1 /* 2 * ASPEED AST2400 SMC Controller (SPI Flash Only) 3 * 4 * Copyright (C) 2016 IBM Corp. 5 * 6 * Permission is hereby granted, free of charge, to any person obtaining a copy 7 * of this software and associated documentation files (the "Software"), to deal 8 * in the Software without restriction, including without limitation the rights 9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 * copies of the Software, and to permit persons to whom the Software is 11 * furnished to do so, subject to the following conditions: 12 * 13 * The above copyright notice and this permission notice shall be included in 14 * all copies or substantial portions of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 * THE SOFTWARE. 23 */ 24 25 #include "qemu/osdep.h" 26 #include "hw/sysbus.h" 27 #include "sysemu/sysemu.h" 28 #include "qemu/log.h" 29 #include "qemu/error-report.h" 30 31 #include "hw/ssi/aspeed_smc.h" 32 33 /* CE Type Setting Register */ 34 #define R_CONF (0x00 / 4) 35 #define CONF_LEGACY_DISABLE (1 << 31) 36 #define CONF_ENABLE_W4 20 37 #define CONF_ENABLE_W3 19 38 #define CONF_ENABLE_W2 18 39 #define CONF_ENABLE_W1 17 40 #define CONF_ENABLE_W0 16 41 #define CONF_FLASH_TYPE4 8 42 #define CONF_FLASH_TYPE3 6 43 #define CONF_FLASH_TYPE2 4 44 #define CONF_FLASH_TYPE1 2 45 #define CONF_FLASH_TYPE0 0 46 #define CONF_FLASH_TYPE_NOR 0x0 47 #define CONF_FLASH_TYPE_NAND 0x1 48 #define CONF_FLASH_TYPE_SPI 0x2 49 50 /* CE Control Register */ 51 #define R_CE_CTRL (0x04 / 4) 52 #define CTRL_EXTENDED4 4 /* 32 bit addressing for SPI */ 53 #define CTRL_EXTENDED3 3 /* 32 bit addressing for SPI */ 54 #define CTRL_EXTENDED2 2 /* 32 bit addressing for SPI */ 55 #define CTRL_EXTENDED1 1 /* 32 bit addressing for SPI */ 56 #define CTRL_EXTENDED0 0 /* 32 bit addressing for SPI */ 57 58 /* Interrupt Control and Status Register */ 59 #define R_INTR_CTRL (0x08 / 4) 60 #define INTR_CTRL_DMA_STATUS (1 << 11) 61 #define INTR_CTRL_CMD_ABORT_STATUS (1 << 10) 62 #define INTR_CTRL_WRITE_PROTECT_STATUS (1 << 9) 63 #define INTR_CTRL_DMA_EN (1 << 3) 64 #define INTR_CTRL_CMD_ABORT_EN (1 << 2) 65 #define INTR_CTRL_WRITE_PROTECT_EN (1 << 1) 66 67 /* CEx Control Register */ 68 #define R_CTRL0 (0x10 / 4) 69 #define CTRL_IO_DUAL_DATA (1 << 29) 70 #define CTRL_IO_DUAL_ADDR_DATA (1 << 28) /* Includes dummies */ 71 #define CTRL_CMD_SHIFT 16 72 #define CTRL_CMD_MASK 0xff 73 #define CTRL_DUMMY_HIGH_SHIFT 14 74 #define CTRL_AST2400_SPI_4BYTE (1 << 13) 75 #define CTRL_DUMMY_LOW_SHIFT 6 /* 2 bits [7:6] */ 76 #define CTRL_CE_STOP_ACTIVE (1 << 2) 77 #define CTRL_CMD_MODE_MASK 0x3 78 #define CTRL_READMODE 0x0 79 #define CTRL_FREADMODE 0x1 80 #define CTRL_WRITEMODE 0x2 81 #define CTRL_USERMODE 0x3 82 #define R_CTRL1 (0x14 / 4) 83 #define R_CTRL2 (0x18 / 4) 84 #define R_CTRL3 (0x1C / 4) 85 #define R_CTRL4 (0x20 / 4) 86 87 /* CEx Segment Address Register */ 88 #define R_SEG_ADDR0 (0x30 / 4) 89 #define SEG_END_SHIFT 24 /* 8MB units */ 90 #define SEG_END_MASK 0xff 91 #define SEG_START_SHIFT 16 /* address bit [A29-A23] */ 92 #define SEG_START_MASK 0xff 93 #define R_SEG_ADDR1 (0x34 / 4) 94 #define R_SEG_ADDR2 (0x38 / 4) 95 #define R_SEG_ADDR3 (0x3C / 4) 96 #define R_SEG_ADDR4 (0x40 / 4) 97 98 /* Misc Control Register #1 */ 99 #define R_MISC_CTRL1 (0x50 / 4) 100 101 /* Misc Control Register #2 */ 102 #define R_MISC_CTRL2 (0x54 / 4) 103 104 /* DMA Control/Status Register */ 105 #define R_DMA_CTRL (0x80 / 4) 106 #define DMA_CTRL_DELAY_MASK 0xf 107 #define DMA_CTRL_DELAY_SHIFT 8 108 #define DMA_CTRL_FREQ_MASK 0xf 109 #define DMA_CTRL_FREQ_SHIFT 4 110 #define DMA_CTRL_MODE (1 << 3) 111 #define DMA_CTRL_CKSUM (1 << 2) 112 #define DMA_CTRL_DIR (1 << 1) 113 #define DMA_CTRL_EN (1 << 0) 114 115 /* DMA Flash Side Address */ 116 #define R_DMA_FLASH_ADDR (0x84 / 4) 117 118 /* DMA DRAM Side Address */ 119 #define R_DMA_DRAM_ADDR (0x88 / 4) 120 121 /* DMA Length Register */ 122 #define R_DMA_LEN (0x8C / 4) 123 124 /* Checksum Calculation Result */ 125 #define R_DMA_CHECKSUM (0x90 / 4) 126 127 /* Misc Control Register #2 */ 128 #define R_TIMINGS (0x94 / 4) 129 130 /* SPI controller registers and bits */ 131 #define R_SPI_CONF (0x00 / 4) 132 #define SPI_CONF_ENABLE_W0 0 133 #define R_SPI_CTRL0 (0x4 / 4) 134 #define R_SPI_MISC_CTRL (0x10 / 4) 135 #define R_SPI_TIMINGS (0x14 / 4) 136 137 #define ASPEED_SMC_R_SPI_MAX (0x20 / 4) 138 #define ASPEED_SMC_R_SMC_MAX (0x20 / 4) 139 140 #define ASPEED_SOC_SMC_FLASH_BASE 0x10000000 141 #define ASPEED_SOC_FMC_FLASH_BASE 0x20000000 142 #define ASPEED_SOC_SPI_FLASH_BASE 0x30000000 143 #define ASPEED_SOC_SPI2_FLASH_BASE 0x38000000 144 145 /* Flash opcodes. */ 146 #define SPI_OP_READ 0x03 /* Read data bytes (low frequency) */ 147 148 /* 149 * Default segments mapping addresses and size for each slave per 150 * controller. These can be changed when board is initialized with the 151 * Segment Address Registers. 152 */ 153 static const AspeedSegments aspeed_segments_legacy[] = { 154 { 0x10000000, 32 * 1024 * 1024 }, 155 }; 156 157 static const AspeedSegments aspeed_segments_fmc[] = { 158 { 0x20000000, 64 * 1024 * 1024 }, /* start address is readonly */ 159 { 0x24000000, 32 * 1024 * 1024 }, 160 { 0x26000000, 32 * 1024 * 1024 }, 161 { 0x28000000, 32 * 1024 * 1024 }, 162 { 0x2A000000, 32 * 1024 * 1024 } 163 }; 164 165 static const AspeedSegments aspeed_segments_spi[] = { 166 { 0x30000000, 64 * 1024 * 1024 }, 167 }; 168 169 static const AspeedSegments aspeed_segments_ast2500_fmc[] = { 170 { 0x20000000, 128 * 1024 * 1024 }, /* start address is readonly */ 171 { 0x28000000, 32 * 1024 * 1024 }, 172 { 0x2A000000, 32 * 1024 * 1024 }, 173 }; 174 175 static const AspeedSegments aspeed_segments_ast2500_spi1[] = { 176 { 0x30000000, 32 * 1024 * 1024 }, /* start address is readonly */ 177 { 0x32000000, 96 * 1024 * 1024 }, /* end address is readonly */ 178 }; 179 180 static const AspeedSegments aspeed_segments_ast2500_spi2[] = { 181 { 0x38000000, 32 * 1024 * 1024 }, /* start address is readonly */ 182 { 0x3A000000, 96 * 1024 * 1024 }, /* end address is readonly */ 183 }; 184 185 static const AspeedSMCController controllers[] = { 186 { 187 .name = "aspeed.smc.smc", 188 .r_conf = R_CONF, 189 .r_ce_ctrl = R_CE_CTRL, 190 .r_ctrl0 = R_CTRL0, 191 .r_timings = R_TIMINGS, 192 .conf_enable_w0 = CONF_ENABLE_W0, 193 .max_slaves = 5, 194 .segments = aspeed_segments_legacy, 195 .flash_window_base = ASPEED_SOC_SMC_FLASH_BASE, 196 .flash_window_size = 0x6000000, 197 .has_dma = false, 198 .nregs = ASPEED_SMC_R_SMC_MAX, 199 }, { 200 .name = "aspeed.smc.fmc", 201 .r_conf = R_CONF, 202 .r_ce_ctrl = R_CE_CTRL, 203 .r_ctrl0 = R_CTRL0, 204 .r_timings = R_TIMINGS, 205 .conf_enable_w0 = CONF_ENABLE_W0, 206 .max_slaves = 5, 207 .segments = aspeed_segments_fmc, 208 .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE, 209 .flash_window_size = 0x10000000, 210 .has_dma = true, 211 .nregs = ASPEED_SMC_R_MAX, 212 }, { 213 .name = "aspeed.smc.spi", 214 .r_conf = R_SPI_CONF, 215 .r_ce_ctrl = 0xff, 216 .r_ctrl0 = R_SPI_CTRL0, 217 .r_timings = R_SPI_TIMINGS, 218 .conf_enable_w0 = SPI_CONF_ENABLE_W0, 219 .max_slaves = 1, 220 .segments = aspeed_segments_spi, 221 .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE, 222 .flash_window_size = 0x10000000, 223 .has_dma = false, 224 .nregs = ASPEED_SMC_R_SPI_MAX, 225 }, { 226 .name = "aspeed.smc.ast2500-fmc", 227 .r_conf = R_CONF, 228 .r_ce_ctrl = R_CE_CTRL, 229 .r_ctrl0 = R_CTRL0, 230 .r_timings = R_TIMINGS, 231 .conf_enable_w0 = CONF_ENABLE_W0, 232 .max_slaves = 3, 233 .segments = aspeed_segments_ast2500_fmc, 234 .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE, 235 .flash_window_size = 0x10000000, 236 .has_dma = true, 237 .nregs = ASPEED_SMC_R_MAX, 238 }, { 239 .name = "aspeed.smc.ast2500-spi1", 240 .r_conf = R_CONF, 241 .r_ce_ctrl = R_CE_CTRL, 242 .r_ctrl0 = R_CTRL0, 243 .r_timings = R_TIMINGS, 244 .conf_enable_w0 = CONF_ENABLE_W0, 245 .max_slaves = 2, 246 .segments = aspeed_segments_ast2500_spi1, 247 .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE, 248 .flash_window_size = 0x8000000, 249 .has_dma = false, 250 .nregs = ASPEED_SMC_R_MAX, 251 }, { 252 .name = "aspeed.smc.ast2500-spi2", 253 .r_conf = R_CONF, 254 .r_ce_ctrl = R_CE_CTRL, 255 .r_ctrl0 = R_CTRL0, 256 .r_timings = R_TIMINGS, 257 .conf_enable_w0 = CONF_ENABLE_W0, 258 .max_slaves = 2, 259 .segments = aspeed_segments_ast2500_spi2, 260 .flash_window_base = ASPEED_SOC_SPI2_FLASH_BASE, 261 .flash_window_size = 0x8000000, 262 .has_dma = false, 263 .nregs = ASPEED_SMC_R_MAX, 264 }, 265 }; 266 267 /* 268 * The Segment Register uses a 8MB unit to encode the start address 269 * and the end address of the mapping window of a flash SPI slave : 270 * 271 * | byte 1 | byte 2 | byte 3 | byte 4 | 272 * +--------+--------+--------+--------+ 273 * | end | start | 0 | 0 | 274 * 275 */ 276 static inline uint32_t aspeed_smc_segment_to_reg(const AspeedSegments *seg) 277 { 278 uint32_t reg = 0; 279 reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT; 280 reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT; 281 return reg; 282 } 283 284 static inline void aspeed_smc_reg_to_segment(uint32_t reg, AspeedSegments *seg) 285 { 286 seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23; 287 seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr; 288 } 289 290 static bool aspeed_smc_flash_overlap(const AspeedSMCState *s, 291 const AspeedSegments *new, 292 int cs) 293 { 294 AspeedSegments seg; 295 int i; 296 297 for (i = 0; i < s->ctrl->max_slaves; i++) { 298 if (i == cs) { 299 continue; 300 } 301 302 aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + i], &seg); 303 304 if (new->addr + new->size > seg.addr && 305 new->addr < seg.addr + seg.size) { 306 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment CS%d [ 0x%" 307 HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with " 308 "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 309 s->ctrl->name, cs, new->addr, new->addr + new->size, 310 i, seg.addr, seg.addr + seg.size); 311 return true; 312 } 313 } 314 return false; 315 } 316 317 static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs, 318 uint64_t new) 319 { 320 AspeedSMCFlash *fl = &s->flashes[cs]; 321 AspeedSegments seg; 322 323 aspeed_smc_reg_to_segment(new, &seg); 324 325 /* The start address of CS0 is read-only */ 326 if (cs == 0 && seg.addr != s->ctrl->flash_window_base) { 327 qemu_log_mask(LOG_GUEST_ERROR, 328 "%s: Tried to change CS0 start address to 0x%" 329 HWADDR_PRIx "\n", s->ctrl->name, seg.addr); 330 seg.addr = s->ctrl->flash_window_base; 331 new = aspeed_smc_segment_to_reg(&seg); 332 } 333 334 /* 335 * The end address of the AST2500 spi controllers is also 336 * read-only. 337 */ 338 if ((s->ctrl->segments == aspeed_segments_ast2500_spi1 || 339 s->ctrl->segments == aspeed_segments_ast2500_spi2) && 340 cs == s->ctrl->max_slaves && 341 seg.addr + seg.size != s->ctrl->segments[cs].addr + 342 s->ctrl->segments[cs].size) { 343 qemu_log_mask(LOG_GUEST_ERROR, 344 "%s: Tried to change CS%d end address to 0x%" 345 HWADDR_PRIx "\n", s->ctrl->name, cs, seg.addr + seg.size); 346 seg.size = s->ctrl->segments[cs].addr + s->ctrl->segments[cs].size - 347 seg.addr; 348 new = aspeed_smc_segment_to_reg(&seg); 349 } 350 351 /* Keep the segment in the overall flash window */ 352 if (seg.addr + seg.size <= s->ctrl->flash_window_base || 353 seg.addr > s->ctrl->flash_window_base + s->ctrl->flash_window_size) { 354 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is invalid : " 355 "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 356 s->ctrl->name, cs, seg.addr, seg.addr + seg.size); 357 return; 358 } 359 360 /* Check start address vs. alignment */ 361 if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) { 362 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is not " 363 "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 364 s->ctrl->name, cs, seg.addr, seg.addr + seg.size); 365 } 366 367 /* And segments should not overlap (in the specs) */ 368 aspeed_smc_flash_overlap(s, &seg, cs); 369 370 /* All should be fine now to move the region */ 371 memory_region_transaction_begin(); 372 memory_region_set_size(&fl->mmio, seg.size); 373 memory_region_set_address(&fl->mmio, seg.addr - s->ctrl->flash_window_base); 374 memory_region_set_enabled(&fl->mmio, true); 375 memory_region_transaction_commit(); 376 377 s->regs[R_SEG_ADDR0 + cs] = new; 378 } 379 380 static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr, 381 unsigned size) 382 { 383 qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u" 384 PRIx64 "\n", __func__, addr, size); 385 return 0; 386 } 387 388 static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr, 389 uint64_t data, unsigned size) 390 { 391 qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u: 0x%" 392 PRIx64 "\n", __func__, addr, size, data); 393 } 394 395 static const MemoryRegionOps aspeed_smc_flash_default_ops = { 396 .read = aspeed_smc_flash_default_read, 397 .write = aspeed_smc_flash_default_write, 398 .endianness = DEVICE_LITTLE_ENDIAN, 399 .valid = { 400 .min_access_size = 1, 401 .max_access_size = 4, 402 }, 403 }; 404 405 static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl) 406 { 407 const AspeedSMCState *s = fl->controller; 408 409 return s->regs[s->r_ctrl0 + fl->id] & CTRL_CMD_MODE_MASK; 410 } 411 412 static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl) 413 { 414 const AspeedSMCState *s = fl->controller; 415 416 return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->id)); 417 } 418 419 static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl) 420 { 421 const AspeedSMCState *s = fl->controller; 422 int cmd = (s->regs[s->r_ctrl0 + fl->id] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK; 423 424 /* In read mode, the default SPI command is READ (0x3). In other 425 * modes, the command should necessarily be defined */ 426 if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) { 427 cmd = SPI_OP_READ; 428 } 429 430 if (!cmd) { 431 qemu_log_mask(LOG_GUEST_ERROR, "%s: no command defined for mode %d\n", 432 __func__, aspeed_smc_flash_mode(fl)); 433 } 434 435 return cmd; 436 } 437 438 static inline int aspeed_smc_flash_is_4byte(const AspeedSMCFlash *fl) 439 { 440 const AspeedSMCState *s = fl->controller; 441 442 if (s->ctrl->segments == aspeed_segments_spi) { 443 return s->regs[s->r_ctrl0] & CTRL_AST2400_SPI_4BYTE; 444 } else { 445 return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->id)); 446 } 447 } 448 449 static inline bool aspeed_smc_is_ce_stop_active(const AspeedSMCFlash *fl) 450 { 451 const AspeedSMCState *s = fl->controller; 452 453 return s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE; 454 } 455 456 static void aspeed_smc_flash_select(AspeedSMCFlash *fl) 457 { 458 AspeedSMCState *s = fl->controller; 459 460 s->regs[s->r_ctrl0 + fl->id] &= ~CTRL_CE_STOP_ACTIVE; 461 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 462 } 463 464 static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl) 465 { 466 AspeedSMCState *s = fl->controller; 467 468 s->regs[s->r_ctrl0 + fl->id] |= CTRL_CE_STOP_ACTIVE; 469 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 470 } 471 472 static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl, 473 uint32_t addr) 474 { 475 const AspeedSMCState *s = fl->controller; 476 AspeedSegments seg; 477 478 aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + fl->id], &seg); 479 if ((addr % seg.size) != addr) { 480 qemu_log_mask(LOG_GUEST_ERROR, 481 "%s: invalid address 0x%08x for CS%d segment : " 482 "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 483 s->ctrl->name, addr, fl->id, seg.addr, 484 seg.addr + seg.size); 485 addr %= seg.size; 486 } 487 488 return addr; 489 } 490 491 static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl) 492 { 493 const AspeedSMCState *s = fl->controller; 494 uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->id]; 495 uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1; 496 uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3; 497 uint32_t dummies = ((dummy_high << 2) | dummy_low) * 8; 498 499 if (r_ctrl0 & CTRL_IO_DUAL_ADDR_DATA) { 500 dummies /= 2; 501 } 502 503 return dummies; 504 } 505 506 static void aspeed_smc_flash_send_addr(AspeedSMCFlash *fl, uint32_t addr) 507 { 508 const AspeedSMCState *s = fl->controller; 509 uint8_t cmd = aspeed_smc_flash_cmd(fl); 510 511 /* Flash access can not exceed CS segment */ 512 addr = aspeed_smc_check_segment_addr(fl, addr); 513 514 ssi_transfer(s->spi, cmd); 515 516 if (aspeed_smc_flash_is_4byte(fl)) { 517 ssi_transfer(s->spi, (addr >> 24) & 0xff); 518 } 519 ssi_transfer(s->spi, (addr >> 16) & 0xff); 520 ssi_transfer(s->spi, (addr >> 8) & 0xff); 521 ssi_transfer(s->spi, (addr & 0xff)); 522 } 523 524 static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size) 525 { 526 AspeedSMCFlash *fl = opaque; 527 AspeedSMCState *s = fl->controller; 528 uint64_t ret = 0; 529 int i; 530 531 switch (aspeed_smc_flash_mode(fl)) { 532 case CTRL_USERMODE: 533 for (i = 0; i < size; i++) { 534 ret |= ssi_transfer(s->spi, 0x0) << (8 * i); 535 } 536 break; 537 case CTRL_READMODE: 538 case CTRL_FREADMODE: 539 aspeed_smc_flash_select(fl); 540 aspeed_smc_flash_send_addr(fl, addr); 541 542 /* 543 * Use fake transfers to model dummy bytes. The value should 544 * be configured to some non-zero value in fast read mode and 545 * zero in read mode. But, as the HW allows inconsistent 546 * settings, let's check for fast read mode. 547 */ 548 if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) { 549 for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) { 550 ssi_transfer(fl->controller->spi, 0xFF); 551 } 552 } 553 554 for (i = 0; i < size; i++) { 555 ret |= ssi_transfer(s->spi, 0x0) << (8 * i); 556 } 557 558 aspeed_smc_flash_unselect(fl); 559 break; 560 default: 561 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n", 562 __func__, aspeed_smc_flash_mode(fl)); 563 } 564 565 return ret; 566 } 567 568 static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data, 569 unsigned size) 570 { 571 AspeedSMCFlash *fl = opaque; 572 AspeedSMCState *s = fl->controller; 573 int i; 574 575 if (!aspeed_smc_is_writable(fl)) { 576 qemu_log_mask(LOG_GUEST_ERROR, "%s: flash is not writable at 0x%" 577 HWADDR_PRIx "\n", __func__, addr); 578 return; 579 } 580 581 switch (aspeed_smc_flash_mode(fl)) { 582 case CTRL_USERMODE: 583 for (i = 0; i < size; i++) { 584 ssi_transfer(s->spi, (data >> (8 * i)) & 0xff); 585 } 586 break; 587 case CTRL_WRITEMODE: 588 aspeed_smc_flash_select(fl); 589 aspeed_smc_flash_send_addr(fl, addr); 590 591 for (i = 0; i < size; i++) { 592 ssi_transfer(s->spi, (data >> (8 * i)) & 0xff); 593 } 594 595 aspeed_smc_flash_unselect(fl); 596 break; 597 default: 598 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n", 599 __func__, aspeed_smc_flash_mode(fl)); 600 } 601 } 602 603 static const MemoryRegionOps aspeed_smc_flash_ops = { 604 .read = aspeed_smc_flash_read, 605 .write = aspeed_smc_flash_write, 606 .endianness = DEVICE_LITTLE_ENDIAN, 607 .valid = { 608 .min_access_size = 1, 609 .max_access_size = 4, 610 }, 611 }; 612 613 static void aspeed_smc_flash_update_cs(AspeedSMCFlash *fl) 614 { 615 const AspeedSMCState *s = fl->controller; 616 617 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 618 } 619 620 static void aspeed_smc_reset(DeviceState *d) 621 { 622 AspeedSMCState *s = ASPEED_SMC(d); 623 int i; 624 625 memset(s->regs, 0, sizeof s->regs); 626 627 /* Pretend DMA is done (u-boot initialization) */ 628 s->regs[R_INTR_CTRL] = INTR_CTRL_DMA_STATUS; 629 630 /* Unselect all slaves */ 631 for (i = 0; i < s->num_cs; ++i) { 632 s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE; 633 qemu_set_irq(s->cs_lines[i], true); 634 } 635 636 /* setup default segment register values for all */ 637 for (i = 0; i < s->ctrl->max_slaves; ++i) { 638 s->regs[R_SEG_ADDR0 + i] = 639 aspeed_smc_segment_to_reg(&s->ctrl->segments[i]); 640 } 641 642 /* HW strapping flash type for FMC controllers */ 643 if (s->ctrl->segments == aspeed_segments_ast2500_fmc) { 644 /* flash type is fixed to SPI for CE0 and CE1 */ 645 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0); 646 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1); 647 } 648 649 /* HW strapping for AST2400 FMC controllers (SCU70). Let's use the 650 * configuration of the palmetto-bmc machine */ 651 if (s->ctrl->segments == aspeed_segments_fmc) { 652 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0); 653 } 654 } 655 656 static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size) 657 { 658 AspeedSMCState *s = ASPEED_SMC(opaque); 659 660 addr >>= 2; 661 662 if (addr == s->r_conf || 663 addr == s->r_timings || 664 addr == s->r_ce_ctrl || 665 addr == R_INTR_CTRL || 666 (addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) || 667 (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs)) { 668 return s->regs[addr]; 669 } else { 670 qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n", 671 __func__, addr); 672 return 0; 673 } 674 } 675 676 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data, 677 unsigned int size) 678 { 679 AspeedSMCState *s = ASPEED_SMC(opaque); 680 uint32_t value = data; 681 682 addr >>= 2; 683 684 if (addr == s->r_conf || 685 addr == s->r_timings || 686 addr == s->r_ce_ctrl) { 687 s->regs[addr] = value; 688 } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) { 689 int cs = addr - s->r_ctrl0; 690 s->regs[addr] = value; 691 aspeed_smc_flash_update_cs(&s->flashes[cs]); 692 } else if (addr >= R_SEG_ADDR0 && 693 addr < R_SEG_ADDR0 + s->ctrl->max_slaves) { 694 int cs = addr - R_SEG_ADDR0; 695 696 if (value != s->regs[R_SEG_ADDR0 + cs]) { 697 aspeed_smc_flash_set_segment(s, cs, value); 698 } 699 } else { 700 qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n", 701 __func__, addr); 702 return; 703 } 704 } 705 706 static const MemoryRegionOps aspeed_smc_ops = { 707 .read = aspeed_smc_read, 708 .write = aspeed_smc_write, 709 .endianness = DEVICE_LITTLE_ENDIAN, 710 .valid.unaligned = true, 711 }; 712 713 static void aspeed_smc_realize(DeviceState *dev, Error **errp) 714 { 715 SysBusDevice *sbd = SYS_BUS_DEVICE(dev); 716 AspeedSMCState *s = ASPEED_SMC(dev); 717 AspeedSMCClass *mc = ASPEED_SMC_GET_CLASS(s); 718 int i; 719 char name[32]; 720 hwaddr offset = 0; 721 722 s->ctrl = mc->ctrl; 723 724 /* keep a copy under AspeedSMCState to speed up accesses */ 725 s->r_conf = s->ctrl->r_conf; 726 s->r_ce_ctrl = s->ctrl->r_ce_ctrl; 727 s->r_ctrl0 = s->ctrl->r_ctrl0; 728 s->r_timings = s->ctrl->r_timings; 729 s->conf_enable_w0 = s->ctrl->conf_enable_w0; 730 731 /* Enforce some real HW limits */ 732 if (s->num_cs > s->ctrl->max_slaves) { 733 qemu_log_mask(LOG_GUEST_ERROR, "%s: num_cs cannot exceed: %d\n", 734 __func__, s->ctrl->max_slaves); 735 s->num_cs = s->ctrl->max_slaves; 736 } 737 738 s->spi = ssi_create_bus(dev, "spi"); 739 740 /* Setup cs_lines for slaves */ 741 sysbus_init_irq(sbd, &s->irq); 742 s->cs_lines = g_new0(qemu_irq, s->num_cs); 743 ssi_auto_connect_slaves(dev, s->cs_lines, s->spi); 744 745 for (i = 0; i < s->num_cs; ++i) { 746 sysbus_init_irq(sbd, &s->cs_lines[i]); 747 } 748 749 /* The memory region for the controller registers */ 750 memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s, 751 s->ctrl->name, s->ctrl->nregs * 4); 752 sysbus_init_mmio(sbd, &s->mmio); 753 754 /* 755 * The container memory region representing the address space 756 * window in which the flash modules are mapped. The size and 757 * address depends on the SoC model and controller type. 758 */ 759 snprintf(name, sizeof(name), "%s.flash", s->ctrl->name); 760 761 memory_region_init_io(&s->mmio_flash, OBJECT(s), 762 &aspeed_smc_flash_default_ops, s, name, 763 s->ctrl->flash_window_size); 764 sysbus_init_mmio(sbd, &s->mmio_flash); 765 766 s->flashes = g_new0(AspeedSMCFlash, s->ctrl->max_slaves); 767 768 /* 769 * Let's create a sub memory region for each possible slave. All 770 * have a configurable memory segment in the overall flash mapping 771 * window of the controller but, there is not necessarily a flash 772 * module behind to handle the memory accesses. This depends on 773 * the board configuration. 774 */ 775 for (i = 0; i < s->ctrl->max_slaves; ++i) { 776 AspeedSMCFlash *fl = &s->flashes[i]; 777 778 snprintf(name, sizeof(name), "%s.%d", s->ctrl->name, i); 779 780 fl->id = i; 781 fl->controller = s; 782 fl->size = s->ctrl->segments[i].size; 783 memory_region_init_io(&fl->mmio, OBJECT(s), &aspeed_smc_flash_ops, 784 fl, name, fl->size); 785 memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio); 786 offset += fl->size; 787 } 788 } 789 790 static const VMStateDescription vmstate_aspeed_smc = { 791 .name = "aspeed.smc", 792 .version_id = 1, 793 .minimum_version_id = 1, 794 .fields = (VMStateField[]) { 795 VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX), 796 VMSTATE_END_OF_LIST() 797 } 798 }; 799 800 static Property aspeed_smc_properties[] = { 801 DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1), 802 DEFINE_PROP_END_OF_LIST(), 803 }; 804 805 static void aspeed_smc_class_init(ObjectClass *klass, void *data) 806 { 807 DeviceClass *dc = DEVICE_CLASS(klass); 808 AspeedSMCClass *mc = ASPEED_SMC_CLASS(klass); 809 810 dc->realize = aspeed_smc_realize; 811 dc->reset = aspeed_smc_reset; 812 dc->props = aspeed_smc_properties; 813 dc->vmsd = &vmstate_aspeed_smc; 814 mc->ctrl = data; 815 } 816 817 static const TypeInfo aspeed_smc_info = { 818 .name = TYPE_ASPEED_SMC, 819 .parent = TYPE_SYS_BUS_DEVICE, 820 .instance_size = sizeof(AspeedSMCState), 821 .class_size = sizeof(AspeedSMCClass), 822 .abstract = true, 823 }; 824 825 static void aspeed_smc_register_types(void) 826 { 827 int i; 828 829 type_register_static(&aspeed_smc_info); 830 for (i = 0; i < ARRAY_SIZE(controllers); ++i) { 831 TypeInfo ti = { 832 .name = controllers[i].name, 833 .parent = TYPE_ASPEED_SMC, 834 .class_init = aspeed_smc_class_init, 835 .class_data = (void *)&controllers[i], 836 }; 837 type_register(&ti); 838 } 839 } 840 841 type_init(aspeed_smc_register_types) 842