xref: /openbmc/qemu/hw/ssi/aspeed_smc.c (revision 7d87775f)
1 /*
2  * ASPEED AST2400 SMC Controller (SPI Flash Only)
3  *
4  * Copyright (C) 2016 IBM Corp.
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "hw/block/flash.h"
27 #include "hw/sysbus.h"
28 #include "migration/vmstate.h"
29 #include "qemu/log.h"
30 #include "qemu/module.h"
31 #include "qemu/error-report.h"
32 #include "qapi/error.h"
33 #include "qemu/units.h"
34 #include "trace.h"
35 
36 #include "hw/irq.h"
37 #include "hw/qdev-properties.h"
38 #include "hw/ssi/aspeed_smc.h"
39 
40 /* CE Type Setting Register */
41 #define R_CONF            (0x00 / 4)
42 #define   CONF_LEGACY_DISABLE  (1 << 31)
43 #define   CONF_ENABLE_W4       20
44 #define   CONF_ENABLE_W3       19
45 #define   CONF_ENABLE_W2       18
46 #define   CONF_ENABLE_W1       17
47 #define   CONF_ENABLE_W0       16
48 #define   CONF_FLASH_TYPE4     8
49 #define   CONF_FLASH_TYPE3     6
50 #define   CONF_FLASH_TYPE2     4
51 #define   CONF_FLASH_TYPE1     2
52 #define   CONF_FLASH_TYPE0     0
53 #define      CONF_FLASH_TYPE_NOR   0x0
54 #define      CONF_FLASH_TYPE_NAND  0x1
55 #define      CONF_FLASH_TYPE_SPI   0x2 /* AST2600 is SPI only */
56 
57 /* CE Control Register */
58 #define R_CE_CTRL            (0x04 / 4)
59 #define   CTRL_EXTENDED4       4  /* 32 bit addressing for SPI */
60 #define   CTRL_EXTENDED3       3  /* 32 bit addressing for SPI */
61 #define   CTRL_EXTENDED2       2  /* 32 bit addressing for SPI */
62 #define   CTRL_EXTENDED1       1  /* 32 bit addressing for SPI */
63 #define   CTRL_EXTENDED0       0  /* 32 bit addressing for SPI */
64 
65 /* Interrupt Control and Status Register */
66 #define R_INTR_CTRL       (0x08 / 4)
67 #define   INTR_CTRL_DMA_STATUS            (1 << 11)
68 #define   INTR_CTRL_CMD_ABORT_STATUS      (1 << 10)
69 #define   INTR_CTRL_WRITE_PROTECT_STATUS  (1 << 9)
70 #define   INTR_CTRL_DMA_EN                (1 << 3)
71 #define   INTR_CTRL_CMD_ABORT_EN          (1 << 2)
72 #define   INTR_CTRL_WRITE_PROTECT_EN      (1 << 1)
73 
74 /* Command Control Register */
75 #define R_CE_CMD_CTRL      (0x0C / 4)
76 #define   CTRL_ADDR_BYTE0_DISABLE_SHIFT       4
77 #define   CTRL_DATA_BYTE0_DISABLE_SHIFT       0
78 
79 #define aspeed_smc_addr_byte_enabled(s, i)                               \
80     (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_ADDR_BYTE0_DISABLE_SHIFT + (i)))))
81 #define aspeed_smc_data_byte_enabled(s, i)                               \
82     (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_DATA_BYTE0_DISABLE_SHIFT + (i)))))
83 
84 /* CEx Control Register */
85 #define R_CTRL0           (0x10 / 4)
86 #define   CTRL_IO_QPI              (1 << 31)
87 #define   CTRL_IO_QUAD_DATA        (1 << 30)
88 #define   CTRL_IO_DUAL_DATA        (1 << 29)
89 #define   CTRL_IO_DUAL_ADDR_DATA   (1 << 28) /* Includes dummies */
90 #define   CTRL_IO_QUAD_ADDR_DATA   (1 << 28) /* Includes dummies */
91 #define   CTRL_CMD_SHIFT           16
92 #define   CTRL_CMD_MASK            0xff
93 #define   CTRL_DUMMY_HIGH_SHIFT    14
94 #define   CTRL_AST2400_SPI_4BYTE   (1 << 13)
95 #define CE_CTRL_CLOCK_FREQ_SHIFT   8
96 #define CE_CTRL_CLOCK_FREQ_MASK    0xf
97 #define CE_CTRL_CLOCK_FREQ(div)                                         \
98     (((div) & CE_CTRL_CLOCK_FREQ_MASK) << CE_CTRL_CLOCK_FREQ_SHIFT)
99 #define   CTRL_DUMMY_LOW_SHIFT     6 /* 2 bits [7:6] */
100 #define   CTRL_CE_STOP_ACTIVE      (1 << 2)
101 #define   CTRL_CMD_MODE_MASK       0x3
102 #define     CTRL_READMODE          0x0
103 #define     CTRL_FREADMODE         0x1
104 #define     CTRL_WRITEMODE         0x2
105 #define     CTRL_USERMODE          0x3
106 #define R_CTRL1           (0x14 / 4)
107 #define R_CTRL2           (0x18 / 4)
108 #define R_CTRL3           (0x1C / 4)
109 #define R_CTRL4           (0x20 / 4)
110 
111 /* CEx Segment Address Register */
112 #define R_SEG_ADDR0       (0x30 / 4)
113 #define   SEG_END_SHIFT        24   /* 8MB units */
114 #define   SEG_END_MASK         0xff
115 #define   SEG_START_SHIFT      16   /* address bit [A29-A23] */
116 #define   SEG_START_MASK       0xff
117 #define R_SEG_ADDR1       (0x34 / 4)
118 #define R_SEG_ADDR2       (0x38 / 4)
119 #define R_SEG_ADDR3       (0x3C / 4)
120 #define R_SEG_ADDR4       (0x40 / 4)
121 
122 /* Misc Control Register #1 */
123 #define R_MISC_CTRL1      (0x50 / 4)
124 
125 /* SPI dummy cycle data */
126 #define R_DUMMY_DATA      (0x54 / 4)
127 
128 /* FMC_WDT2 Control/Status Register for Alternate Boot (AST2600) */
129 #define R_FMC_WDT2_CTRL   (0x64 / 4)
130 #define   FMC_WDT2_CTRL_ALT_BOOT_MODE    BIT(6) /* O: 2 chips 1: 1 chip */
131 #define   FMC_WDT2_CTRL_SINGLE_BOOT_MODE BIT(5)
132 #define   FMC_WDT2_CTRL_BOOT_SOURCE      BIT(4) /* O: primary 1: alternate */
133 #define   FMC_WDT2_CTRL_EN               BIT(0)
134 #define R_FMC_WDT2_RELOAD   (0x68 / 4)
135 #define R_FMC_WDT2_RESTART  (0x6C / 4)
136 
137 /* DMA DRAM Side Address High Part (AST2700) */
138 #define R_DMA_DRAM_ADDR_HIGH   (0x7c / 4)
139 
140 /* DMA Control/Status Register */
141 #define R_DMA_CTRL        (0x80 / 4)
142 #define   DMA_CTRL_REQUEST      (1 << 31)
143 #define   DMA_CTRL_GRANT        (1 << 30)
144 #define   DMA_CTRL_DELAY_MASK   0xf
145 #define   DMA_CTRL_DELAY_SHIFT  8
146 #define   DMA_CTRL_FREQ_MASK    0xf
147 #define   DMA_CTRL_FREQ_SHIFT   4
148 #define   DMA_CTRL_CALIB        (1 << 3)
149 #define   DMA_CTRL_CKSUM        (1 << 2)
150 #define   DMA_CTRL_WRITE        (1 << 1)
151 #define   DMA_CTRL_ENABLE       (1 << 0)
152 
153 /* DMA Flash Side Address */
154 #define R_DMA_FLASH_ADDR  (0x84 / 4)
155 
156 /* DMA DRAM Side Address */
157 #define R_DMA_DRAM_ADDR   (0x88 / 4)
158 
159 /* DMA Length Register */
160 #define R_DMA_LEN         (0x8C / 4)
161 
162 /* Checksum Calculation Result */
163 #define R_DMA_CHECKSUM    (0x90 / 4)
164 
165 /* Read Timing Compensation Register */
166 #define R_TIMINGS         (0x94 / 4)
167 
168 /* SPI controller registers and bits (AST2400) */
169 #define R_SPI_CONF        (0x00 / 4)
170 #define   SPI_CONF_ENABLE_W0   0
171 #define R_SPI_CTRL0       (0x4 / 4)
172 #define R_SPI_MISC_CTRL   (0x10 / 4)
173 #define R_SPI_TIMINGS     (0x14 / 4)
174 
175 #define ASPEED_SMC_R_SPI_MAX (0x20 / 4)
176 #define ASPEED_SMC_R_SMC_MAX (0x20 / 4)
177 
178 /*
179  * DMA DRAM addresses should be 4 bytes aligned and the valid address
180  * range is 0x40000000 - 0x5FFFFFFF (AST2400)
181  *          0x80000000 - 0xBFFFFFFF (AST2500)
182  *
183  * DMA flash addresses should be 4 bytes aligned and the valid address
184  * range is 0x20000000 - 0x2FFFFFFF.
185  *
186  * DMA length is from 4 bytes to 32MB (AST2500)
187  *   0: 4 bytes
188  *   0x1FFFFFC: 32M bytes
189  *
190  * DMA length is from 1 byte to 32MB (AST2600, AST10x0 and AST2700)
191  *   0: 1 byte
192  *   0x1FFFFFF: 32M bytes
193  */
194 #define DMA_DRAM_ADDR(asc, val)   ((val) & (asc)->dma_dram_mask)
195 #define DMA_DRAM_ADDR_HIGH(val)   ((val) & 0xf)
196 #define DMA_FLASH_ADDR(asc, val)  ((val) & (asc)->dma_flash_mask)
197 #define DMA_LENGTH(val)         ((val) & 0x01FFFFFF)
198 
199 /* Flash opcodes. */
200 #define SPI_OP_READ       0x03    /* Read data bytes (low frequency) */
201 
202 #define SNOOP_OFF         0xFF
203 #define SNOOP_START       0x0
204 
205 /*
206  * Default segments mapping addresses and size for each peripheral per
207  * controller. These can be changed when board is initialized with the
208  * Segment Address Registers.
209  */
210 static const AspeedSegments aspeed_2500_spi1_segments[];
211 static const AspeedSegments aspeed_2500_spi2_segments[];
212 
213 #define ASPEED_SMC_FEATURE_DMA       0x1
214 #define ASPEED_SMC_FEATURE_DMA_GRANT 0x2
215 #define ASPEED_SMC_FEATURE_WDT_CONTROL 0x4
216 #define ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH 0x08
217 
218 static inline bool aspeed_smc_has_dma(const AspeedSMCClass *asc)
219 {
220     return !!(asc->features & ASPEED_SMC_FEATURE_DMA);
221 }
222 
223 static inline bool aspeed_smc_has_wdt_control(const AspeedSMCClass *asc)
224 {
225     return !!(asc->features & ASPEED_SMC_FEATURE_WDT_CONTROL);
226 }
227 
228 static inline bool aspeed_smc_has_dma64(const AspeedSMCClass *asc)
229 {
230     return !!(asc->features & ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH);
231 }
232 
233 #define aspeed_smc_error(fmt, ...)                                      \
234     qemu_log_mask(LOG_GUEST_ERROR, "%s: " fmt "\n", __func__, ## __VA_ARGS__)
235 
236 static bool aspeed_smc_flash_overlap(const AspeedSMCState *s,
237                                      const AspeedSegments *new,
238                                      int cs)
239 {
240     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
241     AspeedSegments seg;
242     int i;
243 
244     for (i = 0; i < asc->cs_num_max; i++) {
245         if (i == cs) {
246             continue;
247         }
248 
249         asc->reg_to_segment(s, s->regs[R_SEG_ADDR0 + i], &seg);
250 
251         if (new->addr + new->size > seg.addr &&
252             new->addr < seg.addr + seg.size) {
253             aspeed_smc_error("new segment CS%d [ 0x%"
254                              HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with "
255                              "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
256                              cs, new->addr, new->addr + new->size,
257                              i, seg.addr, seg.addr + seg.size);
258             return true;
259         }
260     }
261     return false;
262 }
263 
264 static void aspeed_smc_flash_set_segment_region(AspeedSMCState *s, int cs,
265                                                 uint64_t regval)
266 {
267     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
268     AspeedSMCFlash *fl = &s->flashes[cs];
269     AspeedSegments seg;
270 
271     asc->reg_to_segment(s, regval, &seg);
272 
273     memory_region_transaction_begin();
274     memory_region_set_size(&fl->mmio, seg.size);
275     memory_region_set_address(&fl->mmio, seg.addr - asc->flash_window_base);
276     memory_region_set_enabled(&fl->mmio, !!seg.size);
277     memory_region_transaction_commit();
278 
279     if (asc->segment_addr_mask) {
280         regval &= asc->segment_addr_mask;
281     }
282 
283     s->regs[R_SEG_ADDR0 + cs] = regval;
284 }
285 
286 static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
287                                          uint64_t new)
288 {
289     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
290     AspeedSegments seg;
291 
292     asc->reg_to_segment(s, new, &seg);
293 
294     trace_aspeed_smc_flash_set_segment(cs, new, seg.addr, seg.addr + seg.size);
295 
296     /* The start address of CS0 is read-only */
297     if (cs == 0 && seg.addr != asc->flash_window_base) {
298         aspeed_smc_error("Tried to change CS0 start address to 0x%"
299                          HWADDR_PRIx, seg.addr);
300         seg.addr = asc->flash_window_base;
301         new = asc->segment_to_reg(s, &seg);
302     }
303 
304     /*
305      * The end address of the AST2500 spi controllers is also
306      * read-only.
307      */
308     if ((asc->segments == aspeed_2500_spi1_segments ||
309          asc->segments == aspeed_2500_spi2_segments) &&
310         cs == asc->cs_num_max &&
311         seg.addr + seg.size != asc->segments[cs].addr +
312         asc->segments[cs].size) {
313         aspeed_smc_error("Tried to change CS%d end address to 0x%"
314                          HWADDR_PRIx, cs, seg.addr + seg.size);
315         seg.size = asc->segments[cs].addr + asc->segments[cs].size -
316             seg.addr;
317         new = asc->segment_to_reg(s, &seg);
318     }
319 
320     /* Keep the segment in the overall flash window */
321     if (seg.size &&
322         (seg.addr + seg.size <= asc->flash_window_base ||
323          seg.addr > asc->flash_window_base + asc->flash_window_size)) {
324         aspeed_smc_error("new segment for CS%d is invalid : "
325                          "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
326                          cs, seg.addr, seg.addr + seg.size);
327         return;
328     }
329 
330     /* Check start address vs. alignment */
331     if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) {
332         aspeed_smc_error("new segment for CS%d is not "
333                          "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
334                          cs, seg.addr, seg.addr + seg.size);
335     }
336 
337     /* And segments should not overlap (in the specs) */
338     aspeed_smc_flash_overlap(s, &seg, cs);
339 
340     /* All should be fine now to move the region */
341     aspeed_smc_flash_set_segment_region(s, cs, new);
342 }
343 
344 static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr,
345                                               unsigned size)
346 {
347     aspeed_smc_error("To 0x%" HWADDR_PRIx " of size %u", addr, size);
348     return 0;
349 }
350 
351 static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr,
352                                            uint64_t data, unsigned size)
353 {
354     aspeed_smc_error("To 0x%" HWADDR_PRIx " of size %u: 0x%" PRIx64,
355                      addr, size, data);
356 }
357 
358 static const MemoryRegionOps aspeed_smc_flash_default_ops = {
359     .read = aspeed_smc_flash_default_read,
360     .write = aspeed_smc_flash_default_write,
361     .endianness = DEVICE_LITTLE_ENDIAN,
362     .valid = {
363         .min_access_size = 1,
364         .max_access_size = 4,
365     },
366 };
367 
368 static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl)
369 {
370     const AspeedSMCState *s = fl->controller;
371 
372     return s->regs[s->r_ctrl0 + fl->cs] & CTRL_CMD_MODE_MASK;
373 }
374 
375 static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl)
376 {
377     const AspeedSMCState *s = fl->controller;
378 
379     return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->cs));
380 }
381 
382 static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl)
383 {
384     const AspeedSMCState *s = fl->controller;
385     int cmd = (s->regs[s->r_ctrl0 + fl->cs] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK;
386 
387     /*
388      * In read mode, the default SPI command is READ (0x3). In other
389      * modes, the command should necessarily be defined
390      *
391      * TODO: add support for READ4 (0x13) on AST2600
392      */
393     if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) {
394         cmd = SPI_OP_READ;
395     }
396 
397     if (!cmd) {
398         aspeed_smc_error("no command defined for mode %d",
399                          aspeed_smc_flash_mode(fl));
400     }
401 
402     return cmd;
403 }
404 
405 static inline int aspeed_smc_flash_addr_width(const AspeedSMCFlash *fl)
406 {
407     const AspeedSMCState *s = fl->controller;
408     AspeedSMCClass *asc = fl->asc;
409 
410     if (asc->addr_width) {
411         return asc->addr_width(s);
412     } else {
413         return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->cs)) ? 4 : 3;
414     }
415 }
416 
417 static void aspeed_smc_flash_do_select(AspeedSMCFlash *fl, bool unselect)
418 {
419     AspeedSMCState *s = fl->controller;
420 
421     trace_aspeed_smc_flash_select(fl->cs, unselect ? "un" : "");
422     s->unselect = unselect;
423     qemu_set_irq(s->cs_lines[fl->cs], unselect);
424 }
425 
426 static void aspeed_smc_flash_select(AspeedSMCFlash *fl)
427 {
428     aspeed_smc_flash_do_select(fl, false);
429 }
430 
431 static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl)
432 {
433     aspeed_smc_flash_do_select(fl, true);
434 }
435 
436 static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
437                                               uint32_t addr)
438 {
439     const AspeedSMCState *s = fl->controller;
440     AspeedSMCClass *asc = fl->asc;
441     AspeedSegments seg;
442 
443     asc->reg_to_segment(s, s->regs[R_SEG_ADDR0 + fl->cs], &seg);
444     if ((addr % seg.size) != addr) {
445         aspeed_smc_error("invalid address 0x%08x for CS%d segment : "
446                          "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
447                          addr, fl->cs, seg.addr, seg.addr + seg.size);
448         addr %= seg.size;
449     }
450 
451     return addr;
452 }
453 
454 static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl)
455 {
456     const AspeedSMCState *s = fl->controller;
457     uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->cs];
458     uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1;
459     uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3;
460     uint32_t dummies = ((dummy_high << 2) | dummy_low) * 8;
461 
462     if (r_ctrl0 & CTRL_IO_DUAL_ADDR_DATA) {
463         dummies /= 2;
464     }
465 
466     return dummies;
467 }
468 
469 static void aspeed_smc_flash_setup(AspeedSMCFlash *fl, uint32_t addr)
470 {
471     const AspeedSMCState *s = fl->controller;
472     uint8_t cmd = aspeed_smc_flash_cmd(fl);
473     int i = aspeed_smc_flash_addr_width(fl);
474 
475     /* Flash access can not exceed CS segment */
476     addr = aspeed_smc_check_segment_addr(fl, addr);
477 
478     ssi_transfer(s->spi, cmd);
479     while (i--) {
480         if (aspeed_smc_addr_byte_enabled(s, i)) {
481             ssi_transfer(s->spi, (addr >> (i * 8)) & 0xff);
482         }
483     }
484 
485     /*
486      * Use fake transfers to model dummy bytes. The value should
487      * be configured to some non-zero value in fast read mode and
488      * zero in read mode. But, as the HW allows inconsistent
489      * settings, let's check for fast read mode.
490      */
491     if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) {
492         for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) {
493             ssi_transfer(fl->controller->spi, s->regs[R_DUMMY_DATA] & 0xff);
494         }
495     }
496 }
497 
498 static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
499 {
500     AspeedSMCFlash *fl = opaque;
501     AspeedSMCState *s = fl->controller;
502     uint64_t ret = 0;
503     int i;
504 
505     switch (aspeed_smc_flash_mode(fl)) {
506     case CTRL_USERMODE:
507         for (i = 0; i < size; i++) {
508             ret |= (uint64_t) ssi_transfer(s->spi, 0x0) << (8 * i);
509         }
510         break;
511     case CTRL_READMODE:
512     case CTRL_FREADMODE:
513         aspeed_smc_flash_select(fl);
514         aspeed_smc_flash_setup(fl, addr);
515 
516         for (i = 0; i < size; i++) {
517             ret |= (uint64_t) ssi_transfer(s->spi, 0x0) << (8 * i);
518         }
519 
520         aspeed_smc_flash_unselect(fl);
521         break;
522     default:
523         aspeed_smc_error("invalid flash mode %d", aspeed_smc_flash_mode(fl));
524     }
525 
526     trace_aspeed_smc_flash_read(fl->cs, addr, size, ret,
527                                 aspeed_smc_flash_mode(fl));
528     return ret;
529 }
530 
531 /*
532  * TODO (clg@kaod.org): stolen from xilinx_spips.c. Should move to a
533  * common include header.
534  */
535 typedef enum {
536     READ = 0x3,         READ_4 = 0x13,
537     FAST_READ = 0xb,    FAST_READ_4 = 0x0c,
538     DOR = 0x3b,         DOR_4 = 0x3c,
539     QOR = 0x6b,         QOR_4 = 0x6c,
540     DIOR = 0xbb,        DIOR_4 = 0xbc,
541     QIOR = 0xeb,        QIOR_4 = 0xec,
542 
543     PP = 0x2,           PP_4 = 0x12,
544     DPP = 0xa2,
545     QPP = 0x32,         QPP_4 = 0x34,
546 } FlashCMD;
547 
548 static int aspeed_smc_num_dummies(uint8_t command)
549 {
550     switch (command) { /* check for dummies */
551     case READ: /* no dummy bytes/cycles */
552     case PP:
553     case DPP:
554     case QPP:
555     case READ_4:
556     case PP_4:
557     case QPP_4:
558         return 0;
559     case FAST_READ:
560     case DOR:
561     case QOR:
562     case FAST_READ_4:
563     case DOR_4:
564     case QOR_4:
565         return 1;
566     case DIOR:
567     case DIOR_4:
568         return 2;
569     case QIOR:
570     case QIOR_4:
571         return 4;
572     default:
573         return -1;
574     }
575 }
576 
577 static bool aspeed_smc_do_snoop(AspeedSMCFlash *fl,  uint64_t data,
578                                 unsigned size)
579 {
580     AspeedSMCState *s = fl->controller;
581     uint8_t addr_width = aspeed_smc_flash_addr_width(fl);
582 
583     trace_aspeed_smc_do_snoop(fl->cs, s->snoop_index, s->snoop_dummies,
584                               (uint8_t) data & 0xff);
585 
586     if (s->snoop_index == SNOOP_OFF) {
587         return false; /* Do nothing */
588 
589     } else if (s->snoop_index == SNOOP_START) {
590         uint8_t cmd = data & 0xff;
591         int ndummies = aspeed_smc_num_dummies(cmd);
592 
593         /*
594          * No dummy cycles are expected with the current command. Turn
595          * off snooping and let the transfer proceed normally.
596          */
597         if (ndummies <= 0) {
598             s->snoop_index = SNOOP_OFF;
599             return false;
600         }
601 
602         s->snoop_dummies = ndummies * 8;
603 
604     } else if (s->snoop_index >= addr_width + 1) {
605 
606         /* The SPI transfer has reached the dummy cycles sequence */
607         for (; s->snoop_dummies; s->snoop_dummies--) {
608             ssi_transfer(s->spi, s->regs[R_DUMMY_DATA] & 0xff);
609         }
610 
611         /* If no more dummy cycles are expected, turn off snooping */
612         if (!s->snoop_dummies) {
613             s->snoop_index = SNOOP_OFF;
614         } else {
615             s->snoop_index += size;
616         }
617 
618         /*
619          * Dummy cycles have been faked already. Ignore the current
620          * SPI transfer
621          */
622         return true;
623     }
624 
625     s->snoop_index += size;
626     return false;
627 }
628 
629 static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,
630                                    unsigned size)
631 {
632     AspeedSMCFlash *fl = opaque;
633     AspeedSMCState *s = fl->controller;
634     int i;
635 
636     trace_aspeed_smc_flash_write(fl->cs, addr, size, data,
637                                  aspeed_smc_flash_mode(fl));
638 
639     if (!aspeed_smc_is_writable(fl)) {
640         aspeed_smc_error("flash is not writable at 0x%" HWADDR_PRIx, addr);
641         return;
642     }
643 
644     switch (aspeed_smc_flash_mode(fl)) {
645     case CTRL_USERMODE:
646         if (aspeed_smc_do_snoop(fl, data, size)) {
647             break;
648         }
649 
650         for (i = 0; i < size; i++) {
651             ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
652         }
653         break;
654     case CTRL_WRITEMODE:
655         aspeed_smc_flash_select(fl);
656         aspeed_smc_flash_setup(fl, addr);
657 
658         for (i = 0; i < size; i++) {
659             ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
660         }
661 
662         aspeed_smc_flash_unselect(fl);
663         break;
664     default:
665         aspeed_smc_error("invalid flash mode %d", aspeed_smc_flash_mode(fl));
666     }
667 }
668 
669 static const MemoryRegionOps aspeed_smc_flash_ops = {
670     .read = aspeed_smc_flash_read,
671     .write = aspeed_smc_flash_write,
672     .endianness = DEVICE_LITTLE_ENDIAN,
673     .valid = {
674         .min_access_size = 1,
675         .max_access_size = 4,
676     },
677 };
678 
679 static void aspeed_smc_flash_update_ctrl(AspeedSMCFlash *fl, uint32_t value)
680 {
681     AspeedSMCState *s = fl->controller;
682     bool unselect = false;
683     uint32_t old_mode;
684     uint32_t new_mode;
685 
686     old_mode = s->regs[s->r_ctrl0 + fl->cs] & CTRL_CMD_MODE_MASK;
687     new_mode = value & CTRL_CMD_MODE_MASK;
688 
689     if (old_mode == CTRL_USERMODE) {
690         if (new_mode != CTRL_USERMODE) {
691             unselect = true;
692         }
693 
694         /* A change of CTRL_CE_STOP_ACTIVE from 0 to 1, unselects the CS */
695         if (!(s->regs[s->r_ctrl0 + fl->cs] & CTRL_CE_STOP_ACTIVE) &&
696             value & CTRL_CE_STOP_ACTIVE) {
697             unselect = true;
698         }
699     } else {
700         if (new_mode != CTRL_USERMODE) {
701             unselect = true;
702         }
703     }
704 
705     s->regs[s->r_ctrl0 + fl->cs] = value;
706 
707     if (unselect != s->unselect) {
708         s->snoop_index = unselect ? SNOOP_OFF : SNOOP_START;
709         aspeed_smc_flash_do_select(fl, unselect);
710     }
711 }
712 
713 static void aspeed_smc_reset(DeviceState *d)
714 {
715     AspeedSMCState *s = ASPEED_SMC(d);
716     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
717     int i;
718 
719     if (asc->resets) {
720         memcpy(s->regs, asc->resets, sizeof s->regs);
721     } else {
722         memset(s->regs, 0, sizeof s->regs);
723     }
724 
725     for (i = 0; i < asc->cs_num_max; i++) {
726         DeviceState *dev = ssi_get_cs(s->spi, i);
727         if (dev) {
728             Object *o = OBJECT(dev);
729 
730             if (!object_dynamic_cast(o, TYPE_M25P80)) {
731                 warn_report("Aspeed SMC %s.%d : Invalid %s device type",
732                             BUS(s->spi)->name, i, object_get_typename(o));
733                 continue;
734             }
735 
736             qemu_irq cs_line = qdev_get_gpio_in_named(dev, SSI_GPIO_CS, 0);
737             qdev_connect_gpio_out_named(DEVICE(s), "cs", i, cs_line);
738         }
739     }
740 
741     /* Unselect all peripherals */
742     for (i = 0; i < asc->cs_num_max; ++i) {
743         s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE;
744         qemu_set_irq(s->cs_lines[i], true);
745     }
746 
747     s->unselect = true;
748 
749     /* setup the default segment register values and regions for all */
750     for (i = 0; i < asc->cs_num_max; ++i) {
751         aspeed_smc_flash_set_segment_region(s, i,
752                     asc->segment_to_reg(s, &asc->segments[i]));
753     }
754 
755     s->snoop_index = SNOOP_OFF;
756     s->snoop_dummies = 0;
757 }
758 
759 #define ASPEED_WDT_RELOAD  0x04
760 #define ASPEED_WDT_RESTART 0x08
761 #define ASPEED_WDT_CTRL    0x0C
762 
763 static void aspeed_smc_wdt2_write(AspeedSMCState *s, uint32_t offset,
764                                   uint32_t value)
765 {
766     MemTxResult result;
767 
768     address_space_stl_le(&s->wdt2_as, offset, value, MEMTXATTRS_UNSPECIFIED,
769                          &result);
770     if (result != MEMTX_OK) {
771         aspeed_smc_error("WDT2 write failed @%08x", offset);
772         return;
773     }
774 }
775 
776 static uint64_t aspeed_smc_wdt2_read(AspeedSMCState *s, uint32_t offset)
777 {
778     MemTxResult result;
779     uint32_t value;
780 
781     value = address_space_ldl_le(&s->wdt2_as, offset, MEMTXATTRS_UNSPECIFIED,
782                                 &result);
783     if (result != MEMTX_OK) {
784         aspeed_smc_error("WDT2 read failed @%08x", offset);
785         return -1;
786     }
787     return value;
788 }
789 
790 static void aspeed_smc_wdt2_enable(AspeedSMCState *s, bool enable)
791 {
792     uint32_t value;
793 
794     value = aspeed_smc_wdt2_read(s, ASPEED_WDT_CTRL);
795     if (value == -1) {
796         return;
797     }
798 
799     value &= ~BIT(0);
800     value |= enable;
801 
802     aspeed_smc_wdt2_write(s, ASPEED_WDT_CTRL, value);
803 
804     trace_aspeed_smc_wdt2_enable(enable ? "en" : "dis");
805 }
806 
807 static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
808 {
809     AspeedSMCState *s = ASPEED_SMC(opaque);
810     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(opaque);
811 
812     addr >>= 2;
813 
814     if (addr == s->r_conf ||
815         (addr >= s->r_timings &&
816          addr < s->r_timings + asc->nregs_timings) ||
817         addr == s->r_ce_ctrl ||
818         addr == R_CE_CMD_CTRL ||
819         addr == R_INTR_CTRL ||
820         addr == R_DUMMY_DATA ||
821         (aspeed_smc_has_dma(asc) && addr == R_DMA_CTRL) ||
822         (aspeed_smc_has_dma(asc) && addr == R_DMA_FLASH_ADDR) ||
823         (aspeed_smc_has_dma(asc) && addr == R_DMA_DRAM_ADDR) ||
824         (aspeed_smc_has_dma(asc) && aspeed_smc_has_dma64(asc) &&
825          addr == R_DMA_DRAM_ADDR_HIGH) ||
826         (aspeed_smc_has_dma(asc) && addr == R_DMA_LEN) ||
827         (aspeed_smc_has_dma(asc) && addr == R_DMA_CHECKSUM) ||
828         (addr >= R_SEG_ADDR0 &&
829          addr < R_SEG_ADDR0 + asc->cs_num_max) ||
830         (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + asc->cs_num_max)) {
831 
832         trace_aspeed_smc_read(addr << 2, size, s->regs[addr]);
833 
834         return s->regs[addr];
835     } else if (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_CTRL) {
836         return aspeed_smc_wdt2_read(s, ASPEED_WDT_CTRL);
837     } else if (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_RELOAD) {
838         return aspeed_smc_wdt2_read(s, ASPEED_WDT_RELOAD) / 100000;
839     } else {
840         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
841                       __func__, addr);
842         return -1;
843     }
844 }
845 
846 static uint8_t aspeed_smc_hclk_divisor(uint8_t hclk_mask)
847 {
848     /* HCLK/1 .. HCLK/16 */
849     const uint8_t hclk_divisors[] = {
850         15, 7, 14, 6, 13, 5, 12, 4, 11, 3, 10, 2, 9, 1, 8, 0
851     };
852     int i;
853 
854     for (i = 0; i < ARRAY_SIZE(hclk_divisors); i++) {
855         if (hclk_mask == hclk_divisors[i]) {
856             return i + 1;
857         }
858     }
859 
860     g_assert_not_reached();
861 }
862 
863 /*
864  * When doing calibration, the SPI clock rate in the CE0 Control
865  * Register and the read delay cycles in the Read Timing Compensation
866  * Register are set using bit[11:4] of the DMA Control Register.
867  */
868 static void aspeed_smc_dma_calibration(AspeedSMCState *s)
869 {
870     uint8_t delay =
871         (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
872     uint8_t hclk_mask =
873         (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
874     uint8_t hclk_div = aspeed_smc_hclk_divisor(hclk_mask);
875     uint32_t hclk_shift = (hclk_div - 1) << 2;
876     uint8_t cs;
877 
878     /*
879      * The Read Timing Compensation Register values apply to all CS on
880      * the SPI bus and only HCLK/1 - HCLK/5 can have tunable delays
881      */
882     if (hclk_div && hclk_div < 6) {
883         s->regs[s->r_timings] &= ~(0xf << hclk_shift);
884         s->regs[s->r_timings] |= delay << hclk_shift;
885     }
886 
887     /*
888      * TODO: compute the CS from the DMA address and the segment
889      * registers. This is not really a problem for now because the
890      * Timing Register values apply to all CS and software uses CS0 to
891      * do calibration.
892      */
893     cs = 0;
894     s->regs[s->r_ctrl0 + cs] &=
895         ~(CE_CTRL_CLOCK_FREQ_MASK << CE_CTRL_CLOCK_FREQ_SHIFT);
896     s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
897 }
898 
899 /*
900  * Emulate read errors in the DMA Checksum Register for high
901  * frequencies and optimistic settings of the Read Timing Compensation
902  * Register. This will help in tuning the SPI timing calibration
903  * algorithm.
904  */
905 static bool aspeed_smc_inject_read_failure(AspeedSMCState *s)
906 {
907     uint8_t delay =
908         (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
909     uint8_t hclk_mask =
910         (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
911 
912     /*
913      * Typical values of a palmetto-bmc machine.
914      */
915     switch (aspeed_smc_hclk_divisor(hclk_mask)) {
916     case 4 ... 16:
917         return false;
918     case 3: /* at least one HCLK cycle delay */
919         return (delay & 0x7) < 1;
920     case 2: /* at least two HCLK cycle delay */
921         return (delay & 0x7) < 2;
922     case 1: /* (> 100MHz) is above the max freq of the controller */
923         return true;
924     default:
925         g_assert_not_reached();
926     }
927 }
928 
929 static uint64_t aspeed_smc_dma_dram_addr(AspeedSMCState *s)
930 {
931     return s->regs[R_DMA_DRAM_ADDR] |
932         ((uint64_t) s->regs[R_DMA_DRAM_ADDR_HIGH] << 32);
933 }
934 
935 static uint32_t aspeed_smc_dma_len(AspeedSMCState *s)
936 {
937     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
938 
939     return QEMU_ALIGN_UP(s->regs[R_DMA_LEN] + asc->dma_start_length, 4);
940 }
941 
942 /*
943  * Accumulate the result of the reads to provide a checksum that will
944  * be used to validate the read timing settings.
945  */
946 static void aspeed_smc_dma_checksum(AspeedSMCState *s)
947 {
948     MemTxResult result;
949     uint32_t dma_len;
950     uint32_t data;
951 
952     if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
953         aspeed_smc_error("invalid direction for DMA checksum");
954         return;
955     }
956 
957     if (s->regs[R_DMA_CTRL] & DMA_CTRL_CALIB) {
958         aspeed_smc_dma_calibration(s);
959     }
960 
961     dma_len = aspeed_smc_dma_len(s);
962 
963     while (dma_len) {
964         data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
965                                     MEMTXATTRS_UNSPECIFIED, &result);
966         if (result != MEMTX_OK) {
967             aspeed_smc_error("Flash read failed @%08x",
968                              s->regs[R_DMA_FLASH_ADDR]);
969             return;
970         }
971         trace_aspeed_smc_dma_checksum(s->regs[R_DMA_FLASH_ADDR], data);
972 
973         /*
974          * When the DMA is on-going, the DMA registers are updated
975          * with the current working addresses and length.
976          */
977         s->regs[R_DMA_CHECKSUM] += data;
978         s->regs[R_DMA_FLASH_ADDR] += 4;
979         dma_len -= 4;
980         s->regs[R_DMA_LEN] = dma_len;
981     }
982 
983     if (s->inject_failure && aspeed_smc_inject_read_failure(s)) {
984         s->regs[R_DMA_CHECKSUM] = 0xbadc0de;
985     }
986 
987 }
988 
989 static void aspeed_smc_dma_rw(AspeedSMCState *s)
990 {
991     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
992     uint64_t dma_dram_offset;
993     uint64_t dma_dram_addr;
994     MemTxResult result;
995     uint32_t dma_len;
996     uint32_t data;
997 
998     dma_len = aspeed_smc_dma_len(s);
999     dma_dram_addr = aspeed_smc_dma_dram_addr(s);
1000 
1001     if (aspeed_smc_has_dma64(asc)) {
1002         dma_dram_offset = dma_dram_addr - s->dram_base;
1003     } else {
1004         dma_dram_offset = dma_dram_addr;
1005     }
1006 
1007     trace_aspeed_smc_dma_rw(s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE ?
1008                             "write" : "read",
1009                             s->regs[R_DMA_FLASH_ADDR],
1010                             dma_dram_offset,
1011                             dma_len);
1012     while (dma_len) {
1013         if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
1014             data = address_space_ldl_le(&s->dram_as, dma_dram_offset,
1015                                         MEMTXATTRS_UNSPECIFIED, &result);
1016             if (result != MEMTX_OK) {
1017                 aspeed_smc_error("DRAM read failed @%" PRIx64,
1018                                  dma_dram_offset);
1019                 return;
1020             }
1021 
1022             address_space_stl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
1023                                  data, MEMTXATTRS_UNSPECIFIED, &result);
1024             if (result != MEMTX_OK) {
1025                 aspeed_smc_error("Flash write failed @%08x",
1026                                  s->regs[R_DMA_FLASH_ADDR]);
1027                 return;
1028             }
1029         } else {
1030             data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
1031                                         MEMTXATTRS_UNSPECIFIED, &result);
1032             if (result != MEMTX_OK) {
1033                 aspeed_smc_error("Flash read failed @%08x",
1034                                  s->regs[R_DMA_FLASH_ADDR]);
1035                 return;
1036             }
1037 
1038             address_space_stl_le(&s->dram_as, dma_dram_offset,
1039                                  data, MEMTXATTRS_UNSPECIFIED, &result);
1040             if (result != MEMTX_OK) {
1041                 aspeed_smc_error("DRAM write failed @%" PRIx64,
1042                                  dma_dram_offset);
1043                 return;
1044             }
1045         }
1046 
1047         /*
1048          * When the DMA is on-going, the DMA registers are updated
1049          * with the current working addresses and length.
1050          */
1051         dma_dram_offset += 4;
1052         dma_dram_addr += 4;
1053 
1054         s->regs[R_DMA_DRAM_ADDR_HIGH] = dma_dram_addr >> 32;
1055         s->regs[R_DMA_DRAM_ADDR] = dma_dram_addr & 0xffffffff;
1056         s->regs[R_DMA_FLASH_ADDR] += 4;
1057         dma_len -= 4;
1058         s->regs[R_DMA_LEN] = dma_len;
1059         s->regs[R_DMA_CHECKSUM] += data;
1060     }
1061 }
1062 
1063 static void aspeed_smc_dma_stop(AspeedSMCState *s)
1064 {
1065     /*
1066      * When the DMA is disabled, INTR_CTRL_DMA_STATUS=0 means the
1067      * engine is idle
1068      */
1069     s->regs[R_INTR_CTRL] &= ~INTR_CTRL_DMA_STATUS;
1070     s->regs[R_DMA_CHECKSUM] = 0;
1071 
1072     /*
1073      * Lower the DMA irq in any case. The IRQ control register could
1074      * have been cleared before disabling the DMA.
1075      */
1076     qemu_irq_lower(s->irq);
1077 }
1078 
1079 /*
1080  * When INTR_CTRL_DMA_STATUS=1, the DMA has completed and a new DMA
1081  * can start even if the result of the previous was not collected.
1082  */
1083 static bool aspeed_smc_dma_in_progress(AspeedSMCState *s)
1084 {
1085     return s->regs[R_DMA_CTRL] & DMA_CTRL_ENABLE &&
1086         !(s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_STATUS);
1087 }
1088 
1089 static void aspeed_smc_dma_done(AspeedSMCState *s)
1090 {
1091     s->regs[R_INTR_CTRL] |= INTR_CTRL_DMA_STATUS;
1092     if (s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_EN) {
1093         qemu_irq_raise(s->irq);
1094     }
1095 }
1096 
1097 static void aspeed_smc_dma_ctrl(AspeedSMCState *s, uint32_t dma_ctrl)
1098 {
1099     if (!(dma_ctrl & DMA_CTRL_ENABLE)) {
1100         s->regs[R_DMA_CTRL] = dma_ctrl;
1101 
1102         aspeed_smc_dma_stop(s);
1103         return;
1104     }
1105 
1106     if (aspeed_smc_dma_in_progress(s)) {
1107         aspeed_smc_error("DMA in progress !");
1108         return;
1109     }
1110 
1111     s->regs[R_DMA_CTRL] = dma_ctrl;
1112 
1113     if (s->regs[R_DMA_CTRL] & DMA_CTRL_CKSUM) {
1114         aspeed_smc_dma_checksum(s);
1115     } else {
1116         aspeed_smc_dma_rw(s);
1117     }
1118 
1119     aspeed_smc_dma_done(s);
1120 }
1121 
1122 static inline bool aspeed_smc_dma_granted(AspeedSMCState *s)
1123 {
1124     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1125 
1126     if (!(asc->features & ASPEED_SMC_FEATURE_DMA_GRANT)) {
1127         return true;
1128     }
1129 
1130     if (!(s->regs[R_DMA_CTRL] & DMA_CTRL_GRANT)) {
1131         aspeed_smc_error("DMA not granted");
1132         return false;
1133     }
1134 
1135     return true;
1136 }
1137 
1138 static void aspeed_2600_smc_dma_ctrl(AspeedSMCState *s, uint32_t dma_ctrl)
1139 {
1140     /* Preserve DMA bits  */
1141     dma_ctrl |= s->regs[R_DMA_CTRL] & (DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1142 
1143     if (dma_ctrl == 0xAEED0000) {
1144         /* automatically grant request */
1145         s->regs[R_DMA_CTRL] |= (DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1146         return;
1147     }
1148 
1149     /* clear request */
1150     if (dma_ctrl == 0xDEEA0000) {
1151         s->regs[R_DMA_CTRL] &= ~(DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1152         return;
1153     }
1154 
1155     if (!aspeed_smc_dma_granted(s)) {
1156         aspeed_smc_error("DMA not granted");
1157         return;
1158     }
1159 
1160     aspeed_smc_dma_ctrl(s, dma_ctrl);
1161     s->regs[R_DMA_CTRL] &= ~(DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1162 }
1163 
1164 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
1165                              unsigned int size)
1166 {
1167     AspeedSMCState *s = ASPEED_SMC(opaque);
1168     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1169     uint32_t value = data;
1170 
1171     trace_aspeed_smc_write(addr, size, data);
1172 
1173     addr >>= 2;
1174 
1175     if (addr == s->r_conf ||
1176         (addr >= s->r_timings &&
1177          addr < s->r_timings + asc->nregs_timings) ||
1178         addr == s->r_ce_ctrl) {
1179         s->regs[addr] = value;
1180     } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + asc->cs_num_max) {
1181         int cs = addr - s->r_ctrl0;
1182         aspeed_smc_flash_update_ctrl(&s->flashes[cs], value);
1183     } else if (addr >= R_SEG_ADDR0 &&
1184                addr < R_SEG_ADDR0 + asc->cs_num_max) {
1185         int cs = addr - R_SEG_ADDR0;
1186 
1187         if (value != s->regs[R_SEG_ADDR0 + cs]) {
1188             aspeed_smc_flash_set_segment(s, cs, value);
1189         }
1190     } else if (addr == R_CE_CMD_CTRL) {
1191         s->regs[addr] = value & 0xff;
1192     } else if (addr == R_DUMMY_DATA) {
1193         s->regs[addr] = value & 0xff;
1194     } else if (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_CTRL) {
1195         aspeed_smc_wdt2_enable(s, !!(value & FMC_WDT2_CTRL_EN));
1196     } else if (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_RELOAD) {
1197         aspeed_smc_wdt2_write(s, ASPEED_WDT_RELOAD, value * 100000);
1198     } else if (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_RESTART) {
1199         aspeed_smc_wdt2_write(s, ASPEED_WDT_RESTART, value);
1200     } else if (addr == R_INTR_CTRL) {
1201         s->regs[addr] = value;
1202     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_CTRL) {
1203         asc->dma_ctrl(s, value);
1204     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_DRAM_ADDR &&
1205                aspeed_smc_dma_granted(s)) {
1206         s->regs[addr] = DMA_DRAM_ADDR(asc, value);
1207     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_FLASH_ADDR &&
1208                aspeed_smc_dma_granted(s)) {
1209         s->regs[addr] = DMA_FLASH_ADDR(asc, value);
1210     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_LEN &&
1211                aspeed_smc_dma_granted(s)) {
1212         s->regs[addr] = DMA_LENGTH(value);
1213     } else if (aspeed_smc_has_dma(asc) && aspeed_smc_has_dma64(asc) &&
1214                addr == R_DMA_DRAM_ADDR_HIGH) {
1215         s->regs[addr] = DMA_DRAM_ADDR_HIGH(value);
1216     } else {
1217         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
1218                       __func__, addr);
1219         return;
1220     }
1221 }
1222 
1223 static const MemoryRegionOps aspeed_smc_ops = {
1224     .read = aspeed_smc_read,
1225     .write = aspeed_smc_write,
1226     .endianness = DEVICE_LITTLE_ENDIAN,
1227 };
1228 
1229 static void aspeed_smc_instance_init(Object *obj)
1230 {
1231     AspeedSMCState *s = ASPEED_SMC(obj);
1232     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1233     int i;
1234 
1235     for (i = 0; i < asc->cs_num_max; i++) {
1236         object_initialize_child(obj, "flash[*]", &s->flashes[i],
1237                                 TYPE_ASPEED_SMC_FLASH);
1238     }
1239 }
1240 
1241 /*
1242  * Initialize the custom address spaces for DMAs
1243  */
1244 static void aspeed_smc_dma_setup(AspeedSMCState *s, Error **errp)
1245 {
1246     if (!s->dram_mr) {
1247         error_setg(errp, TYPE_ASPEED_SMC ": 'dram' link not set");
1248         return;
1249     }
1250 
1251     address_space_init(&s->flash_as, &s->mmio_flash,
1252                        TYPE_ASPEED_SMC ".dma-flash");
1253     address_space_init(&s->dram_as, s->dram_mr,
1254                        TYPE_ASPEED_SMC ".dma-dram");
1255 }
1256 
1257 static void aspeed_smc_wdt_setup(AspeedSMCState *s, Error **errp)
1258 {
1259     if (!s->wdt2_mr) {
1260         error_setg(errp, TYPE_ASPEED_SMC ": 'wdt2' link not set");
1261         return;
1262     }
1263 
1264     address_space_init(&s->wdt2_as, s->wdt2_mr, TYPE_ASPEED_SMC ".wdt2");
1265 }
1266 
1267 static void aspeed_smc_realize(DeviceState *dev, Error **errp)
1268 {
1269     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1270     AspeedSMCState *s = ASPEED_SMC(dev);
1271     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1272     int i;
1273     hwaddr offset = 0;
1274 
1275     /* keep a copy under AspeedSMCState to speed up accesses */
1276     s->r_conf = asc->r_conf;
1277     s->r_ce_ctrl = asc->r_ce_ctrl;
1278     s->r_ctrl0 = asc->r_ctrl0;
1279     s->r_timings = asc->r_timings;
1280     s->conf_enable_w0 = asc->conf_enable_w0;
1281 
1282     /* DMA irq. Keep it first for the initialization in the SoC */
1283     sysbus_init_irq(sbd, &s->irq);
1284 
1285     s->spi = ssi_create_bus(dev, NULL);
1286 
1287     /* Setup cs_lines for peripherals */
1288     s->cs_lines = g_new0(qemu_irq, asc->cs_num_max);
1289     qdev_init_gpio_out_named(DEVICE(s), s->cs_lines, "cs", asc->cs_num_max);
1290 
1291     /* The memory region for the controller registers */
1292     memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s,
1293                           TYPE_ASPEED_SMC, asc->nregs * 4);
1294     sysbus_init_mmio(sbd, &s->mmio);
1295 
1296     /*
1297      * The container memory region representing the address space
1298      * window in which the flash modules are mapped. The size and
1299      * address depends on the SoC model and controller type.
1300      */
1301     memory_region_init(&s->mmio_flash_container, OBJECT(s),
1302                        TYPE_ASPEED_SMC ".container",
1303                        asc->flash_window_size);
1304     sysbus_init_mmio(sbd, &s->mmio_flash_container);
1305 
1306     memory_region_init_io(&s->mmio_flash, OBJECT(s),
1307                           &aspeed_smc_flash_default_ops, s,
1308                           TYPE_ASPEED_SMC ".flash",
1309                           asc->flash_window_size);
1310     memory_region_add_subregion(&s->mmio_flash_container, 0x0,
1311                                 &s->mmio_flash);
1312 
1313     /*
1314      * Let's create a sub memory region for each possible peripheral. All
1315      * have a configurable memory segment in the overall flash mapping
1316      * window of the controller but, there is not necessarily a flash
1317      * module behind to handle the memory accesses. This depends on
1318      * the board configuration.
1319      */
1320     for (i = 0; i < asc->cs_num_max; ++i) {
1321         AspeedSMCFlash *fl = &s->flashes[i];
1322 
1323         if (!object_property_set_link(OBJECT(fl), "controller", OBJECT(s),
1324                                       errp)) {
1325             return;
1326         }
1327         if (!object_property_set_uint(OBJECT(fl), "cs", i, errp)) {
1328             return;
1329         }
1330         if (!sysbus_realize(SYS_BUS_DEVICE(fl), errp)) {
1331             return;
1332         }
1333 
1334         memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio);
1335         offset += asc->segments[i].size;
1336     }
1337 
1338     /* DMA support */
1339     if (aspeed_smc_has_dma(asc)) {
1340         aspeed_smc_dma_setup(s, errp);
1341     }
1342 
1343     /* WDT2 support */
1344     if (aspeed_smc_has_wdt_control(asc)) {
1345         aspeed_smc_wdt_setup(s, errp);
1346     }
1347 }
1348 
1349 static const VMStateDescription vmstate_aspeed_smc = {
1350     .name = "aspeed.smc",
1351     .version_id = 3,
1352     .minimum_version_id = 2,
1353     .fields = (const VMStateField[]) {
1354         VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX),
1355         VMSTATE_UINT8(snoop_index, AspeedSMCState),
1356         VMSTATE_UINT8(snoop_dummies, AspeedSMCState),
1357         VMSTATE_BOOL_V(unselect, AspeedSMCState, 3),
1358         VMSTATE_END_OF_LIST()
1359     }
1360 };
1361 
1362 static Property aspeed_smc_properties[] = {
1363     DEFINE_PROP_BOOL("inject-failure", AspeedSMCState, inject_failure, false),
1364     DEFINE_PROP_UINT64("dram-base", AspeedSMCState, dram_base, 0),
1365     DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
1366                      TYPE_MEMORY_REGION, MemoryRegion *),
1367     DEFINE_PROP_LINK("wdt2", AspeedSMCState, wdt2_mr,
1368                      TYPE_MEMORY_REGION, MemoryRegion *),
1369     DEFINE_PROP_END_OF_LIST(),
1370 };
1371 
1372 static void aspeed_smc_class_init(ObjectClass *klass, void *data)
1373 {
1374     DeviceClass *dc = DEVICE_CLASS(klass);
1375 
1376     dc->realize = aspeed_smc_realize;
1377     device_class_set_legacy_reset(dc, aspeed_smc_reset);
1378     device_class_set_props(dc, aspeed_smc_properties);
1379     dc->vmsd = &vmstate_aspeed_smc;
1380 }
1381 
1382 static const TypeInfo aspeed_smc_info = {
1383     .name           = TYPE_ASPEED_SMC,
1384     .parent         = TYPE_SYS_BUS_DEVICE,
1385     .instance_init  = aspeed_smc_instance_init,
1386     .instance_size  = sizeof(AspeedSMCState),
1387     .class_size     = sizeof(AspeedSMCClass),
1388     .class_init     = aspeed_smc_class_init,
1389     .abstract       = true,
1390 };
1391 
1392 static void aspeed_smc_flash_realize(DeviceState *dev, Error **errp)
1393 {
1394     AspeedSMCFlash *s = ASPEED_SMC_FLASH(dev);
1395     g_autofree char *name = g_strdup_printf(TYPE_ASPEED_SMC_FLASH ".%d", s->cs);
1396 
1397     if (!s->controller) {
1398         error_setg(errp, TYPE_ASPEED_SMC_FLASH ": 'controller' link not set");
1399         return;
1400     }
1401 
1402     s->asc = ASPEED_SMC_GET_CLASS(s->controller);
1403 
1404     /*
1405      * Use the default segment value to size the memory region. This
1406      * can be changed by FW at runtime.
1407      */
1408     memory_region_init_io(&s->mmio, OBJECT(s), s->asc->reg_ops,
1409                           s, name, s->asc->segments[s->cs].size);
1410     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
1411 }
1412 
1413 static Property aspeed_smc_flash_properties[] = {
1414     DEFINE_PROP_UINT8("cs", AspeedSMCFlash, cs, 0),
1415     DEFINE_PROP_LINK("controller", AspeedSMCFlash, controller, TYPE_ASPEED_SMC,
1416                      AspeedSMCState *),
1417     DEFINE_PROP_END_OF_LIST(),
1418 };
1419 
1420 static void aspeed_smc_flash_class_init(ObjectClass *klass, void *data)
1421 {
1422     DeviceClass *dc = DEVICE_CLASS(klass);
1423 
1424     dc->desc = "Aspeed SMC Flash device region";
1425     dc->realize = aspeed_smc_flash_realize;
1426     device_class_set_props(dc, aspeed_smc_flash_properties);
1427 }
1428 
1429 static const TypeInfo aspeed_smc_flash_info = {
1430     .name           = TYPE_ASPEED_SMC_FLASH,
1431     .parent         = TYPE_SYS_BUS_DEVICE,
1432     .instance_size  = sizeof(AspeedSMCFlash),
1433     .class_init     = aspeed_smc_flash_class_init,
1434 };
1435 
1436 /*
1437  * The Segment Registers of the AST2400 and AST2500 have a 8MB
1438  * unit. The address range of a flash SPI peripheral is encoded with
1439  * absolute addresses which should be part of the overall controller
1440  * window.
1441  */
1442 static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s,
1443                                           const AspeedSegments *seg)
1444 {
1445     uint32_t reg = 0;
1446     reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT;
1447     reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT;
1448     return reg;
1449 }
1450 
1451 static void aspeed_smc_reg_to_segment(const AspeedSMCState *s,
1452                                       uint32_t reg, AspeedSegments *seg)
1453 {
1454     seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23;
1455     seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr;
1456 }
1457 
1458 static const AspeedSegments aspeed_2400_smc_segments[] = {
1459     { 0x10000000, 32 * MiB },
1460 };
1461 
1462 static void aspeed_2400_smc_class_init(ObjectClass *klass, void *data)
1463 {
1464     DeviceClass *dc = DEVICE_CLASS(klass);
1465     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1466 
1467     dc->desc               = "Aspeed 2400 SMC Controller";
1468     asc->r_conf            = R_CONF;
1469     asc->r_ce_ctrl         = R_CE_CTRL;
1470     asc->r_ctrl0           = R_CTRL0;
1471     asc->r_timings         = R_TIMINGS;
1472     asc->nregs_timings     = 1;
1473     asc->conf_enable_w0    = CONF_ENABLE_W0;
1474     asc->cs_num_max        = 1;
1475     asc->segments          = aspeed_2400_smc_segments;
1476     asc->flash_window_base = 0x10000000;
1477     asc->flash_window_size = 0x6000000;
1478     asc->features          = 0x0;
1479     asc->nregs             = ASPEED_SMC_R_SMC_MAX;
1480     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1481     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1482     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1483     asc->reg_ops           = &aspeed_smc_flash_ops;
1484 }
1485 
1486 static const TypeInfo aspeed_2400_smc_info = {
1487     .name =  "aspeed.smc-ast2400",
1488     .parent = TYPE_ASPEED_SMC,
1489     .class_init = aspeed_2400_smc_class_init,
1490 };
1491 
1492 static const uint32_t aspeed_2400_fmc_resets[ASPEED_SMC_R_MAX] = {
1493     /*
1494      * CE0 and CE1 types are HW strapped in SCU70. Do it here to
1495      * simplify the model.
1496      */
1497     [R_CONF] = CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0,
1498 };
1499 
1500 static const AspeedSegments aspeed_2400_fmc_segments[] = {
1501     { 0x20000000, 64 * MiB }, /* start address is readonly */
1502     { 0x24000000, 32 * MiB },
1503     { 0x26000000, 32 * MiB },
1504     { 0x28000000, 32 * MiB },
1505     { 0x2A000000, 32 * MiB }
1506 };
1507 
1508 static void aspeed_2400_fmc_class_init(ObjectClass *klass, void *data)
1509 {
1510     DeviceClass *dc = DEVICE_CLASS(klass);
1511     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1512 
1513     dc->desc               = "Aspeed 2400 FMC Controller";
1514     asc->r_conf            = R_CONF;
1515     asc->r_ce_ctrl         = R_CE_CTRL;
1516     asc->r_ctrl0           = R_CTRL0;
1517     asc->r_timings         = R_TIMINGS;
1518     asc->nregs_timings     = 1;
1519     asc->conf_enable_w0    = CONF_ENABLE_W0;
1520     asc->cs_num_max        = 5;
1521     asc->segments          = aspeed_2400_fmc_segments;
1522     asc->segment_addr_mask = 0xffff0000;
1523     asc->resets            = aspeed_2400_fmc_resets;
1524     asc->flash_window_base = 0x20000000;
1525     asc->flash_window_size = 0x10000000;
1526     asc->features          = ASPEED_SMC_FEATURE_DMA;
1527     asc->dma_flash_mask    = 0x0FFFFFFC;
1528     asc->dma_dram_mask     = 0x1FFFFFFC;
1529     asc->dma_start_length  = 4;
1530     asc->nregs             = ASPEED_SMC_R_MAX;
1531     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1532     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1533     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1534     asc->reg_ops           = &aspeed_smc_flash_ops;
1535 }
1536 
1537 static const TypeInfo aspeed_2400_fmc_info = {
1538     .name =  "aspeed.fmc-ast2400",
1539     .parent = TYPE_ASPEED_SMC,
1540     .class_init = aspeed_2400_fmc_class_init,
1541 };
1542 
1543 static const AspeedSegments aspeed_2400_spi1_segments[] = {
1544     { 0x30000000, 64 * MiB },
1545 };
1546 
1547 static int aspeed_2400_spi1_addr_width(const AspeedSMCState *s)
1548 {
1549     return s->regs[R_SPI_CTRL0] & CTRL_AST2400_SPI_4BYTE ? 4 : 3;
1550 }
1551 
1552 static void aspeed_2400_spi1_class_init(ObjectClass *klass, void *data)
1553 {
1554     DeviceClass *dc = DEVICE_CLASS(klass);
1555     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1556 
1557     dc->desc               = "Aspeed 2400 SPI1 Controller";
1558     asc->r_conf            = R_SPI_CONF;
1559     asc->r_ce_ctrl         = 0xff;
1560     asc->r_ctrl0           = R_SPI_CTRL0;
1561     asc->r_timings         = R_SPI_TIMINGS;
1562     asc->nregs_timings     = 1;
1563     asc->conf_enable_w0    = SPI_CONF_ENABLE_W0;
1564     asc->cs_num_max        = 1;
1565     asc->segments          = aspeed_2400_spi1_segments;
1566     asc->flash_window_base = 0x30000000;
1567     asc->flash_window_size = 0x10000000;
1568     asc->features          = 0x0;
1569     asc->nregs             = ASPEED_SMC_R_SPI_MAX;
1570     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1571     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1572     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1573     asc->addr_width        = aspeed_2400_spi1_addr_width;
1574     asc->reg_ops           = &aspeed_smc_flash_ops;
1575 }
1576 
1577 static const TypeInfo aspeed_2400_spi1_info = {
1578     .name =  "aspeed.spi1-ast2400",
1579     .parent = TYPE_ASPEED_SMC,
1580     .class_init = aspeed_2400_spi1_class_init,
1581 };
1582 
1583 static const uint32_t aspeed_2500_fmc_resets[ASPEED_SMC_R_MAX] = {
1584     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1585                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
1586 };
1587 
1588 static const AspeedSegments aspeed_2500_fmc_segments[] = {
1589     { 0x20000000, 128 * MiB }, /* start address is readonly */
1590     { 0x28000000,  32 * MiB },
1591     { 0x2A000000,  32 * MiB },
1592 };
1593 
1594 static void aspeed_2500_fmc_class_init(ObjectClass *klass, void *data)
1595 {
1596     DeviceClass *dc = DEVICE_CLASS(klass);
1597     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1598 
1599     dc->desc               = "Aspeed 2500 FMC Controller";
1600     asc->r_conf            = R_CONF;
1601     asc->r_ce_ctrl         = R_CE_CTRL;
1602     asc->r_ctrl0           = R_CTRL0;
1603     asc->r_timings         = R_TIMINGS;
1604     asc->nregs_timings     = 1;
1605     asc->conf_enable_w0    = CONF_ENABLE_W0;
1606     asc->cs_num_max        = 3;
1607     asc->segments          = aspeed_2500_fmc_segments;
1608     asc->segment_addr_mask = 0xffff0000;
1609     asc->resets            = aspeed_2500_fmc_resets;
1610     asc->flash_window_base = 0x20000000;
1611     asc->flash_window_size = 0x10000000;
1612     asc->features          = ASPEED_SMC_FEATURE_DMA;
1613     asc->dma_flash_mask    = 0x0FFFFFFC;
1614     asc->dma_dram_mask     = 0x3FFFFFFC;
1615     asc->dma_start_length  = 4;
1616     asc->nregs             = ASPEED_SMC_R_MAX;
1617     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1618     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1619     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1620     asc->reg_ops           = &aspeed_smc_flash_ops;
1621 }
1622 
1623 static const TypeInfo aspeed_2500_fmc_info = {
1624     .name =  "aspeed.fmc-ast2500",
1625     .parent = TYPE_ASPEED_SMC,
1626     .class_init = aspeed_2500_fmc_class_init,
1627 };
1628 
1629 static const AspeedSegments aspeed_2500_spi1_segments[] = {
1630     { 0x30000000, 32 * MiB }, /* start address is readonly */
1631     { 0x32000000, 96 * MiB }, /* end address is readonly */
1632 };
1633 
1634 static void aspeed_2500_spi1_class_init(ObjectClass *klass, void *data)
1635 {
1636     DeviceClass *dc = DEVICE_CLASS(klass);
1637     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1638 
1639     dc->desc               = "Aspeed 2500 SPI1 Controller";
1640     asc->r_conf            = R_CONF;
1641     asc->r_ce_ctrl         = R_CE_CTRL;
1642     asc->r_ctrl0           = R_CTRL0;
1643     asc->r_timings         = R_TIMINGS;
1644     asc->nregs_timings     = 1;
1645     asc->conf_enable_w0    = CONF_ENABLE_W0;
1646     asc->cs_num_max        = 2;
1647     asc->segments          = aspeed_2500_spi1_segments;
1648     asc->segment_addr_mask = 0xffff0000;
1649     asc->flash_window_base = 0x30000000;
1650     asc->flash_window_size = 0x8000000;
1651     asc->features          = 0x0;
1652     asc->nregs             = ASPEED_SMC_R_MAX;
1653     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1654     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1655     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1656     asc->reg_ops           = &aspeed_smc_flash_ops;
1657 }
1658 
1659 static const TypeInfo aspeed_2500_spi1_info = {
1660     .name =  "aspeed.spi1-ast2500",
1661     .parent = TYPE_ASPEED_SMC,
1662     .class_init = aspeed_2500_spi1_class_init,
1663 };
1664 
1665 static const AspeedSegments aspeed_2500_spi2_segments[] = {
1666     { 0x38000000, 32 * MiB }, /* start address is readonly */
1667     { 0x3A000000, 96 * MiB }, /* end address is readonly */
1668 };
1669 
1670 static void aspeed_2500_spi2_class_init(ObjectClass *klass, void *data)
1671 {
1672     DeviceClass *dc = DEVICE_CLASS(klass);
1673     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1674 
1675     dc->desc               = "Aspeed 2500 SPI2 Controller";
1676     asc->r_conf            = R_CONF;
1677     asc->r_ce_ctrl         = R_CE_CTRL;
1678     asc->r_ctrl0           = R_CTRL0;
1679     asc->r_timings         = R_TIMINGS;
1680     asc->nregs_timings     = 1;
1681     asc->conf_enable_w0    = CONF_ENABLE_W0;
1682     asc->cs_num_max        = 2;
1683     asc->segments          = aspeed_2500_spi2_segments;
1684     asc->segment_addr_mask = 0xffff0000;
1685     asc->flash_window_base = 0x38000000;
1686     asc->flash_window_size = 0x8000000;
1687     asc->features          = 0x0;
1688     asc->nregs             = ASPEED_SMC_R_MAX;
1689     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1690     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1691     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1692     asc->reg_ops           = &aspeed_smc_flash_ops;
1693 }
1694 
1695 static const TypeInfo aspeed_2500_spi2_info = {
1696     .name =  "aspeed.spi2-ast2500",
1697     .parent = TYPE_ASPEED_SMC,
1698     .class_init = aspeed_2500_spi2_class_init,
1699 };
1700 
1701 /*
1702  * The Segment Registers of the AST2600 have a 1MB unit. The address
1703  * range of a flash SPI peripheral is encoded with offsets in the overall
1704  * controller window. The previous SoC AST2400 and AST2500 used
1705  * absolute addresses. Only bits [27:20] are relevant and the end
1706  * address is an upper bound limit.
1707  */
1708 #define AST2600_SEG_ADDR_MASK 0x0ff00000
1709 
1710 static uint32_t aspeed_2600_smc_segment_to_reg(const AspeedSMCState *s,
1711                                                const AspeedSegments *seg)
1712 {
1713     uint32_t reg = 0;
1714 
1715     /* Disabled segments have a nil register */
1716     if (!seg->size) {
1717         return 0;
1718     }
1719 
1720     reg |= (seg->addr & AST2600_SEG_ADDR_MASK) >> 16; /* start offset */
1721     reg |= (seg->addr + seg->size - 1) & AST2600_SEG_ADDR_MASK; /* end offset */
1722     return reg;
1723 }
1724 
1725 static void aspeed_2600_smc_reg_to_segment(const AspeedSMCState *s,
1726                                            uint32_t reg, AspeedSegments *seg)
1727 {
1728     uint32_t start_offset = (reg << 16) & AST2600_SEG_ADDR_MASK;
1729     uint32_t end_offset = reg & AST2600_SEG_ADDR_MASK;
1730     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1731 
1732     if (reg) {
1733         seg->addr = asc->flash_window_base + start_offset;
1734         seg->size = end_offset + MiB - start_offset;
1735     } else {
1736         seg->addr = asc->flash_window_base;
1737         seg->size = 0;
1738     }
1739 }
1740 
1741 static const uint32_t aspeed_2600_fmc_resets[ASPEED_SMC_R_MAX] = {
1742     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1743                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1 |
1744                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE2),
1745 };
1746 
1747 static const AspeedSegments aspeed_2600_fmc_segments[] = {
1748     { 0x0, 128 * MiB }, /* start address is readonly */
1749     { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
1750     { 0x0, 0 }, /* disabled */
1751 };
1752 
1753 static void aspeed_2600_fmc_class_init(ObjectClass *klass, void *data)
1754 {
1755     DeviceClass *dc = DEVICE_CLASS(klass);
1756     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1757 
1758     dc->desc               = "Aspeed 2600 FMC Controller";
1759     asc->r_conf            = R_CONF;
1760     asc->r_ce_ctrl         = R_CE_CTRL;
1761     asc->r_ctrl0           = R_CTRL0;
1762     asc->r_timings         = R_TIMINGS;
1763     asc->nregs_timings     = 1;
1764     asc->conf_enable_w0    = CONF_ENABLE_W0;
1765     asc->cs_num_max        = 3;
1766     asc->segments          = aspeed_2600_fmc_segments;
1767     asc->segment_addr_mask = 0x0ff00ff0;
1768     asc->resets            = aspeed_2600_fmc_resets;
1769     asc->flash_window_base = 0x20000000;
1770     asc->flash_window_size = 0x10000000;
1771     asc->features          = ASPEED_SMC_FEATURE_DMA |
1772                              ASPEED_SMC_FEATURE_WDT_CONTROL;
1773     asc->dma_flash_mask    = 0x0FFFFFFC;
1774     asc->dma_dram_mask     = 0x3FFFFFFC;
1775     asc->dma_start_length  = 1;
1776     asc->nregs             = ASPEED_SMC_R_MAX;
1777     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1778     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1779     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1780     asc->reg_ops           = &aspeed_smc_flash_ops;
1781 }
1782 
1783 static const TypeInfo aspeed_2600_fmc_info = {
1784     .name =  "aspeed.fmc-ast2600",
1785     .parent = TYPE_ASPEED_SMC,
1786     .class_init = aspeed_2600_fmc_class_init,
1787 };
1788 
1789 static const AspeedSegments aspeed_2600_spi1_segments[] = {
1790     { 0x0, 128 * MiB }, /* start address is readonly */
1791     { 0x0, 0 }, /* disabled */
1792 };
1793 
1794 static void aspeed_2600_spi1_class_init(ObjectClass *klass, void *data)
1795 {
1796     DeviceClass *dc = DEVICE_CLASS(klass);
1797     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1798 
1799     dc->desc               = "Aspeed 2600 SPI1 Controller";
1800     asc->r_conf            = R_CONF;
1801     asc->r_ce_ctrl         = R_CE_CTRL;
1802     asc->r_ctrl0           = R_CTRL0;
1803     asc->r_timings         = R_TIMINGS;
1804     asc->nregs_timings     = 2;
1805     asc->conf_enable_w0    = CONF_ENABLE_W0;
1806     asc->cs_num_max        = 2;
1807     asc->segments          = aspeed_2600_spi1_segments;
1808     asc->segment_addr_mask = 0x0ff00ff0;
1809     asc->flash_window_base = 0x30000000;
1810     asc->flash_window_size = 0x10000000;
1811     asc->features          = ASPEED_SMC_FEATURE_DMA |
1812                              ASPEED_SMC_FEATURE_DMA_GRANT;
1813     asc->dma_flash_mask    = 0x0FFFFFFC;
1814     asc->dma_dram_mask     = 0x3FFFFFFC;
1815     asc->dma_start_length  = 1;
1816     asc->nregs             = ASPEED_SMC_R_MAX;
1817     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1818     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1819     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1820     asc->reg_ops           = &aspeed_smc_flash_ops;
1821 }
1822 
1823 static const TypeInfo aspeed_2600_spi1_info = {
1824     .name =  "aspeed.spi1-ast2600",
1825     .parent = TYPE_ASPEED_SMC,
1826     .class_init = aspeed_2600_spi1_class_init,
1827 };
1828 
1829 static const AspeedSegments aspeed_2600_spi2_segments[] = {
1830     { 0x0, 128 * MiB }, /* start address is readonly */
1831     { 0x0, 0 }, /* disabled */
1832     { 0x0, 0 }, /* disabled */
1833 };
1834 
1835 static void aspeed_2600_spi2_class_init(ObjectClass *klass, void *data)
1836 {
1837     DeviceClass *dc = DEVICE_CLASS(klass);
1838     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1839 
1840     dc->desc               = "Aspeed 2600 SPI2 Controller";
1841     asc->r_conf            = R_CONF;
1842     asc->r_ce_ctrl         = R_CE_CTRL;
1843     asc->r_ctrl0           = R_CTRL0;
1844     asc->r_timings         = R_TIMINGS;
1845     asc->nregs_timings     = 3;
1846     asc->conf_enable_w0    = CONF_ENABLE_W0;
1847     asc->cs_num_max        = 3;
1848     asc->segments          = aspeed_2600_spi2_segments;
1849     asc->segment_addr_mask = 0x0ff00ff0;
1850     asc->flash_window_base = 0x50000000;
1851     asc->flash_window_size = 0x10000000;
1852     asc->features          = ASPEED_SMC_FEATURE_DMA |
1853                              ASPEED_SMC_FEATURE_DMA_GRANT;
1854     asc->dma_flash_mask    = 0x0FFFFFFC;
1855     asc->dma_dram_mask     = 0x3FFFFFFC;
1856     asc->dma_start_length  = 1;
1857     asc->nregs             = ASPEED_SMC_R_MAX;
1858     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1859     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1860     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1861     asc->reg_ops           = &aspeed_smc_flash_ops;
1862 }
1863 
1864 static const TypeInfo aspeed_2600_spi2_info = {
1865     .name =  "aspeed.spi2-ast2600",
1866     .parent = TYPE_ASPEED_SMC,
1867     .class_init = aspeed_2600_spi2_class_init,
1868 };
1869 
1870 /*
1871  * The FMC Segment Registers of the AST1030 have a 512KB unit.
1872  * Only bits [27:19] are used for decoding.
1873  */
1874 #define AST1030_SEG_ADDR_MASK 0x0ff80000
1875 
1876 static uint32_t aspeed_1030_smc_segment_to_reg(const AspeedSMCState *s,
1877         const AspeedSegments *seg)
1878 {
1879     uint32_t reg = 0;
1880 
1881     /* Disabled segments have a nil register */
1882     if (!seg->size) {
1883         return 0;
1884     }
1885 
1886     reg |= (seg->addr & AST1030_SEG_ADDR_MASK) >> 16; /* start offset */
1887     reg |= (seg->addr + seg->size - 1) & AST1030_SEG_ADDR_MASK; /* end offset */
1888     return reg;
1889 }
1890 
1891 static void aspeed_1030_smc_reg_to_segment(const AspeedSMCState *s,
1892         uint32_t reg, AspeedSegments *seg)
1893 {
1894     uint32_t start_offset = (reg << 16) & AST1030_SEG_ADDR_MASK;
1895     uint32_t end_offset = reg & AST1030_SEG_ADDR_MASK;
1896     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1897 
1898     if (reg) {
1899         seg->addr = asc->flash_window_base + start_offset;
1900         seg->size = end_offset + (512 * KiB) - start_offset;
1901     } else {
1902         seg->addr = asc->flash_window_base;
1903         seg->size = 0;
1904     }
1905 }
1906 
1907 static const uint32_t aspeed_1030_fmc_resets[ASPEED_SMC_R_MAX] = {
1908     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1909                             CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
1910 };
1911 
1912 static const AspeedSegments aspeed_1030_fmc_segments[] = {
1913     { 0x0, 128 * MiB }, /* start address is readonly */
1914     { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
1915     { 0x0, 0 }, /* disabled */
1916 };
1917 
1918 static void aspeed_1030_fmc_class_init(ObjectClass *klass, void *data)
1919 {
1920     DeviceClass *dc = DEVICE_CLASS(klass);
1921     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1922 
1923     dc->desc               = "Aspeed 1030 FMC Controller";
1924     asc->r_conf            = R_CONF;
1925     asc->r_ce_ctrl         = R_CE_CTRL;
1926     asc->r_ctrl0           = R_CTRL0;
1927     asc->r_timings         = R_TIMINGS;
1928     asc->nregs_timings     = 2;
1929     asc->conf_enable_w0    = CONF_ENABLE_W0;
1930     asc->cs_num_max        = 2;
1931     asc->segments          = aspeed_1030_fmc_segments;
1932     asc->segment_addr_mask = 0x0ff80ff8;
1933     asc->resets            = aspeed_1030_fmc_resets;
1934     asc->flash_window_base = 0x80000000;
1935     asc->flash_window_size = 0x10000000;
1936     asc->features          = ASPEED_SMC_FEATURE_DMA;
1937     asc->dma_flash_mask    = 0x0FFFFFFC;
1938     asc->dma_dram_mask     = 0x000BFFFC;
1939     asc->dma_start_length  = 1;
1940     asc->nregs             = ASPEED_SMC_R_MAX;
1941     asc->segment_to_reg    = aspeed_1030_smc_segment_to_reg;
1942     asc->reg_to_segment    = aspeed_1030_smc_reg_to_segment;
1943     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1944     asc->reg_ops           = &aspeed_smc_flash_ops;
1945 }
1946 
1947 static const TypeInfo aspeed_1030_fmc_info = {
1948     .name =  "aspeed.fmc-ast1030",
1949     .parent = TYPE_ASPEED_SMC,
1950     .class_init = aspeed_1030_fmc_class_init,
1951 };
1952 
1953 static const AspeedSegments aspeed_1030_spi1_segments[] = {
1954     { 0x0, 128 * MiB }, /* start address is readonly */
1955     { 0x0, 0 }, /* disabled */
1956 };
1957 
1958 static void aspeed_1030_spi1_class_init(ObjectClass *klass, void *data)
1959 {
1960     DeviceClass *dc = DEVICE_CLASS(klass);
1961     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1962 
1963     dc->desc               = "Aspeed 1030 SPI1 Controller";
1964     asc->r_conf            = R_CONF;
1965     asc->r_ce_ctrl         = R_CE_CTRL;
1966     asc->r_ctrl0           = R_CTRL0;
1967     asc->r_timings         = R_TIMINGS;
1968     asc->nregs_timings     = 2;
1969     asc->conf_enable_w0    = CONF_ENABLE_W0;
1970     asc->cs_num_max        = 2;
1971     asc->segments          = aspeed_1030_spi1_segments;
1972     asc->segment_addr_mask = 0x0ff00ff0;
1973     asc->flash_window_base = 0x90000000;
1974     asc->flash_window_size = 0x10000000;
1975     asc->features          = ASPEED_SMC_FEATURE_DMA;
1976     asc->dma_flash_mask    = 0x0FFFFFFC;
1977     asc->dma_dram_mask     = 0x000BFFFC;
1978     asc->dma_start_length  = 1;
1979     asc->nregs             = ASPEED_SMC_R_MAX;
1980     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1981     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1982     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1983     asc->reg_ops           = &aspeed_smc_flash_ops;
1984 }
1985 
1986 static const TypeInfo aspeed_1030_spi1_info = {
1987     .name =  "aspeed.spi1-ast1030",
1988     .parent = TYPE_ASPEED_SMC,
1989     .class_init = aspeed_1030_spi1_class_init,
1990 };
1991 static const AspeedSegments aspeed_1030_spi2_segments[] = {
1992     { 0x0, 128 * MiB }, /* start address is readonly */
1993     { 0x0, 0 }, /* disabled */
1994 };
1995 
1996 static void aspeed_1030_spi2_class_init(ObjectClass *klass, void *data)
1997 {
1998     DeviceClass *dc = DEVICE_CLASS(klass);
1999     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2000 
2001     dc->desc               = "Aspeed 1030 SPI2 Controller";
2002     asc->r_conf            = R_CONF;
2003     asc->r_ce_ctrl         = R_CE_CTRL;
2004     asc->r_ctrl0           = R_CTRL0;
2005     asc->r_timings         = R_TIMINGS;
2006     asc->nregs_timings     = 2;
2007     asc->conf_enable_w0    = CONF_ENABLE_W0;
2008     asc->cs_num_max        = 2;
2009     asc->segments          = aspeed_1030_spi2_segments;
2010     asc->segment_addr_mask = 0x0ff00ff0;
2011     asc->flash_window_base = 0xb0000000;
2012     asc->flash_window_size = 0x10000000;
2013     asc->features          = ASPEED_SMC_FEATURE_DMA;
2014     asc->dma_flash_mask    = 0x0FFFFFFC;
2015     asc->dma_dram_mask     = 0x000BFFFC;
2016     asc->dma_start_length  = 1;
2017     asc->nregs             = ASPEED_SMC_R_MAX;
2018     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
2019     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
2020     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2021     asc->reg_ops           = &aspeed_smc_flash_ops;
2022 }
2023 
2024 static const TypeInfo aspeed_1030_spi2_info = {
2025     .name =  "aspeed.spi2-ast1030",
2026     .parent = TYPE_ASPEED_SMC,
2027     .class_init = aspeed_1030_spi2_class_init,
2028 };
2029 
2030 /*
2031  * The FMC Segment Registers of the AST2700 have a 64KB unit.
2032  * Only bits [31:16] are used for decoding.
2033  */
2034 #define AST2700_SEG_ADDR_MASK 0xffff0000
2035 
2036 static uint32_t aspeed_2700_smc_segment_to_reg(const AspeedSMCState *s,
2037                                                const AspeedSegments *seg)
2038 {
2039     uint32_t reg = 0;
2040 
2041     /* Disabled segments have a nil register */
2042     if (!seg->size) {
2043         return 0;
2044     }
2045 
2046     reg |= (seg->addr & AST2700_SEG_ADDR_MASK) >> 16; /* start offset */
2047     reg |= (seg->addr + seg->size - 1) & AST2700_SEG_ADDR_MASK; /* end offset */
2048     return reg;
2049 }
2050 
2051 static void aspeed_2700_smc_reg_to_segment(const AspeedSMCState *s,
2052                                            uint32_t reg, AspeedSegments *seg)
2053 {
2054     uint32_t start_offset = (reg << 16) & AST2700_SEG_ADDR_MASK;
2055     uint32_t end_offset = reg & AST2700_SEG_ADDR_MASK;
2056     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
2057 
2058     if (reg) {
2059         seg->addr = asc->flash_window_base + start_offset;
2060         seg->size = end_offset + (64 * KiB) - start_offset;
2061     } else {
2062         seg->addr = asc->flash_window_base;
2063         seg->size = 0;
2064     }
2065 }
2066 
2067 static const uint32_t aspeed_2700_fmc_resets[ASPEED_SMC_R_MAX] = {
2068     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
2069             CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
2070     [R_CE_CTRL] = 0x0000aa00,
2071     [R_CTRL0] = 0x406b0641,
2072     [R_CTRL1] = 0x00000400,
2073     [R_CTRL2] = 0x00000400,
2074     [R_CTRL3] = 0x00000400,
2075     [R_SEG_ADDR0] = 0x08000000,
2076     [R_SEG_ADDR1] = 0x10000800,
2077     [R_SEG_ADDR2] = 0x00000000,
2078     [R_SEG_ADDR3] = 0x00000000,
2079     [R_DUMMY_DATA] = 0x00010000,
2080     [R_DMA_DRAM_ADDR_HIGH] = 0x00000000,
2081     [R_TIMINGS] = 0x007b0000,
2082 };
2083 
2084 static const MemoryRegionOps aspeed_2700_smc_flash_ops = {
2085     .read = aspeed_smc_flash_read,
2086     .write = aspeed_smc_flash_write,
2087     .endianness = DEVICE_LITTLE_ENDIAN,
2088     .valid = {
2089         .min_access_size = 1,
2090         .max_access_size = 8,
2091     },
2092 };
2093 
2094 static const AspeedSegments aspeed_2700_fmc_segments[] = {
2095     { 0x0, 128 * MiB }, /* start address is readonly */
2096     { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
2097     { 256 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
2098     { 0x0, 0 }, /* disabled */
2099 };
2100 
2101 static void aspeed_2700_fmc_class_init(ObjectClass *klass, void *data)
2102 {
2103     DeviceClass *dc = DEVICE_CLASS(klass);
2104     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2105 
2106     dc->desc               = "Aspeed 2700 FMC Controller";
2107     asc->r_conf            = R_CONF;
2108     asc->r_ce_ctrl         = R_CE_CTRL;
2109     asc->r_ctrl0           = R_CTRL0;
2110     asc->r_timings         = R_TIMINGS;
2111     asc->nregs_timings     = 3;
2112     asc->conf_enable_w0    = CONF_ENABLE_W0;
2113     asc->cs_num_max        = 3;
2114     asc->segments          = aspeed_2700_fmc_segments;
2115     asc->segment_addr_mask = 0xffffffff;
2116     asc->resets            = aspeed_2700_fmc_resets;
2117     asc->flash_window_base = 0x100000000;
2118     asc->flash_window_size = 1 * GiB;
2119     asc->features          = ASPEED_SMC_FEATURE_DMA |
2120                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2121     asc->dma_flash_mask    = 0x2FFFFFFC;
2122     asc->dma_dram_mask     = 0xFFFFFFFC;
2123     asc->dma_start_length  = 1;
2124     asc->nregs             = ASPEED_SMC_R_MAX;
2125     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2126     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2127     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2128     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2129 }
2130 
2131 static const TypeInfo aspeed_2700_fmc_info = {
2132     .name =  "aspeed.fmc-ast2700",
2133     .parent = TYPE_ASPEED_SMC,
2134     .class_init = aspeed_2700_fmc_class_init,
2135 };
2136 
2137 static const AspeedSegments aspeed_2700_spi0_segments[] = {
2138     { 0x0, 128 * MiB }, /* start address is readonly */
2139     { 128 * MiB, 128 * MiB }, /* start address is readonly */
2140     { 0x0, 0 }, /* disabled */
2141 };
2142 
2143 static void aspeed_2700_spi0_class_init(ObjectClass *klass, void *data)
2144 {
2145     DeviceClass *dc = DEVICE_CLASS(klass);
2146     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2147 
2148     dc->desc               = "Aspeed 2700 SPI0 Controller";
2149     asc->r_conf            = R_CONF;
2150     asc->r_ce_ctrl         = R_CE_CTRL;
2151     asc->r_ctrl0           = R_CTRL0;
2152     asc->r_timings         = R_TIMINGS;
2153     asc->nregs_timings     = 2;
2154     asc->conf_enable_w0    = CONF_ENABLE_W0;
2155     asc->cs_num_max        = 2;
2156     asc->segments          = aspeed_2700_spi0_segments;
2157     asc->segment_addr_mask = 0xffffffff;
2158     asc->flash_window_base = 0x180000000;
2159     asc->flash_window_size = 1 * GiB;
2160     asc->features          = ASPEED_SMC_FEATURE_DMA |
2161                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2162     asc->dma_flash_mask    = 0x2FFFFFFC;
2163     asc->dma_dram_mask     = 0xFFFFFFFC;
2164     asc->dma_start_length  = 1;
2165     asc->nregs             = ASPEED_SMC_R_MAX;
2166     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2167     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2168     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2169     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2170 }
2171 
2172 static const TypeInfo aspeed_2700_spi0_info = {
2173     .name =  "aspeed.spi0-ast2700",
2174     .parent = TYPE_ASPEED_SMC,
2175     .class_init = aspeed_2700_spi0_class_init,
2176 };
2177 
2178 static const AspeedSegments aspeed_2700_spi1_segments[] = {
2179     { 0x0, 128 * MiB }, /* start address is readonly */
2180     { 0x0, 0 }, /* disabled */
2181 };
2182 
2183 static void aspeed_2700_spi1_class_init(ObjectClass *klass, void *data)
2184 {
2185     DeviceClass *dc = DEVICE_CLASS(klass);
2186     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2187 
2188     dc->desc               = "Aspeed 2700 SPI1 Controller";
2189     asc->r_conf            = R_CONF;
2190     asc->r_ce_ctrl         = R_CE_CTRL;
2191     asc->r_ctrl0           = R_CTRL0;
2192     asc->r_timings         = R_TIMINGS;
2193     asc->nregs_timings     = 2;
2194     asc->conf_enable_w0    = CONF_ENABLE_W0;
2195     asc->cs_num_max        = 2;
2196     asc->segments          = aspeed_2700_spi1_segments;
2197     asc->segment_addr_mask = 0xffffffff;
2198     asc->flash_window_base = 0x200000000;
2199     asc->flash_window_size = 1 * GiB;
2200     asc->features          = ASPEED_SMC_FEATURE_DMA |
2201                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2202     asc->dma_flash_mask    = 0x2FFFFFFC;
2203     asc->dma_dram_mask     = 0xFFFFFFFC;
2204     asc->dma_start_length  = 1;
2205     asc->nregs             = ASPEED_SMC_R_MAX;
2206     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2207     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2208     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2209     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2210 }
2211 
2212 static const TypeInfo aspeed_2700_spi1_info = {
2213         .name =  "aspeed.spi1-ast2700",
2214         .parent = TYPE_ASPEED_SMC,
2215         .class_init = aspeed_2700_spi1_class_init,
2216 };
2217 
2218 static const AspeedSegments aspeed_2700_spi2_segments[] = {
2219     { 0x0, 128 * MiB }, /* start address is readonly */
2220     { 0x0, 0 }, /* disabled */
2221 };
2222 
2223 static void aspeed_2700_spi2_class_init(ObjectClass *klass, void *data)
2224 {
2225     DeviceClass *dc = DEVICE_CLASS(klass);
2226     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2227 
2228     dc->desc               = "Aspeed 2700 SPI2 Controller";
2229     asc->r_conf            = R_CONF;
2230     asc->r_ce_ctrl         = R_CE_CTRL;
2231     asc->r_ctrl0           = R_CTRL0;
2232     asc->r_timings         = R_TIMINGS;
2233     asc->nregs_timings     = 2;
2234     asc->conf_enable_w0    = CONF_ENABLE_W0;
2235     asc->cs_num_max        = 2;
2236     asc->segments          = aspeed_2700_spi2_segments;
2237     asc->segment_addr_mask = 0xffffffff;
2238     asc->flash_window_base = 0x280000000;
2239     asc->flash_window_size = 1 * GiB;
2240     asc->features          = ASPEED_SMC_FEATURE_DMA |
2241                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2242     asc->dma_flash_mask    = 0x0FFFFFFC;
2243     asc->dma_dram_mask     = 0xFFFFFFFC;
2244     asc->dma_start_length  = 1;
2245     asc->nregs             = ASPEED_SMC_R_MAX;
2246     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2247     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2248     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2249     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2250 }
2251 
2252 static const TypeInfo aspeed_2700_spi2_info = {
2253         .name =  "aspeed.spi2-ast2700",
2254         .parent = TYPE_ASPEED_SMC,
2255         .class_init = aspeed_2700_spi2_class_init,
2256 };
2257 
2258 static void aspeed_smc_register_types(void)
2259 {
2260     type_register_static(&aspeed_smc_flash_info);
2261     type_register_static(&aspeed_smc_info);
2262     type_register_static(&aspeed_2400_smc_info);
2263     type_register_static(&aspeed_2400_fmc_info);
2264     type_register_static(&aspeed_2400_spi1_info);
2265     type_register_static(&aspeed_2500_fmc_info);
2266     type_register_static(&aspeed_2500_spi1_info);
2267     type_register_static(&aspeed_2500_spi2_info);
2268     type_register_static(&aspeed_2600_fmc_info);
2269     type_register_static(&aspeed_2600_spi1_info);
2270     type_register_static(&aspeed_2600_spi2_info);
2271     type_register_static(&aspeed_1030_fmc_info);
2272     type_register_static(&aspeed_1030_spi1_info);
2273     type_register_static(&aspeed_1030_spi2_info);
2274     type_register_static(&aspeed_2700_fmc_info);
2275     type_register_static(&aspeed_2700_spi0_info);
2276     type_register_static(&aspeed_2700_spi1_info);
2277     type_register_static(&aspeed_2700_spi2_info);
2278 }
2279 
2280 type_init(aspeed_smc_register_types)
2281