xref: /openbmc/qemu/hw/ssi/aspeed_smc.c (revision 13951ccf)
1 /*
2  * ASPEED AST2400 SMC Controller (SPI Flash Only)
3  *
4  * Copyright (C) 2016 IBM Corp.
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "hw/block/flash.h"
27 #include "hw/sysbus.h"
28 #include "migration/vmstate.h"
29 #include "qemu/log.h"
30 #include "qemu/module.h"
31 #include "qemu/error-report.h"
32 #include "qapi/error.h"
33 #include "qemu/units.h"
34 #include "trace.h"
35 
36 #include "hw/irq.h"
37 #include "hw/qdev-properties.h"
38 #include "hw/ssi/aspeed_smc.h"
39 
40 /* CE Type Setting Register */
41 #define R_CONF            (0x00 / 4)
42 #define   CONF_LEGACY_DISABLE  (1 << 31)
43 #define   CONF_ENABLE_W4       20
44 #define   CONF_ENABLE_W3       19
45 #define   CONF_ENABLE_W2       18
46 #define   CONF_ENABLE_W1       17
47 #define   CONF_ENABLE_W0       16
48 #define   CONF_FLASH_TYPE4     8
49 #define   CONF_FLASH_TYPE3     6
50 #define   CONF_FLASH_TYPE2     4
51 #define   CONF_FLASH_TYPE1     2
52 #define   CONF_FLASH_TYPE0     0
53 #define      CONF_FLASH_TYPE_NOR   0x0
54 #define      CONF_FLASH_TYPE_NAND  0x1
55 #define      CONF_FLASH_TYPE_SPI   0x2 /* AST2600 is SPI only */
56 
57 /* CE Control Register */
58 #define R_CE_CTRL            (0x04 / 4)
59 #define   CTRL_EXTENDED4       4  /* 32 bit addressing for SPI */
60 #define   CTRL_EXTENDED3       3  /* 32 bit addressing for SPI */
61 #define   CTRL_EXTENDED2       2  /* 32 bit addressing for SPI */
62 #define   CTRL_EXTENDED1       1  /* 32 bit addressing for SPI */
63 #define   CTRL_EXTENDED0       0  /* 32 bit addressing for SPI */
64 
65 /* Interrupt Control and Status Register */
66 #define R_INTR_CTRL       (0x08 / 4)
67 #define   INTR_CTRL_DMA_STATUS            (1 << 11)
68 #define   INTR_CTRL_CMD_ABORT_STATUS      (1 << 10)
69 #define   INTR_CTRL_WRITE_PROTECT_STATUS  (1 << 9)
70 #define   INTR_CTRL_DMA_EN                (1 << 3)
71 #define   INTR_CTRL_CMD_ABORT_EN          (1 << 2)
72 #define   INTR_CTRL_WRITE_PROTECT_EN      (1 << 1)
73 
74 /* Command Control Register */
75 #define R_CE_CMD_CTRL      (0x0C / 4)
76 #define   CTRL_ADDR_BYTE0_DISABLE_SHIFT       4
77 #define   CTRL_DATA_BYTE0_DISABLE_SHIFT       0
78 
79 #define aspeed_smc_addr_byte_enabled(s, i)                               \
80     (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_ADDR_BYTE0_DISABLE_SHIFT + (i)))))
81 #define aspeed_smc_data_byte_enabled(s, i)                               \
82     (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_DATA_BYTE0_DISABLE_SHIFT + (i)))))
83 
84 /* CEx Control Register */
85 #define R_CTRL0           (0x10 / 4)
86 #define   CTRL_IO_QPI              (1 << 31)
87 #define   CTRL_IO_QUAD_DATA        (1 << 30)
88 #define   CTRL_IO_DUAL_DATA        (1 << 29)
89 #define   CTRL_IO_DUAL_ADDR_DATA   (1 << 28) /* Includes dummies */
90 #define   CTRL_IO_QUAD_ADDR_DATA   (1 << 28) /* Includes dummies */
91 #define   CTRL_CMD_SHIFT           16
92 #define   CTRL_CMD_MASK            0xff
93 #define   CTRL_DUMMY_HIGH_SHIFT    14
94 #define   CTRL_AST2400_SPI_4BYTE   (1 << 13)
95 #define CE_CTRL_CLOCK_FREQ_SHIFT   8
96 #define CE_CTRL_CLOCK_FREQ_MASK    0xf
97 #define CE_CTRL_CLOCK_FREQ(div)                                         \
98     (((div) & CE_CTRL_CLOCK_FREQ_MASK) << CE_CTRL_CLOCK_FREQ_SHIFT)
99 #define   CTRL_DUMMY_LOW_SHIFT     6 /* 2 bits [7:6] */
100 #define   CTRL_CE_STOP_ACTIVE      (1 << 2)
101 #define   CTRL_CMD_MODE_MASK       0x3
102 #define     CTRL_READMODE          0x0
103 #define     CTRL_FREADMODE         0x1
104 #define     CTRL_WRITEMODE         0x2
105 #define     CTRL_USERMODE          0x3
106 #define R_CTRL1           (0x14 / 4)
107 #define R_CTRL2           (0x18 / 4)
108 #define R_CTRL3           (0x1C / 4)
109 #define R_CTRL4           (0x20 / 4)
110 
111 /* CEx Segment Address Register */
112 #define R_SEG_ADDR0       (0x30 / 4)
113 #define   SEG_END_SHIFT        24   /* 8MB units */
114 #define   SEG_END_MASK         0xff
115 #define   SEG_START_SHIFT      16   /* address bit [A29-A23] */
116 #define   SEG_START_MASK       0xff
117 #define R_SEG_ADDR1       (0x34 / 4)
118 #define R_SEG_ADDR2       (0x38 / 4)
119 #define R_SEG_ADDR3       (0x3C / 4)
120 #define R_SEG_ADDR4       (0x40 / 4)
121 
122 /* Misc Control Register #1 */
123 #define R_MISC_CTRL1      (0x50 / 4)
124 
125 /* SPI dummy cycle data */
126 #define R_DUMMY_DATA      (0x54 / 4)
127 
128 /* FMC_WDT2 Control/Status Register for Alternate Boot (AST2600) */
129 #define R_FMC_WDT2_CTRL   (0x64 / 4)
130 #define   FMC_WDT2_CTRL_ALT_BOOT_MODE    BIT(6) /* O: 2 chips 1: 1 chip */
131 #define   FMC_WDT2_CTRL_SINGLE_BOOT_MODE BIT(5)
132 #define   FMC_WDT2_CTRL_BOOT_SOURCE      BIT(4) /* O: primary 1: alternate */
133 #define   FMC_WDT2_CTRL_EN               BIT(0)
134 
135 /* DMA DRAM Side Address High Part (AST2700) */
136 #define R_DMA_DRAM_ADDR_HIGH   (0x7c / 4)
137 
138 /* DMA Control/Status Register */
139 #define R_DMA_CTRL        (0x80 / 4)
140 #define   DMA_CTRL_REQUEST      (1 << 31)
141 #define   DMA_CTRL_GRANT        (1 << 30)
142 #define   DMA_CTRL_DELAY_MASK   0xf
143 #define   DMA_CTRL_DELAY_SHIFT  8
144 #define   DMA_CTRL_FREQ_MASK    0xf
145 #define   DMA_CTRL_FREQ_SHIFT   4
146 #define   DMA_CTRL_CALIB        (1 << 3)
147 #define   DMA_CTRL_CKSUM        (1 << 2)
148 #define   DMA_CTRL_WRITE        (1 << 1)
149 #define   DMA_CTRL_ENABLE       (1 << 0)
150 
151 /* DMA Flash Side Address */
152 #define R_DMA_FLASH_ADDR  (0x84 / 4)
153 
154 /* DMA DRAM Side Address */
155 #define R_DMA_DRAM_ADDR   (0x88 / 4)
156 
157 /* DMA Length Register */
158 #define R_DMA_LEN         (0x8C / 4)
159 
160 /* Checksum Calculation Result */
161 #define R_DMA_CHECKSUM    (0x90 / 4)
162 
163 /* Read Timing Compensation Register */
164 #define R_TIMINGS         (0x94 / 4)
165 
166 /* SPI controller registers and bits (AST2400) */
167 #define R_SPI_CONF        (0x00 / 4)
168 #define   SPI_CONF_ENABLE_W0   0
169 #define R_SPI_CTRL0       (0x4 / 4)
170 #define R_SPI_MISC_CTRL   (0x10 / 4)
171 #define R_SPI_TIMINGS     (0x14 / 4)
172 
173 #define ASPEED_SMC_R_SPI_MAX (0x20 / 4)
174 #define ASPEED_SMC_R_SMC_MAX (0x20 / 4)
175 
176 /*
177  * DMA DRAM addresses should be 4 bytes aligned and the valid address
178  * range is 0x40000000 - 0x5FFFFFFF (AST2400)
179  *          0x80000000 - 0xBFFFFFFF (AST2500)
180  *
181  * DMA flash addresses should be 4 bytes aligned and the valid address
182  * range is 0x20000000 - 0x2FFFFFFF.
183  *
184  * DMA length is from 4 bytes to 32MB (AST2500)
185  *   0: 4 bytes
186  *   0x1FFFFFC: 32M bytes
187  *
188  * DMA length is from 1 byte to 32MB (AST2600, AST10x0 and AST2700)
189  *   0: 1 byte
190  *   0x1FFFFFF: 32M bytes
191  */
192 #define DMA_DRAM_ADDR(asc, val)   ((val) & (asc)->dma_dram_mask)
193 #define DMA_DRAM_ADDR_HIGH(val)   ((val) & 0xf)
194 #define DMA_FLASH_ADDR(asc, val)  ((val) & (asc)->dma_flash_mask)
195 #define DMA_LENGTH(val)         ((val) & 0x01FFFFFF)
196 
197 /* Flash opcodes. */
198 #define SPI_OP_READ       0x03    /* Read data bytes (low frequency) */
199 
200 #define SNOOP_OFF         0xFF
201 #define SNOOP_START       0x0
202 
203 /*
204  * Default segments mapping addresses and size for each peripheral per
205  * controller. These can be changed when board is initialized with the
206  * Segment Address Registers.
207  */
208 static const AspeedSegments aspeed_2500_spi1_segments[];
209 static const AspeedSegments aspeed_2500_spi2_segments[];
210 
211 #define ASPEED_SMC_FEATURE_DMA       0x1
212 #define ASPEED_SMC_FEATURE_DMA_GRANT 0x2
213 #define ASPEED_SMC_FEATURE_WDT_CONTROL 0x4
214 #define ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH 0x08
215 
216 static inline bool aspeed_smc_has_dma(const AspeedSMCClass *asc)
217 {
218     return !!(asc->features & ASPEED_SMC_FEATURE_DMA);
219 }
220 
221 static inline bool aspeed_smc_has_wdt_control(const AspeedSMCClass *asc)
222 {
223     return !!(asc->features & ASPEED_SMC_FEATURE_WDT_CONTROL);
224 }
225 
226 static inline bool aspeed_smc_has_dma64(const AspeedSMCClass *asc)
227 {
228     return !!(asc->features & ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH);
229 }
230 
231 #define aspeed_smc_error(fmt, ...)                                      \
232     qemu_log_mask(LOG_GUEST_ERROR, "%s: " fmt "\n", __func__, ## __VA_ARGS__)
233 
234 static bool aspeed_smc_flash_overlap(const AspeedSMCState *s,
235                                      const AspeedSegments *new,
236                                      int cs)
237 {
238     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
239     AspeedSegments seg;
240     int i;
241 
242     for (i = 0; i < asc->cs_num_max; i++) {
243         if (i == cs) {
244             continue;
245         }
246 
247         asc->reg_to_segment(s, s->regs[R_SEG_ADDR0 + i], &seg);
248 
249         if (new->addr + new->size > seg.addr &&
250             new->addr < seg.addr + seg.size) {
251             aspeed_smc_error("new segment CS%d [ 0x%"
252                              HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with "
253                              "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
254                              cs, new->addr, new->addr + new->size,
255                              i, seg.addr, seg.addr + seg.size);
256             return true;
257         }
258     }
259     return false;
260 }
261 
262 static void aspeed_smc_flash_set_segment_region(AspeedSMCState *s, int cs,
263                                                 uint64_t regval)
264 {
265     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
266     AspeedSMCFlash *fl = &s->flashes[cs];
267     AspeedSegments seg;
268 
269     asc->reg_to_segment(s, regval, &seg);
270 
271     memory_region_transaction_begin();
272     memory_region_set_size(&fl->mmio, seg.size);
273     memory_region_set_address(&fl->mmio, seg.addr - asc->flash_window_base);
274     memory_region_set_enabled(&fl->mmio, !!seg.size);
275     memory_region_transaction_commit();
276 
277     if (asc->segment_addr_mask) {
278         regval &= asc->segment_addr_mask;
279     }
280 
281     s->regs[R_SEG_ADDR0 + cs] = regval;
282 }
283 
284 static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
285                                          uint64_t new)
286 {
287     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
288     AspeedSegments seg;
289 
290     asc->reg_to_segment(s, new, &seg);
291 
292     trace_aspeed_smc_flash_set_segment(cs, new, seg.addr, seg.addr + seg.size);
293 
294     /* The start address of CS0 is read-only */
295     if (cs == 0 && seg.addr != asc->flash_window_base) {
296         aspeed_smc_error("Tried to change CS0 start address to 0x%"
297                          HWADDR_PRIx, seg.addr);
298         seg.addr = asc->flash_window_base;
299         new = asc->segment_to_reg(s, &seg);
300     }
301 
302     /*
303      * The end address of the AST2500 spi controllers is also
304      * read-only.
305      */
306     if ((asc->segments == aspeed_2500_spi1_segments ||
307          asc->segments == aspeed_2500_spi2_segments) &&
308         cs == asc->cs_num_max &&
309         seg.addr + seg.size != asc->segments[cs].addr +
310         asc->segments[cs].size) {
311         aspeed_smc_error("Tried to change CS%d end address to 0x%"
312                          HWADDR_PRIx, cs, seg.addr + seg.size);
313         seg.size = asc->segments[cs].addr + asc->segments[cs].size -
314             seg.addr;
315         new = asc->segment_to_reg(s, &seg);
316     }
317 
318     /* Keep the segment in the overall flash window */
319     if (seg.size &&
320         (seg.addr + seg.size <= asc->flash_window_base ||
321          seg.addr > asc->flash_window_base + asc->flash_window_size)) {
322         aspeed_smc_error("new segment for CS%d is invalid : "
323                          "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
324                          cs, seg.addr, seg.addr + seg.size);
325         return;
326     }
327 
328     /* Check start address vs. alignment */
329     if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) {
330         aspeed_smc_error("new segment for CS%d is not "
331                          "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
332                          cs, seg.addr, seg.addr + seg.size);
333     }
334 
335     /* And segments should not overlap (in the specs) */
336     aspeed_smc_flash_overlap(s, &seg, cs);
337 
338     /* All should be fine now to move the region */
339     aspeed_smc_flash_set_segment_region(s, cs, new);
340 }
341 
342 static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr,
343                                               unsigned size)
344 {
345     aspeed_smc_error("To 0x%" HWADDR_PRIx " of size %u", addr, size);
346     return 0;
347 }
348 
349 static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr,
350                                            uint64_t data, unsigned size)
351 {
352     aspeed_smc_error("To 0x%" HWADDR_PRIx " of size %u: 0x%" PRIx64,
353                      addr, size, data);
354 }
355 
356 static const MemoryRegionOps aspeed_smc_flash_default_ops = {
357     .read = aspeed_smc_flash_default_read,
358     .write = aspeed_smc_flash_default_write,
359     .endianness = DEVICE_LITTLE_ENDIAN,
360     .valid = {
361         .min_access_size = 1,
362         .max_access_size = 4,
363     },
364 };
365 
366 static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl)
367 {
368     const AspeedSMCState *s = fl->controller;
369 
370     return s->regs[s->r_ctrl0 + fl->cs] & CTRL_CMD_MODE_MASK;
371 }
372 
373 static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl)
374 {
375     const AspeedSMCState *s = fl->controller;
376 
377     return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->cs));
378 }
379 
380 static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl)
381 {
382     const AspeedSMCState *s = fl->controller;
383     int cmd = (s->regs[s->r_ctrl0 + fl->cs] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK;
384 
385     /*
386      * In read mode, the default SPI command is READ (0x3). In other
387      * modes, the command should necessarily be defined
388      *
389      * TODO: add support for READ4 (0x13) on AST2600
390      */
391     if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) {
392         cmd = SPI_OP_READ;
393     }
394 
395     if (!cmd) {
396         aspeed_smc_error("no command defined for mode %d",
397                          aspeed_smc_flash_mode(fl));
398     }
399 
400     return cmd;
401 }
402 
403 static inline int aspeed_smc_flash_addr_width(const AspeedSMCFlash *fl)
404 {
405     const AspeedSMCState *s = fl->controller;
406     AspeedSMCClass *asc = fl->asc;
407 
408     if (asc->addr_width) {
409         return asc->addr_width(s);
410     } else {
411         return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->cs)) ? 4 : 3;
412     }
413 }
414 
415 static void aspeed_smc_flash_do_select(AspeedSMCFlash *fl, bool unselect)
416 {
417     AspeedSMCState *s = fl->controller;
418 
419     trace_aspeed_smc_flash_select(fl->cs, unselect ? "un" : "");
420 
421     qemu_set_irq(s->cs_lines[fl->cs], unselect);
422 }
423 
424 static void aspeed_smc_flash_select(AspeedSMCFlash *fl)
425 {
426     aspeed_smc_flash_do_select(fl, false);
427 }
428 
429 static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl)
430 {
431     aspeed_smc_flash_do_select(fl, true);
432 }
433 
434 static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
435                                               uint32_t addr)
436 {
437     const AspeedSMCState *s = fl->controller;
438     AspeedSMCClass *asc = fl->asc;
439     AspeedSegments seg;
440 
441     asc->reg_to_segment(s, s->regs[R_SEG_ADDR0 + fl->cs], &seg);
442     if ((addr % seg.size) != addr) {
443         aspeed_smc_error("invalid address 0x%08x for CS%d segment : "
444                          "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
445                          addr, fl->cs, seg.addr, seg.addr + seg.size);
446         addr %= seg.size;
447     }
448 
449     return addr;
450 }
451 
452 static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl)
453 {
454     const AspeedSMCState *s = fl->controller;
455     uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->cs];
456     uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1;
457     uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3;
458     uint32_t dummies = ((dummy_high << 2) | dummy_low) * 8;
459 
460     if (r_ctrl0 & CTRL_IO_DUAL_ADDR_DATA) {
461         dummies /= 2;
462     }
463 
464     return dummies;
465 }
466 
467 static void aspeed_smc_flash_setup(AspeedSMCFlash *fl, uint32_t addr)
468 {
469     const AspeedSMCState *s = fl->controller;
470     uint8_t cmd = aspeed_smc_flash_cmd(fl);
471     int i = aspeed_smc_flash_addr_width(fl);
472 
473     /* Flash access can not exceed CS segment */
474     addr = aspeed_smc_check_segment_addr(fl, addr);
475 
476     ssi_transfer(s->spi, cmd);
477     while (i--) {
478         if (aspeed_smc_addr_byte_enabled(s, i)) {
479             ssi_transfer(s->spi, (addr >> (i * 8)) & 0xff);
480         }
481     }
482 
483     /*
484      * Use fake transfers to model dummy bytes. The value should
485      * be configured to some non-zero value in fast read mode and
486      * zero in read mode. But, as the HW allows inconsistent
487      * settings, let's check for fast read mode.
488      */
489     if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) {
490         for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) {
491             ssi_transfer(fl->controller->spi, s->regs[R_DUMMY_DATA] & 0xff);
492         }
493     }
494 }
495 
496 static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
497 {
498     AspeedSMCFlash *fl = opaque;
499     AspeedSMCState *s = fl->controller;
500     uint64_t ret = 0;
501     int i;
502 
503     switch (aspeed_smc_flash_mode(fl)) {
504     case CTRL_USERMODE:
505         for (i = 0; i < size; i++) {
506             ret |= (uint64_t) ssi_transfer(s->spi, 0x0) << (8 * i);
507         }
508         break;
509     case CTRL_READMODE:
510     case CTRL_FREADMODE:
511         aspeed_smc_flash_select(fl);
512         aspeed_smc_flash_setup(fl, addr);
513 
514         for (i = 0; i < size; i++) {
515             ret |= (uint64_t) ssi_transfer(s->spi, 0x0) << (8 * i);
516         }
517 
518         aspeed_smc_flash_unselect(fl);
519         break;
520     default:
521         aspeed_smc_error("invalid flash mode %d", aspeed_smc_flash_mode(fl));
522     }
523 
524     trace_aspeed_smc_flash_read(fl->cs, addr, size, ret,
525                                 aspeed_smc_flash_mode(fl));
526     return ret;
527 }
528 
529 /*
530  * TODO (clg@kaod.org): stolen from xilinx_spips.c. Should move to a
531  * common include header.
532  */
533 typedef enum {
534     READ = 0x3,         READ_4 = 0x13,
535     FAST_READ = 0xb,    FAST_READ_4 = 0x0c,
536     DOR = 0x3b,         DOR_4 = 0x3c,
537     QOR = 0x6b,         QOR_4 = 0x6c,
538     DIOR = 0xbb,        DIOR_4 = 0xbc,
539     QIOR = 0xeb,        QIOR_4 = 0xec,
540 
541     PP = 0x2,           PP_4 = 0x12,
542     DPP = 0xa2,
543     QPP = 0x32,         QPP_4 = 0x34,
544 } FlashCMD;
545 
546 static int aspeed_smc_num_dummies(uint8_t command)
547 {
548     switch (command) { /* check for dummies */
549     case READ: /* no dummy bytes/cycles */
550     case PP:
551     case DPP:
552     case QPP:
553     case READ_4:
554     case PP_4:
555     case QPP_4:
556         return 0;
557     case FAST_READ:
558     case DOR:
559     case QOR:
560     case FAST_READ_4:
561     case DOR_4:
562     case QOR_4:
563         return 1;
564     case DIOR:
565     case DIOR_4:
566         return 2;
567     case QIOR:
568     case QIOR_4:
569         return 4;
570     default:
571         return -1;
572     }
573 }
574 
575 static bool aspeed_smc_do_snoop(AspeedSMCFlash *fl,  uint64_t data,
576                                 unsigned size)
577 {
578     AspeedSMCState *s = fl->controller;
579     uint8_t addr_width = aspeed_smc_flash_addr_width(fl);
580 
581     trace_aspeed_smc_do_snoop(fl->cs, s->snoop_index, s->snoop_dummies,
582                               (uint8_t) data & 0xff);
583 
584     if (s->snoop_index == SNOOP_OFF) {
585         return false; /* Do nothing */
586 
587     } else if (s->snoop_index == SNOOP_START) {
588         uint8_t cmd = data & 0xff;
589         int ndummies = aspeed_smc_num_dummies(cmd);
590 
591         /*
592          * No dummy cycles are expected with the current command. Turn
593          * off snooping and let the transfer proceed normally.
594          */
595         if (ndummies <= 0) {
596             s->snoop_index = SNOOP_OFF;
597             return false;
598         }
599 
600         s->snoop_dummies = ndummies * 8;
601 
602     } else if (s->snoop_index >= addr_width + 1) {
603 
604         /* The SPI transfer has reached the dummy cycles sequence */
605         for (; s->snoop_dummies; s->snoop_dummies--) {
606             ssi_transfer(s->spi, s->regs[R_DUMMY_DATA] & 0xff);
607         }
608 
609         /* If no more dummy cycles are expected, turn off snooping */
610         if (!s->snoop_dummies) {
611             s->snoop_index = SNOOP_OFF;
612         } else {
613             s->snoop_index += size;
614         }
615 
616         /*
617          * Dummy cycles have been faked already. Ignore the current
618          * SPI transfer
619          */
620         return true;
621     }
622 
623     s->snoop_index += size;
624     return false;
625 }
626 
627 static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,
628                                    unsigned size)
629 {
630     AspeedSMCFlash *fl = opaque;
631     AspeedSMCState *s = fl->controller;
632     int i;
633 
634     trace_aspeed_smc_flash_write(fl->cs, addr, size, data,
635                                  aspeed_smc_flash_mode(fl));
636 
637     if (!aspeed_smc_is_writable(fl)) {
638         aspeed_smc_error("flash is not writable at 0x%" HWADDR_PRIx, addr);
639         return;
640     }
641 
642     switch (aspeed_smc_flash_mode(fl)) {
643     case CTRL_USERMODE:
644         if (aspeed_smc_do_snoop(fl, data, size)) {
645             break;
646         }
647 
648         for (i = 0; i < size; i++) {
649             ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
650         }
651         break;
652     case CTRL_WRITEMODE:
653         aspeed_smc_flash_select(fl);
654         aspeed_smc_flash_setup(fl, addr);
655 
656         for (i = 0; i < size; i++) {
657             ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
658         }
659 
660         aspeed_smc_flash_unselect(fl);
661         break;
662     default:
663         aspeed_smc_error("invalid flash mode %d", aspeed_smc_flash_mode(fl));
664     }
665 }
666 
667 static const MemoryRegionOps aspeed_smc_flash_ops = {
668     .read = aspeed_smc_flash_read,
669     .write = aspeed_smc_flash_write,
670     .endianness = DEVICE_LITTLE_ENDIAN,
671     .valid = {
672         .min_access_size = 1,
673         .max_access_size = 4,
674     },
675 };
676 
677 static void aspeed_smc_flash_update_ctrl(AspeedSMCFlash *fl, uint32_t value)
678 {
679     AspeedSMCState *s = fl->controller;
680     bool unselect;
681 
682     /* User mode selects the CS, other modes unselect */
683     unselect = (value & CTRL_CMD_MODE_MASK) != CTRL_USERMODE;
684 
685     /* A change of CTRL_CE_STOP_ACTIVE from 0 to 1, unselects the CS */
686     if (!(s->regs[s->r_ctrl0 + fl->cs] & CTRL_CE_STOP_ACTIVE) &&
687         value & CTRL_CE_STOP_ACTIVE) {
688         unselect = true;
689     }
690 
691     s->regs[s->r_ctrl0 + fl->cs] = value;
692 
693     s->snoop_index = unselect ? SNOOP_OFF : SNOOP_START;
694 
695     aspeed_smc_flash_do_select(fl, unselect);
696 }
697 
698 static void aspeed_smc_reset(DeviceState *d)
699 {
700     AspeedSMCState *s = ASPEED_SMC(d);
701     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
702     int i;
703 
704     if (asc->resets) {
705         memcpy(s->regs, asc->resets, sizeof s->regs);
706     } else {
707         memset(s->regs, 0, sizeof s->regs);
708     }
709 
710     for (i = 0; i < asc->cs_num_max; i++) {
711         DeviceState *dev = ssi_get_cs(s->spi, i);
712         if (dev) {
713             Object *o = OBJECT(dev);
714 
715             if (!object_dynamic_cast(o, TYPE_M25P80)) {
716                 warn_report("Aspeed SMC %s.%d : Invalid %s device type",
717                             BUS(s->spi)->name, i, object_get_typename(o));
718                 continue;
719             }
720 
721             qemu_irq cs_line = qdev_get_gpio_in_named(dev, SSI_GPIO_CS, 0);
722             qdev_connect_gpio_out_named(DEVICE(s), "cs", i, cs_line);
723         }
724     }
725 
726     /* Unselect all peripherals */
727     for (i = 0; i < asc->cs_num_max; ++i) {
728         s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE;
729         qemu_set_irq(s->cs_lines[i], true);
730     }
731 
732     /* setup the default segment register values and regions for all */
733     for (i = 0; i < asc->cs_num_max; ++i) {
734         aspeed_smc_flash_set_segment_region(s, i,
735                     asc->segment_to_reg(s, &asc->segments[i]));
736     }
737 
738     s->snoop_index = SNOOP_OFF;
739     s->snoop_dummies = 0;
740 }
741 
742 static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
743 {
744     AspeedSMCState *s = ASPEED_SMC(opaque);
745     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(opaque);
746 
747     addr >>= 2;
748 
749     if (addr == s->r_conf ||
750         (addr >= s->r_timings &&
751          addr < s->r_timings + asc->nregs_timings) ||
752         addr == s->r_ce_ctrl ||
753         addr == R_CE_CMD_CTRL ||
754         addr == R_INTR_CTRL ||
755         addr == R_DUMMY_DATA ||
756         (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_CTRL) ||
757         (aspeed_smc_has_dma(asc) && addr == R_DMA_CTRL) ||
758         (aspeed_smc_has_dma(asc) && addr == R_DMA_FLASH_ADDR) ||
759         (aspeed_smc_has_dma(asc) && addr == R_DMA_DRAM_ADDR) ||
760         (aspeed_smc_has_dma(asc) && aspeed_smc_has_dma64(asc) &&
761          addr == R_DMA_DRAM_ADDR_HIGH) ||
762         (aspeed_smc_has_dma(asc) && addr == R_DMA_LEN) ||
763         (aspeed_smc_has_dma(asc) && addr == R_DMA_CHECKSUM) ||
764         (addr >= R_SEG_ADDR0 &&
765          addr < R_SEG_ADDR0 + asc->cs_num_max) ||
766         (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + asc->cs_num_max)) {
767 
768         trace_aspeed_smc_read(addr << 2, size, s->regs[addr]);
769 
770         return s->regs[addr];
771     } else {
772         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
773                       __func__, addr);
774         return -1;
775     }
776 }
777 
778 static uint8_t aspeed_smc_hclk_divisor(uint8_t hclk_mask)
779 {
780     /* HCLK/1 .. HCLK/16 */
781     const uint8_t hclk_divisors[] = {
782         15, 7, 14, 6, 13, 5, 12, 4, 11, 3, 10, 2, 9, 1, 8, 0
783     };
784     int i;
785 
786     for (i = 0; i < ARRAY_SIZE(hclk_divisors); i++) {
787         if (hclk_mask == hclk_divisors[i]) {
788             return i + 1;
789         }
790     }
791 
792     g_assert_not_reached();
793 }
794 
795 /*
796  * When doing calibration, the SPI clock rate in the CE0 Control
797  * Register and the read delay cycles in the Read Timing Compensation
798  * Register are set using bit[11:4] of the DMA Control Register.
799  */
800 static void aspeed_smc_dma_calibration(AspeedSMCState *s)
801 {
802     uint8_t delay =
803         (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
804     uint8_t hclk_mask =
805         (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
806     uint8_t hclk_div = aspeed_smc_hclk_divisor(hclk_mask);
807     uint32_t hclk_shift = (hclk_div - 1) << 2;
808     uint8_t cs;
809 
810     /*
811      * The Read Timing Compensation Register values apply to all CS on
812      * the SPI bus and only HCLK/1 - HCLK/5 can have tunable delays
813      */
814     if (hclk_div && hclk_div < 6) {
815         s->regs[s->r_timings] &= ~(0xf << hclk_shift);
816         s->regs[s->r_timings] |= delay << hclk_shift;
817     }
818 
819     /*
820      * TODO: compute the CS from the DMA address and the segment
821      * registers. This is not really a problem for now because the
822      * Timing Register values apply to all CS and software uses CS0 to
823      * do calibration.
824      */
825     cs = 0;
826     s->regs[s->r_ctrl0 + cs] &=
827         ~(CE_CTRL_CLOCK_FREQ_MASK << CE_CTRL_CLOCK_FREQ_SHIFT);
828     s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
829 }
830 
831 /*
832  * Emulate read errors in the DMA Checksum Register for high
833  * frequencies and optimistic settings of the Read Timing Compensation
834  * Register. This will help in tuning the SPI timing calibration
835  * algorithm.
836  */
837 static bool aspeed_smc_inject_read_failure(AspeedSMCState *s)
838 {
839     uint8_t delay =
840         (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
841     uint8_t hclk_mask =
842         (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
843 
844     /*
845      * Typical values of a palmetto-bmc machine.
846      */
847     switch (aspeed_smc_hclk_divisor(hclk_mask)) {
848     case 4 ... 16:
849         return false;
850     case 3: /* at least one HCLK cycle delay */
851         return (delay & 0x7) < 1;
852     case 2: /* at least two HCLK cycle delay */
853         return (delay & 0x7) < 2;
854     case 1: /* (> 100MHz) is above the max freq of the controller */
855         return true;
856     default:
857         g_assert_not_reached();
858     }
859 }
860 
861 static uint64_t aspeed_smc_dma_dram_addr(AspeedSMCState *s)
862 {
863     return s->regs[R_DMA_DRAM_ADDR] |
864         ((uint64_t) s->regs[R_DMA_DRAM_ADDR_HIGH] << 32);
865 }
866 
867 static uint32_t aspeed_smc_dma_len(AspeedSMCState *s)
868 {
869     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
870 
871     return QEMU_ALIGN_UP(s->regs[R_DMA_LEN] + asc->dma_start_length, 4);
872 }
873 
874 /*
875  * Accumulate the result of the reads to provide a checksum that will
876  * be used to validate the read timing settings.
877  */
878 static void aspeed_smc_dma_checksum(AspeedSMCState *s)
879 {
880     MemTxResult result;
881     uint32_t dma_len;
882     uint32_t data;
883 
884     if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
885         aspeed_smc_error("invalid direction for DMA checksum");
886         return;
887     }
888 
889     if (s->regs[R_DMA_CTRL] & DMA_CTRL_CALIB) {
890         aspeed_smc_dma_calibration(s);
891     }
892 
893     dma_len = aspeed_smc_dma_len(s);
894 
895     while (dma_len) {
896         data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
897                                     MEMTXATTRS_UNSPECIFIED, &result);
898         if (result != MEMTX_OK) {
899             aspeed_smc_error("Flash read failed @%08x",
900                              s->regs[R_DMA_FLASH_ADDR]);
901             return;
902         }
903         trace_aspeed_smc_dma_checksum(s->regs[R_DMA_FLASH_ADDR], data);
904 
905         /*
906          * When the DMA is on-going, the DMA registers are updated
907          * with the current working addresses and length.
908          */
909         s->regs[R_DMA_CHECKSUM] += data;
910         s->regs[R_DMA_FLASH_ADDR] += 4;
911         dma_len -= 4;
912         s->regs[R_DMA_LEN] = dma_len;
913     }
914 
915     if (s->inject_failure && aspeed_smc_inject_read_failure(s)) {
916         s->regs[R_DMA_CHECKSUM] = 0xbadc0de;
917     }
918 
919 }
920 
921 static void aspeed_smc_dma_rw(AspeedSMCState *s)
922 {
923     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
924     uint64_t dma_dram_offset;
925     uint64_t dma_dram_addr;
926     MemTxResult result;
927     uint32_t dma_len;
928     uint32_t data;
929 
930     dma_len = aspeed_smc_dma_len(s);
931     dma_dram_addr = aspeed_smc_dma_dram_addr(s);
932 
933     if (aspeed_smc_has_dma64(asc)) {
934         dma_dram_offset = dma_dram_addr - s->dram_base;
935     } else {
936         dma_dram_offset = dma_dram_addr;
937     }
938 
939     trace_aspeed_smc_dma_rw(s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE ?
940                             "write" : "read",
941                             s->regs[R_DMA_FLASH_ADDR],
942                             dma_dram_offset,
943                             dma_len);
944     while (dma_len) {
945         if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
946             data = address_space_ldl_le(&s->dram_as, dma_dram_offset,
947                                         MEMTXATTRS_UNSPECIFIED, &result);
948             if (result != MEMTX_OK) {
949                 aspeed_smc_error("DRAM read failed @%" PRIx64,
950                                  dma_dram_offset);
951                 return;
952             }
953 
954             address_space_stl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
955                                  data, MEMTXATTRS_UNSPECIFIED, &result);
956             if (result != MEMTX_OK) {
957                 aspeed_smc_error("Flash write failed @%08x",
958                                  s->regs[R_DMA_FLASH_ADDR]);
959                 return;
960             }
961         } else {
962             data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
963                                         MEMTXATTRS_UNSPECIFIED, &result);
964             if (result != MEMTX_OK) {
965                 aspeed_smc_error("Flash read failed @%08x",
966                                  s->regs[R_DMA_FLASH_ADDR]);
967                 return;
968             }
969 
970             address_space_stl_le(&s->dram_as, dma_dram_offset,
971                                  data, MEMTXATTRS_UNSPECIFIED, &result);
972             if (result != MEMTX_OK) {
973                 aspeed_smc_error("DRAM write failed @%" PRIx64,
974                                  dma_dram_offset);
975                 return;
976             }
977         }
978 
979         /*
980          * When the DMA is on-going, the DMA registers are updated
981          * with the current working addresses and length.
982          */
983         dma_dram_offset += 4;
984         dma_dram_addr += 4;
985 
986         s->regs[R_DMA_DRAM_ADDR_HIGH] = dma_dram_addr >> 32;
987         s->regs[R_DMA_DRAM_ADDR] = dma_dram_addr & 0xffffffff;
988         s->regs[R_DMA_FLASH_ADDR] += 4;
989         dma_len -= 4;
990         s->regs[R_DMA_LEN] = dma_len;
991         s->regs[R_DMA_CHECKSUM] += data;
992     }
993 }
994 
995 static void aspeed_smc_dma_stop(AspeedSMCState *s)
996 {
997     /*
998      * When the DMA is disabled, INTR_CTRL_DMA_STATUS=0 means the
999      * engine is idle
1000      */
1001     s->regs[R_INTR_CTRL] &= ~INTR_CTRL_DMA_STATUS;
1002     s->regs[R_DMA_CHECKSUM] = 0;
1003 
1004     /*
1005      * Lower the DMA irq in any case. The IRQ control register could
1006      * have been cleared before disabling the DMA.
1007      */
1008     qemu_irq_lower(s->irq);
1009 }
1010 
1011 /*
1012  * When INTR_CTRL_DMA_STATUS=1, the DMA has completed and a new DMA
1013  * can start even if the result of the previous was not collected.
1014  */
1015 static bool aspeed_smc_dma_in_progress(AspeedSMCState *s)
1016 {
1017     return s->regs[R_DMA_CTRL] & DMA_CTRL_ENABLE &&
1018         !(s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_STATUS);
1019 }
1020 
1021 static void aspeed_smc_dma_done(AspeedSMCState *s)
1022 {
1023     s->regs[R_INTR_CTRL] |= INTR_CTRL_DMA_STATUS;
1024     if (s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_EN) {
1025         qemu_irq_raise(s->irq);
1026     }
1027 }
1028 
1029 static void aspeed_smc_dma_ctrl(AspeedSMCState *s, uint32_t dma_ctrl)
1030 {
1031     if (!(dma_ctrl & DMA_CTRL_ENABLE)) {
1032         s->regs[R_DMA_CTRL] = dma_ctrl;
1033 
1034         aspeed_smc_dma_stop(s);
1035         return;
1036     }
1037 
1038     if (aspeed_smc_dma_in_progress(s)) {
1039         aspeed_smc_error("DMA in progress !");
1040         return;
1041     }
1042 
1043     s->regs[R_DMA_CTRL] = dma_ctrl;
1044 
1045     if (s->regs[R_DMA_CTRL] & DMA_CTRL_CKSUM) {
1046         aspeed_smc_dma_checksum(s);
1047     } else {
1048         aspeed_smc_dma_rw(s);
1049     }
1050 
1051     aspeed_smc_dma_done(s);
1052 }
1053 
1054 static inline bool aspeed_smc_dma_granted(AspeedSMCState *s)
1055 {
1056     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1057 
1058     if (!(asc->features & ASPEED_SMC_FEATURE_DMA_GRANT)) {
1059         return true;
1060     }
1061 
1062     if (!(s->regs[R_DMA_CTRL] & DMA_CTRL_GRANT)) {
1063         aspeed_smc_error("DMA not granted");
1064         return false;
1065     }
1066 
1067     return true;
1068 }
1069 
1070 static void aspeed_2600_smc_dma_ctrl(AspeedSMCState *s, uint32_t dma_ctrl)
1071 {
1072     /* Preserve DMA bits  */
1073     dma_ctrl |= s->regs[R_DMA_CTRL] & (DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1074 
1075     if (dma_ctrl == 0xAEED0000) {
1076         /* automatically grant request */
1077         s->regs[R_DMA_CTRL] |= (DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1078         return;
1079     }
1080 
1081     /* clear request */
1082     if (dma_ctrl == 0xDEEA0000) {
1083         s->regs[R_DMA_CTRL] &= ~(DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1084         return;
1085     }
1086 
1087     if (!aspeed_smc_dma_granted(s)) {
1088         aspeed_smc_error("DMA not granted");
1089         return;
1090     }
1091 
1092     aspeed_smc_dma_ctrl(s, dma_ctrl);
1093     s->regs[R_DMA_CTRL] &= ~(DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1094 }
1095 
1096 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
1097                              unsigned int size)
1098 {
1099     AspeedSMCState *s = ASPEED_SMC(opaque);
1100     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1101     uint32_t value = data;
1102 
1103     trace_aspeed_smc_write(addr, size, data);
1104 
1105     addr >>= 2;
1106 
1107     if (addr == s->r_conf ||
1108         (addr >= s->r_timings &&
1109          addr < s->r_timings + asc->nregs_timings) ||
1110         addr == s->r_ce_ctrl) {
1111         s->regs[addr] = value;
1112     } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + asc->cs_num_max) {
1113         int cs = addr - s->r_ctrl0;
1114         aspeed_smc_flash_update_ctrl(&s->flashes[cs], value);
1115     } else if (addr >= R_SEG_ADDR0 &&
1116                addr < R_SEG_ADDR0 + asc->cs_num_max) {
1117         int cs = addr - R_SEG_ADDR0;
1118 
1119         if (value != s->regs[R_SEG_ADDR0 + cs]) {
1120             aspeed_smc_flash_set_segment(s, cs, value);
1121         }
1122     } else if (addr == R_CE_CMD_CTRL) {
1123         s->regs[addr] = value & 0xff;
1124     } else if (addr == R_DUMMY_DATA) {
1125         s->regs[addr] = value & 0xff;
1126     } else if (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_CTRL) {
1127         s->regs[addr] = value & FMC_WDT2_CTRL_EN;
1128     } else if (addr == R_INTR_CTRL) {
1129         s->regs[addr] = value;
1130     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_CTRL) {
1131         asc->dma_ctrl(s, value);
1132     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_DRAM_ADDR &&
1133                aspeed_smc_dma_granted(s)) {
1134         s->regs[addr] = DMA_DRAM_ADDR(asc, value);
1135     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_FLASH_ADDR &&
1136                aspeed_smc_dma_granted(s)) {
1137         s->regs[addr] = DMA_FLASH_ADDR(asc, value);
1138     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_LEN &&
1139                aspeed_smc_dma_granted(s)) {
1140         s->regs[addr] = DMA_LENGTH(value);
1141     } else if (aspeed_smc_has_dma(asc) && aspeed_smc_has_dma64(asc) &&
1142                addr == R_DMA_DRAM_ADDR_HIGH) {
1143         s->regs[addr] = DMA_DRAM_ADDR_HIGH(value);
1144     } else {
1145         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
1146                       __func__, addr);
1147         return;
1148     }
1149 }
1150 
1151 static const MemoryRegionOps aspeed_smc_ops = {
1152     .read = aspeed_smc_read,
1153     .write = aspeed_smc_write,
1154     .endianness = DEVICE_LITTLE_ENDIAN,
1155 };
1156 
1157 static void aspeed_smc_instance_init(Object *obj)
1158 {
1159     AspeedSMCState *s = ASPEED_SMC(obj);
1160     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1161     int i;
1162 
1163     for (i = 0; i < asc->cs_num_max; i++) {
1164         object_initialize_child(obj, "flash[*]", &s->flashes[i],
1165                                 TYPE_ASPEED_SMC_FLASH);
1166     }
1167 }
1168 
1169 /*
1170  * Initialize the custom address spaces for DMAs
1171  */
1172 static void aspeed_smc_dma_setup(AspeedSMCState *s, Error **errp)
1173 {
1174     if (!s->dram_mr) {
1175         error_setg(errp, TYPE_ASPEED_SMC ": 'dram' link not set");
1176         return;
1177     }
1178 
1179     address_space_init(&s->flash_as, &s->mmio_flash,
1180                        TYPE_ASPEED_SMC ".dma-flash");
1181     address_space_init(&s->dram_as, s->dram_mr,
1182                        TYPE_ASPEED_SMC ".dma-dram");
1183 }
1184 
1185 static void aspeed_smc_realize(DeviceState *dev, Error **errp)
1186 {
1187     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1188     AspeedSMCState *s = ASPEED_SMC(dev);
1189     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1190     int i;
1191     hwaddr offset = 0;
1192 
1193     /* keep a copy under AspeedSMCState to speed up accesses */
1194     s->r_conf = asc->r_conf;
1195     s->r_ce_ctrl = asc->r_ce_ctrl;
1196     s->r_ctrl0 = asc->r_ctrl0;
1197     s->r_timings = asc->r_timings;
1198     s->conf_enable_w0 = asc->conf_enable_w0;
1199 
1200     /* DMA irq. Keep it first for the initialization in the SoC */
1201     sysbus_init_irq(sbd, &s->irq);
1202 
1203     s->spi = ssi_create_bus(dev, NULL);
1204 
1205     /* Setup cs_lines for peripherals */
1206     s->cs_lines = g_new0(qemu_irq, asc->cs_num_max);
1207     qdev_init_gpio_out_named(DEVICE(s), s->cs_lines, "cs", asc->cs_num_max);
1208 
1209     /* The memory region for the controller registers */
1210     memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s,
1211                           TYPE_ASPEED_SMC, asc->nregs * 4);
1212     sysbus_init_mmio(sbd, &s->mmio);
1213 
1214     /*
1215      * The container memory region representing the address space
1216      * window in which the flash modules are mapped. The size and
1217      * address depends on the SoC model and controller type.
1218      */
1219     memory_region_init(&s->mmio_flash_container, OBJECT(s),
1220                        TYPE_ASPEED_SMC ".container",
1221                        asc->flash_window_size);
1222     sysbus_init_mmio(sbd, &s->mmio_flash_container);
1223 
1224     memory_region_init_io(&s->mmio_flash, OBJECT(s),
1225                           &aspeed_smc_flash_default_ops, s,
1226                           TYPE_ASPEED_SMC ".flash",
1227                           asc->flash_window_size);
1228     memory_region_add_subregion(&s->mmio_flash_container, 0x0,
1229                                 &s->mmio_flash);
1230 
1231     /*
1232      * Let's create a sub memory region for each possible peripheral. All
1233      * have a configurable memory segment in the overall flash mapping
1234      * window of the controller but, there is not necessarily a flash
1235      * module behind to handle the memory accesses. This depends on
1236      * the board configuration.
1237      */
1238     for (i = 0; i < asc->cs_num_max; ++i) {
1239         AspeedSMCFlash *fl = &s->flashes[i];
1240 
1241         if (!object_property_set_link(OBJECT(fl), "controller", OBJECT(s),
1242                                       errp)) {
1243             return;
1244         }
1245         if (!object_property_set_uint(OBJECT(fl), "cs", i, errp)) {
1246             return;
1247         }
1248         if (!sysbus_realize(SYS_BUS_DEVICE(fl), errp)) {
1249             return;
1250         }
1251 
1252         memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio);
1253         offset += asc->segments[i].size;
1254     }
1255 
1256     /* DMA support */
1257     if (aspeed_smc_has_dma(asc)) {
1258         aspeed_smc_dma_setup(s, errp);
1259     }
1260 }
1261 
1262 static const VMStateDescription vmstate_aspeed_smc = {
1263     .name = "aspeed.smc",
1264     .version_id = 2,
1265     .minimum_version_id = 2,
1266     .fields = (const VMStateField[]) {
1267         VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX),
1268         VMSTATE_UINT8(snoop_index, AspeedSMCState),
1269         VMSTATE_UINT8(snoop_dummies, AspeedSMCState),
1270         VMSTATE_END_OF_LIST()
1271     }
1272 };
1273 
1274 static Property aspeed_smc_properties[] = {
1275     DEFINE_PROP_BOOL("inject-failure", AspeedSMCState, inject_failure, false),
1276     DEFINE_PROP_UINT64("dram-base", AspeedSMCState, dram_base, 0),
1277     DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
1278                      TYPE_MEMORY_REGION, MemoryRegion *),
1279     DEFINE_PROP_END_OF_LIST(),
1280 };
1281 
1282 static void aspeed_smc_class_init(ObjectClass *klass, void *data)
1283 {
1284     DeviceClass *dc = DEVICE_CLASS(klass);
1285 
1286     dc->realize = aspeed_smc_realize;
1287     dc->reset = aspeed_smc_reset;
1288     device_class_set_props(dc, aspeed_smc_properties);
1289     dc->vmsd = &vmstate_aspeed_smc;
1290 }
1291 
1292 static const TypeInfo aspeed_smc_info = {
1293     .name           = TYPE_ASPEED_SMC,
1294     .parent         = TYPE_SYS_BUS_DEVICE,
1295     .instance_init  = aspeed_smc_instance_init,
1296     .instance_size  = sizeof(AspeedSMCState),
1297     .class_size     = sizeof(AspeedSMCClass),
1298     .class_init     = aspeed_smc_class_init,
1299     .abstract       = true,
1300 };
1301 
1302 static void aspeed_smc_flash_realize(DeviceState *dev, Error **errp)
1303 {
1304     AspeedSMCFlash *s = ASPEED_SMC_FLASH(dev);
1305     g_autofree char *name = g_strdup_printf(TYPE_ASPEED_SMC_FLASH ".%d", s->cs);
1306 
1307     if (!s->controller) {
1308         error_setg(errp, TYPE_ASPEED_SMC_FLASH ": 'controller' link not set");
1309         return;
1310     }
1311 
1312     s->asc = ASPEED_SMC_GET_CLASS(s->controller);
1313 
1314     /*
1315      * Use the default segment value to size the memory region. This
1316      * can be changed by FW at runtime.
1317      */
1318     memory_region_init_io(&s->mmio, OBJECT(s), s->asc->reg_ops,
1319                           s, name, s->asc->segments[s->cs].size);
1320     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
1321 }
1322 
1323 static Property aspeed_smc_flash_properties[] = {
1324     DEFINE_PROP_UINT8("cs", AspeedSMCFlash, cs, 0),
1325     DEFINE_PROP_LINK("controller", AspeedSMCFlash, controller, TYPE_ASPEED_SMC,
1326                      AspeedSMCState *),
1327     DEFINE_PROP_END_OF_LIST(),
1328 };
1329 
1330 static void aspeed_smc_flash_class_init(ObjectClass *klass, void *data)
1331 {
1332     DeviceClass *dc = DEVICE_CLASS(klass);
1333 
1334     dc->desc = "Aspeed SMC Flash device region";
1335     dc->realize = aspeed_smc_flash_realize;
1336     device_class_set_props(dc, aspeed_smc_flash_properties);
1337 }
1338 
1339 static const TypeInfo aspeed_smc_flash_info = {
1340     .name           = TYPE_ASPEED_SMC_FLASH,
1341     .parent         = TYPE_SYS_BUS_DEVICE,
1342     .instance_size  = sizeof(AspeedSMCFlash),
1343     .class_init     = aspeed_smc_flash_class_init,
1344 };
1345 
1346 /*
1347  * The Segment Registers of the AST2400 and AST2500 have a 8MB
1348  * unit. The address range of a flash SPI peripheral is encoded with
1349  * absolute addresses which should be part of the overall controller
1350  * window.
1351  */
1352 static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s,
1353                                           const AspeedSegments *seg)
1354 {
1355     uint32_t reg = 0;
1356     reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT;
1357     reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT;
1358     return reg;
1359 }
1360 
1361 static void aspeed_smc_reg_to_segment(const AspeedSMCState *s,
1362                                       uint32_t reg, AspeedSegments *seg)
1363 {
1364     seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23;
1365     seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr;
1366 }
1367 
1368 static const AspeedSegments aspeed_2400_smc_segments[] = {
1369     { 0x10000000, 32 * MiB },
1370 };
1371 
1372 static void aspeed_2400_smc_class_init(ObjectClass *klass, void *data)
1373 {
1374     DeviceClass *dc = DEVICE_CLASS(klass);
1375     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1376 
1377     dc->desc               = "Aspeed 2400 SMC Controller";
1378     asc->r_conf            = R_CONF;
1379     asc->r_ce_ctrl         = R_CE_CTRL;
1380     asc->r_ctrl0           = R_CTRL0;
1381     asc->r_timings         = R_TIMINGS;
1382     asc->nregs_timings     = 1;
1383     asc->conf_enable_w0    = CONF_ENABLE_W0;
1384     asc->cs_num_max        = 1;
1385     asc->segments          = aspeed_2400_smc_segments;
1386     asc->flash_window_base = 0x10000000;
1387     asc->flash_window_size = 0x6000000;
1388     asc->features          = 0x0;
1389     asc->nregs             = ASPEED_SMC_R_SMC_MAX;
1390     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1391     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1392     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1393     asc->reg_ops           = &aspeed_smc_flash_ops;
1394 }
1395 
1396 static const TypeInfo aspeed_2400_smc_info = {
1397     .name =  "aspeed.smc-ast2400",
1398     .parent = TYPE_ASPEED_SMC,
1399     .class_init = aspeed_2400_smc_class_init,
1400 };
1401 
1402 static const uint32_t aspeed_2400_fmc_resets[ASPEED_SMC_R_MAX] = {
1403     /*
1404      * CE0 and CE1 types are HW strapped in SCU70. Do it here to
1405      * simplify the model.
1406      */
1407     [R_CONF] = CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0,
1408 };
1409 
1410 static const AspeedSegments aspeed_2400_fmc_segments[] = {
1411     { 0x20000000, 64 * MiB }, /* start address is readonly */
1412     { 0x24000000, 32 * MiB },
1413     { 0x26000000, 32 * MiB },
1414     { 0x28000000, 32 * MiB },
1415     { 0x2A000000, 32 * MiB }
1416 };
1417 
1418 static void aspeed_2400_fmc_class_init(ObjectClass *klass, void *data)
1419 {
1420     DeviceClass *dc = DEVICE_CLASS(klass);
1421     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1422 
1423     dc->desc               = "Aspeed 2400 FMC Controller";
1424     asc->r_conf            = R_CONF;
1425     asc->r_ce_ctrl         = R_CE_CTRL;
1426     asc->r_ctrl0           = R_CTRL0;
1427     asc->r_timings         = R_TIMINGS;
1428     asc->nregs_timings     = 1;
1429     asc->conf_enable_w0    = CONF_ENABLE_W0;
1430     asc->cs_num_max        = 5;
1431     asc->segments          = aspeed_2400_fmc_segments;
1432     asc->segment_addr_mask = 0xffff0000;
1433     asc->resets            = aspeed_2400_fmc_resets;
1434     asc->flash_window_base = 0x20000000;
1435     asc->flash_window_size = 0x10000000;
1436     asc->features          = ASPEED_SMC_FEATURE_DMA;
1437     asc->dma_flash_mask    = 0x0FFFFFFC;
1438     asc->dma_dram_mask     = 0x1FFFFFFC;
1439     asc->dma_start_length  = 4;
1440     asc->nregs             = ASPEED_SMC_R_MAX;
1441     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1442     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1443     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1444     asc->reg_ops           = &aspeed_smc_flash_ops;
1445 }
1446 
1447 static const TypeInfo aspeed_2400_fmc_info = {
1448     .name =  "aspeed.fmc-ast2400",
1449     .parent = TYPE_ASPEED_SMC,
1450     .class_init = aspeed_2400_fmc_class_init,
1451 };
1452 
1453 static const AspeedSegments aspeed_2400_spi1_segments[] = {
1454     { 0x30000000, 64 * MiB },
1455 };
1456 
1457 static int aspeed_2400_spi1_addr_width(const AspeedSMCState *s)
1458 {
1459     return s->regs[R_SPI_CTRL0] & CTRL_AST2400_SPI_4BYTE ? 4 : 3;
1460 }
1461 
1462 static void aspeed_2400_spi1_class_init(ObjectClass *klass, void *data)
1463 {
1464     DeviceClass *dc = DEVICE_CLASS(klass);
1465     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1466 
1467     dc->desc               = "Aspeed 2400 SPI1 Controller";
1468     asc->r_conf            = R_SPI_CONF;
1469     asc->r_ce_ctrl         = 0xff;
1470     asc->r_ctrl0           = R_SPI_CTRL0;
1471     asc->r_timings         = R_SPI_TIMINGS;
1472     asc->nregs_timings     = 1;
1473     asc->conf_enable_w0    = SPI_CONF_ENABLE_W0;
1474     asc->cs_num_max        = 1;
1475     asc->segments          = aspeed_2400_spi1_segments;
1476     asc->flash_window_base = 0x30000000;
1477     asc->flash_window_size = 0x10000000;
1478     asc->features          = 0x0;
1479     asc->nregs             = ASPEED_SMC_R_SPI_MAX;
1480     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1481     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1482     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1483     asc->addr_width        = aspeed_2400_spi1_addr_width;
1484     asc->reg_ops           = &aspeed_smc_flash_ops;
1485 }
1486 
1487 static const TypeInfo aspeed_2400_spi1_info = {
1488     .name =  "aspeed.spi1-ast2400",
1489     .parent = TYPE_ASPEED_SMC,
1490     .class_init = aspeed_2400_spi1_class_init,
1491 };
1492 
1493 static const uint32_t aspeed_2500_fmc_resets[ASPEED_SMC_R_MAX] = {
1494     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1495                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
1496 };
1497 
1498 static const AspeedSegments aspeed_2500_fmc_segments[] = {
1499     { 0x20000000, 128 * MiB }, /* start address is readonly */
1500     { 0x28000000,  32 * MiB },
1501     { 0x2A000000,  32 * MiB },
1502 };
1503 
1504 static void aspeed_2500_fmc_class_init(ObjectClass *klass, void *data)
1505 {
1506     DeviceClass *dc = DEVICE_CLASS(klass);
1507     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1508 
1509     dc->desc               = "Aspeed 2500 FMC Controller";
1510     asc->r_conf            = R_CONF;
1511     asc->r_ce_ctrl         = R_CE_CTRL;
1512     asc->r_ctrl0           = R_CTRL0;
1513     asc->r_timings         = R_TIMINGS;
1514     asc->nregs_timings     = 1;
1515     asc->conf_enable_w0    = CONF_ENABLE_W0;
1516     asc->cs_num_max        = 3;
1517     asc->segments          = aspeed_2500_fmc_segments;
1518     asc->segment_addr_mask = 0xffff0000;
1519     asc->resets            = aspeed_2500_fmc_resets;
1520     asc->flash_window_base = 0x20000000;
1521     asc->flash_window_size = 0x10000000;
1522     asc->features          = ASPEED_SMC_FEATURE_DMA;
1523     asc->dma_flash_mask    = 0x0FFFFFFC;
1524     asc->dma_dram_mask     = 0x3FFFFFFC;
1525     asc->dma_start_length  = 4;
1526     asc->nregs             = ASPEED_SMC_R_MAX;
1527     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1528     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1529     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1530     asc->reg_ops           = &aspeed_smc_flash_ops;
1531 }
1532 
1533 static const TypeInfo aspeed_2500_fmc_info = {
1534     .name =  "aspeed.fmc-ast2500",
1535     .parent = TYPE_ASPEED_SMC,
1536     .class_init = aspeed_2500_fmc_class_init,
1537 };
1538 
1539 static const AspeedSegments aspeed_2500_spi1_segments[] = {
1540     { 0x30000000, 32 * MiB }, /* start address is readonly */
1541     { 0x32000000, 96 * MiB }, /* end address is readonly */
1542 };
1543 
1544 static void aspeed_2500_spi1_class_init(ObjectClass *klass, void *data)
1545 {
1546     DeviceClass *dc = DEVICE_CLASS(klass);
1547     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1548 
1549     dc->desc               = "Aspeed 2500 SPI1 Controller";
1550     asc->r_conf            = R_CONF;
1551     asc->r_ce_ctrl         = R_CE_CTRL;
1552     asc->r_ctrl0           = R_CTRL0;
1553     asc->r_timings         = R_TIMINGS;
1554     asc->nregs_timings     = 1;
1555     asc->conf_enable_w0    = CONF_ENABLE_W0;
1556     asc->cs_num_max        = 2;
1557     asc->segments          = aspeed_2500_spi1_segments;
1558     asc->segment_addr_mask = 0xffff0000;
1559     asc->flash_window_base = 0x30000000;
1560     asc->flash_window_size = 0x8000000;
1561     asc->features          = 0x0;
1562     asc->nregs             = ASPEED_SMC_R_MAX;
1563     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1564     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1565     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1566     asc->reg_ops           = &aspeed_smc_flash_ops;
1567 }
1568 
1569 static const TypeInfo aspeed_2500_spi1_info = {
1570     .name =  "aspeed.spi1-ast2500",
1571     .parent = TYPE_ASPEED_SMC,
1572     .class_init = aspeed_2500_spi1_class_init,
1573 };
1574 
1575 static const AspeedSegments aspeed_2500_spi2_segments[] = {
1576     { 0x38000000, 32 * MiB }, /* start address is readonly */
1577     { 0x3A000000, 96 * MiB }, /* end address is readonly */
1578 };
1579 
1580 static void aspeed_2500_spi2_class_init(ObjectClass *klass, void *data)
1581 {
1582     DeviceClass *dc = DEVICE_CLASS(klass);
1583     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1584 
1585     dc->desc               = "Aspeed 2500 SPI2 Controller";
1586     asc->r_conf            = R_CONF;
1587     asc->r_ce_ctrl         = R_CE_CTRL;
1588     asc->r_ctrl0           = R_CTRL0;
1589     asc->r_timings         = R_TIMINGS;
1590     asc->nregs_timings     = 1;
1591     asc->conf_enable_w0    = CONF_ENABLE_W0;
1592     asc->cs_num_max        = 2;
1593     asc->segments          = aspeed_2500_spi2_segments;
1594     asc->segment_addr_mask = 0xffff0000;
1595     asc->flash_window_base = 0x38000000;
1596     asc->flash_window_size = 0x8000000;
1597     asc->features          = 0x0;
1598     asc->nregs             = ASPEED_SMC_R_MAX;
1599     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1600     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1601     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1602     asc->reg_ops           = &aspeed_smc_flash_ops;
1603 }
1604 
1605 static const TypeInfo aspeed_2500_spi2_info = {
1606     .name =  "aspeed.spi2-ast2500",
1607     .parent = TYPE_ASPEED_SMC,
1608     .class_init = aspeed_2500_spi2_class_init,
1609 };
1610 
1611 /*
1612  * The Segment Registers of the AST2600 have a 1MB unit. The address
1613  * range of a flash SPI peripheral is encoded with offsets in the overall
1614  * controller window. The previous SoC AST2400 and AST2500 used
1615  * absolute addresses. Only bits [27:20] are relevant and the end
1616  * address is an upper bound limit.
1617  */
1618 #define AST2600_SEG_ADDR_MASK 0x0ff00000
1619 
1620 static uint32_t aspeed_2600_smc_segment_to_reg(const AspeedSMCState *s,
1621                                                const AspeedSegments *seg)
1622 {
1623     uint32_t reg = 0;
1624 
1625     /* Disabled segments have a nil register */
1626     if (!seg->size) {
1627         return 0;
1628     }
1629 
1630     reg |= (seg->addr & AST2600_SEG_ADDR_MASK) >> 16; /* start offset */
1631     reg |= (seg->addr + seg->size - 1) & AST2600_SEG_ADDR_MASK; /* end offset */
1632     return reg;
1633 }
1634 
1635 static void aspeed_2600_smc_reg_to_segment(const AspeedSMCState *s,
1636                                            uint32_t reg, AspeedSegments *seg)
1637 {
1638     uint32_t start_offset = (reg << 16) & AST2600_SEG_ADDR_MASK;
1639     uint32_t end_offset = reg & AST2600_SEG_ADDR_MASK;
1640     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1641 
1642     if (reg) {
1643         seg->addr = asc->flash_window_base + start_offset;
1644         seg->size = end_offset + MiB - start_offset;
1645     } else {
1646         seg->addr = asc->flash_window_base;
1647         seg->size = 0;
1648     }
1649 }
1650 
1651 static const uint32_t aspeed_2600_fmc_resets[ASPEED_SMC_R_MAX] = {
1652     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1653                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1 |
1654                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE2),
1655 };
1656 
1657 static const AspeedSegments aspeed_2600_fmc_segments[] = {
1658     { 0x0, 128 * MiB }, /* start address is readonly */
1659     { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
1660     { 0x0, 0 }, /* disabled */
1661 };
1662 
1663 static void aspeed_2600_fmc_class_init(ObjectClass *klass, void *data)
1664 {
1665     DeviceClass *dc = DEVICE_CLASS(klass);
1666     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1667 
1668     dc->desc               = "Aspeed 2600 FMC Controller";
1669     asc->r_conf            = R_CONF;
1670     asc->r_ce_ctrl         = R_CE_CTRL;
1671     asc->r_ctrl0           = R_CTRL0;
1672     asc->r_timings         = R_TIMINGS;
1673     asc->nregs_timings     = 1;
1674     asc->conf_enable_w0    = CONF_ENABLE_W0;
1675     asc->cs_num_max        = 3;
1676     asc->segments          = aspeed_2600_fmc_segments;
1677     asc->segment_addr_mask = 0x0ff00ff0;
1678     asc->resets            = aspeed_2600_fmc_resets;
1679     asc->flash_window_base = 0x20000000;
1680     asc->flash_window_size = 0x10000000;
1681     asc->features          = ASPEED_SMC_FEATURE_DMA |
1682                              ASPEED_SMC_FEATURE_WDT_CONTROL;
1683     asc->dma_flash_mask    = 0x0FFFFFFC;
1684     asc->dma_dram_mask     = 0x3FFFFFFC;
1685     asc->dma_start_length  = 1;
1686     asc->nregs             = ASPEED_SMC_R_MAX;
1687     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1688     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1689     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1690     asc->reg_ops           = &aspeed_smc_flash_ops;
1691 }
1692 
1693 static const TypeInfo aspeed_2600_fmc_info = {
1694     .name =  "aspeed.fmc-ast2600",
1695     .parent = TYPE_ASPEED_SMC,
1696     .class_init = aspeed_2600_fmc_class_init,
1697 };
1698 
1699 static const AspeedSegments aspeed_2600_spi1_segments[] = {
1700     { 0x0, 128 * MiB }, /* start address is readonly */
1701     { 0x0, 0 }, /* disabled */
1702 };
1703 
1704 static void aspeed_2600_spi1_class_init(ObjectClass *klass, void *data)
1705 {
1706     DeviceClass *dc = DEVICE_CLASS(klass);
1707     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1708 
1709     dc->desc               = "Aspeed 2600 SPI1 Controller";
1710     asc->r_conf            = R_CONF;
1711     asc->r_ce_ctrl         = R_CE_CTRL;
1712     asc->r_ctrl0           = R_CTRL0;
1713     asc->r_timings         = R_TIMINGS;
1714     asc->nregs_timings     = 2;
1715     asc->conf_enable_w0    = CONF_ENABLE_W0;
1716     asc->cs_num_max        = 2;
1717     asc->segments          = aspeed_2600_spi1_segments;
1718     asc->segment_addr_mask = 0x0ff00ff0;
1719     asc->flash_window_base = 0x30000000;
1720     asc->flash_window_size = 0x10000000;
1721     asc->features          = ASPEED_SMC_FEATURE_DMA |
1722                              ASPEED_SMC_FEATURE_DMA_GRANT;
1723     asc->dma_flash_mask    = 0x0FFFFFFC;
1724     asc->dma_dram_mask     = 0x3FFFFFFC;
1725     asc->dma_start_length  = 1;
1726     asc->nregs             = ASPEED_SMC_R_MAX;
1727     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1728     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1729     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1730     asc->reg_ops           = &aspeed_smc_flash_ops;
1731 }
1732 
1733 static const TypeInfo aspeed_2600_spi1_info = {
1734     .name =  "aspeed.spi1-ast2600",
1735     .parent = TYPE_ASPEED_SMC,
1736     .class_init = aspeed_2600_spi1_class_init,
1737 };
1738 
1739 static const AspeedSegments aspeed_2600_spi2_segments[] = {
1740     { 0x0, 128 * MiB }, /* start address is readonly */
1741     { 0x0, 0 }, /* disabled */
1742     { 0x0, 0 }, /* disabled */
1743 };
1744 
1745 static void aspeed_2600_spi2_class_init(ObjectClass *klass, void *data)
1746 {
1747     DeviceClass *dc = DEVICE_CLASS(klass);
1748     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1749 
1750     dc->desc               = "Aspeed 2600 SPI2 Controller";
1751     asc->r_conf            = R_CONF;
1752     asc->r_ce_ctrl         = R_CE_CTRL;
1753     asc->r_ctrl0           = R_CTRL0;
1754     asc->r_timings         = R_TIMINGS;
1755     asc->nregs_timings     = 3;
1756     asc->conf_enable_w0    = CONF_ENABLE_W0;
1757     asc->cs_num_max        = 3;
1758     asc->segments          = aspeed_2600_spi2_segments;
1759     asc->segment_addr_mask = 0x0ff00ff0;
1760     asc->flash_window_base = 0x50000000;
1761     asc->flash_window_size = 0x10000000;
1762     asc->features          = ASPEED_SMC_FEATURE_DMA |
1763                              ASPEED_SMC_FEATURE_DMA_GRANT;
1764     asc->dma_flash_mask    = 0x0FFFFFFC;
1765     asc->dma_dram_mask     = 0x3FFFFFFC;
1766     asc->dma_start_length  = 1;
1767     asc->nregs             = ASPEED_SMC_R_MAX;
1768     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1769     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1770     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1771     asc->reg_ops           = &aspeed_smc_flash_ops;
1772 }
1773 
1774 static const TypeInfo aspeed_2600_spi2_info = {
1775     .name =  "aspeed.spi2-ast2600",
1776     .parent = TYPE_ASPEED_SMC,
1777     .class_init = aspeed_2600_spi2_class_init,
1778 };
1779 
1780 /*
1781  * The FMC Segment Registers of the AST1030 have a 512KB unit.
1782  * Only bits [27:19] are used for decoding.
1783  */
1784 #define AST1030_SEG_ADDR_MASK 0x0ff80000
1785 
1786 static uint32_t aspeed_1030_smc_segment_to_reg(const AspeedSMCState *s,
1787         const AspeedSegments *seg)
1788 {
1789     uint32_t reg = 0;
1790 
1791     /* Disabled segments have a nil register */
1792     if (!seg->size) {
1793         return 0;
1794     }
1795 
1796     reg |= (seg->addr & AST1030_SEG_ADDR_MASK) >> 16; /* start offset */
1797     reg |= (seg->addr + seg->size - 1) & AST1030_SEG_ADDR_MASK; /* end offset */
1798     return reg;
1799 }
1800 
1801 static void aspeed_1030_smc_reg_to_segment(const AspeedSMCState *s,
1802         uint32_t reg, AspeedSegments *seg)
1803 {
1804     uint32_t start_offset = (reg << 16) & AST1030_SEG_ADDR_MASK;
1805     uint32_t end_offset = reg & AST1030_SEG_ADDR_MASK;
1806     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1807 
1808     if (reg) {
1809         seg->addr = asc->flash_window_base + start_offset;
1810         seg->size = end_offset + (512 * KiB) - start_offset;
1811     } else {
1812         seg->addr = asc->flash_window_base;
1813         seg->size = 0;
1814     }
1815 }
1816 
1817 static const uint32_t aspeed_1030_fmc_resets[ASPEED_SMC_R_MAX] = {
1818     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1819                             CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
1820 };
1821 
1822 static const AspeedSegments aspeed_1030_fmc_segments[] = {
1823     { 0x0, 128 * MiB }, /* start address is readonly */
1824     { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
1825     { 0x0, 0 }, /* disabled */
1826 };
1827 
1828 static void aspeed_1030_fmc_class_init(ObjectClass *klass, void *data)
1829 {
1830     DeviceClass *dc = DEVICE_CLASS(klass);
1831     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1832 
1833     dc->desc               = "Aspeed 1030 FMC Controller";
1834     asc->r_conf            = R_CONF;
1835     asc->r_ce_ctrl         = R_CE_CTRL;
1836     asc->r_ctrl0           = R_CTRL0;
1837     asc->r_timings         = R_TIMINGS;
1838     asc->nregs_timings     = 2;
1839     asc->conf_enable_w0    = CONF_ENABLE_W0;
1840     asc->cs_num_max        = 2;
1841     asc->segments          = aspeed_1030_fmc_segments;
1842     asc->segment_addr_mask = 0x0ff80ff8;
1843     asc->resets            = aspeed_1030_fmc_resets;
1844     asc->flash_window_base = 0x80000000;
1845     asc->flash_window_size = 0x10000000;
1846     asc->features          = ASPEED_SMC_FEATURE_DMA;
1847     asc->dma_flash_mask    = 0x0FFFFFFC;
1848     asc->dma_dram_mask     = 0x000BFFFC;
1849     asc->dma_start_length  = 1;
1850     asc->nregs             = ASPEED_SMC_R_MAX;
1851     asc->segment_to_reg    = aspeed_1030_smc_segment_to_reg;
1852     asc->reg_to_segment    = aspeed_1030_smc_reg_to_segment;
1853     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1854     asc->reg_ops           = &aspeed_smc_flash_ops;
1855 }
1856 
1857 static const TypeInfo aspeed_1030_fmc_info = {
1858     .name =  "aspeed.fmc-ast1030",
1859     .parent = TYPE_ASPEED_SMC,
1860     .class_init = aspeed_1030_fmc_class_init,
1861 };
1862 
1863 static const AspeedSegments aspeed_1030_spi1_segments[] = {
1864     { 0x0, 128 * MiB }, /* start address is readonly */
1865     { 0x0, 0 }, /* disabled */
1866 };
1867 
1868 static void aspeed_1030_spi1_class_init(ObjectClass *klass, void *data)
1869 {
1870     DeviceClass *dc = DEVICE_CLASS(klass);
1871     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1872 
1873     dc->desc               = "Aspeed 1030 SPI1 Controller";
1874     asc->r_conf            = R_CONF;
1875     asc->r_ce_ctrl         = R_CE_CTRL;
1876     asc->r_ctrl0           = R_CTRL0;
1877     asc->r_timings         = R_TIMINGS;
1878     asc->nregs_timings     = 2;
1879     asc->conf_enable_w0    = CONF_ENABLE_W0;
1880     asc->cs_num_max        = 2;
1881     asc->segments          = aspeed_1030_spi1_segments;
1882     asc->segment_addr_mask = 0x0ff00ff0;
1883     asc->flash_window_base = 0x90000000;
1884     asc->flash_window_size = 0x10000000;
1885     asc->features          = ASPEED_SMC_FEATURE_DMA;
1886     asc->dma_flash_mask    = 0x0FFFFFFC;
1887     asc->dma_dram_mask     = 0x000BFFFC;
1888     asc->dma_start_length  = 1;
1889     asc->nregs             = ASPEED_SMC_R_MAX;
1890     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1891     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1892     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1893     asc->reg_ops           = &aspeed_smc_flash_ops;
1894 }
1895 
1896 static const TypeInfo aspeed_1030_spi1_info = {
1897     .name =  "aspeed.spi1-ast1030",
1898     .parent = TYPE_ASPEED_SMC,
1899     .class_init = aspeed_1030_spi1_class_init,
1900 };
1901 static const AspeedSegments aspeed_1030_spi2_segments[] = {
1902     { 0x0, 128 * MiB }, /* start address is readonly */
1903     { 0x0, 0 }, /* disabled */
1904 };
1905 
1906 static void aspeed_1030_spi2_class_init(ObjectClass *klass, void *data)
1907 {
1908     DeviceClass *dc = DEVICE_CLASS(klass);
1909     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1910 
1911     dc->desc               = "Aspeed 1030 SPI2 Controller";
1912     asc->r_conf            = R_CONF;
1913     asc->r_ce_ctrl         = R_CE_CTRL;
1914     asc->r_ctrl0           = R_CTRL0;
1915     asc->r_timings         = R_TIMINGS;
1916     asc->nregs_timings     = 2;
1917     asc->conf_enable_w0    = CONF_ENABLE_W0;
1918     asc->cs_num_max        = 2;
1919     asc->segments          = aspeed_1030_spi2_segments;
1920     asc->segment_addr_mask = 0x0ff00ff0;
1921     asc->flash_window_base = 0xb0000000;
1922     asc->flash_window_size = 0x10000000;
1923     asc->features          = ASPEED_SMC_FEATURE_DMA;
1924     asc->dma_flash_mask    = 0x0FFFFFFC;
1925     asc->dma_dram_mask     = 0x000BFFFC;
1926     asc->dma_start_length  = 1;
1927     asc->nregs             = ASPEED_SMC_R_MAX;
1928     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1929     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1930     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1931     asc->reg_ops           = &aspeed_smc_flash_ops;
1932 }
1933 
1934 static const TypeInfo aspeed_1030_spi2_info = {
1935     .name =  "aspeed.spi2-ast1030",
1936     .parent = TYPE_ASPEED_SMC,
1937     .class_init = aspeed_1030_spi2_class_init,
1938 };
1939 
1940 /*
1941  * The FMC Segment Registers of the AST2700 have a 64KB unit.
1942  * Only bits [31:16] are used for decoding.
1943  */
1944 #define AST2700_SEG_ADDR_MASK 0xffff0000
1945 
1946 static uint32_t aspeed_2700_smc_segment_to_reg(const AspeedSMCState *s,
1947                                                const AspeedSegments *seg)
1948 {
1949     uint32_t reg = 0;
1950 
1951     /* Disabled segments have a nil register */
1952     if (!seg->size) {
1953         return 0;
1954     }
1955 
1956     reg |= (seg->addr & AST2700_SEG_ADDR_MASK) >> 16; /* start offset */
1957     reg |= (seg->addr + seg->size - 1) & AST2700_SEG_ADDR_MASK; /* end offset */
1958     return reg;
1959 }
1960 
1961 static void aspeed_2700_smc_reg_to_segment(const AspeedSMCState *s,
1962                                            uint32_t reg, AspeedSegments *seg)
1963 {
1964     uint32_t start_offset = (reg << 16) & AST2700_SEG_ADDR_MASK;
1965     uint32_t end_offset = reg & AST2700_SEG_ADDR_MASK;
1966     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1967 
1968     if (reg) {
1969         seg->addr = asc->flash_window_base + start_offset;
1970         seg->size = end_offset + (64 * KiB) - start_offset;
1971     } else {
1972         seg->addr = asc->flash_window_base;
1973         seg->size = 0;
1974     }
1975 }
1976 
1977 static const uint32_t aspeed_2700_fmc_resets[ASPEED_SMC_R_MAX] = {
1978     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1979             CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
1980     [R_CE_CTRL] = 0x0000aa00,
1981     [R_CTRL0] = 0x406b0641,
1982     [R_CTRL1] = 0x00000400,
1983     [R_CTRL2] = 0x00000400,
1984     [R_CTRL3] = 0x00000400,
1985     [R_SEG_ADDR0] = 0x08000000,
1986     [R_SEG_ADDR1] = 0x10000800,
1987     [R_SEG_ADDR2] = 0x00000000,
1988     [R_SEG_ADDR3] = 0x00000000,
1989     [R_DUMMY_DATA] = 0x00010000,
1990     [R_DMA_DRAM_ADDR_HIGH] = 0x00000000,
1991     [R_TIMINGS] = 0x007b0000,
1992 };
1993 
1994 static const MemoryRegionOps aspeed_2700_smc_flash_ops = {
1995     .read = aspeed_smc_flash_read,
1996     .write = aspeed_smc_flash_write,
1997     .endianness = DEVICE_LITTLE_ENDIAN,
1998     .valid = {
1999         .min_access_size = 1,
2000         .max_access_size = 8,
2001     },
2002 };
2003 
2004 static const AspeedSegments aspeed_2700_fmc_segments[] = {
2005     { 0x0, 128 * MiB }, /* start address is readonly */
2006     { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
2007     { 256 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
2008     { 0x0, 0 }, /* disabled */
2009 };
2010 
2011 static void aspeed_2700_fmc_class_init(ObjectClass *klass, void *data)
2012 {
2013     DeviceClass *dc = DEVICE_CLASS(klass);
2014     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2015 
2016     dc->desc               = "Aspeed 2700 FMC Controller";
2017     asc->r_conf            = R_CONF;
2018     asc->r_ce_ctrl         = R_CE_CTRL;
2019     asc->r_ctrl0           = R_CTRL0;
2020     asc->r_timings         = R_TIMINGS;
2021     asc->nregs_timings     = 3;
2022     asc->conf_enable_w0    = CONF_ENABLE_W0;
2023     asc->cs_num_max        = 3;
2024     asc->segments          = aspeed_2700_fmc_segments;
2025     asc->segment_addr_mask = 0xffffffff;
2026     asc->resets            = aspeed_2700_fmc_resets;
2027     asc->flash_window_base = 0x100000000;
2028     asc->flash_window_size = 1 * GiB;
2029     asc->features          = ASPEED_SMC_FEATURE_DMA |
2030                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2031     asc->dma_flash_mask    = 0x2FFFFFFC;
2032     asc->dma_dram_mask     = 0xFFFFFFFC;
2033     asc->dma_start_length  = 1;
2034     asc->nregs             = ASPEED_SMC_R_MAX;
2035     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2036     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2037     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2038     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2039 }
2040 
2041 static const TypeInfo aspeed_2700_fmc_info = {
2042     .name =  "aspeed.fmc-ast2700",
2043     .parent = TYPE_ASPEED_SMC,
2044     .class_init = aspeed_2700_fmc_class_init,
2045 };
2046 
2047 static const AspeedSegments aspeed_2700_spi0_segments[] = {
2048     { 0x0, 128 * MiB }, /* start address is readonly */
2049     { 128 * MiB, 128 * MiB }, /* start address is readonly */
2050     { 0x0, 0 }, /* disabled */
2051 };
2052 
2053 static void aspeed_2700_spi0_class_init(ObjectClass *klass, void *data)
2054 {
2055     DeviceClass *dc = DEVICE_CLASS(klass);
2056     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2057 
2058     dc->desc               = "Aspeed 2700 SPI0 Controller";
2059     asc->r_conf            = R_CONF;
2060     asc->r_ce_ctrl         = R_CE_CTRL;
2061     asc->r_ctrl0           = R_CTRL0;
2062     asc->r_timings         = R_TIMINGS;
2063     asc->nregs_timings     = 2;
2064     asc->conf_enable_w0    = CONF_ENABLE_W0;
2065     asc->cs_num_max        = 2;
2066     asc->segments          = aspeed_2700_spi0_segments;
2067     asc->segment_addr_mask = 0xffffffff;
2068     asc->flash_window_base = 0x180000000;
2069     asc->flash_window_size = 1 * GiB;
2070     asc->features          = ASPEED_SMC_FEATURE_DMA |
2071                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2072     asc->dma_flash_mask    = 0x2FFFFFFC;
2073     asc->dma_dram_mask     = 0xFFFFFFFC;
2074     asc->dma_start_length  = 1;
2075     asc->nregs             = ASPEED_SMC_R_MAX;
2076     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2077     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2078     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2079     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2080 }
2081 
2082 static const TypeInfo aspeed_2700_spi0_info = {
2083     .name =  "aspeed.spi0-ast2700",
2084     .parent = TYPE_ASPEED_SMC,
2085     .class_init = aspeed_2700_spi0_class_init,
2086 };
2087 
2088 static const AspeedSegments aspeed_2700_spi1_segments[] = {
2089     { 0x0, 128 * MiB }, /* start address is readonly */
2090     { 0x0, 0 }, /* disabled */
2091 };
2092 
2093 static void aspeed_2700_spi1_class_init(ObjectClass *klass, void *data)
2094 {
2095     DeviceClass *dc = DEVICE_CLASS(klass);
2096     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2097 
2098     dc->desc               = "Aspeed 2700 SPI1 Controller";
2099     asc->r_conf            = R_CONF;
2100     asc->r_ce_ctrl         = R_CE_CTRL;
2101     asc->r_ctrl0           = R_CTRL0;
2102     asc->r_timings         = R_TIMINGS;
2103     asc->nregs_timings     = 2;
2104     asc->conf_enable_w0    = CONF_ENABLE_W0;
2105     asc->cs_num_max        = 2;
2106     asc->segments          = aspeed_2700_spi1_segments;
2107     asc->segment_addr_mask = 0xffffffff;
2108     asc->flash_window_base = 0x200000000;
2109     asc->flash_window_size = 1 * GiB;
2110     asc->features          = ASPEED_SMC_FEATURE_DMA |
2111                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2112     asc->dma_flash_mask    = 0x2FFFFFFC;
2113     asc->dma_dram_mask     = 0xFFFFFFFC;
2114     asc->dma_start_length  = 1;
2115     asc->nregs             = ASPEED_SMC_R_MAX;
2116     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2117     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2118     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2119     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2120 }
2121 
2122 static const TypeInfo aspeed_2700_spi1_info = {
2123         .name =  "aspeed.spi1-ast2700",
2124         .parent = TYPE_ASPEED_SMC,
2125         .class_init = aspeed_2700_spi1_class_init,
2126 };
2127 
2128 static const AspeedSegments aspeed_2700_spi2_segments[] = {
2129     { 0x0, 128 * MiB }, /* start address is readonly */
2130     { 0x0, 0 }, /* disabled */
2131 };
2132 
2133 static void aspeed_2700_spi2_class_init(ObjectClass *klass, void *data)
2134 {
2135     DeviceClass *dc = DEVICE_CLASS(klass);
2136     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2137 
2138     dc->desc               = "Aspeed 2700 SPI2 Controller";
2139     asc->r_conf            = R_CONF;
2140     asc->r_ce_ctrl         = R_CE_CTRL;
2141     asc->r_ctrl0           = R_CTRL0;
2142     asc->r_timings         = R_TIMINGS;
2143     asc->nregs_timings     = 2;
2144     asc->conf_enable_w0    = CONF_ENABLE_W0;
2145     asc->cs_num_max        = 2;
2146     asc->segments          = aspeed_2700_spi2_segments;
2147     asc->segment_addr_mask = 0xffffffff;
2148     asc->flash_window_base = 0x280000000;
2149     asc->flash_window_size = 1 * GiB;
2150     asc->features          = ASPEED_SMC_FEATURE_DMA |
2151                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2152     asc->dma_flash_mask    = 0x0FFFFFFC;
2153     asc->dma_dram_mask     = 0xFFFFFFFC;
2154     asc->dma_start_length  = 1;
2155     asc->nregs             = ASPEED_SMC_R_MAX;
2156     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2157     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2158     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2159     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2160 }
2161 
2162 static const TypeInfo aspeed_2700_spi2_info = {
2163         .name =  "aspeed.spi2-ast2700",
2164         .parent = TYPE_ASPEED_SMC,
2165         .class_init = aspeed_2700_spi2_class_init,
2166 };
2167 
2168 static void aspeed_smc_register_types(void)
2169 {
2170     type_register_static(&aspeed_smc_flash_info);
2171     type_register_static(&aspeed_smc_info);
2172     type_register_static(&aspeed_2400_smc_info);
2173     type_register_static(&aspeed_2400_fmc_info);
2174     type_register_static(&aspeed_2400_spi1_info);
2175     type_register_static(&aspeed_2500_fmc_info);
2176     type_register_static(&aspeed_2500_spi1_info);
2177     type_register_static(&aspeed_2500_spi2_info);
2178     type_register_static(&aspeed_2600_fmc_info);
2179     type_register_static(&aspeed_2600_spi1_info);
2180     type_register_static(&aspeed_2600_spi2_info);
2181     type_register_static(&aspeed_1030_fmc_info);
2182     type_register_static(&aspeed_1030_spi1_info);
2183     type_register_static(&aspeed_1030_spi2_info);
2184     type_register_static(&aspeed_2700_fmc_info);
2185     type_register_static(&aspeed_2700_spi0_info);
2186     type_register_static(&aspeed_2700_spi1_info);
2187     type_register_static(&aspeed_2700_spi2_info);
2188 }
2189 
2190 type_init(aspeed_smc_register_types)
2191