xref: /openbmc/qemu/hw/ssi/aspeed_smc.c (revision 215caca6)
1 /*
2  * ASPEED AST2400 SMC Controller (SPI Flash Only)
3  *
4  * Copyright (C) 2016 IBM Corp.
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "hw/sysbus.h"
27 #include "migration/vmstate.h"
28 #include "qemu/log.h"
29 #include "qemu/module.h"
30 #include "qemu/error-report.h"
31 #include "qapi/error.h"
32 #include "qemu/units.h"
33 #include "trace.h"
34 
35 #include "hw/irq.h"
36 #include "hw/qdev-properties.h"
37 #include "hw/ssi/aspeed_smc.h"
38 
39 /* CE Type Setting Register */
40 #define R_CONF            (0x00 / 4)
41 #define   CONF_LEGACY_DISABLE  (1 << 31)
42 #define   CONF_ENABLE_W4       20
43 #define   CONF_ENABLE_W3       19
44 #define   CONF_ENABLE_W2       18
45 #define   CONF_ENABLE_W1       17
46 #define   CONF_ENABLE_W0       16
47 #define   CONF_FLASH_TYPE4     8
48 #define   CONF_FLASH_TYPE3     6
49 #define   CONF_FLASH_TYPE2     4
50 #define   CONF_FLASH_TYPE1     2
51 #define   CONF_FLASH_TYPE0     0
52 #define      CONF_FLASH_TYPE_NOR   0x0
53 #define      CONF_FLASH_TYPE_NAND  0x1
54 #define      CONF_FLASH_TYPE_SPI   0x2 /* AST2600 is SPI only */
55 
56 /* CE Control Register */
57 #define R_CE_CTRL            (0x04 / 4)
58 #define   CTRL_EXTENDED4       4  /* 32 bit addressing for SPI */
59 #define   CTRL_EXTENDED3       3  /* 32 bit addressing for SPI */
60 #define   CTRL_EXTENDED2       2  /* 32 bit addressing for SPI */
61 #define   CTRL_EXTENDED1       1  /* 32 bit addressing for SPI */
62 #define   CTRL_EXTENDED0       0  /* 32 bit addressing for SPI */
63 
64 /* Interrupt Control and Status Register */
65 #define R_INTR_CTRL       (0x08 / 4)
66 #define   INTR_CTRL_DMA_STATUS            (1 << 11)
67 #define   INTR_CTRL_CMD_ABORT_STATUS      (1 << 10)
68 #define   INTR_CTRL_WRITE_PROTECT_STATUS  (1 << 9)
69 #define   INTR_CTRL_DMA_EN                (1 << 3)
70 #define   INTR_CTRL_CMD_ABORT_EN          (1 << 2)
71 #define   INTR_CTRL_WRITE_PROTECT_EN      (1 << 1)
72 
73 /* Command Control Register */
74 #define R_CE_CMD_CTRL      (0x0C / 4)
75 #define   CTRL_ADDR_BYTE0_DISABLE_SHIFT       4
76 #define   CTRL_DATA_BYTE0_DISABLE_SHIFT       0
77 
78 #define aspeed_smc_addr_byte_enabled(s, i)                               \
79     (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_ADDR_BYTE0_DISABLE_SHIFT + (i)))))
80 #define aspeed_smc_data_byte_enabled(s, i)                               \
81     (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_DATA_BYTE0_DISABLE_SHIFT + (i)))))
82 
83 /* CEx Control Register */
84 #define R_CTRL0           (0x10 / 4)
85 #define   CTRL_IO_QPI              (1 << 31)
86 #define   CTRL_IO_QUAD_DATA        (1 << 30)
87 #define   CTRL_IO_DUAL_DATA        (1 << 29)
88 #define   CTRL_IO_DUAL_ADDR_DATA   (1 << 28) /* Includes dummies */
89 #define   CTRL_IO_QUAD_ADDR_DATA   (1 << 28) /* Includes dummies */
90 #define   CTRL_CMD_SHIFT           16
91 #define   CTRL_CMD_MASK            0xff
92 #define   CTRL_DUMMY_HIGH_SHIFT    14
93 #define   CTRL_AST2400_SPI_4BYTE   (1 << 13)
94 #define CE_CTRL_CLOCK_FREQ_SHIFT   8
95 #define CE_CTRL_CLOCK_FREQ_MASK    0xf
96 #define CE_CTRL_CLOCK_FREQ(div)                                         \
97     (((div) & CE_CTRL_CLOCK_FREQ_MASK) << CE_CTRL_CLOCK_FREQ_SHIFT)
98 #define   CTRL_DUMMY_LOW_SHIFT     6 /* 2 bits [7:6] */
99 #define   CTRL_CE_STOP_ACTIVE      (1 << 2)
100 #define   CTRL_CMD_MODE_MASK       0x3
101 #define     CTRL_READMODE          0x0
102 #define     CTRL_FREADMODE         0x1
103 #define     CTRL_WRITEMODE         0x2
104 #define     CTRL_USERMODE          0x3
105 #define R_CTRL1           (0x14 / 4)
106 #define R_CTRL2           (0x18 / 4)
107 #define R_CTRL3           (0x1C / 4)
108 #define R_CTRL4           (0x20 / 4)
109 
110 /* CEx Segment Address Register */
111 #define R_SEG_ADDR0       (0x30 / 4)
112 #define   SEG_END_SHIFT        24   /* 8MB units */
113 #define   SEG_END_MASK         0xff
114 #define   SEG_START_SHIFT      16   /* address bit [A29-A23] */
115 #define   SEG_START_MASK       0xff
116 #define R_SEG_ADDR1       (0x34 / 4)
117 #define R_SEG_ADDR2       (0x38 / 4)
118 #define R_SEG_ADDR3       (0x3C / 4)
119 #define R_SEG_ADDR4       (0x40 / 4)
120 
121 /* Misc Control Register #1 */
122 #define R_MISC_CTRL1      (0x50 / 4)
123 
124 /* SPI dummy cycle data */
125 #define R_DUMMY_DATA      (0x54 / 4)
126 
127 /* FMC_WDT2 Control/Status Register for Alternate Boot (AST2600) */
128 #define R_FMC_WDT2_CTRL   (0x64 / 4)
129 #define   FMC_WDT2_CTRL_ALT_BOOT_MODE    BIT(6) /* O: 2 chips 1: 1 chip */
130 #define   FMC_WDT2_CTRL_SINGLE_BOOT_MODE BIT(5)
131 #define   FMC_WDT2_CTRL_BOOT_SOURCE      BIT(4) /* O: primary 1: alternate */
132 #define   FMC_WDT2_CTRL_EN               BIT(0)
133 
134 /* DMA Control/Status Register */
135 #define R_DMA_CTRL        (0x80 / 4)
136 #define   DMA_CTRL_REQUEST      (1 << 31)
137 #define   DMA_CTRL_GRANT        (1 << 30)
138 #define   DMA_CTRL_DELAY_MASK   0xf
139 #define   DMA_CTRL_DELAY_SHIFT  8
140 #define   DMA_CTRL_FREQ_MASK    0xf
141 #define   DMA_CTRL_FREQ_SHIFT   4
142 #define   DMA_CTRL_CALIB        (1 << 3)
143 #define   DMA_CTRL_CKSUM        (1 << 2)
144 #define   DMA_CTRL_WRITE        (1 << 1)
145 #define   DMA_CTRL_ENABLE       (1 << 0)
146 
147 /* DMA Flash Side Address */
148 #define R_DMA_FLASH_ADDR  (0x84 / 4)
149 
150 /* DMA DRAM Side Address */
151 #define R_DMA_DRAM_ADDR   (0x88 / 4)
152 
153 /* DMA Length Register */
154 #define R_DMA_LEN         (0x8C / 4)
155 
156 /* Checksum Calculation Result */
157 #define R_DMA_CHECKSUM    (0x90 / 4)
158 
159 /* Read Timing Compensation Register */
160 #define R_TIMINGS         (0x94 / 4)
161 
162 /* SPI controller registers and bits (AST2400) */
163 #define R_SPI_CONF        (0x00 / 4)
164 #define   SPI_CONF_ENABLE_W0   0
165 #define R_SPI_CTRL0       (0x4 / 4)
166 #define R_SPI_MISC_CTRL   (0x10 / 4)
167 #define R_SPI_TIMINGS     (0x14 / 4)
168 
169 #define ASPEED_SMC_R_SPI_MAX (0x20 / 4)
170 #define ASPEED_SMC_R_SMC_MAX (0x20 / 4)
171 
172 /*
173  * DMA DRAM addresses should be 4 bytes aligned and the valid address
174  * range is 0x40000000 - 0x5FFFFFFF (AST2400)
175  *          0x80000000 - 0xBFFFFFFF (AST2500)
176  *
177  * DMA flash addresses should be 4 bytes aligned and the valid address
178  * range is 0x20000000 - 0x2FFFFFFF.
179  *
180  * DMA length is from 4 bytes to 32MB
181  *   0: 4 bytes
182  *   0x7FFFFF: 32M bytes
183  */
184 #define DMA_DRAM_ADDR(asc, val)   ((val) & (asc)->dma_dram_mask)
185 #define DMA_FLASH_ADDR(asc, val)  ((val) & (asc)->dma_flash_mask)
186 #define DMA_LENGTH(val)         ((val) & 0x01FFFFFC)
187 
188 /* Flash opcodes. */
189 #define SPI_OP_READ       0x03    /* Read data bytes (low frequency) */
190 
191 #define SNOOP_OFF         0xFF
192 #define SNOOP_START       0x0
193 
194 /*
195  * Default segments mapping addresses and size for each peripheral per
196  * controller. These can be changed when board is initialized with the
197  * Segment Address Registers.
198  */
199 static const AspeedSegments aspeed_2500_spi1_segments[];
200 static const AspeedSegments aspeed_2500_spi2_segments[];
201 
202 #define ASPEED_SMC_FEATURE_DMA       0x1
203 #define ASPEED_SMC_FEATURE_DMA_GRANT 0x2
204 #define ASPEED_SMC_FEATURE_WDT_CONTROL 0x4
205 
206 static inline bool aspeed_smc_has_dma(const AspeedSMCClass *asc)
207 {
208     return !!(asc->features & ASPEED_SMC_FEATURE_DMA);
209 }
210 
211 static inline bool aspeed_smc_has_wdt_control(const AspeedSMCClass *asc)
212 {
213     return !!(asc->features & ASPEED_SMC_FEATURE_WDT_CONTROL);
214 }
215 
216 #define aspeed_smc_error(fmt, ...)                                      \
217     qemu_log_mask(LOG_GUEST_ERROR, "%s: " fmt "\n", __func__, ## __VA_ARGS__)
218 
219 static bool aspeed_smc_flash_overlap(const AspeedSMCState *s,
220                                      const AspeedSegments *new,
221                                      int cs)
222 {
223     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
224     AspeedSegments seg;
225     int i;
226 
227     for (i = 0; i < asc->max_peripherals; i++) {
228         if (i == cs) {
229             continue;
230         }
231 
232         asc->reg_to_segment(s, s->regs[R_SEG_ADDR0 + i], &seg);
233 
234         if (new->addr + new->size > seg.addr &&
235             new->addr < seg.addr + seg.size) {
236             aspeed_smc_error("new segment CS%d [ 0x%"
237                              HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with "
238                              "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
239                              cs, new->addr, new->addr + new->size,
240                              i, seg.addr, seg.addr + seg.size);
241             return true;
242         }
243     }
244     return false;
245 }
246 
247 static void aspeed_smc_flash_set_segment_region(AspeedSMCState *s, int cs,
248                                                 uint64_t regval)
249 {
250     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
251     AspeedSMCFlash *fl = &s->flashes[cs];
252     AspeedSegments seg;
253 
254     asc->reg_to_segment(s, regval, &seg);
255 
256     memory_region_transaction_begin();
257     memory_region_set_size(&fl->mmio, seg.size);
258     memory_region_set_address(&fl->mmio, seg.addr - asc->flash_window_base);
259     memory_region_set_enabled(&fl->mmio, !!seg.size);
260     memory_region_transaction_commit();
261 
262     if (asc->segment_addr_mask) {
263         regval &= asc->segment_addr_mask;
264     }
265 
266     s->regs[R_SEG_ADDR0 + cs] = regval;
267 }
268 
269 static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
270                                          uint64_t new)
271 {
272     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
273     AspeedSegments seg;
274 
275     asc->reg_to_segment(s, new, &seg);
276 
277     trace_aspeed_smc_flash_set_segment(cs, new, seg.addr, seg.addr + seg.size);
278 
279     /* The start address of CS0 is read-only */
280     if (cs == 0 && seg.addr != asc->flash_window_base) {
281         aspeed_smc_error("Tried to change CS0 start address to 0x%"
282                          HWADDR_PRIx, seg.addr);
283         seg.addr = asc->flash_window_base;
284         new = asc->segment_to_reg(s, &seg);
285     }
286 
287     /*
288      * The end address of the AST2500 spi controllers is also
289      * read-only.
290      */
291     if ((asc->segments == aspeed_2500_spi1_segments ||
292          asc->segments == aspeed_2500_spi2_segments) &&
293         cs == asc->max_peripherals &&
294         seg.addr + seg.size != asc->segments[cs].addr +
295         asc->segments[cs].size) {
296         aspeed_smc_error("Tried to change CS%d end address to 0x%"
297                          HWADDR_PRIx, cs, seg.addr + seg.size);
298         seg.size = asc->segments[cs].addr + asc->segments[cs].size -
299             seg.addr;
300         new = asc->segment_to_reg(s, &seg);
301     }
302 
303     /* Keep the segment in the overall flash window */
304     if (seg.size &&
305         (seg.addr + seg.size <= asc->flash_window_base ||
306          seg.addr > asc->flash_window_base + asc->flash_window_size)) {
307         aspeed_smc_error("new segment for CS%d is invalid : "
308                          "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
309                          cs, seg.addr, seg.addr + seg.size);
310         return;
311     }
312 
313     /* Check start address vs. alignment */
314     if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) {
315         aspeed_smc_error("new segment for CS%d is not "
316                          "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
317                          cs, seg.addr, seg.addr + seg.size);
318     }
319 
320     /* And segments should not overlap (in the specs) */
321     aspeed_smc_flash_overlap(s, &seg, cs);
322 
323     /* All should be fine now to move the region */
324     aspeed_smc_flash_set_segment_region(s, cs, new);
325 }
326 
327 static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr,
328                                               unsigned size)
329 {
330     aspeed_smc_error("To 0x%" HWADDR_PRIx " of size %u" PRIx64, addr, size);
331     return 0;
332 }
333 
334 static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr,
335                                            uint64_t data, unsigned size)
336 {
337     aspeed_smc_error("To 0x%" HWADDR_PRIx " of size %u: 0x%" PRIx64,
338                      addr, size, data);
339 }
340 
341 static const MemoryRegionOps aspeed_smc_flash_default_ops = {
342     .read = aspeed_smc_flash_default_read,
343     .write = aspeed_smc_flash_default_write,
344     .endianness = DEVICE_LITTLE_ENDIAN,
345     .valid = {
346         .min_access_size = 1,
347         .max_access_size = 4,
348     },
349 };
350 
351 static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl)
352 {
353     const AspeedSMCState *s = fl->controller;
354 
355     return s->regs[s->r_ctrl0 + fl->cs] & CTRL_CMD_MODE_MASK;
356 }
357 
358 static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl)
359 {
360     const AspeedSMCState *s = fl->controller;
361 
362     return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->cs));
363 }
364 
365 static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl)
366 {
367     const AspeedSMCState *s = fl->controller;
368     int cmd = (s->regs[s->r_ctrl0 + fl->cs] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK;
369 
370     /*
371      * In read mode, the default SPI command is READ (0x3). In other
372      * modes, the command should necessarily be defined
373      *
374      * TODO: add support for READ4 (0x13) on AST2600
375      */
376     if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) {
377         cmd = SPI_OP_READ;
378     }
379 
380     if (!cmd) {
381         aspeed_smc_error("no command defined for mode %d",
382                          aspeed_smc_flash_mode(fl));
383     }
384 
385     return cmd;
386 }
387 
388 static inline int aspeed_smc_flash_addr_width(const AspeedSMCFlash *fl)
389 {
390     const AspeedSMCState *s = fl->controller;
391     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
392 
393     if (asc->addr_width) {
394         return asc->addr_width(s);
395     } else {
396         return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->cs)) ? 4 : 3;
397     }
398 }
399 
400 static void aspeed_smc_flash_do_select(AspeedSMCFlash *fl, bool unselect)
401 {
402     AspeedSMCState *s = fl->controller;
403 
404     trace_aspeed_smc_flash_select(fl->cs, unselect ? "un" : "");
405 
406     qemu_set_irq(s->cs_lines[fl->cs], unselect);
407 }
408 
409 static void aspeed_smc_flash_select(AspeedSMCFlash *fl)
410 {
411     aspeed_smc_flash_do_select(fl, false);
412 }
413 
414 static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl)
415 {
416     aspeed_smc_flash_do_select(fl, true);
417 }
418 
419 static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
420                                               uint32_t addr)
421 {
422     const AspeedSMCState *s = fl->controller;
423     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
424     AspeedSegments seg;
425 
426     asc->reg_to_segment(s, s->regs[R_SEG_ADDR0 + fl->cs], &seg);
427     if ((addr % seg.size) != addr) {
428         aspeed_smc_error("invalid address 0x%08x for CS%d segment : "
429                          "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
430                          addr, fl->cs, seg.addr, seg.addr + seg.size);
431         addr %= seg.size;
432     }
433 
434     return addr;
435 }
436 
437 static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl)
438 {
439     const AspeedSMCState *s = fl->controller;
440     uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->cs];
441     uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1;
442     uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3;
443     uint32_t dummies = ((dummy_high << 2) | dummy_low) * 8;
444 
445     if (r_ctrl0 & CTRL_IO_DUAL_ADDR_DATA) {
446         dummies /= 2;
447     }
448 
449     return dummies;
450 }
451 
452 static void aspeed_smc_flash_setup(AspeedSMCFlash *fl, uint32_t addr)
453 {
454     const AspeedSMCState *s = fl->controller;
455     uint8_t cmd = aspeed_smc_flash_cmd(fl);
456     int i = aspeed_smc_flash_addr_width(fl);
457 
458     /* Flash access can not exceed CS segment */
459     addr = aspeed_smc_check_segment_addr(fl, addr);
460 
461     ssi_transfer(s->spi, cmd);
462     while (i--) {
463         if (aspeed_smc_addr_byte_enabled(s, i)) {
464             ssi_transfer(s->spi, (addr >> (i * 8)) & 0xff);
465         }
466     }
467 
468     /*
469      * Use fake transfers to model dummy bytes. The value should
470      * be configured to some non-zero value in fast read mode and
471      * zero in read mode. But, as the HW allows inconsistent
472      * settings, let's check for fast read mode.
473      */
474     if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) {
475         for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) {
476             ssi_transfer(fl->controller->spi, s->regs[R_DUMMY_DATA] & 0xff);
477         }
478     }
479 }
480 
481 static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
482 {
483     AspeedSMCFlash *fl = opaque;
484     AspeedSMCState *s = fl->controller;
485     uint64_t ret = 0;
486     int i;
487 
488     switch (aspeed_smc_flash_mode(fl)) {
489     case CTRL_USERMODE:
490         for (i = 0; i < size; i++) {
491             ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
492         }
493         break;
494     case CTRL_READMODE:
495     case CTRL_FREADMODE:
496         aspeed_smc_flash_select(fl);
497         aspeed_smc_flash_setup(fl, addr);
498 
499         for (i = 0; i < size; i++) {
500             ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
501         }
502 
503         aspeed_smc_flash_unselect(fl);
504         break;
505     default:
506         aspeed_smc_error("invalid flash mode %d", aspeed_smc_flash_mode(fl));
507     }
508 
509     trace_aspeed_smc_flash_read(fl->cs, addr, size, ret,
510                                 aspeed_smc_flash_mode(fl));
511     return ret;
512 }
513 
514 /*
515  * TODO (clg@kaod.org): stolen from xilinx_spips.c. Should move to a
516  * common include header.
517  */
518 typedef enum {
519     READ = 0x3,         READ_4 = 0x13,
520     FAST_READ = 0xb,    FAST_READ_4 = 0x0c,
521     DOR = 0x3b,         DOR_4 = 0x3c,
522     QOR = 0x6b,         QOR_4 = 0x6c,
523     DIOR = 0xbb,        DIOR_4 = 0xbc,
524     QIOR = 0xeb,        QIOR_4 = 0xec,
525 
526     PP = 0x2,           PP_4 = 0x12,
527     DPP = 0xa2,
528     QPP = 0x32,         QPP_4 = 0x34,
529 } FlashCMD;
530 
531 static int aspeed_smc_num_dummies(uint8_t command)
532 {
533     switch (command) { /* check for dummies */
534     case READ: /* no dummy bytes/cycles */
535     case PP:
536     case DPP:
537     case QPP:
538     case READ_4:
539     case PP_4:
540     case QPP_4:
541         return 0;
542     case FAST_READ:
543     case DOR:
544     case QOR:
545     case FAST_READ_4:
546     case DOR_4:
547     case QOR_4:
548         return 1;
549     case DIOR:
550     case DIOR_4:
551         return 2;
552     case QIOR:
553     case QIOR_4:
554         return 4;
555     default:
556         return -1;
557     }
558 }
559 
560 static bool aspeed_smc_do_snoop(AspeedSMCFlash *fl,  uint64_t data,
561                                 unsigned size)
562 {
563     AspeedSMCState *s = fl->controller;
564     uint8_t addr_width = aspeed_smc_flash_addr_width(fl);
565 
566     trace_aspeed_smc_do_snoop(fl->cs, s->snoop_index, s->snoop_dummies,
567                               (uint8_t) data & 0xff);
568 
569     if (s->snoop_index == SNOOP_OFF) {
570         return false; /* Do nothing */
571 
572     } else if (s->snoop_index == SNOOP_START) {
573         uint8_t cmd = data & 0xff;
574         int ndummies = aspeed_smc_num_dummies(cmd);
575 
576         /*
577          * No dummy cycles are expected with the current command. Turn
578          * off snooping and let the transfer proceed normally.
579          */
580         if (ndummies <= 0) {
581             s->snoop_index = SNOOP_OFF;
582             return false;
583         }
584 
585         s->snoop_dummies = ndummies * 8;
586 
587     } else if (s->snoop_index >= addr_width + 1) {
588 
589         /* The SPI transfer has reached the dummy cycles sequence */
590         for (; s->snoop_dummies; s->snoop_dummies--) {
591             ssi_transfer(s->spi, s->regs[R_DUMMY_DATA] & 0xff);
592         }
593 
594         /* If no more dummy cycles are expected, turn off snooping */
595         if (!s->snoop_dummies) {
596             s->snoop_index = SNOOP_OFF;
597         } else {
598             s->snoop_index += size;
599         }
600 
601         /*
602          * Dummy cycles have been faked already. Ignore the current
603          * SPI transfer
604          */
605         return true;
606     }
607 
608     s->snoop_index += size;
609     return false;
610 }
611 
612 static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,
613                                    unsigned size)
614 {
615     AspeedSMCFlash *fl = opaque;
616     AspeedSMCState *s = fl->controller;
617     int i;
618 
619     trace_aspeed_smc_flash_write(fl->cs, addr, size, data,
620                                  aspeed_smc_flash_mode(fl));
621 
622     if (!aspeed_smc_is_writable(fl)) {
623         aspeed_smc_error("flash is not writable at 0x%" HWADDR_PRIx, addr);
624         return;
625     }
626 
627     switch (aspeed_smc_flash_mode(fl)) {
628     case CTRL_USERMODE:
629         if (aspeed_smc_do_snoop(fl, data, size)) {
630             break;
631         }
632 
633         for (i = 0; i < size; i++) {
634             ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
635         }
636         break;
637     case CTRL_WRITEMODE:
638         aspeed_smc_flash_select(fl);
639         aspeed_smc_flash_setup(fl, addr);
640 
641         for (i = 0; i < size; i++) {
642             ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
643         }
644 
645         aspeed_smc_flash_unselect(fl);
646         break;
647     default:
648         aspeed_smc_error("invalid flash mode %d", aspeed_smc_flash_mode(fl));
649     }
650 }
651 
652 static const MemoryRegionOps aspeed_smc_flash_ops = {
653     .read = aspeed_smc_flash_read,
654     .write = aspeed_smc_flash_write,
655     .endianness = DEVICE_LITTLE_ENDIAN,
656     .valid = {
657         .min_access_size = 1,
658         .max_access_size = 4,
659     },
660 };
661 
662 static void aspeed_smc_flash_update_ctrl(AspeedSMCFlash *fl, uint32_t value)
663 {
664     AspeedSMCState *s = fl->controller;
665     bool unselect;
666 
667     /* User mode selects the CS, other modes unselect */
668     unselect = (value & CTRL_CMD_MODE_MASK) != CTRL_USERMODE;
669 
670     /* A change of CTRL_CE_STOP_ACTIVE from 0 to 1, unselects the CS */
671     if (!(s->regs[s->r_ctrl0 + fl->cs] & CTRL_CE_STOP_ACTIVE) &&
672         value & CTRL_CE_STOP_ACTIVE) {
673         unselect = true;
674     }
675 
676     s->regs[s->r_ctrl0 + fl->cs] = value;
677 
678     s->snoop_index = unselect ? SNOOP_OFF : SNOOP_START;
679 
680     aspeed_smc_flash_do_select(fl, unselect);
681 }
682 
683 static void aspeed_smc_reset(DeviceState *d)
684 {
685     AspeedSMCState *s = ASPEED_SMC(d);
686     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
687     int i;
688 
689     if (asc->resets) {
690         memcpy(s->regs, asc->resets, sizeof s->regs);
691     } else {
692         memset(s->regs, 0, sizeof s->regs);
693     }
694 
695     /* Unselect all peripherals */
696     for (i = 0; i < s->num_cs; ++i) {
697         s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE;
698         qemu_set_irq(s->cs_lines[i], true);
699     }
700 
701     /* setup the default segment register values and regions for all */
702     for (i = 0; i < asc->max_peripherals; ++i) {
703         aspeed_smc_flash_set_segment_region(s, i,
704                     asc->segment_to_reg(s, &asc->segments[i]));
705     }
706 
707     s->snoop_index = SNOOP_OFF;
708     s->snoop_dummies = 0;
709 }
710 
711 static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
712 {
713     AspeedSMCState *s = ASPEED_SMC(opaque);
714     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(opaque);
715 
716     addr >>= 2;
717 
718     if (addr == s->r_conf ||
719         (addr >= s->r_timings &&
720          addr < s->r_timings + asc->nregs_timings) ||
721         addr == s->r_ce_ctrl ||
722         addr == R_CE_CMD_CTRL ||
723         addr == R_INTR_CTRL ||
724         addr == R_DUMMY_DATA ||
725         (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_CTRL) ||
726         (aspeed_smc_has_dma(asc) && addr == R_DMA_CTRL) ||
727         (aspeed_smc_has_dma(asc) && addr == R_DMA_FLASH_ADDR) ||
728         (aspeed_smc_has_dma(asc) && addr == R_DMA_DRAM_ADDR) ||
729         (aspeed_smc_has_dma(asc) && addr == R_DMA_LEN) ||
730         (aspeed_smc_has_dma(asc) && addr == R_DMA_CHECKSUM) ||
731         (addr >= R_SEG_ADDR0 &&
732          addr < R_SEG_ADDR0 + asc->max_peripherals) ||
733         (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + asc->max_peripherals)) {
734 
735         trace_aspeed_smc_read(addr << 2, size, s->regs[addr]);
736 
737         return s->regs[addr];
738     } else {
739         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
740                       __func__, addr);
741         return -1;
742     }
743 }
744 
745 static uint8_t aspeed_smc_hclk_divisor(uint8_t hclk_mask)
746 {
747     /* HCLK/1 .. HCLK/16 */
748     const uint8_t hclk_divisors[] = {
749         15, 7, 14, 6, 13, 5, 12, 4, 11, 3, 10, 2, 9, 1, 8, 0
750     };
751     int i;
752 
753     for (i = 0; i < ARRAY_SIZE(hclk_divisors); i++) {
754         if (hclk_mask == hclk_divisors[i]) {
755             return i + 1;
756         }
757     }
758 
759     aspeed_smc_error("invalid HCLK mask %x", hclk_mask);
760     return 0;
761 }
762 
763 /*
764  * When doing calibration, the SPI clock rate in the CE0 Control
765  * Register and the read delay cycles in the Read Timing Compensation
766  * Register are set using bit[11:4] of the DMA Control Register.
767  */
768 static void aspeed_smc_dma_calibration(AspeedSMCState *s)
769 {
770     uint8_t delay =
771         (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
772     uint8_t hclk_mask =
773         (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
774     uint8_t hclk_div = aspeed_smc_hclk_divisor(hclk_mask);
775     uint32_t hclk_shift = (hclk_div - 1) << 2;
776     uint8_t cs;
777 
778     /*
779      * The Read Timing Compensation Register values apply to all CS on
780      * the SPI bus and only HCLK/1 - HCLK/5 can have tunable delays
781      */
782     if (hclk_div && hclk_div < 6) {
783         s->regs[s->r_timings] &= ~(0xf << hclk_shift);
784         s->regs[s->r_timings] |= delay << hclk_shift;
785     }
786 
787     /*
788      * TODO: compute the CS from the DMA address and the segment
789      * registers. This is not really a problem for now because the
790      * Timing Register values apply to all CS and software uses CS0 to
791      * do calibration.
792      */
793     cs = 0;
794     s->regs[s->r_ctrl0 + cs] &=
795         ~(CE_CTRL_CLOCK_FREQ_MASK << CE_CTRL_CLOCK_FREQ_SHIFT);
796     s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
797 }
798 
799 /*
800  * Emulate read errors in the DMA Checksum Register for high
801  * frequencies and optimistic settings of the Read Timing Compensation
802  * Register. This will help in tuning the SPI timing calibration
803  * algorithm.
804  */
805 static bool aspeed_smc_inject_read_failure(AspeedSMCState *s)
806 {
807     uint8_t delay =
808         (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
809     uint8_t hclk_mask =
810         (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
811 
812     /*
813      * Typical values of a palmetto-bmc machine.
814      */
815     switch (aspeed_smc_hclk_divisor(hclk_mask)) {
816     case 4 ... 16:
817         return false;
818     case 3: /* at least one HCLK cycle delay */
819         return (delay & 0x7) < 1;
820     case 2: /* at least two HCLK cycle delay */
821         return (delay & 0x7) < 2;
822     case 1: /* (> 100MHz) is above the max freq of the controller */
823         return true;
824     default:
825         g_assert_not_reached();
826     }
827 }
828 
829 /*
830  * Accumulate the result of the reads to provide a checksum that will
831  * be used to validate the read timing settings.
832  */
833 static void aspeed_smc_dma_checksum(AspeedSMCState *s)
834 {
835     MemTxResult result;
836     uint32_t data;
837 
838     if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
839         aspeed_smc_error("invalid direction for DMA checksum");
840         return;
841     }
842 
843     if (s->regs[R_DMA_CTRL] & DMA_CTRL_CALIB) {
844         aspeed_smc_dma_calibration(s);
845     }
846 
847     while (s->regs[R_DMA_LEN]) {
848         data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
849                                     MEMTXATTRS_UNSPECIFIED, &result);
850         if (result != MEMTX_OK) {
851             aspeed_smc_error("Flash read failed @%08x",
852                              s->regs[R_DMA_FLASH_ADDR]);
853             return;
854         }
855         trace_aspeed_smc_dma_checksum(s->regs[R_DMA_FLASH_ADDR], data);
856 
857         /*
858          * When the DMA is on-going, the DMA registers are updated
859          * with the current working addresses and length.
860          */
861         s->regs[R_DMA_CHECKSUM] += data;
862         s->regs[R_DMA_FLASH_ADDR] += 4;
863         s->regs[R_DMA_LEN] -= 4;
864     }
865 
866     if (s->inject_failure && aspeed_smc_inject_read_failure(s)) {
867         s->regs[R_DMA_CHECKSUM] = 0xbadc0de;
868     }
869 
870 }
871 
872 static void aspeed_smc_dma_rw(AspeedSMCState *s)
873 {
874     MemTxResult result;
875     uint32_t data;
876 
877     trace_aspeed_smc_dma_rw(s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE ?
878                             "write" : "read",
879                             s->regs[R_DMA_FLASH_ADDR],
880                             s->regs[R_DMA_DRAM_ADDR],
881                             s->regs[R_DMA_LEN]);
882     while (s->regs[R_DMA_LEN]) {
883         if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
884             data = address_space_ldl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
885                                         MEMTXATTRS_UNSPECIFIED, &result);
886             if (result != MEMTX_OK) {
887                 aspeed_smc_error("DRAM read failed @%08x",
888                                  s->regs[R_DMA_DRAM_ADDR]);
889                 return;
890             }
891 
892             address_space_stl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
893                                  data, MEMTXATTRS_UNSPECIFIED, &result);
894             if (result != MEMTX_OK) {
895                 aspeed_smc_error("Flash write failed @%08x",
896                                  s->regs[R_DMA_FLASH_ADDR]);
897                 return;
898             }
899         } else {
900             data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
901                                         MEMTXATTRS_UNSPECIFIED, &result);
902             if (result != MEMTX_OK) {
903                 aspeed_smc_error("Flash read failed @%08x",
904                                  s->regs[R_DMA_FLASH_ADDR]);
905                 return;
906             }
907 
908             address_space_stl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
909                                  data, MEMTXATTRS_UNSPECIFIED, &result);
910             if (result != MEMTX_OK) {
911                 aspeed_smc_error("DRAM write failed @%08x",
912                                  s->regs[R_DMA_DRAM_ADDR]);
913                 return;
914             }
915         }
916 
917         /*
918          * When the DMA is on-going, the DMA registers are updated
919          * with the current working addresses and length.
920          */
921         s->regs[R_DMA_FLASH_ADDR] += 4;
922         s->regs[R_DMA_DRAM_ADDR] += 4;
923         s->regs[R_DMA_LEN] -= 4;
924         s->regs[R_DMA_CHECKSUM] += data;
925     }
926 }
927 
928 static void aspeed_smc_dma_stop(AspeedSMCState *s)
929 {
930     /*
931      * When the DMA is disabled, INTR_CTRL_DMA_STATUS=0 means the
932      * engine is idle
933      */
934     s->regs[R_INTR_CTRL] &= ~INTR_CTRL_DMA_STATUS;
935     s->regs[R_DMA_CHECKSUM] = 0;
936 
937     /*
938      * Lower the DMA irq in any case. The IRQ control register could
939      * have been cleared before disabling the DMA.
940      */
941     qemu_irq_lower(s->irq);
942 }
943 
944 /*
945  * When INTR_CTRL_DMA_STATUS=1, the DMA has completed and a new DMA
946  * can start even if the result of the previous was not collected.
947  */
948 static bool aspeed_smc_dma_in_progress(AspeedSMCState *s)
949 {
950     return s->regs[R_DMA_CTRL] & DMA_CTRL_ENABLE &&
951         !(s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_STATUS);
952 }
953 
954 static void aspeed_smc_dma_done(AspeedSMCState *s)
955 {
956     s->regs[R_INTR_CTRL] |= INTR_CTRL_DMA_STATUS;
957     if (s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_EN) {
958         qemu_irq_raise(s->irq);
959     }
960 }
961 
962 static void aspeed_smc_dma_ctrl(AspeedSMCState *s, uint32_t dma_ctrl)
963 {
964     if (!(dma_ctrl & DMA_CTRL_ENABLE)) {
965         s->regs[R_DMA_CTRL] = dma_ctrl;
966 
967         aspeed_smc_dma_stop(s);
968         return;
969     }
970 
971     if (aspeed_smc_dma_in_progress(s)) {
972         aspeed_smc_error("DMA in progress !");
973         return;
974     }
975 
976     s->regs[R_DMA_CTRL] = dma_ctrl;
977 
978     if (s->regs[R_DMA_CTRL] & DMA_CTRL_CKSUM) {
979         aspeed_smc_dma_checksum(s);
980     } else {
981         aspeed_smc_dma_rw(s);
982     }
983 
984     aspeed_smc_dma_done(s);
985 }
986 
987 static inline bool aspeed_smc_dma_granted(AspeedSMCState *s)
988 {
989     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
990 
991     if (!(asc->features & ASPEED_SMC_FEATURE_DMA_GRANT)) {
992         return true;
993     }
994 
995     if (!(s->regs[R_DMA_CTRL] & DMA_CTRL_GRANT)) {
996         aspeed_smc_error("DMA not granted");
997         return false;
998     }
999 
1000     return true;
1001 }
1002 
1003 static void aspeed_2600_smc_dma_ctrl(AspeedSMCState *s, uint32_t dma_ctrl)
1004 {
1005     /* Preserve DMA bits  */
1006     dma_ctrl |= s->regs[R_DMA_CTRL] & (DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1007 
1008     if (dma_ctrl == 0xAEED0000) {
1009         /* automatically grant request */
1010         s->regs[R_DMA_CTRL] |= (DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1011         return;
1012     }
1013 
1014     /* clear request */
1015     if (dma_ctrl == 0xDEEA0000) {
1016         s->regs[R_DMA_CTRL] &= ~(DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1017         return;
1018     }
1019 
1020     if (!aspeed_smc_dma_granted(s)) {
1021         aspeed_smc_error("DMA not granted");
1022         return;
1023     }
1024 
1025     aspeed_smc_dma_ctrl(s, dma_ctrl);
1026     s->regs[R_DMA_CTRL] &= ~(DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1027 }
1028 
1029 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
1030                              unsigned int size)
1031 {
1032     AspeedSMCState *s = ASPEED_SMC(opaque);
1033     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1034     uint32_t value = data;
1035 
1036     trace_aspeed_smc_write(addr, size, data);
1037 
1038     addr >>= 2;
1039 
1040     if (addr == s->r_conf ||
1041         (addr >= s->r_timings &&
1042          addr < s->r_timings + asc->nregs_timings) ||
1043         addr == s->r_ce_ctrl) {
1044         s->regs[addr] = value;
1045     } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) {
1046         int cs = addr - s->r_ctrl0;
1047         aspeed_smc_flash_update_ctrl(&s->flashes[cs], value);
1048     } else if (addr >= R_SEG_ADDR0 &&
1049                addr < R_SEG_ADDR0 + asc->max_peripherals) {
1050         int cs = addr - R_SEG_ADDR0;
1051 
1052         if (value != s->regs[R_SEG_ADDR0 + cs]) {
1053             aspeed_smc_flash_set_segment(s, cs, value);
1054         }
1055     } else if (addr == R_CE_CMD_CTRL) {
1056         s->regs[addr] = value & 0xff;
1057     } else if (addr == R_DUMMY_DATA) {
1058         s->regs[addr] = value & 0xff;
1059     } else if (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_CTRL) {
1060         s->regs[addr] = value & FMC_WDT2_CTRL_EN;
1061     } else if (addr == R_INTR_CTRL) {
1062         s->regs[addr] = value;
1063     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_CTRL) {
1064         asc->dma_ctrl(s, value);
1065     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_DRAM_ADDR &&
1066                aspeed_smc_dma_granted(s)) {
1067         s->regs[addr] = DMA_DRAM_ADDR(asc, value);
1068     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_FLASH_ADDR &&
1069                aspeed_smc_dma_granted(s)) {
1070         s->regs[addr] = DMA_FLASH_ADDR(asc, value);
1071     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_LEN &&
1072                aspeed_smc_dma_granted(s)) {
1073         s->regs[addr] = DMA_LENGTH(value);
1074     } else {
1075         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
1076                       __func__, addr);
1077         return;
1078     }
1079 }
1080 
1081 static const MemoryRegionOps aspeed_smc_ops = {
1082     .read = aspeed_smc_read,
1083     .write = aspeed_smc_write,
1084     .endianness = DEVICE_LITTLE_ENDIAN,
1085 };
1086 
1087 static void aspeed_smc_instance_init(Object *obj)
1088 {
1089     AspeedSMCState *s = ASPEED_SMC(obj);
1090     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1091     int i;
1092 
1093     for (i = 0; i < asc->max_peripherals; i++) {
1094         object_initialize_child(obj, "flash[*]", &s->flashes[i],
1095                                 TYPE_ASPEED_SMC_FLASH);
1096     }
1097 }
1098 
1099 /*
1100  * Initialize the custom address spaces for DMAs
1101  */
1102 static void aspeed_smc_dma_setup(AspeedSMCState *s, Error **errp)
1103 {
1104     if (!s->dram_mr) {
1105         error_setg(errp, TYPE_ASPEED_SMC ": 'dram' link not set");
1106         return;
1107     }
1108 
1109     address_space_init(&s->flash_as, &s->mmio_flash,
1110                        TYPE_ASPEED_SMC ".dma-flash");
1111     address_space_init(&s->dram_as, s->dram_mr,
1112                        TYPE_ASPEED_SMC ".dma-dram");
1113 }
1114 
1115 static void aspeed_smc_realize(DeviceState *dev, Error **errp)
1116 {
1117     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1118     AspeedSMCState *s = ASPEED_SMC(dev);
1119     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1120     int i;
1121     hwaddr offset = 0;
1122 
1123     /* keep a copy under AspeedSMCState to speed up accesses */
1124     s->r_conf = asc->r_conf;
1125     s->r_ce_ctrl = asc->r_ce_ctrl;
1126     s->r_ctrl0 = asc->r_ctrl0;
1127     s->r_timings = asc->r_timings;
1128     s->conf_enable_w0 = asc->conf_enable_w0;
1129 
1130     /* Enforce some real HW limits */
1131     if (s->num_cs > asc->max_peripherals) {
1132         aspeed_smc_error("num_cs cannot exceed: %d", asc->max_peripherals);
1133         s->num_cs = asc->max_peripherals;
1134     }
1135 
1136     /* DMA irq. Keep it first for the initialization in the SoC */
1137     sysbus_init_irq(sbd, &s->irq);
1138 
1139     s->spi = ssi_create_bus(dev, "spi");
1140 
1141     /* Setup cs_lines for peripherals */
1142     s->cs_lines = g_new0(qemu_irq, s->num_cs);
1143 
1144     for (i = 0; i < s->num_cs; ++i) {
1145         sysbus_init_irq(sbd, &s->cs_lines[i]);
1146     }
1147 
1148     /* The memory region for the controller registers */
1149     memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s,
1150                           TYPE_ASPEED_SMC, asc->nregs * 4);
1151     sysbus_init_mmio(sbd, &s->mmio);
1152 
1153     /*
1154      * The container memory region representing the address space
1155      * window in which the flash modules are mapped. The size and
1156      * address depends on the SoC model and controller type.
1157      */
1158     memory_region_init(&s->mmio_flash_container, OBJECT(s),
1159                        TYPE_ASPEED_SMC ".container",
1160                        asc->flash_window_size);
1161     sysbus_init_mmio(sbd, &s->mmio_flash_container);
1162 
1163     memory_region_init_io(&s->mmio_flash, OBJECT(s),
1164                           &aspeed_smc_flash_default_ops, s,
1165                           TYPE_ASPEED_SMC ".flash",
1166                           asc->flash_window_size);
1167     memory_region_add_subregion(&s->mmio_flash_container, 0x0,
1168                                 &s->mmio_flash);
1169 
1170     /*
1171      * Let's create a sub memory region for each possible peripheral. All
1172      * have a configurable memory segment in the overall flash mapping
1173      * window of the controller but, there is not necessarily a flash
1174      * module behind to handle the memory accesses. This depends on
1175      * the board configuration.
1176      */
1177     for (i = 0; i < asc->max_peripherals; ++i) {
1178         AspeedSMCFlash *fl = &s->flashes[i];
1179 
1180         if (!object_property_set_link(OBJECT(fl), "controller", OBJECT(s),
1181                                       errp)) {
1182             return;
1183         }
1184         if (!object_property_set_uint(OBJECT(fl), "cs", i, errp)) {
1185             return;
1186         }
1187         if (!sysbus_realize(SYS_BUS_DEVICE(fl), errp)) {
1188             return;
1189         }
1190 
1191         memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio);
1192         offset += asc->segments[i].size;
1193     }
1194 
1195     /* DMA support */
1196     if (aspeed_smc_has_dma(asc)) {
1197         aspeed_smc_dma_setup(s, errp);
1198     }
1199 }
1200 
1201 static const VMStateDescription vmstate_aspeed_smc = {
1202     .name = "aspeed.smc",
1203     .version_id = 2,
1204     .minimum_version_id = 2,
1205     .fields = (VMStateField[]) {
1206         VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX),
1207         VMSTATE_UINT8(snoop_index, AspeedSMCState),
1208         VMSTATE_UINT8(snoop_dummies, AspeedSMCState),
1209         VMSTATE_END_OF_LIST()
1210     }
1211 };
1212 
1213 static Property aspeed_smc_properties[] = {
1214     DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1),
1215     DEFINE_PROP_BOOL("inject-failure", AspeedSMCState, inject_failure, false),
1216     DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
1217                      TYPE_MEMORY_REGION, MemoryRegion *),
1218     DEFINE_PROP_END_OF_LIST(),
1219 };
1220 
1221 static void aspeed_smc_class_init(ObjectClass *klass, void *data)
1222 {
1223     DeviceClass *dc = DEVICE_CLASS(klass);
1224 
1225     dc->realize = aspeed_smc_realize;
1226     dc->reset = aspeed_smc_reset;
1227     device_class_set_props(dc, aspeed_smc_properties);
1228     dc->vmsd = &vmstate_aspeed_smc;
1229 }
1230 
1231 static const TypeInfo aspeed_smc_info = {
1232     .name           = TYPE_ASPEED_SMC,
1233     .parent         = TYPE_SYS_BUS_DEVICE,
1234     .instance_init  = aspeed_smc_instance_init,
1235     .instance_size  = sizeof(AspeedSMCState),
1236     .class_size     = sizeof(AspeedSMCClass),
1237     .class_init     = aspeed_smc_class_init,
1238     .abstract       = true,
1239 };
1240 
1241 static void aspeed_smc_flash_realize(DeviceState *dev, Error **errp)
1242 {
1243     AspeedSMCFlash *s = ASPEED_SMC_FLASH(dev);
1244     AspeedSMCClass *asc;
1245     g_autofree char *name = g_strdup_printf(TYPE_ASPEED_SMC_FLASH ".%d", s->cs);
1246 
1247     if (!s->controller) {
1248         error_setg(errp, TYPE_ASPEED_SMC_FLASH ": 'controller' link not set");
1249         return;
1250     }
1251 
1252     asc = ASPEED_SMC_GET_CLASS(s->controller);
1253 
1254     /*
1255      * Use the default segment value to size the memory region. This
1256      * can be changed by FW at runtime.
1257      */
1258     memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_flash_ops,
1259                           s, name, asc->segments[s->cs].size);
1260     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
1261 }
1262 
1263 static Property aspeed_smc_flash_properties[] = {
1264     DEFINE_PROP_UINT8("cs", AspeedSMCFlash, cs, 0),
1265     DEFINE_PROP_LINK("controller", AspeedSMCFlash, controller, TYPE_ASPEED_SMC,
1266                      AspeedSMCState *),
1267     DEFINE_PROP_END_OF_LIST(),
1268 };
1269 
1270 static void aspeed_smc_flash_class_init(ObjectClass *klass, void *data)
1271 {
1272     DeviceClass *dc = DEVICE_CLASS(klass);
1273 
1274     dc->desc = "Aspeed SMC Flash device region";
1275     dc->realize = aspeed_smc_flash_realize;
1276     device_class_set_props(dc, aspeed_smc_flash_properties);
1277 }
1278 
1279 static const TypeInfo aspeed_smc_flash_info = {
1280     .name           = TYPE_ASPEED_SMC_FLASH,
1281     .parent         = TYPE_SYS_BUS_DEVICE,
1282     .instance_size  = sizeof(AspeedSMCFlash),
1283     .class_init     = aspeed_smc_flash_class_init,
1284 };
1285 
1286 /*
1287  * The Segment Registers of the AST2400 and AST2500 have a 8MB
1288  * unit. The address range of a flash SPI peripheral is encoded with
1289  * absolute addresses which should be part of the overall controller
1290  * window.
1291  */
1292 static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s,
1293                                           const AspeedSegments *seg)
1294 {
1295     uint32_t reg = 0;
1296     reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT;
1297     reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT;
1298     return reg;
1299 }
1300 
1301 static void aspeed_smc_reg_to_segment(const AspeedSMCState *s,
1302                                       uint32_t reg, AspeedSegments *seg)
1303 {
1304     seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23;
1305     seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr;
1306 }
1307 
1308 static const AspeedSegments aspeed_2400_smc_segments[] = {
1309     { 0x10000000, 32 * MiB },
1310 };
1311 
1312 static void aspeed_2400_smc_class_init(ObjectClass *klass, void *data)
1313 {
1314     DeviceClass *dc = DEVICE_CLASS(klass);
1315     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1316 
1317     dc->desc               = "Aspeed 2400 SMC Controller";
1318     asc->r_conf            = R_CONF;
1319     asc->r_ce_ctrl         = R_CE_CTRL;
1320     asc->r_ctrl0           = R_CTRL0;
1321     asc->r_timings         = R_TIMINGS;
1322     asc->nregs_timings     = 1;
1323     asc->conf_enable_w0    = CONF_ENABLE_W0;
1324     asc->max_peripherals   = 1;
1325     asc->segments          = aspeed_2400_smc_segments;
1326     asc->flash_window_base = 0x10000000;
1327     asc->flash_window_size = 0x6000000;
1328     asc->features          = 0x0;
1329     asc->nregs             = ASPEED_SMC_R_SMC_MAX;
1330     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1331     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1332     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1333 }
1334 
1335 static const TypeInfo aspeed_2400_smc_info = {
1336     .name =  "aspeed.smc-ast2400",
1337     .parent = TYPE_ASPEED_SMC,
1338     .class_init = aspeed_2400_smc_class_init,
1339 };
1340 
1341 static const uint32_t aspeed_2400_fmc_resets[ASPEED_SMC_R_MAX] = {
1342     /*
1343      * CE0 and CE1 types are HW strapped in SCU70. Do it here to
1344      * simplify the model.
1345      */
1346     [R_CONF] = CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0,
1347 };
1348 
1349 static const AspeedSegments aspeed_2400_fmc_segments[] = {
1350     { 0x20000000, 64 * MiB }, /* start address is readonly */
1351     { 0x24000000, 32 * MiB },
1352     { 0x26000000, 32 * MiB },
1353     { 0x28000000, 32 * MiB },
1354     { 0x2A000000, 32 * MiB }
1355 };
1356 
1357 static void aspeed_2400_fmc_class_init(ObjectClass *klass, void *data)
1358 {
1359     DeviceClass *dc = DEVICE_CLASS(klass);
1360     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1361 
1362     dc->desc               = "Aspeed 2400 FMC Controller";
1363     asc->r_conf            = R_CONF;
1364     asc->r_ce_ctrl         = R_CE_CTRL;
1365     asc->r_ctrl0           = R_CTRL0;
1366     asc->r_timings         = R_TIMINGS;
1367     asc->nregs_timings     = 1;
1368     asc->conf_enable_w0    = CONF_ENABLE_W0;
1369     asc->max_peripherals   = 5;
1370     asc->segments          = aspeed_2400_fmc_segments;
1371     asc->segment_addr_mask = 0xffff0000;
1372     asc->resets            = aspeed_2400_fmc_resets;
1373     asc->flash_window_base = 0x20000000;
1374     asc->flash_window_size = 0x10000000;
1375     asc->features          = ASPEED_SMC_FEATURE_DMA;
1376     asc->dma_flash_mask    = 0x0FFFFFFC;
1377     asc->dma_dram_mask     = 0x1FFFFFFC;
1378     asc->nregs             = ASPEED_SMC_R_MAX;
1379     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1380     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1381     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1382 }
1383 
1384 static const TypeInfo aspeed_2400_fmc_info = {
1385     .name =  "aspeed.fmc-ast2400",
1386     .parent = TYPE_ASPEED_SMC,
1387     .class_init = aspeed_2400_fmc_class_init,
1388 };
1389 
1390 static const AspeedSegments aspeed_2400_spi1_segments[] = {
1391     { 0x30000000, 64 * MiB },
1392 };
1393 
1394 static int aspeed_2400_spi1_addr_width(const AspeedSMCState *s)
1395 {
1396     return s->regs[R_SPI_CTRL0] & CTRL_AST2400_SPI_4BYTE ? 4 : 3;
1397 }
1398 
1399 static void aspeed_2400_spi1_class_init(ObjectClass *klass, void *data)
1400 {
1401     DeviceClass *dc = DEVICE_CLASS(klass);
1402     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1403 
1404     dc->desc               = "Aspeed 2400 SPI1 Controller";
1405     asc->r_conf            = R_SPI_CONF;
1406     asc->r_ce_ctrl         = 0xff;
1407     asc->r_ctrl0           = R_SPI_CTRL0;
1408     asc->r_timings         = R_SPI_TIMINGS;
1409     asc->nregs_timings     = 1;
1410     asc->conf_enable_w0    = SPI_CONF_ENABLE_W0;
1411     asc->max_peripherals   = 1;
1412     asc->segments          = aspeed_2400_spi1_segments;
1413     asc->flash_window_base = 0x30000000;
1414     asc->flash_window_size = 0x10000000;
1415     asc->features          = 0x0;
1416     asc->nregs             = ASPEED_SMC_R_SPI_MAX;
1417     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1418     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1419     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1420     asc->addr_width        = aspeed_2400_spi1_addr_width;
1421 }
1422 
1423 static const TypeInfo aspeed_2400_spi1_info = {
1424     .name =  "aspeed.spi1-ast2400",
1425     .parent = TYPE_ASPEED_SMC,
1426     .class_init = aspeed_2400_spi1_class_init,
1427 };
1428 
1429 static const uint32_t aspeed_2500_fmc_resets[ASPEED_SMC_R_MAX] = {
1430     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1431                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
1432 };
1433 
1434 static const AspeedSegments aspeed_2500_fmc_segments[] = {
1435     { 0x20000000, 128 * MiB }, /* start address is readonly */
1436     { 0x28000000,  32 * MiB },
1437     { 0x2A000000,  32 * MiB },
1438 };
1439 
1440 static void aspeed_2500_fmc_class_init(ObjectClass *klass, void *data)
1441 {
1442     DeviceClass *dc = DEVICE_CLASS(klass);
1443     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1444 
1445     dc->desc               = "Aspeed 2600 FMC Controller";
1446     asc->r_conf            = R_CONF;
1447     asc->r_ce_ctrl         = R_CE_CTRL;
1448     asc->r_ctrl0           = R_CTRL0;
1449     asc->r_timings         = R_TIMINGS;
1450     asc->nregs_timings     = 1;
1451     asc->conf_enable_w0    = CONF_ENABLE_W0;
1452     asc->max_peripherals   = 3;
1453     asc->segments          = aspeed_2500_fmc_segments;
1454     asc->segment_addr_mask = 0xffff0000;
1455     asc->resets            = aspeed_2500_fmc_resets;
1456     asc->flash_window_base = 0x20000000;
1457     asc->flash_window_size = 0x10000000;
1458     asc->features          = ASPEED_SMC_FEATURE_DMA;
1459     asc->dma_flash_mask    = 0x0FFFFFFC;
1460     asc->dma_dram_mask     = 0x3FFFFFFC;
1461     asc->nregs             = ASPEED_SMC_R_MAX;
1462     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1463     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1464     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1465 }
1466 
1467 static const TypeInfo aspeed_2500_fmc_info = {
1468     .name =  "aspeed.fmc-ast2500",
1469     .parent = TYPE_ASPEED_SMC,
1470     .class_init = aspeed_2500_fmc_class_init,
1471 };
1472 
1473 static const AspeedSegments aspeed_2500_spi1_segments[] = {
1474     { 0x30000000, 32 * MiB }, /* start address is readonly */
1475     { 0x32000000, 96 * MiB }, /* end address is readonly */
1476 };
1477 
1478 static void aspeed_2500_spi1_class_init(ObjectClass *klass, void *data)
1479 {
1480     DeviceClass *dc = DEVICE_CLASS(klass);
1481     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1482 
1483     dc->desc               = "Aspeed 2600 SPI1 Controller";
1484     asc->r_conf            = R_CONF;
1485     asc->r_ce_ctrl         = R_CE_CTRL;
1486     asc->r_ctrl0           = R_CTRL0;
1487     asc->r_timings         = R_TIMINGS;
1488     asc->nregs_timings     = 1;
1489     asc->conf_enable_w0    = CONF_ENABLE_W0;
1490     asc->max_peripherals   = 2;
1491     asc->segments          = aspeed_2500_spi1_segments;
1492     asc->segment_addr_mask = 0xffff0000;
1493     asc->flash_window_base = 0x30000000;
1494     asc->flash_window_size = 0x8000000;
1495     asc->features          = 0x0;
1496     asc->nregs             = ASPEED_SMC_R_MAX;
1497     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1498     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1499     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1500 }
1501 
1502 static const TypeInfo aspeed_2500_spi1_info = {
1503     .name =  "aspeed.spi1-ast2500",
1504     .parent = TYPE_ASPEED_SMC,
1505     .class_init = aspeed_2500_spi1_class_init,
1506 };
1507 
1508 static const AspeedSegments aspeed_2500_spi2_segments[] = {
1509     { 0x38000000, 32 * MiB }, /* start address is readonly */
1510     { 0x3A000000, 96 * MiB }, /* end address is readonly */
1511 };
1512 
1513 static void aspeed_2500_spi2_class_init(ObjectClass *klass, void *data)
1514 {
1515     DeviceClass *dc = DEVICE_CLASS(klass);
1516     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1517 
1518     dc->desc               = "Aspeed 2600 SPI2 Controller";
1519     asc->r_conf            = R_CONF;
1520     asc->r_ce_ctrl         = R_CE_CTRL;
1521     asc->r_ctrl0           = R_CTRL0;
1522     asc->r_timings         = R_TIMINGS;
1523     asc->nregs_timings     = 1;
1524     asc->conf_enable_w0    = CONF_ENABLE_W0;
1525     asc->max_peripherals   = 2;
1526     asc->segments          = aspeed_2500_spi2_segments;
1527     asc->segment_addr_mask = 0xffff0000;
1528     asc->flash_window_base = 0x38000000;
1529     asc->flash_window_size = 0x8000000;
1530     asc->features          = 0x0;
1531     asc->nregs             = ASPEED_SMC_R_MAX;
1532     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1533     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1534     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1535 }
1536 
1537 static const TypeInfo aspeed_2500_spi2_info = {
1538     .name =  "aspeed.spi2-ast2500",
1539     .parent = TYPE_ASPEED_SMC,
1540     .class_init = aspeed_2500_spi2_class_init,
1541 };
1542 
1543 /*
1544  * The Segment Registers of the AST2600 have a 1MB unit. The address
1545  * range of a flash SPI peripheral is encoded with offsets in the overall
1546  * controller window. The previous SoC AST2400 and AST2500 used
1547  * absolute addresses. Only bits [27:20] are relevant and the end
1548  * address is an upper bound limit.
1549  */
1550 #define AST2600_SEG_ADDR_MASK 0x0ff00000
1551 
1552 static uint32_t aspeed_2600_smc_segment_to_reg(const AspeedSMCState *s,
1553                                                const AspeedSegments *seg)
1554 {
1555     uint32_t reg = 0;
1556 
1557     /* Disabled segments have a nil register */
1558     if (!seg->size) {
1559         return 0;
1560     }
1561 
1562     reg |= (seg->addr & AST2600_SEG_ADDR_MASK) >> 16; /* start offset */
1563     reg |= (seg->addr + seg->size - 1) & AST2600_SEG_ADDR_MASK; /* end offset */
1564     return reg;
1565 }
1566 
1567 static void aspeed_2600_smc_reg_to_segment(const AspeedSMCState *s,
1568                                            uint32_t reg, AspeedSegments *seg)
1569 {
1570     uint32_t start_offset = (reg << 16) & AST2600_SEG_ADDR_MASK;
1571     uint32_t end_offset = reg & AST2600_SEG_ADDR_MASK;
1572     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1573 
1574     if (reg) {
1575         seg->addr = asc->flash_window_base + start_offset;
1576         seg->size = end_offset + MiB - start_offset;
1577     } else {
1578         seg->addr = asc->flash_window_base;
1579         seg->size = 0;
1580     }
1581 }
1582 
1583 static const uint32_t aspeed_2600_fmc_resets[ASPEED_SMC_R_MAX] = {
1584     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1585                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1 |
1586                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE2),
1587 };
1588 
1589 static const AspeedSegments aspeed_2600_fmc_segments[] = {
1590     { 0x0, 128 * MiB }, /* start address is readonly */
1591     { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
1592     { 0x0, 0 }, /* disabled */
1593 };
1594 
1595 static void aspeed_2600_fmc_class_init(ObjectClass *klass, void *data)
1596 {
1597     DeviceClass *dc = DEVICE_CLASS(klass);
1598     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1599 
1600     dc->desc               = "Aspeed 2600 FMC Controller";
1601     asc->r_conf            = R_CONF;
1602     asc->r_ce_ctrl         = R_CE_CTRL;
1603     asc->r_ctrl0           = R_CTRL0;
1604     asc->r_timings         = R_TIMINGS;
1605     asc->nregs_timings     = 1;
1606     asc->conf_enable_w0    = CONF_ENABLE_W0;
1607     asc->max_peripherals   = 3;
1608     asc->segments          = aspeed_2600_fmc_segments;
1609     asc->segment_addr_mask = 0x0ff00ff0;
1610     asc->resets            = aspeed_2600_fmc_resets;
1611     asc->flash_window_base = 0x20000000;
1612     asc->flash_window_size = 0x10000000;
1613     asc->features          = ASPEED_SMC_FEATURE_DMA |
1614                              ASPEED_SMC_FEATURE_WDT_CONTROL;
1615     asc->dma_flash_mask    = 0x0FFFFFFC;
1616     asc->dma_dram_mask     = 0x3FFFFFFC;
1617     asc->nregs             = ASPEED_SMC_R_MAX;
1618     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1619     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1620     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1621 }
1622 
1623 static const TypeInfo aspeed_2600_fmc_info = {
1624     .name =  "aspeed.fmc-ast2600",
1625     .parent = TYPE_ASPEED_SMC,
1626     .class_init = aspeed_2600_fmc_class_init,
1627 };
1628 
1629 static const AspeedSegments aspeed_2600_spi1_segments[] = {
1630     { 0x0, 128 * MiB }, /* start address is readonly */
1631     { 0x0, 0 }, /* disabled */
1632 };
1633 
1634 static void aspeed_2600_spi1_class_init(ObjectClass *klass, void *data)
1635 {
1636     DeviceClass *dc = DEVICE_CLASS(klass);
1637     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1638 
1639     dc->desc               = "Aspeed 2600 SPI1 Controller";
1640     asc->r_conf            = R_CONF;
1641     asc->r_ce_ctrl         = R_CE_CTRL;
1642     asc->r_ctrl0           = R_CTRL0;
1643     asc->r_timings         = R_TIMINGS;
1644     asc->nregs_timings     = 2;
1645     asc->conf_enable_w0    = CONF_ENABLE_W0;
1646     asc->max_peripherals   = 2;
1647     asc->segments          = aspeed_2600_spi1_segments;
1648     asc->segment_addr_mask = 0x0ff00ff0;
1649     asc->flash_window_base = 0x30000000;
1650     asc->flash_window_size = 0x10000000;
1651     asc->features          = ASPEED_SMC_FEATURE_DMA |
1652                              ASPEED_SMC_FEATURE_DMA_GRANT;
1653     asc->dma_flash_mask    = 0x0FFFFFFC;
1654     asc->dma_dram_mask     = 0x3FFFFFFC;
1655     asc->nregs             = ASPEED_SMC_R_MAX;
1656     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1657     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1658     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1659 }
1660 
1661 static const TypeInfo aspeed_2600_spi1_info = {
1662     .name =  "aspeed.spi1-ast2600",
1663     .parent = TYPE_ASPEED_SMC,
1664     .class_init = aspeed_2600_spi1_class_init,
1665 };
1666 
1667 static const AspeedSegments aspeed_2600_spi2_segments[] = {
1668     { 0x0, 128 * MiB }, /* start address is readonly */
1669     { 0x0, 0 }, /* disabled */
1670     { 0x0, 0 }, /* disabled */
1671 };
1672 
1673 static void aspeed_2600_spi2_class_init(ObjectClass *klass, void *data)
1674 {
1675     DeviceClass *dc = DEVICE_CLASS(klass);
1676     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1677 
1678     dc->desc               = "Aspeed 2600 SPI2 Controller";
1679     asc->r_conf            = R_CONF;
1680     asc->r_ce_ctrl         = R_CE_CTRL;
1681     asc->r_ctrl0           = R_CTRL0;
1682     asc->r_timings         = R_TIMINGS;
1683     asc->nregs_timings     = 3;
1684     asc->conf_enable_w0    = CONF_ENABLE_W0;
1685     asc->max_peripherals   = 3;
1686     asc->segments          = aspeed_2600_spi2_segments;
1687     asc->segment_addr_mask = 0x0ff00ff0;
1688     asc->flash_window_base = 0x50000000;
1689     asc->flash_window_size = 0x10000000;
1690     asc->features          = ASPEED_SMC_FEATURE_DMA |
1691                              ASPEED_SMC_FEATURE_DMA_GRANT;
1692     asc->dma_flash_mask    = 0x0FFFFFFC;
1693     asc->dma_dram_mask     = 0x3FFFFFFC;
1694     asc->nregs             = ASPEED_SMC_R_MAX;
1695     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1696     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1697     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1698 }
1699 
1700 static const TypeInfo aspeed_2600_spi2_info = {
1701     .name =  "aspeed.spi2-ast2600",
1702     .parent = TYPE_ASPEED_SMC,
1703     .class_init = aspeed_2600_spi2_class_init,
1704 };
1705 
1706 static void aspeed_smc_register_types(void)
1707 {
1708     type_register_static(&aspeed_smc_flash_info);
1709     type_register_static(&aspeed_smc_info);
1710     type_register_static(&aspeed_2400_smc_info);
1711     type_register_static(&aspeed_2400_fmc_info);
1712     type_register_static(&aspeed_2400_spi1_info);
1713     type_register_static(&aspeed_2500_fmc_info);
1714     type_register_static(&aspeed_2500_spi1_info);
1715     type_register_static(&aspeed_2500_spi2_info);
1716     type_register_static(&aspeed_2600_fmc_info);
1717     type_register_static(&aspeed_2600_spi1_info);
1718     type_register_static(&aspeed_2600_spi2_info);
1719 }
1720 
1721 type_init(aspeed_smc_register_types)
1722