qemu/hw/ssi/aspeed_smc.c
<<
>>
Prefs
   1/*
   2 * ASPEED AST2400 SMC Controller (SPI Flash Only)
   3 *
   4 * Copyright (C) 2016 IBM Corp.
   5 *
   6 * Permission is hereby granted, free of charge, to any person obtaining a copy
   7 * of this software and associated documentation files (the "Software"), to deal
   8 * in the Software without restriction, including without limitation the rights
   9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10 * copies of the Software, and to permit persons to whom the Software is
  11 * furnished to do so, subject to the following conditions:
  12 *
  13 * The above copyright notice and this permission notice shall be included in
  14 * all copies or substantial portions of the Software.
  15 *
  16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22 * THE SOFTWARE.
  23 */
  24
  25#include "qemu/osdep.h"
  26#include "hw/sysbus.h"
  27#include "sysemu/sysemu.h"
  28#include "qemu/log.h"
  29#include "qemu/error-report.h"
  30
  31#include "hw/ssi/aspeed_smc.h"
  32
  33/* CE Type Setting Register */
  34#define R_CONF            (0x00 / 4)
  35#define   CONF_LEGACY_DISABLE  (1 << 31)
  36#define   CONF_ENABLE_W4       20
  37#define   CONF_ENABLE_W3       19
  38#define   CONF_ENABLE_W2       18
  39#define   CONF_ENABLE_W1       17
  40#define   CONF_ENABLE_W0       16
  41#define   CONF_FLASH_TYPE4     8
  42#define   CONF_FLASH_TYPE3     6
  43#define   CONF_FLASH_TYPE2     4
  44#define   CONF_FLASH_TYPE1     2
  45#define   CONF_FLASH_TYPE0     0
  46#define      CONF_FLASH_TYPE_NOR   0x0
  47#define      CONF_FLASH_TYPE_NAND  0x1
  48#define      CONF_FLASH_TYPE_SPI   0x2
  49
  50/* CE Control Register */
  51#define R_CE_CTRL            (0x04 / 4)
  52#define   CTRL_EXTENDED4       4  /* 32 bit addressing for SPI */
  53#define   CTRL_EXTENDED3       3  /* 32 bit addressing for SPI */
  54#define   CTRL_EXTENDED2       2  /* 32 bit addressing for SPI */
  55#define   CTRL_EXTENDED1       1  /* 32 bit addressing for SPI */
  56#define   CTRL_EXTENDED0       0  /* 32 bit addressing for SPI */
  57
  58/* Interrupt Control and Status Register */
  59#define R_INTR_CTRL       (0x08 / 4)
  60#define   INTR_CTRL_DMA_STATUS            (1 << 11)
  61#define   INTR_CTRL_CMD_ABORT_STATUS      (1 << 10)
  62#define   INTR_CTRL_WRITE_PROTECT_STATUS  (1 << 9)
  63#define   INTR_CTRL_DMA_EN                (1 << 3)
  64#define   INTR_CTRL_CMD_ABORT_EN          (1 << 2)
  65#define   INTR_CTRL_WRITE_PROTECT_EN      (1 << 1)
  66
  67/* CEx Control Register */
  68#define R_CTRL0           (0x10 / 4)
  69#define   CTRL_CMD_SHIFT           16
  70#define   CTRL_CMD_MASK            0xff
  71#define   CTRL_DUMMY_HIGH_SHIFT    14
  72#define   CTRL_AST2400_SPI_4BYTE   (1 << 13)
  73#define   CTRL_DUMMY_LOW_SHIFT     6 /* 2 bits [7:6] */
  74#define   CTRL_CE_STOP_ACTIVE      (1 << 2)
  75#define   CTRL_CMD_MODE_MASK       0x3
  76#define     CTRL_READMODE          0x0
  77#define     CTRL_FREADMODE         0x1
  78#define     CTRL_WRITEMODE         0x2
  79#define     CTRL_USERMODE          0x3
  80#define R_CTRL1           (0x14 / 4)
  81#define R_CTRL2           (0x18 / 4)
  82#define R_CTRL3           (0x1C / 4)
  83#define R_CTRL4           (0x20 / 4)
  84
  85/* CEx Segment Address Register */
  86#define R_SEG_ADDR0       (0x30 / 4)
  87#define   SEG_END_SHIFT        24   /* 8MB units */
  88#define   SEG_END_MASK         0xff
  89#define   SEG_START_SHIFT      16   /* address bit [A29-A23] */
  90#define   SEG_START_MASK       0xff
  91#define R_SEG_ADDR1       (0x34 / 4)
  92#define R_SEG_ADDR2       (0x38 / 4)
  93#define R_SEG_ADDR3       (0x3C / 4)
  94#define R_SEG_ADDR4       (0x40 / 4)
  95
  96/* Misc Control Register #1 */
  97#define R_MISC_CTRL1      (0x50 / 4)
  98
  99/* Misc Control Register #2 */
 100#define R_MISC_CTRL2      (0x54 / 4)
 101
 102/* DMA Control/Status Register */
 103#define R_DMA_CTRL        (0x80 / 4)
 104#define   DMA_CTRL_DELAY_MASK   0xf
 105#define   DMA_CTRL_DELAY_SHIFT  8
 106#define   DMA_CTRL_FREQ_MASK    0xf
 107#define   DMA_CTRL_FREQ_SHIFT   4
 108#define   DMA_CTRL_MODE         (1 << 3)
 109#define   DMA_CTRL_CKSUM        (1 << 2)
 110#define   DMA_CTRL_DIR          (1 << 1)
 111#define   DMA_CTRL_EN           (1 << 0)
 112
 113/* DMA Flash Side Address */
 114#define R_DMA_FLASH_ADDR  (0x84 / 4)
 115
 116/* DMA DRAM Side Address */
 117#define R_DMA_DRAM_ADDR   (0x88 / 4)
 118
 119/* DMA Length Register */
 120#define R_DMA_LEN         (0x8C / 4)
 121
 122/* Checksum Calculation Result */
 123#define R_DMA_CHECKSUM    (0x90 / 4)
 124
 125/* Misc Control Register #2 */
 126#define R_TIMINGS         (0x94 / 4)
 127
 128/* SPI controller registers and bits */
 129#define R_SPI_CONF        (0x00 / 4)
 130#define   SPI_CONF_ENABLE_W0   0
 131#define R_SPI_CTRL0       (0x4 / 4)
 132#define R_SPI_MISC_CTRL   (0x10 / 4)
 133#define R_SPI_TIMINGS     (0x14 / 4)
 134
 135#define ASPEED_SMC_R_SPI_MAX (0x20 / 4)
 136#define ASPEED_SMC_R_SMC_MAX (0x20 / 4)
 137
 138#define ASPEED_SOC_SMC_FLASH_BASE   0x10000000
 139#define ASPEED_SOC_FMC_FLASH_BASE   0x20000000
 140#define ASPEED_SOC_SPI_FLASH_BASE   0x30000000
 141#define ASPEED_SOC_SPI2_FLASH_BASE  0x38000000
 142
 143/* Flash opcodes. */
 144#define SPI_OP_READ       0x03    /* Read data bytes (low frequency) */
 145
 146/*
 147 * Default segments mapping addresses and size for each slave per
 148 * controller. These can be changed when board is initialized with the
 149 * Segment Address Registers.
 150 */
 151static const AspeedSegments aspeed_segments_legacy[] = {
 152    { 0x10000000, 32 * 1024 * 1024 },
 153};
 154
 155static const AspeedSegments aspeed_segments_fmc[] = {
 156    { 0x20000000, 64 * 1024 * 1024 }, /* start address is readonly */
 157    { 0x24000000, 32 * 1024 * 1024 },
 158    { 0x26000000, 32 * 1024 * 1024 },
 159    { 0x28000000, 32 * 1024 * 1024 },
 160    { 0x2A000000, 32 * 1024 * 1024 }
 161};
 162
 163static const AspeedSegments aspeed_segments_spi[] = {
 164    { 0x30000000, 64 * 1024 * 1024 },
 165};
 166
 167static const AspeedSegments aspeed_segments_ast2500_fmc[] = {
 168    { 0x20000000, 128 * 1024 * 1024 }, /* start address is readonly */
 169    { 0x28000000,  32 * 1024 * 1024 },
 170    { 0x2A000000,  32 * 1024 * 1024 },
 171};
 172
 173static const AspeedSegments aspeed_segments_ast2500_spi1[] = {
 174    { 0x30000000, 32 * 1024 * 1024 }, /* start address is readonly */
 175    { 0x32000000, 96 * 1024 * 1024 }, /* end address is readonly */
 176};
 177
 178static const AspeedSegments aspeed_segments_ast2500_spi2[] = {
 179    { 0x38000000, 32 * 1024 * 1024 }, /* start address is readonly */
 180    { 0x3A000000, 96 * 1024 * 1024 }, /* end address is readonly */
 181};
 182
 183static const AspeedSMCController controllers[] = {
 184    {
 185        .name              = "aspeed.smc.smc",
 186        .r_conf            = R_CONF,
 187        .r_ce_ctrl         = R_CE_CTRL,
 188        .r_ctrl0           = R_CTRL0,
 189        .r_timings         = R_TIMINGS,
 190        .conf_enable_w0    = CONF_ENABLE_W0,
 191        .max_slaves        = 5,
 192        .segments          = aspeed_segments_legacy,
 193        .flash_window_base = ASPEED_SOC_SMC_FLASH_BASE,
 194        .flash_window_size = 0x6000000,
 195        .has_dma           = false,
 196        .nregs             = ASPEED_SMC_R_SMC_MAX,
 197    }, {
 198        .name              = "aspeed.smc.fmc",
 199        .r_conf            = R_CONF,
 200        .r_ce_ctrl         = R_CE_CTRL,
 201        .r_ctrl0           = R_CTRL0,
 202        .r_timings         = R_TIMINGS,
 203        .conf_enable_w0    = CONF_ENABLE_W0,
 204        .max_slaves        = 5,
 205        .segments          = aspeed_segments_fmc,
 206        .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE,
 207        .flash_window_size = 0x10000000,
 208        .has_dma           = true,
 209        .nregs             = ASPEED_SMC_R_MAX,
 210    }, {
 211        .name              = "aspeed.smc.spi",
 212        .r_conf            = R_SPI_CONF,
 213        .r_ce_ctrl         = 0xff,
 214        .r_ctrl0           = R_SPI_CTRL0,
 215        .r_timings         = R_SPI_TIMINGS,
 216        .conf_enable_w0    = SPI_CONF_ENABLE_W0,
 217        .max_slaves        = 1,
 218        .segments          = aspeed_segments_spi,
 219        .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE,
 220        .flash_window_size = 0x10000000,
 221        .has_dma           = false,
 222        .nregs             = ASPEED_SMC_R_SPI_MAX,
 223    }, {
 224        .name              = "aspeed.smc.ast2500-fmc",
 225        .r_conf            = R_CONF,
 226        .r_ce_ctrl         = R_CE_CTRL,
 227        .r_ctrl0           = R_CTRL0,
 228        .r_timings         = R_TIMINGS,
 229        .conf_enable_w0    = CONF_ENABLE_W0,
 230        .max_slaves        = 3,
 231        .segments          = aspeed_segments_ast2500_fmc,
 232        .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE,
 233        .flash_window_size = 0x10000000,
 234        .has_dma           = true,
 235        .nregs             = ASPEED_SMC_R_MAX,
 236    }, {
 237        .name              = "aspeed.smc.ast2500-spi1",
 238        .r_conf            = R_CONF,
 239        .r_ce_ctrl         = R_CE_CTRL,
 240        .r_ctrl0           = R_CTRL0,
 241        .r_timings         = R_TIMINGS,
 242        .conf_enable_w0    = CONF_ENABLE_W0,
 243        .max_slaves        = 2,
 244        .segments          = aspeed_segments_ast2500_spi1,
 245        .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE,
 246        .flash_window_size = 0x8000000,
 247        .has_dma           = false,
 248        .nregs             = ASPEED_SMC_R_MAX,
 249    }, {
 250        .name              = "aspeed.smc.ast2500-spi2",
 251        .r_conf            = R_CONF,
 252        .r_ce_ctrl         = R_CE_CTRL,
 253        .r_ctrl0           = R_CTRL0,
 254        .r_timings         = R_TIMINGS,
 255        .conf_enable_w0    = CONF_ENABLE_W0,
 256        .max_slaves        = 2,
 257        .segments          = aspeed_segments_ast2500_spi2,
 258        .flash_window_base = ASPEED_SOC_SPI2_FLASH_BASE,
 259        .flash_window_size = 0x8000000,
 260        .has_dma           = false,
 261        .nregs             = ASPEED_SMC_R_MAX,
 262    },
 263};
 264
 265/*
 266 * The Segment Register uses a 8MB unit to encode the start address
 267 * and the end address of the mapping window of a flash SPI slave :
 268 *
 269 *        | byte 1 | byte 2 | byte 3 | byte 4 |
 270 *        +--------+--------+--------+--------+
 271 *        |  end   |  start |   0    |   0    |
 272 *
 273 */
 274static inline uint32_t aspeed_smc_segment_to_reg(const AspeedSegments *seg)
 275{
 276    uint32_t reg = 0;
 277    reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT;
 278    reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT;
 279    return reg;
 280}
 281
 282static inline void aspeed_smc_reg_to_segment(uint32_t reg, AspeedSegments *seg)
 283{
 284    seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23;
 285    seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr;
 286}
 287
 288static bool aspeed_smc_flash_overlap(const AspeedSMCState *s,
 289                                     const AspeedSegments *new,
 290                                     int cs)
 291{
 292    AspeedSegments seg;
 293    int i;
 294
 295    for (i = 0; i < s->ctrl->max_slaves; i++) {
 296        if (i == cs) {
 297            continue;
 298        }
 299
 300        aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + i], &seg);
 301
 302        if (new->addr + new->size > seg.addr &&
 303            new->addr < seg.addr + seg.size) {
 304            qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment CS%d [ 0x%"
 305                          HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with "
 306                          "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n",
 307                          s->ctrl->name, cs, new->addr, new->addr + new->size,
 308                          i, seg.addr, seg.addr + seg.size);
 309            return true;
 310        }
 311    }
 312    return false;
 313}
 314
 315static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
 316                                         uint64_t new)
 317{
 318    AspeedSMCFlash *fl = &s->flashes[cs];
 319    AspeedSegments seg;
 320
 321    aspeed_smc_reg_to_segment(new, &seg);
 322
 323    /* The start address of CS0 is read-only */
 324    if (cs == 0 && seg.addr != s->ctrl->flash_window_base) {
 325        qemu_log_mask(LOG_GUEST_ERROR,
 326                      "%s: Tried to change CS0 start address to 0x%"
 327                      HWADDR_PRIx "\n", s->ctrl->name, seg.addr);
 328        seg.addr = s->ctrl->flash_window_base;
 329        new = aspeed_smc_segment_to_reg(&seg);
 330    }
 331
 332    /*
 333     * The end address of the AST2500 spi controllers is also
 334     * read-only.
 335     */
 336    if ((s->ctrl->segments == aspeed_segments_ast2500_spi1 ||
 337         s->ctrl->segments == aspeed_segments_ast2500_spi2) &&
 338        cs == s->ctrl->max_slaves &&
 339        seg.addr + seg.size != s->ctrl->segments[cs].addr +
 340        s->ctrl->segments[cs].size) {
 341        qemu_log_mask(LOG_GUEST_ERROR,
 342                      "%s: Tried to change CS%d end address to 0x%"
 343                      HWADDR_PRIx "\n", s->ctrl->name, cs, seg.addr + seg.size);
 344        seg.size = s->ctrl->segments[cs].addr + s->ctrl->segments[cs].size -
 345            seg.addr;
 346        new = aspeed_smc_segment_to_reg(&seg);
 347    }
 348
 349    /* Keep the segment in the overall flash window */
 350    if (seg.addr + seg.size <= s->ctrl->flash_window_base ||
 351        seg.addr > s->ctrl->flash_window_base + s->ctrl->flash_window_size) {
 352        qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is invalid : "
 353                      "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n",
 354                      s->ctrl->name, cs, seg.addr, seg.addr + seg.size);
 355        return;
 356    }
 357
 358    /* Check start address vs. alignment */
 359    if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) {
 360        qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is not "
 361                      "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n",
 362                      s->ctrl->name, cs, seg.addr, seg.addr + seg.size);
 363    }
 364
 365    /* And segments should not overlap (in the specs) */
 366    aspeed_smc_flash_overlap(s, &seg, cs);
 367
 368    /* All should be fine now to move the region */
 369    memory_region_transaction_begin();
 370    memory_region_set_size(&fl->mmio, seg.size);
 371    memory_region_set_address(&fl->mmio, seg.addr - s->ctrl->flash_window_base);
 372    memory_region_set_enabled(&fl->mmio, true);
 373    memory_region_transaction_commit();
 374
 375    s->regs[R_SEG_ADDR0 + cs] = new;
 376}
 377
 378static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr,
 379                                              unsigned size)
 380{
 381    qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u"
 382                  PRIx64 "\n", __func__, addr, size);
 383    return 0;
 384}
 385
 386static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr,
 387                                           uint64_t data, unsigned size)
 388{
 389   qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u: 0x%"
 390                 PRIx64 "\n", __func__, addr, size, data);
 391}
 392
 393static const MemoryRegionOps aspeed_smc_flash_default_ops = {
 394    .read = aspeed_smc_flash_default_read,
 395    .write = aspeed_smc_flash_default_write,
 396    .endianness = DEVICE_LITTLE_ENDIAN,
 397    .valid = {
 398        .min_access_size = 1,
 399        .max_access_size = 4,
 400    },
 401};
 402
 403static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl)
 404{
 405    const AspeedSMCState *s = fl->controller;
 406
 407    return s->regs[s->r_ctrl0 + fl->id] & CTRL_CMD_MODE_MASK;
 408}
 409
 410static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl)
 411{
 412    const AspeedSMCState *s = fl->controller;
 413
 414    return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->id));
 415}
 416
 417static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl)
 418{
 419    const AspeedSMCState *s = fl->controller;
 420    int cmd = (s->regs[s->r_ctrl0 + fl->id] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK;
 421
 422    /* In read mode, the default SPI command is READ (0x3). In other
 423     * modes, the command should necessarily be defined */
 424    if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) {
 425        cmd = SPI_OP_READ;
 426    }
 427
 428    if (!cmd) {
 429        qemu_log_mask(LOG_GUEST_ERROR, "%s: no command defined for mode %d\n",
 430                      __func__, aspeed_smc_flash_mode(fl));
 431    }
 432
 433    return cmd;
 434}
 435
 436static inline int aspeed_smc_flash_is_4byte(const AspeedSMCFlash *fl)
 437{
 438    const AspeedSMCState *s = fl->controller;
 439
 440    if (s->ctrl->segments == aspeed_segments_spi) {
 441        return s->regs[s->r_ctrl0] & CTRL_AST2400_SPI_4BYTE;
 442    } else {
 443        return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->id));
 444    }
 445}
 446
 447static inline bool aspeed_smc_is_ce_stop_active(const AspeedSMCFlash *fl)
 448{
 449    const AspeedSMCState *s = fl->controller;
 450
 451    return s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE;
 452}
 453
 454static void aspeed_smc_flash_select(AspeedSMCFlash *fl)
 455{
 456    AspeedSMCState *s = fl->controller;
 457
 458    s->regs[s->r_ctrl0 + fl->id] &= ~CTRL_CE_STOP_ACTIVE;
 459    qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
 460}
 461
 462static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl)
 463{
 464    AspeedSMCState *s = fl->controller;
 465
 466    s->regs[s->r_ctrl0 + fl->id] |= CTRL_CE_STOP_ACTIVE;
 467    qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
 468}
 469
 470static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
 471                                              uint32_t addr)
 472{
 473    const AspeedSMCState *s = fl->controller;
 474    AspeedSegments seg;
 475
 476    aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + fl->id], &seg);
 477    if ((addr % seg.size) != addr) {
 478        qemu_log_mask(LOG_GUEST_ERROR,
 479                      "%s: invalid address 0x%08x for CS%d segment : "
 480                      "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n",
 481                      s->ctrl->name, addr, fl->id, seg.addr,
 482                      seg.addr + seg.size);
 483        addr %= seg.size;
 484    }
 485
 486    return addr;
 487}
 488
 489static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl)
 490{
 491    const AspeedSMCState *s = fl->controller;
 492    uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->id];
 493    uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1;
 494    uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3;
 495
 496    return ((dummy_high << 2) | dummy_low) * 8;
 497}
 498
 499static void aspeed_smc_flash_send_addr(AspeedSMCFlash *fl, uint32_t addr)
 500{
 501    const AspeedSMCState *s = fl->controller;
 502    uint8_t cmd = aspeed_smc_flash_cmd(fl);
 503
 504    /* Flash access can not exceed CS segment */
 505    addr = aspeed_smc_check_segment_addr(fl, addr);
 506
 507    ssi_transfer(s->spi, cmd);
 508
 509    if (aspeed_smc_flash_is_4byte(fl)) {
 510        ssi_transfer(s->spi, (addr >> 24) & 0xff);
 511    }
 512    ssi_transfer(s->spi, (addr >> 16) & 0xff);
 513    ssi_transfer(s->spi, (addr >> 8) & 0xff);
 514    ssi_transfer(s->spi, (addr & 0xff));
 515}
 516
 517static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
 518{
 519    AspeedSMCFlash *fl = opaque;
 520    AspeedSMCState *s = fl->controller;
 521    uint64_t ret = 0;
 522    int i;
 523
 524    switch (aspeed_smc_flash_mode(fl)) {
 525    case CTRL_USERMODE:
 526        for (i = 0; i < size; i++) {
 527            ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
 528        }
 529        break;
 530    case CTRL_READMODE:
 531    case CTRL_FREADMODE:
 532        aspeed_smc_flash_select(fl);
 533        aspeed_smc_flash_send_addr(fl, addr);
 534
 535        /*
 536         * Use fake transfers to model dummy bytes. The value should
 537         * be configured to some non-zero value in fast read mode and
 538         * zero in read mode. But, as the HW allows inconsistent
 539         * settings, let's check for fast read mode.
 540         */
 541        if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) {
 542            for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) {
 543                ssi_transfer(fl->controller->spi, 0xFF);
 544            }
 545        }
 546
 547        for (i = 0; i < size; i++) {
 548            ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
 549        }
 550
 551        aspeed_smc_flash_unselect(fl);
 552        break;
 553    default:
 554        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n",
 555                      __func__, aspeed_smc_flash_mode(fl));
 556    }
 557
 558    return ret;
 559}
 560
 561static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,
 562                           unsigned size)
 563{
 564    AspeedSMCFlash *fl = opaque;
 565    AspeedSMCState *s = fl->controller;
 566    int i;
 567
 568    if (!aspeed_smc_is_writable(fl)) {
 569        qemu_log_mask(LOG_GUEST_ERROR, "%s: flash is not writable at 0x%"
 570                      HWADDR_PRIx "\n", __func__, addr);
 571        return;
 572    }
 573
 574    switch (aspeed_smc_flash_mode(fl)) {
 575    case CTRL_USERMODE:
 576        for (i = 0; i < size; i++) {
 577            ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
 578        }
 579        break;
 580    case CTRL_WRITEMODE:
 581        aspeed_smc_flash_select(fl);
 582        aspeed_smc_flash_send_addr(fl, addr);
 583
 584        for (i = 0; i < size; i++) {
 585            ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
 586        }
 587
 588        aspeed_smc_flash_unselect(fl);
 589        break;
 590    default:
 591        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n",
 592                      __func__, aspeed_smc_flash_mode(fl));
 593    }
 594}
 595
 596static const MemoryRegionOps aspeed_smc_flash_ops = {
 597    .read = aspeed_smc_flash_read,
 598    .write = aspeed_smc_flash_write,
 599    .endianness = DEVICE_LITTLE_ENDIAN,
 600    .valid = {
 601        .min_access_size = 1,
 602        .max_access_size = 4,
 603    },
 604};
 605
 606static void aspeed_smc_flash_update_cs(AspeedSMCFlash *fl)
 607{
 608    const AspeedSMCState *s = fl->controller;
 609
 610    qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
 611}
 612
 613static void aspeed_smc_reset(DeviceState *d)
 614{
 615    AspeedSMCState *s = ASPEED_SMC(d);
 616    int i;
 617
 618    memset(s->regs, 0, sizeof s->regs);
 619
 620    /* Pretend DMA is done (u-boot initialization) */
 621    s->regs[R_INTR_CTRL] = INTR_CTRL_DMA_STATUS;
 622
 623    /* Unselect all slaves */
 624    for (i = 0; i < s->num_cs; ++i) {
 625        s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE;
 626        qemu_set_irq(s->cs_lines[i], true);
 627    }
 628
 629    /* setup default segment register values for all */
 630    for (i = 0; i < s->ctrl->max_slaves; ++i) {
 631        s->regs[R_SEG_ADDR0 + i] =
 632            aspeed_smc_segment_to_reg(&s->ctrl->segments[i]);
 633    }
 634
 635    /* HW strapping for AST2500 FMC controllers  */
 636    if (s->ctrl->segments == aspeed_segments_ast2500_fmc) {
 637        /* flash type is fixed to SPI for CE0 and CE1 */
 638        s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0);
 639        s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1);
 640
 641        /* 4BYTE mode is autodetected for CE0. Let's force it to 1 for
 642         * now */
 643        s->regs[s->r_ce_ctrl] |= (1 << (CTRL_EXTENDED0));
 644    }
 645
 646    /* HW strapping for AST2400 FMC controllers (SCU70). Let's use the
 647     * configuration of the palmetto-bmc machine */
 648    if (s->ctrl->segments == aspeed_segments_fmc) {
 649        s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0);
 650
 651        s->regs[s->r_ce_ctrl] |= (1 << (CTRL_EXTENDED0));
 652    }
 653}
 654
 655static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
 656{
 657    AspeedSMCState *s = ASPEED_SMC(opaque);
 658
 659    addr >>= 2;
 660
 661    if (addr == s->r_conf ||
 662        addr == s->r_timings ||
 663        addr == s->r_ce_ctrl ||
 664        addr == R_INTR_CTRL ||
 665        (addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) ||
 666        (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs)) {
 667        return s->regs[addr];
 668    } else {
 669        qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
 670                      __func__, addr);
 671        return 0;
 672    }
 673}
 674
 675static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
 676                             unsigned int size)
 677{
 678    AspeedSMCState *s = ASPEED_SMC(opaque);
 679    uint32_t value = data;
 680
 681    addr >>= 2;
 682
 683    if (addr == s->r_conf ||
 684        addr == s->r_timings ||
 685        addr == s->r_ce_ctrl) {
 686        s->regs[addr] = value;
 687    } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) {
 688        int cs = addr - s->r_ctrl0;
 689        s->regs[addr] = value;
 690        aspeed_smc_flash_update_cs(&s->flashes[cs]);
 691    } else if (addr >= R_SEG_ADDR0 &&
 692               addr < R_SEG_ADDR0 + s->ctrl->max_slaves) {
 693        int cs = addr - R_SEG_ADDR0;
 694
 695        if (value != s->regs[R_SEG_ADDR0 + cs]) {
 696            aspeed_smc_flash_set_segment(s, cs, value);
 697        }
 698    } else {
 699        qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
 700                      __func__, addr);
 701        return;
 702    }
 703}
 704
 705static const MemoryRegionOps aspeed_smc_ops = {
 706    .read = aspeed_smc_read,
 707    .write = aspeed_smc_write,
 708    .endianness = DEVICE_LITTLE_ENDIAN,
 709    .valid.unaligned = true,
 710};
 711
 712static void aspeed_smc_realize(DeviceState *dev, Error **errp)
 713{
 714    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 715    AspeedSMCState *s = ASPEED_SMC(dev);
 716    AspeedSMCClass *mc = ASPEED_SMC_GET_CLASS(s);
 717    int i;
 718    char name[32];
 719    hwaddr offset = 0;
 720
 721    s->ctrl = mc->ctrl;
 722
 723    /* keep a copy under AspeedSMCState to speed up accesses */
 724    s->r_conf = s->ctrl->r_conf;
 725    s->r_ce_ctrl = s->ctrl->r_ce_ctrl;
 726    s->r_ctrl0 = s->ctrl->r_ctrl0;
 727    s->r_timings = s->ctrl->r_timings;
 728    s->conf_enable_w0 = s->ctrl->conf_enable_w0;
 729
 730    /* Enforce some real HW limits */
 731    if (s->num_cs > s->ctrl->max_slaves) {
 732        qemu_log_mask(LOG_GUEST_ERROR, "%s: num_cs cannot exceed: %d\n",
 733                      __func__, s->ctrl->max_slaves);
 734        s->num_cs = s->ctrl->max_slaves;
 735    }
 736
 737    s->spi = ssi_create_bus(dev, "spi");
 738
 739    /* Setup cs_lines for slaves */
 740    sysbus_init_irq(sbd, &s->irq);
 741    s->cs_lines = g_new0(qemu_irq, s->num_cs);
 742    ssi_auto_connect_slaves(dev, s->cs_lines, s->spi);
 743
 744    for (i = 0; i < s->num_cs; ++i) {
 745        sysbus_init_irq(sbd, &s->cs_lines[i]);
 746    }
 747
 748    /* The memory region for the controller registers */
 749    memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s,
 750                          s->ctrl->name, s->ctrl->nregs * 4);
 751    sysbus_init_mmio(sbd, &s->mmio);
 752
 753    /*
 754     * The container memory region representing the address space
 755     * window in which the flash modules are mapped. The size and
 756     * address depends on the SoC model and controller type.
 757     */
 758    snprintf(name, sizeof(name), "%s.flash", s->ctrl->name);
 759
 760    memory_region_init_io(&s->mmio_flash, OBJECT(s),
 761                          &aspeed_smc_flash_default_ops, s, name,
 762                          s->ctrl->flash_window_size);
 763    sysbus_init_mmio(sbd, &s->mmio_flash);
 764
 765    s->flashes = g_new0(AspeedSMCFlash, s->ctrl->max_slaves);
 766
 767    /*
 768     * Let's create a sub memory region for each possible slave. All
 769     * have a configurable memory segment in the overall flash mapping
 770     * window of the controller but, there is not necessarily a flash
 771     * module behind to handle the memory accesses. This depends on
 772     * the board configuration.
 773     */
 774    for (i = 0; i < s->ctrl->max_slaves; ++i) {
 775        AspeedSMCFlash *fl = &s->flashes[i];
 776
 777        snprintf(name, sizeof(name), "%s.%d", s->ctrl->name, i);
 778
 779        fl->id = i;
 780        fl->controller = s;
 781        fl->size = s->ctrl->segments[i].size;
 782        memory_region_init_io(&fl->mmio, OBJECT(s), &aspeed_smc_flash_ops,
 783                              fl, name, fl->size);
 784        memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio);
 785        offset += fl->size;
 786    }
 787}
 788
 789static const VMStateDescription vmstate_aspeed_smc = {
 790    .name = "aspeed.smc",
 791    .version_id = 1,
 792    .minimum_version_id = 1,
 793    .fields = (VMStateField[]) {
 794        VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX),
 795        VMSTATE_END_OF_LIST()
 796    }
 797};
 798
 799static Property aspeed_smc_properties[] = {
 800    DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1),
 801    DEFINE_PROP_END_OF_LIST(),
 802};
 803
 804static void aspeed_smc_class_init(ObjectClass *klass, void *data)
 805{
 806    DeviceClass *dc = DEVICE_CLASS(klass);
 807    AspeedSMCClass *mc = ASPEED_SMC_CLASS(klass);
 808
 809    dc->realize = aspeed_smc_realize;
 810    dc->reset = aspeed_smc_reset;
 811    dc->props = aspeed_smc_properties;
 812    dc->vmsd = &vmstate_aspeed_smc;
 813    mc->ctrl = data;
 814}
 815
 816static const TypeInfo aspeed_smc_info = {
 817    .name           = TYPE_ASPEED_SMC,
 818    .parent         = TYPE_SYS_BUS_DEVICE,
 819    .instance_size  = sizeof(AspeedSMCState),
 820    .class_size     = sizeof(AspeedSMCClass),
 821    .abstract       = true,
 822};
 823
 824static void aspeed_smc_register_types(void)
 825{
 826    int i;
 827
 828    type_register_static(&aspeed_smc_info);
 829    for (i = 0; i < ARRAY_SIZE(controllers); ++i) {
 830        TypeInfo ti = {
 831            .name       = controllers[i].name,
 832            .parent     = TYPE_ASPEED_SMC,
 833            .class_init = aspeed_smc_class_init,
 834            .class_data = (void *)&controllers[i],
 835        };
 836        type_register(&ti);
 837    }
 838}
 839
 840type_init(aspeed_smc_register_types)
 841