qemu/hw/ssi/xilinx_spips.c
<<
>>
Prefs
   1/*
   2 * QEMU model of the Xilinx Zynq SPI controller
   3 *
   4 * Copyright (c) 2012 Peter A. G. Crosthwaite
   5 *
   6 * Permission is hereby granted, free of charge, to any person obtaining a copy
   7 * of this software and associated documentation files (the "Software"), to deal
   8 * in the Software without restriction, including without limitation the rights
   9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10 * copies of the Software, and to permit persons to whom the Software is
  11 * furnished to do so, subject to the following conditions:
  12 *
  13 * The above copyright notice and this permission notice shall be included in
  14 * all copies or substantial portions of the Software.
  15 *
  16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22 * THE SOFTWARE.
  23 */
  24
  25#include "qemu/osdep.h"
  26#include "hw/sysbus.h"
  27#include "sysemu/sysemu.h"
  28#include "hw/ptimer.h"
  29#include "qemu/log.h"
  30#include "qemu/module.h"
  31#include "qemu/bitops.h"
  32#include "hw/ssi/xilinx_spips.h"
  33#include "qapi/error.h"
  34#include "hw/register.h"
  35#include "sysemu/dma.h"
  36#include "migration/blocker.h"
  37
  38#ifndef XILINX_SPIPS_ERR_DEBUG
  39#define XILINX_SPIPS_ERR_DEBUG 0
  40#endif
  41
  42#define DB_PRINT_L(level, ...) do { \
  43    if (XILINX_SPIPS_ERR_DEBUG > (level)) { \
  44        fprintf(stderr,  ": %s: ", __func__); \
  45        fprintf(stderr, ## __VA_ARGS__); \
  46    } \
  47} while (0)
  48
  49/* config register */
  50#define R_CONFIG            (0x00 / 4)
  51#define IFMODE              (1U << 31)
  52#define R_CONFIG_ENDIAN     (1 << 26)
  53#define MODEFAIL_GEN_EN     (1 << 17)
  54#define MAN_START_COM       (1 << 16)
  55#define MAN_START_EN        (1 << 15)
  56#define MANUAL_CS           (1 << 14)
  57#define CS                  (0xF << 10)
  58#define CS_SHIFT            (10)
  59#define PERI_SEL            (1 << 9)
  60#define REF_CLK             (1 << 8)
  61#define FIFO_WIDTH          (3 << 6)
  62#define BAUD_RATE_DIV       (7 << 3)
  63#define CLK_PH              (1 << 2)
  64#define CLK_POL             (1 << 1)
  65#define MODE_SEL            (1 << 0)
  66#define R_CONFIG_RSVD       (0x7bf40000)
  67
  68/* interrupt mechanism */
  69#define R_INTR_STATUS       (0x04 / 4)
  70#define R_INTR_STATUS_RESET (0x104)
  71#define R_INTR_EN           (0x08 / 4)
  72#define R_INTR_DIS          (0x0C / 4)
  73#define R_INTR_MASK         (0x10 / 4)
  74#define IXR_TX_FIFO_UNDERFLOW   (1 << 6)
  75/* Poll timeout not implemented */
  76#define IXR_RX_FIFO_EMPTY       (1 << 11)
  77#define IXR_GENERIC_FIFO_FULL   (1 << 10)
  78#define IXR_GENERIC_FIFO_NOT_FULL (1 << 9)
  79#define IXR_TX_FIFO_EMPTY       (1 << 8)
  80#define IXR_GENERIC_FIFO_EMPTY  (1 << 7)
  81#define IXR_RX_FIFO_FULL        (1 << 5)
  82#define IXR_RX_FIFO_NOT_EMPTY   (1 << 4)
  83#define IXR_TX_FIFO_FULL        (1 << 3)
  84#define IXR_TX_FIFO_NOT_FULL    (1 << 2)
  85#define IXR_TX_FIFO_MODE_FAIL   (1 << 1)
  86#define IXR_RX_FIFO_OVERFLOW    (1 << 0)
  87#define IXR_ALL                 ((1 << 13) - 1)
  88#define GQSPI_IXR_MASK          0xFBE
  89#define IXR_SELF_CLEAR \
  90(IXR_GENERIC_FIFO_EMPTY \
  91| IXR_GENERIC_FIFO_FULL  \
  92| IXR_GENERIC_FIFO_NOT_FULL \
  93| IXR_TX_FIFO_EMPTY \
  94| IXR_TX_FIFO_FULL  \
  95| IXR_TX_FIFO_NOT_FULL \
  96| IXR_RX_FIFO_EMPTY \
  97| IXR_RX_FIFO_FULL  \
  98| IXR_RX_FIFO_NOT_EMPTY)
  99
 100#define R_EN                (0x14 / 4)
 101#define R_DELAY             (0x18 / 4)
 102#define R_TX_DATA           (0x1C / 4)
 103#define R_RX_DATA           (0x20 / 4)
 104#define R_SLAVE_IDLE_COUNT  (0x24 / 4)
 105#define R_TX_THRES          (0x28 / 4)
 106#define R_RX_THRES          (0x2C / 4)
 107#define R_GPIO              (0x30 / 4)
 108#define R_LPBK_DLY_ADJ      (0x38 / 4)
 109#define R_LPBK_DLY_ADJ_RESET (0x33)
 110#define R_TXD1              (0x80 / 4)
 111#define R_TXD2              (0x84 / 4)
 112#define R_TXD3              (0x88 / 4)
 113
 114#define R_LQSPI_CFG         (0xa0 / 4)
 115#define R_LQSPI_CFG_RESET       0x03A002EB
 116#define LQSPI_CFG_LQ_MODE       (1U << 31)
 117#define LQSPI_CFG_TWO_MEM       (1 << 30)
 118#define LQSPI_CFG_SEP_BUS       (1 << 29)
 119#define LQSPI_CFG_U_PAGE        (1 << 28)
 120#define LQSPI_CFG_ADDR4         (1 << 27)
 121#define LQSPI_CFG_MODE_EN       (1 << 25)
 122#define LQSPI_CFG_MODE_WIDTH    8
 123#define LQSPI_CFG_MODE_SHIFT    16
 124#define LQSPI_CFG_DUMMY_WIDTH   3
 125#define LQSPI_CFG_DUMMY_SHIFT   8
 126#define LQSPI_CFG_INST_CODE     0xFF
 127
 128#define R_CMND        (0xc0 / 4)
 129    #define R_CMND_RXFIFO_DRAIN   (1 << 19)
 130    FIELD(CMND, PARTIAL_BYTE_LEN, 16, 3)
 131#define R_CMND_EXT_ADD        (1 << 15)
 132    FIELD(CMND, RX_DISCARD, 8, 7)
 133    FIELD(CMND, DUMMY_CYCLES, 2, 6)
 134#define R_CMND_DMA_EN         (1 << 1)
 135#define R_CMND_PUSH_WAIT      (1 << 0)
 136#define R_TRANSFER_SIZE     (0xc4 / 4)
 137#define R_LQSPI_STS         (0xA4 / 4)
 138#define LQSPI_STS_WR_RECVD      (1 << 1)
 139
 140#define R_MOD_ID            (0xFC / 4)
 141
 142#define R_GQSPI_SELECT          (0x144 / 4)
 143    FIELD(GQSPI_SELECT, GENERIC_QSPI_EN, 0, 1)
 144#define R_GQSPI_ISR         (0x104 / 4)
 145#define R_GQSPI_IER         (0x108 / 4)
 146#define R_GQSPI_IDR         (0x10c / 4)
 147#define R_GQSPI_IMR         (0x110 / 4)
 148#define R_GQSPI_IMR_RESET   (0xfbe)
 149#define R_GQSPI_TX_THRESH   (0x128 / 4)
 150#define R_GQSPI_RX_THRESH   (0x12c / 4)
 151#define R_GQSPI_GPIO (0x130 / 4)
 152#define R_GQSPI_LPBK_DLY_ADJ (0x138 / 4)
 153#define R_GQSPI_LPBK_DLY_ADJ_RESET (0x33)
 154#define R_GQSPI_CNFG        (0x100 / 4)
 155    FIELD(GQSPI_CNFG, MODE_EN, 30, 2)
 156    FIELD(GQSPI_CNFG, GEN_FIFO_START_MODE, 29, 1)
 157    FIELD(GQSPI_CNFG, GEN_FIFO_START, 28, 1)
 158    FIELD(GQSPI_CNFG, ENDIAN, 26, 1)
 159    /* Poll timeout not implemented */
 160    FIELD(GQSPI_CNFG, EN_POLL_TIMEOUT, 20, 1)
 161    /* QEMU doesnt care about any of these last three */
 162    FIELD(GQSPI_CNFG, BR, 3, 3)
 163    FIELD(GQSPI_CNFG, CPH, 2, 1)
 164    FIELD(GQSPI_CNFG, CPL, 1, 1)
 165#define R_GQSPI_GEN_FIFO        (0x140 / 4)
 166#define R_GQSPI_TXD             (0x11c / 4)
 167#define R_GQSPI_RXD             (0x120 / 4)
 168#define R_GQSPI_FIFO_CTRL       (0x14c / 4)
 169    FIELD(GQSPI_FIFO_CTRL, RX_FIFO_RESET, 2, 1)
 170    FIELD(GQSPI_FIFO_CTRL, TX_FIFO_RESET, 1, 1)
 171    FIELD(GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET, 0, 1)
 172#define R_GQSPI_GFIFO_THRESH    (0x150 / 4)
 173#define R_GQSPI_DATA_STS (0x15c / 4)
 174/* We use the snapshot register to hold the core state for the currently
 175 * or most recently executed command. So the generic fifo format is defined
 176 * for the snapshot register
 177 */
 178#define R_GQSPI_GF_SNAPSHOT (0x160 / 4)
 179    FIELD(GQSPI_GF_SNAPSHOT, POLL, 19, 1)
 180    FIELD(GQSPI_GF_SNAPSHOT, STRIPE, 18, 1)
 181    FIELD(GQSPI_GF_SNAPSHOT, RECIEVE, 17, 1)
 182    FIELD(GQSPI_GF_SNAPSHOT, TRANSMIT, 16, 1)
 183    FIELD(GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT, 14, 2)
 184    FIELD(GQSPI_GF_SNAPSHOT, CHIP_SELECT, 12, 2)
 185    FIELD(GQSPI_GF_SNAPSHOT, SPI_MODE, 10, 2)
 186    FIELD(GQSPI_GF_SNAPSHOT, EXPONENT, 9, 1)
 187    FIELD(GQSPI_GF_SNAPSHOT, DATA_XFER, 8, 1)
 188    FIELD(GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA, 0, 8)
 189#define R_GQSPI_MOD_ID        (0x1fc / 4)
 190#define R_GQSPI_MOD_ID_RESET  (0x10a0000)
 191
 192#define R_QSPIDMA_DST_CTRL         (0x80c / 4)
 193#define R_QSPIDMA_DST_CTRL_RESET   (0x803ffa00)
 194#define R_QSPIDMA_DST_I_MASK       (0x820 / 4)
 195#define R_QSPIDMA_DST_I_MASK_RESET (0xfe)
 196#define R_QSPIDMA_DST_CTRL2        (0x824 / 4)
 197#define R_QSPIDMA_DST_CTRL2_RESET  (0x081bfff8)
 198
 199/* size of TXRX FIFOs */
 200#define RXFF_A          (128)
 201#define TXFF_A          (128)
 202
 203#define RXFF_A_Q          (64 * 4)
 204#define TXFF_A_Q          (64 * 4)
 205
 206/* 16MB per linear region */
 207#define LQSPI_ADDRESS_BITS 24
 208
 209#define SNOOP_CHECKING 0xFF
 210#define SNOOP_ADDR 0xF0
 211#define SNOOP_NONE 0xEE
 212#define SNOOP_STRIPING 0
 213
 214#define MIN_NUM_BUSSES 1
 215#define MAX_NUM_BUSSES 2
 216
 217static inline int num_effective_busses(XilinxSPIPS *s)
 218{
 219    return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
 220            s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM) ? s->num_busses : 1;
 221}
 222
 223static void xilinx_spips_update_cs(XilinxSPIPS *s, int field)
 224{
 225    int i;
 226
 227    for (i = 0; i < s->num_cs * s->num_busses; i++) {
 228        bool old_state = s->cs_lines_state[i];
 229        bool new_state = field & (1 << i);
 230
 231        if (old_state != new_state) {
 232            s->cs_lines_state[i] = new_state;
 233            s->rx_discard = ARRAY_FIELD_EX32(s->regs, CMND, RX_DISCARD);
 234            DB_PRINT_L(1, "%sselecting slave %d\n", new_state ? "" : "de", i);
 235        }
 236        qemu_set_irq(s->cs_lines[i], !new_state);
 237    }
 238    if (!(field & ((1 << (s->num_cs * s->num_busses)) - 1))) {
 239        s->snoop_state = SNOOP_CHECKING;
 240        s->cmd_dummies = 0;
 241        s->link_state = 1;
 242        s->link_state_next = 1;
 243        s->link_state_next_when = 0;
 244        DB_PRINT_L(1, "moving to snoop check state\n");
 245    }
 246}
 247
 248static void xlnx_zynqmp_qspips_update_cs_lines(XlnxZynqMPQSPIPS *s)
 249{
 250    if (s->regs[R_GQSPI_GF_SNAPSHOT]) {
 251        int field = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, CHIP_SELECT);
 252        bool upper_cs_sel = field & (1 << 1);
 253        bool lower_cs_sel = field & 1;
 254        bool bus0_enabled;
 255        bool bus1_enabled;
 256        uint8_t buses;
 257        int cs = 0;
 258
 259        buses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
 260        bus0_enabled = buses & 1;
 261        bus1_enabled = buses & (1 << 1);
 262
 263        if (bus0_enabled && bus1_enabled) {
 264            if (lower_cs_sel) {
 265                cs |= 1;
 266            }
 267            if (upper_cs_sel) {
 268                cs |= 1 << 3;
 269            }
 270        } else if (bus0_enabled) {
 271            if (lower_cs_sel) {
 272                cs |= 1;
 273            }
 274            if (upper_cs_sel) {
 275                cs |= 1 << 1;
 276            }
 277        } else if (bus1_enabled) {
 278            if (lower_cs_sel) {
 279                cs |= 1 << 2;
 280            }
 281            if (upper_cs_sel) {
 282                cs |= 1 << 3;
 283            }
 284        }
 285        xilinx_spips_update_cs(XILINX_SPIPS(s), cs);
 286    }
 287}
 288
 289static void xilinx_spips_update_cs_lines(XilinxSPIPS *s)
 290{
 291    int field = ~((s->regs[R_CONFIG] & CS) >> CS_SHIFT);
 292
 293    /* In dual parallel, mirror low CS to both */
 294    if (num_effective_busses(s) == 2) {
 295        /* Single bit chip-select for qspi */
 296        field &= 0x1;
 297        field |= field << 3;
 298    /* Dual stack U-Page */
 299    } else if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM &&
 300               s->regs[R_LQSPI_STS] & LQSPI_CFG_U_PAGE) {
 301        /* Single bit chip-select for qspi */
 302        field &= 0x1;
 303        /* change from CS0 to CS1 */
 304        field <<= 1;
 305    }
 306    /* Auto CS */
 307    if (!(s->regs[R_CONFIG] & MANUAL_CS) &&
 308        fifo8_is_empty(&s->tx_fifo)) {
 309        field = 0;
 310    }
 311    xilinx_spips_update_cs(s, field);
 312}
 313
 314static void xilinx_spips_update_ixr(XilinxSPIPS *s)
 315{
 316    if (!(s->regs[R_LQSPI_CFG] & LQSPI_CFG_LQ_MODE)) {
 317        s->regs[R_INTR_STATUS] &= ~IXR_SELF_CLEAR;
 318        s->regs[R_INTR_STATUS] |=
 319            (fifo8_is_full(&s->rx_fifo) ? IXR_RX_FIFO_FULL : 0) |
 320            (s->rx_fifo.num >= s->regs[R_RX_THRES] ?
 321                                    IXR_RX_FIFO_NOT_EMPTY : 0) |
 322            (fifo8_is_full(&s->tx_fifo) ? IXR_TX_FIFO_FULL : 0) |
 323            (fifo8_is_empty(&s->tx_fifo) ? IXR_TX_FIFO_EMPTY : 0) |
 324            (s->tx_fifo.num < s->regs[R_TX_THRES] ? IXR_TX_FIFO_NOT_FULL : 0);
 325    }
 326    int new_irqline = !!(s->regs[R_INTR_MASK] & s->regs[R_INTR_STATUS] &
 327                                                                IXR_ALL);
 328    if (new_irqline != s->irqline) {
 329        s->irqline = new_irqline;
 330        qemu_set_irq(s->irq, s->irqline);
 331    }
 332}
 333
 334static void xlnx_zynqmp_qspips_update_ixr(XlnxZynqMPQSPIPS *s)
 335{
 336    uint32_t gqspi_int;
 337    int new_irqline;
 338
 339    s->regs[R_GQSPI_ISR] &= ~IXR_SELF_CLEAR;
 340    s->regs[R_GQSPI_ISR] |=
 341        (fifo32_is_empty(&s->fifo_g) ? IXR_GENERIC_FIFO_EMPTY : 0) |
 342        (fifo32_is_full(&s->fifo_g) ? IXR_GENERIC_FIFO_FULL : 0) |
 343        (s->fifo_g.fifo.num < s->regs[R_GQSPI_GFIFO_THRESH] ?
 344                                    IXR_GENERIC_FIFO_NOT_FULL : 0) |
 345        (fifo8_is_empty(&s->rx_fifo_g) ? IXR_RX_FIFO_EMPTY : 0) |
 346        (fifo8_is_full(&s->rx_fifo_g) ? IXR_RX_FIFO_FULL : 0) |
 347        (s->rx_fifo_g.num >= s->regs[R_GQSPI_RX_THRESH] ?
 348                                    IXR_RX_FIFO_NOT_EMPTY : 0) |
 349        (fifo8_is_empty(&s->tx_fifo_g) ? IXR_TX_FIFO_EMPTY : 0) |
 350        (fifo8_is_full(&s->tx_fifo_g) ? IXR_TX_FIFO_FULL : 0) |
 351        (s->tx_fifo_g.num < s->regs[R_GQSPI_TX_THRESH] ?
 352                                    IXR_TX_FIFO_NOT_FULL : 0);
 353
 354    /* GQSPI Interrupt Trigger Status */
 355    gqspi_int = (~s->regs[R_GQSPI_IMR]) & s->regs[R_GQSPI_ISR] & GQSPI_IXR_MASK;
 356    new_irqline = !!(gqspi_int & IXR_ALL);
 357
 358    /* drive external interrupt pin */
 359    if (new_irqline != s->gqspi_irqline) {
 360        s->gqspi_irqline = new_irqline;
 361        qemu_set_irq(XILINX_SPIPS(s)->irq, s->gqspi_irqline);
 362    }
 363}
 364
 365static void xilinx_spips_reset(DeviceState *d)
 366{
 367    XilinxSPIPS *s = XILINX_SPIPS(d);
 368
 369    memset(s->regs, 0, sizeof(s->regs));
 370
 371    fifo8_reset(&s->rx_fifo);
 372    fifo8_reset(&s->rx_fifo);
 373    /* non zero resets */
 374    s->regs[R_CONFIG] |= MODEFAIL_GEN_EN;
 375    s->regs[R_SLAVE_IDLE_COUNT] = 0xFF;
 376    s->regs[R_TX_THRES] = 1;
 377    s->regs[R_RX_THRES] = 1;
 378    /* FIXME: move magic number definition somewhere sensible */
 379    s->regs[R_MOD_ID] = 0x01090106;
 380    s->regs[R_LQSPI_CFG] = R_LQSPI_CFG_RESET;
 381    s->link_state = 1;
 382    s->link_state_next = 1;
 383    s->link_state_next_when = 0;
 384    s->snoop_state = SNOOP_CHECKING;
 385    s->cmd_dummies = 0;
 386    s->man_start_com = false;
 387    xilinx_spips_update_ixr(s);
 388    xilinx_spips_update_cs_lines(s);
 389}
 390
 391static void xlnx_zynqmp_qspips_reset(DeviceState *d)
 392{
 393    XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(d);
 394
 395    xilinx_spips_reset(d);
 396
 397    memset(s->regs, 0, sizeof(s->regs));
 398
 399    fifo8_reset(&s->rx_fifo_g);
 400    fifo8_reset(&s->rx_fifo_g);
 401    fifo32_reset(&s->fifo_g);
 402    s->regs[R_INTR_STATUS] = R_INTR_STATUS_RESET;
 403    s->regs[R_GPIO] = 1;
 404    s->regs[R_LPBK_DLY_ADJ] = R_LPBK_DLY_ADJ_RESET;
 405    s->regs[R_GQSPI_GFIFO_THRESH] = 0x10;
 406    s->regs[R_MOD_ID] = 0x01090101;
 407    s->regs[R_GQSPI_IMR] = R_GQSPI_IMR_RESET;
 408    s->regs[R_GQSPI_TX_THRESH] = 1;
 409    s->regs[R_GQSPI_RX_THRESH] = 1;
 410    s->regs[R_GQSPI_GPIO] = 1;
 411    s->regs[R_GQSPI_LPBK_DLY_ADJ] = R_GQSPI_LPBK_DLY_ADJ_RESET;
 412    s->regs[R_GQSPI_MOD_ID] = R_GQSPI_MOD_ID_RESET;
 413    s->regs[R_QSPIDMA_DST_CTRL] = R_QSPIDMA_DST_CTRL_RESET;
 414    s->regs[R_QSPIDMA_DST_I_MASK] = R_QSPIDMA_DST_I_MASK_RESET;
 415    s->regs[R_QSPIDMA_DST_CTRL2] = R_QSPIDMA_DST_CTRL2_RESET;
 416    s->man_start_com_g = false;
 417    s->gqspi_irqline = 0;
 418    xlnx_zynqmp_qspips_update_ixr(s);
 419}
 420
 421/* N way (num) in place bit striper. Lay out row wise bits (MSB to LSB)
 422 * column wise (from element 0 to N-1). num is the length of x, and dir
 423 * reverses the direction of the transform. Best illustrated by example:
 424 * Each digit in the below array is a single bit (num == 3):
 425 *
 426 * {{ 76543210, }  ----- stripe (dir == false) -----> {{ 741gdaFC, }
 427 *  { hgfedcba, }                                      { 630fcHEB, }
 428 *  { HGFEDCBA, }} <---- upstripe (dir == true) -----  { 52hebGDA, }}
 429 */
 430
 431static inline void stripe8(uint8_t *x, int num, bool dir)
 432{
 433    uint8_t r[MAX_NUM_BUSSES];
 434    int idx[2] = {0, 0};
 435    int bit[2] = {0, 7};
 436    int d = dir;
 437
 438    assert(num <= MAX_NUM_BUSSES);
 439    memset(r, 0, sizeof(uint8_t) * num);
 440
 441    for (idx[0] = 0; idx[0] < num; ++idx[0]) {
 442        for (bit[0] = 7; bit[0] >= 0; bit[0]--) {
 443            r[idx[!d]] |= x[idx[d]] & 1 << bit[d] ? 1 << bit[!d] : 0;
 444            idx[1] = (idx[1] + 1) % num;
 445            if (!idx[1]) {
 446                bit[1]--;
 447            }
 448        }
 449    }
 450    memcpy(x, r, sizeof(uint8_t) * num);
 451}
 452
 453static void xlnx_zynqmp_qspips_flush_fifo_g(XlnxZynqMPQSPIPS *s)
 454{
 455    while (s->regs[R_GQSPI_DATA_STS] || !fifo32_is_empty(&s->fifo_g)) {
 456        uint8_t tx_rx[2] = { 0 };
 457        int num_stripes = 1;
 458        uint8_t busses;
 459        int i;
 460
 461        if (!s->regs[R_GQSPI_DATA_STS]) {
 462            uint8_t imm;
 463
 464            s->regs[R_GQSPI_GF_SNAPSHOT] = fifo32_pop(&s->fifo_g);
 465            DB_PRINT_L(0, "GQSPI command: %x\n", s->regs[R_GQSPI_GF_SNAPSHOT]);
 466            if (!s->regs[R_GQSPI_GF_SNAPSHOT]) {
 467                DB_PRINT_L(0, "Dummy GQSPI Delay Command Entry, Do nothing");
 468                continue;
 469            }
 470            xlnx_zynqmp_qspips_update_cs_lines(s);
 471
 472            imm = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
 473            if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
 474                /* immedate transfer */
 475                if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
 476                    ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
 477                    s->regs[R_GQSPI_DATA_STS] = 1;
 478                /* CS setup/hold - do nothing */
 479                } else {
 480                    s->regs[R_GQSPI_DATA_STS] = 0;
 481                }
 482            } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, EXPONENT)) {
 483                if (imm > 31) {
 484                    qemu_log_mask(LOG_UNIMP, "QSPI exponential transfer too"
 485                                  " long - 2 ^ %" PRId8 " requested\n", imm);
 486                }
 487                s->regs[R_GQSPI_DATA_STS] = 1ul << imm;
 488            } else {
 489                s->regs[R_GQSPI_DATA_STS] = imm;
 490            }
 491        }
 492        /* Zero length transfer check */
 493        if (!s->regs[R_GQSPI_DATA_STS]) {
 494            continue;
 495        }
 496        if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE) &&
 497            fifo8_is_full(&s->rx_fifo_g)) {
 498            /* No space in RX fifo for transfer - try again later */
 499            return;
 500        }
 501        if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, STRIPE) &&
 502            (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
 503             ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE))) {
 504            num_stripes = 2;
 505        }
 506        if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
 507            tx_rx[0] = ARRAY_FIELD_EX32(s->regs,
 508                                        GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
 509        } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT)) {
 510            for (i = 0; i < num_stripes; ++i) {
 511                if (!fifo8_is_empty(&s->tx_fifo_g)) {
 512                    tx_rx[i] = fifo8_pop(&s->tx_fifo_g);
 513                    s->tx_fifo_g_align++;
 514                } else {
 515                    return;
 516                }
 517            }
 518        }
 519        if (num_stripes == 1) {
 520            /* mirror */
 521            tx_rx[1] = tx_rx[0];
 522        }
 523        busses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
 524        for (i = 0; i < 2; ++i) {
 525            DB_PRINT_L(1, "bus %d tx = %02x\n", i, tx_rx[i]);
 526            tx_rx[i] = ssi_transfer(XILINX_SPIPS(s)->spi[i], tx_rx[i]);
 527            DB_PRINT_L(1, "bus %d rx = %02x\n", i, tx_rx[i]);
 528        }
 529        if (s->regs[R_GQSPI_DATA_STS] > 1 &&
 530            busses == 0x3 && num_stripes == 2) {
 531            s->regs[R_GQSPI_DATA_STS] -= 2;
 532        } else if (s->regs[R_GQSPI_DATA_STS] > 0) {
 533            s->regs[R_GQSPI_DATA_STS]--;
 534        }
 535        if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
 536            for (i = 0; i < 2; ++i) {
 537                if (busses & (1 << i)) {
 538                    DB_PRINT_L(1, "bus %d push_byte = %02x\n", i, tx_rx[i]);
 539                    fifo8_push(&s->rx_fifo_g, tx_rx[i]);
 540                    s->rx_fifo_g_align++;
 541                }
 542            }
 543        }
 544        if (!s->regs[R_GQSPI_DATA_STS]) {
 545            for (; s->tx_fifo_g_align % 4; s->tx_fifo_g_align++) {
 546                fifo8_pop(&s->tx_fifo_g);
 547            }
 548            for (; s->rx_fifo_g_align % 4; s->rx_fifo_g_align++) {
 549                fifo8_push(&s->rx_fifo_g, 0);
 550            }
 551        }
 552    }
 553}
 554
 555static int xilinx_spips_num_dummies(XilinxQSPIPS *qs, uint8_t command)
 556{
 557    if (!qs) {
 558        /* The SPI device is not a QSPI device */
 559        return -1;
 560    }
 561
 562    switch (command) { /* check for dummies */
 563    case READ: /* no dummy bytes/cycles */
 564    case PP:
 565    case DPP:
 566    case QPP:
 567    case READ_4:
 568    case PP_4:
 569    case QPP_4:
 570        return 0;
 571    case FAST_READ:
 572    case DOR:
 573    case QOR:
 574    case DOR_4:
 575    case QOR_4:
 576        return 1;
 577    case DIOR:
 578    case FAST_READ_4:
 579    case DIOR_4:
 580        return 2;
 581    case QIOR:
 582    case QIOR_4:
 583        return 4;
 584    default:
 585        return -1;
 586    }
 587}
 588
 589static inline uint8_t get_addr_length(XilinxSPIPS *s, uint8_t cmd)
 590{
 591   switch (cmd) {
 592   case PP_4:
 593   case QPP_4:
 594   case READ_4:
 595   case QIOR_4:
 596   case FAST_READ_4:
 597   case DOR_4:
 598   case QOR_4:
 599   case DIOR_4:
 600       return 4;
 601   default:
 602       return (s->regs[R_CMND] & R_CMND_EXT_ADD) ? 4 : 3;
 603   }
 604}
 605
 606static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
 607{
 608    int debug_level = 0;
 609    XilinxQSPIPS *q = (XilinxQSPIPS *) object_dynamic_cast(OBJECT(s),
 610                                                           TYPE_XILINX_QSPIPS);
 611
 612    for (;;) {
 613        int i;
 614        uint8_t tx = 0;
 615        uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
 616        uint8_t dummy_cycles = 0;
 617        uint8_t addr_length;
 618
 619        if (fifo8_is_empty(&s->tx_fifo)) {
 620            xilinx_spips_update_ixr(s);
 621            return;
 622        } else if (s->snoop_state == SNOOP_STRIPING ||
 623                   s->snoop_state == SNOOP_NONE) {
 624            for (i = 0; i < num_effective_busses(s); ++i) {
 625                tx_rx[i] = fifo8_pop(&s->tx_fifo);
 626            }
 627            stripe8(tx_rx, num_effective_busses(s), false);
 628        } else if (s->snoop_state >= SNOOP_ADDR) {
 629            tx = fifo8_pop(&s->tx_fifo);
 630            for (i = 0; i < num_effective_busses(s); ++i) {
 631                tx_rx[i] = tx;
 632            }
 633        } else {
 634            /* Extract a dummy byte and generate dummy cycles according to the
 635             * link state */
 636            tx = fifo8_pop(&s->tx_fifo);
 637            dummy_cycles = 8 / s->link_state;
 638        }
 639
 640        for (i = 0; i < num_effective_busses(s); ++i) {
 641            int bus = num_effective_busses(s) - 1 - i;
 642            if (dummy_cycles) {
 643                int d;
 644                for (d = 0; d < dummy_cycles; ++d) {
 645                    tx_rx[0] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[0]);
 646                }
 647            } else {
 648                DB_PRINT_L(debug_level, "tx = %02x\n", tx_rx[i]);
 649                tx_rx[i] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[i]);
 650                DB_PRINT_L(debug_level, "rx = %02x\n", tx_rx[i]);
 651            }
 652        }
 653
 654        if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
 655            DB_PRINT_L(debug_level, "dircarding drained rx byte\n");
 656            /* Do nothing */
 657        } else if (s->rx_discard) {
 658            DB_PRINT_L(debug_level, "dircarding discarded rx byte\n");
 659            s->rx_discard -= 8 / s->link_state;
 660        } else if (fifo8_is_full(&s->rx_fifo)) {
 661            s->regs[R_INTR_STATUS] |= IXR_RX_FIFO_OVERFLOW;
 662            DB_PRINT_L(0, "rx FIFO overflow");
 663        } else if (s->snoop_state == SNOOP_STRIPING) {
 664            stripe8(tx_rx, num_effective_busses(s), true);
 665            for (i = 0; i < num_effective_busses(s); ++i) {
 666                fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[i]);
 667                DB_PRINT_L(debug_level, "pushing striped rx byte\n");
 668            }
 669        } else {
 670           DB_PRINT_L(debug_level, "pushing unstriped rx byte\n");
 671           fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[0]);
 672        }
 673
 674        if (s->link_state_next_when) {
 675            s->link_state_next_when--;
 676            if (!s->link_state_next_when) {
 677                s->link_state = s->link_state_next;
 678            }
 679        }
 680
 681        DB_PRINT_L(debug_level, "initial snoop state: %x\n",
 682                   (unsigned)s->snoop_state);
 683        switch (s->snoop_state) {
 684        case (SNOOP_CHECKING):
 685            /* Store the count of dummy bytes in the txfifo */
 686            s->cmd_dummies = xilinx_spips_num_dummies(q, tx);
 687            addr_length = get_addr_length(s, tx);
 688            if (s->cmd_dummies < 0) {
 689                s->snoop_state = SNOOP_NONE;
 690            } else {
 691                s->snoop_state = SNOOP_ADDR + addr_length - 1;
 692            }
 693            switch (tx) {
 694            case DPP:
 695            case DOR:
 696            case DOR_4:
 697                s->link_state_next = 2;
 698                s->link_state_next_when = addr_length + s->cmd_dummies;
 699                break;
 700            case QPP:
 701            case QPP_4:
 702            case QOR:
 703            case QOR_4:
 704                s->link_state_next = 4;
 705                s->link_state_next_when = addr_length + s->cmd_dummies;
 706                break;
 707            case DIOR:
 708            case DIOR_4:
 709                s->link_state = 2;
 710                break;
 711            case QIOR:
 712            case QIOR_4:
 713                s->link_state = 4;
 714                break;
 715            }
 716            break;
 717        case (SNOOP_ADDR):
 718            /* Address has been transmitted, transmit dummy cycles now if
 719             * needed */
 720            if (s->cmd_dummies < 0) {
 721                s->snoop_state = SNOOP_NONE;
 722            } else {
 723                s->snoop_state = s->cmd_dummies;
 724            }
 725            break;
 726        case (SNOOP_STRIPING):
 727        case (SNOOP_NONE):
 728            /* Once we hit the boring stuff - squelch debug noise */
 729            if (!debug_level) {
 730                DB_PRINT_L(0, "squelching debug info ....\n");
 731                debug_level = 1;
 732            }
 733            break;
 734        default:
 735            s->snoop_state--;
 736        }
 737        DB_PRINT_L(debug_level, "final snoop state: %x\n",
 738                   (unsigned)s->snoop_state);
 739    }
 740}
 741
 742static inline void tx_data_bytes(Fifo8 *fifo, uint32_t value, int num, bool be)
 743{
 744    int i;
 745    for (i = 0; i < num && !fifo8_is_full(fifo); ++i) {
 746        if (be) {
 747            fifo8_push(fifo, (uint8_t)(value >> 24));
 748            value <<= 8;
 749        } else {
 750            fifo8_push(fifo, (uint8_t)value);
 751            value >>= 8;
 752        }
 753    }
 754}
 755
 756static void xilinx_spips_check_zero_pump(XilinxSPIPS *s)
 757{
 758    if (!s->regs[R_TRANSFER_SIZE]) {
 759        return;
 760    }
 761    if (!fifo8_is_empty(&s->tx_fifo) && s->regs[R_CMND] & R_CMND_PUSH_WAIT) {
 762        return;
 763    }
 764    /*
 765     * The zero pump must never fill tx fifo such that rx overflow is
 766     * possible
 767     */
 768    while (s->regs[R_TRANSFER_SIZE] &&
 769           s->rx_fifo.num + s->tx_fifo.num < RXFF_A_Q - 3) {
 770        /* endianess just doesn't matter when zero pumping */
 771        tx_data_bytes(&s->tx_fifo, 0, 4, false);
 772        s->regs[R_TRANSFER_SIZE] &= ~0x03ull;
 773        s->regs[R_TRANSFER_SIZE] -= 4;
 774    }
 775}
 776
 777static void xilinx_spips_check_flush(XilinxSPIPS *s)
 778{
 779    if (s->man_start_com ||
 780        (!fifo8_is_empty(&s->tx_fifo) &&
 781         !(s->regs[R_CONFIG] & MAN_START_EN))) {
 782        xilinx_spips_check_zero_pump(s);
 783        xilinx_spips_flush_txfifo(s);
 784    }
 785    if (fifo8_is_empty(&s->tx_fifo) && !s->regs[R_TRANSFER_SIZE]) {
 786        s->man_start_com = false;
 787    }
 788    xilinx_spips_update_ixr(s);
 789}
 790
 791static void xlnx_zynqmp_qspips_check_flush(XlnxZynqMPQSPIPS *s)
 792{
 793    bool gqspi_has_work = s->regs[R_GQSPI_DATA_STS] ||
 794                          !fifo32_is_empty(&s->fifo_g);
 795
 796    if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
 797        if (s->man_start_com_g || (gqspi_has_work &&
 798             !ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE))) {
 799            xlnx_zynqmp_qspips_flush_fifo_g(s);
 800        }
 801    } else {
 802        xilinx_spips_check_flush(XILINX_SPIPS(s));
 803    }
 804    if (!gqspi_has_work) {
 805        s->man_start_com_g = false;
 806    }
 807    xlnx_zynqmp_qspips_update_ixr(s);
 808}
 809
 810static inline int rx_data_bytes(Fifo8 *fifo, uint8_t *value, int max)
 811{
 812    int i;
 813
 814    for (i = 0; i < max && !fifo8_is_empty(fifo); ++i) {
 815        value[i] = fifo8_pop(fifo);
 816    }
 817    return max - i;
 818}
 819
 820static const void *pop_buf(Fifo8 *fifo, uint32_t max, uint32_t *num)
 821{
 822    void *ret;
 823
 824    if (max == 0 || max > fifo->num) {
 825        abort();
 826    }
 827    *num = MIN(fifo->capacity - fifo->head, max);
 828    ret = &fifo->data[fifo->head];
 829    fifo->head += *num;
 830    fifo->head %= fifo->capacity;
 831    fifo->num -= *num;
 832    return ret;
 833}
 834
 835static void xlnx_zynqmp_qspips_notify(void *opaque)
 836{
 837    XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(opaque);
 838    XilinxSPIPS *s = XILINX_SPIPS(rq);
 839    Fifo8 *recv_fifo;
 840
 841    if (ARRAY_FIELD_EX32(rq->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
 842        if (!(ARRAY_FIELD_EX32(rq->regs, GQSPI_CNFG, MODE_EN) == 2)) {
 843            return;
 844        }
 845        recv_fifo = &rq->rx_fifo_g;
 846    } else {
 847        if (!(s->regs[R_CMND] & R_CMND_DMA_EN)) {
 848            return;
 849        }
 850        recv_fifo = &s->rx_fifo;
 851    }
 852    while (recv_fifo->num >= 4
 853           && stream_can_push(rq->dma, xlnx_zynqmp_qspips_notify, rq))
 854    {
 855        size_t ret;
 856        uint32_t num;
 857        const void *rxd;
 858        int len;
 859
 860        len = recv_fifo->num >= rq->dma_burst_size ? rq->dma_burst_size :
 861                                                   recv_fifo->num;
 862        rxd = pop_buf(recv_fifo, len, &num);
 863
 864        memcpy(rq->dma_buf, rxd, num);
 865
 866        ret = stream_push(rq->dma, rq->dma_buf, num);
 867        assert(ret == num);
 868        xlnx_zynqmp_qspips_check_flush(rq);
 869    }
 870}
 871
 872static uint64_t xilinx_spips_read(void *opaque, hwaddr addr,
 873                                                        unsigned size)
 874{
 875    XilinxSPIPS *s = opaque;
 876    uint32_t mask = ~0;
 877    uint32_t ret;
 878    uint8_t rx_buf[4];
 879    int shortfall;
 880
 881    addr >>= 2;
 882    switch (addr) {
 883    case R_CONFIG:
 884        mask = ~(R_CONFIG_RSVD | MAN_START_COM);
 885        break;
 886    case R_INTR_STATUS:
 887        ret = s->regs[addr] & IXR_ALL;
 888        s->regs[addr] = 0;
 889        DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
 890        xilinx_spips_update_ixr(s);
 891        return ret;
 892    case R_INTR_MASK:
 893        mask = IXR_ALL;
 894        break;
 895    case  R_EN:
 896        mask = 0x1;
 897        break;
 898    case R_SLAVE_IDLE_COUNT:
 899        mask = 0xFF;
 900        break;
 901    case R_MOD_ID:
 902        mask = 0x01FFFFFF;
 903        break;
 904    case R_INTR_EN:
 905    case R_INTR_DIS:
 906    case R_TX_DATA:
 907        mask = 0;
 908        break;
 909    case R_RX_DATA:
 910        memset(rx_buf, 0, sizeof(rx_buf));
 911        shortfall = rx_data_bytes(&s->rx_fifo, rx_buf, s->num_txrx_bytes);
 912        ret = s->regs[R_CONFIG] & R_CONFIG_ENDIAN ?
 913                        cpu_to_be32(*(uint32_t *)rx_buf) :
 914                        cpu_to_le32(*(uint32_t *)rx_buf);
 915        if (!(s->regs[R_CONFIG] & R_CONFIG_ENDIAN)) {
 916            ret <<= 8 * shortfall;
 917        }
 918        DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
 919        xilinx_spips_check_flush(s);
 920        xilinx_spips_update_ixr(s);
 921        return ret;
 922    }
 923    DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4,
 924               s->regs[addr] & mask);
 925    return s->regs[addr] & mask;
 926
 927}
 928
 929static uint64_t xlnx_zynqmp_qspips_read(void *opaque,
 930                                        hwaddr addr, unsigned size)
 931{
 932    XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
 933    uint32_t reg = addr / 4;
 934    uint32_t ret;
 935    uint8_t rx_buf[4];
 936    int shortfall;
 937
 938    if (reg <= R_MOD_ID) {
 939        return xilinx_spips_read(opaque, addr, size);
 940    } else {
 941        switch (reg) {
 942        case R_GQSPI_RXD:
 943            if (fifo8_is_empty(&s->rx_fifo_g)) {
 944                qemu_log_mask(LOG_GUEST_ERROR,
 945                              "Read from empty GQSPI RX FIFO\n");
 946                return 0;
 947            }
 948            memset(rx_buf, 0, sizeof(rx_buf));
 949            shortfall = rx_data_bytes(&s->rx_fifo_g, rx_buf,
 950                                      XILINX_SPIPS(s)->num_txrx_bytes);
 951            ret = ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN) ?
 952                  cpu_to_be32(*(uint32_t *)rx_buf) :
 953                  cpu_to_le32(*(uint32_t *)rx_buf);
 954            if (!ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN)) {
 955                ret <<= 8 * shortfall;
 956            }
 957            xlnx_zynqmp_qspips_check_flush(s);
 958            xlnx_zynqmp_qspips_update_ixr(s);
 959            return ret;
 960        default:
 961            return s->regs[reg];
 962        }
 963    }
 964}
 965
 966static void xilinx_spips_write(void *opaque, hwaddr addr,
 967                                        uint64_t value, unsigned size)
 968{
 969    int mask = ~0;
 970    XilinxSPIPS *s = opaque;
 971
 972    DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr, (unsigned)value);
 973    addr >>= 2;
 974    switch (addr) {
 975    case R_CONFIG:
 976        mask = ~(R_CONFIG_RSVD | MAN_START_COM);
 977        if ((value & MAN_START_COM) && (s->regs[R_CONFIG] & MAN_START_EN)) {
 978            s->man_start_com = true;
 979        }
 980        break;
 981    case R_INTR_STATUS:
 982        mask = IXR_ALL;
 983        s->regs[R_INTR_STATUS] &= ~(mask & value);
 984        goto no_reg_update;
 985    case R_INTR_DIS:
 986        mask = IXR_ALL;
 987        s->regs[R_INTR_MASK] &= ~(mask & value);
 988        goto no_reg_update;
 989    case R_INTR_EN:
 990        mask = IXR_ALL;
 991        s->regs[R_INTR_MASK] |= mask & value;
 992        goto no_reg_update;
 993    case R_EN:
 994        mask = 0x1;
 995        break;
 996    case R_SLAVE_IDLE_COUNT:
 997        mask = 0xFF;
 998        break;
 999    case R_RX_DATA:
1000    case R_INTR_MASK:
1001    case R_MOD_ID:
1002        mask = 0;
1003        break;
1004    case R_TX_DATA:
1005        tx_data_bytes(&s->tx_fifo, (uint32_t)value, s->num_txrx_bytes,
1006                      s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1007        goto no_reg_update;
1008    case R_TXD1:
1009        tx_data_bytes(&s->tx_fifo, (uint32_t)value, 1,
1010                      s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1011        goto no_reg_update;
1012    case R_TXD2:
1013        tx_data_bytes(&s->tx_fifo, (uint32_t)value, 2,
1014                      s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1015        goto no_reg_update;
1016    case R_TXD3:
1017        tx_data_bytes(&s->tx_fifo, (uint32_t)value, 3,
1018                      s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1019        goto no_reg_update;
1020    }
1021    s->regs[addr] = (s->regs[addr] & ~mask) | (value & mask);
1022no_reg_update:
1023    xilinx_spips_update_cs_lines(s);
1024    xilinx_spips_check_flush(s);
1025    xilinx_spips_update_cs_lines(s);
1026    xilinx_spips_update_ixr(s);
1027}
1028
1029static const MemoryRegionOps spips_ops = {
1030    .read = xilinx_spips_read,
1031    .write = xilinx_spips_write,
1032    .endianness = DEVICE_LITTLE_ENDIAN,
1033};
1034
1035static void xilinx_qspips_invalidate_mmio_ptr(XilinxQSPIPS *q)
1036{
1037    q->lqspi_cached_addr = ~0ULL;
1038}
1039
1040static void xilinx_qspips_write(void *opaque, hwaddr addr,
1041                                uint64_t value, unsigned size)
1042{
1043    XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
1044    XilinxSPIPS *s = XILINX_SPIPS(opaque);
1045
1046    xilinx_spips_write(opaque, addr, value, size);
1047    addr >>= 2;
1048
1049    if (addr == R_LQSPI_CFG) {
1050        xilinx_qspips_invalidate_mmio_ptr(q);
1051    }
1052    if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
1053        fifo8_reset(&s->rx_fifo);
1054    }
1055}
1056
1057static void xlnx_zynqmp_qspips_write(void *opaque, hwaddr addr,
1058                                        uint64_t value, unsigned size)
1059{
1060    XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
1061    uint32_t reg = addr / 4;
1062
1063    if (reg <= R_MOD_ID) {
1064        xilinx_qspips_write(opaque, addr, value, size);
1065    } else {
1066        switch (reg) {
1067        case R_GQSPI_CNFG:
1068            if (FIELD_EX32(value, GQSPI_CNFG, GEN_FIFO_START) &&
1069                ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE)) {
1070                s->man_start_com_g = true;
1071            }
1072            s->regs[reg] = value & ~(R_GQSPI_CNFG_GEN_FIFO_START_MASK);
1073            break;
1074        case R_GQSPI_GEN_FIFO:
1075            if (!fifo32_is_full(&s->fifo_g)) {
1076                fifo32_push(&s->fifo_g, value);
1077            }
1078            break;
1079        case R_GQSPI_TXD:
1080            tx_data_bytes(&s->tx_fifo_g, (uint32_t)value, 4,
1081                          ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN));
1082            break;
1083        case R_GQSPI_FIFO_CTRL:
1084            if (FIELD_EX32(value, GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET)) {
1085                fifo32_reset(&s->fifo_g);
1086            }
1087            if (FIELD_EX32(value, GQSPI_FIFO_CTRL, TX_FIFO_RESET)) {
1088                fifo8_reset(&s->tx_fifo_g);
1089            }
1090            if (FIELD_EX32(value, GQSPI_FIFO_CTRL, RX_FIFO_RESET)) {
1091                fifo8_reset(&s->rx_fifo_g);
1092            }
1093            break;
1094        case R_GQSPI_IDR:
1095            s->regs[R_GQSPI_IMR] |= value;
1096            break;
1097        case R_GQSPI_IER:
1098            s->regs[R_GQSPI_IMR] &= ~value;
1099            break;
1100        case R_GQSPI_ISR:
1101            s->regs[R_GQSPI_ISR] &= ~value;
1102            break;
1103        case R_GQSPI_IMR:
1104        case R_GQSPI_RXD:
1105        case R_GQSPI_GF_SNAPSHOT:
1106        case R_GQSPI_MOD_ID:
1107            break;
1108        default:
1109            s->regs[reg] = value;
1110            break;
1111        }
1112        xlnx_zynqmp_qspips_update_cs_lines(s);
1113        xlnx_zynqmp_qspips_check_flush(s);
1114        xlnx_zynqmp_qspips_update_cs_lines(s);
1115        xlnx_zynqmp_qspips_update_ixr(s);
1116    }
1117    xlnx_zynqmp_qspips_notify(s);
1118}
1119
1120static const MemoryRegionOps qspips_ops = {
1121    .read = xilinx_spips_read,
1122    .write = xilinx_qspips_write,
1123    .endianness = DEVICE_LITTLE_ENDIAN,
1124};
1125
1126static const MemoryRegionOps xlnx_zynqmp_qspips_ops = {
1127    .read = xlnx_zynqmp_qspips_read,
1128    .write = xlnx_zynqmp_qspips_write,
1129    .endianness = DEVICE_LITTLE_ENDIAN,
1130};
1131
1132#define LQSPI_CACHE_SIZE 1024
1133
1134static void lqspi_load_cache(void *opaque, hwaddr addr)
1135{
1136    XilinxQSPIPS *q = opaque;
1137    XilinxSPIPS *s = opaque;
1138    int i;
1139    int flash_addr = ((addr & ~(LQSPI_CACHE_SIZE - 1))
1140                   / num_effective_busses(s));
1141    int slave = flash_addr >> LQSPI_ADDRESS_BITS;
1142    int cache_entry = 0;
1143    uint32_t u_page_save = s->regs[R_LQSPI_STS] & ~LQSPI_CFG_U_PAGE;
1144
1145    if (addr < q->lqspi_cached_addr ||
1146            addr > q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1147        xilinx_qspips_invalidate_mmio_ptr(q);
1148        s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1149        s->regs[R_LQSPI_STS] |= slave ? LQSPI_CFG_U_PAGE : 0;
1150
1151        DB_PRINT_L(0, "config reg status: %08x\n", s->regs[R_LQSPI_CFG]);
1152
1153        fifo8_reset(&s->tx_fifo);
1154        fifo8_reset(&s->rx_fifo);
1155
1156        /* instruction */
1157        DB_PRINT_L(0, "pushing read instruction: %02x\n",
1158                   (unsigned)(uint8_t)(s->regs[R_LQSPI_CFG] &
1159                                       LQSPI_CFG_INST_CODE));
1160        fifo8_push(&s->tx_fifo, s->regs[R_LQSPI_CFG] & LQSPI_CFG_INST_CODE);
1161        /* read address */
1162        DB_PRINT_L(0, "pushing read address %06x\n", flash_addr);
1163        if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_ADDR4) {
1164            fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 24));
1165        }
1166        fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 16));
1167        fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 8));
1168        fifo8_push(&s->tx_fifo, (uint8_t)flash_addr);
1169        /* mode bits */
1170        if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_MODE_EN) {
1171            fifo8_push(&s->tx_fifo, extract32(s->regs[R_LQSPI_CFG],
1172                                              LQSPI_CFG_MODE_SHIFT,
1173                                              LQSPI_CFG_MODE_WIDTH));
1174        }
1175        /* dummy bytes */
1176        for (i = 0; i < (extract32(s->regs[R_LQSPI_CFG], LQSPI_CFG_DUMMY_SHIFT,
1177                                   LQSPI_CFG_DUMMY_WIDTH)); ++i) {
1178            DB_PRINT_L(0, "pushing dummy byte\n");
1179            fifo8_push(&s->tx_fifo, 0);
1180        }
1181        xilinx_spips_update_cs_lines(s);
1182        xilinx_spips_flush_txfifo(s);
1183        fifo8_reset(&s->rx_fifo);
1184
1185        DB_PRINT_L(0, "starting QSPI data read\n");
1186
1187        while (cache_entry < LQSPI_CACHE_SIZE) {
1188            for (i = 0; i < 64; ++i) {
1189                tx_data_bytes(&s->tx_fifo, 0, 1, false);
1190            }
1191            xilinx_spips_flush_txfifo(s);
1192            for (i = 0; i < 64; ++i) {
1193                rx_data_bytes(&s->rx_fifo, &q->lqspi_buf[cache_entry++], 1);
1194            }
1195        }
1196
1197        s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1198        s->regs[R_LQSPI_STS] |= u_page_save;
1199        xilinx_spips_update_cs_lines(s);
1200
1201        q->lqspi_cached_addr = flash_addr * num_effective_busses(s);
1202    }
1203}
1204
1205static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
1206                              unsigned size, MemTxAttrs attrs)
1207{
1208    XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
1209
1210    if (addr >= q->lqspi_cached_addr &&
1211            addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1212        uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
1213        *value = cpu_to_le32(*(uint32_t *)retp);
1214        DB_PRINT_L(1, "addr: %08" HWADDR_PRIx ", data: %08" PRIx64 "\n",
1215                   addr, *value);
1216        return MEMTX_OK;
1217    }
1218
1219    lqspi_load_cache(opaque, addr);
1220    return lqspi_read(opaque, addr, value, size, attrs);
1221}
1222
1223static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,
1224                               unsigned size, MemTxAttrs attrs)
1225{
1226    /*
1227     * From UG1085, Chapter 24 (Quad-SPI controllers):
1228     * - Writes are ignored
1229     * - AXI writes generate an external AXI slave error (SLVERR)
1230     */
1231    qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64
1232                                   " (value: 0x%" PRIx64 "\n",
1233                  __func__, size << 3, offset, value);
1234
1235    return MEMTX_ERROR;
1236}
1237
1238static const MemoryRegionOps lqspi_ops = {
1239    .read_with_attrs = lqspi_read,
1240    .write_with_attrs = lqspi_write,
1241    .endianness = DEVICE_NATIVE_ENDIAN,
1242    .impl = {
1243        .min_access_size = 4,
1244        .max_access_size = 4,
1245    },
1246    .valid = {
1247        .min_access_size = 1,
1248        .max_access_size = 4
1249    }
1250};
1251
1252static void xilinx_spips_realize(DeviceState *dev, Error **errp)
1253{
1254    XilinxSPIPS *s = XILINX_SPIPS(dev);
1255    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1256    XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1257    qemu_irq *cs;
1258    int i;
1259
1260    DB_PRINT_L(0, "realized spips\n");
1261
1262    if (s->num_busses > MAX_NUM_BUSSES) {
1263        error_setg(errp,
1264                   "requested number of SPI busses %u exceeds maximum %d",
1265                   s->num_busses, MAX_NUM_BUSSES);
1266        return;
1267    }
1268    if (s->num_busses < MIN_NUM_BUSSES) {
1269        error_setg(errp,
1270                   "requested number of SPI busses %u is below minimum %d",
1271                   s->num_busses, MIN_NUM_BUSSES);
1272        return;
1273    }
1274
1275    s->spi = g_new(SSIBus *, s->num_busses);
1276    for (i = 0; i < s->num_busses; ++i) {
1277        char bus_name[16];
1278        snprintf(bus_name, 16, "spi%d", i);
1279        s->spi[i] = ssi_create_bus(dev, bus_name);
1280    }
1281
1282    s->cs_lines = g_new0(qemu_irq, s->num_cs * s->num_busses);
1283    s->cs_lines_state = g_new0(bool, s->num_cs * s->num_busses);
1284    for (i = 0, cs = s->cs_lines; i < s->num_busses; ++i, cs += s->num_cs) {
1285        ssi_auto_connect_slaves(DEVICE(s), cs, s->spi[i]);
1286    }
1287
1288    sysbus_init_irq(sbd, &s->irq);
1289    for (i = 0; i < s->num_cs * s->num_busses; ++i) {
1290        sysbus_init_irq(sbd, &s->cs_lines[i]);
1291    }
1292
1293    memory_region_init_io(&s->iomem, OBJECT(s), xsc->reg_ops, s,
1294                          "spi", XLNX_ZYNQMP_SPIPS_R_MAX * 4);
1295    sysbus_init_mmio(sbd, &s->iomem);
1296
1297    s->irqline = -1;
1298
1299    fifo8_create(&s->rx_fifo, xsc->rx_fifo_size);
1300    fifo8_create(&s->tx_fifo, xsc->tx_fifo_size);
1301}
1302
1303static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
1304{
1305    XilinxSPIPS *s = XILINX_SPIPS(dev);
1306    XilinxQSPIPS *q = XILINX_QSPIPS(dev);
1307    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1308
1309    DB_PRINT_L(0, "realized qspips\n");
1310
1311    s->num_busses = 2;
1312    s->num_cs = 2;
1313    s->num_txrx_bytes = 4;
1314
1315    xilinx_spips_realize(dev, errp);
1316    memory_region_init_io(&s->mmlqspi, OBJECT(s), &lqspi_ops, s, "lqspi",
1317                          (1 << LQSPI_ADDRESS_BITS) * 2);
1318    sysbus_init_mmio(sbd, &s->mmlqspi);
1319
1320    q->lqspi_cached_addr = ~0ULL;
1321}
1322
1323static void xlnx_zynqmp_qspips_realize(DeviceState *dev, Error **errp)
1324{
1325    XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(dev);
1326    XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1327
1328    if (s->dma_burst_size > QSPI_DMA_MAX_BURST_SIZE) {
1329        error_setg(errp,
1330                   "qspi dma burst size %u exceeds maximum limit %d",
1331                   s->dma_burst_size, QSPI_DMA_MAX_BURST_SIZE);
1332        return;
1333    }
1334    xilinx_qspips_realize(dev, errp);
1335    fifo8_create(&s->rx_fifo_g, xsc->rx_fifo_size);
1336    fifo8_create(&s->tx_fifo_g, xsc->tx_fifo_size);
1337    fifo32_create(&s->fifo_g, 32);
1338}
1339
1340static void xlnx_zynqmp_qspips_init(Object *obj)
1341{
1342    XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(obj);
1343
1344    object_property_add_link(obj, "stream-connected-dma", TYPE_STREAM_SLAVE,
1345                             (Object **)&rq->dma,
1346                             object_property_allow_set_link,
1347                             OBJ_PROP_LINK_STRONG,
1348                             NULL);
1349}
1350
1351static int xilinx_spips_post_load(void *opaque, int version_id)
1352{
1353    xilinx_spips_update_ixr((XilinxSPIPS *)opaque);
1354    xilinx_spips_update_cs_lines((XilinxSPIPS *)opaque);
1355    return 0;
1356}
1357
1358static const VMStateDescription vmstate_xilinx_spips = {
1359    .name = "xilinx_spips",
1360    .version_id = 2,
1361    .minimum_version_id = 2,
1362    .post_load = xilinx_spips_post_load,
1363    .fields = (VMStateField[]) {
1364        VMSTATE_FIFO8(tx_fifo, XilinxSPIPS),
1365        VMSTATE_FIFO8(rx_fifo, XilinxSPIPS),
1366        VMSTATE_UINT32_ARRAY(regs, XilinxSPIPS, XLNX_SPIPS_R_MAX),
1367        VMSTATE_UINT8(snoop_state, XilinxSPIPS),
1368        VMSTATE_END_OF_LIST()
1369    }
1370};
1371
1372static int xlnx_zynqmp_qspips_post_load(void *opaque, int version_id)
1373{
1374    XlnxZynqMPQSPIPS *s = (XlnxZynqMPQSPIPS *)opaque;
1375    XilinxSPIPS *qs = XILINX_SPIPS(s);
1376
1377    if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN) &&
1378        fifo8_is_empty(&qs->rx_fifo) && fifo8_is_empty(&qs->tx_fifo)) {
1379        xlnx_zynqmp_qspips_update_ixr(s);
1380        xlnx_zynqmp_qspips_update_cs_lines(s);
1381    }
1382    return 0;
1383}
1384
1385static const VMStateDescription vmstate_xilinx_qspips = {
1386    .name = "xilinx_qspips",
1387    .version_id = 1,
1388    .minimum_version_id = 1,
1389    .fields = (VMStateField[]) {
1390        VMSTATE_STRUCT(parent_obj, XilinxQSPIPS, 0,
1391                       vmstate_xilinx_spips, XilinxSPIPS),
1392        VMSTATE_END_OF_LIST()
1393    }
1394};
1395
1396static const VMStateDescription vmstate_xlnx_zynqmp_qspips = {
1397    .name = "xlnx_zynqmp_qspips",
1398    .version_id = 1,
1399    .minimum_version_id = 1,
1400    .post_load = xlnx_zynqmp_qspips_post_load,
1401    .fields = (VMStateField[]) {
1402        VMSTATE_STRUCT(parent_obj, XlnxZynqMPQSPIPS, 0,
1403                       vmstate_xilinx_qspips, XilinxQSPIPS),
1404        VMSTATE_FIFO8(tx_fifo_g, XlnxZynqMPQSPIPS),
1405        VMSTATE_FIFO8(rx_fifo_g, XlnxZynqMPQSPIPS),
1406        VMSTATE_FIFO32(fifo_g, XlnxZynqMPQSPIPS),
1407        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPQSPIPS, XLNX_ZYNQMP_SPIPS_R_MAX),
1408        VMSTATE_END_OF_LIST()
1409    }
1410};
1411
1412static Property xilinx_zynqmp_qspips_properties[] = {
1413    DEFINE_PROP_UINT32("dma-burst-size", XlnxZynqMPQSPIPS, dma_burst_size, 64),
1414    DEFINE_PROP_END_OF_LIST(),
1415};
1416
1417static Property xilinx_spips_properties[] = {
1418    DEFINE_PROP_UINT8("num-busses", XilinxSPIPS, num_busses, 1),
1419    DEFINE_PROP_UINT8("num-ss-bits", XilinxSPIPS, num_cs, 4),
1420    DEFINE_PROP_UINT8("num-txrx-bytes", XilinxSPIPS, num_txrx_bytes, 1),
1421    DEFINE_PROP_END_OF_LIST(),
1422};
1423
1424static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
1425{
1426    DeviceClass *dc = DEVICE_CLASS(klass);
1427    XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1428
1429    dc->realize = xilinx_qspips_realize;
1430    xsc->reg_ops = &qspips_ops;
1431    xsc->rx_fifo_size = RXFF_A_Q;
1432    xsc->tx_fifo_size = TXFF_A_Q;
1433}
1434
1435static void xilinx_spips_class_init(ObjectClass *klass, void *data)
1436{
1437    DeviceClass *dc = DEVICE_CLASS(klass);
1438    XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1439
1440    dc->realize = xilinx_spips_realize;
1441    dc->reset = xilinx_spips_reset;
1442    dc->props = xilinx_spips_properties;
1443    dc->vmsd = &vmstate_xilinx_spips;
1444
1445    xsc->reg_ops = &spips_ops;
1446    xsc->rx_fifo_size = RXFF_A;
1447    xsc->tx_fifo_size = TXFF_A;
1448}
1449
1450static void xlnx_zynqmp_qspips_class_init(ObjectClass *klass, void * data)
1451{
1452    DeviceClass *dc = DEVICE_CLASS(klass);
1453    XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1454
1455    dc->realize = xlnx_zynqmp_qspips_realize;
1456    dc->reset = xlnx_zynqmp_qspips_reset;
1457    dc->vmsd = &vmstate_xlnx_zynqmp_qspips;
1458    dc->props = xilinx_zynqmp_qspips_properties;
1459    xsc->reg_ops = &xlnx_zynqmp_qspips_ops;
1460    xsc->rx_fifo_size = RXFF_A_Q;
1461    xsc->tx_fifo_size = TXFF_A_Q;
1462}
1463
1464static const TypeInfo xilinx_spips_info = {
1465    .name  = TYPE_XILINX_SPIPS,
1466    .parent = TYPE_SYS_BUS_DEVICE,
1467    .instance_size  = sizeof(XilinxSPIPS),
1468    .class_init = xilinx_spips_class_init,
1469    .class_size = sizeof(XilinxSPIPSClass),
1470};
1471
1472static const TypeInfo xilinx_qspips_info = {
1473    .name  = TYPE_XILINX_QSPIPS,
1474    .parent = TYPE_XILINX_SPIPS,
1475    .instance_size  = sizeof(XilinxQSPIPS),
1476    .class_init = xilinx_qspips_class_init,
1477};
1478
1479static const TypeInfo xlnx_zynqmp_qspips_info = {
1480    .name  = TYPE_XLNX_ZYNQMP_QSPIPS,
1481    .parent = TYPE_XILINX_QSPIPS,
1482    .instance_size  = sizeof(XlnxZynqMPQSPIPS),
1483    .instance_init  = xlnx_zynqmp_qspips_init,
1484    .class_init = xlnx_zynqmp_qspips_class_init,
1485};
1486
1487static void xilinx_spips_register_types(void)
1488{
1489    type_register_static(&xilinx_spips_info);
1490    type_register_static(&xilinx_qspips_info);
1491    type_register_static(&xlnx_zynqmp_qspips_info);
1492}
1493
1494type_init(xilinx_spips_register_types)
1495