1 /* 2 * ASPEED AST2400 SMC Controller (SPI Flash Only) 3 * 4 * Copyright (C) 2016 IBM Corp. 5 * 6 * Permission is hereby granted, free of charge, to any person obtaining a copy 7 * of this software and associated documentation files (the "Software"), to deal 8 * in the Software without restriction, including without limitation the rights 9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 * copies of the Software, and to permit persons to whom the Software is 11 * furnished to do so, subject to the following conditions: 12 * 13 * The above copyright notice and this permission notice shall be included in 14 * all copies or substantial portions of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 * THE SOFTWARE. 23 */ 24 25 #include "qemu/osdep.h" 26 #include "hw/sysbus.h" 27 #include "sysemu/sysemu.h" 28 #include "qemu/log.h" 29 #include "include/qemu/error-report.h" 30 #include "exec/address-spaces.h" 31 32 #include "hw/ssi/aspeed_smc.h" 33 34 /* CE Type Setting Register */ 35 #define R_CONF (0x00 / 4) 36 #define CONF_LEGACY_DISABLE (1 << 31) 37 #define CONF_ENABLE_W4 20 38 #define CONF_ENABLE_W3 19 39 #define CONF_ENABLE_W2 18 40 #define CONF_ENABLE_W1 17 41 #define CONF_ENABLE_W0 16 42 #define CONF_FLASH_TYPE4 8 43 #define CONF_FLASH_TYPE3 6 44 #define CONF_FLASH_TYPE2 4 45 #define CONF_FLASH_TYPE1 2 46 #define CONF_FLASH_TYPE0 0 47 #define CONF_FLASH_TYPE_NOR 0x0 48 #define CONF_FLASH_TYPE_NAND 0x1 49 #define CONF_FLASH_TYPE_SPI 0x2 50 51 /* CE Control Register */ 52 #define R_CE_CTRL (0x04 / 4) 53 #define CTRL_EXTENDED4 4 /* 32 bit addressing for SPI */ 54 #define CTRL_EXTENDED3 3 /* 32 bit addressing for SPI */ 55 #define CTRL_EXTENDED2 2 /* 32 bit addressing for SPI */ 56 #define CTRL_EXTENDED1 1 /* 32 bit addressing for SPI */ 57 #define CTRL_EXTENDED0 0 /* 32 bit addressing for SPI */ 58 59 /* Interrupt Control and Status Register */ 60 #define R_INTR_CTRL (0x08 / 4) 61 #define INTR_CTRL_DMA_STATUS (1 << 11) 62 #define INTR_CTRL_CMD_ABORT_STATUS (1 << 10) 63 #define INTR_CTRL_WRITE_PROTECT_STATUS (1 << 9) 64 #define INTR_CTRL_DMA_EN (1 << 3) 65 #define INTR_CTRL_CMD_ABORT_EN (1 << 2) 66 #define INTR_CTRL_WRITE_PROTECT_EN (1 << 1) 67 68 /* CEx Control Register */ 69 #define R_CTRL0 (0x10 / 4) 70 #define CTRL_CMD_SHIFT 16 71 #define CTRL_CMD_MASK 0xff 72 #define CTRL_DUMMY_HIGH_SHIFT 14 73 #define CTRL_AST2400_SPI_4BYTE (1 << 13) 74 #define CTRL_DUMMY_LOW_SHIFT 6 /* 2 bits [7:6] */ 75 #define CTRL_CE_STOP_ACTIVE (1 << 2) 76 #define CTRL_CMD_MODE_MASK 0x3 77 #define CTRL_READMODE 0x0 78 #define CTRL_FREADMODE 0x1 79 #define CTRL_WRITEMODE 0x2 80 #define CTRL_USERMODE 0x3 81 #define R_CTRL1 (0x14 / 4) 82 #define R_CTRL2 (0x18 / 4) 83 #define R_CTRL3 (0x1C / 4) 84 #define R_CTRL4 (0x20 / 4) 85 86 /* CEx Segment Address Register */ 87 #define R_SEG_ADDR0 (0x30 / 4) 88 #define SEG_END_SHIFT 24 /* 8MB units */ 89 #define SEG_END_MASK 0xff 90 #define SEG_START_SHIFT 16 /* address bit [A29-A23] */ 91 #define SEG_START_MASK 0xff 92 #define R_SEG_ADDR1 (0x34 / 4) 93 #define R_SEG_ADDR2 (0x38 / 4) 94 #define R_SEG_ADDR3 (0x3C / 4) 95 #define R_SEG_ADDR4 (0x40 / 4) 96 97 /* Misc Control Register #1 */ 98 #define R_MISC_CTRL1 (0x50 / 4) 99 100 /* Misc Control Register #2 */ 101 #define R_MISC_CTRL2 (0x54 / 4) 102 103 /* DMA Control/Status Register */ 104 #define R_DMA_CTRL (0x80 / 4) 105 #define DMA_CTRL_DELAY_MASK 0xf 106 #define DMA_CTRL_DELAY_SHIFT 8 107 #define DMA_CTRL_FREQ_MASK 0xf 108 #define DMA_CTRL_FREQ_SHIFT 4 109 #define DMA_CTRL_MODE (1 << 3) 110 #define DMA_CTRL_CKSUM (1 << 2) 111 #define DMA_CTRL_DIR (1 << 1) 112 #define DMA_CTRL_EN (1 << 0) 113 114 /* DMA Flash Side Address */ 115 #define R_DMA_FLASH_ADDR (0x84 / 4) 116 117 /* DMA DRAM Side Address */ 118 #define R_DMA_DRAM_ADDR (0x88 / 4) 119 120 /* DMA Length Register */ 121 #define R_DMA_LEN (0x8C / 4) 122 123 /* Checksum Calculation Result */ 124 #define R_DMA_CHECKSUM (0x90 / 4) 125 126 /* Misc Control Register #2 */ 127 #define R_TIMINGS (0x94 / 4) 128 129 /* SPI controller registers and bits */ 130 #define R_SPI_CONF (0x00 / 4) 131 #define SPI_CONF_ENABLE_W0 0 132 #define R_SPI_CTRL0 (0x4 / 4) 133 #define R_SPI_MISC_CTRL (0x10 / 4) 134 #define R_SPI_TIMINGS (0x14 / 4) 135 136 #define ASPEED_SMC_R_SPI_MAX (0x20 / 4) 137 #define ASPEED_SMC_R_SMC_MAX (0x20 / 4) 138 139 #define ASPEED_SOC_SMC_FLASH_BASE 0x10000000 140 #define ASPEED_SOC_FMC_FLASH_BASE 0x20000000 141 #define ASPEED_SOC_SPI_FLASH_BASE 0x30000000 142 #define ASPEED_SOC_SPI2_FLASH_BASE 0x38000000 143 144 /* Flash opcodes. */ 145 #define SPI_OP_READ 0x03 /* Read data bytes (low frequency) */ 146 147 /* 148 * Default segments mapping addresses and size for each slave per 149 * controller. These can be changed when board is initialized with the 150 * Segment Address Registers. 151 */ 152 static const AspeedSegments aspeed_segments_legacy[] = { 153 { 0x10000000, 32 * 1024 * 1024 }, 154 }; 155 156 static const AspeedSegments aspeed_segments_fmc[] = { 157 { 0x20000000, 64 * 1024 * 1024 }, /* start address is readonly */ 158 { 0x24000000, 32 * 1024 * 1024 }, 159 { 0x26000000, 32 * 1024 * 1024 }, 160 { 0x28000000, 32 * 1024 * 1024 }, 161 { 0x2A000000, 32 * 1024 * 1024 } 162 }; 163 164 static const AspeedSegments aspeed_segments_spi[] = { 165 { 0x30000000, 64 * 1024 * 1024 }, 166 }; 167 168 static const AspeedSegments aspeed_segments_ast2500_fmc[] = { 169 { 0x20000000, 128 * 1024 * 1024 }, /* start address is readonly */ 170 { 0x28000000, 32 * 1024 * 1024 }, 171 { 0x2A000000, 32 * 1024 * 1024 }, 172 }; 173 174 static const AspeedSegments aspeed_segments_ast2500_spi1[] = { 175 { 0x30000000, 32 * 1024 * 1024 }, /* start address is readonly */ 176 { 0x32000000, 96 * 1024 * 1024 }, /* end address is readonly */ 177 }; 178 179 static const AspeedSegments aspeed_segments_ast2500_spi2[] = { 180 { 0x38000000, 32 * 1024 * 1024 }, /* start address is readonly */ 181 { 0x3A000000, 96 * 1024 * 1024 }, /* end address is readonly */ 182 }; 183 184 static const AspeedSMCController controllers[] = { 185 { 186 .name = "aspeed.smc.smc", 187 .r_conf = R_CONF, 188 .r_ce_ctrl = R_CE_CTRL, 189 .r_ctrl0 = R_CTRL0, 190 .r_timings = R_TIMINGS, 191 .conf_enable_w0 = CONF_ENABLE_W0, 192 .max_slaves = 5, 193 .segments = aspeed_segments_legacy, 194 .flash_window_base = ASPEED_SOC_SMC_FLASH_BASE, 195 .flash_window_size = 0x6000000, 196 .has_dma = false, 197 .nregs = ASPEED_SMC_R_SMC_MAX, 198 }, { 199 .name = "aspeed.smc.fmc", 200 .r_conf = R_CONF, 201 .r_ce_ctrl = R_CE_CTRL, 202 .r_ctrl0 = R_CTRL0, 203 .r_timings = R_TIMINGS, 204 .conf_enable_w0 = CONF_ENABLE_W0, 205 .max_slaves = 5, 206 .segments = aspeed_segments_fmc, 207 .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE, 208 .flash_window_size = 0x10000000, 209 .has_dma = true, 210 .nregs = ASPEED_SMC_R_MAX, 211 }, { 212 .name = "aspeed.smc.spi", 213 .r_conf = R_SPI_CONF, 214 .r_ce_ctrl = 0xff, 215 .r_ctrl0 = R_SPI_CTRL0, 216 .r_timings = R_SPI_TIMINGS, 217 .conf_enable_w0 = SPI_CONF_ENABLE_W0, 218 .max_slaves = 1, 219 .segments = aspeed_segments_spi, 220 .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE, 221 .flash_window_size = 0x10000000, 222 .has_dma = false, 223 .nregs = ASPEED_SMC_R_SPI_MAX, 224 }, { 225 .name = "aspeed.smc.ast2500-fmc", 226 .r_conf = R_CONF, 227 .r_ce_ctrl = R_CE_CTRL, 228 .r_ctrl0 = R_CTRL0, 229 .r_timings = R_TIMINGS, 230 .conf_enable_w0 = CONF_ENABLE_W0, 231 .max_slaves = 3, 232 .segments = aspeed_segments_ast2500_fmc, 233 .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE, 234 .flash_window_size = 0x10000000, 235 .has_dma = true, 236 .nregs = ASPEED_SMC_R_MAX, 237 }, { 238 .name = "aspeed.smc.ast2500-spi1", 239 .r_conf = R_CONF, 240 .r_ce_ctrl = R_CE_CTRL, 241 .r_ctrl0 = R_CTRL0, 242 .r_timings = R_TIMINGS, 243 .conf_enable_w0 = CONF_ENABLE_W0, 244 .max_slaves = 2, 245 .segments = aspeed_segments_ast2500_spi1, 246 .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE, 247 .flash_window_size = 0x8000000, 248 .has_dma = false, 249 .nregs = ASPEED_SMC_R_MAX, 250 }, { 251 .name = "aspeed.smc.ast2500-spi2", 252 .r_conf = R_CONF, 253 .r_ce_ctrl = R_CE_CTRL, 254 .r_ctrl0 = R_CTRL0, 255 .r_timings = R_TIMINGS, 256 .conf_enable_w0 = CONF_ENABLE_W0, 257 .max_slaves = 2, 258 .segments = aspeed_segments_ast2500_spi2, 259 .flash_window_base = ASPEED_SOC_SPI2_FLASH_BASE, 260 .flash_window_size = 0x8000000, 261 .has_dma = false, 262 .nregs = ASPEED_SMC_R_MAX, 263 }, 264 }; 265 266 /* 267 * The Segment Register uses a 8MB unit to encode the start address 268 * and the end address of the mapping window of a flash SPI slave : 269 * 270 * | byte 1 | byte 2 | byte 3 | byte 4 | 271 * +--------+--------+--------+--------+ 272 * | end | start | 0 | 0 | 273 * 274 */ 275 static inline uint32_t aspeed_smc_segment_to_reg(const AspeedSegments *seg) 276 { 277 uint32_t reg = 0; 278 reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT; 279 reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT; 280 return reg; 281 } 282 283 static inline void aspeed_smc_reg_to_segment(uint32_t reg, AspeedSegments *seg) 284 { 285 seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23; 286 seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr; 287 } 288 289 static bool aspeed_smc_flash_overlap(const AspeedSMCState *s, 290 const AspeedSegments *new, 291 int cs) 292 { 293 AspeedSegments seg; 294 int i; 295 296 for (i = 0; i < s->ctrl->max_slaves; i++) { 297 if (i == cs) { 298 continue; 299 } 300 301 aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + i], &seg); 302 303 if (new->addr + new->size > seg.addr && 304 new->addr < seg.addr + seg.size) { 305 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment CS%d [ 0x%" 306 HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with " 307 "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 308 s->ctrl->name, cs, new->addr, new->addr + new->size, 309 i, seg.addr, seg.addr + seg.size); 310 return true; 311 } 312 } 313 return false; 314 } 315 316 static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs, 317 uint64_t new) 318 { 319 AspeedSMCFlash *fl = &s->flashes[cs]; 320 AspeedSegments seg; 321 322 aspeed_smc_reg_to_segment(new, &seg); 323 324 /* The start address of CS0 is read-only */ 325 if (cs == 0 && seg.addr != s->ctrl->flash_window_base) { 326 qemu_log_mask(LOG_GUEST_ERROR, 327 "%s: Tried to change CS0 start address to 0x%" 328 HWADDR_PRIx "\n", s->ctrl->name, seg.addr); 329 seg.addr = s->ctrl->flash_window_base; 330 new = aspeed_smc_segment_to_reg(&seg); 331 } 332 333 /* 334 * The end address of the AST2500 spi controllers is also 335 * read-only. 336 */ 337 if ((s->ctrl->segments == aspeed_segments_ast2500_spi1 || 338 s->ctrl->segments == aspeed_segments_ast2500_spi2) && 339 cs == s->ctrl->max_slaves && 340 seg.addr + seg.size != s->ctrl->segments[cs].addr + 341 s->ctrl->segments[cs].size) { 342 qemu_log_mask(LOG_GUEST_ERROR, 343 "%s: Tried to change CS%d end address to 0x%" 344 HWADDR_PRIx "\n", s->ctrl->name, cs, seg.addr + seg.size); 345 seg.size = s->ctrl->segments[cs].addr + s->ctrl->segments[cs].size - 346 seg.addr; 347 new = aspeed_smc_segment_to_reg(&seg); 348 } 349 350 /* Keep the segment in the overall flash window */ 351 if (seg.addr + seg.size <= s->ctrl->flash_window_base || 352 seg.addr > s->ctrl->flash_window_base + s->ctrl->flash_window_size) { 353 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is invalid : " 354 "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 355 s->ctrl->name, cs, seg.addr, seg.addr + seg.size); 356 return; 357 } 358 359 /* Check start address vs. alignment */ 360 if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) { 361 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is not " 362 "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 363 s->ctrl->name, cs, seg.addr, seg.addr + seg.size); 364 } 365 366 /* And segments should not overlap (in the specs) */ 367 aspeed_smc_flash_overlap(s, &seg, cs); 368 369 /* All should be fine now to move the region */ 370 memory_region_transaction_begin(); 371 memory_region_set_size(&fl->mmio, seg.size); 372 memory_region_set_address(&fl->mmio, seg.addr - s->ctrl->flash_window_base); 373 memory_region_set_enabled(&fl->mmio, true); 374 memory_region_transaction_commit(); 375 376 s->regs[R_SEG_ADDR0 + cs] = new; 377 } 378 379 static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr, 380 unsigned size) 381 { 382 qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u" 383 PRIx64 "\n", __func__, addr, size); 384 return 0; 385 } 386 387 static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr, 388 uint64_t data, unsigned size) 389 { 390 qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u: 0x%" 391 PRIx64 "\n", __func__, addr, size, data); 392 } 393 394 static const MemoryRegionOps aspeed_smc_flash_default_ops = { 395 .read = aspeed_smc_flash_default_read, 396 .write = aspeed_smc_flash_default_write, 397 .endianness = DEVICE_LITTLE_ENDIAN, 398 .valid = { 399 .min_access_size = 1, 400 .max_access_size = 4, 401 }, 402 }; 403 404 static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl) 405 { 406 const AspeedSMCState *s = fl->controller; 407 408 return s->regs[s->r_ctrl0 + fl->id] & CTRL_CMD_MODE_MASK; 409 } 410 411 static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl) 412 { 413 const AspeedSMCState *s = fl->controller; 414 415 return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->id)); 416 } 417 418 static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl) 419 { 420 const AspeedSMCState *s = fl->controller; 421 int cmd = (s->regs[s->r_ctrl0 + fl->id] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK; 422 423 /* In read mode, the default SPI command is READ (0x3). In other 424 * modes, the command should necessarily be defined */ 425 if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) { 426 cmd = SPI_OP_READ; 427 } 428 429 if (!cmd) { 430 qemu_log_mask(LOG_GUEST_ERROR, "%s: no command defined for mode %d\n", 431 __func__, aspeed_smc_flash_mode(fl)); 432 } 433 434 return cmd; 435 } 436 437 static inline int aspeed_smc_flash_is_4byte(const AspeedSMCFlash *fl) 438 { 439 const AspeedSMCState *s = fl->controller; 440 441 if (s->ctrl->segments == aspeed_segments_spi) { 442 return s->regs[s->r_ctrl0] & CTRL_AST2400_SPI_4BYTE; 443 } else { 444 return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->id)); 445 } 446 } 447 448 static inline bool aspeed_smc_is_ce_stop_active(const AspeedSMCFlash *fl) 449 { 450 const AspeedSMCState *s = fl->controller; 451 452 return s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE; 453 } 454 455 static void aspeed_smc_flash_select(AspeedSMCFlash *fl) 456 { 457 AspeedSMCState *s = fl->controller; 458 459 s->regs[s->r_ctrl0 + fl->id] &= ~CTRL_CE_STOP_ACTIVE; 460 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 461 } 462 463 static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl) 464 { 465 AspeedSMCState *s = fl->controller; 466 467 s->regs[s->r_ctrl0 + fl->id] |= CTRL_CE_STOP_ACTIVE; 468 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 469 } 470 471 static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl, 472 uint32_t addr) 473 { 474 const AspeedSMCState *s = fl->controller; 475 AspeedSegments seg; 476 477 aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + fl->id], &seg); 478 if ((addr % seg.size) != addr) { 479 qemu_log_mask(LOG_GUEST_ERROR, 480 "%s: invalid address 0x%08x for CS%d segment : " 481 "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 482 s->ctrl->name, addr, fl->id, seg.addr, 483 seg.addr + seg.size); 484 addr %= seg.size; 485 } 486 487 return addr; 488 } 489 490 static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl) 491 { 492 const AspeedSMCState *s = fl->controller; 493 uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->id]; 494 uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1; 495 uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3; 496 497 return ((dummy_high << 2) | dummy_low) * 8; 498 } 499 500 static void aspeed_smc_flash_send_addr(AspeedSMCFlash *fl, uint32_t addr) 501 { 502 const AspeedSMCState *s = fl->controller; 503 uint8_t cmd = aspeed_smc_flash_cmd(fl); 504 505 /* Flash access can not exceed CS segment */ 506 addr = aspeed_smc_check_segment_addr(fl, addr); 507 508 ssi_transfer(s->spi, cmd); 509 510 if (aspeed_smc_flash_is_4byte(fl)) { 511 ssi_transfer(s->spi, (addr >> 24) & 0xff); 512 } 513 ssi_transfer(s->spi, (addr >> 16) & 0xff); 514 ssi_transfer(s->spi, (addr >> 8) & 0xff); 515 ssi_transfer(s->spi, (addr & 0xff)); 516 } 517 518 static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size) 519 { 520 AspeedSMCFlash *fl = opaque; 521 AspeedSMCState *s = fl->controller; 522 uint64_t ret = 0; 523 int i; 524 525 switch (aspeed_smc_flash_mode(fl)) { 526 case CTRL_USERMODE: 527 for (i = 0; i < size; i++) { 528 ret |= ssi_transfer(s->spi, 0x0) << (8 * i); 529 } 530 break; 531 case CTRL_READMODE: 532 case CTRL_FREADMODE: 533 aspeed_smc_flash_select(fl); 534 aspeed_smc_flash_send_addr(fl, addr); 535 536 /* 537 * Use fake transfers to model dummy bytes. The value should 538 * be configured to some non-zero value in fast read mode and 539 * zero in read mode. But, as the HW allows inconsistent 540 * settings, let's check for fast read mode. 541 */ 542 if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) { 543 for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) { 544 ssi_transfer(fl->controller->spi, 0xFF); 545 } 546 } 547 548 for (i = 0; i < size; i++) { 549 ret |= ssi_transfer(s->spi, 0x0) << (8 * i); 550 } 551 552 aspeed_smc_flash_unselect(fl); 553 break; 554 default: 555 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n", 556 __func__, aspeed_smc_flash_mode(fl)); 557 } 558 559 return ret; 560 } 561 562 static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data, 563 unsigned size) 564 { 565 AspeedSMCFlash *fl = opaque; 566 AspeedSMCState *s = fl->controller; 567 int i; 568 569 if (!aspeed_smc_is_writable(fl)) { 570 qemu_log_mask(LOG_GUEST_ERROR, "%s: flash is not writable at 0x%" 571 HWADDR_PRIx "\n", __func__, addr); 572 return; 573 } 574 575 switch (aspeed_smc_flash_mode(fl)) { 576 case CTRL_USERMODE: 577 for (i = 0; i < size; i++) { 578 ssi_transfer(s->spi, (data >> (8 * i)) & 0xff); 579 } 580 break; 581 case CTRL_WRITEMODE: 582 aspeed_smc_flash_select(fl); 583 aspeed_smc_flash_send_addr(fl, addr); 584 585 for (i = 0; i < size; i++) { 586 ssi_transfer(s->spi, (data >> (8 * i)) & 0xff); 587 } 588 589 aspeed_smc_flash_unselect(fl); 590 break; 591 default: 592 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n", 593 __func__, aspeed_smc_flash_mode(fl)); 594 } 595 } 596 597 static const MemoryRegionOps aspeed_smc_flash_ops = { 598 .read = aspeed_smc_flash_read, 599 .write = aspeed_smc_flash_write, 600 .endianness = DEVICE_LITTLE_ENDIAN, 601 .valid = { 602 .min_access_size = 1, 603 .max_access_size = 4, 604 }, 605 }; 606 607 static void aspeed_smc_flash_update_cs(AspeedSMCFlash *fl) 608 { 609 const AspeedSMCState *s = fl->controller; 610 611 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 612 } 613 614 static void aspeed_smc_reset(DeviceState *d) 615 { 616 AspeedSMCState *s = ASPEED_SMC(d); 617 int i; 618 619 memset(s->regs, 0, sizeof s->regs); 620 621 /* Pretend DMA is done (u-boot initialization) */ 622 s->regs[R_INTR_CTRL] = INTR_CTRL_DMA_STATUS; 623 624 /* Unselect all slaves */ 625 for (i = 0; i < s->num_cs; ++i) { 626 s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE; 627 qemu_set_irq(s->cs_lines[i], true); 628 } 629 630 /* setup default segment register values for all */ 631 for (i = 0; i < s->ctrl->max_slaves; ++i) { 632 s->regs[R_SEG_ADDR0 + i] = 633 aspeed_smc_segment_to_reg(&s->ctrl->segments[i]); 634 } 635 636 /* HW strapping for AST2500 FMC controllers */ 637 if (s->ctrl->segments == aspeed_segments_ast2500_fmc) { 638 /* flash type is fixed to SPI for CE0 and CE1 */ 639 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0); 640 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1); 641 642 /* 4BYTE mode is autodetected for CE0. Let's force it to 1 for 643 * now */ 644 s->regs[s->r_ce_ctrl] |= (1 << (CTRL_EXTENDED0)); 645 } 646 647 /* HW strapping for AST2400 FMC controllers (SCU70). Let's use the 648 * configuration of the palmetto-bmc machine */ 649 if (s->ctrl->segments == aspeed_segments_fmc) { 650 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0); 651 652 s->regs[s->r_ce_ctrl] |= (1 << (CTRL_EXTENDED0)); 653 } 654 } 655 656 static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size) 657 { 658 AspeedSMCState *s = ASPEED_SMC(opaque); 659 660 addr >>= 2; 661 662 if (addr == s->r_conf || 663 addr == s->r_timings || 664 addr == s->r_ce_ctrl || 665 addr == R_INTR_CTRL || 666 (addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) || 667 (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs)) { 668 return s->regs[addr]; 669 } else { 670 qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n", 671 __func__, addr); 672 return 0; 673 } 674 } 675 676 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data, 677 unsigned int size) 678 { 679 AspeedSMCState *s = ASPEED_SMC(opaque); 680 uint32_t value = data; 681 682 addr >>= 2; 683 684 if (addr == s->r_conf || 685 addr == s->r_timings || 686 addr == s->r_ce_ctrl) { 687 s->regs[addr] = value; 688 } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) { 689 int cs = addr - s->r_ctrl0; 690 s->regs[addr] = value; 691 aspeed_smc_flash_update_cs(&s->flashes[cs]); 692 } else if (addr >= R_SEG_ADDR0 && 693 addr < R_SEG_ADDR0 + s->ctrl->max_slaves) { 694 int cs = addr - R_SEG_ADDR0; 695 696 if (value != s->regs[R_SEG_ADDR0 + cs]) { 697 aspeed_smc_flash_set_segment(s, cs, value); 698 } 699 } else { 700 qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n", 701 __func__, addr); 702 return; 703 } 704 } 705 706 static const MemoryRegionOps aspeed_smc_ops = { 707 .read = aspeed_smc_read, 708 .write = aspeed_smc_write, 709 .endianness = DEVICE_LITTLE_ENDIAN, 710 .valid.unaligned = true, 711 }; 712 713 static void aspeed_smc_realize(DeviceState *dev, Error **errp) 714 { 715 SysBusDevice *sbd = SYS_BUS_DEVICE(dev); 716 AspeedSMCState *s = ASPEED_SMC(dev); 717 AspeedSMCClass *mc = ASPEED_SMC_GET_CLASS(s); 718 int i; 719 char name[32]; 720 hwaddr offset = 0; 721 722 s->ctrl = mc->ctrl; 723 724 /* keep a copy under AspeedSMCState to speed up accesses */ 725 s->r_conf = s->ctrl->r_conf; 726 s->r_ce_ctrl = s->ctrl->r_ce_ctrl; 727 s->r_ctrl0 = s->ctrl->r_ctrl0; 728 s->r_timings = s->ctrl->r_timings; 729 s->conf_enable_w0 = s->ctrl->conf_enable_w0; 730 731 /* Enforce some real HW limits */ 732 if (s->num_cs > s->ctrl->max_slaves) { 733 qemu_log_mask(LOG_GUEST_ERROR, "%s: num_cs cannot exceed: %d\n", 734 __func__, s->ctrl->max_slaves); 735 s->num_cs = s->ctrl->max_slaves; 736 } 737 738 s->spi = ssi_create_bus(dev, "spi"); 739 740 /* Setup cs_lines for slaves */ 741 sysbus_init_irq(sbd, &s->irq); 742 s->cs_lines = g_new0(qemu_irq, s->num_cs); 743 ssi_auto_connect_slaves(dev, s->cs_lines, s->spi); 744 745 for (i = 0; i < s->num_cs; ++i) { 746 sysbus_init_irq(sbd, &s->cs_lines[i]); 747 } 748 749 /* The memory region for the controller registers */ 750 memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s, 751 s->ctrl->name, s->ctrl->nregs * 4); 752 sysbus_init_mmio(sbd, &s->mmio); 753 754 /* 755 * The container memory region representing the address space 756 * window in which the flash modules are mapped. The size and 757 * address depends on the SoC model and controller type. 758 */ 759 snprintf(name, sizeof(name), "%s.flash", s->ctrl->name); 760 761 memory_region_init_io(&s->mmio_flash, OBJECT(s), 762 &aspeed_smc_flash_default_ops, s, name, 763 s->ctrl->flash_window_size); 764 sysbus_init_mmio(sbd, &s->mmio_flash); 765 766 s->flashes = g_new0(AspeedSMCFlash, s->ctrl->max_slaves); 767 768 /* 769 * Let's create a sub memory region for each possible slave. All 770 * have a configurable memory segment in the overall flash mapping 771 * window of the controller but, there is not necessarily a flash 772 * module behind to handle the memory accesses. This depends on 773 * the board configuration. 774 */ 775 for (i = 0; i < s->ctrl->max_slaves; ++i) { 776 AspeedSMCFlash *fl = &s->flashes[i]; 777 778 snprintf(name, sizeof(name), "%s.%d", s->ctrl->name, i); 779 780 fl->id = i; 781 fl->controller = s; 782 fl->size = s->ctrl->segments[i].size; 783 memory_region_init_io(&fl->mmio, OBJECT(s), &aspeed_smc_flash_ops, 784 fl, name, fl->size); 785 memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio); 786 offset += fl->size; 787 } 788 } 789 790 static const VMStateDescription vmstate_aspeed_smc = { 791 .name = "aspeed.smc", 792 .version_id = 1, 793 .minimum_version_id = 1, 794 .fields = (VMStateField[]) { 795 VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX), 796 VMSTATE_END_OF_LIST() 797 } 798 }; 799 800 static Property aspeed_smc_properties[] = { 801 DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1), 802 DEFINE_PROP_END_OF_LIST(), 803 }; 804 805 static void aspeed_smc_class_init(ObjectClass *klass, void *data) 806 { 807 DeviceClass *dc = DEVICE_CLASS(klass); 808 AspeedSMCClass *mc = ASPEED_SMC_CLASS(klass); 809 810 dc->realize = aspeed_smc_realize; 811 dc->reset = aspeed_smc_reset; 812 dc->props = aspeed_smc_properties; 813 dc->vmsd = &vmstate_aspeed_smc; 814 mc->ctrl = data; 815 } 816 817 static const TypeInfo aspeed_smc_info = { 818 .name = TYPE_ASPEED_SMC, 819 .parent = TYPE_SYS_BUS_DEVICE, 820 .instance_size = sizeof(AspeedSMCState), 821 .class_size = sizeof(AspeedSMCClass), 822 .abstract = true, 823 }; 824 825 static void aspeed_smc_register_types(void) 826 { 827 int i; 828 829 type_register_static(&aspeed_smc_info); 830 for (i = 0; i < ARRAY_SIZE(controllers); ++i) { 831 TypeInfo ti = { 832 .name = controllers[i].name, 833 .parent = TYPE_ASPEED_SMC, 834 .class_init = aspeed_smc_class_init, 835 .class_data = (void *)&controllers[i], 836 }; 837 type_register(&ti); 838 } 839 } 840 841 type_init(aspeed_smc_register_types) 842