xref: /qemu/hw/ssi/aspeed_smc.c (revision a27bd6c779badb8d76e4430d810ef710a1b98f4e)
1 /*
2  * ASPEED AST2400 SMC Controller (SPI Flash Only)
3  *
4  * Copyright (C) 2016 IBM Corp.
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "hw/sysbus.h"
27 #include "migration/vmstate.h"
28 #include "sysemu/sysemu.h"
29 #include "qemu/log.h"
30 #include "qemu/module.h"
31 #include "qemu/error-report.h"
32 
33 #include "hw/irq.h"
34 #include "hw/qdev-properties.h"
35 #include "hw/ssi/aspeed_smc.h"
36 
37 /* CE Type Setting Register */
38 #define R_CONF            (0x00 / 4)
39 #define   CONF_LEGACY_DISABLE  (1 << 31)
40 #define   CONF_ENABLE_W4       20
41 #define   CONF_ENABLE_W3       19
42 #define   CONF_ENABLE_W2       18
43 #define   CONF_ENABLE_W1       17
44 #define   CONF_ENABLE_W0       16
45 #define   CONF_FLASH_TYPE4     8
46 #define   CONF_FLASH_TYPE3     6
47 #define   CONF_FLASH_TYPE2     4
48 #define   CONF_FLASH_TYPE1     2
49 #define   CONF_FLASH_TYPE0     0
50 #define      CONF_FLASH_TYPE_NOR   0x0
51 #define      CONF_FLASH_TYPE_NAND  0x1
52 #define      CONF_FLASH_TYPE_SPI   0x2
53 
54 /* CE Control Register */
55 #define R_CE_CTRL            (0x04 / 4)
56 #define   CTRL_EXTENDED4       4  /* 32 bit addressing for SPI */
57 #define   CTRL_EXTENDED3       3  /* 32 bit addressing for SPI */
58 #define   CTRL_EXTENDED2       2  /* 32 bit addressing for SPI */
59 #define   CTRL_EXTENDED1       1  /* 32 bit addressing for SPI */
60 #define   CTRL_EXTENDED0       0  /* 32 bit addressing for SPI */
61 
62 /* Interrupt Control and Status Register */
63 #define R_INTR_CTRL       (0x08 / 4)
64 #define   INTR_CTRL_DMA_STATUS            (1 << 11)
65 #define   INTR_CTRL_CMD_ABORT_STATUS      (1 << 10)
66 #define   INTR_CTRL_WRITE_PROTECT_STATUS  (1 << 9)
67 #define   INTR_CTRL_DMA_EN                (1 << 3)
68 #define   INTR_CTRL_CMD_ABORT_EN          (1 << 2)
69 #define   INTR_CTRL_WRITE_PROTECT_EN      (1 << 1)
70 
71 /* CEx Control Register */
72 #define R_CTRL0           (0x10 / 4)
73 #define   CTRL_IO_DUAL_DATA        (1 << 29)
74 #define   CTRL_IO_DUAL_ADDR_DATA   (1 << 28) /* Includes dummies */
75 #define   CTRL_CMD_SHIFT           16
76 #define   CTRL_CMD_MASK            0xff
77 #define   CTRL_DUMMY_HIGH_SHIFT    14
78 #define   CTRL_AST2400_SPI_4BYTE   (1 << 13)
79 #define   CTRL_DUMMY_LOW_SHIFT     6 /* 2 bits [7:6] */
80 #define   CTRL_CE_STOP_ACTIVE      (1 << 2)
81 #define   CTRL_CMD_MODE_MASK       0x3
82 #define     CTRL_READMODE          0x0
83 #define     CTRL_FREADMODE         0x1
84 #define     CTRL_WRITEMODE         0x2
85 #define     CTRL_USERMODE          0x3
86 #define R_CTRL1           (0x14 / 4)
87 #define R_CTRL2           (0x18 / 4)
88 #define R_CTRL3           (0x1C / 4)
89 #define R_CTRL4           (0x20 / 4)
90 
91 /* CEx Segment Address Register */
92 #define R_SEG_ADDR0       (0x30 / 4)
93 #define   SEG_END_SHIFT        24   /* 8MB units */
94 #define   SEG_END_MASK         0xff
95 #define   SEG_START_SHIFT      16   /* address bit [A29-A23] */
96 #define   SEG_START_MASK       0xff
97 #define R_SEG_ADDR1       (0x34 / 4)
98 #define R_SEG_ADDR2       (0x38 / 4)
99 #define R_SEG_ADDR3       (0x3C / 4)
100 #define R_SEG_ADDR4       (0x40 / 4)
101 
102 /* Misc Control Register #1 */
103 #define R_MISC_CTRL1      (0x50 / 4)
104 
105 /* SPI dummy cycle data */
106 #define R_DUMMY_DATA      (0x54 / 4)
107 
108 /* DMA Control/Status Register */
109 #define R_DMA_CTRL        (0x80 / 4)
110 #define   DMA_CTRL_DELAY_MASK   0xf
111 #define   DMA_CTRL_DELAY_SHIFT  8
112 #define   DMA_CTRL_FREQ_MASK    0xf
113 #define   DMA_CTRL_FREQ_SHIFT   4
114 #define   DMA_CTRL_MODE         (1 << 3)
115 #define   DMA_CTRL_CKSUM        (1 << 2)
116 #define   DMA_CTRL_DIR          (1 << 1)
117 #define   DMA_CTRL_EN           (1 << 0)
118 
119 /* DMA Flash Side Address */
120 #define R_DMA_FLASH_ADDR  (0x84 / 4)
121 
122 /* DMA DRAM Side Address */
123 #define R_DMA_DRAM_ADDR   (0x88 / 4)
124 
125 /* DMA Length Register */
126 #define R_DMA_LEN         (0x8C / 4)
127 
128 /* Checksum Calculation Result */
129 #define R_DMA_CHECKSUM    (0x90 / 4)
130 
131 /* Misc Control Register #2 */
132 #define R_TIMINGS         (0x94 / 4)
133 
134 /* SPI controller registers and bits */
135 #define R_SPI_CONF        (0x00 / 4)
136 #define   SPI_CONF_ENABLE_W0   0
137 #define R_SPI_CTRL0       (0x4 / 4)
138 #define R_SPI_MISC_CTRL   (0x10 / 4)
139 #define R_SPI_TIMINGS     (0x14 / 4)
140 
141 #define ASPEED_SMC_R_SPI_MAX (0x20 / 4)
142 #define ASPEED_SMC_R_SMC_MAX (0x20 / 4)
143 
144 #define ASPEED_SOC_SMC_FLASH_BASE   0x10000000
145 #define ASPEED_SOC_FMC_FLASH_BASE   0x20000000
146 #define ASPEED_SOC_SPI_FLASH_BASE   0x30000000
147 #define ASPEED_SOC_SPI2_FLASH_BASE  0x38000000
148 
149 /* Flash opcodes. */
150 #define SPI_OP_READ       0x03    /* Read data bytes (low frequency) */
151 
152 #define SNOOP_OFF         0xFF
153 #define SNOOP_START       0x0
154 
155 /*
156  * Default segments mapping addresses and size for each slave per
157  * controller. These can be changed when board is initialized with the
158  * Segment Address Registers.
159  */
160 static const AspeedSegments aspeed_segments_legacy[] = {
161     { 0x10000000, 32 * 1024 * 1024 },
162 };
163 
164 static const AspeedSegments aspeed_segments_fmc[] = {
165     { 0x20000000, 64 * 1024 * 1024 }, /* start address is readonly */
166     { 0x24000000, 32 * 1024 * 1024 },
167     { 0x26000000, 32 * 1024 * 1024 },
168     { 0x28000000, 32 * 1024 * 1024 },
169     { 0x2A000000, 32 * 1024 * 1024 }
170 };
171 
172 static const AspeedSegments aspeed_segments_spi[] = {
173     { 0x30000000, 64 * 1024 * 1024 },
174 };
175 
176 static const AspeedSegments aspeed_segments_ast2500_fmc[] = {
177     { 0x20000000, 128 * 1024 * 1024 }, /* start address is readonly */
178     { 0x28000000,  32 * 1024 * 1024 },
179     { 0x2A000000,  32 * 1024 * 1024 },
180 };
181 
182 static const AspeedSegments aspeed_segments_ast2500_spi1[] = {
183     { 0x30000000, 32 * 1024 * 1024 }, /* start address is readonly */
184     { 0x32000000, 96 * 1024 * 1024 }, /* end address is readonly */
185 };
186 
187 static const AspeedSegments aspeed_segments_ast2500_spi2[] = {
188     { 0x38000000, 32 * 1024 * 1024 }, /* start address is readonly */
189     { 0x3A000000, 96 * 1024 * 1024 }, /* end address is readonly */
190 };
191 
192 static const AspeedSMCController controllers[] = {
193     {
194         .name              = "aspeed.smc.smc",
195         .r_conf            = R_CONF,
196         .r_ce_ctrl         = R_CE_CTRL,
197         .r_ctrl0           = R_CTRL0,
198         .r_timings         = R_TIMINGS,
199         .conf_enable_w0    = CONF_ENABLE_W0,
200         .max_slaves        = 5,
201         .segments          = aspeed_segments_legacy,
202         .flash_window_base = ASPEED_SOC_SMC_FLASH_BASE,
203         .flash_window_size = 0x6000000,
204         .has_dma           = false,
205         .nregs             = ASPEED_SMC_R_SMC_MAX,
206     }, {
207         .name              = "aspeed.smc.fmc",
208         .r_conf            = R_CONF,
209         .r_ce_ctrl         = R_CE_CTRL,
210         .r_ctrl0           = R_CTRL0,
211         .r_timings         = R_TIMINGS,
212         .conf_enable_w0    = CONF_ENABLE_W0,
213         .max_slaves        = 5,
214         .segments          = aspeed_segments_fmc,
215         .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE,
216         .flash_window_size = 0x10000000,
217         .has_dma           = true,
218         .nregs             = ASPEED_SMC_R_MAX,
219     }, {
220         .name              = "aspeed.smc.spi",
221         .r_conf            = R_SPI_CONF,
222         .r_ce_ctrl         = 0xff,
223         .r_ctrl0           = R_SPI_CTRL0,
224         .r_timings         = R_SPI_TIMINGS,
225         .conf_enable_w0    = SPI_CONF_ENABLE_W0,
226         .max_slaves        = 1,
227         .segments          = aspeed_segments_spi,
228         .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE,
229         .flash_window_size = 0x10000000,
230         .has_dma           = false,
231         .nregs             = ASPEED_SMC_R_SPI_MAX,
232     }, {
233         .name              = "aspeed.smc.ast2500-fmc",
234         .r_conf            = R_CONF,
235         .r_ce_ctrl         = R_CE_CTRL,
236         .r_ctrl0           = R_CTRL0,
237         .r_timings         = R_TIMINGS,
238         .conf_enable_w0    = CONF_ENABLE_W0,
239         .max_slaves        = 3,
240         .segments          = aspeed_segments_ast2500_fmc,
241         .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE,
242         .flash_window_size = 0x10000000,
243         .has_dma           = true,
244         .nregs             = ASPEED_SMC_R_MAX,
245     }, {
246         .name              = "aspeed.smc.ast2500-spi1",
247         .r_conf            = R_CONF,
248         .r_ce_ctrl         = R_CE_CTRL,
249         .r_ctrl0           = R_CTRL0,
250         .r_timings         = R_TIMINGS,
251         .conf_enable_w0    = CONF_ENABLE_W0,
252         .max_slaves        = 2,
253         .segments          = aspeed_segments_ast2500_spi1,
254         .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE,
255         .flash_window_size = 0x8000000,
256         .has_dma           = false,
257         .nregs             = ASPEED_SMC_R_MAX,
258     }, {
259         .name              = "aspeed.smc.ast2500-spi2",
260         .r_conf            = R_CONF,
261         .r_ce_ctrl         = R_CE_CTRL,
262         .r_ctrl0           = R_CTRL0,
263         .r_timings         = R_TIMINGS,
264         .conf_enable_w0    = CONF_ENABLE_W0,
265         .max_slaves        = 2,
266         .segments          = aspeed_segments_ast2500_spi2,
267         .flash_window_base = ASPEED_SOC_SPI2_FLASH_BASE,
268         .flash_window_size = 0x8000000,
269         .has_dma           = false,
270         .nregs             = ASPEED_SMC_R_MAX,
271     },
272 };
273 
274 /*
275  * The Segment Register uses a 8MB unit to encode the start address
276  * and the end address of the mapping window of a flash SPI slave :
277  *
278  *        | byte 1 | byte 2 | byte 3 | byte 4 |
279  *        +--------+--------+--------+--------+
280  *        |  end   |  start |   0    |   0    |
281  *
282  */
283 static inline uint32_t aspeed_smc_segment_to_reg(const AspeedSegments *seg)
284 {
285     uint32_t reg = 0;
286     reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT;
287     reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT;
288     return reg;
289 }
290 
291 static inline void aspeed_smc_reg_to_segment(uint32_t reg, AspeedSegments *seg)
292 {
293     seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23;
294     seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr;
295 }
296 
297 static bool aspeed_smc_flash_overlap(const AspeedSMCState *s,
298                                      const AspeedSegments *new,
299                                      int cs)
300 {
301     AspeedSegments seg;
302     int i;
303 
304     for (i = 0; i < s->ctrl->max_slaves; i++) {
305         if (i == cs) {
306             continue;
307         }
308 
309         aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + i], &seg);
310 
311         if (new->addr + new->size > seg.addr &&
312             new->addr < seg.addr + seg.size) {
313             qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment CS%d [ 0x%"
314                           HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with "
315                           "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n",
316                           s->ctrl->name, cs, new->addr, new->addr + new->size,
317                           i, seg.addr, seg.addr + seg.size);
318             return true;
319         }
320     }
321     return false;
322 }
323 
324 static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
325                                          uint64_t new)
326 {
327     AspeedSMCFlash *fl = &s->flashes[cs];
328     AspeedSegments seg;
329 
330     aspeed_smc_reg_to_segment(new, &seg);
331 
332     /* The start address of CS0 is read-only */
333     if (cs == 0 && seg.addr != s->ctrl->flash_window_base) {
334         qemu_log_mask(LOG_GUEST_ERROR,
335                       "%s: Tried to change CS0 start address to 0x%"
336                       HWADDR_PRIx "\n", s->ctrl->name, seg.addr);
337         seg.addr = s->ctrl->flash_window_base;
338         new = aspeed_smc_segment_to_reg(&seg);
339     }
340 
341     /*
342      * The end address of the AST2500 spi controllers is also
343      * read-only.
344      */
345     if ((s->ctrl->segments == aspeed_segments_ast2500_spi1 ||
346          s->ctrl->segments == aspeed_segments_ast2500_spi2) &&
347         cs == s->ctrl->max_slaves &&
348         seg.addr + seg.size != s->ctrl->segments[cs].addr +
349         s->ctrl->segments[cs].size) {
350         qemu_log_mask(LOG_GUEST_ERROR,
351                       "%s: Tried to change CS%d end address to 0x%"
352                       HWADDR_PRIx "\n", s->ctrl->name, cs, seg.addr + seg.size);
353         seg.size = s->ctrl->segments[cs].addr + s->ctrl->segments[cs].size -
354             seg.addr;
355         new = aspeed_smc_segment_to_reg(&seg);
356     }
357 
358     /* Keep the segment in the overall flash window */
359     if (seg.addr + seg.size <= s->ctrl->flash_window_base ||
360         seg.addr > s->ctrl->flash_window_base + s->ctrl->flash_window_size) {
361         qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is invalid : "
362                       "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n",
363                       s->ctrl->name, cs, seg.addr, seg.addr + seg.size);
364         return;
365     }
366 
367     /* Check start address vs. alignment */
368     if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) {
369         qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is not "
370                       "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n",
371                       s->ctrl->name, cs, seg.addr, seg.addr + seg.size);
372     }
373 
374     /* And segments should not overlap (in the specs) */
375     aspeed_smc_flash_overlap(s, &seg, cs);
376 
377     /* All should be fine now to move the region */
378     memory_region_transaction_begin();
379     memory_region_set_size(&fl->mmio, seg.size);
380     memory_region_set_address(&fl->mmio, seg.addr - s->ctrl->flash_window_base);
381     memory_region_set_enabled(&fl->mmio, true);
382     memory_region_transaction_commit();
383 
384     s->regs[R_SEG_ADDR0 + cs] = new;
385 }
386 
387 static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr,
388                                               unsigned size)
389 {
390     qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u"
391                   PRIx64 "\n", __func__, addr, size);
392     return 0;
393 }
394 
395 static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr,
396                                            uint64_t data, unsigned size)
397 {
398     qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u: 0x%"
399                   PRIx64 "\n", __func__, addr, size, data);
400 }
401 
402 static const MemoryRegionOps aspeed_smc_flash_default_ops = {
403     .read = aspeed_smc_flash_default_read,
404     .write = aspeed_smc_flash_default_write,
405     .endianness = DEVICE_LITTLE_ENDIAN,
406     .valid = {
407         .min_access_size = 1,
408         .max_access_size = 4,
409     },
410 };
411 
412 static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl)
413 {
414     const AspeedSMCState *s = fl->controller;
415 
416     return s->regs[s->r_ctrl0 + fl->id] & CTRL_CMD_MODE_MASK;
417 }
418 
419 static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl)
420 {
421     const AspeedSMCState *s = fl->controller;
422 
423     return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->id));
424 }
425 
426 static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl)
427 {
428     const AspeedSMCState *s = fl->controller;
429     int cmd = (s->regs[s->r_ctrl0 + fl->id] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK;
430 
431     /* In read mode, the default SPI command is READ (0x3). In other
432      * modes, the command should necessarily be defined */
433     if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) {
434         cmd = SPI_OP_READ;
435     }
436 
437     if (!cmd) {
438         qemu_log_mask(LOG_GUEST_ERROR, "%s: no command defined for mode %d\n",
439                       __func__, aspeed_smc_flash_mode(fl));
440     }
441 
442     return cmd;
443 }
444 
445 static inline int aspeed_smc_flash_is_4byte(const AspeedSMCFlash *fl)
446 {
447     const AspeedSMCState *s = fl->controller;
448 
449     if (s->ctrl->segments == aspeed_segments_spi) {
450         return s->regs[s->r_ctrl0] & CTRL_AST2400_SPI_4BYTE;
451     } else {
452         return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->id));
453     }
454 }
455 
456 static inline bool aspeed_smc_is_ce_stop_active(const AspeedSMCFlash *fl)
457 {
458     const AspeedSMCState *s = fl->controller;
459 
460     return s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE;
461 }
462 
463 static void aspeed_smc_flash_select(AspeedSMCFlash *fl)
464 {
465     AspeedSMCState *s = fl->controller;
466 
467     s->regs[s->r_ctrl0 + fl->id] &= ~CTRL_CE_STOP_ACTIVE;
468     qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
469 }
470 
471 static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl)
472 {
473     AspeedSMCState *s = fl->controller;
474 
475     s->regs[s->r_ctrl0 + fl->id] |= CTRL_CE_STOP_ACTIVE;
476     qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
477 }
478 
479 static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
480                                               uint32_t addr)
481 {
482     const AspeedSMCState *s = fl->controller;
483     AspeedSegments seg;
484 
485     aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + fl->id], &seg);
486     if ((addr % seg.size) != addr) {
487         qemu_log_mask(LOG_GUEST_ERROR,
488                       "%s: invalid address 0x%08x for CS%d segment : "
489                       "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n",
490                       s->ctrl->name, addr, fl->id, seg.addr,
491                       seg.addr + seg.size);
492         addr %= seg.size;
493     }
494 
495     return addr;
496 }
497 
498 static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl)
499 {
500     const AspeedSMCState *s = fl->controller;
501     uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->id];
502     uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1;
503     uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3;
504     uint32_t dummies = ((dummy_high << 2) | dummy_low) * 8;
505 
506     if (r_ctrl0 & CTRL_IO_DUAL_ADDR_DATA) {
507         dummies /= 2;
508     }
509 
510     return dummies;
511 }
512 
513 static void aspeed_smc_flash_setup(AspeedSMCFlash *fl, uint32_t addr)
514 {
515     const AspeedSMCState *s = fl->controller;
516     uint8_t cmd = aspeed_smc_flash_cmd(fl);
517     int i;
518 
519     /* Flash access can not exceed CS segment */
520     addr = aspeed_smc_check_segment_addr(fl, addr);
521 
522     ssi_transfer(s->spi, cmd);
523 
524     if (aspeed_smc_flash_is_4byte(fl)) {
525         ssi_transfer(s->spi, (addr >> 24) & 0xff);
526     }
527     ssi_transfer(s->spi, (addr >> 16) & 0xff);
528     ssi_transfer(s->spi, (addr >> 8) & 0xff);
529     ssi_transfer(s->spi, (addr & 0xff));
530 
531     /*
532      * Use fake transfers to model dummy bytes. The value should
533      * be configured to some non-zero value in fast read mode and
534      * zero in read mode. But, as the HW allows inconsistent
535      * settings, let's check for fast read mode.
536      */
537     if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) {
538         for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) {
539             ssi_transfer(fl->controller->spi, s->regs[R_DUMMY_DATA] & 0xff);
540         }
541     }
542 }
543 
544 static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
545 {
546     AspeedSMCFlash *fl = opaque;
547     AspeedSMCState *s = fl->controller;
548     uint64_t ret = 0;
549     int i;
550 
551     switch (aspeed_smc_flash_mode(fl)) {
552     case CTRL_USERMODE:
553         for (i = 0; i < size; i++) {
554             ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
555         }
556         break;
557     case CTRL_READMODE:
558     case CTRL_FREADMODE:
559         aspeed_smc_flash_select(fl);
560         aspeed_smc_flash_setup(fl, addr);
561 
562         for (i = 0; i < size; i++) {
563             ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
564         }
565 
566         aspeed_smc_flash_unselect(fl);
567         break;
568     default:
569         qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n",
570                       __func__, aspeed_smc_flash_mode(fl));
571     }
572 
573     return ret;
574 }
575 
576 /*
577  * TODO (clg@kaod.org): stolen from xilinx_spips.c. Should move to a
578  * common include header.
579  */
580 typedef enum {
581     READ = 0x3,         READ_4 = 0x13,
582     FAST_READ = 0xb,    FAST_READ_4 = 0x0c,
583     DOR = 0x3b,         DOR_4 = 0x3c,
584     QOR = 0x6b,         QOR_4 = 0x6c,
585     DIOR = 0xbb,        DIOR_4 = 0xbc,
586     QIOR = 0xeb,        QIOR_4 = 0xec,
587 
588     PP = 0x2,           PP_4 = 0x12,
589     DPP = 0xa2,
590     QPP = 0x32,         QPP_4 = 0x34,
591 } FlashCMD;
592 
593 static int aspeed_smc_num_dummies(uint8_t command)
594 {
595     switch (command) { /* check for dummies */
596     case READ: /* no dummy bytes/cycles */
597     case PP:
598     case DPP:
599     case QPP:
600     case READ_4:
601     case PP_4:
602     case QPP_4:
603         return 0;
604     case FAST_READ:
605     case DOR:
606     case QOR:
607     case DOR_4:
608     case QOR_4:
609         return 1;
610     case DIOR:
611     case FAST_READ_4:
612     case DIOR_4:
613         return 2;
614     case QIOR:
615     case QIOR_4:
616         return 4;
617     default:
618         return -1;
619     }
620 }
621 
622 static bool aspeed_smc_do_snoop(AspeedSMCFlash *fl,  uint64_t data,
623                                 unsigned size)
624 {
625     AspeedSMCState *s = fl->controller;
626     uint8_t addr_width = aspeed_smc_flash_is_4byte(fl) ? 4 : 3;
627 
628     if (s->snoop_index == SNOOP_OFF) {
629         return false; /* Do nothing */
630 
631     } else if (s->snoop_index == SNOOP_START) {
632         uint8_t cmd = data & 0xff;
633         int ndummies = aspeed_smc_num_dummies(cmd);
634 
635         /*
636          * No dummy cycles are expected with the current command. Turn
637          * off snooping and let the transfer proceed normally.
638          */
639         if (ndummies <= 0) {
640             s->snoop_index = SNOOP_OFF;
641             return false;
642         }
643 
644         s->snoop_dummies = ndummies * 8;
645 
646     } else if (s->snoop_index >= addr_width + 1) {
647 
648         /* The SPI transfer has reached the dummy cycles sequence */
649         for (; s->snoop_dummies; s->snoop_dummies--) {
650             ssi_transfer(s->spi, s->regs[R_DUMMY_DATA] & 0xff);
651         }
652 
653         /* If no more dummy cycles are expected, turn off snooping */
654         if (!s->snoop_dummies) {
655             s->snoop_index = SNOOP_OFF;
656         } else {
657             s->snoop_index += size;
658         }
659 
660         /*
661          * Dummy cycles have been faked already. Ignore the current
662          * SPI transfer
663          */
664         return true;
665     }
666 
667     s->snoop_index += size;
668     return false;
669 }
670 
671 static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,
672                                    unsigned size)
673 {
674     AspeedSMCFlash *fl = opaque;
675     AspeedSMCState *s = fl->controller;
676     int i;
677 
678     if (!aspeed_smc_is_writable(fl)) {
679         qemu_log_mask(LOG_GUEST_ERROR, "%s: flash is not writable at 0x%"
680                       HWADDR_PRIx "\n", __func__, addr);
681         return;
682     }
683 
684     switch (aspeed_smc_flash_mode(fl)) {
685     case CTRL_USERMODE:
686         if (aspeed_smc_do_snoop(fl, data, size)) {
687             break;
688         }
689 
690         for (i = 0; i < size; i++) {
691             ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
692         }
693         break;
694     case CTRL_WRITEMODE:
695         aspeed_smc_flash_select(fl);
696         aspeed_smc_flash_setup(fl, addr);
697 
698         for (i = 0; i < size; i++) {
699             ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
700         }
701 
702         aspeed_smc_flash_unselect(fl);
703         break;
704     default:
705         qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n",
706                       __func__, aspeed_smc_flash_mode(fl));
707     }
708 }
709 
710 static const MemoryRegionOps aspeed_smc_flash_ops = {
711     .read = aspeed_smc_flash_read,
712     .write = aspeed_smc_flash_write,
713     .endianness = DEVICE_LITTLE_ENDIAN,
714     .valid = {
715         .min_access_size = 1,
716         .max_access_size = 4,
717     },
718 };
719 
720 static void aspeed_smc_flash_update_cs(AspeedSMCFlash *fl)
721 {
722     AspeedSMCState *s = fl->controller;
723 
724     s->snoop_index = aspeed_smc_is_ce_stop_active(fl) ? SNOOP_OFF : SNOOP_START;
725 
726     qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
727 }
728 
729 static void aspeed_smc_reset(DeviceState *d)
730 {
731     AspeedSMCState *s = ASPEED_SMC(d);
732     int i;
733 
734     memset(s->regs, 0, sizeof s->regs);
735 
736     /* Pretend DMA is done (u-boot initialization) */
737     s->regs[R_INTR_CTRL] = INTR_CTRL_DMA_STATUS;
738 
739     /* Unselect all slaves */
740     for (i = 0; i < s->num_cs; ++i) {
741         s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE;
742         qemu_set_irq(s->cs_lines[i], true);
743     }
744 
745     /* setup default segment register values for all */
746     for (i = 0; i < s->ctrl->max_slaves; ++i) {
747         s->regs[R_SEG_ADDR0 + i] =
748             aspeed_smc_segment_to_reg(&s->ctrl->segments[i]);
749     }
750 
751     /* HW strapping flash type for FMC controllers  */
752     if (s->ctrl->segments == aspeed_segments_ast2500_fmc) {
753         /* flash type is fixed to SPI for CE0 and CE1 */
754         s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0);
755         s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1);
756     }
757 
758     /* HW strapping for AST2400 FMC controllers (SCU70). Let's use the
759      * configuration of the palmetto-bmc machine */
760     if (s->ctrl->segments == aspeed_segments_fmc) {
761         s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0);
762     }
763 
764     s->snoop_index = SNOOP_OFF;
765     s->snoop_dummies = 0;
766 }
767 
768 static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
769 {
770     AspeedSMCState *s = ASPEED_SMC(opaque);
771 
772     addr >>= 2;
773 
774     if (addr == s->r_conf ||
775         addr == s->r_timings ||
776         addr == s->r_ce_ctrl ||
777         addr == R_INTR_CTRL ||
778         addr == R_DUMMY_DATA ||
779         (addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) ||
780         (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->ctrl->max_slaves)) {
781         return s->regs[addr];
782     } else {
783         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
784                       __func__, addr);
785         return -1;
786     }
787 }
788 
789 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
790                              unsigned int size)
791 {
792     AspeedSMCState *s = ASPEED_SMC(opaque);
793     uint32_t value = data;
794 
795     addr >>= 2;
796 
797     if (addr == s->r_conf ||
798         addr == s->r_timings ||
799         addr == s->r_ce_ctrl) {
800         s->regs[addr] = value;
801     } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) {
802         int cs = addr - s->r_ctrl0;
803         s->regs[addr] = value;
804         aspeed_smc_flash_update_cs(&s->flashes[cs]);
805     } else if (addr >= R_SEG_ADDR0 &&
806                addr < R_SEG_ADDR0 + s->ctrl->max_slaves) {
807         int cs = addr - R_SEG_ADDR0;
808 
809         if (value != s->regs[R_SEG_ADDR0 + cs]) {
810             aspeed_smc_flash_set_segment(s, cs, value);
811         }
812     } else if (addr == R_DUMMY_DATA) {
813         s->regs[addr] = value & 0xff;
814     } else {
815         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
816                       __func__, addr);
817         return;
818     }
819 }
820 
821 static const MemoryRegionOps aspeed_smc_ops = {
822     .read = aspeed_smc_read,
823     .write = aspeed_smc_write,
824     .endianness = DEVICE_LITTLE_ENDIAN,
825     .valid.unaligned = true,
826 };
827 
828 static void aspeed_smc_realize(DeviceState *dev, Error **errp)
829 {
830     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
831     AspeedSMCState *s = ASPEED_SMC(dev);
832     AspeedSMCClass *mc = ASPEED_SMC_GET_CLASS(s);
833     int i;
834     char name[32];
835     hwaddr offset = 0;
836 
837     s->ctrl = mc->ctrl;
838 
839     /* keep a copy under AspeedSMCState to speed up accesses */
840     s->r_conf = s->ctrl->r_conf;
841     s->r_ce_ctrl = s->ctrl->r_ce_ctrl;
842     s->r_ctrl0 = s->ctrl->r_ctrl0;
843     s->r_timings = s->ctrl->r_timings;
844     s->conf_enable_w0 = s->ctrl->conf_enable_w0;
845 
846     /* Enforce some real HW limits */
847     if (s->num_cs > s->ctrl->max_slaves) {
848         qemu_log_mask(LOG_GUEST_ERROR, "%s: num_cs cannot exceed: %d\n",
849                       __func__, s->ctrl->max_slaves);
850         s->num_cs = s->ctrl->max_slaves;
851     }
852 
853     s->spi = ssi_create_bus(dev, "spi");
854 
855     /* Setup cs_lines for slaves */
856     sysbus_init_irq(sbd, &s->irq);
857     s->cs_lines = g_new0(qemu_irq, s->num_cs);
858     ssi_auto_connect_slaves(dev, s->cs_lines, s->spi);
859 
860     for (i = 0; i < s->num_cs; ++i) {
861         sysbus_init_irq(sbd, &s->cs_lines[i]);
862     }
863 
864     /* The memory region for the controller registers */
865     memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s,
866                           s->ctrl->name, s->ctrl->nregs * 4);
867     sysbus_init_mmio(sbd, &s->mmio);
868 
869     /*
870      * The container memory region representing the address space
871      * window in which the flash modules are mapped. The size and
872      * address depends on the SoC model and controller type.
873      */
874     snprintf(name, sizeof(name), "%s.flash", s->ctrl->name);
875 
876     memory_region_init_io(&s->mmio_flash, OBJECT(s),
877                           &aspeed_smc_flash_default_ops, s, name,
878                           s->ctrl->flash_window_size);
879     sysbus_init_mmio(sbd, &s->mmio_flash);
880 
881     s->flashes = g_new0(AspeedSMCFlash, s->ctrl->max_slaves);
882 
883     /*
884      * Let's create a sub memory region for each possible slave. All
885      * have a configurable memory segment in the overall flash mapping
886      * window of the controller but, there is not necessarily a flash
887      * module behind to handle the memory accesses. This depends on
888      * the board configuration.
889      */
890     for (i = 0; i < s->ctrl->max_slaves; ++i) {
891         AspeedSMCFlash *fl = &s->flashes[i];
892 
893         snprintf(name, sizeof(name), "%s.%d", s->ctrl->name, i);
894 
895         fl->id = i;
896         fl->controller = s;
897         fl->size = s->ctrl->segments[i].size;
898         memory_region_init_io(&fl->mmio, OBJECT(s), &aspeed_smc_flash_ops,
899                               fl, name, fl->size);
900         memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio);
901         offset += fl->size;
902     }
903 }
904 
905 static const VMStateDescription vmstate_aspeed_smc = {
906     .name = "aspeed.smc",
907     .version_id = 2,
908     .minimum_version_id = 2,
909     .fields = (VMStateField[]) {
910         VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX),
911         VMSTATE_UINT8(snoop_index, AspeedSMCState),
912         VMSTATE_UINT8(snoop_dummies, AspeedSMCState),
913         VMSTATE_END_OF_LIST()
914     }
915 };
916 
917 static Property aspeed_smc_properties[] = {
918     DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1),
919     DEFINE_PROP_UINT64("sdram-base", AspeedSMCState, sdram_base, 0),
920     DEFINE_PROP_END_OF_LIST(),
921 };
922 
923 static void aspeed_smc_class_init(ObjectClass *klass, void *data)
924 {
925     DeviceClass *dc = DEVICE_CLASS(klass);
926     AspeedSMCClass *mc = ASPEED_SMC_CLASS(klass);
927 
928     dc->realize = aspeed_smc_realize;
929     dc->reset = aspeed_smc_reset;
930     dc->props = aspeed_smc_properties;
931     dc->vmsd = &vmstate_aspeed_smc;
932     mc->ctrl = data;
933 }
934 
935 static const TypeInfo aspeed_smc_info = {
936     .name           = TYPE_ASPEED_SMC,
937     .parent         = TYPE_SYS_BUS_DEVICE,
938     .instance_size  = sizeof(AspeedSMCState),
939     .class_size     = sizeof(AspeedSMCClass),
940     .abstract       = true,
941 };
942 
943 static void aspeed_smc_register_types(void)
944 {
945     int i;
946 
947     type_register_static(&aspeed_smc_info);
948     for (i = 0; i < ARRAY_SIZE(controllers); ++i) {
949         TypeInfo ti = {
950             .name       = controllers[i].name,
951             .parent     = TYPE_ASPEED_SMC,
952             .class_init = aspeed_smc_class_init,
953             .class_data = (void *)&controllers[i],
954         };
955         type_register(&ti);
956     }
957 }
958 
959 type_init(aspeed_smc_register_types)
960