xref: /qemu/hw/ssi/xilinx_spips.c (revision a27bd6c779badb8d76e4430d810ef710a1b98f4e)
1 /*
2  * QEMU model of the Xilinx Zynq SPI controller
3  *
4  * Copyright (c) 2012 Peter A. G. Crosthwaite
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "hw/sysbus.h"
27 #include "sysemu/sysemu.h"
28 #include "hw/irq.h"
29 #include "hw/ptimer.h"
30 #include "hw/qdev-properties.h"
31 #include "qemu/log.h"
32 #include "qemu/module.h"
33 #include "qemu/bitops.h"
34 #include "hw/ssi/xilinx_spips.h"
35 #include "qapi/error.h"
36 #include "hw/register.h"
37 #include "sysemu/dma.h"
38 #include "migration/blocker.h"
39 #include "migration/vmstate.h"
40 
41 #ifndef XILINX_SPIPS_ERR_DEBUG
42 #define XILINX_SPIPS_ERR_DEBUG 0
43 #endif
44 
45 #define DB_PRINT_L(level, ...) do { \
46     if (XILINX_SPIPS_ERR_DEBUG > (level)) { \
47         fprintf(stderr,  ": %s: ", __func__); \
48         fprintf(stderr, ## __VA_ARGS__); \
49     } \
50 } while (0)
51 
52 /* config register */
53 #define R_CONFIG            (0x00 / 4)
54 #define IFMODE              (1U << 31)
55 #define R_CONFIG_ENDIAN     (1 << 26)
56 #define MODEFAIL_GEN_EN     (1 << 17)
57 #define MAN_START_COM       (1 << 16)
58 #define MAN_START_EN        (1 << 15)
59 #define MANUAL_CS           (1 << 14)
60 #define CS                  (0xF << 10)
61 #define CS_SHIFT            (10)
62 #define PERI_SEL            (1 << 9)
63 #define REF_CLK             (1 << 8)
64 #define FIFO_WIDTH          (3 << 6)
65 #define BAUD_RATE_DIV       (7 << 3)
66 #define CLK_PH              (1 << 2)
67 #define CLK_POL             (1 << 1)
68 #define MODE_SEL            (1 << 0)
69 #define R_CONFIG_RSVD       (0x7bf40000)
70 
71 /* interrupt mechanism */
72 #define R_INTR_STATUS       (0x04 / 4)
73 #define R_INTR_STATUS_RESET (0x104)
74 #define R_INTR_EN           (0x08 / 4)
75 #define R_INTR_DIS          (0x0C / 4)
76 #define R_INTR_MASK         (0x10 / 4)
77 #define IXR_TX_FIFO_UNDERFLOW   (1 << 6)
78 /* Poll timeout not implemented */
79 #define IXR_RX_FIFO_EMPTY       (1 << 11)
80 #define IXR_GENERIC_FIFO_FULL   (1 << 10)
81 #define IXR_GENERIC_FIFO_NOT_FULL (1 << 9)
82 #define IXR_TX_FIFO_EMPTY       (1 << 8)
83 #define IXR_GENERIC_FIFO_EMPTY  (1 << 7)
84 #define IXR_RX_FIFO_FULL        (1 << 5)
85 #define IXR_RX_FIFO_NOT_EMPTY   (1 << 4)
86 #define IXR_TX_FIFO_FULL        (1 << 3)
87 #define IXR_TX_FIFO_NOT_FULL    (1 << 2)
88 #define IXR_TX_FIFO_MODE_FAIL   (1 << 1)
89 #define IXR_RX_FIFO_OVERFLOW    (1 << 0)
90 #define IXR_ALL                 ((1 << 13) - 1)
91 #define GQSPI_IXR_MASK          0xFBE
92 #define IXR_SELF_CLEAR \
93 (IXR_GENERIC_FIFO_EMPTY \
94 | IXR_GENERIC_FIFO_FULL  \
95 | IXR_GENERIC_FIFO_NOT_FULL \
96 | IXR_TX_FIFO_EMPTY \
97 | IXR_TX_FIFO_FULL  \
98 | IXR_TX_FIFO_NOT_FULL \
99 | IXR_RX_FIFO_EMPTY \
100 | IXR_RX_FIFO_FULL  \
101 | IXR_RX_FIFO_NOT_EMPTY)
102 
103 #define R_EN                (0x14 / 4)
104 #define R_DELAY             (0x18 / 4)
105 #define R_TX_DATA           (0x1C / 4)
106 #define R_RX_DATA           (0x20 / 4)
107 #define R_SLAVE_IDLE_COUNT  (0x24 / 4)
108 #define R_TX_THRES          (0x28 / 4)
109 #define R_RX_THRES          (0x2C / 4)
110 #define R_GPIO              (0x30 / 4)
111 #define R_LPBK_DLY_ADJ      (0x38 / 4)
112 #define R_LPBK_DLY_ADJ_RESET (0x33)
113 #define R_TXD1              (0x80 / 4)
114 #define R_TXD2              (0x84 / 4)
115 #define R_TXD3              (0x88 / 4)
116 
117 #define R_LQSPI_CFG         (0xa0 / 4)
118 #define R_LQSPI_CFG_RESET       0x03A002EB
119 #define LQSPI_CFG_LQ_MODE       (1U << 31)
120 #define LQSPI_CFG_TWO_MEM       (1 << 30)
121 #define LQSPI_CFG_SEP_BUS       (1 << 29)
122 #define LQSPI_CFG_U_PAGE        (1 << 28)
123 #define LQSPI_CFG_ADDR4         (1 << 27)
124 #define LQSPI_CFG_MODE_EN       (1 << 25)
125 #define LQSPI_CFG_MODE_WIDTH    8
126 #define LQSPI_CFG_MODE_SHIFT    16
127 #define LQSPI_CFG_DUMMY_WIDTH   3
128 #define LQSPI_CFG_DUMMY_SHIFT   8
129 #define LQSPI_CFG_INST_CODE     0xFF
130 
131 #define R_CMND        (0xc0 / 4)
132     #define R_CMND_RXFIFO_DRAIN   (1 << 19)
133     FIELD(CMND, PARTIAL_BYTE_LEN, 16, 3)
134 #define R_CMND_EXT_ADD        (1 << 15)
135     FIELD(CMND, RX_DISCARD, 8, 7)
136     FIELD(CMND, DUMMY_CYCLES, 2, 6)
137 #define R_CMND_DMA_EN         (1 << 1)
138 #define R_CMND_PUSH_WAIT      (1 << 0)
139 #define R_TRANSFER_SIZE     (0xc4 / 4)
140 #define R_LQSPI_STS         (0xA4 / 4)
141 #define LQSPI_STS_WR_RECVD      (1 << 1)
142 
143 #define R_MOD_ID            (0xFC / 4)
144 
145 #define R_GQSPI_SELECT          (0x144 / 4)
146     FIELD(GQSPI_SELECT, GENERIC_QSPI_EN, 0, 1)
147 #define R_GQSPI_ISR         (0x104 / 4)
148 #define R_GQSPI_IER         (0x108 / 4)
149 #define R_GQSPI_IDR         (0x10c / 4)
150 #define R_GQSPI_IMR         (0x110 / 4)
151 #define R_GQSPI_IMR_RESET   (0xfbe)
152 #define R_GQSPI_TX_THRESH   (0x128 / 4)
153 #define R_GQSPI_RX_THRESH   (0x12c / 4)
154 #define R_GQSPI_GPIO (0x130 / 4)
155 #define R_GQSPI_LPBK_DLY_ADJ (0x138 / 4)
156 #define R_GQSPI_LPBK_DLY_ADJ_RESET (0x33)
157 #define R_GQSPI_CNFG        (0x100 / 4)
158     FIELD(GQSPI_CNFG, MODE_EN, 30, 2)
159     FIELD(GQSPI_CNFG, GEN_FIFO_START_MODE, 29, 1)
160     FIELD(GQSPI_CNFG, GEN_FIFO_START, 28, 1)
161     FIELD(GQSPI_CNFG, ENDIAN, 26, 1)
162     /* Poll timeout not implemented */
163     FIELD(GQSPI_CNFG, EN_POLL_TIMEOUT, 20, 1)
164     /* QEMU doesnt care about any of these last three */
165     FIELD(GQSPI_CNFG, BR, 3, 3)
166     FIELD(GQSPI_CNFG, CPH, 2, 1)
167     FIELD(GQSPI_CNFG, CPL, 1, 1)
168 #define R_GQSPI_GEN_FIFO        (0x140 / 4)
169 #define R_GQSPI_TXD             (0x11c / 4)
170 #define R_GQSPI_RXD             (0x120 / 4)
171 #define R_GQSPI_FIFO_CTRL       (0x14c / 4)
172     FIELD(GQSPI_FIFO_CTRL, RX_FIFO_RESET, 2, 1)
173     FIELD(GQSPI_FIFO_CTRL, TX_FIFO_RESET, 1, 1)
174     FIELD(GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET, 0, 1)
175 #define R_GQSPI_GFIFO_THRESH    (0x150 / 4)
176 #define R_GQSPI_DATA_STS (0x15c / 4)
177 /* We use the snapshot register to hold the core state for the currently
178  * or most recently executed command. So the generic fifo format is defined
179  * for the snapshot register
180  */
181 #define R_GQSPI_GF_SNAPSHOT (0x160 / 4)
182     FIELD(GQSPI_GF_SNAPSHOT, POLL, 19, 1)
183     FIELD(GQSPI_GF_SNAPSHOT, STRIPE, 18, 1)
184     FIELD(GQSPI_GF_SNAPSHOT, RECIEVE, 17, 1)
185     FIELD(GQSPI_GF_SNAPSHOT, TRANSMIT, 16, 1)
186     FIELD(GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT, 14, 2)
187     FIELD(GQSPI_GF_SNAPSHOT, CHIP_SELECT, 12, 2)
188     FIELD(GQSPI_GF_SNAPSHOT, SPI_MODE, 10, 2)
189     FIELD(GQSPI_GF_SNAPSHOT, EXPONENT, 9, 1)
190     FIELD(GQSPI_GF_SNAPSHOT, DATA_XFER, 8, 1)
191     FIELD(GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA, 0, 8)
192 #define R_GQSPI_MOD_ID        (0x1fc / 4)
193 #define R_GQSPI_MOD_ID_RESET  (0x10a0000)
194 
195 #define R_QSPIDMA_DST_CTRL         (0x80c / 4)
196 #define R_QSPIDMA_DST_CTRL_RESET   (0x803ffa00)
197 #define R_QSPIDMA_DST_I_MASK       (0x820 / 4)
198 #define R_QSPIDMA_DST_I_MASK_RESET (0xfe)
199 #define R_QSPIDMA_DST_CTRL2        (0x824 / 4)
200 #define R_QSPIDMA_DST_CTRL2_RESET  (0x081bfff8)
201 
202 /* size of TXRX FIFOs */
203 #define RXFF_A          (128)
204 #define TXFF_A          (128)
205 
206 #define RXFF_A_Q          (64 * 4)
207 #define TXFF_A_Q          (64 * 4)
208 
209 /* 16MB per linear region */
210 #define LQSPI_ADDRESS_BITS 24
211 
212 #define SNOOP_CHECKING 0xFF
213 #define SNOOP_ADDR 0xF0
214 #define SNOOP_NONE 0xEE
215 #define SNOOP_STRIPING 0
216 
217 #define MIN_NUM_BUSSES 1
218 #define MAX_NUM_BUSSES 2
219 
220 static inline int num_effective_busses(XilinxSPIPS *s)
221 {
222     return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
223             s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM) ? s->num_busses : 1;
224 }
225 
226 static void xilinx_spips_update_cs(XilinxSPIPS *s, int field)
227 {
228     int i;
229 
230     for (i = 0; i < s->num_cs * s->num_busses; i++) {
231         bool old_state = s->cs_lines_state[i];
232         bool new_state = field & (1 << i);
233 
234         if (old_state != new_state) {
235             s->cs_lines_state[i] = new_state;
236             s->rx_discard = ARRAY_FIELD_EX32(s->regs, CMND, RX_DISCARD);
237             DB_PRINT_L(1, "%sselecting slave %d\n", new_state ? "" : "de", i);
238         }
239         qemu_set_irq(s->cs_lines[i], !new_state);
240     }
241     if (!(field & ((1 << (s->num_cs * s->num_busses)) - 1))) {
242         s->snoop_state = SNOOP_CHECKING;
243         s->cmd_dummies = 0;
244         s->link_state = 1;
245         s->link_state_next = 1;
246         s->link_state_next_when = 0;
247         DB_PRINT_L(1, "moving to snoop check state\n");
248     }
249 }
250 
251 static void xlnx_zynqmp_qspips_update_cs_lines(XlnxZynqMPQSPIPS *s)
252 {
253     if (s->regs[R_GQSPI_GF_SNAPSHOT]) {
254         int field = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, CHIP_SELECT);
255         bool upper_cs_sel = field & (1 << 1);
256         bool lower_cs_sel = field & 1;
257         bool bus0_enabled;
258         bool bus1_enabled;
259         uint8_t buses;
260         int cs = 0;
261 
262         buses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
263         bus0_enabled = buses & 1;
264         bus1_enabled = buses & (1 << 1);
265 
266         if (bus0_enabled && bus1_enabled) {
267             if (lower_cs_sel) {
268                 cs |= 1;
269             }
270             if (upper_cs_sel) {
271                 cs |= 1 << 3;
272             }
273         } else if (bus0_enabled) {
274             if (lower_cs_sel) {
275                 cs |= 1;
276             }
277             if (upper_cs_sel) {
278                 cs |= 1 << 1;
279             }
280         } else if (bus1_enabled) {
281             if (lower_cs_sel) {
282                 cs |= 1 << 2;
283             }
284             if (upper_cs_sel) {
285                 cs |= 1 << 3;
286             }
287         }
288         xilinx_spips_update_cs(XILINX_SPIPS(s), cs);
289     }
290 }
291 
292 static void xilinx_spips_update_cs_lines(XilinxSPIPS *s)
293 {
294     int field = ~((s->regs[R_CONFIG] & CS) >> CS_SHIFT);
295 
296     /* In dual parallel, mirror low CS to both */
297     if (num_effective_busses(s) == 2) {
298         /* Single bit chip-select for qspi */
299         field &= 0x1;
300         field |= field << 3;
301     /* Dual stack U-Page */
302     } else if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM &&
303                s->regs[R_LQSPI_STS] & LQSPI_CFG_U_PAGE) {
304         /* Single bit chip-select for qspi */
305         field &= 0x1;
306         /* change from CS0 to CS1 */
307         field <<= 1;
308     }
309     /* Auto CS */
310     if (!(s->regs[R_CONFIG] & MANUAL_CS) &&
311         fifo8_is_empty(&s->tx_fifo)) {
312         field = 0;
313     }
314     xilinx_spips_update_cs(s, field);
315 }
316 
317 static void xilinx_spips_update_ixr(XilinxSPIPS *s)
318 {
319     if (!(s->regs[R_LQSPI_CFG] & LQSPI_CFG_LQ_MODE)) {
320         s->regs[R_INTR_STATUS] &= ~IXR_SELF_CLEAR;
321         s->regs[R_INTR_STATUS] |=
322             (fifo8_is_full(&s->rx_fifo) ? IXR_RX_FIFO_FULL : 0) |
323             (s->rx_fifo.num >= s->regs[R_RX_THRES] ?
324                                     IXR_RX_FIFO_NOT_EMPTY : 0) |
325             (fifo8_is_full(&s->tx_fifo) ? IXR_TX_FIFO_FULL : 0) |
326             (fifo8_is_empty(&s->tx_fifo) ? IXR_TX_FIFO_EMPTY : 0) |
327             (s->tx_fifo.num < s->regs[R_TX_THRES] ? IXR_TX_FIFO_NOT_FULL : 0);
328     }
329     int new_irqline = !!(s->regs[R_INTR_MASK] & s->regs[R_INTR_STATUS] &
330                                                                 IXR_ALL);
331     if (new_irqline != s->irqline) {
332         s->irqline = new_irqline;
333         qemu_set_irq(s->irq, s->irqline);
334     }
335 }
336 
337 static void xlnx_zynqmp_qspips_update_ixr(XlnxZynqMPQSPIPS *s)
338 {
339     uint32_t gqspi_int;
340     int new_irqline;
341 
342     s->regs[R_GQSPI_ISR] &= ~IXR_SELF_CLEAR;
343     s->regs[R_GQSPI_ISR] |=
344         (fifo32_is_empty(&s->fifo_g) ? IXR_GENERIC_FIFO_EMPTY : 0) |
345         (fifo32_is_full(&s->fifo_g) ? IXR_GENERIC_FIFO_FULL : 0) |
346         (s->fifo_g.fifo.num < s->regs[R_GQSPI_GFIFO_THRESH] ?
347                                     IXR_GENERIC_FIFO_NOT_FULL : 0) |
348         (fifo8_is_empty(&s->rx_fifo_g) ? IXR_RX_FIFO_EMPTY : 0) |
349         (fifo8_is_full(&s->rx_fifo_g) ? IXR_RX_FIFO_FULL : 0) |
350         (s->rx_fifo_g.num >= s->regs[R_GQSPI_RX_THRESH] ?
351                                     IXR_RX_FIFO_NOT_EMPTY : 0) |
352         (fifo8_is_empty(&s->tx_fifo_g) ? IXR_TX_FIFO_EMPTY : 0) |
353         (fifo8_is_full(&s->tx_fifo_g) ? IXR_TX_FIFO_FULL : 0) |
354         (s->tx_fifo_g.num < s->regs[R_GQSPI_TX_THRESH] ?
355                                     IXR_TX_FIFO_NOT_FULL : 0);
356 
357     /* GQSPI Interrupt Trigger Status */
358     gqspi_int = (~s->regs[R_GQSPI_IMR]) & s->regs[R_GQSPI_ISR] & GQSPI_IXR_MASK;
359     new_irqline = !!(gqspi_int & IXR_ALL);
360 
361     /* drive external interrupt pin */
362     if (new_irqline != s->gqspi_irqline) {
363         s->gqspi_irqline = new_irqline;
364         qemu_set_irq(XILINX_SPIPS(s)->irq, s->gqspi_irqline);
365     }
366 }
367 
368 static void xilinx_spips_reset(DeviceState *d)
369 {
370     XilinxSPIPS *s = XILINX_SPIPS(d);
371 
372     memset(s->regs, 0, sizeof(s->regs));
373 
374     fifo8_reset(&s->rx_fifo);
375     fifo8_reset(&s->rx_fifo);
376     /* non zero resets */
377     s->regs[R_CONFIG] |= MODEFAIL_GEN_EN;
378     s->regs[R_SLAVE_IDLE_COUNT] = 0xFF;
379     s->regs[R_TX_THRES] = 1;
380     s->regs[R_RX_THRES] = 1;
381     /* FIXME: move magic number definition somewhere sensible */
382     s->regs[R_MOD_ID] = 0x01090106;
383     s->regs[R_LQSPI_CFG] = R_LQSPI_CFG_RESET;
384     s->link_state = 1;
385     s->link_state_next = 1;
386     s->link_state_next_when = 0;
387     s->snoop_state = SNOOP_CHECKING;
388     s->cmd_dummies = 0;
389     s->man_start_com = false;
390     xilinx_spips_update_ixr(s);
391     xilinx_spips_update_cs_lines(s);
392 }
393 
394 static void xlnx_zynqmp_qspips_reset(DeviceState *d)
395 {
396     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(d);
397 
398     xilinx_spips_reset(d);
399 
400     memset(s->regs, 0, sizeof(s->regs));
401 
402     fifo8_reset(&s->rx_fifo_g);
403     fifo8_reset(&s->rx_fifo_g);
404     fifo32_reset(&s->fifo_g);
405     s->regs[R_INTR_STATUS] = R_INTR_STATUS_RESET;
406     s->regs[R_GPIO] = 1;
407     s->regs[R_LPBK_DLY_ADJ] = R_LPBK_DLY_ADJ_RESET;
408     s->regs[R_GQSPI_GFIFO_THRESH] = 0x10;
409     s->regs[R_MOD_ID] = 0x01090101;
410     s->regs[R_GQSPI_IMR] = R_GQSPI_IMR_RESET;
411     s->regs[R_GQSPI_TX_THRESH] = 1;
412     s->regs[R_GQSPI_RX_THRESH] = 1;
413     s->regs[R_GQSPI_GPIO] = 1;
414     s->regs[R_GQSPI_LPBK_DLY_ADJ] = R_GQSPI_LPBK_DLY_ADJ_RESET;
415     s->regs[R_GQSPI_MOD_ID] = R_GQSPI_MOD_ID_RESET;
416     s->regs[R_QSPIDMA_DST_CTRL] = R_QSPIDMA_DST_CTRL_RESET;
417     s->regs[R_QSPIDMA_DST_I_MASK] = R_QSPIDMA_DST_I_MASK_RESET;
418     s->regs[R_QSPIDMA_DST_CTRL2] = R_QSPIDMA_DST_CTRL2_RESET;
419     s->man_start_com_g = false;
420     s->gqspi_irqline = 0;
421     xlnx_zynqmp_qspips_update_ixr(s);
422 }
423 
424 /* N way (num) in place bit striper. Lay out row wise bits (MSB to LSB)
425  * column wise (from element 0 to N-1). num is the length of x, and dir
426  * reverses the direction of the transform. Best illustrated by example:
427  * Each digit in the below array is a single bit (num == 3):
428  *
429  * {{ 76543210, }  ----- stripe (dir == false) -----> {{ 741gdaFC, }
430  *  { hgfedcba, }                                      { 630fcHEB, }
431  *  { HGFEDCBA, }} <---- upstripe (dir == true) -----  { 52hebGDA, }}
432  */
433 
434 static inline void stripe8(uint8_t *x, int num, bool dir)
435 {
436     uint8_t r[MAX_NUM_BUSSES];
437     int idx[2] = {0, 0};
438     int bit[2] = {0, 7};
439     int d = dir;
440 
441     assert(num <= MAX_NUM_BUSSES);
442     memset(r, 0, sizeof(uint8_t) * num);
443 
444     for (idx[0] = 0; idx[0] < num; ++idx[0]) {
445         for (bit[0] = 7; bit[0] >= 0; bit[0]--) {
446             r[idx[!d]] |= x[idx[d]] & 1 << bit[d] ? 1 << bit[!d] : 0;
447             idx[1] = (idx[1] + 1) % num;
448             if (!idx[1]) {
449                 bit[1]--;
450             }
451         }
452     }
453     memcpy(x, r, sizeof(uint8_t) * num);
454 }
455 
456 static void xlnx_zynqmp_qspips_flush_fifo_g(XlnxZynqMPQSPIPS *s)
457 {
458     while (s->regs[R_GQSPI_DATA_STS] || !fifo32_is_empty(&s->fifo_g)) {
459         uint8_t tx_rx[2] = { 0 };
460         int num_stripes = 1;
461         uint8_t busses;
462         int i;
463 
464         if (!s->regs[R_GQSPI_DATA_STS]) {
465             uint8_t imm;
466 
467             s->regs[R_GQSPI_GF_SNAPSHOT] = fifo32_pop(&s->fifo_g);
468             DB_PRINT_L(0, "GQSPI command: %x\n", s->regs[R_GQSPI_GF_SNAPSHOT]);
469             if (!s->regs[R_GQSPI_GF_SNAPSHOT]) {
470                 DB_PRINT_L(0, "Dummy GQSPI Delay Command Entry, Do nothing");
471                 continue;
472             }
473             xlnx_zynqmp_qspips_update_cs_lines(s);
474 
475             imm = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
476             if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
477                 /* immedate transfer */
478                 if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
479                     ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
480                     s->regs[R_GQSPI_DATA_STS] = 1;
481                 /* CS setup/hold - do nothing */
482                 } else {
483                     s->regs[R_GQSPI_DATA_STS] = 0;
484                 }
485             } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, EXPONENT)) {
486                 if (imm > 31) {
487                     qemu_log_mask(LOG_UNIMP, "QSPI exponential transfer too"
488                                   " long - 2 ^ %" PRId8 " requested\n", imm);
489                 }
490                 s->regs[R_GQSPI_DATA_STS] = 1ul << imm;
491             } else {
492                 s->regs[R_GQSPI_DATA_STS] = imm;
493             }
494         }
495         /* Zero length transfer check */
496         if (!s->regs[R_GQSPI_DATA_STS]) {
497             continue;
498         }
499         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE) &&
500             fifo8_is_full(&s->rx_fifo_g)) {
501             /* No space in RX fifo for transfer - try again later */
502             return;
503         }
504         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, STRIPE) &&
505             (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
506              ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE))) {
507             num_stripes = 2;
508         }
509         if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
510             tx_rx[0] = ARRAY_FIELD_EX32(s->regs,
511                                         GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
512         } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT)) {
513             for (i = 0; i < num_stripes; ++i) {
514                 if (!fifo8_is_empty(&s->tx_fifo_g)) {
515                     tx_rx[i] = fifo8_pop(&s->tx_fifo_g);
516                     s->tx_fifo_g_align++;
517                 } else {
518                     return;
519                 }
520             }
521         }
522         if (num_stripes == 1) {
523             /* mirror */
524             tx_rx[1] = tx_rx[0];
525         }
526         busses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
527         for (i = 0; i < 2; ++i) {
528             DB_PRINT_L(1, "bus %d tx = %02x\n", i, tx_rx[i]);
529             tx_rx[i] = ssi_transfer(XILINX_SPIPS(s)->spi[i], tx_rx[i]);
530             DB_PRINT_L(1, "bus %d rx = %02x\n", i, tx_rx[i]);
531         }
532         if (s->regs[R_GQSPI_DATA_STS] > 1 &&
533             busses == 0x3 && num_stripes == 2) {
534             s->regs[R_GQSPI_DATA_STS] -= 2;
535         } else if (s->regs[R_GQSPI_DATA_STS] > 0) {
536             s->regs[R_GQSPI_DATA_STS]--;
537         }
538         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
539             for (i = 0; i < 2; ++i) {
540                 if (busses & (1 << i)) {
541                     DB_PRINT_L(1, "bus %d push_byte = %02x\n", i, tx_rx[i]);
542                     fifo8_push(&s->rx_fifo_g, tx_rx[i]);
543                     s->rx_fifo_g_align++;
544                 }
545             }
546         }
547         if (!s->regs[R_GQSPI_DATA_STS]) {
548             for (; s->tx_fifo_g_align % 4; s->tx_fifo_g_align++) {
549                 fifo8_pop(&s->tx_fifo_g);
550             }
551             for (; s->rx_fifo_g_align % 4; s->rx_fifo_g_align++) {
552                 fifo8_push(&s->rx_fifo_g, 0);
553             }
554         }
555     }
556 }
557 
558 static int xilinx_spips_num_dummies(XilinxQSPIPS *qs, uint8_t command)
559 {
560     if (!qs) {
561         /* The SPI device is not a QSPI device */
562         return -1;
563     }
564 
565     switch (command) { /* check for dummies */
566     case READ: /* no dummy bytes/cycles */
567     case PP:
568     case DPP:
569     case QPP:
570     case READ_4:
571     case PP_4:
572     case QPP_4:
573         return 0;
574     case FAST_READ:
575     case DOR:
576     case QOR:
577     case DOR_4:
578     case QOR_4:
579         return 1;
580     case DIOR:
581     case FAST_READ_4:
582     case DIOR_4:
583         return 2;
584     case QIOR:
585     case QIOR_4:
586         return 4;
587     default:
588         return -1;
589     }
590 }
591 
592 static inline uint8_t get_addr_length(XilinxSPIPS *s, uint8_t cmd)
593 {
594    switch (cmd) {
595    case PP_4:
596    case QPP_4:
597    case READ_4:
598    case QIOR_4:
599    case FAST_READ_4:
600    case DOR_4:
601    case QOR_4:
602    case DIOR_4:
603        return 4;
604    default:
605        return (s->regs[R_CMND] & R_CMND_EXT_ADD) ? 4 : 3;
606    }
607 }
608 
609 static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
610 {
611     int debug_level = 0;
612     XilinxQSPIPS *q = (XilinxQSPIPS *) object_dynamic_cast(OBJECT(s),
613                                                            TYPE_XILINX_QSPIPS);
614 
615     for (;;) {
616         int i;
617         uint8_t tx = 0;
618         uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
619         uint8_t dummy_cycles = 0;
620         uint8_t addr_length;
621 
622         if (fifo8_is_empty(&s->tx_fifo)) {
623             xilinx_spips_update_ixr(s);
624             return;
625         } else if (s->snoop_state == SNOOP_STRIPING ||
626                    s->snoop_state == SNOOP_NONE) {
627             for (i = 0; i < num_effective_busses(s); ++i) {
628                 tx_rx[i] = fifo8_pop(&s->tx_fifo);
629             }
630             stripe8(tx_rx, num_effective_busses(s), false);
631         } else if (s->snoop_state >= SNOOP_ADDR) {
632             tx = fifo8_pop(&s->tx_fifo);
633             for (i = 0; i < num_effective_busses(s); ++i) {
634                 tx_rx[i] = tx;
635             }
636         } else {
637             /* Extract a dummy byte and generate dummy cycles according to the
638              * link state */
639             tx = fifo8_pop(&s->tx_fifo);
640             dummy_cycles = 8 / s->link_state;
641         }
642 
643         for (i = 0; i < num_effective_busses(s); ++i) {
644             int bus = num_effective_busses(s) - 1 - i;
645             if (dummy_cycles) {
646                 int d;
647                 for (d = 0; d < dummy_cycles; ++d) {
648                     tx_rx[0] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[0]);
649                 }
650             } else {
651                 DB_PRINT_L(debug_level, "tx = %02x\n", tx_rx[i]);
652                 tx_rx[i] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[i]);
653                 DB_PRINT_L(debug_level, "rx = %02x\n", tx_rx[i]);
654             }
655         }
656 
657         if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
658             DB_PRINT_L(debug_level, "dircarding drained rx byte\n");
659             /* Do nothing */
660         } else if (s->rx_discard) {
661             DB_PRINT_L(debug_level, "dircarding discarded rx byte\n");
662             s->rx_discard -= 8 / s->link_state;
663         } else if (fifo8_is_full(&s->rx_fifo)) {
664             s->regs[R_INTR_STATUS] |= IXR_RX_FIFO_OVERFLOW;
665             DB_PRINT_L(0, "rx FIFO overflow");
666         } else if (s->snoop_state == SNOOP_STRIPING) {
667             stripe8(tx_rx, num_effective_busses(s), true);
668             for (i = 0; i < num_effective_busses(s); ++i) {
669                 fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[i]);
670                 DB_PRINT_L(debug_level, "pushing striped rx byte\n");
671             }
672         } else {
673            DB_PRINT_L(debug_level, "pushing unstriped rx byte\n");
674            fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[0]);
675         }
676 
677         if (s->link_state_next_when) {
678             s->link_state_next_when--;
679             if (!s->link_state_next_when) {
680                 s->link_state = s->link_state_next;
681             }
682         }
683 
684         DB_PRINT_L(debug_level, "initial snoop state: %x\n",
685                    (unsigned)s->snoop_state);
686         switch (s->snoop_state) {
687         case (SNOOP_CHECKING):
688             /* Store the count of dummy bytes in the txfifo */
689             s->cmd_dummies = xilinx_spips_num_dummies(q, tx);
690             addr_length = get_addr_length(s, tx);
691             if (s->cmd_dummies < 0) {
692                 s->snoop_state = SNOOP_NONE;
693             } else {
694                 s->snoop_state = SNOOP_ADDR + addr_length - 1;
695             }
696             switch (tx) {
697             case DPP:
698             case DOR:
699             case DOR_4:
700                 s->link_state_next = 2;
701                 s->link_state_next_when = addr_length + s->cmd_dummies;
702                 break;
703             case QPP:
704             case QPP_4:
705             case QOR:
706             case QOR_4:
707                 s->link_state_next = 4;
708                 s->link_state_next_when = addr_length + s->cmd_dummies;
709                 break;
710             case DIOR:
711             case DIOR_4:
712                 s->link_state = 2;
713                 break;
714             case QIOR:
715             case QIOR_4:
716                 s->link_state = 4;
717                 break;
718             }
719             break;
720         case (SNOOP_ADDR):
721             /* Address has been transmitted, transmit dummy cycles now if
722              * needed */
723             if (s->cmd_dummies < 0) {
724                 s->snoop_state = SNOOP_NONE;
725             } else {
726                 s->snoop_state = s->cmd_dummies;
727             }
728             break;
729         case (SNOOP_STRIPING):
730         case (SNOOP_NONE):
731             /* Once we hit the boring stuff - squelch debug noise */
732             if (!debug_level) {
733                 DB_PRINT_L(0, "squelching debug info ....\n");
734                 debug_level = 1;
735             }
736             break;
737         default:
738             s->snoop_state--;
739         }
740         DB_PRINT_L(debug_level, "final snoop state: %x\n",
741                    (unsigned)s->snoop_state);
742     }
743 }
744 
745 static inline void tx_data_bytes(Fifo8 *fifo, uint32_t value, int num, bool be)
746 {
747     int i;
748     for (i = 0; i < num && !fifo8_is_full(fifo); ++i) {
749         if (be) {
750             fifo8_push(fifo, (uint8_t)(value >> 24));
751             value <<= 8;
752         } else {
753             fifo8_push(fifo, (uint8_t)value);
754             value >>= 8;
755         }
756     }
757 }
758 
759 static void xilinx_spips_check_zero_pump(XilinxSPIPS *s)
760 {
761     if (!s->regs[R_TRANSFER_SIZE]) {
762         return;
763     }
764     if (!fifo8_is_empty(&s->tx_fifo) && s->regs[R_CMND] & R_CMND_PUSH_WAIT) {
765         return;
766     }
767     /*
768      * The zero pump must never fill tx fifo such that rx overflow is
769      * possible
770      */
771     while (s->regs[R_TRANSFER_SIZE] &&
772            s->rx_fifo.num + s->tx_fifo.num < RXFF_A_Q - 3) {
773         /* endianess just doesn't matter when zero pumping */
774         tx_data_bytes(&s->tx_fifo, 0, 4, false);
775         s->regs[R_TRANSFER_SIZE] &= ~0x03ull;
776         s->regs[R_TRANSFER_SIZE] -= 4;
777     }
778 }
779 
780 static void xilinx_spips_check_flush(XilinxSPIPS *s)
781 {
782     if (s->man_start_com ||
783         (!fifo8_is_empty(&s->tx_fifo) &&
784          !(s->regs[R_CONFIG] & MAN_START_EN))) {
785         xilinx_spips_check_zero_pump(s);
786         xilinx_spips_flush_txfifo(s);
787     }
788     if (fifo8_is_empty(&s->tx_fifo) && !s->regs[R_TRANSFER_SIZE]) {
789         s->man_start_com = false;
790     }
791     xilinx_spips_update_ixr(s);
792 }
793 
794 static void xlnx_zynqmp_qspips_check_flush(XlnxZynqMPQSPIPS *s)
795 {
796     bool gqspi_has_work = s->regs[R_GQSPI_DATA_STS] ||
797                           !fifo32_is_empty(&s->fifo_g);
798 
799     if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
800         if (s->man_start_com_g || (gqspi_has_work &&
801              !ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE))) {
802             xlnx_zynqmp_qspips_flush_fifo_g(s);
803         }
804     } else {
805         xilinx_spips_check_flush(XILINX_SPIPS(s));
806     }
807     if (!gqspi_has_work) {
808         s->man_start_com_g = false;
809     }
810     xlnx_zynqmp_qspips_update_ixr(s);
811 }
812 
813 static inline int rx_data_bytes(Fifo8 *fifo, uint8_t *value, int max)
814 {
815     int i;
816 
817     for (i = 0; i < max && !fifo8_is_empty(fifo); ++i) {
818         value[i] = fifo8_pop(fifo);
819     }
820     return max - i;
821 }
822 
823 static const void *pop_buf(Fifo8 *fifo, uint32_t max, uint32_t *num)
824 {
825     void *ret;
826 
827     if (max == 0 || max > fifo->num) {
828         abort();
829     }
830     *num = MIN(fifo->capacity - fifo->head, max);
831     ret = &fifo->data[fifo->head];
832     fifo->head += *num;
833     fifo->head %= fifo->capacity;
834     fifo->num -= *num;
835     return ret;
836 }
837 
838 static void xlnx_zynqmp_qspips_notify(void *opaque)
839 {
840     XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(opaque);
841     XilinxSPIPS *s = XILINX_SPIPS(rq);
842     Fifo8 *recv_fifo;
843 
844     if (ARRAY_FIELD_EX32(rq->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
845         if (!(ARRAY_FIELD_EX32(rq->regs, GQSPI_CNFG, MODE_EN) == 2)) {
846             return;
847         }
848         recv_fifo = &rq->rx_fifo_g;
849     } else {
850         if (!(s->regs[R_CMND] & R_CMND_DMA_EN)) {
851             return;
852         }
853         recv_fifo = &s->rx_fifo;
854     }
855     while (recv_fifo->num >= 4
856            && stream_can_push(rq->dma, xlnx_zynqmp_qspips_notify, rq))
857     {
858         size_t ret;
859         uint32_t num;
860         const void *rxd;
861         int len;
862 
863         len = recv_fifo->num >= rq->dma_burst_size ? rq->dma_burst_size :
864                                                    recv_fifo->num;
865         rxd = pop_buf(recv_fifo, len, &num);
866 
867         memcpy(rq->dma_buf, rxd, num);
868 
869         ret = stream_push(rq->dma, rq->dma_buf, num);
870         assert(ret == num);
871         xlnx_zynqmp_qspips_check_flush(rq);
872     }
873 }
874 
875 static uint64_t xilinx_spips_read(void *opaque, hwaddr addr,
876                                                         unsigned size)
877 {
878     XilinxSPIPS *s = opaque;
879     uint32_t mask = ~0;
880     uint32_t ret;
881     uint8_t rx_buf[4];
882     int shortfall;
883 
884     addr >>= 2;
885     switch (addr) {
886     case R_CONFIG:
887         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
888         break;
889     case R_INTR_STATUS:
890         ret = s->regs[addr] & IXR_ALL;
891         s->regs[addr] = 0;
892         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
893         xilinx_spips_update_ixr(s);
894         return ret;
895     case R_INTR_MASK:
896         mask = IXR_ALL;
897         break;
898     case  R_EN:
899         mask = 0x1;
900         break;
901     case R_SLAVE_IDLE_COUNT:
902         mask = 0xFF;
903         break;
904     case R_MOD_ID:
905         mask = 0x01FFFFFF;
906         break;
907     case R_INTR_EN:
908     case R_INTR_DIS:
909     case R_TX_DATA:
910         mask = 0;
911         break;
912     case R_RX_DATA:
913         memset(rx_buf, 0, sizeof(rx_buf));
914         shortfall = rx_data_bytes(&s->rx_fifo, rx_buf, s->num_txrx_bytes);
915         ret = s->regs[R_CONFIG] & R_CONFIG_ENDIAN ?
916                         cpu_to_be32(*(uint32_t *)rx_buf) :
917                         cpu_to_le32(*(uint32_t *)rx_buf);
918         if (!(s->regs[R_CONFIG] & R_CONFIG_ENDIAN)) {
919             ret <<= 8 * shortfall;
920         }
921         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
922         xilinx_spips_check_flush(s);
923         xilinx_spips_update_ixr(s);
924         return ret;
925     }
926     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4,
927                s->regs[addr] & mask);
928     return s->regs[addr] & mask;
929 
930 }
931 
932 static uint64_t xlnx_zynqmp_qspips_read(void *opaque,
933                                         hwaddr addr, unsigned size)
934 {
935     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
936     uint32_t reg = addr / 4;
937     uint32_t ret;
938     uint8_t rx_buf[4];
939     int shortfall;
940 
941     if (reg <= R_MOD_ID) {
942         return xilinx_spips_read(opaque, addr, size);
943     } else {
944         switch (reg) {
945         case R_GQSPI_RXD:
946             if (fifo8_is_empty(&s->rx_fifo_g)) {
947                 qemu_log_mask(LOG_GUEST_ERROR,
948                               "Read from empty GQSPI RX FIFO\n");
949                 return 0;
950             }
951             memset(rx_buf, 0, sizeof(rx_buf));
952             shortfall = rx_data_bytes(&s->rx_fifo_g, rx_buf,
953                                       XILINX_SPIPS(s)->num_txrx_bytes);
954             ret = ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN) ?
955                   cpu_to_be32(*(uint32_t *)rx_buf) :
956                   cpu_to_le32(*(uint32_t *)rx_buf);
957             if (!ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN)) {
958                 ret <<= 8 * shortfall;
959             }
960             xlnx_zynqmp_qspips_check_flush(s);
961             xlnx_zynqmp_qspips_update_ixr(s);
962             return ret;
963         default:
964             return s->regs[reg];
965         }
966     }
967 }
968 
969 static void xilinx_spips_write(void *opaque, hwaddr addr,
970                                         uint64_t value, unsigned size)
971 {
972     int mask = ~0;
973     XilinxSPIPS *s = opaque;
974 
975     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr, (unsigned)value);
976     addr >>= 2;
977     switch (addr) {
978     case R_CONFIG:
979         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
980         if ((value & MAN_START_COM) && (s->regs[R_CONFIG] & MAN_START_EN)) {
981             s->man_start_com = true;
982         }
983         break;
984     case R_INTR_STATUS:
985         mask = IXR_ALL;
986         s->regs[R_INTR_STATUS] &= ~(mask & value);
987         goto no_reg_update;
988     case R_INTR_DIS:
989         mask = IXR_ALL;
990         s->regs[R_INTR_MASK] &= ~(mask & value);
991         goto no_reg_update;
992     case R_INTR_EN:
993         mask = IXR_ALL;
994         s->regs[R_INTR_MASK] |= mask & value;
995         goto no_reg_update;
996     case R_EN:
997         mask = 0x1;
998         break;
999     case R_SLAVE_IDLE_COUNT:
1000         mask = 0xFF;
1001         break;
1002     case R_RX_DATA:
1003     case R_INTR_MASK:
1004     case R_MOD_ID:
1005         mask = 0;
1006         break;
1007     case R_TX_DATA:
1008         tx_data_bytes(&s->tx_fifo, (uint32_t)value, s->num_txrx_bytes,
1009                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1010         goto no_reg_update;
1011     case R_TXD1:
1012         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 1,
1013                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1014         goto no_reg_update;
1015     case R_TXD2:
1016         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 2,
1017                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1018         goto no_reg_update;
1019     case R_TXD3:
1020         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 3,
1021                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1022         goto no_reg_update;
1023     }
1024     s->regs[addr] = (s->regs[addr] & ~mask) | (value & mask);
1025 no_reg_update:
1026     xilinx_spips_update_cs_lines(s);
1027     xilinx_spips_check_flush(s);
1028     xilinx_spips_update_cs_lines(s);
1029     xilinx_spips_update_ixr(s);
1030 }
1031 
1032 static const MemoryRegionOps spips_ops = {
1033     .read = xilinx_spips_read,
1034     .write = xilinx_spips_write,
1035     .endianness = DEVICE_LITTLE_ENDIAN,
1036 };
1037 
1038 static void xilinx_qspips_invalidate_mmio_ptr(XilinxQSPIPS *q)
1039 {
1040     q->lqspi_cached_addr = ~0ULL;
1041 }
1042 
1043 static void xilinx_qspips_write(void *opaque, hwaddr addr,
1044                                 uint64_t value, unsigned size)
1045 {
1046     XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
1047     XilinxSPIPS *s = XILINX_SPIPS(opaque);
1048 
1049     xilinx_spips_write(opaque, addr, value, size);
1050     addr >>= 2;
1051 
1052     if (addr == R_LQSPI_CFG) {
1053         xilinx_qspips_invalidate_mmio_ptr(q);
1054     }
1055     if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
1056         fifo8_reset(&s->rx_fifo);
1057     }
1058 }
1059 
1060 static void xlnx_zynqmp_qspips_write(void *opaque, hwaddr addr,
1061                                         uint64_t value, unsigned size)
1062 {
1063     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
1064     uint32_t reg = addr / 4;
1065 
1066     if (reg <= R_MOD_ID) {
1067         xilinx_qspips_write(opaque, addr, value, size);
1068     } else {
1069         switch (reg) {
1070         case R_GQSPI_CNFG:
1071             if (FIELD_EX32(value, GQSPI_CNFG, GEN_FIFO_START) &&
1072                 ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE)) {
1073                 s->man_start_com_g = true;
1074             }
1075             s->regs[reg] = value & ~(R_GQSPI_CNFG_GEN_FIFO_START_MASK);
1076             break;
1077         case R_GQSPI_GEN_FIFO:
1078             if (!fifo32_is_full(&s->fifo_g)) {
1079                 fifo32_push(&s->fifo_g, value);
1080             }
1081             break;
1082         case R_GQSPI_TXD:
1083             tx_data_bytes(&s->tx_fifo_g, (uint32_t)value, 4,
1084                           ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN));
1085             break;
1086         case R_GQSPI_FIFO_CTRL:
1087             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET)) {
1088                 fifo32_reset(&s->fifo_g);
1089             }
1090             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, TX_FIFO_RESET)) {
1091                 fifo8_reset(&s->tx_fifo_g);
1092             }
1093             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, RX_FIFO_RESET)) {
1094                 fifo8_reset(&s->rx_fifo_g);
1095             }
1096             break;
1097         case R_GQSPI_IDR:
1098             s->regs[R_GQSPI_IMR] |= value;
1099             break;
1100         case R_GQSPI_IER:
1101             s->regs[R_GQSPI_IMR] &= ~value;
1102             break;
1103         case R_GQSPI_ISR:
1104             s->regs[R_GQSPI_ISR] &= ~value;
1105             break;
1106         case R_GQSPI_IMR:
1107         case R_GQSPI_RXD:
1108         case R_GQSPI_GF_SNAPSHOT:
1109         case R_GQSPI_MOD_ID:
1110             break;
1111         default:
1112             s->regs[reg] = value;
1113             break;
1114         }
1115         xlnx_zynqmp_qspips_update_cs_lines(s);
1116         xlnx_zynqmp_qspips_check_flush(s);
1117         xlnx_zynqmp_qspips_update_cs_lines(s);
1118         xlnx_zynqmp_qspips_update_ixr(s);
1119     }
1120     xlnx_zynqmp_qspips_notify(s);
1121 }
1122 
1123 static const MemoryRegionOps qspips_ops = {
1124     .read = xilinx_spips_read,
1125     .write = xilinx_qspips_write,
1126     .endianness = DEVICE_LITTLE_ENDIAN,
1127 };
1128 
1129 static const MemoryRegionOps xlnx_zynqmp_qspips_ops = {
1130     .read = xlnx_zynqmp_qspips_read,
1131     .write = xlnx_zynqmp_qspips_write,
1132     .endianness = DEVICE_LITTLE_ENDIAN,
1133 };
1134 
1135 #define LQSPI_CACHE_SIZE 1024
1136 
1137 static void lqspi_load_cache(void *opaque, hwaddr addr)
1138 {
1139     XilinxQSPIPS *q = opaque;
1140     XilinxSPIPS *s = opaque;
1141     int i;
1142     int flash_addr = ((addr & ~(LQSPI_CACHE_SIZE - 1))
1143                    / num_effective_busses(s));
1144     int slave = flash_addr >> LQSPI_ADDRESS_BITS;
1145     int cache_entry = 0;
1146     uint32_t u_page_save = s->regs[R_LQSPI_STS] & ~LQSPI_CFG_U_PAGE;
1147 
1148     if (addr < q->lqspi_cached_addr ||
1149             addr > q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1150         xilinx_qspips_invalidate_mmio_ptr(q);
1151         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1152         s->regs[R_LQSPI_STS] |= slave ? LQSPI_CFG_U_PAGE : 0;
1153 
1154         DB_PRINT_L(0, "config reg status: %08x\n", s->regs[R_LQSPI_CFG]);
1155 
1156         fifo8_reset(&s->tx_fifo);
1157         fifo8_reset(&s->rx_fifo);
1158 
1159         /* instruction */
1160         DB_PRINT_L(0, "pushing read instruction: %02x\n",
1161                    (unsigned)(uint8_t)(s->regs[R_LQSPI_CFG] &
1162                                        LQSPI_CFG_INST_CODE));
1163         fifo8_push(&s->tx_fifo, s->regs[R_LQSPI_CFG] & LQSPI_CFG_INST_CODE);
1164         /* read address */
1165         DB_PRINT_L(0, "pushing read address %06x\n", flash_addr);
1166         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_ADDR4) {
1167             fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 24));
1168         }
1169         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 16));
1170         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 8));
1171         fifo8_push(&s->tx_fifo, (uint8_t)flash_addr);
1172         /* mode bits */
1173         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_MODE_EN) {
1174             fifo8_push(&s->tx_fifo, extract32(s->regs[R_LQSPI_CFG],
1175                                               LQSPI_CFG_MODE_SHIFT,
1176                                               LQSPI_CFG_MODE_WIDTH));
1177         }
1178         /* dummy bytes */
1179         for (i = 0; i < (extract32(s->regs[R_LQSPI_CFG], LQSPI_CFG_DUMMY_SHIFT,
1180                                    LQSPI_CFG_DUMMY_WIDTH)); ++i) {
1181             DB_PRINT_L(0, "pushing dummy byte\n");
1182             fifo8_push(&s->tx_fifo, 0);
1183         }
1184         xilinx_spips_update_cs_lines(s);
1185         xilinx_spips_flush_txfifo(s);
1186         fifo8_reset(&s->rx_fifo);
1187 
1188         DB_PRINT_L(0, "starting QSPI data read\n");
1189 
1190         while (cache_entry < LQSPI_CACHE_SIZE) {
1191             for (i = 0; i < 64; ++i) {
1192                 tx_data_bytes(&s->tx_fifo, 0, 1, false);
1193             }
1194             xilinx_spips_flush_txfifo(s);
1195             for (i = 0; i < 64; ++i) {
1196                 rx_data_bytes(&s->rx_fifo, &q->lqspi_buf[cache_entry++], 1);
1197             }
1198         }
1199 
1200         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1201         s->regs[R_LQSPI_STS] |= u_page_save;
1202         xilinx_spips_update_cs_lines(s);
1203 
1204         q->lqspi_cached_addr = flash_addr * num_effective_busses(s);
1205     }
1206 }
1207 
1208 static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
1209                               unsigned size, MemTxAttrs attrs)
1210 {
1211     XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
1212 
1213     if (addr >= q->lqspi_cached_addr &&
1214             addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1215         uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
1216         *value = cpu_to_le32(*(uint32_t *)retp);
1217         DB_PRINT_L(1, "addr: %08" HWADDR_PRIx ", data: %08" PRIx64 "\n",
1218                    addr, *value);
1219         return MEMTX_OK;
1220     }
1221 
1222     lqspi_load_cache(opaque, addr);
1223     return lqspi_read(opaque, addr, value, size, attrs);
1224 }
1225 
1226 static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,
1227                                unsigned size, MemTxAttrs attrs)
1228 {
1229     /*
1230      * From UG1085, Chapter 24 (Quad-SPI controllers):
1231      * - Writes are ignored
1232      * - AXI writes generate an external AXI slave error (SLVERR)
1233      */
1234     qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64
1235                                    " (value: 0x%" PRIx64 "\n",
1236                   __func__, size << 3, offset, value);
1237 
1238     return MEMTX_ERROR;
1239 }
1240 
1241 static const MemoryRegionOps lqspi_ops = {
1242     .read_with_attrs = lqspi_read,
1243     .write_with_attrs = lqspi_write,
1244     .endianness = DEVICE_NATIVE_ENDIAN,
1245     .impl = {
1246         .min_access_size = 4,
1247         .max_access_size = 4,
1248     },
1249     .valid = {
1250         .min_access_size = 1,
1251         .max_access_size = 4
1252     }
1253 };
1254 
1255 static void xilinx_spips_realize(DeviceState *dev, Error **errp)
1256 {
1257     XilinxSPIPS *s = XILINX_SPIPS(dev);
1258     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1259     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1260     qemu_irq *cs;
1261     int i;
1262 
1263     DB_PRINT_L(0, "realized spips\n");
1264 
1265     if (s->num_busses > MAX_NUM_BUSSES) {
1266         error_setg(errp,
1267                    "requested number of SPI busses %u exceeds maximum %d",
1268                    s->num_busses, MAX_NUM_BUSSES);
1269         return;
1270     }
1271     if (s->num_busses < MIN_NUM_BUSSES) {
1272         error_setg(errp,
1273                    "requested number of SPI busses %u is below minimum %d",
1274                    s->num_busses, MIN_NUM_BUSSES);
1275         return;
1276     }
1277 
1278     s->spi = g_new(SSIBus *, s->num_busses);
1279     for (i = 0; i < s->num_busses; ++i) {
1280         char bus_name[16];
1281         snprintf(bus_name, 16, "spi%d", i);
1282         s->spi[i] = ssi_create_bus(dev, bus_name);
1283     }
1284 
1285     s->cs_lines = g_new0(qemu_irq, s->num_cs * s->num_busses);
1286     s->cs_lines_state = g_new0(bool, s->num_cs * s->num_busses);
1287     for (i = 0, cs = s->cs_lines; i < s->num_busses; ++i, cs += s->num_cs) {
1288         ssi_auto_connect_slaves(DEVICE(s), cs, s->spi[i]);
1289     }
1290 
1291     sysbus_init_irq(sbd, &s->irq);
1292     for (i = 0; i < s->num_cs * s->num_busses; ++i) {
1293         sysbus_init_irq(sbd, &s->cs_lines[i]);
1294     }
1295 
1296     memory_region_init_io(&s->iomem, OBJECT(s), xsc->reg_ops, s,
1297                           "spi", XLNX_ZYNQMP_SPIPS_R_MAX * 4);
1298     sysbus_init_mmio(sbd, &s->iomem);
1299 
1300     s->irqline = -1;
1301 
1302     fifo8_create(&s->rx_fifo, xsc->rx_fifo_size);
1303     fifo8_create(&s->tx_fifo, xsc->tx_fifo_size);
1304 }
1305 
1306 static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
1307 {
1308     XilinxSPIPS *s = XILINX_SPIPS(dev);
1309     XilinxQSPIPS *q = XILINX_QSPIPS(dev);
1310     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1311 
1312     DB_PRINT_L(0, "realized qspips\n");
1313 
1314     s->num_busses = 2;
1315     s->num_cs = 2;
1316     s->num_txrx_bytes = 4;
1317 
1318     xilinx_spips_realize(dev, errp);
1319     memory_region_init_io(&s->mmlqspi, OBJECT(s), &lqspi_ops, s, "lqspi",
1320                           (1 << LQSPI_ADDRESS_BITS) * 2);
1321     sysbus_init_mmio(sbd, &s->mmlqspi);
1322 
1323     q->lqspi_cached_addr = ~0ULL;
1324 }
1325 
1326 static void xlnx_zynqmp_qspips_realize(DeviceState *dev, Error **errp)
1327 {
1328     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(dev);
1329     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1330 
1331     if (s->dma_burst_size > QSPI_DMA_MAX_BURST_SIZE) {
1332         error_setg(errp,
1333                    "qspi dma burst size %u exceeds maximum limit %d",
1334                    s->dma_burst_size, QSPI_DMA_MAX_BURST_SIZE);
1335         return;
1336     }
1337     xilinx_qspips_realize(dev, errp);
1338     fifo8_create(&s->rx_fifo_g, xsc->rx_fifo_size);
1339     fifo8_create(&s->tx_fifo_g, xsc->tx_fifo_size);
1340     fifo32_create(&s->fifo_g, 32);
1341 }
1342 
1343 static void xlnx_zynqmp_qspips_init(Object *obj)
1344 {
1345     XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(obj);
1346 
1347     object_property_add_link(obj, "stream-connected-dma", TYPE_STREAM_SLAVE,
1348                              (Object **)&rq->dma,
1349                              object_property_allow_set_link,
1350                              OBJ_PROP_LINK_STRONG,
1351                              NULL);
1352 }
1353 
1354 static int xilinx_spips_post_load(void *opaque, int version_id)
1355 {
1356     xilinx_spips_update_ixr((XilinxSPIPS *)opaque);
1357     xilinx_spips_update_cs_lines((XilinxSPIPS *)opaque);
1358     return 0;
1359 }
1360 
1361 static const VMStateDescription vmstate_xilinx_spips = {
1362     .name = "xilinx_spips",
1363     .version_id = 2,
1364     .minimum_version_id = 2,
1365     .post_load = xilinx_spips_post_load,
1366     .fields = (VMStateField[]) {
1367         VMSTATE_FIFO8(tx_fifo, XilinxSPIPS),
1368         VMSTATE_FIFO8(rx_fifo, XilinxSPIPS),
1369         VMSTATE_UINT32_ARRAY(regs, XilinxSPIPS, XLNX_SPIPS_R_MAX),
1370         VMSTATE_UINT8(snoop_state, XilinxSPIPS),
1371         VMSTATE_END_OF_LIST()
1372     }
1373 };
1374 
1375 static int xlnx_zynqmp_qspips_post_load(void *opaque, int version_id)
1376 {
1377     XlnxZynqMPQSPIPS *s = (XlnxZynqMPQSPIPS *)opaque;
1378     XilinxSPIPS *qs = XILINX_SPIPS(s);
1379 
1380     if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN) &&
1381         fifo8_is_empty(&qs->rx_fifo) && fifo8_is_empty(&qs->tx_fifo)) {
1382         xlnx_zynqmp_qspips_update_ixr(s);
1383         xlnx_zynqmp_qspips_update_cs_lines(s);
1384     }
1385     return 0;
1386 }
1387 
1388 static const VMStateDescription vmstate_xilinx_qspips = {
1389     .name = "xilinx_qspips",
1390     .version_id = 1,
1391     .minimum_version_id = 1,
1392     .fields = (VMStateField[]) {
1393         VMSTATE_STRUCT(parent_obj, XilinxQSPIPS, 0,
1394                        vmstate_xilinx_spips, XilinxSPIPS),
1395         VMSTATE_END_OF_LIST()
1396     }
1397 };
1398 
1399 static const VMStateDescription vmstate_xlnx_zynqmp_qspips = {
1400     .name = "xlnx_zynqmp_qspips",
1401     .version_id = 1,
1402     .minimum_version_id = 1,
1403     .post_load = xlnx_zynqmp_qspips_post_load,
1404     .fields = (VMStateField[]) {
1405         VMSTATE_STRUCT(parent_obj, XlnxZynqMPQSPIPS, 0,
1406                        vmstate_xilinx_qspips, XilinxQSPIPS),
1407         VMSTATE_FIFO8(tx_fifo_g, XlnxZynqMPQSPIPS),
1408         VMSTATE_FIFO8(rx_fifo_g, XlnxZynqMPQSPIPS),
1409         VMSTATE_FIFO32(fifo_g, XlnxZynqMPQSPIPS),
1410         VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPQSPIPS, XLNX_ZYNQMP_SPIPS_R_MAX),
1411         VMSTATE_END_OF_LIST()
1412     }
1413 };
1414 
1415 static Property xilinx_zynqmp_qspips_properties[] = {
1416     DEFINE_PROP_UINT32("dma-burst-size", XlnxZynqMPQSPIPS, dma_burst_size, 64),
1417     DEFINE_PROP_END_OF_LIST(),
1418 };
1419 
1420 static Property xilinx_spips_properties[] = {
1421     DEFINE_PROP_UINT8("num-busses", XilinxSPIPS, num_busses, 1),
1422     DEFINE_PROP_UINT8("num-ss-bits", XilinxSPIPS, num_cs, 4),
1423     DEFINE_PROP_UINT8("num-txrx-bytes", XilinxSPIPS, num_txrx_bytes, 1),
1424     DEFINE_PROP_END_OF_LIST(),
1425 };
1426 
1427 static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
1428 {
1429     DeviceClass *dc = DEVICE_CLASS(klass);
1430     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1431 
1432     dc->realize = xilinx_qspips_realize;
1433     xsc->reg_ops = &qspips_ops;
1434     xsc->rx_fifo_size = RXFF_A_Q;
1435     xsc->tx_fifo_size = TXFF_A_Q;
1436 }
1437 
1438 static void xilinx_spips_class_init(ObjectClass *klass, void *data)
1439 {
1440     DeviceClass *dc = DEVICE_CLASS(klass);
1441     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1442 
1443     dc->realize = xilinx_spips_realize;
1444     dc->reset = xilinx_spips_reset;
1445     dc->props = xilinx_spips_properties;
1446     dc->vmsd = &vmstate_xilinx_spips;
1447 
1448     xsc->reg_ops = &spips_ops;
1449     xsc->rx_fifo_size = RXFF_A;
1450     xsc->tx_fifo_size = TXFF_A;
1451 }
1452 
1453 static void xlnx_zynqmp_qspips_class_init(ObjectClass *klass, void * data)
1454 {
1455     DeviceClass *dc = DEVICE_CLASS(klass);
1456     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1457 
1458     dc->realize = xlnx_zynqmp_qspips_realize;
1459     dc->reset = xlnx_zynqmp_qspips_reset;
1460     dc->vmsd = &vmstate_xlnx_zynqmp_qspips;
1461     dc->props = xilinx_zynqmp_qspips_properties;
1462     xsc->reg_ops = &xlnx_zynqmp_qspips_ops;
1463     xsc->rx_fifo_size = RXFF_A_Q;
1464     xsc->tx_fifo_size = TXFF_A_Q;
1465 }
1466 
1467 static const TypeInfo xilinx_spips_info = {
1468     .name  = TYPE_XILINX_SPIPS,
1469     .parent = TYPE_SYS_BUS_DEVICE,
1470     .instance_size  = sizeof(XilinxSPIPS),
1471     .class_init = xilinx_spips_class_init,
1472     .class_size = sizeof(XilinxSPIPSClass),
1473 };
1474 
1475 static const TypeInfo xilinx_qspips_info = {
1476     .name  = TYPE_XILINX_QSPIPS,
1477     .parent = TYPE_XILINX_SPIPS,
1478     .instance_size  = sizeof(XilinxQSPIPS),
1479     .class_init = xilinx_qspips_class_init,
1480 };
1481 
1482 static const TypeInfo xlnx_zynqmp_qspips_info = {
1483     .name  = TYPE_XLNX_ZYNQMP_QSPIPS,
1484     .parent = TYPE_XILINX_QSPIPS,
1485     .instance_size  = sizeof(XlnxZynqMPQSPIPS),
1486     .instance_init  = xlnx_zynqmp_qspips_init,
1487     .class_init = xlnx_zynqmp_qspips_class_init,
1488 };
1489 
1490 static void xilinx_spips_register_types(void)
1491 {
1492     type_register_static(&xilinx_spips_info);
1493     type_register_static(&xilinx_qspips_info);
1494     type_register_static(&xlnx_zynqmp_qspips_info);
1495 }
1496 
1497 type_init(xilinx_spips_register_types)
1498