xref: /openbmc/qemu/hw/ssi/aspeed_smc.c (revision 5857974d)
1 /*
2  * ASPEED AST2400 SMC Controller (SPI Flash Only)
3  *
4  * Copyright (C) 2016 IBM Corp.
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "hw/sysbus.h"
27 #include "migration/vmstate.h"
28 #include "qemu/log.h"
29 #include "qemu/module.h"
30 #include "qemu/error-report.h"
31 #include "qapi/error.h"
32 #include "qemu/units.h"
33 #include "trace.h"
34 
35 #include "hw/irq.h"
36 #include "hw/qdev-properties.h"
37 #include "hw/ssi/aspeed_smc.h"
38 
39 /* CE Type Setting Register */
40 #define R_CONF            (0x00 / 4)
41 #define   CONF_LEGACY_DISABLE  (1 << 31)
42 #define   CONF_ENABLE_W4       20
43 #define   CONF_ENABLE_W3       19
44 #define   CONF_ENABLE_W2       18
45 #define   CONF_ENABLE_W1       17
46 #define   CONF_ENABLE_W0       16
47 #define   CONF_FLASH_TYPE4     8
48 #define   CONF_FLASH_TYPE3     6
49 #define   CONF_FLASH_TYPE2     4
50 #define   CONF_FLASH_TYPE1     2
51 #define   CONF_FLASH_TYPE0     0
52 #define      CONF_FLASH_TYPE_NOR   0x0
53 #define      CONF_FLASH_TYPE_NAND  0x1
54 #define      CONF_FLASH_TYPE_SPI   0x2 /* AST2600 is SPI only */
55 
56 /* CE Control Register */
57 #define R_CE_CTRL            (0x04 / 4)
58 #define   CTRL_EXTENDED4       4  /* 32 bit addressing for SPI */
59 #define   CTRL_EXTENDED3       3  /* 32 bit addressing for SPI */
60 #define   CTRL_EXTENDED2       2  /* 32 bit addressing for SPI */
61 #define   CTRL_EXTENDED1       1  /* 32 bit addressing for SPI */
62 #define   CTRL_EXTENDED0       0  /* 32 bit addressing for SPI */
63 
64 /* Interrupt Control and Status Register */
65 #define R_INTR_CTRL       (0x08 / 4)
66 #define   INTR_CTRL_DMA_STATUS            (1 << 11)
67 #define   INTR_CTRL_CMD_ABORT_STATUS      (1 << 10)
68 #define   INTR_CTRL_WRITE_PROTECT_STATUS  (1 << 9)
69 #define   INTR_CTRL_DMA_EN                (1 << 3)
70 #define   INTR_CTRL_CMD_ABORT_EN          (1 << 2)
71 #define   INTR_CTRL_WRITE_PROTECT_EN      (1 << 1)
72 
73 /* Command Control Register */
74 #define R_CE_CMD_CTRL      (0x0C / 4)
75 #define   CTRL_ADDR_BYTE0_DISABLE_SHIFT       4
76 #define   CTRL_DATA_BYTE0_DISABLE_SHIFT       0
77 
78 #define aspeed_smc_addr_byte_enabled(s, i)                               \
79     (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_ADDR_BYTE0_DISABLE_SHIFT + (i)))))
80 #define aspeed_smc_data_byte_enabled(s, i)                               \
81     (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_DATA_BYTE0_DISABLE_SHIFT + (i)))))
82 
83 /* CEx Control Register */
84 #define R_CTRL0           (0x10 / 4)
85 #define   CTRL_IO_QPI              (1 << 31)
86 #define   CTRL_IO_QUAD_DATA        (1 << 30)
87 #define   CTRL_IO_DUAL_DATA        (1 << 29)
88 #define   CTRL_IO_DUAL_ADDR_DATA   (1 << 28) /* Includes dummies */
89 #define   CTRL_IO_QUAD_ADDR_DATA   (1 << 28) /* Includes dummies */
90 #define   CTRL_CMD_SHIFT           16
91 #define   CTRL_CMD_MASK            0xff
92 #define   CTRL_DUMMY_HIGH_SHIFT    14
93 #define   CTRL_AST2400_SPI_4BYTE   (1 << 13)
94 #define CE_CTRL_CLOCK_FREQ_SHIFT   8
95 #define CE_CTRL_CLOCK_FREQ_MASK    0xf
96 #define CE_CTRL_CLOCK_FREQ(div)                                         \
97     (((div) & CE_CTRL_CLOCK_FREQ_MASK) << CE_CTRL_CLOCK_FREQ_SHIFT)
98 #define   CTRL_DUMMY_LOW_SHIFT     6 /* 2 bits [7:6] */
99 #define   CTRL_CE_STOP_ACTIVE      (1 << 2)
100 #define   CTRL_CMD_MODE_MASK       0x3
101 #define     CTRL_READMODE          0x0
102 #define     CTRL_FREADMODE         0x1
103 #define     CTRL_WRITEMODE         0x2
104 #define     CTRL_USERMODE          0x3
105 #define R_CTRL1           (0x14 / 4)
106 #define R_CTRL2           (0x18 / 4)
107 #define R_CTRL3           (0x1C / 4)
108 #define R_CTRL4           (0x20 / 4)
109 
110 /* CEx Segment Address Register */
111 #define R_SEG_ADDR0       (0x30 / 4)
112 #define   SEG_END_SHIFT        24   /* 8MB units */
113 #define   SEG_END_MASK         0xff
114 #define   SEG_START_SHIFT      16   /* address bit [A29-A23] */
115 #define   SEG_START_MASK       0xff
116 #define R_SEG_ADDR1       (0x34 / 4)
117 #define R_SEG_ADDR2       (0x38 / 4)
118 #define R_SEG_ADDR3       (0x3C / 4)
119 #define R_SEG_ADDR4       (0x40 / 4)
120 
121 /* Misc Control Register #1 */
122 #define R_MISC_CTRL1      (0x50 / 4)
123 
124 /* SPI dummy cycle data */
125 #define R_DUMMY_DATA      (0x54 / 4)
126 
127 /* FMC_WDT2 Control/Status Register for Alternate Boot (AST2600) */
128 #define R_FMC_WDT2_CTRL   (0x64 / 4)
129 #define   FMC_WDT2_CTRL_ALT_BOOT_MODE    BIT(6) /* O: 2 chips 1: 1 chip */
130 #define   FMC_WDT2_CTRL_SINGLE_BOOT_MODE BIT(5)
131 #define   FMC_WDT2_CTRL_BOOT_SOURCE      BIT(4) /* O: primary 1: alternate */
132 #define   FMC_WDT2_CTRL_EN               BIT(0)
133 
134 /* DMA Control/Status Register */
135 #define R_DMA_CTRL        (0x80 / 4)
136 #define   DMA_CTRL_REQUEST      (1 << 31)
137 #define   DMA_CTRL_GRANT        (1 << 30)
138 #define   DMA_CTRL_DELAY_MASK   0xf
139 #define   DMA_CTRL_DELAY_SHIFT  8
140 #define   DMA_CTRL_FREQ_MASK    0xf
141 #define   DMA_CTRL_FREQ_SHIFT   4
142 #define   DMA_CTRL_CALIB        (1 << 3)
143 #define   DMA_CTRL_CKSUM        (1 << 2)
144 #define   DMA_CTRL_WRITE        (1 << 1)
145 #define   DMA_CTRL_ENABLE       (1 << 0)
146 
147 /* DMA Flash Side Address */
148 #define R_DMA_FLASH_ADDR  (0x84 / 4)
149 
150 /* DMA DRAM Side Address */
151 #define R_DMA_DRAM_ADDR   (0x88 / 4)
152 
153 /* DMA Length Register */
154 #define R_DMA_LEN         (0x8C / 4)
155 
156 /* Checksum Calculation Result */
157 #define R_DMA_CHECKSUM    (0x90 / 4)
158 
159 /* Read Timing Compensation Register */
160 #define R_TIMINGS         (0x94 / 4)
161 
162 /* SPI controller registers and bits (AST2400) */
163 #define R_SPI_CONF        (0x00 / 4)
164 #define   SPI_CONF_ENABLE_W0   0
165 #define R_SPI_CTRL0       (0x4 / 4)
166 #define R_SPI_MISC_CTRL   (0x10 / 4)
167 #define R_SPI_TIMINGS     (0x14 / 4)
168 
169 #define ASPEED_SMC_R_SPI_MAX (0x20 / 4)
170 #define ASPEED_SMC_R_SMC_MAX (0x20 / 4)
171 
172 /*
173  * DMA DRAM addresses should be 4 bytes aligned and the valid address
174  * range is 0x40000000 - 0x5FFFFFFF (AST2400)
175  *          0x80000000 - 0xBFFFFFFF (AST2500)
176  *
177  * DMA flash addresses should be 4 bytes aligned and the valid address
178  * range is 0x20000000 - 0x2FFFFFFF.
179  *
180  * DMA length is from 4 bytes to 32MB
181  *   0: 4 bytes
182  *   0x7FFFFF: 32M bytes
183  */
184 #define DMA_DRAM_ADDR(asc, val)   ((val) & (asc)->dma_dram_mask)
185 #define DMA_FLASH_ADDR(asc, val)  ((val) & (asc)->dma_flash_mask)
186 #define DMA_LENGTH(val)         ((val) & 0x01FFFFFC)
187 
188 /* Flash opcodes. */
189 #define SPI_OP_READ       0x03    /* Read data bytes (low frequency) */
190 
191 #define SNOOP_OFF         0xFF
192 #define SNOOP_START       0x0
193 
194 /*
195  * Default segments mapping addresses and size for each peripheral per
196  * controller. These can be changed when board is initialized with the
197  * Segment Address Registers.
198  */
199 static const AspeedSegments aspeed_2500_spi1_segments[];
200 static const AspeedSegments aspeed_2500_spi2_segments[];
201 
202 #define ASPEED_SMC_FEATURE_DMA       0x1
203 #define ASPEED_SMC_FEATURE_DMA_GRANT 0x2
204 #define ASPEED_SMC_FEATURE_WDT_CONTROL 0x4
205 
206 static inline bool aspeed_smc_has_dma(const AspeedSMCClass *asc)
207 {
208     return !!(asc->features & ASPEED_SMC_FEATURE_DMA);
209 }
210 
211 static inline bool aspeed_smc_has_wdt_control(const AspeedSMCClass *asc)
212 {
213     return !!(asc->features & ASPEED_SMC_FEATURE_WDT_CONTROL);
214 }
215 
216 #define aspeed_smc_error(fmt, ...)                                      \
217     qemu_log_mask(LOG_GUEST_ERROR, "%s: " fmt "\n", __func__, ## __VA_ARGS__)
218 
219 static bool aspeed_smc_flash_overlap(const AspeedSMCState *s,
220                                      const AspeedSegments *new,
221                                      int cs)
222 {
223     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
224     AspeedSegments seg;
225     int i;
226 
227     for (i = 0; i < asc->max_peripherals; i++) {
228         if (i == cs) {
229             continue;
230         }
231 
232         asc->reg_to_segment(s, s->regs[R_SEG_ADDR0 + i], &seg);
233 
234         if (new->addr + new->size > seg.addr &&
235             new->addr < seg.addr + seg.size) {
236             aspeed_smc_error("new segment CS%d [ 0x%"
237                              HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with "
238                              "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
239                              cs, new->addr, new->addr + new->size,
240                              i, seg.addr, seg.addr + seg.size);
241             return true;
242         }
243     }
244     return false;
245 }
246 
247 static void aspeed_smc_flash_set_segment_region(AspeedSMCState *s, int cs,
248                                                 uint64_t regval)
249 {
250     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
251     AspeedSMCFlash *fl = &s->flashes[cs];
252     AspeedSegments seg;
253 
254     asc->reg_to_segment(s, regval, &seg);
255 
256     memory_region_transaction_begin();
257     memory_region_set_size(&fl->mmio, seg.size);
258     memory_region_set_address(&fl->mmio, seg.addr - asc->flash_window_base);
259     memory_region_set_enabled(&fl->mmio, !!seg.size);
260     memory_region_transaction_commit();
261 
262     s->regs[R_SEG_ADDR0 + cs] = regval;
263 }
264 
265 static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
266                                          uint64_t new)
267 {
268     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
269     AspeedSegments seg;
270 
271     asc->reg_to_segment(s, new, &seg);
272 
273     trace_aspeed_smc_flash_set_segment(cs, new, seg.addr, seg.addr + seg.size);
274 
275     /* The start address of CS0 is read-only */
276     if (cs == 0 && seg.addr != asc->flash_window_base) {
277         aspeed_smc_error("Tried to change CS0 start address to 0x%"
278                          HWADDR_PRIx, seg.addr);
279         seg.addr = asc->flash_window_base;
280         new = asc->segment_to_reg(s, &seg);
281     }
282 
283     /*
284      * The end address of the AST2500 spi controllers is also
285      * read-only.
286      */
287     if ((asc->segments == aspeed_2500_spi1_segments ||
288          asc->segments == aspeed_2500_spi2_segments) &&
289         cs == asc->max_peripherals &&
290         seg.addr + seg.size != asc->segments[cs].addr +
291         asc->segments[cs].size) {
292         aspeed_smc_error("Tried to change CS%d end address to 0x%"
293                          HWADDR_PRIx, cs, seg.addr + seg.size);
294         seg.size = asc->segments[cs].addr + asc->segments[cs].size -
295             seg.addr;
296         new = asc->segment_to_reg(s, &seg);
297     }
298 
299     /* Keep the segment in the overall flash window */
300     if (seg.size &&
301         (seg.addr + seg.size <= asc->flash_window_base ||
302          seg.addr > asc->flash_window_base + asc->flash_window_size)) {
303         aspeed_smc_error("new segment for CS%d is invalid : "
304                          "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
305                          cs, seg.addr, seg.addr + seg.size);
306         return;
307     }
308 
309     /* Check start address vs. alignment */
310     if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) {
311         aspeed_smc_error("new segment for CS%d is not "
312                          "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
313                          cs, seg.addr, seg.addr + seg.size);
314     }
315 
316     /* And segments should not overlap (in the specs) */
317     aspeed_smc_flash_overlap(s, &seg, cs);
318 
319     /* All should be fine now to move the region */
320     aspeed_smc_flash_set_segment_region(s, cs, new);
321 }
322 
323 static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr,
324                                               unsigned size)
325 {
326     aspeed_smc_error("To 0x%" HWADDR_PRIx " of size %u" PRIx64, addr, size);
327     return 0;
328 }
329 
330 static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr,
331                                            uint64_t data, unsigned size)
332 {
333     aspeed_smc_error("To 0x%" HWADDR_PRIx " of size %u: 0x%" PRIx64,
334                      addr, size, data);
335 }
336 
337 static const MemoryRegionOps aspeed_smc_flash_default_ops = {
338     .read = aspeed_smc_flash_default_read,
339     .write = aspeed_smc_flash_default_write,
340     .endianness = DEVICE_LITTLE_ENDIAN,
341     .valid = {
342         .min_access_size = 1,
343         .max_access_size = 4,
344     },
345 };
346 
347 static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl)
348 {
349     const AspeedSMCState *s = fl->controller;
350 
351     return s->regs[s->r_ctrl0 + fl->cs] & CTRL_CMD_MODE_MASK;
352 }
353 
354 static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl)
355 {
356     const AspeedSMCState *s = fl->controller;
357 
358     return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->cs));
359 }
360 
361 static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl)
362 {
363     const AspeedSMCState *s = fl->controller;
364     int cmd = (s->regs[s->r_ctrl0 + fl->cs] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK;
365 
366     /*
367      * In read mode, the default SPI command is READ (0x3). In other
368      * modes, the command should necessarily be defined
369      *
370      * TODO: add support for READ4 (0x13) on AST2600
371      */
372     if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) {
373         cmd = SPI_OP_READ;
374     }
375 
376     if (!cmd) {
377         aspeed_smc_error("no command defined for mode %d",
378                          aspeed_smc_flash_mode(fl));
379     }
380 
381     return cmd;
382 }
383 
384 static inline int aspeed_smc_flash_addr_width(const AspeedSMCFlash *fl)
385 {
386     const AspeedSMCState *s = fl->controller;
387     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
388 
389     if (asc->addr_width) {
390         return asc->addr_width(s);
391     } else {
392         return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->cs)) ? 4 : 3;
393     }
394 }
395 
396 static void aspeed_smc_flash_do_select(AspeedSMCFlash *fl, bool unselect)
397 {
398     AspeedSMCState *s = fl->controller;
399 
400     trace_aspeed_smc_flash_select(fl->cs, unselect ? "un" : "");
401 
402     qemu_set_irq(s->cs_lines[fl->cs], unselect);
403 }
404 
405 static void aspeed_smc_flash_select(AspeedSMCFlash *fl)
406 {
407     aspeed_smc_flash_do_select(fl, false);
408 }
409 
410 static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl)
411 {
412     aspeed_smc_flash_do_select(fl, true);
413 }
414 
415 static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
416                                               uint32_t addr)
417 {
418     const AspeedSMCState *s = fl->controller;
419     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
420     AspeedSegments seg;
421 
422     asc->reg_to_segment(s, s->regs[R_SEG_ADDR0 + fl->cs], &seg);
423     if ((addr % seg.size) != addr) {
424         aspeed_smc_error("invalid address 0x%08x for CS%d segment : "
425                          "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
426                          addr, fl->cs, seg.addr, seg.addr + seg.size);
427         addr %= seg.size;
428     }
429 
430     return addr;
431 }
432 
433 static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl)
434 {
435     const AspeedSMCState *s = fl->controller;
436     uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->cs];
437     uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1;
438     uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3;
439     uint32_t dummies = ((dummy_high << 2) | dummy_low) * 8;
440 
441     if (r_ctrl0 & CTRL_IO_DUAL_ADDR_DATA) {
442         dummies /= 2;
443     }
444 
445     return dummies;
446 }
447 
448 static void aspeed_smc_flash_setup(AspeedSMCFlash *fl, uint32_t addr)
449 {
450     const AspeedSMCState *s = fl->controller;
451     uint8_t cmd = aspeed_smc_flash_cmd(fl);
452     int i = aspeed_smc_flash_addr_width(fl);
453 
454     /* Flash access can not exceed CS segment */
455     addr = aspeed_smc_check_segment_addr(fl, addr);
456 
457     ssi_transfer(s->spi, cmd);
458     while (i--) {
459         if (aspeed_smc_addr_byte_enabled(s, i)) {
460             ssi_transfer(s->spi, (addr >> (i * 8)) & 0xff);
461         }
462     }
463 
464     /*
465      * Use fake transfers to model dummy bytes. The value should
466      * be configured to some non-zero value in fast read mode and
467      * zero in read mode. But, as the HW allows inconsistent
468      * settings, let's check for fast read mode.
469      */
470     if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) {
471         for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) {
472             ssi_transfer(fl->controller->spi, s->regs[R_DUMMY_DATA] & 0xff);
473         }
474     }
475 }
476 
477 static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
478 {
479     AspeedSMCFlash *fl = opaque;
480     AspeedSMCState *s = fl->controller;
481     uint64_t ret = 0;
482     int i;
483 
484     switch (aspeed_smc_flash_mode(fl)) {
485     case CTRL_USERMODE:
486         for (i = 0; i < size; i++) {
487             ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
488         }
489         break;
490     case CTRL_READMODE:
491     case CTRL_FREADMODE:
492         aspeed_smc_flash_select(fl);
493         aspeed_smc_flash_setup(fl, addr);
494 
495         for (i = 0; i < size; i++) {
496             ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
497         }
498 
499         aspeed_smc_flash_unselect(fl);
500         break;
501     default:
502         aspeed_smc_error("invalid flash mode %d", aspeed_smc_flash_mode(fl));
503     }
504 
505     trace_aspeed_smc_flash_read(fl->cs, addr, size, ret,
506                                 aspeed_smc_flash_mode(fl));
507     return ret;
508 }
509 
510 /*
511  * TODO (clg@kaod.org): stolen from xilinx_spips.c. Should move to a
512  * common include header.
513  */
514 typedef enum {
515     READ = 0x3,         READ_4 = 0x13,
516     FAST_READ = 0xb,    FAST_READ_4 = 0x0c,
517     DOR = 0x3b,         DOR_4 = 0x3c,
518     QOR = 0x6b,         QOR_4 = 0x6c,
519     DIOR = 0xbb,        DIOR_4 = 0xbc,
520     QIOR = 0xeb,        QIOR_4 = 0xec,
521 
522     PP = 0x2,           PP_4 = 0x12,
523     DPP = 0xa2,
524     QPP = 0x32,         QPP_4 = 0x34,
525 } FlashCMD;
526 
527 static int aspeed_smc_num_dummies(uint8_t command)
528 {
529     switch (command) { /* check for dummies */
530     case READ: /* no dummy bytes/cycles */
531     case PP:
532     case DPP:
533     case QPP:
534     case READ_4:
535     case PP_4:
536     case QPP_4:
537         return 0;
538     case FAST_READ:
539     case DOR:
540     case QOR:
541     case FAST_READ_4:
542     case DOR_4:
543     case QOR_4:
544         return 1;
545     case DIOR:
546     case DIOR_4:
547         return 2;
548     case QIOR:
549     case QIOR_4:
550         return 4;
551     default:
552         return -1;
553     }
554 }
555 
556 static bool aspeed_smc_do_snoop(AspeedSMCFlash *fl,  uint64_t data,
557                                 unsigned size)
558 {
559     AspeedSMCState *s = fl->controller;
560     uint8_t addr_width = aspeed_smc_flash_addr_width(fl);
561 
562     trace_aspeed_smc_do_snoop(fl->cs, s->snoop_index, s->snoop_dummies,
563                               (uint8_t) data & 0xff);
564 
565     if (s->snoop_index == SNOOP_OFF) {
566         return false; /* Do nothing */
567 
568     } else if (s->snoop_index == SNOOP_START) {
569         uint8_t cmd = data & 0xff;
570         int ndummies = aspeed_smc_num_dummies(cmd);
571 
572         /*
573          * No dummy cycles are expected with the current command. Turn
574          * off snooping and let the transfer proceed normally.
575          */
576         if (ndummies <= 0) {
577             s->snoop_index = SNOOP_OFF;
578             return false;
579         }
580 
581         s->snoop_dummies = ndummies * 8;
582 
583     } else if (s->snoop_index >= addr_width + 1) {
584 
585         /* The SPI transfer has reached the dummy cycles sequence */
586         for (; s->snoop_dummies; s->snoop_dummies--) {
587             ssi_transfer(s->spi, s->regs[R_DUMMY_DATA] & 0xff);
588         }
589 
590         /* If no more dummy cycles are expected, turn off snooping */
591         if (!s->snoop_dummies) {
592             s->snoop_index = SNOOP_OFF;
593         } else {
594             s->snoop_index += size;
595         }
596 
597         /*
598          * Dummy cycles have been faked already. Ignore the current
599          * SPI transfer
600          */
601         return true;
602     }
603 
604     s->snoop_index += size;
605     return false;
606 }
607 
608 static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,
609                                    unsigned size)
610 {
611     AspeedSMCFlash *fl = opaque;
612     AspeedSMCState *s = fl->controller;
613     int i;
614 
615     trace_aspeed_smc_flash_write(fl->cs, addr, size, data,
616                                  aspeed_smc_flash_mode(fl));
617 
618     if (!aspeed_smc_is_writable(fl)) {
619         aspeed_smc_error("flash is not writable at 0x%" HWADDR_PRIx, addr);
620         return;
621     }
622 
623     switch (aspeed_smc_flash_mode(fl)) {
624     case CTRL_USERMODE:
625         if (aspeed_smc_do_snoop(fl, data, size)) {
626             break;
627         }
628 
629         for (i = 0; i < size; i++) {
630             ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
631         }
632         break;
633     case CTRL_WRITEMODE:
634         aspeed_smc_flash_select(fl);
635         aspeed_smc_flash_setup(fl, addr);
636 
637         for (i = 0; i < size; i++) {
638             ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
639         }
640 
641         aspeed_smc_flash_unselect(fl);
642         break;
643     default:
644         aspeed_smc_error("invalid flash mode %d", aspeed_smc_flash_mode(fl));
645     }
646 }
647 
648 static const MemoryRegionOps aspeed_smc_flash_ops = {
649     .read = aspeed_smc_flash_read,
650     .write = aspeed_smc_flash_write,
651     .endianness = DEVICE_LITTLE_ENDIAN,
652     .valid = {
653         .min_access_size = 1,
654         .max_access_size = 4,
655     },
656 };
657 
658 static void aspeed_smc_flash_update_ctrl(AspeedSMCFlash *fl, uint32_t value)
659 {
660     AspeedSMCState *s = fl->controller;
661     bool unselect;
662 
663     /* User mode selects the CS, other modes unselect */
664     unselect = (value & CTRL_CMD_MODE_MASK) != CTRL_USERMODE;
665 
666     /* A change of CTRL_CE_STOP_ACTIVE from 0 to 1, unselects the CS */
667     if (!(s->regs[s->r_ctrl0 + fl->cs] & CTRL_CE_STOP_ACTIVE) &&
668         value & CTRL_CE_STOP_ACTIVE) {
669         unselect = true;
670     }
671 
672     s->regs[s->r_ctrl0 + fl->cs] = value;
673 
674     s->snoop_index = unselect ? SNOOP_OFF : SNOOP_START;
675 
676     aspeed_smc_flash_do_select(fl, unselect);
677 }
678 
679 static void aspeed_smc_reset(DeviceState *d)
680 {
681     AspeedSMCState *s = ASPEED_SMC(d);
682     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
683     int i;
684 
685     if (asc->resets) {
686         memcpy(s->regs, asc->resets, sizeof s->regs);
687     } else {
688         memset(s->regs, 0, sizeof s->regs);
689     }
690 
691     /* Unselect all peripherals */
692     for (i = 0; i < s->num_cs; ++i) {
693         s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE;
694         qemu_set_irq(s->cs_lines[i], true);
695     }
696 
697     /* setup the default segment register values and regions for all */
698     for (i = 0; i < asc->max_peripherals; ++i) {
699         aspeed_smc_flash_set_segment_region(s, i,
700                     asc->segment_to_reg(s, &asc->segments[i]));
701     }
702 
703     s->snoop_index = SNOOP_OFF;
704     s->snoop_dummies = 0;
705 }
706 
707 static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
708 {
709     AspeedSMCState *s = ASPEED_SMC(opaque);
710     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(opaque);
711 
712     addr >>= 2;
713 
714     if (addr == s->r_conf ||
715         (addr >= s->r_timings &&
716          addr < s->r_timings + asc->nregs_timings) ||
717         addr == s->r_ce_ctrl ||
718         addr == R_CE_CMD_CTRL ||
719         addr == R_INTR_CTRL ||
720         addr == R_DUMMY_DATA ||
721         (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_CTRL) ||
722         (aspeed_smc_has_dma(asc) && addr == R_DMA_CTRL) ||
723         (aspeed_smc_has_dma(asc) && addr == R_DMA_FLASH_ADDR) ||
724         (aspeed_smc_has_dma(asc) && addr == R_DMA_DRAM_ADDR) ||
725         (aspeed_smc_has_dma(asc) && addr == R_DMA_LEN) ||
726         (aspeed_smc_has_dma(asc) && addr == R_DMA_CHECKSUM) ||
727         (addr >= R_SEG_ADDR0 &&
728          addr < R_SEG_ADDR0 + asc->max_peripherals) ||
729         (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + asc->max_peripherals)) {
730 
731         trace_aspeed_smc_read(addr, size, s->regs[addr]);
732 
733         return s->regs[addr];
734     } else {
735         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
736                       __func__, addr);
737         return -1;
738     }
739 }
740 
741 static uint8_t aspeed_smc_hclk_divisor(uint8_t hclk_mask)
742 {
743     /* HCLK/1 .. HCLK/16 */
744     const uint8_t hclk_divisors[] = {
745         15, 7, 14, 6, 13, 5, 12, 4, 11, 3, 10, 2, 9, 1, 8, 0
746     };
747     int i;
748 
749     for (i = 0; i < ARRAY_SIZE(hclk_divisors); i++) {
750         if (hclk_mask == hclk_divisors[i]) {
751             return i + 1;
752         }
753     }
754 
755     aspeed_smc_error("invalid HCLK mask %x", hclk_mask);
756     return 0;
757 }
758 
759 /*
760  * When doing calibration, the SPI clock rate in the CE0 Control
761  * Register and the read delay cycles in the Read Timing Compensation
762  * Register are set using bit[11:4] of the DMA Control Register.
763  */
764 static void aspeed_smc_dma_calibration(AspeedSMCState *s)
765 {
766     uint8_t delay =
767         (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
768     uint8_t hclk_mask =
769         (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
770     uint8_t hclk_div = aspeed_smc_hclk_divisor(hclk_mask);
771     uint32_t hclk_shift = (hclk_div - 1) << 2;
772     uint8_t cs;
773 
774     /*
775      * The Read Timing Compensation Register values apply to all CS on
776      * the SPI bus and only HCLK/1 - HCLK/5 can have tunable delays
777      */
778     if (hclk_div && hclk_div < 6) {
779         s->regs[s->r_timings] &= ~(0xf << hclk_shift);
780         s->regs[s->r_timings] |= delay << hclk_shift;
781     }
782 
783     /*
784      * TODO: compute the CS from the DMA address and the segment
785      * registers. This is not really a problem for now because the
786      * Timing Register values apply to all CS and software uses CS0 to
787      * do calibration.
788      */
789     cs = 0;
790     s->regs[s->r_ctrl0 + cs] &=
791         ~(CE_CTRL_CLOCK_FREQ_MASK << CE_CTRL_CLOCK_FREQ_SHIFT);
792     s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
793 }
794 
795 /*
796  * Emulate read errors in the DMA Checksum Register for high
797  * frequencies and optimistic settings of the Read Timing Compensation
798  * Register. This will help in tuning the SPI timing calibration
799  * algorithm.
800  */
801 static bool aspeed_smc_inject_read_failure(AspeedSMCState *s)
802 {
803     uint8_t delay =
804         (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
805     uint8_t hclk_mask =
806         (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
807 
808     /*
809      * Typical values of a palmetto-bmc machine.
810      */
811     switch (aspeed_smc_hclk_divisor(hclk_mask)) {
812     case 4 ... 16:
813         return false;
814     case 3: /* at least one HCLK cycle delay */
815         return (delay & 0x7) < 1;
816     case 2: /* at least two HCLK cycle delay */
817         return (delay & 0x7) < 2;
818     case 1: /* (> 100MHz) is above the max freq of the controller */
819         return true;
820     default:
821         g_assert_not_reached();
822     }
823 }
824 
825 /*
826  * Accumulate the result of the reads to provide a checksum that will
827  * be used to validate the read timing settings.
828  */
829 static void aspeed_smc_dma_checksum(AspeedSMCState *s)
830 {
831     MemTxResult result;
832     uint32_t data;
833 
834     if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
835         aspeed_smc_error("invalid direction for DMA checksum");
836         return;
837     }
838 
839     if (s->regs[R_DMA_CTRL] & DMA_CTRL_CALIB) {
840         aspeed_smc_dma_calibration(s);
841     }
842 
843     while (s->regs[R_DMA_LEN]) {
844         data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
845                                     MEMTXATTRS_UNSPECIFIED, &result);
846         if (result != MEMTX_OK) {
847             aspeed_smc_error("Flash read failed @%08x",
848                              s->regs[R_DMA_FLASH_ADDR]);
849             return;
850         }
851         trace_aspeed_smc_dma_checksum(s->regs[R_DMA_FLASH_ADDR], data);
852 
853         /*
854          * When the DMA is on-going, the DMA registers are updated
855          * with the current working addresses and length.
856          */
857         s->regs[R_DMA_CHECKSUM] += data;
858         s->regs[R_DMA_FLASH_ADDR] += 4;
859         s->regs[R_DMA_LEN] -= 4;
860     }
861 
862     if (s->inject_failure && aspeed_smc_inject_read_failure(s)) {
863         s->regs[R_DMA_CHECKSUM] = 0xbadc0de;
864     }
865 
866 }
867 
868 static void aspeed_smc_dma_rw(AspeedSMCState *s)
869 {
870     MemTxResult result;
871     uint32_t data;
872 
873     trace_aspeed_smc_dma_rw(s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE ?
874                             "write" : "read",
875                             s->regs[R_DMA_FLASH_ADDR],
876                             s->regs[R_DMA_DRAM_ADDR],
877                             s->regs[R_DMA_LEN]);
878     while (s->regs[R_DMA_LEN]) {
879         if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
880             data = address_space_ldl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
881                                         MEMTXATTRS_UNSPECIFIED, &result);
882             if (result != MEMTX_OK) {
883                 aspeed_smc_error("DRAM read failed @%08x",
884                                  s->regs[R_DMA_DRAM_ADDR]);
885                 return;
886             }
887 
888             address_space_stl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
889                                  data, MEMTXATTRS_UNSPECIFIED, &result);
890             if (result != MEMTX_OK) {
891                 aspeed_smc_error("Flash write failed @%08x",
892                                  s->regs[R_DMA_FLASH_ADDR]);
893                 return;
894             }
895         } else {
896             data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
897                                         MEMTXATTRS_UNSPECIFIED, &result);
898             if (result != MEMTX_OK) {
899                 aspeed_smc_error("Flash read failed @%08x",
900                                  s->regs[R_DMA_FLASH_ADDR]);
901                 return;
902             }
903 
904             address_space_stl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
905                                  data, MEMTXATTRS_UNSPECIFIED, &result);
906             if (result != MEMTX_OK) {
907                 aspeed_smc_error("DRAM write failed @%08x",
908                                  s->regs[R_DMA_DRAM_ADDR]);
909                 return;
910             }
911         }
912 
913         /*
914          * When the DMA is on-going, the DMA registers are updated
915          * with the current working addresses and length.
916          */
917         s->regs[R_DMA_FLASH_ADDR] += 4;
918         s->regs[R_DMA_DRAM_ADDR] += 4;
919         s->regs[R_DMA_LEN] -= 4;
920         s->regs[R_DMA_CHECKSUM] += data;
921     }
922 }
923 
924 static void aspeed_smc_dma_stop(AspeedSMCState *s)
925 {
926     /*
927      * When the DMA is disabled, INTR_CTRL_DMA_STATUS=0 means the
928      * engine is idle
929      */
930     s->regs[R_INTR_CTRL] &= ~INTR_CTRL_DMA_STATUS;
931     s->regs[R_DMA_CHECKSUM] = 0;
932 
933     /*
934      * Lower the DMA irq in any case. The IRQ control register could
935      * have been cleared before disabling the DMA.
936      */
937     qemu_irq_lower(s->irq);
938 }
939 
940 /*
941  * When INTR_CTRL_DMA_STATUS=1, the DMA has completed and a new DMA
942  * can start even if the result of the previous was not collected.
943  */
944 static bool aspeed_smc_dma_in_progress(AspeedSMCState *s)
945 {
946     return s->regs[R_DMA_CTRL] & DMA_CTRL_ENABLE &&
947         !(s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_STATUS);
948 }
949 
950 static void aspeed_smc_dma_done(AspeedSMCState *s)
951 {
952     s->regs[R_INTR_CTRL] |= INTR_CTRL_DMA_STATUS;
953     if (s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_EN) {
954         qemu_irq_raise(s->irq);
955     }
956 }
957 
958 static void aspeed_smc_dma_ctrl(AspeedSMCState *s, uint32_t dma_ctrl)
959 {
960     if (!(dma_ctrl & DMA_CTRL_ENABLE)) {
961         s->regs[R_DMA_CTRL] = dma_ctrl;
962 
963         aspeed_smc_dma_stop(s);
964         return;
965     }
966 
967     if (aspeed_smc_dma_in_progress(s)) {
968         aspeed_smc_error("DMA in progress !");
969         return;
970     }
971 
972     s->regs[R_DMA_CTRL] = dma_ctrl;
973 
974     if (s->regs[R_DMA_CTRL] & DMA_CTRL_CKSUM) {
975         aspeed_smc_dma_checksum(s);
976     } else {
977         aspeed_smc_dma_rw(s);
978     }
979 
980     aspeed_smc_dma_done(s);
981 }
982 
983 static inline bool aspeed_smc_dma_granted(AspeedSMCState *s)
984 {
985     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
986 
987     if (!(asc->features & ASPEED_SMC_FEATURE_DMA_GRANT)) {
988         return true;
989     }
990 
991     if (!(s->regs[R_DMA_CTRL] & DMA_CTRL_GRANT)) {
992         aspeed_smc_error("DMA not granted");
993         return false;
994     }
995 
996     return true;
997 }
998 
999 static void aspeed_2600_smc_dma_ctrl(AspeedSMCState *s, uint32_t dma_ctrl)
1000 {
1001     /* Preserve DMA bits  */
1002     dma_ctrl |= s->regs[R_DMA_CTRL] & (DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1003 
1004     if (dma_ctrl == 0xAEED0000) {
1005         /* automatically grant request */
1006         s->regs[R_DMA_CTRL] |= (DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1007         return;
1008     }
1009 
1010     /* clear request */
1011     if (dma_ctrl == 0xDEEA0000) {
1012         s->regs[R_DMA_CTRL] &= ~(DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1013         return;
1014     }
1015 
1016     if (!aspeed_smc_dma_granted(s)) {
1017         aspeed_smc_error("DMA not granted");
1018         return;
1019     }
1020 
1021     aspeed_smc_dma_ctrl(s, dma_ctrl);
1022     s->regs[R_DMA_CTRL] &= ~(DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1023 }
1024 
1025 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
1026                              unsigned int size)
1027 {
1028     AspeedSMCState *s = ASPEED_SMC(opaque);
1029     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1030     uint32_t value = data;
1031 
1032     addr >>= 2;
1033 
1034     trace_aspeed_smc_write(addr, size, data);
1035 
1036     if (addr == s->r_conf ||
1037         (addr >= s->r_timings &&
1038          addr < s->r_timings + asc->nregs_timings) ||
1039         addr == s->r_ce_ctrl) {
1040         s->regs[addr] = value;
1041     } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) {
1042         int cs = addr - s->r_ctrl0;
1043         aspeed_smc_flash_update_ctrl(&s->flashes[cs], value);
1044     } else if (addr >= R_SEG_ADDR0 &&
1045                addr < R_SEG_ADDR0 + asc->max_peripherals) {
1046         int cs = addr - R_SEG_ADDR0;
1047 
1048         if (value != s->regs[R_SEG_ADDR0 + cs]) {
1049             aspeed_smc_flash_set_segment(s, cs, value);
1050         }
1051     } else if (addr == R_CE_CMD_CTRL) {
1052         s->regs[addr] = value & 0xff;
1053     } else if (addr == R_DUMMY_DATA) {
1054         s->regs[addr] = value & 0xff;
1055     } else if (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_CTRL) {
1056         s->regs[addr] = value & FMC_WDT2_CTRL_EN;
1057     } else if (addr == R_INTR_CTRL) {
1058         s->regs[addr] = value;
1059     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_CTRL) {
1060         asc->dma_ctrl(s, value);
1061     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_DRAM_ADDR &&
1062                aspeed_smc_dma_granted(s)) {
1063         s->regs[addr] = DMA_DRAM_ADDR(asc, value);
1064     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_FLASH_ADDR &&
1065                aspeed_smc_dma_granted(s)) {
1066         s->regs[addr] = DMA_FLASH_ADDR(asc, value);
1067     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_LEN &&
1068                aspeed_smc_dma_granted(s)) {
1069         s->regs[addr] = DMA_LENGTH(value);
1070     } else {
1071         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
1072                       __func__, addr);
1073         return;
1074     }
1075 }
1076 
1077 static const MemoryRegionOps aspeed_smc_ops = {
1078     .read = aspeed_smc_read,
1079     .write = aspeed_smc_write,
1080     .endianness = DEVICE_LITTLE_ENDIAN,
1081 };
1082 
1083 static void aspeed_smc_instance_init(Object *obj)
1084 {
1085     AspeedSMCState *s = ASPEED_SMC(obj);
1086     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1087     int i;
1088 
1089     for (i = 0; i < asc->max_peripherals; i++) {
1090         object_initialize_child(obj, "flash[*]", &s->flashes[i],
1091                                 TYPE_ASPEED_SMC_FLASH);
1092     }
1093 }
1094 
1095 /*
1096  * Initialize the custom address spaces for DMAs
1097  */
1098 static void aspeed_smc_dma_setup(AspeedSMCState *s, Error **errp)
1099 {
1100     if (!s->dram_mr) {
1101         error_setg(errp, TYPE_ASPEED_SMC ": 'dram' link not set");
1102         return;
1103     }
1104 
1105     address_space_init(&s->flash_as, &s->mmio_flash,
1106                        TYPE_ASPEED_SMC ".dma-flash");
1107     address_space_init(&s->dram_as, s->dram_mr,
1108                        TYPE_ASPEED_SMC ".dma-dram");
1109 }
1110 
1111 static void aspeed_smc_realize(DeviceState *dev, Error **errp)
1112 {
1113     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1114     AspeedSMCState *s = ASPEED_SMC(dev);
1115     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1116     int i;
1117     hwaddr offset = 0;
1118 
1119     /* keep a copy under AspeedSMCState to speed up accesses */
1120     s->r_conf = asc->r_conf;
1121     s->r_ce_ctrl = asc->r_ce_ctrl;
1122     s->r_ctrl0 = asc->r_ctrl0;
1123     s->r_timings = asc->r_timings;
1124     s->conf_enable_w0 = asc->conf_enable_w0;
1125 
1126     /* Enforce some real HW limits */
1127     if (s->num_cs > asc->max_peripherals) {
1128         aspeed_smc_error("num_cs cannot exceed: %d", asc->max_peripherals);
1129         s->num_cs = asc->max_peripherals;
1130     }
1131 
1132     /* DMA irq. Keep it first for the initialization in the SoC */
1133     sysbus_init_irq(sbd, &s->irq);
1134 
1135     s->spi = ssi_create_bus(dev, "spi");
1136 
1137     /* Setup cs_lines for peripherals */
1138     s->cs_lines = g_new0(qemu_irq, s->num_cs);
1139 
1140     for (i = 0; i < s->num_cs; ++i) {
1141         sysbus_init_irq(sbd, &s->cs_lines[i]);
1142     }
1143 
1144     /* The memory region for the controller registers */
1145     memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s,
1146                           TYPE_ASPEED_SMC, asc->nregs * 4);
1147     sysbus_init_mmio(sbd, &s->mmio);
1148 
1149     /*
1150      * The container memory region representing the address space
1151      * window in which the flash modules are mapped. The size and
1152      * address depends on the SoC model and controller type.
1153      */
1154     memory_region_init_io(&s->mmio_flash, OBJECT(s),
1155                           &aspeed_smc_flash_default_ops, s,
1156                           TYPE_ASPEED_SMC ".flash",
1157                           asc->flash_window_size);
1158     memory_region_init_alias(&s->mmio_flash_alias, OBJECT(s),
1159                              TYPE_ASPEED_SMC ".flash",
1160                              &s->mmio_flash, 0, asc->flash_window_size);
1161     sysbus_init_mmio(sbd, &s->mmio_flash_alias);
1162 
1163     /*
1164      * Let's create a sub memory region for each possible peripheral. All
1165      * have a configurable memory segment in the overall flash mapping
1166      * window of the controller but, there is not necessarily a flash
1167      * module behind to handle the memory accesses. This depends on
1168      * the board configuration.
1169      */
1170     for (i = 0; i < asc->max_peripherals; ++i) {
1171         AspeedSMCFlash *fl = &s->flashes[i];
1172 
1173         if (!object_property_set_link(OBJECT(fl), "controller", OBJECT(s),
1174                                       errp)) {
1175             return;
1176         }
1177         if (!object_property_set_uint(OBJECT(fl), "cs", i, errp)) {
1178             return;
1179         }
1180         if (!sysbus_realize(SYS_BUS_DEVICE(fl), errp)) {
1181             return;
1182         }
1183 
1184         memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio);
1185         offset += asc->segments[i].size;
1186     }
1187 
1188     /* DMA support */
1189     if (aspeed_smc_has_dma(asc)) {
1190         aspeed_smc_dma_setup(s, errp);
1191     }
1192 }
1193 
1194 static const VMStateDescription vmstate_aspeed_smc = {
1195     .name = "aspeed.smc",
1196     .version_id = 2,
1197     .minimum_version_id = 2,
1198     .fields = (VMStateField[]) {
1199         VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX),
1200         VMSTATE_UINT8(snoop_index, AspeedSMCState),
1201         VMSTATE_UINT8(snoop_dummies, AspeedSMCState),
1202         VMSTATE_END_OF_LIST()
1203     }
1204 };
1205 
1206 static Property aspeed_smc_properties[] = {
1207     DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1),
1208     DEFINE_PROP_BOOL("inject-failure", AspeedSMCState, inject_failure, false),
1209     DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
1210                      TYPE_MEMORY_REGION, MemoryRegion *),
1211     DEFINE_PROP_END_OF_LIST(),
1212 };
1213 
1214 static void aspeed_smc_class_init(ObjectClass *klass, void *data)
1215 {
1216     DeviceClass *dc = DEVICE_CLASS(klass);
1217 
1218     dc->realize = aspeed_smc_realize;
1219     dc->reset = aspeed_smc_reset;
1220     device_class_set_props(dc, aspeed_smc_properties);
1221     dc->vmsd = &vmstate_aspeed_smc;
1222 }
1223 
1224 static const TypeInfo aspeed_smc_info = {
1225     .name           = TYPE_ASPEED_SMC,
1226     .parent         = TYPE_SYS_BUS_DEVICE,
1227     .instance_init  = aspeed_smc_instance_init,
1228     .instance_size  = sizeof(AspeedSMCState),
1229     .class_size     = sizeof(AspeedSMCClass),
1230     .class_init     = aspeed_smc_class_init,
1231     .abstract       = true,
1232 };
1233 
1234 static void aspeed_smc_flash_realize(DeviceState *dev, Error **errp)
1235 {
1236     AspeedSMCFlash *s = ASPEED_SMC_FLASH(dev);
1237     AspeedSMCClass *asc;
1238     g_autofree char *name = g_strdup_printf(TYPE_ASPEED_SMC_FLASH ".%d", s->cs);
1239 
1240     if (!s->controller) {
1241         error_setg(errp, TYPE_ASPEED_SMC_FLASH ": 'controller' link not set");
1242         return;
1243     }
1244 
1245     asc = ASPEED_SMC_GET_CLASS(s->controller);
1246 
1247     /*
1248      * Use the default segment value to size the memory region. This
1249      * can be changed by FW at runtime.
1250      */
1251     memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_flash_ops,
1252                           s, name, asc->segments[s->cs].size);
1253     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
1254 }
1255 
1256 static Property aspeed_smc_flash_properties[] = {
1257     DEFINE_PROP_UINT8("cs", AspeedSMCFlash, cs, 0),
1258     DEFINE_PROP_LINK("controller", AspeedSMCFlash, controller, TYPE_ASPEED_SMC,
1259                      AspeedSMCState *),
1260     DEFINE_PROP_END_OF_LIST(),
1261 };
1262 
1263 static void aspeed_smc_flash_class_init(ObjectClass *klass, void *data)
1264 {
1265     DeviceClass *dc = DEVICE_CLASS(klass);
1266 
1267     dc->desc = "Aspeed SMC Flash device region";
1268     dc->realize = aspeed_smc_flash_realize;
1269     device_class_set_props(dc, aspeed_smc_flash_properties);
1270 }
1271 
1272 static const TypeInfo aspeed_smc_flash_info = {
1273     .name           = TYPE_ASPEED_SMC_FLASH,
1274     .parent         = TYPE_SYS_BUS_DEVICE,
1275     .instance_size  = sizeof(AspeedSMCFlash),
1276     .class_init     = aspeed_smc_flash_class_init,
1277 };
1278 
1279 /*
1280  * The Segment Registers of the AST2400 and AST2500 have a 8MB
1281  * unit. The address range of a flash SPI peripheral is encoded with
1282  * absolute addresses which should be part of the overall controller
1283  * window.
1284  */
1285 static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s,
1286                                           const AspeedSegments *seg)
1287 {
1288     uint32_t reg = 0;
1289     reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT;
1290     reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT;
1291     return reg;
1292 }
1293 
1294 static void aspeed_smc_reg_to_segment(const AspeedSMCState *s,
1295                                       uint32_t reg, AspeedSegments *seg)
1296 {
1297     seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23;
1298     seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr;
1299 }
1300 
1301 static const AspeedSegments aspeed_2400_smc_segments[] = {
1302     { 0x10000000, 32 * MiB },
1303 };
1304 
1305 static void aspeed_2400_smc_class_init(ObjectClass *klass, void *data)
1306 {
1307     DeviceClass *dc = DEVICE_CLASS(klass);
1308     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1309 
1310     dc->desc               = "Aspeed 2400 SMC Controller";
1311     asc->r_conf            = R_CONF;
1312     asc->r_ce_ctrl         = R_CE_CTRL;
1313     asc->r_ctrl0           = R_CTRL0;
1314     asc->r_timings         = R_TIMINGS;
1315     asc->nregs_timings     = 1;
1316     asc->conf_enable_w0    = CONF_ENABLE_W0;
1317     asc->max_peripherals   = 1;
1318     asc->segments          = aspeed_2400_smc_segments;
1319     asc->flash_window_base = 0x10000000;
1320     asc->flash_window_size = 0x6000000;
1321     asc->features          = 0x0;
1322     asc->nregs             = ASPEED_SMC_R_SMC_MAX;
1323     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1324     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1325     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1326 }
1327 
1328 static const TypeInfo aspeed_2400_smc_info = {
1329     .name =  "aspeed.smc-ast2400",
1330     .parent = TYPE_ASPEED_SMC,
1331     .class_init = aspeed_2400_smc_class_init,
1332 };
1333 
1334 static const uint32_t aspeed_2400_fmc_resets[ASPEED_SMC_R_MAX] = {
1335     /*
1336      * CE0 and CE1 types are HW strapped in SCU70. Do it here to
1337      * simplify the model.
1338      */
1339     [R_CONF] = CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0,
1340 };
1341 
1342 static const AspeedSegments aspeed_2400_fmc_segments[] = {
1343     { 0x20000000, 64 * MiB }, /* start address is readonly */
1344     { 0x24000000, 32 * MiB },
1345     { 0x26000000, 32 * MiB },
1346     { 0x28000000, 32 * MiB },
1347     { 0x2A000000, 32 * MiB }
1348 };
1349 
1350 static void aspeed_2400_fmc_class_init(ObjectClass *klass, void *data)
1351 {
1352     DeviceClass *dc = DEVICE_CLASS(klass);
1353     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1354 
1355     dc->desc               = "Aspeed 2400 FMC Controller";
1356     asc->r_conf            = R_CONF;
1357     asc->r_ce_ctrl         = R_CE_CTRL;
1358     asc->r_ctrl0           = R_CTRL0;
1359     asc->r_timings         = R_TIMINGS;
1360     asc->nregs_timings     = 1;
1361     asc->conf_enable_w0    = CONF_ENABLE_W0;
1362     asc->max_peripherals   = 5;
1363     asc->segments          = aspeed_2400_fmc_segments;
1364     asc->resets            = aspeed_2400_fmc_resets;
1365     asc->flash_window_base = 0x20000000;
1366     asc->flash_window_size = 0x10000000;
1367     asc->features          = ASPEED_SMC_FEATURE_DMA;
1368     asc->dma_flash_mask    = 0x0FFFFFFC;
1369     asc->dma_dram_mask     = 0x1FFFFFFC;
1370     asc->nregs             = ASPEED_SMC_R_MAX;
1371     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1372     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1373     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1374 }
1375 
1376 static const TypeInfo aspeed_2400_fmc_info = {
1377     .name =  "aspeed.fmc-ast2400",
1378     .parent = TYPE_ASPEED_SMC,
1379     .class_init = aspeed_2400_fmc_class_init,
1380 };
1381 
1382 static const AspeedSegments aspeed_2400_spi1_segments[] = {
1383     { 0x30000000, 64 * MiB },
1384 };
1385 
1386 static int aspeed_2400_spi1_addr_width(const AspeedSMCState *s)
1387 {
1388     return s->regs[R_SPI_CTRL0] & CTRL_AST2400_SPI_4BYTE ? 4 : 3;
1389 }
1390 
1391 static void aspeed_2400_spi1_class_init(ObjectClass *klass, void *data)
1392 {
1393     DeviceClass *dc = DEVICE_CLASS(klass);
1394     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1395 
1396     dc->desc               = "Aspeed 2400 SPI1 Controller";
1397     asc->r_conf            = R_SPI_CONF;
1398     asc->r_ce_ctrl         = 0xff;
1399     asc->r_ctrl0           = R_SPI_CTRL0;
1400     asc->r_timings         = R_SPI_TIMINGS;
1401     asc->nregs_timings     = 1;
1402     asc->conf_enable_w0    = SPI_CONF_ENABLE_W0;
1403     asc->max_peripherals   = 1;
1404     asc->segments          = aspeed_2400_spi1_segments;
1405     asc->flash_window_base = 0x30000000;
1406     asc->flash_window_size = 0x10000000;
1407     asc->features          = 0x0;
1408     asc->nregs             = ASPEED_SMC_R_SPI_MAX;
1409     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1410     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1411     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1412     asc->addr_width        = aspeed_2400_spi1_addr_width;
1413 }
1414 
1415 static const TypeInfo aspeed_2400_spi1_info = {
1416     .name =  "aspeed.spi1-ast2400",
1417     .parent = TYPE_ASPEED_SMC,
1418     .class_init = aspeed_2400_spi1_class_init,
1419 };
1420 
1421 static const uint32_t aspeed_2500_fmc_resets[ASPEED_SMC_R_MAX] = {
1422     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1423                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
1424 };
1425 
1426 static const AspeedSegments aspeed_2500_fmc_segments[] = {
1427     { 0x20000000, 128 * MiB }, /* start address is readonly */
1428     { 0x28000000,  32 * MiB },
1429     { 0x2A000000,  32 * MiB },
1430 };
1431 
1432 static void aspeed_2500_fmc_class_init(ObjectClass *klass, void *data)
1433 {
1434     DeviceClass *dc = DEVICE_CLASS(klass);
1435     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1436 
1437     dc->desc               = "Aspeed 2600 FMC Controller";
1438     asc->r_conf            = R_CONF;
1439     asc->r_ce_ctrl         = R_CE_CTRL;
1440     asc->r_ctrl0           = R_CTRL0;
1441     asc->r_timings         = R_TIMINGS;
1442     asc->nregs_timings     = 1;
1443     asc->conf_enable_w0    = CONF_ENABLE_W0;
1444     asc->max_peripherals   = 3;
1445     asc->segments          = aspeed_2500_fmc_segments;
1446     asc->resets            = aspeed_2500_fmc_resets;
1447     asc->flash_window_base = 0x20000000;
1448     asc->flash_window_size = 0x10000000;
1449     asc->features          = ASPEED_SMC_FEATURE_DMA;
1450     asc->dma_flash_mask    = 0x0FFFFFFC;
1451     asc->dma_dram_mask     = 0x3FFFFFFC;
1452     asc->nregs             = ASPEED_SMC_R_MAX;
1453     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1454     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1455     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1456 }
1457 
1458 static const TypeInfo aspeed_2500_fmc_info = {
1459     .name =  "aspeed.fmc-ast2500",
1460     .parent = TYPE_ASPEED_SMC,
1461     .class_init = aspeed_2500_fmc_class_init,
1462 };
1463 
1464 static const AspeedSegments aspeed_2500_spi1_segments[] = {
1465     { 0x30000000, 32 * MiB }, /* start address is readonly */
1466     { 0x32000000, 96 * MiB }, /* end address is readonly */
1467 };
1468 
1469 static void aspeed_2500_spi1_class_init(ObjectClass *klass, void *data)
1470 {
1471     DeviceClass *dc = DEVICE_CLASS(klass);
1472     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1473 
1474     dc->desc               = "Aspeed 2600 SPI1 Controller";
1475     asc->r_conf            = R_CONF;
1476     asc->r_ce_ctrl         = R_CE_CTRL;
1477     asc->r_ctrl0           = R_CTRL0;
1478     asc->r_timings         = R_TIMINGS;
1479     asc->nregs_timings     = 1;
1480     asc->conf_enable_w0    = CONF_ENABLE_W0;
1481     asc->max_peripherals   = 2;
1482     asc->segments          = aspeed_2500_spi1_segments;
1483     asc->flash_window_base = 0x30000000;
1484     asc->flash_window_size = 0x8000000;
1485     asc->features          = 0x0;
1486     asc->nregs             = ASPEED_SMC_R_MAX;
1487     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1488     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1489     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1490 }
1491 
1492 static const TypeInfo aspeed_2500_spi1_info = {
1493     .name =  "aspeed.spi1-ast2500",
1494     .parent = TYPE_ASPEED_SMC,
1495     .class_init = aspeed_2500_spi1_class_init,
1496 };
1497 
1498 static const AspeedSegments aspeed_2500_spi2_segments[] = {
1499     { 0x38000000, 32 * MiB }, /* start address is readonly */
1500     { 0x3A000000, 96 * MiB }, /* end address is readonly */
1501 };
1502 
1503 static void aspeed_2500_spi2_class_init(ObjectClass *klass, void *data)
1504 {
1505     DeviceClass *dc = DEVICE_CLASS(klass);
1506     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1507 
1508     dc->desc               = "Aspeed 2600 SPI2 Controller";
1509     asc->r_conf            = R_CONF;
1510     asc->r_ce_ctrl         = R_CE_CTRL;
1511     asc->r_ctrl0           = R_CTRL0;
1512     asc->r_timings         = R_TIMINGS;
1513     asc->nregs_timings     = 1;
1514     asc->conf_enable_w0    = CONF_ENABLE_W0;
1515     asc->max_peripherals   = 2;
1516     asc->segments          = aspeed_2500_spi2_segments;
1517     asc->flash_window_base = 0x38000000;
1518     asc->flash_window_size = 0x8000000;
1519     asc->features          = 0x0;
1520     asc->nregs             = ASPEED_SMC_R_MAX;
1521     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1522     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1523     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1524 }
1525 
1526 static const TypeInfo aspeed_2500_spi2_info = {
1527     .name =  "aspeed.spi2-ast2500",
1528     .parent = TYPE_ASPEED_SMC,
1529     .class_init = aspeed_2500_spi2_class_init,
1530 };
1531 
1532 /*
1533  * The Segment Registers of the AST2600 have a 1MB unit. The address
1534  * range of a flash SPI peripheral is encoded with offsets in the overall
1535  * controller window. The previous SoC AST2400 and AST2500 used
1536  * absolute addresses. Only bits [27:20] are relevant and the end
1537  * address is an upper bound limit.
1538  */
1539 #define AST2600_SEG_ADDR_MASK 0x0ff00000
1540 
1541 static uint32_t aspeed_2600_smc_segment_to_reg(const AspeedSMCState *s,
1542                                                const AspeedSegments *seg)
1543 {
1544     uint32_t reg = 0;
1545 
1546     /* Disabled segments have a nil register */
1547     if (!seg->size) {
1548         return 0;
1549     }
1550 
1551     reg |= (seg->addr & AST2600_SEG_ADDR_MASK) >> 16; /* start offset */
1552     reg |= (seg->addr + seg->size - 1) & AST2600_SEG_ADDR_MASK; /* end offset */
1553     return reg;
1554 }
1555 
1556 static void aspeed_2600_smc_reg_to_segment(const AspeedSMCState *s,
1557                                            uint32_t reg, AspeedSegments *seg)
1558 {
1559     uint32_t start_offset = (reg << 16) & AST2600_SEG_ADDR_MASK;
1560     uint32_t end_offset = reg & AST2600_SEG_ADDR_MASK;
1561     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1562 
1563     if (reg) {
1564         seg->addr = asc->flash_window_base + start_offset;
1565         seg->size = end_offset + MiB - start_offset;
1566     } else {
1567         seg->addr = asc->flash_window_base;
1568         seg->size = 0;
1569     }
1570 }
1571 
1572 static const uint32_t aspeed_2600_fmc_resets[ASPEED_SMC_R_MAX] = {
1573     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1574                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1 |
1575                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE2),
1576 };
1577 
1578 static const AspeedSegments aspeed_2600_fmc_segments[] = {
1579     { 0x0, 128 * MiB }, /* start address is readonly */
1580     { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
1581     { 0x0, 0 }, /* disabled */
1582 };
1583 
1584 static void aspeed_2600_fmc_class_init(ObjectClass *klass, void *data)
1585 {
1586     DeviceClass *dc = DEVICE_CLASS(klass);
1587     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1588 
1589     dc->desc               = "Aspeed 2600 FMC Controller";
1590     asc->r_conf            = R_CONF;
1591     asc->r_ce_ctrl         = R_CE_CTRL;
1592     asc->r_ctrl0           = R_CTRL0;
1593     asc->r_timings         = R_TIMINGS;
1594     asc->nregs_timings     = 1;
1595     asc->conf_enable_w0    = CONF_ENABLE_W0;
1596     asc->max_peripherals   = 3;
1597     asc->segments          = aspeed_2600_fmc_segments;
1598     asc->resets            = aspeed_2600_fmc_resets;
1599     asc->flash_window_base = 0x20000000;
1600     asc->flash_window_size = 0x10000000;
1601     asc->features          = ASPEED_SMC_FEATURE_DMA |
1602                              ASPEED_SMC_FEATURE_WDT_CONTROL;
1603     asc->dma_flash_mask    = 0x0FFFFFFC;
1604     asc->dma_dram_mask     = 0x3FFFFFFC;
1605     asc->nregs             = ASPEED_SMC_R_MAX;
1606     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1607     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1608     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1609 }
1610 
1611 static const TypeInfo aspeed_2600_fmc_info = {
1612     .name =  "aspeed.fmc-ast2600",
1613     .parent = TYPE_ASPEED_SMC,
1614     .class_init = aspeed_2600_fmc_class_init,
1615 };
1616 
1617 static const AspeedSegments aspeed_2600_spi1_segments[] = {
1618     { 0x0, 128 * MiB }, /* start address is readonly */
1619     { 0x0, 0 }, /* disabled */
1620 };
1621 
1622 static void aspeed_2600_spi1_class_init(ObjectClass *klass, void *data)
1623 {
1624     DeviceClass *dc = DEVICE_CLASS(klass);
1625     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1626 
1627     dc->desc               = "Aspeed 2600 SPI1 Controller";
1628     asc->r_conf            = R_CONF;
1629     asc->r_ce_ctrl         = R_CE_CTRL;
1630     asc->r_ctrl0           = R_CTRL0;
1631     asc->r_timings         = R_TIMINGS;
1632     asc->nregs_timings     = 2;
1633     asc->conf_enable_w0    = CONF_ENABLE_W0;
1634     asc->max_peripherals   = 2;
1635     asc->segments          = aspeed_2600_spi1_segments;
1636     asc->flash_window_base = 0x30000000;
1637     asc->flash_window_size = 0x10000000;
1638     asc->features          = ASPEED_SMC_FEATURE_DMA |
1639                              ASPEED_SMC_FEATURE_DMA_GRANT;
1640     asc->dma_flash_mask    = 0x0FFFFFFC;
1641     asc->dma_dram_mask     = 0x3FFFFFFC;
1642     asc->nregs             = ASPEED_SMC_R_MAX;
1643     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1644     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1645     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1646 }
1647 
1648 static const TypeInfo aspeed_2600_spi1_info = {
1649     .name =  "aspeed.spi1-ast2600",
1650     .parent = TYPE_ASPEED_SMC,
1651     .class_init = aspeed_2600_spi1_class_init,
1652 };
1653 
1654 static const AspeedSegments aspeed_2600_spi2_segments[] = {
1655     { 0x0, 128 * MiB }, /* start address is readonly */
1656     { 0x0, 0 }, /* disabled */
1657     { 0x0, 0 }, /* disabled */
1658 };
1659 
1660 static void aspeed_2600_spi2_class_init(ObjectClass *klass, void *data)
1661 {
1662     DeviceClass *dc = DEVICE_CLASS(klass);
1663     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1664 
1665     dc->desc               = "Aspeed 2600 SPI2 Controller";
1666     asc->r_conf            = R_CONF;
1667     asc->r_ce_ctrl         = R_CE_CTRL;
1668     asc->r_ctrl0           = R_CTRL0;
1669     asc->r_timings         = R_TIMINGS;
1670     asc->nregs_timings     = 3;
1671     asc->conf_enable_w0    = CONF_ENABLE_W0;
1672     asc->max_peripherals   = 3;
1673     asc->segments          = aspeed_2600_spi2_segments;
1674     asc->flash_window_base = 0x50000000;
1675     asc->flash_window_size = 0x10000000;
1676     asc->features          = ASPEED_SMC_FEATURE_DMA |
1677                              ASPEED_SMC_FEATURE_DMA_GRANT;
1678     asc->dma_flash_mask    = 0x0FFFFFFC;
1679     asc->dma_dram_mask     = 0x3FFFFFFC;
1680     asc->nregs             = ASPEED_SMC_R_MAX;
1681     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1682     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1683     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1684 }
1685 
1686 static const TypeInfo aspeed_2600_spi2_info = {
1687     .name =  "aspeed.spi2-ast2600",
1688     .parent = TYPE_ASPEED_SMC,
1689     .class_init = aspeed_2600_spi2_class_init,
1690 };
1691 
1692 static void aspeed_smc_register_types(void)
1693 {
1694     type_register_static(&aspeed_smc_flash_info);
1695     type_register_static(&aspeed_smc_info);
1696     type_register_static(&aspeed_2400_smc_info);
1697     type_register_static(&aspeed_2400_fmc_info);
1698     type_register_static(&aspeed_2400_spi1_info);
1699     type_register_static(&aspeed_2500_fmc_info);
1700     type_register_static(&aspeed_2500_spi1_info);
1701     type_register_static(&aspeed_2500_spi2_info);
1702     type_register_static(&aspeed_2600_fmc_info);
1703     type_register_static(&aspeed_2600_spi1_info);
1704     type_register_static(&aspeed_2600_spi2_info);
1705 }
1706 
1707 type_init(aspeed_smc_register_types)
1708