xref: /qemu/hw/ssi/xilinx_spips.c (revision cbf8b991f8a3ea293a6b43c6f4738cc0e19c722c)
1 /*
2  * QEMU model of the Xilinx Zynq SPI controller
3  *
4  * Copyright (c) 2012 Peter A. G. Crosthwaite
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "hw/sysbus.h"
27 #include "sysemu/sysemu.h"
28 #include "hw/ptimer.h"
29 #include "qemu/log.h"
30 #include "qemu/bitops.h"
31 #include "hw/ssi/xilinx_spips.h"
32 #include "qapi/error.h"
33 #include "hw/register.h"
34 #include "sysemu/dma.h"
35 #include "migration/blocker.h"
36 
37 #ifndef XILINX_SPIPS_ERR_DEBUG
38 #define XILINX_SPIPS_ERR_DEBUG 0
39 #endif
40 
41 #define DB_PRINT_L(level, ...) do { \
42     if (XILINX_SPIPS_ERR_DEBUG > (level)) { \
43         fprintf(stderr,  ": %s: ", __func__); \
44         fprintf(stderr, ## __VA_ARGS__); \
45     } \
46 } while (0);
47 
48 /* config register */
49 #define R_CONFIG            (0x00 / 4)
50 #define IFMODE              (1U << 31)
51 #define R_CONFIG_ENDIAN     (1 << 26)
52 #define MODEFAIL_GEN_EN     (1 << 17)
53 #define MAN_START_COM       (1 << 16)
54 #define MAN_START_EN        (1 << 15)
55 #define MANUAL_CS           (1 << 14)
56 #define CS                  (0xF << 10)
57 #define CS_SHIFT            (10)
58 #define PERI_SEL            (1 << 9)
59 #define REF_CLK             (1 << 8)
60 #define FIFO_WIDTH          (3 << 6)
61 #define BAUD_RATE_DIV       (7 << 3)
62 #define CLK_PH              (1 << 2)
63 #define CLK_POL             (1 << 1)
64 #define MODE_SEL            (1 << 0)
65 #define R_CONFIG_RSVD       (0x7bf40000)
66 
67 /* interrupt mechanism */
68 #define R_INTR_STATUS       (0x04 / 4)
69 #define R_INTR_EN           (0x08 / 4)
70 #define R_INTR_DIS          (0x0C / 4)
71 #define R_INTR_MASK         (0x10 / 4)
72 #define IXR_TX_FIFO_UNDERFLOW   (1 << 6)
73 /* Poll timeout not implemented */
74 #define IXR_RX_FIFO_EMPTY       (1 << 11)
75 #define IXR_GENERIC_FIFO_FULL   (1 << 10)
76 #define IXR_GENERIC_FIFO_NOT_FULL (1 << 9)
77 #define IXR_TX_FIFO_EMPTY       (1 << 8)
78 #define IXR_GENERIC_FIFO_EMPTY  (1 << 7)
79 #define IXR_RX_FIFO_FULL        (1 << 5)
80 #define IXR_RX_FIFO_NOT_EMPTY   (1 << 4)
81 #define IXR_TX_FIFO_FULL        (1 << 3)
82 #define IXR_TX_FIFO_NOT_FULL    (1 << 2)
83 #define IXR_TX_FIFO_MODE_FAIL   (1 << 1)
84 #define IXR_RX_FIFO_OVERFLOW    (1 << 0)
85 #define IXR_ALL                 ((1 << 13) - 1)
86 #define GQSPI_IXR_MASK          0xFBE
87 #define IXR_SELF_CLEAR \
88 (IXR_GENERIC_FIFO_EMPTY \
89 | IXR_GENERIC_FIFO_FULL  \
90 | IXR_GENERIC_FIFO_NOT_FULL \
91 | IXR_TX_FIFO_EMPTY \
92 | IXR_TX_FIFO_FULL  \
93 | IXR_TX_FIFO_NOT_FULL \
94 | IXR_RX_FIFO_EMPTY \
95 | IXR_RX_FIFO_FULL  \
96 | IXR_RX_FIFO_NOT_EMPTY)
97 
98 #define R_EN                (0x14 / 4)
99 #define R_DELAY             (0x18 / 4)
100 #define R_TX_DATA           (0x1C / 4)
101 #define R_RX_DATA           (0x20 / 4)
102 #define R_SLAVE_IDLE_COUNT  (0x24 / 4)
103 #define R_TX_THRES          (0x28 / 4)
104 #define R_RX_THRES          (0x2C / 4)
105 #define R_TXD1              (0x80 / 4)
106 #define R_TXD2              (0x84 / 4)
107 #define R_TXD3              (0x88 / 4)
108 
109 #define R_LQSPI_CFG         (0xa0 / 4)
110 #define R_LQSPI_CFG_RESET       0x03A002EB
111 #define LQSPI_CFG_LQ_MODE       (1U << 31)
112 #define LQSPI_CFG_TWO_MEM       (1 << 30)
113 #define LQSPI_CFG_SEP_BUS       (1 << 29)
114 #define LQSPI_CFG_U_PAGE        (1 << 28)
115 #define LQSPI_CFG_ADDR4         (1 << 27)
116 #define LQSPI_CFG_MODE_EN       (1 << 25)
117 #define LQSPI_CFG_MODE_WIDTH    8
118 #define LQSPI_CFG_MODE_SHIFT    16
119 #define LQSPI_CFG_DUMMY_WIDTH   3
120 #define LQSPI_CFG_DUMMY_SHIFT   8
121 #define LQSPI_CFG_INST_CODE     0xFF
122 
123 #define R_CMND        (0xc0 / 4)
124     #define R_CMND_RXFIFO_DRAIN   (1 << 19)
125     FIELD(CMND, PARTIAL_BYTE_LEN, 16, 3)
126 #define R_CMND_EXT_ADD        (1 << 15)
127     FIELD(CMND, RX_DISCARD, 8, 7)
128     FIELD(CMND, DUMMY_CYCLES, 2, 6)
129 #define R_CMND_DMA_EN         (1 << 1)
130 #define R_CMND_PUSH_WAIT      (1 << 0)
131 #define R_TRANSFER_SIZE     (0xc4 / 4)
132 #define R_LQSPI_STS         (0xA4 / 4)
133 #define LQSPI_STS_WR_RECVD      (1 << 1)
134 
135 #define R_MOD_ID            (0xFC / 4)
136 
137 #define R_GQSPI_SELECT          (0x144 / 4)
138     FIELD(GQSPI_SELECT, GENERIC_QSPI_EN, 0, 1)
139 #define R_GQSPI_ISR         (0x104 / 4)
140 #define R_GQSPI_IER         (0x108 / 4)
141 #define R_GQSPI_IDR         (0x10c / 4)
142 #define R_GQSPI_IMR         (0x110 / 4)
143 #define R_GQSPI_TX_THRESH   (0x128 / 4)
144 #define R_GQSPI_RX_THRESH   (0x12c / 4)
145 #define R_GQSPI_CNFG        (0x100 / 4)
146     FIELD(GQSPI_CNFG, MODE_EN, 30, 2)
147     FIELD(GQSPI_CNFG, GEN_FIFO_START_MODE, 29, 1)
148     FIELD(GQSPI_CNFG, GEN_FIFO_START, 28, 1)
149     FIELD(GQSPI_CNFG, ENDIAN, 26, 1)
150     /* Poll timeout not implemented */
151     FIELD(GQSPI_CNFG, EN_POLL_TIMEOUT, 20, 1)
152     /* QEMU doesnt care about any of these last three */
153     FIELD(GQSPI_CNFG, BR, 3, 3)
154     FIELD(GQSPI_CNFG, CPH, 2, 1)
155     FIELD(GQSPI_CNFG, CPL, 1, 1)
156 #define R_GQSPI_GEN_FIFO        (0x140 / 4)
157 #define R_GQSPI_TXD             (0x11c / 4)
158 #define R_GQSPI_RXD             (0x120 / 4)
159 #define R_GQSPI_FIFO_CTRL       (0x14c / 4)
160     FIELD(GQSPI_FIFO_CTRL, RX_FIFO_RESET, 2, 1)
161     FIELD(GQSPI_FIFO_CTRL, TX_FIFO_RESET, 1, 1)
162     FIELD(GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET, 0, 1)
163 #define R_GQSPI_GFIFO_THRESH    (0x150 / 4)
164 #define R_GQSPI_DATA_STS (0x15c / 4)
165 /* We use the snapshot register to hold the core state for the currently
166  * or most recently executed command. So the generic fifo format is defined
167  * for the snapshot register
168  */
169 #define R_GQSPI_GF_SNAPSHOT (0x160 / 4)
170     FIELD(GQSPI_GF_SNAPSHOT, POLL, 19, 1)
171     FIELD(GQSPI_GF_SNAPSHOT, STRIPE, 18, 1)
172     FIELD(GQSPI_GF_SNAPSHOT, RECIEVE, 17, 1)
173     FIELD(GQSPI_GF_SNAPSHOT, TRANSMIT, 16, 1)
174     FIELD(GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT, 14, 2)
175     FIELD(GQSPI_GF_SNAPSHOT, CHIP_SELECT, 12, 2)
176     FIELD(GQSPI_GF_SNAPSHOT, SPI_MODE, 10, 2)
177     FIELD(GQSPI_GF_SNAPSHOT, EXPONENT, 9, 1)
178     FIELD(GQSPI_GF_SNAPSHOT, DATA_XFER, 8, 1)
179     FIELD(GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA, 0, 8)
180 #define R_GQSPI_MOD_ID        (0x168 / 4)
181 #define R_GQSPI_MOD_ID_VALUE  0x010A0000
182 /* size of TXRX FIFOs */
183 #define RXFF_A          (128)
184 #define TXFF_A          (128)
185 
186 #define RXFF_A_Q          (64 * 4)
187 #define TXFF_A_Q          (64 * 4)
188 
189 /* 16MB per linear region */
190 #define LQSPI_ADDRESS_BITS 24
191 
192 #define SNOOP_CHECKING 0xFF
193 #define SNOOP_ADDR 0xF0
194 #define SNOOP_NONE 0xEE
195 #define SNOOP_STRIPING 0
196 
197 static inline int num_effective_busses(XilinxSPIPS *s)
198 {
199     return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
200             s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM) ? s->num_busses : 1;
201 }
202 
203 static void xilinx_spips_update_cs(XilinxSPIPS *s, int field)
204 {
205     int i;
206 
207     for (i = 0; i < s->num_cs; i++) {
208         bool old_state = s->cs_lines_state[i];
209         bool new_state = field & (1 << i);
210 
211         if (old_state != new_state) {
212             s->cs_lines_state[i] = new_state;
213             s->rx_discard = ARRAY_FIELD_EX32(s->regs, CMND, RX_DISCARD);
214             DB_PRINT_L(1, "%sselecting slave %d\n", new_state ? "" : "de", i);
215         }
216         qemu_set_irq(s->cs_lines[i], !new_state);
217     }
218     if (!(field & ((1 << s->num_cs) - 1))) {
219         s->snoop_state = SNOOP_CHECKING;
220         s->cmd_dummies = 0;
221         s->link_state = 1;
222         s->link_state_next = 1;
223         s->link_state_next_when = 0;
224         DB_PRINT_L(1, "moving to snoop check state\n");
225     }
226 }
227 
228 static void xlnx_zynqmp_qspips_update_cs_lines(XlnxZynqMPQSPIPS *s)
229 {
230     if (s->regs[R_GQSPI_GF_SNAPSHOT]) {
231         int field = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, CHIP_SELECT);
232         xilinx_spips_update_cs(XILINX_SPIPS(s), field);
233     }
234 }
235 
236 static void xilinx_spips_update_cs_lines(XilinxSPIPS *s)
237 {
238     int field = ~((s->regs[R_CONFIG] & CS) >> CS_SHIFT);
239 
240     /* In dual parallel, mirror low CS to both */
241     if (num_effective_busses(s) == 2) {
242         /* Single bit chip-select for qspi */
243         field &= 0x1;
244         field |= field << 1;
245     /* Dual stack U-Page */
246     } else if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM &&
247                s->regs[R_LQSPI_STS] & LQSPI_CFG_U_PAGE) {
248         /* Single bit chip-select for qspi */
249         field &= 0x1;
250         /* change from CS0 to CS1 */
251         field <<= 1;
252     }
253     /* Auto CS */
254     if (!(s->regs[R_CONFIG] & MANUAL_CS) &&
255         fifo8_is_empty(&s->tx_fifo)) {
256         field = 0;
257     }
258     xilinx_spips_update_cs(s, field);
259 }
260 
261 static void xilinx_spips_update_ixr(XilinxSPIPS *s)
262 {
263     if (!(s->regs[R_LQSPI_CFG] & LQSPI_CFG_LQ_MODE)) {
264         s->regs[R_INTR_STATUS] &= ~IXR_SELF_CLEAR;
265         s->regs[R_INTR_STATUS] |=
266             (fifo8_is_full(&s->rx_fifo) ? IXR_RX_FIFO_FULL : 0) |
267             (s->rx_fifo.num >= s->regs[R_RX_THRES] ?
268                                     IXR_RX_FIFO_NOT_EMPTY : 0) |
269             (fifo8_is_full(&s->tx_fifo) ? IXR_TX_FIFO_FULL : 0) |
270             (fifo8_is_empty(&s->tx_fifo) ? IXR_TX_FIFO_EMPTY : 0) |
271             (s->tx_fifo.num < s->regs[R_TX_THRES] ? IXR_TX_FIFO_NOT_FULL : 0);
272     }
273     int new_irqline = !!(s->regs[R_INTR_MASK] & s->regs[R_INTR_STATUS] &
274                                                                 IXR_ALL);
275     if (new_irqline != s->irqline) {
276         s->irqline = new_irqline;
277         qemu_set_irq(s->irq, s->irqline);
278     }
279 }
280 
281 static void xlnx_zynqmp_qspips_update_ixr(XlnxZynqMPQSPIPS *s)
282 {
283     uint32_t gqspi_int;
284     int new_irqline;
285 
286     s->regs[R_GQSPI_ISR] &= ~IXR_SELF_CLEAR;
287     s->regs[R_GQSPI_ISR] |=
288         (fifo32_is_empty(&s->fifo_g) ? IXR_GENERIC_FIFO_EMPTY : 0) |
289         (fifo32_is_full(&s->fifo_g) ? IXR_GENERIC_FIFO_FULL : 0) |
290         (s->fifo_g.fifo.num < s->regs[R_GQSPI_GFIFO_THRESH] ?
291                                     IXR_GENERIC_FIFO_NOT_FULL : 0) |
292         (fifo8_is_empty(&s->rx_fifo_g) ? IXR_RX_FIFO_EMPTY : 0) |
293         (fifo8_is_full(&s->rx_fifo_g) ? IXR_RX_FIFO_FULL : 0) |
294         (s->rx_fifo_g.num >= s->regs[R_GQSPI_RX_THRESH] ?
295                                     IXR_RX_FIFO_NOT_EMPTY : 0) |
296         (fifo8_is_empty(&s->tx_fifo_g) ? IXR_TX_FIFO_EMPTY : 0) |
297         (fifo8_is_full(&s->tx_fifo_g) ? IXR_TX_FIFO_FULL : 0) |
298         (s->tx_fifo_g.num < s->regs[R_GQSPI_TX_THRESH] ?
299                                     IXR_TX_FIFO_NOT_FULL : 0);
300 
301     /* GQSPI Interrupt Trigger Status */
302     gqspi_int = (~s->regs[R_GQSPI_IMR]) & s->regs[R_GQSPI_ISR] & GQSPI_IXR_MASK;
303     new_irqline = !!(gqspi_int & IXR_ALL);
304 
305     /* drive external interrupt pin */
306     if (new_irqline != s->gqspi_irqline) {
307         s->gqspi_irqline = new_irqline;
308         qemu_set_irq(XILINX_SPIPS(s)->irq, s->gqspi_irqline);
309     }
310 }
311 
312 static void xilinx_spips_reset(DeviceState *d)
313 {
314     XilinxSPIPS *s = XILINX_SPIPS(d);
315 
316     int i;
317     for (i = 0; i < XLNX_SPIPS_R_MAX; i++) {
318         s->regs[i] = 0;
319     }
320 
321     fifo8_reset(&s->rx_fifo);
322     fifo8_reset(&s->rx_fifo);
323     /* non zero resets */
324     s->regs[R_CONFIG] |= MODEFAIL_GEN_EN;
325     s->regs[R_SLAVE_IDLE_COUNT] = 0xFF;
326     s->regs[R_TX_THRES] = 1;
327     s->regs[R_RX_THRES] = 1;
328     /* FIXME: move magic number definition somewhere sensible */
329     s->regs[R_MOD_ID] = 0x01090106;
330     s->regs[R_LQSPI_CFG] = R_LQSPI_CFG_RESET;
331     s->link_state = 1;
332     s->link_state_next = 1;
333     s->link_state_next_when = 0;
334     s->snoop_state = SNOOP_CHECKING;
335     s->cmd_dummies = 0;
336     s->man_start_com = false;
337     xilinx_spips_update_ixr(s);
338     xilinx_spips_update_cs_lines(s);
339 }
340 
341 static void xlnx_zynqmp_qspips_reset(DeviceState *d)
342 {
343     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(d);
344     int i;
345 
346     xilinx_spips_reset(d);
347 
348     for (i = 0; i < XLNX_ZYNQMP_SPIPS_R_MAX; i++) {
349         s->regs[i] = 0;
350     }
351     fifo8_reset(&s->rx_fifo_g);
352     fifo8_reset(&s->rx_fifo_g);
353     fifo32_reset(&s->fifo_g);
354     s->regs[R_GQSPI_TX_THRESH] = 1;
355     s->regs[R_GQSPI_RX_THRESH] = 1;
356     s->regs[R_GQSPI_GFIFO_THRESH] = 1;
357     s->regs[R_GQSPI_IMR] = GQSPI_IXR_MASK;
358     s->regs[R_MOD_ID] = 0x01090101;
359     s->man_start_com_g = false;
360     s->gqspi_irqline = 0;
361     xlnx_zynqmp_qspips_update_ixr(s);
362 }
363 
364 /* N way (num) in place bit striper. Lay out row wise bits (MSB to LSB)
365  * column wise (from element 0 to N-1). num is the length of x, and dir
366  * reverses the direction of the transform. Best illustrated by example:
367  * Each digit in the below array is a single bit (num == 3):
368  *
369  * {{ 76543210, }  ----- stripe (dir == false) -----> {{ 741gdaFC, }
370  *  { hgfedcba, }                                      { 630fcHEB, }
371  *  { HGFEDCBA, }} <---- upstripe (dir == true) -----  { 52hebGDA, }}
372  */
373 
374 static inline void stripe8(uint8_t *x, int num, bool dir)
375 {
376     uint8_t r[num];
377     memset(r, 0, sizeof(uint8_t) * num);
378     int idx[2] = {0, 0};
379     int bit[2] = {0, 7};
380     int d = dir;
381 
382     for (idx[0] = 0; idx[0] < num; ++idx[0]) {
383         for (bit[0] = 7; bit[0] >= 0; bit[0]--) {
384             r[idx[!d]] |= x[idx[d]] & 1 << bit[d] ? 1 << bit[!d] : 0;
385             idx[1] = (idx[1] + 1) % num;
386             if (!idx[1]) {
387                 bit[1]--;
388             }
389         }
390     }
391     memcpy(x, r, sizeof(uint8_t) * num);
392 }
393 
394 static void xlnx_zynqmp_qspips_flush_fifo_g(XlnxZynqMPQSPIPS *s)
395 {
396     while (s->regs[R_GQSPI_DATA_STS] || !fifo32_is_empty(&s->fifo_g)) {
397         uint8_t tx_rx[2] = { 0 };
398         int num_stripes = 1;
399         uint8_t busses;
400         int i;
401 
402         if (!s->regs[R_GQSPI_DATA_STS]) {
403             uint8_t imm;
404 
405             s->regs[R_GQSPI_GF_SNAPSHOT] = fifo32_pop(&s->fifo_g);
406             DB_PRINT_L(0, "GQSPI command: %x\n", s->regs[R_GQSPI_GF_SNAPSHOT]);
407             if (!s->regs[R_GQSPI_GF_SNAPSHOT]) {
408                 DB_PRINT_L(0, "Dummy GQSPI Delay Command Entry, Do nothing");
409                 continue;
410             }
411             xlnx_zynqmp_qspips_update_cs_lines(s);
412 
413             imm = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
414             if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
415                 /* immedate transfer */
416                 if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
417                     ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
418                     s->regs[R_GQSPI_DATA_STS] = 1;
419                 /* CS setup/hold - do nothing */
420                 } else {
421                     s->regs[R_GQSPI_DATA_STS] = 0;
422                 }
423             } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, EXPONENT)) {
424                 if (imm > 31) {
425                     qemu_log_mask(LOG_UNIMP, "QSPI exponential transfer too"
426                                   " long - 2 ^ %" PRId8 " requested\n", imm);
427                 }
428                 s->regs[R_GQSPI_DATA_STS] = 1ul << imm;
429             } else {
430                 s->regs[R_GQSPI_DATA_STS] = imm;
431             }
432         }
433         /* Zero length transfer check */
434         if (!s->regs[R_GQSPI_DATA_STS]) {
435             continue;
436         }
437         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE) &&
438             fifo8_is_full(&s->rx_fifo_g)) {
439             /* No space in RX fifo for transfer - try again later */
440             return;
441         }
442         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, STRIPE) &&
443             (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
444              ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE))) {
445             num_stripes = 2;
446         }
447         if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
448             tx_rx[0] = ARRAY_FIELD_EX32(s->regs,
449                                         GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
450         } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT)) {
451             for (i = 0; i < num_stripes; ++i) {
452                 if (!fifo8_is_empty(&s->tx_fifo_g)) {
453                     tx_rx[i] = fifo8_pop(&s->tx_fifo_g);
454                     s->tx_fifo_g_align++;
455                 } else {
456                     return;
457                 }
458             }
459         }
460         if (num_stripes == 1) {
461             /* mirror */
462             tx_rx[1] = tx_rx[0];
463         }
464         busses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
465         for (i = 0; i < 2; ++i) {
466             DB_PRINT_L(1, "bus %d tx = %02x\n", i, tx_rx[i]);
467             tx_rx[i] = ssi_transfer(XILINX_SPIPS(s)->spi[i], tx_rx[i]);
468             DB_PRINT_L(1, "bus %d rx = %02x\n", i, tx_rx[i]);
469         }
470         if (s->regs[R_GQSPI_DATA_STS] > 1 &&
471             busses == 0x3 && num_stripes == 2) {
472             s->regs[R_GQSPI_DATA_STS] -= 2;
473         } else if (s->regs[R_GQSPI_DATA_STS] > 0) {
474             s->regs[R_GQSPI_DATA_STS]--;
475         }
476         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
477             for (i = 0; i < 2; ++i) {
478                 if (busses & (1 << i)) {
479                     DB_PRINT_L(1, "bus %d push_byte = %02x\n", i, tx_rx[i]);
480                     fifo8_push(&s->rx_fifo_g, tx_rx[i]);
481                     s->rx_fifo_g_align++;
482                 }
483             }
484         }
485         if (!s->regs[R_GQSPI_DATA_STS]) {
486             for (; s->tx_fifo_g_align % 4; s->tx_fifo_g_align++) {
487                 fifo8_pop(&s->tx_fifo_g);
488             }
489             for (; s->rx_fifo_g_align % 4; s->rx_fifo_g_align++) {
490                 fifo8_push(&s->rx_fifo_g, 0);
491             }
492         }
493     }
494 }
495 
496 static int xilinx_spips_num_dummies(XilinxQSPIPS *qs, uint8_t command)
497 {
498     if (!qs) {
499         /* The SPI device is not a QSPI device */
500         return -1;
501     }
502 
503     switch (command) { /* check for dummies */
504     case READ: /* no dummy bytes/cycles */
505     case PP:
506     case DPP:
507     case QPP:
508     case READ_4:
509     case PP_4:
510     case QPP_4:
511         return 0;
512     case FAST_READ:
513     case DOR:
514     case QOR:
515     case DOR_4:
516     case QOR_4:
517         return 1;
518     case DIOR:
519     case FAST_READ_4:
520     case DIOR_4:
521         return 2;
522     case QIOR:
523     case QIOR_4:
524         return 5;
525     default:
526         return -1;
527     }
528 }
529 
530 static inline uint8_t get_addr_length(XilinxSPIPS *s, uint8_t cmd)
531 {
532    switch (cmd) {
533    case PP_4:
534    case QPP_4:
535    case READ_4:
536    case QIOR_4:
537    case FAST_READ_4:
538    case DOR_4:
539    case QOR_4:
540    case DIOR_4:
541        return 4;
542    default:
543        return (s->regs[R_CMND] & R_CMND_EXT_ADD) ? 4 : 3;
544    }
545 }
546 
547 static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
548 {
549     int debug_level = 0;
550     XilinxQSPIPS *q = (XilinxQSPIPS *) object_dynamic_cast(OBJECT(s),
551                                                            TYPE_XILINX_QSPIPS);
552 
553     for (;;) {
554         int i;
555         uint8_t tx = 0;
556         uint8_t tx_rx[num_effective_busses(s)];
557         uint8_t dummy_cycles = 0;
558         uint8_t addr_length;
559 
560         if (fifo8_is_empty(&s->tx_fifo)) {
561             xilinx_spips_update_ixr(s);
562             return;
563         } else if (s->snoop_state == SNOOP_STRIPING) {
564             for (i = 0; i < num_effective_busses(s); ++i) {
565                 tx_rx[i] = fifo8_pop(&s->tx_fifo);
566             }
567             stripe8(tx_rx, num_effective_busses(s), false);
568         } else if (s->snoop_state >= SNOOP_ADDR) {
569             tx = fifo8_pop(&s->tx_fifo);
570             for (i = 0; i < num_effective_busses(s); ++i) {
571                 tx_rx[i] = tx;
572             }
573         } else {
574             /* Extract a dummy byte and generate dummy cycles according to the
575              * link state */
576             tx = fifo8_pop(&s->tx_fifo);
577             dummy_cycles = 8 / s->link_state;
578         }
579 
580         for (i = 0; i < num_effective_busses(s); ++i) {
581             int bus = num_effective_busses(s) - 1 - i;
582             if (dummy_cycles) {
583                 int d;
584                 for (d = 0; d < dummy_cycles; ++d) {
585                     tx_rx[0] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[0]);
586                 }
587             } else {
588                 DB_PRINT_L(debug_level, "tx = %02x\n", tx_rx[i]);
589                 tx_rx[i] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[i]);
590                 DB_PRINT_L(debug_level, "rx = %02x\n", tx_rx[i]);
591             }
592         }
593 
594         if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
595             DB_PRINT_L(debug_level, "dircarding drained rx byte\n");
596             /* Do nothing */
597         } else if (s->rx_discard) {
598             DB_PRINT_L(debug_level, "dircarding discarded rx byte\n");
599             s->rx_discard -= 8 / s->link_state;
600         } else if (fifo8_is_full(&s->rx_fifo)) {
601             s->regs[R_INTR_STATUS] |= IXR_RX_FIFO_OVERFLOW;
602             DB_PRINT_L(0, "rx FIFO overflow");
603         } else if (s->snoop_state == SNOOP_STRIPING) {
604             stripe8(tx_rx, num_effective_busses(s), true);
605             for (i = 0; i < num_effective_busses(s); ++i) {
606                 fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[i]);
607                 DB_PRINT_L(debug_level, "pushing striped rx byte\n");
608             }
609         } else {
610            DB_PRINT_L(debug_level, "pushing unstriped rx byte\n");
611            fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[0]);
612         }
613 
614         if (s->link_state_next_when) {
615             s->link_state_next_when--;
616             if (!s->link_state_next_when) {
617                 s->link_state = s->link_state_next;
618             }
619         }
620 
621         DB_PRINT_L(debug_level, "initial snoop state: %x\n",
622                    (unsigned)s->snoop_state);
623         switch (s->snoop_state) {
624         case (SNOOP_CHECKING):
625             /* Store the count of dummy bytes in the txfifo */
626             s->cmd_dummies = xilinx_spips_num_dummies(q, tx);
627             addr_length = get_addr_length(s, tx);
628             if (s->cmd_dummies < 0) {
629                 s->snoop_state = SNOOP_NONE;
630             } else {
631                 s->snoop_state = SNOOP_ADDR + addr_length - 1;
632             }
633             switch (tx) {
634             case DPP:
635             case DOR:
636             case DOR_4:
637                 s->link_state_next = 2;
638                 s->link_state_next_when = addr_length + s->cmd_dummies;
639                 break;
640             case QPP:
641             case QPP_4:
642             case QOR:
643             case QOR_4:
644                 s->link_state_next = 4;
645                 s->link_state_next_when = addr_length + s->cmd_dummies;
646                 break;
647             case DIOR:
648             case DIOR_4:
649                 s->link_state = 2;
650                 break;
651             case QIOR:
652             case QIOR_4:
653                 s->link_state = 4;
654                 break;
655             }
656             break;
657         case (SNOOP_ADDR):
658             /* Address has been transmitted, transmit dummy cycles now if
659              * needed */
660             if (s->cmd_dummies < 0) {
661                 s->snoop_state = SNOOP_NONE;
662             } else {
663                 s->snoop_state = s->cmd_dummies;
664             }
665             break;
666         case (SNOOP_STRIPING):
667         case (SNOOP_NONE):
668             /* Once we hit the boring stuff - squelch debug noise */
669             if (!debug_level) {
670                 DB_PRINT_L(0, "squelching debug info ....\n");
671                 debug_level = 1;
672             }
673             break;
674         default:
675             s->snoop_state--;
676         }
677         DB_PRINT_L(debug_level, "final snoop state: %x\n",
678                    (unsigned)s->snoop_state);
679     }
680 }
681 
682 static inline void tx_data_bytes(Fifo8 *fifo, uint32_t value, int num, bool be)
683 {
684     int i;
685     for (i = 0; i < num && !fifo8_is_full(fifo); ++i) {
686         if (be) {
687             fifo8_push(fifo, (uint8_t)(value >> 24));
688             value <<= 8;
689         } else {
690             fifo8_push(fifo, (uint8_t)value);
691             value >>= 8;
692         }
693     }
694 }
695 
696 static void xilinx_spips_check_zero_pump(XilinxSPIPS *s)
697 {
698     if (!s->regs[R_TRANSFER_SIZE]) {
699         return;
700     }
701     if (!fifo8_is_empty(&s->tx_fifo) && s->regs[R_CMND] & R_CMND_PUSH_WAIT) {
702         return;
703     }
704     /*
705      * The zero pump must never fill tx fifo such that rx overflow is
706      * possible
707      */
708     while (s->regs[R_TRANSFER_SIZE] &&
709            s->rx_fifo.num + s->tx_fifo.num < RXFF_A_Q - 3) {
710         /* endianess just doesn't matter when zero pumping */
711         tx_data_bytes(&s->tx_fifo, 0, 4, false);
712         s->regs[R_TRANSFER_SIZE] &= ~0x03ull;
713         s->regs[R_TRANSFER_SIZE] -= 4;
714     }
715 }
716 
717 static void xilinx_spips_check_flush(XilinxSPIPS *s)
718 {
719     if (s->man_start_com ||
720         (!fifo8_is_empty(&s->tx_fifo) &&
721          !(s->regs[R_CONFIG] & MAN_START_EN))) {
722         xilinx_spips_check_zero_pump(s);
723         xilinx_spips_flush_txfifo(s);
724     }
725     if (fifo8_is_empty(&s->tx_fifo) && !s->regs[R_TRANSFER_SIZE]) {
726         s->man_start_com = false;
727     }
728     xilinx_spips_update_ixr(s);
729 }
730 
731 static void xlnx_zynqmp_qspips_check_flush(XlnxZynqMPQSPIPS *s)
732 {
733     bool gqspi_has_work = s->regs[R_GQSPI_DATA_STS] ||
734                           !fifo32_is_empty(&s->fifo_g);
735 
736     if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
737         if (s->man_start_com_g || (gqspi_has_work &&
738              !ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE))) {
739             xlnx_zynqmp_qspips_flush_fifo_g(s);
740         }
741     } else {
742         xilinx_spips_check_flush(XILINX_SPIPS(s));
743     }
744     if (!gqspi_has_work) {
745         s->man_start_com_g = false;
746     }
747     xlnx_zynqmp_qspips_update_ixr(s);
748 }
749 
750 static inline int rx_data_bytes(Fifo8 *fifo, uint8_t *value, int max)
751 {
752     int i;
753 
754     for (i = 0; i < max && !fifo8_is_empty(fifo); ++i) {
755         value[i] = fifo8_pop(fifo);
756     }
757     return max - i;
758 }
759 
760 static const void *pop_buf(Fifo8 *fifo, uint32_t max, uint32_t *num)
761 {
762     void *ret;
763 
764     if (max == 0 || max > fifo->num) {
765         abort();
766     }
767     *num = MIN(fifo->capacity - fifo->head, max);
768     ret = &fifo->data[fifo->head];
769     fifo->head += *num;
770     fifo->head %= fifo->capacity;
771     fifo->num -= *num;
772     return ret;
773 }
774 
775 static void xlnx_zynqmp_qspips_notify(void *opaque)
776 {
777     XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(opaque);
778     XilinxSPIPS *s = XILINX_SPIPS(rq);
779     Fifo8 *recv_fifo;
780 
781     if (ARRAY_FIELD_EX32(rq->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
782         if (!(ARRAY_FIELD_EX32(rq->regs, GQSPI_CNFG, MODE_EN) == 2)) {
783             return;
784         }
785         recv_fifo = &rq->rx_fifo_g;
786     } else {
787         if (!(s->regs[R_CMND] & R_CMND_DMA_EN)) {
788             return;
789         }
790         recv_fifo = &s->rx_fifo;
791     }
792     while (recv_fifo->num >= 4
793            && stream_can_push(rq->dma, xlnx_zynqmp_qspips_notify, rq))
794     {
795         size_t ret;
796         uint32_t num;
797         const void *rxd = pop_buf(recv_fifo, 4, &num);
798 
799         memcpy(rq->dma_buf, rxd, num);
800 
801         ret = stream_push(rq->dma, rq->dma_buf, 4);
802         assert(ret == 4);
803         xlnx_zynqmp_qspips_check_flush(rq);
804     }
805 }
806 
807 static uint64_t xilinx_spips_read(void *opaque, hwaddr addr,
808                                                         unsigned size)
809 {
810     XilinxSPIPS *s = opaque;
811     uint32_t mask = ~0;
812     uint32_t ret;
813     uint8_t rx_buf[4];
814     int shortfall;
815 
816     addr >>= 2;
817     switch (addr) {
818     case R_CONFIG:
819         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
820         break;
821     case R_INTR_STATUS:
822         ret = s->regs[addr] & IXR_ALL;
823         s->regs[addr] = 0;
824         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
825         xilinx_spips_update_ixr(s);
826         return ret;
827     case R_INTR_MASK:
828         mask = IXR_ALL;
829         break;
830     case  R_EN:
831         mask = 0x1;
832         break;
833     case R_SLAVE_IDLE_COUNT:
834         mask = 0xFF;
835         break;
836     case R_MOD_ID:
837         mask = 0x01FFFFFF;
838         break;
839     case R_INTR_EN:
840     case R_INTR_DIS:
841     case R_TX_DATA:
842         mask = 0;
843         break;
844     case R_RX_DATA:
845         memset(rx_buf, 0, sizeof(rx_buf));
846         shortfall = rx_data_bytes(&s->rx_fifo, rx_buf, s->num_txrx_bytes);
847         ret = s->regs[R_CONFIG] & R_CONFIG_ENDIAN ?
848                         cpu_to_be32(*(uint32_t *)rx_buf) :
849                         cpu_to_le32(*(uint32_t *)rx_buf);
850         if (!(s->regs[R_CONFIG] & R_CONFIG_ENDIAN)) {
851             ret <<= 8 * shortfall;
852         }
853         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
854         xilinx_spips_check_flush(s);
855         xilinx_spips_update_ixr(s);
856         return ret;
857     }
858     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4,
859                s->regs[addr] & mask);
860     return s->regs[addr] & mask;
861 
862 }
863 
864 static uint64_t xlnx_zynqmp_qspips_read(void *opaque,
865                                         hwaddr addr, unsigned size)
866 {
867     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
868     uint32_t reg = addr / 4;
869     uint32_t ret;
870     uint8_t rx_buf[4];
871     int shortfall;
872 
873     if (reg <= R_MOD_ID) {
874         return xilinx_spips_read(opaque, addr, size);
875     } else {
876         switch (reg) {
877         case R_GQSPI_RXD:
878             if (fifo8_is_empty(&s->rx_fifo_g)) {
879                 qemu_log_mask(LOG_GUEST_ERROR,
880                               "Read from empty GQSPI RX FIFO\n");
881                 return 0;
882             }
883             memset(rx_buf, 0, sizeof(rx_buf));
884             shortfall = rx_data_bytes(&s->rx_fifo_g, rx_buf,
885                                       XILINX_SPIPS(s)->num_txrx_bytes);
886             ret = ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN) ?
887                   cpu_to_be32(*(uint32_t *)rx_buf) :
888                   cpu_to_le32(*(uint32_t *)rx_buf);
889             if (!ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN)) {
890                 ret <<= 8 * shortfall;
891             }
892             xlnx_zynqmp_qspips_check_flush(s);
893             xlnx_zynqmp_qspips_update_ixr(s);
894             return ret;
895         default:
896             return s->regs[reg];
897         }
898     }
899 }
900 
901 static void xilinx_spips_write(void *opaque, hwaddr addr,
902                                         uint64_t value, unsigned size)
903 {
904     int mask = ~0;
905     XilinxSPIPS *s = opaque;
906 
907     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr, (unsigned)value);
908     addr >>= 2;
909     switch (addr) {
910     case R_CONFIG:
911         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
912         if ((value & MAN_START_COM) && (s->regs[R_CONFIG] & MAN_START_EN)) {
913             s->man_start_com = true;
914         }
915         break;
916     case R_INTR_STATUS:
917         mask = IXR_ALL;
918         s->regs[R_INTR_STATUS] &= ~(mask & value);
919         goto no_reg_update;
920     case R_INTR_DIS:
921         mask = IXR_ALL;
922         s->regs[R_INTR_MASK] &= ~(mask & value);
923         goto no_reg_update;
924     case R_INTR_EN:
925         mask = IXR_ALL;
926         s->regs[R_INTR_MASK] |= mask & value;
927         goto no_reg_update;
928     case R_EN:
929         mask = 0x1;
930         break;
931     case R_SLAVE_IDLE_COUNT:
932         mask = 0xFF;
933         break;
934     case R_RX_DATA:
935     case R_INTR_MASK:
936     case R_MOD_ID:
937         mask = 0;
938         break;
939     case R_TX_DATA:
940         tx_data_bytes(&s->tx_fifo, (uint32_t)value, s->num_txrx_bytes,
941                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
942         goto no_reg_update;
943     case R_TXD1:
944         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 1,
945                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
946         goto no_reg_update;
947     case R_TXD2:
948         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 2,
949                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
950         goto no_reg_update;
951     case R_TXD3:
952         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 3,
953                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
954         goto no_reg_update;
955     }
956     s->regs[addr] = (s->regs[addr] & ~mask) | (value & mask);
957 no_reg_update:
958     xilinx_spips_update_cs_lines(s);
959     xilinx_spips_check_flush(s);
960     xilinx_spips_update_cs_lines(s);
961     xilinx_spips_update_ixr(s);
962 }
963 
964 static const MemoryRegionOps spips_ops = {
965     .read = xilinx_spips_read,
966     .write = xilinx_spips_write,
967     .endianness = DEVICE_LITTLE_ENDIAN,
968 };
969 
970 static void xilinx_qspips_invalidate_mmio_ptr(XilinxQSPIPS *q)
971 {
972     XilinxSPIPS *s = &q->parent_obj;
973 
974     if ((q->mmio_execution_enabled) && (q->lqspi_cached_addr != ~0ULL)) {
975         /* Invalidate the current mapped mmio */
976         memory_region_invalidate_mmio_ptr(&s->mmlqspi, q->lqspi_cached_addr,
977                                           LQSPI_CACHE_SIZE);
978     }
979 
980     q->lqspi_cached_addr = ~0ULL;
981 }
982 
983 static void xilinx_qspips_write(void *opaque, hwaddr addr,
984                                 uint64_t value, unsigned size)
985 {
986     XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
987     XilinxSPIPS *s = XILINX_SPIPS(opaque);
988 
989     xilinx_spips_write(opaque, addr, value, size);
990     addr >>= 2;
991 
992     if (addr == R_LQSPI_CFG) {
993         xilinx_qspips_invalidate_mmio_ptr(q);
994     }
995     if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
996         fifo8_reset(&s->rx_fifo);
997     }
998 }
999 
1000 static void xlnx_zynqmp_qspips_write(void *opaque, hwaddr addr,
1001                                         uint64_t value, unsigned size)
1002 {
1003     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
1004     uint32_t reg = addr / 4;
1005 
1006     if (reg <= R_MOD_ID) {
1007         xilinx_qspips_write(opaque, addr, value, size);
1008     } else {
1009         switch (reg) {
1010         case R_GQSPI_CNFG:
1011             if (FIELD_EX32(value, GQSPI_CNFG, GEN_FIFO_START) &&
1012                 ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE)) {
1013                 s->man_start_com_g = true;
1014             }
1015             s->regs[reg] = value & ~(R_GQSPI_CNFG_GEN_FIFO_START_MASK);
1016             break;
1017         case R_GQSPI_GEN_FIFO:
1018             if (!fifo32_is_full(&s->fifo_g)) {
1019                 fifo32_push(&s->fifo_g, value);
1020             }
1021             break;
1022         case R_GQSPI_TXD:
1023             tx_data_bytes(&s->tx_fifo_g, (uint32_t)value, 4,
1024                           ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN));
1025             break;
1026         case R_GQSPI_FIFO_CTRL:
1027             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET)) {
1028                 fifo32_reset(&s->fifo_g);
1029             }
1030             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, TX_FIFO_RESET)) {
1031                 fifo8_reset(&s->tx_fifo_g);
1032             }
1033             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, RX_FIFO_RESET)) {
1034                 fifo8_reset(&s->rx_fifo_g);
1035             }
1036             break;
1037         case R_GQSPI_IDR:
1038             s->regs[R_GQSPI_IMR] |= value;
1039             break;
1040         case R_GQSPI_IER:
1041             s->regs[R_GQSPI_IMR] &= ~value;
1042             break;
1043         case R_GQSPI_ISR:
1044             s->regs[R_GQSPI_ISR] &= ~value;
1045             break;
1046         case R_GQSPI_IMR:
1047         case R_GQSPI_RXD:
1048         case R_GQSPI_GF_SNAPSHOT:
1049         case R_GQSPI_MOD_ID:
1050             break;
1051         default:
1052             s->regs[reg] = value;
1053             break;
1054         }
1055         xlnx_zynqmp_qspips_update_cs_lines(s);
1056         xlnx_zynqmp_qspips_check_flush(s);
1057         xlnx_zynqmp_qspips_update_cs_lines(s);
1058         xlnx_zynqmp_qspips_update_ixr(s);
1059     }
1060     xlnx_zynqmp_qspips_notify(s);
1061 }
1062 
1063 static const MemoryRegionOps qspips_ops = {
1064     .read = xilinx_spips_read,
1065     .write = xilinx_qspips_write,
1066     .endianness = DEVICE_LITTLE_ENDIAN,
1067 };
1068 
1069 static const MemoryRegionOps xlnx_zynqmp_qspips_ops = {
1070     .read = xlnx_zynqmp_qspips_read,
1071     .write = xlnx_zynqmp_qspips_write,
1072     .endianness = DEVICE_LITTLE_ENDIAN,
1073 };
1074 
1075 #define LQSPI_CACHE_SIZE 1024
1076 
1077 static void lqspi_load_cache(void *opaque, hwaddr addr)
1078 {
1079     XilinxQSPIPS *q = opaque;
1080     XilinxSPIPS *s = opaque;
1081     int i;
1082     int flash_addr = ((addr & ~(LQSPI_CACHE_SIZE - 1))
1083                    / num_effective_busses(s));
1084     int slave = flash_addr >> LQSPI_ADDRESS_BITS;
1085     int cache_entry = 0;
1086     uint32_t u_page_save = s->regs[R_LQSPI_STS] & ~LQSPI_CFG_U_PAGE;
1087 
1088     if (addr < q->lqspi_cached_addr ||
1089             addr > q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1090         xilinx_qspips_invalidate_mmio_ptr(q);
1091         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1092         s->regs[R_LQSPI_STS] |= slave ? LQSPI_CFG_U_PAGE : 0;
1093 
1094         DB_PRINT_L(0, "config reg status: %08x\n", s->regs[R_LQSPI_CFG]);
1095 
1096         fifo8_reset(&s->tx_fifo);
1097         fifo8_reset(&s->rx_fifo);
1098 
1099         /* instruction */
1100         DB_PRINT_L(0, "pushing read instruction: %02x\n",
1101                    (unsigned)(uint8_t)(s->regs[R_LQSPI_CFG] &
1102                                        LQSPI_CFG_INST_CODE));
1103         fifo8_push(&s->tx_fifo, s->regs[R_LQSPI_CFG] & LQSPI_CFG_INST_CODE);
1104         /* read address */
1105         DB_PRINT_L(0, "pushing read address %06x\n", flash_addr);
1106         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_ADDR4) {
1107             fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 24));
1108         }
1109         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 16));
1110         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 8));
1111         fifo8_push(&s->tx_fifo, (uint8_t)flash_addr);
1112         /* mode bits */
1113         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_MODE_EN) {
1114             fifo8_push(&s->tx_fifo, extract32(s->regs[R_LQSPI_CFG],
1115                                               LQSPI_CFG_MODE_SHIFT,
1116                                               LQSPI_CFG_MODE_WIDTH));
1117         }
1118         /* dummy bytes */
1119         for (i = 0; i < (extract32(s->regs[R_LQSPI_CFG], LQSPI_CFG_DUMMY_SHIFT,
1120                                    LQSPI_CFG_DUMMY_WIDTH)); ++i) {
1121             DB_PRINT_L(0, "pushing dummy byte\n");
1122             fifo8_push(&s->tx_fifo, 0);
1123         }
1124         xilinx_spips_update_cs_lines(s);
1125         xilinx_spips_flush_txfifo(s);
1126         fifo8_reset(&s->rx_fifo);
1127 
1128         DB_PRINT_L(0, "starting QSPI data read\n");
1129 
1130         while (cache_entry < LQSPI_CACHE_SIZE) {
1131             for (i = 0; i < 64; ++i) {
1132                 tx_data_bytes(&s->tx_fifo, 0, 1, false);
1133             }
1134             xilinx_spips_flush_txfifo(s);
1135             for (i = 0; i < 64; ++i) {
1136                 rx_data_bytes(&s->rx_fifo, &q->lqspi_buf[cache_entry++], 1);
1137             }
1138         }
1139 
1140         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1141         s->regs[R_LQSPI_STS] |= u_page_save;
1142         xilinx_spips_update_cs_lines(s);
1143 
1144         q->lqspi_cached_addr = flash_addr * num_effective_busses(s);
1145     }
1146 }
1147 
1148 static void *lqspi_request_mmio_ptr(void *opaque, hwaddr addr, unsigned *size,
1149                                     unsigned *offset)
1150 {
1151     XilinxQSPIPS *q = opaque;
1152     hwaddr offset_within_the_region;
1153 
1154     if (!q->mmio_execution_enabled) {
1155         return NULL;
1156     }
1157 
1158     offset_within_the_region = addr & ~(LQSPI_CACHE_SIZE - 1);
1159     lqspi_load_cache(opaque, offset_within_the_region);
1160     *size = LQSPI_CACHE_SIZE;
1161     *offset = offset_within_the_region;
1162     return q->lqspi_buf;
1163 }
1164 
1165 static uint64_t
1166 lqspi_read(void *opaque, hwaddr addr, unsigned int size)
1167 {
1168     XilinxQSPIPS *q = opaque;
1169     uint32_t ret;
1170 
1171     if (addr >= q->lqspi_cached_addr &&
1172             addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1173         uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
1174         ret = cpu_to_le32(*(uint32_t *)retp);
1175         DB_PRINT_L(1, "addr: %08x, data: %08x\n", (unsigned)addr,
1176                    (unsigned)ret);
1177         return ret;
1178     } else {
1179         lqspi_load_cache(opaque, addr);
1180         return lqspi_read(opaque, addr, size);
1181     }
1182 }
1183 
1184 static const MemoryRegionOps lqspi_ops = {
1185     .read = lqspi_read,
1186     .request_ptr = lqspi_request_mmio_ptr,
1187     .endianness = DEVICE_NATIVE_ENDIAN,
1188     .valid = {
1189         .min_access_size = 1,
1190         .max_access_size = 4
1191     }
1192 };
1193 
1194 static void xilinx_spips_realize(DeviceState *dev, Error **errp)
1195 {
1196     XilinxSPIPS *s = XILINX_SPIPS(dev);
1197     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1198     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1199     qemu_irq *cs;
1200     int i;
1201 
1202     DB_PRINT_L(0, "realized spips\n");
1203 
1204     s->spi = g_new(SSIBus *, s->num_busses);
1205     for (i = 0; i < s->num_busses; ++i) {
1206         char bus_name[16];
1207         snprintf(bus_name, 16, "spi%d", i);
1208         s->spi[i] = ssi_create_bus(dev, bus_name);
1209     }
1210 
1211     s->cs_lines = g_new0(qemu_irq, s->num_cs * s->num_busses);
1212     s->cs_lines_state = g_new0(bool, s->num_cs * s->num_busses);
1213     for (i = 0, cs = s->cs_lines; i < s->num_busses; ++i, cs += s->num_cs) {
1214         ssi_auto_connect_slaves(DEVICE(s), cs, s->spi[i]);
1215     }
1216 
1217     sysbus_init_irq(sbd, &s->irq);
1218     for (i = 0; i < s->num_cs * s->num_busses; ++i) {
1219         sysbus_init_irq(sbd, &s->cs_lines[i]);
1220     }
1221 
1222     memory_region_init_io(&s->iomem, OBJECT(s), xsc->reg_ops, s,
1223                           "spi", XLNX_ZYNQMP_SPIPS_R_MAX * 4);
1224     sysbus_init_mmio(sbd, &s->iomem);
1225 
1226     s->irqline = -1;
1227 
1228     fifo8_create(&s->rx_fifo, xsc->rx_fifo_size);
1229     fifo8_create(&s->tx_fifo, xsc->tx_fifo_size);
1230 }
1231 
1232 static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
1233 {
1234     XilinxSPIPS *s = XILINX_SPIPS(dev);
1235     XilinxQSPIPS *q = XILINX_QSPIPS(dev);
1236     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1237 
1238     DB_PRINT_L(0, "realized qspips\n");
1239 
1240     s->num_busses = 2;
1241     s->num_cs = 2;
1242     s->num_txrx_bytes = 4;
1243 
1244     xilinx_spips_realize(dev, errp);
1245     memory_region_init_io(&s->mmlqspi, OBJECT(s), &lqspi_ops, s, "lqspi",
1246                           (1 << LQSPI_ADDRESS_BITS) * 2);
1247     sysbus_init_mmio(sbd, &s->mmlqspi);
1248 
1249     q->lqspi_cached_addr = ~0ULL;
1250 
1251     /* mmio_execution breaks migration better aborting than having strange
1252      * bugs.
1253      */
1254     if (q->mmio_execution_enabled) {
1255         error_setg(&q->migration_blocker,
1256                    "enabling mmio_execution breaks migration");
1257         migrate_add_blocker(q->migration_blocker, &error_fatal);
1258     }
1259 }
1260 
1261 static void xlnx_zynqmp_qspips_realize(DeviceState *dev, Error **errp)
1262 {
1263     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(dev);
1264     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1265 
1266     xilinx_qspips_realize(dev, errp);
1267     fifo8_create(&s->rx_fifo_g, xsc->rx_fifo_size);
1268     fifo8_create(&s->tx_fifo_g, xsc->tx_fifo_size);
1269     fifo32_create(&s->fifo_g, 32);
1270 }
1271 
1272 static void xlnx_zynqmp_qspips_init(Object *obj)
1273 {
1274     XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(obj);
1275 
1276     object_property_add_link(obj, "stream-connected-dma", TYPE_STREAM_SLAVE,
1277                              (Object **)&rq->dma,
1278                              object_property_allow_set_link,
1279                              OBJ_PROP_LINK_UNREF_ON_RELEASE,
1280                              NULL);
1281 }
1282 
1283 static int xilinx_spips_post_load(void *opaque, int version_id)
1284 {
1285     xilinx_spips_update_ixr((XilinxSPIPS *)opaque);
1286     xilinx_spips_update_cs_lines((XilinxSPIPS *)opaque);
1287     return 0;
1288 }
1289 
1290 static const VMStateDescription vmstate_xilinx_spips = {
1291     .name = "xilinx_spips",
1292     .version_id = 2,
1293     .minimum_version_id = 2,
1294     .post_load = xilinx_spips_post_load,
1295     .fields = (VMStateField[]) {
1296         VMSTATE_FIFO8(tx_fifo, XilinxSPIPS),
1297         VMSTATE_FIFO8(rx_fifo, XilinxSPIPS),
1298         VMSTATE_UINT32_ARRAY(regs, XilinxSPIPS, XLNX_SPIPS_R_MAX),
1299         VMSTATE_UINT8(snoop_state, XilinxSPIPS),
1300         VMSTATE_END_OF_LIST()
1301     }
1302 };
1303 
1304 static int xlnx_zynqmp_qspips_post_load(void *opaque, int version_id)
1305 {
1306     XlnxZynqMPQSPIPS *s = (XlnxZynqMPQSPIPS *)opaque;
1307     XilinxSPIPS *qs = XILINX_SPIPS(s);
1308 
1309     if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN) &&
1310         fifo8_is_empty(&qs->rx_fifo) && fifo8_is_empty(&qs->tx_fifo)) {
1311         xlnx_zynqmp_qspips_update_ixr(s);
1312         xlnx_zynqmp_qspips_update_cs_lines(s);
1313     }
1314     return 0;
1315 }
1316 
1317 static const VMStateDescription vmstate_xilinx_qspips = {
1318     .name = "xilinx_qspips",
1319     .version_id = 1,
1320     .minimum_version_id = 1,
1321     .fields = (VMStateField[]) {
1322         VMSTATE_STRUCT(parent_obj, XilinxQSPIPS, 0,
1323                        vmstate_xilinx_spips, XilinxSPIPS),
1324         VMSTATE_END_OF_LIST()
1325     }
1326 };
1327 
1328 static const VMStateDescription vmstate_xlnx_zynqmp_qspips = {
1329     .name = "xlnx_zynqmp_qspips",
1330     .version_id = 1,
1331     .minimum_version_id = 1,
1332     .post_load = xlnx_zynqmp_qspips_post_load,
1333     .fields = (VMStateField[]) {
1334         VMSTATE_STRUCT(parent_obj, XlnxZynqMPQSPIPS, 0,
1335                        vmstate_xilinx_qspips, XilinxQSPIPS),
1336         VMSTATE_FIFO8(tx_fifo_g, XlnxZynqMPQSPIPS),
1337         VMSTATE_FIFO8(rx_fifo_g, XlnxZynqMPQSPIPS),
1338         VMSTATE_FIFO32(fifo_g, XlnxZynqMPQSPIPS),
1339         VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPQSPIPS, XLNX_ZYNQMP_SPIPS_R_MAX),
1340         VMSTATE_END_OF_LIST()
1341     }
1342 };
1343 
1344 static Property xilinx_qspips_properties[] = {
1345     /* We had to turn this off for 2.10 as it is not compatible with migration.
1346      * It can be enabled but will prevent the device to be migrated.
1347      * This will go aways when a fix will be released.
1348      */
1349     DEFINE_PROP_BOOL("x-mmio-exec", XilinxQSPIPS, mmio_execution_enabled,
1350                      false),
1351     DEFINE_PROP_END_OF_LIST(),
1352 };
1353 
1354 static Property xilinx_spips_properties[] = {
1355     DEFINE_PROP_UINT8("num-busses", XilinxSPIPS, num_busses, 1),
1356     DEFINE_PROP_UINT8("num-ss-bits", XilinxSPIPS, num_cs, 4),
1357     DEFINE_PROP_UINT8("num-txrx-bytes", XilinxSPIPS, num_txrx_bytes, 1),
1358     DEFINE_PROP_END_OF_LIST(),
1359 };
1360 
1361 static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
1362 {
1363     DeviceClass *dc = DEVICE_CLASS(klass);
1364     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1365 
1366     dc->realize = xilinx_qspips_realize;
1367     dc->props = xilinx_qspips_properties;
1368     xsc->reg_ops = &qspips_ops;
1369     xsc->rx_fifo_size = RXFF_A_Q;
1370     xsc->tx_fifo_size = TXFF_A_Q;
1371 }
1372 
1373 static void xilinx_spips_class_init(ObjectClass *klass, void *data)
1374 {
1375     DeviceClass *dc = DEVICE_CLASS(klass);
1376     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1377 
1378     dc->realize = xilinx_spips_realize;
1379     dc->reset = xilinx_spips_reset;
1380     dc->props = xilinx_spips_properties;
1381     dc->vmsd = &vmstate_xilinx_spips;
1382 
1383     xsc->reg_ops = &spips_ops;
1384     xsc->rx_fifo_size = RXFF_A;
1385     xsc->tx_fifo_size = TXFF_A;
1386 }
1387 
1388 static void xlnx_zynqmp_qspips_class_init(ObjectClass *klass, void * data)
1389 {
1390     DeviceClass *dc = DEVICE_CLASS(klass);
1391     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1392 
1393     dc->realize = xlnx_zynqmp_qspips_realize;
1394     dc->reset = xlnx_zynqmp_qspips_reset;
1395     dc->vmsd = &vmstate_xlnx_zynqmp_qspips;
1396     xsc->reg_ops = &xlnx_zynqmp_qspips_ops;
1397     xsc->rx_fifo_size = RXFF_A_Q;
1398     xsc->tx_fifo_size = TXFF_A_Q;
1399 }
1400 
1401 static const TypeInfo xilinx_spips_info = {
1402     .name  = TYPE_XILINX_SPIPS,
1403     .parent = TYPE_SYS_BUS_DEVICE,
1404     .instance_size  = sizeof(XilinxSPIPS),
1405     .class_init = xilinx_spips_class_init,
1406     .class_size = sizeof(XilinxSPIPSClass),
1407 };
1408 
1409 static const TypeInfo xilinx_qspips_info = {
1410     .name  = TYPE_XILINX_QSPIPS,
1411     .parent = TYPE_XILINX_SPIPS,
1412     .instance_size  = sizeof(XilinxQSPIPS),
1413     .class_init = xilinx_qspips_class_init,
1414 };
1415 
1416 static const TypeInfo xlnx_zynqmp_qspips_info = {
1417     .name  = TYPE_XLNX_ZYNQMP_QSPIPS,
1418     .parent = TYPE_XILINX_QSPIPS,
1419     .instance_size  = sizeof(XlnxZynqMPQSPIPS),
1420     .instance_init  = xlnx_zynqmp_qspips_init,
1421     .class_init = xlnx_zynqmp_qspips_class_init,
1422 };
1423 
1424 static void xilinx_spips_register_types(void)
1425 {
1426     type_register_static(&xilinx_spips_info);
1427     type_register_static(&xilinx_qspips_info);
1428     type_register_static(&xlnx_zynqmp_qspips_info);
1429 }
1430 
1431 type_init(xilinx_spips_register_types)
1432