Handle on-chip DMA controllers in one place, convert OMAP DMA to use it.

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4920 c046a42c-6fe2-441c-8c8c-71466251a162

6 files changed, 895 insertions, 163 deletions

diff --git a/hw/omap.h b/hw/omap.h
index 7270e202b6..7006ecbe8e 100644
--- a/hw/omap.h
+++ b/hw/omap.h
@@ -417,14 +417,14 @@ enum omap_dma_model {
     omap_dma_4,
 };
 
-struct omap_dma_s;
-struct omap_dma_s *omap_dma_init(target_phys_addr_t base, qemu_irq *irqs,
+struct soc_dma_s;
+struct soc_dma_s *omap_dma_init(target_phys_addr_t base, qemu_irq *irqs,
                 qemu_irq lcd_irq, struct omap_mpu_state_s *mpu, omap_clk clk,
                 enum omap_dma_model model);
-struct omap_dma_s *omap_dma4_init(target_phys_addr_t base, qemu_irq *irqs,
+struct soc_dma_s *omap_dma4_init(target_phys_addr_t base, qemu_irq *irqs,
                 struct omap_mpu_state_s *mpu, int fifo,
                 int chans, omap_clk iclk, omap_clk fclk);
-void omap_dma_reset(struct omap_dma_s *s);
+void omap_dma_reset(struct soc_dma_s *s);
 
 struct dma_irq_map {
     int ih;
@@ -494,7 +494,7 @@ struct omap_dma_lcd_channel_s {
     ram_addr_t phys_framebuffer[2];
     qemu_irq irq;
     struct omap_mpu_state_s *mpu;
-} *omap_dma_get_lcdch(struct omap_dma_s *s);
+} *omap_dma_get_lcdch(struct soc_dma_s *s);
 
 /*
  * DMA request numbers for OMAP1
@@ -882,7 +882,7 @@ struct omap_mpu_state_s {
     /* MPU private TIPB peripherals */
     struct omap_intr_handler_s *ih[2];
 
-    struct omap_dma_s *dma;
+    struct soc_dma_s *dma;
 
     struct omap_mpu_timer_s *timer[3];
     struct omap_watchdog_timer_s *wdt;
diff --git a/hw/omap1.c b/hw/omap1.c
index 7dab6c8e4b..5854500764 100644
--- a/hw/omap1.c
+++ b/hw/omap1.c
@@ -24,6 +24,7 @@
 #include "sysemu.h"
 #include "qemu-timer.h"
 #include "qemu-char.h"
+#include "soc_dma.h"
 /* We use pc-style serial ports.  */
 #include "pc.h"
 
@@ -4704,6 +4705,12 @@ struct omap_mpu_state_s *omap310_mpu_init(unsigned long sdram_size,
     s->port[local    ].addr_valid = omap_validate_local_addr;
     s->port[tipb_mpui].addr_valid = omap_validate_tipb_mpui_addr;
 
+    /* Register SDRAM and SRAM DMA ports for fast transfers.  */
+    soc_dma_port_add_mem_ram(s->dma,
+                    emiff_base, OMAP_EMIFF_BASE, s->sdram_size);
+    soc_dma_port_add_mem_ram(s->dma,
+                    imif_base, OMAP_IMIF_BASE, s->sram_size);
+
     s->timer[0] = omap_mpu_timer_init(0xfffec500,
                     s->irq[0][OMAP_INT_TIMER1],
                     omap_findclk(s, "mputim_ck"));
diff --git a/hw/omap2.c b/hw/omap2.c
index 8c9ac6a81e..fa7b35c07f 100644
--- a/hw/omap2.c
+++ b/hw/omap2.c
@@ -26,6 +26,7 @@
 #include "qemu-timer.h"
 #include "qemu-char.h"
 #include "flash.h"
+#include "soc_dma.h"
 #include "audio/audio.h"
 
 /* GP timers */
@@ -4493,6 +4494,10 @@ struct omap_mpu_state_s *omap2420_mpu_init(unsigned long sdram_size,
                     omap_findclk(s, "sdma_fclk"));
     s->port->addr_valid = omap2_validate_addr;
 
+    /* Register SDRAM and SRAM ports for fast DMA transfers.  */
+    soc_dma_port_add_mem_ram(s->dma, q2_base, OMAP2_Q2_BASE, s->sdram_size);
+    soc_dma_port_add_mem_ram(s->dma, sram_base, OMAP2_SRAM_BASE, s->sram_size);
+
     s->uart[0] = omap2_uart_init(omap_l4ta(s->l4, 19),
                     s->irq[0][OMAP_INT_24XX_UART1_IRQ],
                     omap_findclk(s, "uart1_fclk"),
diff --git a/hw/omap_dma.c b/hw/omap_dma.c
index 6c0bd8267f..df4fb01c99 100644
--- a/hw/omap_dma.c
+++ b/hw/omap_dma.c
@@ -23,6 +23,7 @@
 #include "qemu-timer.h"
 #include "omap.h"
 #include "irq.h"
+#include "soc_dma.h"
 
 struct omap_dma_channel_s {
     /* transfer data */
@@ -66,6 +67,7 @@ struct omap_dma_channel_s {
     int pending_request;
     int waiting_end_prog;
     uint16_t cpc;
+    int set_update;
 
     /* sync type */
     int fs;
@@ -89,6 +91,8 @@ struct omap_dma_channel_s {
         int pck_elements;
     } active_set;
 
+    struct soc_dma_ch_s *dma;
+
     /* unused parameters */
     int write_mode;
     int priority;
@@ -99,12 +103,11 @@ struct omap_dma_channel_s {
 };
 
 struct omap_dma_s {
-    QEMUTimer *tm;
+    struct soc_dma_s *dma;
+
     struct omap_mpu_state_s *mpu;
     target_phys_addr_t base;
     omap_clk clk;
-    int64_t delay;
-    uint64_t drq;
     qemu_irq irq[4];
     void (*intr_update)(struct omap_dma_s *s);
     enum omap_dma_model model;
@@ -115,7 +118,6 @@ struct omap_dma_s {
     uint32_t caps[5];
     uint32_t irqen[4];
     uint32_t irqstat[4];
-    int run_count;
 
     int chans;
     struct omap_dma_channel_s ch[32];
@@ -139,11 +141,10 @@ static inline void omap_dma_interrupts_update(struct omap_dma_s *s)
     return s->intr_update(s);
 }
 
-static void omap_dma_channel_load(struct omap_dma_s *s,
-                struct omap_dma_channel_s *ch)
+static void omap_dma_channel_load(struct omap_dma_channel_s *ch)
 {
     struct omap_dma_reg_set_s *a = &ch->active_set;
-    int i;
+    int i, normal;
     int omap_3_1 = !ch->omap_3_1_compatible_disable;
 
     /*
@@ -189,20 +190,50 @@ static void omap_dma_channel_load(struct omap_dma_s *s,
         default:
             break;
         }
+
+    normal = !ch->transparent_copy && !ch->constant_fill &&
+            /* FIFO is big-endian so either (ch->endian[n] == 1) OR
+             * (ch->endian_lock[n] == 1) mean no endianism conversion.  */
+            (ch->endian[0] | ch->endian_lock[0]) ==
+            (ch->endian[1] | ch->endian_lock[1]);
+    for (i = 0; i < 2; i ++) {
+        /* TODO: for a->frame_delta[i] > 0 still use the fast path, just
+         * limit min_elems in omap_dma_transfer_setup to the nearest frame
+         * end.  */
+        if (!a->elem_delta[i] && normal &&
+                        (a->frames == 1 || !a->frame_delta[i]))
+            ch->dma->type[i] = soc_dma_access_const;
+        else if (a->elem_delta[i] == ch->data_type && normal &&
+                        (a->frames == 1 || !a->frame_delta[i]))
+            ch->dma->type[i] = soc_dma_access_linear;
+        else
+            ch->dma->type[i] = soc_dma_access_other;
+
+        ch->dma->vaddr[i] = ch->addr[i];
+    }
+    soc_dma_ch_update(ch->dma);
 }
 
 static void omap_dma_activate_channel(struct omap_dma_s *s,
                 struct omap_dma_channel_s *ch)
 {
     if (!ch->active) {
+        if (ch->set_update) {
+            /* It's not clear when the active set is supposed to be
+             * loaded from registers.  We're already loading it when the
+             * channel is enabled, and for some guests this is not enough
+             * but that may be also because of a race condition (no
+             * delays in qemu) in the guest code, which we're just
+             * working around here.  */
+            omap_dma_channel_load(ch);
+            ch->set_update = 0;
+        }
+
         ch->active = 1;
+        soc_dma_set_request(ch->dma, 1);
         if (ch->sync)
             ch->status |= SYNC;
-        s->run_count ++;
     }
-
-    if (s->delay && !qemu_timer_pending(s->tm))
-        qemu_mod_timer(s->tm, qemu_get_clock(vm_clock) + s->delay);
 }
 
 static void omap_dma_deactivate_channel(struct omap_dma_s *s,
@@ -219,17 +250,14 @@ static void omap_dma_deactivate_channel(struct omap_dma_s *s,
 
     /* Don't deactive the channel if it is synchronized and the DMA request is
        active */
-    if (ch->sync && ch->enable && (s->drq & (1 << ch->sync)))
+    if (ch->sync && ch->enable && (s->dma->drqbmp & (1 << ch->sync)))
         return;
 
     if (ch->active) {
         ch->active = 0;
         ch->status &= ~SYNC;
-        s->run_count --;
+        soc_dma_set_request(ch->dma, 0);
     }
-
-    if (!s->run_count)
-        qemu_del_timer(s->tm);
 }
 
 static void omap_dma_enable_channel(struct omap_dma_s *s,
@@ -238,11 +266,11 @@ static void omap_dma_enable_channel(struct omap_dma_s *s,
     if (!ch->enable) {
         ch->enable = 1;
         ch->waiting_end_prog = 0;
-        omap_dma_channel_load(s, ch);
+        omap_dma_channel_load(ch);
         /* TODO: theoretically if ch->sync && ch->prefetch &&
-         * !s->drq[ch->sync], we should also activate and fetch from source
-         * and then stall until signalled.  */
-        if ((!ch->sync) || (s->drq & (1 << ch->sync)))
+         * !s->dma->drqbmp[ch->sync], we should also activate and fetch
+         * from source and then stall until signalled.  */
+        if ((!ch->sync) || (s->dma->drqbmp & (1 << ch->sync)))
             omap_dma_activate_channel(s, ch);
     }
 }
@@ -338,140 +366,319 @@ static void omap_dma_process_request(struct omap_dma_s *s, int request)
         omap_dma_interrupts_update(s);
 }
 
-static void omap_dma_channel_run(struct omap_dma_s *s)
+static void omap_dma_transfer_generic(struct soc_dma_ch_s *dma)
 {
-    int n = s->chans;
-    uint16_t status;
     uint8_t value[4];
-    struct omap_dma_port_if_s *src_p, *dest_p;
-    struct omap_dma_reg_set_s *a;
-    struct omap_dma_channel_s *ch;
-
-    for (ch = s->ch; n; n --, ch ++) {
-        if (!ch->active)
-            continue;
-
-        a = &ch->active_set;
+    struct omap_dma_channel_s *ch = dma->opaque;
+    struct omap_dma_reg_set_s *a = &ch->active_set;
+    int bytes = dma->bytes;
+#ifdef MULTI_REQ
+    uint16_t status = ch->status;
+#endif
 
-        src_p = &s->mpu->port[ch->port[0]];
-        dest_p = &s->mpu->port[ch->port[1]];
-        if ((!ch->constant_fill && !src_p->addr_valid(s->mpu, a->src)) ||
-                        (!dest_p->addr_valid(s->mpu, a->dest))) {
-#if 0
-            /* Bus time-out */
-            if (ch->interrupts & TIMEOUT_INTR)
-                ch->status |= TIMEOUT_INTR;
+    do {
+        /* Transfer a single element */
+        /* FIXME: check the endianness */
+        if (!ch->constant_fill)
+            cpu_physical_memory_read(a->src, value, ch->data_type);
+        else
+            *(uint32_t *) value = ch->color;
+
+        if (!ch->transparent_copy || *(uint32_t *) value != ch->color)
+            cpu_physical_memory_write(a->dest, value, ch->data_type);
+
+        a->src += a->elem_delta[0];
+        a->dest += a->elem_delta[1];
+        a->element ++;
+
+#ifndef MULTI_REQ
+        if (a->element == a->elements) {
+            /* End of Frame */
+            a->element = 0;
+            a->src += a->frame_delta[0];
+            a->dest += a->frame_delta[1];
+            a->frame ++;
+
+            /* If the channel is async, update cpc */
+            if (!ch->sync)
+                ch->cpc = a->dest & 0xffff;
+        }
+    } while ((bytes -= ch->data_type));
+#else
+        /* If the channel is element synchronized, deactivate it */
+        if (ch->sync && !ch->fs && !ch->bs)
             omap_dma_deactivate_channel(s, ch);
-            continue;
-#endif
-            printf("%s: Bus time-out in DMA%i operation\n",
-                            __FUNCTION__, s->chans - n);
+
+        /* If it is the last frame, set the LAST_FRAME interrupt */
+        if (a->element == 1 && a->frame == a->frames - 1)
+            if (ch->interrupts & LAST_FRAME_INTR)
+                ch->status |= LAST_FRAME_INTR;
+
+        /* If the half of the frame was reached, set the HALF_FRAME
+           interrupt */
+        if (a->element == (a->elements >> 1))
+            if (ch->interrupts & HALF_FRAME_INTR)
+                ch->status |= HALF_FRAME_INTR;
+
+        if (ch->fs && ch->bs) {
+            a->pck_element ++;
+            /* Check if a full packet has beed transferred.  */
+            if (a->pck_element == a->pck_elements) {
+                a->pck_element = 0;
+
+                /* Set the END_PKT interrupt */
+                if ((ch->interrupts & END_PKT_INTR) && !ch->src_sync)
+                    ch->status |= END_PKT_INTR;
+
+                /* If the channel is packet-synchronized, deactivate it */
+                if (ch->sync)
+                    omap_dma_deactivate_channel(s, ch);
+            }
         }
 
-        status = ch->status;
-        while (status == ch->status && ch->active) {
-            /* Transfer a single element */
-            /* FIXME: check the endianness */
-            if (!ch->constant_fill)
-                cpu_physical_memory_read(a->src, value, ch->data_type);
-            else
-                *(uint32_t *) value = ch->color;
-
-            if (!ch->transparent_copy ||
-                    *(uint32_t *) value != ch->color)
-                cpu_physical_memory_write(a->dest, value, ch->data_type);
-
-            a->src += a->elem_delta[0];
-            a->dest += a->elem_delta[1];
-            a->element ++;
-
-            /* If the channel is element synchronized, deactivate it */
-            if (ch->sync && !ch->fs && !ch->bs)
+        if (a->element == a->elements) {
+            /* End of Frame */
+            a->element = 0;
+            a->src += a->frame_delta[0];
+            a->dest += a->frame_delta[1];
+            a->frame ++;
+
+            /* If the channel is frame synchronized, deactivate it */
+            if (ch->sync && ch->fs && !ch->bs)
                 omap_dma_deactivate_channel(s, ch);
 
-            /* If it is the last frame, set the LAST_FRAME interrupt */
-            if (a->element == 1 && a->frame == a->frames - 1)
-                if (ch->interrupts & LAST_FRAME_INTR)
-                    ch->status |= LAST_FRAME_INTR;
-
-            /* If the half of the frame was reached, set the HALF_FRAME
-               interrupt */
-            if (a->element == (a->elements >> 1))
-                if (ch->interrupts & HALF_FRAME_INTR)
-                    ch->status |= HALF_FRAME_INTR;
-
-            if (ch->fs && ch->bs) {
-                a->pck_element ++;
-                /* Check if a full packet has beed transferred.  */
-                if (a->pck_element == a->pck_elements) {
-                    a->pck_element = 0;
-
-                    /* Set the END_PKT interrupt */
-                    if ((ch->interrupts & END_PKT_INTR) && !ch->src_sync)
-                        ch->status |= END_PKT_INTR;
-
-                    /* If the channel is packet-synchronized, deactivate it */
-                    if (ch->sync)
+            /* If the channel is async, update cpc */
+            if (!ch->sync)
+                ch->cpc = a->dest & 0xffff;
+
+            /* Set the END_FRAME interrupt */
+            if (ch->interrupts & END_FRAME_INTR)
+                ch->status |= END_FRAME_INTR;
+
+            if (a->frame == a->frames) {
+                /* End of Block */
+                /* Disable the channel */
+
+                if (ch->omap_3_1_compatible_disable) {
+                    omap_dma_disable_channel(s, ch);
+                    if (ch->link_enabled)
+                        omap_dma_enable_channel(s,
+                                        &s->ch[ch->link_next_ch]);
+                } else {
+                    if (!ch->auto_init)
+                        omap_dma_disable_channel(s, ch);
+                    else if (ch->repeat || ch->end_prog)
+                        omap_dma_channel_load(ch);
+                    else {
+                        ch->waiting_end_prog = 1;
                         omap_dma_deactivate_channel(s, ch);
+                    }
                 }
+
+                if (ch->interrupts & END_BLOCK_INTR)
+                    ch->status |= END_BLOCK_INTR;
             }
+        }
+    } while (status == ch->status && ch->active);
 
-            if (a->element == a->elements) {
-                /* End of Frame */
-                a->element = 0;
-                a->src += a->frame_delta[0];
-                a->dest += a->frame_delta[1];
-                a->frame ++;
+    omap_dma_interrupts_update(s);
+#endif
+}
 
-                /* If the channel is frame synchronized, deactivate it */
-                if (ch->sync && ch->fs && !ch->bs)
-                    omap_dma_deactivate_channel(s, ch);
+enum {
+    omap_dma_intr_element_sync,
+    omap_dma_intr_last_frame,
+    omap_dma_intr_half_frame,
+    omap_dma_intr_frame,
+    omap_dma_intr_frame_sync,
+    omap_dma_intr_packet,
+    omap_dma_intr_packet_sync,
+    omap_dma_intr_block,
+    __omap_dma_intr_last,
+};
 
-                /* If the channel is async, update cpc */
-                if (!ch->sync)
-                    ch->cpc = a->dest & 0xffff;
+static void omap_dma_transfer_setup(struct soc_dma_ch_s *dma)
+{
+    struct omap_dma_port_if_s *src_p, *dest_p;
+    struct omap_dma_reg_set_s *a;
+    struct omap_dma_channel_s *ch = dma->opaque;
+    struct omap_dma_s *s = dma->dma->opaque;
+    int frames, min_elems, elements[__omap_dma_intr_last];
 
-                /* Set the END_FRAME interrupt */
-                if (ch->interrupts & END_FRAME_INTR)
-                    ch->status |= END_FRAME_INTR;
+    a = &ch->active_set;
 
-                if (a->frame == a->frames) {
-                    /* End of Block */
-                    /* Disable the channel */
+    src_p = &s->mpu->port[ch->port[0]];
+    dest_p = &s->mpu->port[ch->port[1]];
+    if ((!ch->constant_fill && !src_p->addr_valid(s->mpu, a->src)) ||
+                    (!dest_p->addr_valid(s->mpu, a->dest))) {
+#if 0
+        /* Bus time-out */
+        if (ch->interrupts & TIMEOUT_INTR)
+            ch->status |= TIMEOUT_INTR;
+        omap_dma_deactivate_channel(s, ch);
+        continue;
+#endif
+        printf("%s: Bus time-out in DMA%i operation\n",
+                        __FUNCTION__, dma->num);
+    }
 
-                    if (ch->omap_3_1_compatible_disable) {
-                        omap_dma_disable_channel(s, ch);
-                        if (ch->link_enabled)
-                            omap_dma_enable_channel(s,
-                                            &s->ch[ch->link_next_ch]);
-                    } else {
-                        if (!ch->auto_init)
-                            omap_dma_disable_channel(s, ch);
-                        else if (ch->repeat || ch->end_prog)
-                            omap_dma_channel_load(s, ch);
-                        else {
-                            ch->waiting_end_prog = 1;
-                            omap_dma_deactivate_channel(s, ch);
-                        }
-                    }
+    min_elems = INT_MAX;
+
+    /* Check all the conditions that terminate the transfer starting
+     * with those that can occur the soonest.  */
+#define INTR_CHECK(cond, id, nelements)	\
+    if (cond) {			\
+        elements[id] = nelements;	\
+        if (elements[id] < min_elems)	\
+            min_elems = elements[id];	\
+    } else				\
+        elements[id] = INT_MAX;
+
+    /* Elements */
+    INTR_CHECK(
+                    ch->sync && !ch->fs && !ch->bs,
+                    omap_dma_intr_element_sync,
+                    1)
+
+    /* Frames */
+    /* TODO: for transfers where entire frames can be read and written
+     * using memcpy() but a->frame_delta is non-zero, try to still do
+     * transfers using soc_dma but limit min_elems to a->elements - ...
+     * See also the TODO in omap_dma_channel_load.  */
+    INTR_CHECK(
+                    (ch->interrupts & LAST_FRAME_INTR) &&
+                    ((a->frame < a->frames - 1) || !a->element),
+                    omap_dma_intr_last_frame,
+                    (a->frames - a->frame - 2) * a->elements +
+                    (a->elements - a->element + 1))
+    INTR_CHECK(
+                    ch->interrupts & HALF_FRAME_INTR,
+                    omap_dma_intr_half_frame,
+                    (a->elements >> 1) +
+                    (a->element >= (a->elements >> 1) ? a->elements : 0) -
+                    a->element)
+    INTR_CHECK(
+                    ch->sync && ch->fs && (ch->interrupts & END_FRAME_INTR),
+                    omap_dma_intr_frame,
+                    a->elements - a->element)
+    INTR_CHECK(
+                    ch->sync && ch->fs && !ch->bs,
+                    omap_dma_intr_frame_sync,
+                    a->elements - a->element)
+
+    /* Packets */
+    INTR_CHECK(
+                    ch->fs && ch->bs &&
+                    (ch->interrupts & END_PKT_INTR) && !ch->src_sync,
+                    omap_dma_intr_packet,
+                    a->pck_elements - a->pck_element)
+    INTR_CHECK(
+                    ch->fs && ch->bs && ch->sync,
+                    omap_dma_intr_packet_sync,
+                    a->pck_elements - a->pck_element)
+
+    /* Blocks */
+    INTR_CHECK(
+                    1,
+                    omap_dma_intr_block,
+                    (a->frames - a->frame - 1) * a->elements +
+                    (a->elements - a->element))
+
+    dma->bytes = min_elems * ch->data_type;
+
+    /* Set appropriate interrupts and/or deactivate channels */
+
+#ifdef MULTI_REQ
+    /* TODO: should all of this only be done if dma->update, and otherwise
+     * inside omap_dma_transfer_generic below - check what's faster.  */
+    if (dma->update) {
+#endif
 
-                    if (ch->interrupts & END_BLOCK_INTR)
-                        ch->status |= END_BLOCK_INTR;
-                }
+    /* If the channel is element synchronized, deactivate it */
+    if (min_elems == elements[omap_dma_intr_element_sync])
+        omap_dma_deactivate_channel(s, ch);
+
+    /* If it is the last frame, set the LAST_FRAME interrupt */
+    if (min_elems == elements[omap_dma_intr_last_frame])
+        ch->status |= LAST_FRAME_INTR;
+
+    /* If exactly half of the frame was reached, set the HALF_FRAME
+       interrupt */
+    if (min_elems == elements[omap_dma_intr_half_frame])
+        ch->status |= HALF_FRAME_INTR;
+
+    /* If a full packet has been transferred, set the END_PKT interrupt */
+    if (min_elems == elements[omap_dma_intr_packet])
+        ch->status |= END_PKT_INTR;
+
+    /* If the channel is packet-synchronized, deactivate it */
+    if (min_elems == elements[omap_dma_intr_packet_sync])
+        omap_dma_deactivate_channel(s, ch);
+
+    /* If the channel is frame synchronized, deactivate it */
+    if (min_elems == elements[omap_dma_intr_frame_sync])
+        omap_dma_deactivate_channel(s, ch);
+
+    /* Set the END_FRAME interrupt */
+    if (min_elems == elements[omap_dma_intr_frame])
+        ch->status |= END_FRAME_INTR;
+
+    if (min_elems == elements[omap_dma_intr_block]) {
+        /* End of Block */
+        /* Disable the channel */
+
+        if (ch->omap_3_1_compatible_disable) {
+            omap_dma_disable_channel(s, ch);
+            if (ch->link_enabled)
+                omap_dma_enable_channel(s, &s->ch[ch->link_next_ch]);
+        } else {
+            if (!ch->auto_init)
+                omap_dma_disable_channel(s, ch);
+            else if (ch->repeat || ch->end_prog)
+                omap_dma_channel_load(ch);
+            else {
+                ch->waiting_end_prog = 1;
+                omap_dma_deactivate_channel(s, ch);
             }
         }
+
+        if (ch->interrupts & END_BLOCK_INTR)
+            ch->status |= END_BLOCK_INTR;
+    }
+
+    /* Update packet number */
+    if (ch->fs && ch->bs) {
+        a->pck_element += min_elems;
+        a->pck_element %= a->pck_elements;
+    }
+
+    /* TODO: check if we really need to update anything here or perhaps we
+     * can skip part of this.  */
+#ifndef MULTI_REQ
+    if (dma->update) {
+#endif
+        a->element += min_elems;
+
+        frames     = a->element / a->elements;
+        a->element = a->element % a->elements;
+        a->frame  += frames;
+        a->src    += min_elems * a->elem_delta[0] + frames * a->frame_delta[0];
+        a->dest   += min_elems * a->elem_delta[1] + frames * a->frame_delta[1];
+
+        /* If the channel is async, update cpc */
+        if (!ch->sync && frames)
+            ch->cpc = a->dest & 0xffff;
     }
 
     omap_dma_interrupts_update(s);
-    if (s->run_count && s->delay)
-        qemu_mod_timer(s->tm, qemu_get_clock(vm_clock) + s->delay);
 }
 
-void omap_dma_reset(struct omap_dma_s *s)
+void omap_dma_reset(struct soc_dma_s *dma)
 {
     int i;
+    struct omap_dma_s *s = dma->opaque;
 
-    qemu_del_timer(s->tm);
+    soc_dma_reset(s->dma);
     if (s->model < omap_dma_4)
         s->gcr = 0x0004;
     else
@@ -479,8 +686,6 @@ void omap_dma_reset(struct omap_dma_s *s)
     s->ocp = 0x00000000;
     memset(&s->irqstat, 0, sizeof(s->irqstat));
     memset(&s->irqen, 0, sizeof(s->irqen));
-    s->drq = 0x00000000;
-    s->run_count = 0;
     s->lcd_ch.src = emiff;
     s->lcd_ch.condition = 0;
     s->lcd_ch.interrupts = 0;
@@ -1161,7 +1366,7 @@ static int omap_dma_sys_write(struct omap_dma_s *s, int offset, uint16_t value)
 
     case 0x408:	/* DMA_GRST */
         if (value & 0x1)
-            omap_dma_reset(s);
+            omap_dma_reset(s->dma);
         break;
 
     default:
@@ -1338,27 +1543,25 @@ static void omap_dma_request(void *opaque, int drq, int req)
     struct omap_dma_s *s = (struct omap_dma_s *) opaque;
     /* The request pins are level triggered in QEMU.  */
     if (req) {
-        if (~s->drq & (1 << drq)) {
-            s->drq |= 1 << drq;
+        if (~s->dma->drqbmp & (1 << drq)) {
+            s->dma->drqbmp |= 1 << drq;
             omap_dma_process_request(s, drq);
         }
     } else
-        s->drq &= ~(1 << drq);
+        s->dma->drqbmp &= ~(1 << drq);
 }
 
+/* XXX: this won't be needed once soc_dma knows about clocks.  */
 static void omap_dma_clk_update(void *opaque, int line, int on)
 {
     struct omap_dma_s *s = (struct omap_dma_s *) opaque;
+    int i;
 
-    if (on) {
-        /* TODO: make a clever calculation */
-        s->delay = ticks_per_sec >> 8;
-        if (s->run_count)
-            qemu_mod_timer(s->tm, qemu_get_clock(vm_clock) + s->delay);
-    } else {
-        s->delay = 0;
-        qemu_del_timer(s->tm);
-    }
+    s->dma->freq = omap_clk_getrate(s->clk);
+
+    for (i = 0; i < s->chans; i ++)
+        if (s->ch[i].active)
+            soc_dma_set_request(s->ch[i].dma, on);
 }
 
 static void omap_dma_setcaps(struct omap_dma_s *s)
@@ -1407,7 +1610,7 @@ static void omap_dma_setcaps(struct omap_dma_s *s)
     }
 }
 
-struct omap_dma_s *omap_dma_init(target_phys_addr_t base, qemu_irq *irqs,
+struct soc_dma_s *omap_dma_init(target_phys_addr_t base, qemu_irq *irqs,
                 qemu_irq lcd_irq, struct omap_mpu_state_s *mpu, omap_clk clk,
                 enum omap_dma_model model)
 {
@@ -1428,24 +1631,37 @@ struct omap_dma_s *omap_dma_init(target_phys_addr_t base, qemu_irq *irqs,
     s->clk = clk;
     s->lcd_ch.irq = lcd_irq;
     s->lcd_ch.mpu = mpu;
-    omap_dma_setcaps(s);
+
+    s->dma = soc_dma_init((model <= omap_dma_3_1) ? 9 : 16);
+    s->dma->freq = omap_clk_getrate(clk);
+    s->dma->transfer_fn = omap_dma_transfer_generic;
+    s->dma->setup_fn = omap_dma_transfer_setup;
+    s->dma->drq = qemu_allocate_irqs(omap_dma_request, s, 32);
+    s->dma->opaque = s;
+
     while (num_irqs --)
         s->ch[num_irqs].irq = irqs[num_irqs];
     for (i = 0; i < 3; i ++) {
         s->ch[i].sibling = &s->ch[i + 6];
         s->ch[i + 6].sibling = &s->ch[i];
     }
-    s->tm = qemu_new_timer(vm_clock, (QEMUTimerCB *) omap_dma_channel_run, s);
+    for (i = (model <= omap_dma_3_1) ? 8 : 15; i >= 0; i --) {
+        s->ch[i].dma = &s->dma->ch[i];
+        s->dma->ch[i].opaque = &s->ch[i];
+    }
+
+    omap_dma_setcaps(s);
     omap_clk_adduser(s->clk, qemu_allocate_irqs(omap_dma_clk_update, s, 1)[0]);
-    mpu->drq = qemu_allocate_irqs(omap_dma_request, s, 32);
-    omap_dma_reset(s);
+    omap_dma_reset(s->dma);
     omap_dma_clk_update(s, 0, 1);
 
     iomemtype = cpu_register_io_memory(0, omap_dma_readfn,
                     omap_dma_writefn, s);
     cpu_register_physical_memory(s->base, memsize, iomemtype);
 
-    return s;
+    mpu->drq = s->dma->drq;
+
+    return s->dma;
 }
 
 static void omap_dma_interrupts_4_update(struct omap_dma_s *s)
@@ -1646,7 +1862,7 @@ static void omap_dma4_write(void *opaque, target_phys_addr_t addr,
 
     case 0x2c:	/* DMA4_OCP_SYSCONFIG */
         if (value & 2)						/* SOFTRESET */
-            omap_dma_reset(s);
+            omap_dma_reset(s->dma);
         s->ocp = value & 0x3321;
         if (((s->ocp >> 12) & 3) == 3)				/* MIDLEMODE */
             fprintf(stderr, "%s: invalid DMA power mode\n", __FUNCTION__);
@@ -1728,7 +1944,7 @@ static void omap_dma4_write(void *opaque, target_phys_addr_t addr,
         ch->endian[1] =(value >> 19) & 1;
         ch->endian_lock[1] =(value >> 18) & 1;
         if (ch->endian[0] != ch->endian[1])
-            fprintf(stderr, "%s: DMA endianned conversion enable attempt\n",
+            fprintf(stderr, "%s: DMA endiannes conversion enable attempt\n",
                             __FUNCTION__);
         ch->write_mode = (value >> 16) & 3;
         ch->burst[1] = (value & 0xc000) >> 14;
@@ -1746,35 +1962,43 @@ static void omap_dma4_write(void *opaque, target_phys_addr_t addr,
         break;
 
     case 0x14:	/* DMA4_CEN */
+        ch->set_update = 1;
         ch->elements = value & 0xffffff;
         break;
 
     case 0x18:	/* DMA4_CFN */
         ch->frames = value & 0xffff;
+        ch->set_update = 1;
         break;
 
     case 0x1c:	/* DMA4_CSSA */
         ch->addr[0] = (target_phys_addr_t) (uint32_t) value;
+        ch->set_update = 1;
         break;
 
     case 0x20:	/* DMA4_CDSA */
         ch->addr[1] = (target_phys_addr_t) (uint32_t) value;
+        ch->set_update = 1;
         break;
 
     case 0x24:	/* DMA4_CSEI */
         ch->element_index[0] = (int16_t) value;
+        ch->set_update = 1;
         break;
 
     case 0x28:	/* DMA4_CSFI */
         ch->frame_index[0] = (int32_t) value;
+        ch->set_update = 1;
         break;
 
     case 0x2c:	/* DMA4_CDEI */
         ch->element_index[1] = (int16_t) value;
+        ch->set_update = 1;
         break;
 
     case 0x30:	/* DMA4_CDFI */
         ch->frame_index[1] = (int32_t) value;
+        ch->set_update = 1;
         break;
 
     case 0x44:	/* DMA4_COLOR */
@@ -1806,11 +2030,11 @@ static CPUWriteMemoryFunc *omap_dma4_writefn[] = {
     omap_dma4_write,
 };
 
-struct omap_dma_s *omap_dma4_init(target_phys_addr_t base, qemu_irq *irqs,
+struct soc_dma_s *omap_dma4_init(target_phys_addr_t base, qemu_irq *irqs,
                 struct omap_mpu_state_s *mpu, int fifo,
                 int chans, omap_clk iclk, omap_clk fclk)
 {
-    int iomemtype;
+    int iomemtype, i;
     struct omap_dma_s *s = (struct omap_dma_s *)
             qemu_mallocz(sizeof(struct omap_dma_s));
 
@@ -1819,23 +2043,38 @@ struct omap_dma_s *omap_dma4_init(target_phys_addr_t base, qemu_irq *irqs,
     s->chans = chans;
     s->mpu = mpu;
     s->clk = fclk;
+
+    s->dma = soc_dma_init(s->chans);
+    s->dma->freq = omap_clk_getrate(fclk);
+    s->dma->transfer_fn = omap_dma_transfer_generic;
+    s->dma->setup_fn = omap_dma_transfer_setup;
+    s->dma->drq = qemu_allocate_irqs(omap_dma_request, s, 64);
+    s->dma->opaque = s;
+    for (i = 0; i < s->chans; i ++) {
+        s->ch[i].dma = &s->dma->ch[i];
+        s->dma->ch[i].opaque = &s->ch[i];
+    }
+
     memcpy(&s->irq, irqs, sizeof(s->irq));
     s->intr_update = omap_dma_interrupts_4_update;
+
     omap_dma_setcaps(s);
-    s->tm = qemu_new_timer(vm_clock, (QEMUTimerCB *) omap_dma_channel_run, s);
     omap_clk_adduser(s->clk, qemu_allocate_irqs(omap_dma_clk_update, s, 1)[0]);
-    mpu->drq = qemu_allocate_irqs(omap_dma_request, s, 64);
-    omap_dma_reset(s);
-    omap_dma_clk_update(s, 0, 1);
+    omap_dma_reset(s->dma);
+    omap_dma_clk_update(s, 0, !!s->dma->freq);
 
     iomemtype = cpu_register_io_memory(0, omap_dma4_readfn,
                     omap_dma4_writefn, s);
     cpu_register_physical_memory(s->base, 0x1000, iomemtype);
 
-    return s;
+    mpu->drq = s->dma->drq;
+
+    return s->dma;
 }
 
-struct omap_dma_lcd_channel_s *omap_dma_get_lcdch(struct omap_dma_s *s)
+struct omap_dma_lcd_channel_s *omap_dma_get_lcdch(struct soc_dma_s *dma)
 {
+    struct omap_dma_s *s = dma->opaque;
+
     return &s->lcd_ch;
 }
diff --git a/hw/soc_dma.c b/hw/soc_dma.c
new file mode 100644
index 0000000000..f46e260600
--- /dev/null
+++ b/hw/soc_dma.c
@@ -0,0 +1,366 @@
+/*
+ * On-chip DMA controller framework.
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ * Written by Andrzej Zaborowski <andrew@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+ * MA 02111-1307 USA
+ */
+#include "qemu-common.h"
+#include "qemu-timer.h"
+#include "soc_dma.h"
+
+void transfer_mem2mem(struct soc_dma_ch_s *ch)
+{
+    memcpy(ch->paddr[0], ch->paddr[1], ch->bytes);
+    ch->paddr[0] += ch->bytes;
+    ch->paddr[1] += ch->bytes;
+}
+
+void transfer_mem2fifo(struct soc_dma_ch_s *ch)
+{
+    ch->io_fn[1](ch->io_opaque[1], ch->paddr[0], ch->bytes);
+    ch->paddr[0] += ch->bytes;
+}
+
+void transfer_fifo2mem(struct soc_dma_ch_s *ch)
+{
+    ch->io_fn[0](ch->io_opaque[0], ch->paddr[1], ch->bytes);
+    ch->paddr[1] += ch->bytes;
+}
+
+/* This is further optimisable but isn't very important because often
+ * DMA peripherals forbid this kind of transfers and even when they don't,
+ * oprating systems may not need to use them.  */
+static void *fifo_buf;
+static int fifo_size;
+void transfer_fifo2fifo(struct soc_dma_ch_s *ch)
+{
+    if (ch->bytes < fifo_size)
+        fifo_buf = realloc(fifo_buf, fifo_size = ch->bytes);
+
+    /* Implement as transfer_fifo2linear + transfer_linear2fifo.  */
+    ch->io_fn[0](ch->io_opaque[0], fifo_buf, ch->bytes);
+    ch->io_fn[1](ch->io_opaque[1], fifo_buf, ch->bytes);
+}
+
+struct dma_s {
+    struct soc_dma_s soc;
+    int chnum;
+    uint64_t ch_enable_mask;
+    int64_t channel_freq;
+    int enabled_count;
+
+    struct memmap_entry_s {
+        enum soc_dma_port_type type;
+        target_phys_addr_t addr;
+        union {
+           struct {
+               void *opaque;
+               soc_dma_io_t fn;
+               int out;
+           } fifo;
+           struct {
+               void *base;
+               size_t size;
+           } mem;
+        } u;
+    } *memmap;
+    int memmap_size;
+
+    struct soc_dma_ch_s ch[0];
+};
+
+static void soc_dma_ch_schedule(struct soc_dma_ch_s *ch, int delay_bytes)
+{
+    int64_t now = qemu_get_clock(vm_clock);
+    struct dma_s *dma = (struct dma_s *) ch->dma;
+
+    qemu_mod_timer(ch->timer, now + delay_bytes / dma->channel_freq);
+}
+
+static void soc_dma_ch_run(void *opaque)
+{
+    struct soc_dma_ch_s *ch = (struct soc_dma_ch_s *) opaque;
+
+    ch->running = 1;
+    ch->dma->setup_fn(ch);
+    ch->transfer_fn(ch);
+    ch->running = 0;
+
+    if (ch->enable)
+        soc_dma_ch_schedule(ch, ch->bytes);
+    ch->bytes = 0;
+}
+
+static inline struct memmap_entry_s *soc_dma_lookup(struct dma_s *dma,
+                target_phys_addr_t addr)
+{
+    struct memmap_entry_s *lo;
+    int hi;
+
+    lo = dma->memmap;
+    hi = dma->memmap_size;
+
+    while (hi > 1) {
+        hi /= 2;
+        if (lo[hi].addr <= addr)
+            lo += hi;
+    }
+
+    return lo;
+}
+
+static inline enum soc_dma_port_type soc_dma_ch_update_type(
+                struct soc_dma_ch_s *ch, int port)
+{
+    struct dma_s *dma = (struct dma_s *) ch->dma;
+    struct memmap_entry_s *entry = soc_dma_lookup(dma, ch->vaddr[port]);
+
+    if (entry->type == soc_dma_port_fifo) {
+        while (entry < dma->memmap + dma->memmap_size &&
+                        entry->u.fifo.out != port)
+            entry ++;
+        if (entry->addr != ch->vaddr[port] || entry->u.fifo.out != port)
+            return soc_dma_port_other;
+
+        if (ch->type[port] != soc_dma_access_const)
+            return soc_dma_port_other;
+
+        ch->io_fn[port] = entry->u.fifo.fn;
+        ch->io_opaque[port] = entry->u.fifo.opaque;
+        return soc_dma_port_fifo;
+    } else if (entry->type == soc_dma_port_mem) {
+        if (entry->addr > ch->vaddr[port] ||
+                        entry->addr + entry->u.mem.size <= ch->vaddr[port])
+            return soc_dma_port_other;
+
+        /* TODO: support constant memory address for source port as used for
+         * drawing solid rectangles by PalmOS(R).  */
+        if (ch->type[port] != soc_dma_access_const)
+            return soc_dma_port_other;
+
+        ch->paddr[port] = (uint8_t *) entry->u.mem.base +
+                (ch->vaddr[port] - entry->addr);
+        /* TODO: save bytes left to the end of the mapping somewhere so we
+         * can check we're not reading beyond it.  */
+        return soc_dma_port_mem;
+    } else
+        return soc_dma_port_other;
+}
+
+void soc_dma_ch_update(struct soc_dma_ch_s *ch)
+{
+    enum soc_dma_port_type src, dst;
+
+    src = soc_dma_ch_update_type(ch, 0);
+    if (src == soc_dma_port_other) {
+        ch->update = 0;
+        ch->transfer_fn = ch->dma->transfer_fn;
+        return;
+    }
+    dst = soc_dma_ch_update_type(ch, 1);
+
+    /* TODO: use src and dst as array indices.  */
+    if (src == soc_dma_port_mem && dst == soc_dma_port_mem)
+        ch->transfer_fn = transfer_mem2mem;
+    else if (src == soc_dma_port_mem && dst == soc_dma_port_fifo)
+        ch->transfer_fn = transfer_mem2fifo;
+    else if (src == soc_dma_port_fifo && dst == soc_dma_port_mem)
+        ch->transfer_fn = transfer_fifo2mem;
+    else if (src == soc_dma_port_fifo && dst == soc_dma_port_fifo)
+        ch->transfer_fn = transfer_fifo2fifo;
+    else
+        ch->transfer_fn = ch->dma->transfer_fn;
+
+    ch->update = (dst != soc_dma_port_other);
+}
+
+static void soc_dma_ch_freq_update(struct dma_s *s)
+{
+    if (s->enabled_count)
+        /* We completely ignore channel priorities and stuff */
+        s->channel_freq = s->soc.freq / s->enabled_count;
+    else
+        /* TODO: Signal that we want to disable the functional clock and let
+         * the platform code decide what to do with it, i.e. check that
+         * auto-idle is enabled in the clock controller and if we are stopping
+         * the clock, do the same with any parent clocks that had only one
+         * user keeping them on and auto-idle enabled.  */;
+}
+
+void soc_dma_set_request(struct soc_dma_ch_s *ch, int level)
+{
+    struct dma_s *dma = (struct dma_s *) ch->dma;
+
+    dma->enabled_count += level - ch->enable;
+
+    if (level)
+        dma->ch_enable_mask |= 1 << ch->num;
+    else
+        dma->ch_enable_mask &= ~(1 << ch->num);
+
+    if (level != ch->enable) {
+        soc_dma_ch_freq_update(dma);
+        ch->enable = level;
+
+        if (!ch->enable)
+            qemu_del_timer(ch->timer);
+        else if (!ch->running)
+            soc_dma_ch_run(ch);
+        else
+            soc_dma_ch_schedule(ch, 1);
+    }
+}
+
+void soc_dma_reset(struct soc_dma_s *soc)
+{
+    struct dma_s *s = (struct dma_s *) soc;
+
+    s->soc.drqbmp = 0;
+    s->ch_enable_mask = 0;
+    s->enabled_count = 0;
+    soc_dma_ch_freq_update(s);
+}
+
+/* TODO: take a functional-clock argument */
+struct soc_dma_s *soc_dma_init(int n)
+{
+    int i;
+    struct dma_s *s = qemu_mallocz(sizeof(*s) + n * sizeof(*s->ch));
+
+    s->chnum = n;
+    s->soc.ch = s->ch;
+    for (i = 0; i < n; i ++) {
+        s->ch[i].dma = &s->soc;
+        s->ch[i].num = i;
+        s->ch[i].timer = qemu_new_timer(vm_clock, soc_dma_ch_run, &s->ch[i]);
+    }
+
+    soc_dma_reset(&s->soc);
+
+    return &s->soc;
+}
+
+void soc_dma_port_add_fifo(struct soc_dma_s *soc, target_phys_addr_t virt_base,
+                soc_dma_io_t fn, void *opaque, int out)
+{
+    struct memmap_entry_s *entry;
+    struct dma_s *dma = (struct dma_s *) soc;
+
+    dma->memmap = realloc(dma->memmap, sizeof(*entry) *
+                    (dma->memmap_size + 1));
+    entry = soc_dma_lookup(dma, virt_base);
+
+    if (dma->memmap_size) {
+        if (entry->type == soc_dma_port_mem) {
+            if (entry->addr <= virt_base &&
+                            entry->addr + entry->u.mem.size > virt_base) {
+                fprintf(stderr, "%s: FIFO at " TARGET_FMT_lx
+                                " collides with RAM region at " TARGET_FMT_lx
+                                "-" TARGET_FMT_lx "\n", __FUNCTION__,
+                                (target_ulong) virt_base,
+                                (target_ulong) entry->addr, (target_ulong)
+                                (entry->addr + entry->u.mem.size));
+                exit(-1);
+            }
+
+            if (entry->addr <= virt_base)
+                entry ++;
+        } else
+            while (entry < dma->memmap + dma->memmap_size &&
+                            entry->addr <= virt_base) {
+                if (entry->addr == virt_base && entry->u.fifo.out == out) {
+                    fprintf(stderr, "%s: FIFO at " TARGET_FMT_lx
+                                    " collides FIFO at " TARGET_FMT_lx "\n",
+                                    __FUNCTION__, (target_ulong) virt_base,
+                                    (target_ulong) entry->addr);
+                    exit(-1);
+                }
+
+                entry ++;
+            }
+
+        memmove(entry + 1, entry,
+                        (uint8_t *) (dma->memmap + dma->memmap_size ++) -
+                        (uint8_t *) entry);
+    } else
+        dma->memmap_size ++;
+
+    entry->addr          = virt_base;
+    entry->type          = soc_dma_port_fifo;
+    entry->u.fifo.fn     = fn;
+    entry->u.fifo.opaque = opaque;
+    entry->u.fifo.out    = out;
+}
+
+void soc_dma_port_add_mem(struct soc_dma_s *soc, uint8_t *phys_base,
+                target_phys_addr_t virt_base, size_t size)
+{
+    struct memmap_entry_s *entry;
+    struct dma_s *dma = (struct dma_s *) soc;
+
+    dma->memmap = realloc(dma->memmap, sizeof(*entry) *
+                    (dma->memmap_size + 1));
+    entry = soc_dma_lookup(dma, virt_base);
+
+    if (dma->memmap_size) {
+        if (entry->type == soc_dma_port_mem) {
+            if ((entry->addr >= virt_base && entry->addr < virt_base + size) ||
+                            (entry->addr <= virt_base &&
+                             entry->addr + entry->u.mem.size > virt_base)) {
+                fprintf(stderr, "%s: RAM at " TARGET_FMT_lx "-" TARGET_FMT_lx
+                                " collides with RAM region at " TARGET_FMT_lx
+                                "-" TARGET_FMT_lx "\n", __FUNCTION__,
+                                (target_ulong) virt_base,
+                                (target_ulong) (virt_base + size),
+                                (target_ulong) entry->addr, (target_ulong)
+                                (entry->addr + entry->u.mem.size));
+                exit(-1);
+            }
+
+            if (entry->addr <= virt_base)
+                entry ++;
+        } else {
+            if (entry->addr >= virt_base &&
+                            entry->addr < virt_base + size) {
+                fprintf(stderr, "%s: RAM at " TARGET_FMT_lx "-" TARGET_FMT_lx
+                                " collides with FIFO at " TARGET_FMT_lx
+                                "\n", __FUNCTION__,
+                                (target_ulong) virt_base,
+                                (target_ulong) (virt_base + size),
+                                (target_ulong) entry->addr);
+                exit(-1);
+            }
+
+            while (entry < dma->memmap + dma->memmap_size &&
+                            entry->addr <= virt_base)
+                entry ++;
+	}
+
+        memmove(entry + 1, entry,
+                        (uint8_t *) (dma->memmap + dma->memmap_size ++) -
+                        (uint8_t *) entry);
+    } else
+        dma->memmap_size ++;
+
+    entry->addr          = virt_base;
+    entry->type          = soc_dma_port_mem;
+    entry->u.mem.base    = phys_base;
+    entry->u.mem.size    = size;
+}
+
+/* TODO: port removal for ports like PCMCIA memory */
diff --git a/hw/soc_dma.h b/hw/soc_dma.h
new file mode 100644
index 0000000000..6ce8b9e579
--- /dev/null
+++ b/hw/soc_dma.h
@@ -0,0 +1,115 @@
+/*
+ * On-chip DMA controller framework.
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ * Written by Andrzej Zaborowski <andrew@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+ * MA 02111-1307 USA
+ */
+
+struct soc_dma_s;
+struct soc_dma_ch_s;
+typedef void (*soc_dma_io_t)(void *opaque, uint8_t *buf, int len);
+typedef void (*soc_dma_transfer_t)(struct soc_dma_ch_s *ch);
+
+enum soc_dma_port_type {
+    soc_dma_port_mem,
+    soc_dma_port_fifo,
+    soc_dma_port_other,
+};
+
+enum soc_dma_access_type {
+    soc_dma_access_const,
+    soc_dma_access_linear,
+    soc_dma_access_other,
+};
+
+struct soc_dma_ch_s {
+    /* Private */
+    struct soc_dma_s *dma;
+    int num;
+    QEMUTimer *timer;
+
+    /* Set by soc_dma.c */
+    int enable;
+    int update;
+
+    /* This should be set by dma->setup_fn().  */
+    int bytes;
+    /* Initialised by the DMA module, call soc_dma_ch_update after writing.  */
+    enum soc_dma_access_type type[2];
+    target_phys_addr_t vaddr[2];	/* Updated by .transfer_fn().  */
+    /* Private */
+    void *paddr[2];
+    soc_dma_io_t io_fn[2];
+    void *io_opaque[2];
+
+    int running;
+    soc_dma_transfer_t transfer_fn;
+
+    /* Set and used by the DMA module.  */
+    void *opaque;
+};
+
+struct soc_dma_s {
+    /* Following fields are set by the SoC DMA module and can be used
+     * by anybody.  */
+    uint64_t drqbmp;	/* Is zeroed by soc_dma_reset() */
+    qemu_irq *drq;
+    void *opaque;
+    int64_t freq;
+    soc_dma_transfer_t transfer_fn;
+    soc_dma_transfer_t setup_fn;
+    /* Set by soc_dma_init() for use by the DMA module.  */
+    struct soc_dma_ch_s *ch;
+};
+
+/* Call to activate or stop a DMA channel.  */
+void soc_dma_set_request(struct soc_dma_ch_s *ch, int level);
+/* Call after every write to one of the following fields and before
+ * calling soc_dma_set_request(ch, 1):
+ *   ch->type[0...1],
+ *   ch->vaddr[0...1],
+ *   ch->paddr[0...1],
+ * or after a soc_dma_port_add_fifo() or soc_dma_port_add_mem().  */
+void soc_dma_ch_update(struct soc_dma_ch_s *ch);
+
+/* The SoC should call this when the DMA module is being reset.  */
+void soc_dma_reset(struct soc_dma_s *s);
+struct soc_dma_s *soc_dma_init(int n);
+
+void soc_dma_port_add_fifo(struct soc_dma_s *dma, target_phys_addr_t virt_base,
+                soc_dma_io_t fn, void *opaque, int out);
+void soc_dma_port_add_mem(struct soc_dma_s *dma, uint8_t *phys_base,
+                target_phys_addr_t virt_base, size_t size);
+
+static inline void soc_dma_port_add_fifo_in(struct soc_dma_s *dma,
+                target_phys_addr_t virt_base, soc_dma_io_t fn, void *opaque)
+{
+    return soc_dma_port_add_fifo(dma, virt_base, fn, opaque, 0);
+}
+
+static inline void soc_dma_port_add_fifo_out(struct soc_dma_s *dma,
+                target_phys_addr_t virt_base, soc_dma_io_t fn, void *opaque)
+{
+    return soc_dma_port_add_fifo(dma, virt_base, fn, opaque, 1);
+}
+
+static inline void soc_dma_port_add_mem_ram(struct soc_dma_s *dma,
+                ram_addr_t offset, target_phys_addr_t virt_base, size_t size)
+{
+    return soc_dma_port_add_mem(dma, phys_ram_base + offset, virt_base, size);
+}