i]) {
2119             serial_mm_init(address_space, pxa270_serial[i].io_base, 2,
2120                            qdev_get_gpio_in(s->pic, pxa270_serial[i].irqn),
2121                            14857000 / 16, serial_hds[i],
2122                            DEVICE_NATIVE_ENDIAN);
2123         } else {
2124             break;
2125         }
2126     }
2127     if (serial_hds[i])
2128         s->fir = pxa2xx_fir_init(address_space, 0x40800000,
2129                         qdev_get_gpio_in(s->pic, PXA2XX_PIC_ICP),
2130                         qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_ICP),
2131                         qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_ICP),
2132                         serial_hds[i]);
2133 
2134     s->lcd = pxa2xx_lcdc_init(address_space, 0x44000000,
2135                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_LCD));
2136 
2137     s->cm_base = 0x41300000;
2138     s->cm_regs[CCCR >> 2] = 0x02000210;	/* 416.0 MHz */
2139     s->clkcfg = 0x00000009;		/* Turbo mode active */
2140     memory_region_init_io(&s->cm_iomem, NULL, &pxa2xx_cm_ops, s, "pxa2xx-cm", 0x1000);
2141     memory_region_add_subregion(address_space, s->cm_base, &s->cm_iomem);
2142     vmstate_register(NULL, 0, &vmstate_pxa2xx_cm, s);
2143 
2144     pxa2xx_setup_cp14(s);
2145 
2146     s->mm_base = 0x48000000;
2147     s->mm_regs[MDMRS >> 2] = 0x00020002;
2148     s->mm_regs[MDREFR >> 2] = 0x03ca4000;
2149     s->mm_regs[MECR >> 2] = 0x00000001;	/* Two PC Card sockets */
2150     memory_region_init_io(&s->mm_iomem, NULL, &pxa2xx_mm_ops, s, "pxa2xx-mm", 0x1000);
2151     memory_region_add_subregion(address_space, s->mm_base, &s->mm_iomem);
2152     vmstate_register(NULL, 0, &vmstate_pxa2xx_mm, s);
2153 
2154     s->pm_base = 0x40f00000;
2155     memory_region_init_io(&s->pm_iomem, NULL, &pxa2xx_pm_ops, s, "pxa2xx-pm", 0x100);
2156     memory_region_add_subregion(address_space, s->pm_base, &s->pm_iomem);
2157     vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
2158 
2159     for (i = 0; pxa27x_ssp[i].io_base; i ++);
2160     s->ssp = g_new0(SSIBus *, i);
2161     for (i = 0; pxa27x_ssp[i].io_base; i ++) {
2162         DeviceState *dev;
2163         dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa27x_ssp[i].io_base,
2164                         qdev_get_gpio_in(s->pic, pxa27x_ssp[i].irqn));
2165         s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
2166     }
2167 
2168     if (usb_enabled()) {
2169         sysbus_create_simple("sysbus-ohci", 0x4c000000,
2170                         qdev_get_gpio_in(s->pic, PXA2XX_PIC_USBH1));
2171     }
2172 
2173     s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
2174     s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
2175 
2176     sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000,
2177                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM));
2178 
2179     s->i2c[0] = pxa2xx_i2c_init(0x40301600,
2180                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2C), 0xffff);
2181     s->i2c[1] = pxa2xx_i2c_init(0x40f00100,
2182                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_PWRI2C), 0xff);
2183 
2184     s->i2s = pxa2xx_i2s_init(address_space, 0x40400000,
2185                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2S),
2186                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_I2S),
2187                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_I2S));
2188 
2189     s->kp = pxa27x_keypad_init(address_space, 0x41500000,
2190                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_KEYPAD));
2191 
2192     /* GPIO1 resets the processor */
2193     /* The handler can be overridden by board-specific code */
2194     qdev_connect_gpio_out(s->gpio, 1, s->reset);
2195     return s;
2196 }
2197 
2198 /* Initialise a PXA255 integrated chip (ARM based core).  */
2199 PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
2200 {
2201     PXA2xxState *s;
2202     int i;
2203     DriveInfo *dinfo;
2204 
2205     s = g_new0(PXA2xxState, 1);
2206 
2207     s->cpu = cpu_arm_init("pxa255");
2208     if (s->cpu == NULL) {
2209         fprintf(stderr, "Unable to find CPU definition\n");
2210         exit(1);
2211     }
2212     s->reset = qemu_allocate_irq(pxa2xx_reset, s, 0);
2213 
2214     /* SDRAM & Internal Memory Storage */
2215     memory_region_init_ram(&s->sdram, NULL, "pxa255.sdram", sdram_size,
2216                            &error_fatal);
2217     vmstate_register_ram_global(&s->sdram);
2218     memory_region_add_subregion(address_space, PXA2XX_SDRAM_BASE, &s->sdram);
2219     memory_region_init_ram(&s->internal, NULL, "pxa255.internal",
2220                            PXA2XX_INTERNAL_SIZE, &error_fatal);
2221     vmstate_register_ram_global(&s->internal);
2222     memory_region_add_subregion(address_space, PXA2XX_INTERNAL_BASE,
2223                                 &s->internal);
2224 
2225     s->pic = pxa2xx_pic_init(0x40d00000, s->cpu);
2226 
2227     s->dma = pxa255_dma_init(0x40000000,
2228                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_DMA));
2229 
2230     sysbus_create_varargs("pxa25x-timer", 0x40a00000,
2231                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 0),
2232                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 1),
2233                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 2),
2234                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 3),
2235                     NULL);
2236 
2237     s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 85);
2238 
2239     dinfo = drive_get(IF_SD, 0, 0);
2240     if (!dinfo) {
2241         fprintf(stderr, "qemu: missing SecureDigital device\n");
2242         exit(1);
2243     }
2244     s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
2245                     blk_by_legacy_dinfo(dinfo),
2246                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
2247                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
2248                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
2249 
2250     for (i = 0; pxa255_serial[i].io_base; i++) {
2251         if (serial_hds[i]) {
2252             serial_mm_init(address_space, pxa255_serial[i].io_base, 2,
2253                            qdev_get_gpio_in(s->pic, pxa255_serial[i].irqn),
2254                            14745600 / 16, serial_hds[i],
2255                            DEVICE_NATIVE_ENDIAN);
2256         } else {
2257             break;
2258         }
2259     }
2260     if (serial_hds[i])
2261         s->fir = pxa2xx_fir_init(address_space, 0x40800000,
2262                         qdev_get_gpio_in(s->pic, PXA2XX_PIC_ICP),
2263                         qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_ICP),
2264                         qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_ICP),
2265                         serial_hds[i]);
2266 
2267     s->lcd = pxa2xx_lcdc_init(address_space, 0x44000000,
2268                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_LCD));
2269 
2270     s->cm_base = 0x41300000;
2271     s->cm_regs[CCCR >> 2] = 0x02000210;	/* 416.0 MHz */
2272     s->clkcfg = 0x00000009;		/* Turbo mode active */
2273     memory_region_init_io(&s->cm_iomem, NULL, &pxa2xx_cm_ops, s, "pxa2xx-cm", 0x1000);
2274     memory_region_add_subregion(address_space, s->cm_base, &s->cm_iomem);
2275     vmstate_register(NULL, 0, &vmstate_pxa2xx_cm, s);
2276 
2277     pxa2xx_setup_cp14(s);
2278 
2279     s->mm_base = 0x48000000;
2280     s->mm_regs[MDMRS >> 2] = 0x00020002;
2281     s->mm_regs[MDREFR >> 2] = 0x03ca4000;
2282     s->mm_regs[MECR >> 2] = 0x00000001;	/* Two PC Card sockets */
2283     memory_region_init_io(&s->mm_iomem, NULL, &pxa2xx_mm_ops, s, "pxa2xx-mm", 0x1000);
2284     memory_region_add_subregion(address_space, s->mm_base, &s->mm_iomem);
2285     vmstate_register(NULL, 0, &vmstate_pxa2xx_mm, s);
2286 
2287     s->pm_base = 0x40f00000;
2288     memory_region_init_io(&s->pm_iomem, NULL, &pxa2xx_pm_ops, s, "pxa2xx-pm", 0x100);
2289     memory_region_add_subregion(address_space, s->pm_base, &s->pm_iomem);
2290     vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
2291 
2292     for (i = 0; pxa255_ssp[i].io_base; i ++);
2293     s->ssp = g_new0(SSIBus *, i);
2294     for (i = 0; pxa255_ssp[i].io_base; i ++) {
2295         DeviceState *dev;
2296         dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa255_ssp[i].io_base,
2297                         qdev_get_gpio_in(s->pic, pxa255_ssp[i].irqn));
2298         s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
2299     }
2300 
2301     if (usb_enabled()) {
2302         sysbus_create_simple("sysbus-ohci", 0x4c000000,
2303                         qdev_get_gpio_in(s->pic, PXA2XX_PIC_USBH1));
2304     }
2305 
2306     s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
2307     s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
2308 
2309     sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000,
2310                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM));
2311 
2312     s->i2c[0] = pxa2xx_i2c_init(0x40301600,
2313                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2C), 0xffff);
2314     s->i2c[1] = pxa2xx_i2c_init(0x40f00100,
2315                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_PWRI2C), 0xff);
2316 
2317     s->i2s = pxa2xx_i2s_init(address_space, 0x40400000,
2318                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2S),
2319                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_I2S),
2320                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_I2S));
2321 
2322     /* GPIO1 resets the processor */
2323     /* The handler can be overridden by board-specific code */
2324     qdev_connect_gpio_out(s->gpio, 1, s->reset);
2325     return s;
2326 }
2327 
2328 static void pxa2xx_ssp_class_init(ObjectClass *klass, void *data)
2329 {
2330     SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
2331     DeviceClass *dc = DEVICE_CLASS(klass);
2332 
2333     sdc->init = pxa2xx_ssp_init;
2334     dc->reset = pxa2xx_ssp_reset;
2335     dc->vmsd = &vmstate_pxa2xx_ssp;
2336 }
2337 
2338 static const TypeInfo pxa2xx_ssp_info = {
2339     .name          = TYPE_PXA2XX_SSP,
2340     .parent        = TYPE_SYS_BUS_DEVICE,
2341     .instance_size = sizeof(PXA2xxSSPState),
2342     .class_init    = pxa2xx_ssp_class_init,
2343 };
2344 
2345 static void pxa2xx_register_types(void)
2346 {
2347     type_register_static(&pxa2xx_i2c_slave_info);
2348     type_register_static(&pxa2xx_ssp_info);
2349     type_register_static(&pxa2xx_i2c_info);
2350     type_register_static(&pxa2xx_rtc_sysbus_info);
2351     type_register_static(&pxa2xx_fir_info);
2352 }
2353 
2354 type_init(pxa2xx_register_types)
2355