qemu/hw/ssi/aspeed_smc.c
<<
>>
Prefs
   1/*
   2 * ASPEED AST2400 SMC Controller (SPI Flash Only)
   3 *
   4 * Copyright (C) 2016 IBM Corp.
   5 *
   6 * Permission is hereby granted, free of charge, to any person obtaining a copy
   7 * of this software and associated documentation files (the "Software"), to deal
   8 * in the Software without restriction, including without limitation the rights
   9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10 * copies of the Software, and to permit persons to whom the Software is
  11 * furnished to do so, subject to the following conditions:
  12 *
  13 * The above copyright notice and this permission notice shall be included in
  14 * all copies or substantial portions of the Software.
  15 *
  16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22 * THE SOFTWARE.
  23 */
  24
  25#include "qemu/osdep.h"
  26#include "hw/sysbus.h"
  27#include "sysemu/sysemu.h"
  28#include "qemu/log.h"
  29#include "include/qemu/error-report.h"
  30#include "exec/address-spaces.h"
  31
  32#include "hw/ssi/aspeed_smc.h"
  33
  34/* CE Type Setting Register */
  35#define R_CONF            (0x00 / 4)
  36#define   CONF_LEGACY_DISABLE  (1 << 31)
  37#define   CONF_ENABLE_W4       20
  38#define   CONF_ENABLE_W3       19
  39#define   CONF_ENABLE_W2       18
  40#define   CONF_ENABLE_W1       17
  41#define   CONF_ENABLE_W0       16
  42#define   CONF_FLASH_TYPE4     8
  43#define   CONF_FLASH_TYPE3     6
  44#define   CONF_FLASH_TYPE2     4
  45#define   CONF_FLASH_TYPE1     2
  46#define   CONF_FLASH_TYPE0     0
  47#define      CONF_FLASH_TYPE_NOR   0x0
  48#define      CONF_FLASH_TYPE_NAND  0x1
  49#define      CONF_FLASH_TYPE_SPI   0x2
  50
  51/* CE Control Register */
  52#define R_CE_CTRL            (0x04 / 4)
  53#define   CTRL_EXTENDED4       4  /* 32 bit addressing for SPI */
  54#define   CTRL_EXTENDED3       3  /* 32 bit addressing for SPI */
  55#define   CTRL_EXTENDED2       2  /* 32 bit addressing for SPI */
  56#define   CTRL_EXTENDED1       1  /* 32 bit addressing for SPI */
  57#define   CTRL_EXTENDED0       0  /* 32 bit addressing for SPI */
  58
  59/* Interrupt Control and Status Register */
  60#define R_INTR_CTRL       (0x08 / 4)
  61#define   INTR_CTRL_DMA_STATUS            (1 << 11)
  62#define   INTR_CTRL_CMD_ABORT_STATUS      (1 << 10)
  63#define   INTR_CTRL_WRITE_PROTECT_STATUS  (1 << 9)
  64#define   INTR_CTRL_DMA_EN                (1 << 3)
  65#define   INTR_CTRL_CMD_ABORT_EN          (1 << 2)
  66#define   INTR_CTRL_WRITE_PROTECT_EN      (1 << 1)
  67
  68/* CEx Control Register */
  69#define R_CTRL0           (0x10 / 4)
  70#define   CTRL_CMD_SHIFT           16
  71#define   CTRL_CMD_MASK            0xff
  72#define   CTRL_DUMMY_HIGH_SHIFT    14
  73#define   CTRL_AST2400_SPI_4BYTE   (1 << 13)
  74#define   CTRL_DUMMY_LOW_SHIFT     6 /* 2 bits [7:6] */
  75#define   CTRL_CE_STOP_ACTIVE      (1 << 2)
  76#define   CTRL_CMD_MODE_MASK       0x3
  77#define     CTRL_READMODE          0x0
  78#define     CTRL_FREADMODE         0x1
  79#define     CTRL_WRITEMODE         0x2
  80#define     CTRL_USERMODE          0x3
  81#define R_CTRL1           (0x14 / 4)
  82#define R_CTRL2           (0x18 / 4)
  83#define R_CTRL3           (0x1C / 4)
  84#define R_CTRL4           (0x20 / 4)
  85
  86/* CEx Segment Address Register */
  87#define R_SEG_ADDR0       (0x30 / 4)
  88#define   SEG_END_SHIFT        24   /* 8MB units */
  89#define   SEG_END_MASK         0xff
  90#define   SEG_START_SHIFT      16   /* address bit [A29-A23] */
  91#define   SEG_START_MASK       0xff
  92#define R_SEG_ADDR1       (0x34 / 4)
  93#define R_SEG_ADDR2       (0x38 / 4)
  94#define R_SEG_ADDR3       (0x3C / 4)
  95#define R_SEG_ADDR4       (0x40 / 4)
  96
  97/* Misc Control Register #1 */
  98#define R_MISC_CTRL1      (0x50 / 4)
  99
 100/* Misc Control Register #2 */
 101#define R_MISC_CTRL2      (0x54 / 4)
 102
 103/* DMA Control/Status Register */
 104#define R_DMA_CTRL        (0x80 / 4)
 105#define   DMA_CTRL_DELAY_MASK   0xf
 106#define   DMA_CTRL_DELAY_SHIFT  8
 107#define   DMA_CTRL_FREQ_MASK    0xf
 108#define   DMA_CTRL_FREQ_SHIFT   4
 109#define   DMA_CTRL_MODE         (1 << 3)
 110#define   DMA_CTRL_CKSUM        (1 << 2)
 111#define   DMA_CTRL_DIR          (1 << 1)
 112#define   DMA_CTRL_EN           (1 << 0)
 113
 114/* DMA Flash Side Address */
 115#define R_DMA_FLASH_ADDR  (0x84 / 4)
 116
 117/* DMA DRAM Side Address */
 118#define R_DMA_DRAM_ADDR   (0x88 / 4)
 119
 120/* DMA Length Register */
 121#define R_DMA_LEN         (0x8C / 4)
 122
 123/* Checksum Calculation Result */
 124#define R_DMA_CHECKSUM    (0x90 / 4)
 125
 126/* Misc Control Register #2 */
 127#define R_TIMINGS         (0x94 / 4)
 128
 129/* SPI controller registers and bits */
 130#define R_SPI_CONF        (0x00 / 4)
 131#define   SPI_CONF_ENABLE_W0   0
 132#define R_SPI_CTRL0       (0x4 / 4)
 133#define R_SPI_MISC_CTRL   (0x10 / 4)
 134#define R_SPI_TIMINGS     (0x14 / 4)
 135
 136#define ASPEED_SMC_R_SPI_MAX (0x20 / 4)
 137#define ASPEED_SMC_R_SMC_MAX (0x20 / 4)
 138
 139#define ASPEED_SOC_SMC_FLASH_BASE   0x10000000
 140#define ASPEED_SOC_FMC_FLASH_BASE   0x20000000
 141#define ASPEED_SOC_SPI_FLASH_BASE   0x30000000
 142#define ASPEED_SOC_SPI2_FLASH_BASE  0x38000000
 143
 144/* Flash opcodes. */
 145#define SPI_OP_READ       0x03    /* Read data bytes (low frequency) */
 146
 147/*
 148 * Default segments mapping addresses and size for each slave per
 149 * controller. These can be changed when board is initialized with the
 150 * Segment Address Registers.
 151 */
 152static const AspeedSegments aspeed_segments_legacy[] = {
 153    { 0x10000000, 32 * 1024 * 1024 },
 154};
 155
 156static const AspeedSegments aspeed_segments_fmc[] = {
 157    { 0x20000000, 64 * 1024 * 1024 }, /* start address is readonly */
 158    { 0x24000000, 32 * 1024 * 1024 },
 159    { 0x26000000, 32 * 1024 * 1024 },
 160    { 0x28000000, 32 * 1024 * 1024 },
 161    { 0x2A000000, 32 * 1024 * 1024 }
 162};
 163
 164static const AspeedSegments aspeed_segments_spi[] = {
 165    { 0x30000000, 64 * 1024 * 1024 },
 166};
 167
 168static const AspeedSegments aspeed_segments_ast2500_fmc[] = {
 169    { 0x20000000, 128 * 1024 * 1024 }, /* start address is readonly */
 170    { 0x28000000,  32 * 1024 * 1024 },
 171    { 0x2A000000,  32 * 1024 * 1024 },
 172};
 173
 174static const AspeedSegments aspeed_segments_ast2500_spi1[] = {
 175    { 0x30000000, 32 * 1024 * 1024 }, /* start address is readonly */
 176    { 0x32000000, 96 * 1024 * 1024 }, /* end address is readonly */
 177};
 178
 179static const AspeedSegments aspeed_segments_ast2500_spi2[] = {
 180    { 0x38000000, 32 * 1024 * 1024 }, /* start address is readonly */
 181    { 0x3A000000, 96 * 1024 * 1024 }, /* end address is readonly */
 182};
 183
 184static const AspeedSMCController controllers[] = {
 185    {
 186        .name              = "aspeed.smc.smc",
 187        .r_conf            = R_CONF,
 188        .r_ce_ctrl         = R_CE_CTRL,
 189        .r_ctrl0           = R_CTRL0,
 190        .r_timings         = R_TIMINGS,
 191        .conf_enable_w0    = CONF_ENABLE_W0,
 192        .max_slaves        = 5,
 193        .segments          = aspeed_segments_legacy,
 194        .flash_window_base = ASPEED_SOC_SMC_FLASH_BASE,
 195        .flash_window_size = 0x6000000,
 196        .has_dma           = false,
 197        .nregs             = ASPEED_SMC_R_SMC_MAX,
 198    }, {
 199        .name              = "aspeed.smc.fmc",
 200        .r_conf            = R_CONF,
 201        .r_ce_ctrl         = R_CE_CTRL,
 202        .r_ctrl0           = R_CTRL0,
 203        .r_timings         = R_TIMINGS,
 204        .conf_enable_w0    = CONF_ENABLE_W0,
 205        .max_slaves        = 5,
 206        .segments          = aspeed_segments_fmc,
 207        .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE,
 208        .flash_window_size = 0x10000000,
 209        .has_dma           = true,
 210        .nregs             = ASPEED_SMC_R_MAX,
 211    }, {
 212        .name              = "aspeed.smc.spi",
 213        .r_conf            = R_SPI_CONF,
 214        .r_ce_ctrl         = 0xff,
 215        .r_ctrl0           = R_SPI_CTRL0,
 216        .r_timings         = R_SPI_TIMINGS,
 217        .conf_enable_w0    = SPI_CONF_ENABLE_W0,
 218        .max_slaves        = 1,
 219        .segments          = aspeed_segments_spi,
 220        .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE,
 221        .flash_window_size = 0x10000000,
 222        .has_dma           = false,
 223        .nregs             = ASPEED_SMC_R_SPI_MAX,
 224    }, {
 225        .name              = "aspeed.smc.ast2500-fmc",
 226        .r_conf            = R_CONF,
 227        .r_ce_ctrl         = R_CE_CTRL,
 228        .r_ctrl0           = R_CTRL0,
 229        .r_timings         = R_TIMINGS,
 230        .conf_enable_w0    = CONF_ENABLE_W0,
 231        .max_slaves        = 3,
 232        .segments          = aspeed_segments_ast2500_fmc,
 233        .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE,
 234        .flash_window_size = 0x10000000,
 235        .has_dma           = true,
 236        .nregs             = ASPEED_SMC_R_MAX,
 237    }, {
 238        .name              = "aspeed.smc.ast2500-spi1",
 239        .r_conf            = R_CONF,
 240        .r_ce_ctrl         = R_CE_CTRL,
 241        .r_ctrl0           = R_CTRL0,
 242        .r_timings         = R_TIMINGS,
 243        .conf_enable_w0    = CONF_ENABLE_W0,
 244        .max_slaves        = 2,
 245        .segments          = aspeed_segments_ast2500_spi1,
 246        .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE,
 247        .flash_window_size = 0x8000000,
 248        .has_dma           = false,
 249        .nregs             = ASPEED_SMC_R_MAX,
 250    }, {
 251        .name              = "aspeed.smc.ast2500-spi2",
 252        .r_conf            = R_CONF,
 253        .r_ce_ctrl         = R_CE_CTRL,
 254        .r_ctrl0           = R_CTRL0,
 255        .r_timings         = R_TIMINGS,
 256        .conf_enable_w0    = CONF_ENABLE_W0,
 257        .max_slaves        = 2,
 258        .segments          = aspeed_segments_ast2500_spi2,
 259        .flash_window_base = ASPEED_SOC_SPI2_FLASH_BASE,
 260        .flash_window_size = 0x8000000,
 261        .has_dma           = false,
 262        .nregs             = ASPEED_SMC_R_MAX,
 263    },
 264};
 265
 266/*
 267 * The Segment Register uses a 8MB unit to encode the start address
 268 * and the end address of the mapping window of a flash SPI slave :
 269 *
 270 *        | byte 1 | byte 2 | byte 3 | byte 4 |
 271 *        +--------+--------+--------+--------+
 272 *        |  end   |  start |   0    |   0    |
 273 *
 274 */
 275static inline uint32_t aspeed_smc_segment_to_reg(const AspeedSegments *seg)
 276{
 277    uint32_t reg = 0;
 278    reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT;
 279    reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT;
 280    return reg;
 281}
 282
 283static inline void aspeed_smc_reg_to_segment(uint32_t reg, AspeedSegments *seg)
 284{
 285    seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23;
 286    seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr;
 287}
 288
 289static bool aspeed_smc_flash_overlap(const AspeedSMCState *s,
 290                                     const AspeedSegments *new,
 291                                     int cs)
 292{
 293    AspeedSegments seg;
 294    int i;
 295
 296    for (i = 0; i < s->ctrl->max_slaves; i++) {
 297        if (i == cs) {
 298            continue;
 299        }
 300
 301        aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + i], &seg);
 302
 303        if (new->addr + new->size > seg.addr &&
 304            new->addr < seg.addr + seg.size) {
 305            qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment CS%d [ 0x%"
 306                          HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with "
 307                          "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n",
 308                          s->ctrl->name, cs, new->addr, new->addr + new->size,
 309                          i, seg.addr, seg.addr + seg.size);
 310            return true;
 311        }
 312    }
 313    return false;
 314}
 315
 316static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
 317                                         uint64_t new)
 318{
 319    AspeedSMCFlash *fl = &s->flashes[cs];
 320    AspeedSegments seg;
 321
 322    aspeed_smc_reg_to_segment(new, &seg);
 323
 324    /* The start address of CS0 is read-only */
 325    if (cs == 0 && seg.addr != s->ctrl->flash_window_base) {
 326        qemu_log_mask(LOG_GUEST_ERROR,
 327                      "%s: Tried to change CS0 start address to 0x%"
 328                      HWADDR_PRIx "\n", s->ctrl->name, seg.addr);
 329        seg.addr = s->ctrl->flash_window_base;
 330        new = aspeed_smc_segment_to_reg(&seg);
 331    }
 332
 333    /*
 334     * The end address of the AST2500 spi controllers is also
 335     * read-only.
 336     */
 337    if ((s->ctrl->segments == aspeed_segments_ast2500_spi1 ||
 338         s->ctrl->segments == aspeed_segments_ast2500_spi2) &&
 339        cs == s->ctrl->max_slaves &&
 340        seg.addr + seg.size != s->ctrl->segments[cs].addr +
 341        s->ctrl->segments[cs].size) {
 342        qemu_log_mask(LOG_GUEST_ERROR,
 343                      "%s: Tried to change CS%d end address to 0x%"
 344                      HWADDR_PRIx "\n", s->ctrl->name, cs, seg.addr + seg.size);
 345        seg.size = s->ctrl->segments[cs].addr + s->ctrl->segments[cs].size -
 346            seg.addr;
 347        new = aspeed_smc_segment_to_reg(&seg);
 348    }
 349
 350    /* Keep the segment in the overall flash window */
 351    if (seg.addr + seg.size <= s->ctrl->flash_window_base ||
 352        seg.addr > s->ctrl->flash_window_base + s->ctrl->flash_window_size) {
 353        qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is invalid : "
 354                      "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n",
 355                      s->ctrl->name, cs, seg.addr, seg.addr + seg.size);
 356        return;
 357    }
 358
 359    /* Check start address vs. alignment */
 360    if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) {
 361        qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is not "
 362                      "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n",
 363                      s->ctrl->name, cs, seg.addr, seg.addr + seg.size);
 364    }
 365
 366    /* And segments should not overlap (in the specs) */
 367    aspeed_smc_flash_overlap(s, &seg, cs);
 368
 369    /* All should be fine now to move the region */
 370    memory_region_transaction_begin();
 371    memory_region_set_size(&fl->mmio, seg.size);
 372    memory_region_set_address(&fl->mmio, seg.addr - s->ctrl->flash_window_base);
 373    memory_region_set_enabled(&fl->mmio, true);
 374    memory_region_transaction_commit();
 375
 376    s->regs[R_SEG_ADDR0 + cs] = new;
 377}
 378
 379static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr,
 380                                              unsigned size)
 381{
 382    qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u"
 383                  PRIx64 "\n", __func__, addr, size);
 384    return 0;
 385}
 386
 387static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr,
 388                                           uint64_t data, unsigned size)
 389{
 390   qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u: 0x%"
 391                 PRIx64 "\n", __func__, addr, size, data);
 392}
 393
 394static const MemoryRegionOps aspeed_smc_flash_default_ops = {
 395    .read = aspeed_smc_flash_default_read,
 396    .write = aspeed_smc_flash_default_write,
 397    .endianness = DEVICE_LITTLE_ENDIAN,
 398    .valid = {
 399        .min_access_size = 1,
 400        .max_access_size = 4,
 401    },
 402};
 403
 404static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl)
 405{
 406    const AspeedSMCState *s = fl->controller;
 407
 408    return s->regs[s->r_ctrl0 + fl->id] & CTRL_CMD_MODE_MASK;
 409}
 410
 411static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl)
 412{
 413    const AspeedSMCState *s = fl->controller;
 414
 415    return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->id));
 416}
 417
 418static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl)
 419{
 420    const AspeedSMCState *s = fl->controller;
 421    int cmd = (s->regs[s->r_ctrl0 + fl->id] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK;
 422
 423    /* In read mode, the default SPI command is READ (0x3). In other
 424     * modes, the command should necessarily be defined */
 425    if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) {
 426        cmd = SPI_OP_READ;
 427    }
 428
 429    if (!cmd) {
 430        qemu_log_mask(LOG_GUEST_ERROR, "%s: no command defined for mode %d\n",
 431                      __func__, aspeed_smc_flash_mode(fl));
 432    }
 433
 434    return cmd;
 435}
 436
 437static inline int aspeed_smc_flash_is_4byte(const AspeedSMCFlash *fl)
 438{
 439    const AspeedSMCState *s = fl->controller;
 440
 441    if (s->ctrl->segments == aspeed_segments_spi) {
 442        return s->regs[s->r_ctrl0] & CTRL_AST2400_SPI_4BYTE;
 443    } else {
 444        return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->id));
 445    }
 446}
 447
 448static inline bool aspeed_smc_is_ce_stop_active(const AspeedSMCFlash *fl)
 449{
 450    const AspeedSMCState *s = fl->controller;
 451
 452    return s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE;
 453}
 454
 455static void aspeed_smc_flash_select(AspeedSMCFlash *fl)
 456{
 457    AspeedSMCState *s = fl->controller;
 458
 459    s->regs[s->r_ctrl0 + fl->id] &= ~CTRL_CE_STOP_ACTIVE;
 460    qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
 461}
 462
 463static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl)
 464{
 465    AspeedSMCState *s = fl->controller;
 466
 467    s->regs[s->r_ctrl0 + fl->id] |= CTRL_CE_STOP_ACTIVE;
 468    qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
 469}
 470
 471static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
 472                                              uint32_t addr)
 473{
 474    const AspeedSMCState *s = fl->controller;
 475    AspeedSegments seg;
 476
 477    aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + fl->id], &seg);
 478    if ((addr % seg.size) != addr) {
 479        qemu_log_mask(LOG_GUEST_ERROR,
 480                      "%s: invalid address 0x%08x for CS%d segment : "
 481                      "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n",
 482                      s->ctrl->name, addr, fl->id, seg.addr,
 483                      seg.addr + seg.size);
 484        addr %= seg.size;
 485    }
 486
 487    return addr;
 488}
 489
 490static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl)
 491{
 492    const AspeedSMCState *s = fl->controller;
 493    uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->id];
 494    uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1;
 495    uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3;
 496
 497    return ((dummy_high << 2) | dummy_low) * 8;
 498}
 499
 500static void aspeed_smc_flash_send_addr(AspeedSMCFlash *fl, uint32_t addr)
 501{
 502    const AspeedSMCState *s = fl->controller;
 503    uint8_t cmd = aspeed_smc_flash_cmd(fl);
 504
 505    /* Flash access can not exceed CS segment */
 506    addr = aspeed_smc_check_segment_addr(fl, addr);
 507
 508    ssi_transfer(s->spi, cmd);
 509
 510    if (aspeed_smc_flash_is_4byte(fl)) {
 511        ssi_transfer(s->spi, (addr >> 24) & 0xff);
 512    }
 513    ssi_transfer(s->spi, (addr >> 16) & 0xff);
 514    ssi_transfer(s->spi, (addr >> 8) & 0xff);
 515    ssi_transfer(s->spi, (addr & 0xff));
 516}
 517
 518static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
 519{
 520    AspeedSMCFlash *fl = opaque;
 521    AspeedSMCState *s = fl->controller;
 522    uint64_t ret = 0;
 523    int i;
 524
 525    switch (aspeed_smc_flash_mode(fl)) {
 526    case CTRL_USERMODE:
 527        for (i = 0; i < size; i++) {
 528            ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
 529        }
 530        break;
 531    case CTRL_READMODE:
 532    case CTRL_FREADMODE:
 533        aspeed_smc_flash_select(fl);
 534        aspeed_smc_flash_send_addr(fl, addr);
 535
 536        /*
 537         * Use fake transfers to model dummy bytes. The value should
 538         * be configured to some non-zero value in fast read mode and
 539         * zero in read mode. But, as the HW allows inconsistent
 540         * settings, let's check for fast read mode.
 541         */
 542        if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) {
 543            for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) {
 544                ssi_transfer(fl->controller->spi, 0xFF);
 545            }
 546        }
 547
 548        for (i = 0; i < size; i++) {
 549            ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
 550        }
 551
 552        aspeed_smc_flash_unselect(fl);
 553        break;
 554    default:
 555        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n",
 556                      __func__, aspeed_smc_flash_mode(fl));
 557    }
 558
 559    return ret;
 560}
 561
 562static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,
 563                           unsigned size)
 564{
 565    AspeedSMCFlash *fl = opaque;
 566    AspeedSMCState *s = fl->controller;
 567    int i;
 568
 569    if (!aspeed_smc_is_writable(fl)) {
 570        qemu_log_mask(LOG_GUEST_ERROR, "%s: flash is not writable at 0x%"
 571                      HWADDR_PRIx "\n", __func__, addr);
 572        return;
 573    }
 574
 575    switch (aspeed_smc_flash_mode(fl)) {
 576    case CTRL_USERMODE:
 577        for (i = 0; i < size; i++) {
 578            ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
 579        }
 580        break;
 581    case CTRL_WRITEMODE:
 582        aspeed_smc_flash_select(fl);
 583        aspeed_smc_flash_send_addr(fl, addr);
 584
 585        for (i = 0; i < size; i++) {
 586            ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
 587        }
 588
 589        aspeed_smc_flash_unselect(fl);
 590        break;
 591    default:
 592        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n",
 593                      __func__, aspeed_smc_flash_mode(fl));
 594    }
 595}
 596
 597static const MemoryRegionOps aspeed_smc_flash_ops = {
 598    .read = aspeed_smc_flash_read,
 599    .write = aspeed_smc_flash_write,
 600    .endianness = DEVICE_LITTLE_ENDIAN,
 601    .valid = {
 602        .min_access_size = 1,
 603        .max_access_size = 4,
 604    },
 605};
 606
 607static void aspeed_smc_flash_update_cs(AspeedSMCFlash *fl)
 608{
 609    const AspeedSMCState *s = fl->controller;
 610
 611    qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
 612}
 613
 614static void aspeed_smc_reset(DeviceState *d)
 615{
 616    AspeedSMCState *s = ASPEED_SMC(d);
 617    int i;
 618
 619    memset(s->regs, 0, sizeof s->regs);
 620
 621    /* Pretend DMA is done (u-boot initialization) */
 622    s->regs[R_INTR_CTRL] = INTR_CTRL_DMA_STATUS;
 623
 624    /* Unselect all slaves */
 625    for (i = 0; i < s->num_cs; ++i) {
 626        s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE;
 627        qemu_set_irq(s->cs_lines[i], true);
 628    }
 629
 630    /* setup default segment register values for all */
 631    for (i = 0; i < s->ctrl->max_slaves; ++i) {
 632        s->regs[R_SEG_ADDR0 + i] =
 633            aspeed_smc_segment_to_reg(&s->ctrl->segments[i]);
 634    }
 635
 636    /* HW strapping for AST2500 FMC controllers  */
 637    if (s->ctrl->segments == aspeed_segments_ast2500_fmc) {
 638        /* flash type is fixed to SPI for CE0 and CE1 */
 639        s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0);
 640        s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1);
 641
 642        /* 4BYTE mode is autodetected for CE0. Let's force it to 1 for
 643         * now */
 644        s->regs[s->r_ce_ctrl] |= (1 << (CTRL_EXTENDED0));
 645    }
 646
 647    /* HW strapping for AST2400 FMC controllers (SCU70). Let's use the
 648     * configuration of the palmetto-bmc machine */
 649    if (s->ctrl->segments == aspeed_segments_fmc) {
 650        s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0);
 651
 652        s->regs[s->r_ce_ctrl] |= (1 << (CTRL_EXTENDED0));
 653    }
 654}
 655
 656static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
 657{
 658    AspeedSMCState *s = ASPEED_SMC(opaque);
 659
 660    addr >>= 2;
 661
 662    if (addr == s->r_conf ||
 663        addr == s->r_timings ||
 664        addr == s->r_ce_ctrl ||
 665        addr == R_INTR_CTRL ||
 666        (addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) ||
 667        (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs)) {
 668        return s->regs[addr];
 669    } else {
 670        qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
 671                      __func__, addr);
 672        return 0;
 673    }
 674}
 675
 676static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
 677                             unsigned int size)
 678{
 679    AspeedSMCState *s = ASPEED_SMC(opaque);
 680    uint32_t value = data;
 681
 682    addr >>= 2;
 683
 684    if (addr == s->r_conf ||
 685        addr == s->r_timings ||
 686        addr == s->r_ce_ctrl) {
 687        s->regs[addr] = value;
 688    } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) {
 689        int cs = addr - s->r_ctrl0;
 690        s->regs[addr] = value;
 691        aspeed_smc_flash_update_cs(&s->flashes[cs]);
 692    } else if (addr >= R_SEG_ADDR0 &&
 693               addr < R_SEG_ADDR0 + s->ctrl->max_slaves) {
 694        int cs = addr - R_SEG_ADDR0;
 695
 696        if (value != s->regs[R_SEG_ADDR0 + cs]) {
 697            aspeed_smc_flash_set_segment(s, cs, value);
 698        }
 699    } else {
 700        qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
 701                      __func__, addr);
 702        return;
 703    }
 704}
 705
 706static const MemoryRegionOps aspeed_smc_ops = {
 707    .read = aspeed_smc_read,
 708    .write = aspeed_smc_write,
 709    .endianness = DEVICE_LITTLE_ENDIAN,
 710    .valid.unaligned = true,
 711};
 712
 713static void aspeed_smc_realize(DeviceState *dev, Error **errp)
 714{
 715    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 716    AspeedSMCState *s = ASPEED_SMC(dev);
 717    AspeedSMCClass *mc = ASPEED_SMC_GET_CLASS(s);
 718    int i;
 719    char name[32];
 720    hwaddr offset = 0;
 721
 722    s->ctrl = mc->ctrl;
 723
 724    /* keep a copy under AspeedSMCState to speed up accesses */
 725    s->r_conf = s->ctrl->r_conf;
 726    s->r_ce_ctrl = s->ctrl->r_ce_ctrl;
 727    s->r_ctrl0 = s->ctrl->r_ctrl0;
 728    s->r_timings = s->ctrl->r_timings;
 729    s->conf_enable_w0 = s->ctrl->conf_enable_w0;
 730
 731    /* Enforce some real HW limits */
 732    if (s->num_cs > s->ctrl->max_slaves) {
 733        qemu_log_mask(LOG_GUEST_ERROR, "%s: num_cs cannot exceed: %d\n",
 734                      __func__, s->ctrl->max_slaves);
 735        s->num_cs = s->ctrl->max_slaves;
 736    }
 737
 738    s->spi = ssi_create_bus(dev, "spi");
 739
 740    /* Setup cs_lines for slaves */
 741    sysbus_init_irq(sbd, &s->irq);
 742    s->cs_lines = g_new0(qemu_irq, s->num_cs);
 743    ssi_auto_connect_slaves(dev, s->cs_lines, s->spi);
 744
 745    for (i = 0; i < s->num_cs; ++i) {
 746        sysbus_init_irq(sbd, &s->cs_lines[i]);
 747    }
 748
 749    /* The memory region for the controller registers */
 750    memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s,
 751                          s->ctrl->name, s->ctrl->nregs * 4);
 752    sysbus_init_mmio(sbd, &s->mmio);
 753
 754    /*
 755     * The container memory region representing the address space
 756     * window in which the flash modules are mapped. The size and
 757     * address depends on the SoC model and controller type.
 758     */
 759    snprintf(name, sizeof(name), "%s.flash", s->ctrl->name);
 760
 761    memory_region_init_io(&s->mmio_flash, OBJECT(s),
 762                          &aspeed_smc_flash_default_ops, s, name,
 763                          s->ctrl->flash_window_size);
 764    sysbus_init_mmio(sbd, &s->mmio_flash);
 765
 766    s->flashes = g_new0(AspeedSMCFlash, s->ctrl->max_slaves);
 767
 768    /*
 769     * Let's create a sub memory region for each possible slave. All
 770     * have a configurable memory segment in the overall flash mapping
 771     * window of the controller but, there is not necessarily a flash
 772     * module behind to handle the memory accesses. This depends on
 773     * the board configuration.
 774     */
 775    for (i = 0; i < s->ctrl->max_slaves; ++i) {
 776        AspeedSMCFlash *fl = &s->flashes[i];
 777
 778        snprintf(name, sizeof(name), "%s.%d", s->ctrl->name, i);
 779
 780        fl->id = i;
 781        fl->controller = s;
 782        fl->size = s->ctrl->segments[i].size;
 783        memory_region_init_io(&fl->mmio, OBJECT(s), &aspeed_smc_flash_ops,
 784                              fl, name, fl->size);
 785        memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio);
 786        offset += fl->size;
 787    }
 788}
 789
 790static const VMStateDescription vmstate_aspeed_smc = {
 791    .name = "aspeed.smc",
 792    .version_id = 1,
 793    .minimum_version_id = 1,
 794    .fields = (VMStateField[]) {
 795        VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX),
 796        VMSTATE_END_OF_LIST()
 797    }
 798};
 799
 800static Property aspeed_smc_properties[] = {
 801    DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1),
 802    DEFINE_PROP_END_OF_LIST(),
 803};
 804
 805static void aspeed_smc_class_init(ObjectClass *klass, void *data)
 806{
 807    DeviceClass *dc = DEVICE_CLASS(klass);
 808    AspeedSMCClass *mc = ASPEED_SMC_CLASS(klass);
 809
 810    dc->realize = aspeed_smc_realize;
 811    dc->reset = aspeed_smc_reset;
 812    dc->props = aspeed_smc_properties;
 813    dc->vmsd = &vmstate_aspeed_smc;
 814    mc->ctrl = data;
 815}
 816
 817static const TypeInfo aspeed_smc_info = {
 818    .name           = TYPE_ASPEED_SMC,
 819    .parent         = TYPE_SYS_BUS_DEVICE,
 820    .instance_size  = sizeof(AspeedSMCState),
 821    .class_size     = sizeof(AspeedSMCClass),
 822    .abstract       = true,
 823};
 824
 825static void aspeed_smc_register_types(void)
 826{
 827    int i;
 828
 829    type_register_static(&aspeed_smc_info);
 830    for (i = 0; i < ARRAY_SIZE(controllers); ++i) {
 831        TypeInfo ti = {
 832            .name       = controllers[i].name,
 833            .parent     = TYPE_ASPEED_SMC,
 834            .class_init = aspeed_smc_class_init,
 835            .class_data = (void *)&controllers[i],
 836        };
 837        type_register(&ti);
 838    }
 839}
 840
 841type_init(aspeed_smc_register_types)
 842