1 /* 2 * ASPEED AST2400 SMC Controller (SPI Flash Only) 3 * 4 * Copyright (C) 2016 IBM Corp. 5 * 6 * Permission is hereby granted, free of charge, to any person obtaining a copy 7 * of this software and associated documentation files (the "Software"), to deal 8 * in the Software without restriction, including without limitation the rights 9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 * copies of the Software, and to permit persons to whom the Software is 11 * furnished to do so, subject to the following conditions: 12 * 13 * The above copyright notice and this permission notice shall be included in 14 * all copies or substantial portions of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 * THE SOFTWARE. 23 */ 24 25 #include "qemu/osdep.h" 26 #include "hw/sysbus.h" 27 #include "sysemu/sysemu.h" 28 #include "qemu/log.h" 29 #include "qemu/error-report.h" 30 31 #include "hw/ssi/aspeed_smc.h" 32 33 /* CE Type Setting Register */ 34 #define R_CONF (0x00 / 4) 35 #define CONF_LEGACY_DISABLE (1 << 31) 36 #define CONF_ENABLE_W4 20 37 #define CONF_ENABLE_W3 19 38 #define CONF_ENABLE_W2 18 39 #define CONF_ENABLE_W1 17 40 #define CONF_ENABLE_W0 16 41 #define CONF_FLASH_TYPE4 8 42 #define CONF_FLASH_TYPE3 6 43 #define CONF_FLASH_TYPE2 4 44 #define CONF_FLASH_TYPE1 2 45 #define CONF_FLASH_TYPE0 0 46 #define CONF_FLASH_TYPE_NOR 0x0 47 #define CONF_FLASH_TYPE_NAND 0x1 48 #define CONF_FLASH_TYPE_SPI 0x2 49 50 /* CE Control Register */ 51 #define R_CE_CTRL (0x04 / 4) 52 #define CTRL_EXTENDED4 4 /* 32 bit addressing for SPI */ 53 #define CTRL_EXTENDED3 3 /* 32 bit addressing for SPI */ 54 #define CTRL_EXTENDED2 2 /* 32 bit addressing for SPI */ 55 #define CTRL_EXTENDED1 1 /* 32 bit addressing for SPI */ 56 #define CTRL_EXTENDED0 0 /* 32 bit addressing for SPI */ 57 58 /* Interrupt Control and Status Register */ 59 #define R_INTR_CTRL (0x08 / 4) 60 #define INTR_CTRL_DMA_STATUS (1 << 11) 61 #define INTR_CTRL_CMD_ABORT_STATUS (1 << 10) 62 #define INTR_CTRL_WRITE_PROTECT_STATUS (1 << 9) 63 #define INTR_CTRL_DMA_EN (1 << 3) 64 #define INTR_CTRL_CMD_ABORT_EN (1 << 2) 65 #define INTR_CTRL_WRITE_PROTECT_EN (1 << 1) 66 67 /* CEx Control Register */ 68 #define R_CTRL0 (0x10 / 4) 69 #define CTRL_CMD_SHIFT 16 70 #define CTRL_CMD_MASK 0xff 71 #define CTRL_DUMMY_HIGH_SHIFT 14 72 #define CTRL_AST2400_SPI_4BYTE (1 << 13) 73 #define CTRL_DUMMY_LOW_SHIFT 6 /* 2 bits [7:6] */ 74 #define CTRL_CE_STOP_ACTIVE (1 << 2) 75 #define CTRL_CMD_MODE_MASK 0x3 76 #define CTRL_READMODE 0x0 77 #define CTRL_FREADMODE 0x1 78 #define CTRL_WRITEMODE 0x2 79 #define CTRL_USERMODE 0x3 80 #define R_CTRL1 (0x14 / 4) 81 #define R_CTRL2 (0x18 / 4) 82 #define R_CTRL3 (0x1C / 4) 83 #define R_CTRL4 (0x20 / 4) 84 85 /* CEx Segment Address Register */ 86 #define R_SEG_ADDR0 (0x30 / 4) 87 #define SEG_END_SHIFT 24 /* 8MB units */ 88 #define SEG_END_MASK 0xff 89 #define SEG_START_SHIFT 16 /* address bit [A29-A23] */ 90 #define SEG_START_MASK 0xff 91 #define R_SEG_ADDR1 (0x34 / 4) 92 #define R_SEG_ADDR2 (0x38 / 4) 93 #define R_SEG_ADDR3 (0x3C / 4) 94 #define R_SEG_ADDR4 (0x40 / 4) 95 96 /* Misc Control Register #1 */ 97 #define R_MISC_CTRL1 (0x50 / 4) 98 99 /* Misc Control Register #2 */ 100 #define R_MISC_CTRL2 (0x54 / 4) 101 102 /* DMA Control/Status Register */ 103 #define R_DMA_CTRL (0x80 / 4) 104 #define DMA_CTRL_DELAY_MASK 0xf 105 #define DMA_CTRL_DELAY_SHIFT 8 106 #define DMA_CTRL_FREQ_MASK 0xf 107 #define DMA_CTRL_FREQ_SHIFT 4 108 #define DMA_CTRL_MODE (1 << 3) 109 #define DMA_CTRL_CKSUM (1 << 2) 110 #define DMA_CTRL_DIR (1 << 1) 111 #define DMA_CTRL_EN (1 << 0) 112 113 /* DMA Flash Side Address */ 114 #define R_DMA_FLASH_ADDR (0x84 / 4) 115 116 /* DMA DRAM Side Address */ 117 #define R_DMA_DRAM_ADDR (0x88 / 4) 118 119 /* DMA Length Register */ 120 #define R_DMA_LEN (0x8C / 4) 121 122 /* Checksum Calculation Result */ 123 #define R_DMA_CHECKSUM (0x90 / 4) 124 125 /* Misc Control Register #2 */ 126 #define R_TIMINGS (0x94 / 4) 127 128 /* SPI controller registers and bits */ 129 #define R_SPI_CONF (0x00 / 4) 130 #define SPI_CONF_ENABLE_W0 0 131 #define R_SPI_CTRL0 (0x4 / 4) 132 #define R_SPI_MISC_CTRL (0x10 / 4) 133 #define R_SPI_TIMINGS (0x14 / 4) 134 135 #define ASPEED_SMC_R_SPI_MAX (0x20 / 4) 136 #define ASPEED_SMC_R_SMC_MAX (0x20 / 4) 137 138 #define ASPEED_SOC_SMC_FLASH_BASE 0x10000000 139 #define ASPEED_SOC_FMC_FLASH_BASE 0x20000000 140 #define ASPEED_SOC_SPI_FLASH_BASE 0x30000000 141 #define ASPEED_SOC_SPI2_FLASH_BASE 0x38000000 142 143 /* Flash opcodes. */ 144 #define SPI_OP_READ 0x03 /* Read data bytes (low frequency) */ 145 146 /* 147 * Default segments mapping addresses and size for each slave per 148 * controller. These can be changed when board is initialized with the 149 * Segment Address Registers. 150 */ 151 static const AspeedSegments aspeed_segments_legacy[] = { 152 { 0x10000000, 32 * 1024 * 1024 }, 153 }; 154 155 static const AspeedSegments aspeed_segments_fmc[] = { 156 { 0x20000000, 64 * 1024 * 1024 }, /* start address is readonly */ 157 { 0x24000000, 32 * 1024 * 1024 }, 158 { 0x26000000, 32 * 1024 * 1024 }, 159 { 0x28000000, 32 * 1024 * 1024 }, 160 { 0x2A000000, 32 * 1024 * 1024 } 161 }; 162 163 static const AspeedSegments aspeed_segments_spi[] = { 164 { 0x30000000, 64 * 1024 * 1024 }, 165 }; 166 167 static const AspeedSegments aspeed_segments_ast2500_fmc[] = { 168 { 0x20000000, 128 * 1024 * 1024 }, /* start address is readonly */ 169 { 0x28000000, 32 * 1024 * 1024 }, 170 { 0x2A000000, 32 * 1024 * 1024 }, 171 }; 172 173 static const AspeedSegments aspeed_segments_ast2500_spi1[] = { 174 { 0x30000000, 32 * 1024 * 1024 }, /* start address is readonly */ 175 { 0x32000000, 96 * 1024 * 1024 }, /* end address is readonly */ 176 }; 177 178 static const AspeedSegments aspeed_segments_ast2500_spi2[] = { 179 { 0x38000000, 32 * 1024 * 1024 }, /* start address is readonly */ 180 { 0x3A000000, 96 * 1024 * 1024 }, /* end address is readonly */ 181 }; 182 183 static const AspeedSMCController controllers[] = { 184 { 185 .name = "aspeed.smc.smc", 186 .r_conf = R_CONF, 187 .r_ce_ctrl = R_CE_CTRL, 188 .r_ctrl0 = R_CTRL0, 189 .r_timings = R_TIMINGS, 190 .conf_enable_w0 = CONF_ENABLE_W0, 191 .max_slaves = 5, 192 .segments = aspeed_segments_legacy, 193 .flash_window_base = ASPEED_SOC_SMC_FLASH_BASE, 194 .flash_window_size = 0x6000000, 195 .has_dma = false, 196 .nregs = ASPEED_SMC_R_SMC_MAX, 197 }, { 198 .name = "aspeed.smc.fmc", 199 .r_conf = R_CONF, 200 .r_ce_ctrl = R_CE_CTRL, 201 .r_ctrl0 = R_CTRL0, 202 .r_timings = R_TIMINGS, 203 .conf_enable_w0 = CONF_ENABLE_W0, 204 .max_slaves = 5, 205 .segments = aspeed_segments_fmc, 206 .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE, 207 .flash_window_size = 0x10000000, 208 .has_dma = true, 209 .nregs = ASPEED_SMC_R_MAX, 210 }, { 211 .name = "aspeed.smc.spi", 212 .r_conf = R_SPI_CONF, 213 .r_ce_ctrl = 0xff, 214 .r_ctrl0 = R_SPI_CTRL0, 215 .r_timings = R_SPI_TIMINGS, 216 .conf_enable_w0 = SPI_CONF_ENABLE_W0, 217 .max_slaves = 1, 218 .segments = aspeed_segments_spi, 219 .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE, 220 .flash_window_size = 0x10000000, 221 .has_dma = false, 222 .nregs = ASPEED_SMC_R_SPI_MAX, 223 }, { 224 .name = "aspeed.smc.ast2500-fmc", 225 .r_conf = R_CONF, 226 .r_ce_ctrl = R_CE_CTRL, 227 .r_ctrl0 = R_CTRL0, 228 .r_timings = R_TIMINGS, 229 .conf_enable_w0 = CONF_ENABLE_W0, 230 .max_slaves = 3, 231 .segments = aspeed_segments_ast2500_fmc, 232 .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE, 233 .flash_window_size = 0x10000000, 234 .has_dma = true, 235 .nregs = ASPEED_SMC_R_MAX, 236 }, { 237 .name = "aspeed.smc.ast2500-spi1", 238 .r_conf = R_CONF, 239 .r_ce_ctrl = R_CE_CTRL, 240 .r_ctrl0 = R_CTRL0, 241 .r_timings = R_TIMINGS, 242 .conf_enable_w0 = CONF_ENABLE_W0, 243 .max_slaves = 2, 244 .segments = aspeed_segments_ast2500_spi1, 245 .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE, 246 .flash_window_size = 0x8000000, 247 .has_dma = false, 248 .nregs = ASPEED_SMC_R_MAX, 249 }, { 250 .name = "aspeed.smc.ast2500-spi2", 251 .r_conf = R_CONF, 252 .r_ce_ctrl = R_CE_CTRL, 253 .r_ctrl0 = R_CTRL0, 254 .r_timings = R_TIMINGS, 255 .conf_enable_w0 = CONF_ENABLE_W0, 256 .max_slaves = 2, 257 .segments = aspeed_segments_ast2500_spi2, 258 .flash_window_base = ASPEED_SOC_SPI2_FLASH_BASE, 259 .flash_window_size = 0x8000000, 260 .has_dma = false, 261 .nregs = ASPEED_SMC_R_MAX, 262 }, 263 }; 264 265 /* 266 * The Segment Register uses a 8MB unit to encode the start address 267 * and the end address of the mapping window of a flash SPI slave : 268 * 269 * | byte 1 | byte 2 | byte 3 | byte 4 | 270 * +--------+--------+--------+--------+ 271 * | end | start | 0 | 0 | 272 * 273 */ 274 static inline uint32_t aspeed_smc_segment_to_reg(const AspeedSegments *seg) 275 { 276 uint32_t reg = 0; 277 reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT; 278 reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT; 279 return reg; 280 } 281 282 static inline void aspeed_smc_reg_to_segment(uint32_t reg, AspeedSegments *seg) 283 { 284 seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23; 285 seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr; 286 } 287 288 static bool aspeed_smc_flash_overlap(const AspeedSMCState *s, 289 const AspeedSegments *new, 290 int cs) 291 { 292 AspeedSegments seg; 293 int i; 294 295 for (i = 0; i < s->ctrl->max_slaves; i++) { 296 if (i == cs) { 297 continue; 298 } 299 300 aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + i], &seg); 301 302 if (new->addr + new->size > seg.addr && 303 new->addr < seg.addr + seg.size) { 304 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment CS%d [ 0x%" 305 HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with " 306 "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 307 s->ctrl->name, cs, new->addr, new->addr + new->size, 308 i, seg.addr, seg.addr + seg.size); 309 return true; 310 } 311 } 312 return false; 313 } 314 315 static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs, 316 uint64_t new) 317 { 318 AspeedSMCFlash *fl = &s->flashes[cs]; 319 AspeedSegments seg; 320 321 aspeed_smc_reg_to_segment(new, &seg); 322 323 /* The start address of CS0 is read-only */ 324 if (cs == 0 && seg.addr != s->ctrl->flash_window_base) { 325 qemu_log_mask(LOG_GUEST_ERROR, 326 "%s: Tried to change CS0 start address to 0x%" 327 HWADDR_PRIx "\n", s->ctrl->name, seg.addr); 328 seg.addr = s->ctrl->flash_window_base; 329 new = aspeed_smc_segment_to_reg(&seg); 330 } 331 332 /* 333 * The end address of the AST2500 spi controllers is also 334 * read-only. 335 */ 336 if ((s->ctrl->segments == aspeed_segments_ast2500_spi1 || 337 s->ctrl->segments == aspeed_segments_ast2500_spi2) && 338 cs == s->ctrl->max_slaves && 339 seg.addr + seg.size != s->ctrl->segments[cs].addr + 340 s->ctrl->segments[cs].size) { 341 qemu_log_mask(LOG_GUEST_ERROR, 342 "%s: Tried to change CS%d end address to 0x%" 343 HWADDR_PRIx "\n", s->ctrl->name, cs, seg.addr + seg.size); 344 seg.size = s->ctrl->segments[cs].addr + s->ctrl->segments[cs].size - 345 seg.addr; 346 new = aspeed_smc_segment_to_reg(&seg); 347 } 348 349 /* Keep the segment in the overall flash window */ 350 if (seg.addr + seg.size <= s->ctrl->flash_window_base || 351 seg.addr > s->ctrl->flash_window_base + s->ctrl->flash_window_size) { 352 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is invalid : " 353 "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 354 s->ctrl->name, cs, seg.addr, seg.addr + seg.size); 355 return; 356 } 357 358 /* Check start address vs. alignment */ 359 if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) { 360 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is not " 361 "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 362 s->ctrl->name, cs, seg.addr, seg.addr + seg.size); 363 } 364 365 /* And segments should not overlap (in the specs) */ 366 aspeed_smc_flash_overlap(s, &seg, cs); 367 368 /* All should be fine now to move the region */ 369 memory_region_transaction_begin(); 370 memory_region_set_size(&fl->mmio, seg.size); 371 memory_region_set_address(&fl->mmio, seg.addr - s->ctrl->flash_window_base); 372 memory_region_set_enabled(&fl->mmio, true); 373 memory_region_transaction_commit(); 374 375 s->regs[R_SEG_ADDR0 + cs] = new; 376 } 377 378 static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr, 379 unsigned size) 380 { 381 qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u" 382 PRIx64 "\n", __func__, addr, size); 383 return 0; 384 } 385 386 static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr, 387 uint64_t data, unsigned size) 388 { 389 qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u: 0x%" 390 PRIx64 "\n", __func__, addr, size, data); 391 } 392 393 static const MemoryRegionOps aspeed_smc_flash_default_ops = { 394 .read = aspeed_smc_flash_default_read, 395 .write = aspeed_smc_flash_default_write, 396 .endianness = DEVICE_LITTLE_ENDIAN, 397 .valid = { 398 .min_access_size = 1, 399 .max_access_size = 4, 400 }, 401 }; 402 403 static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl) 404 { 405 const AspeedSMCState *s = fl->controller; 406 407 return s->regs[s->r_ctrl0 + fl->id] & CTRL_CMD_MODE_MASK; 408 } 409 410 static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl) 411 { 412 const AspeedSMCState *s = fl->controller; 413 414 return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->id)); 415 } 416 417 static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl) 418 { 419 const AspeedSMCState *s = fl->controller; 420 int cmd = (s->regs[s->r_ctrl0 + fl->id] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK; 421 422 /* In read mode, the default SPI command is READ (0x3). In other 423 * modes, the command should necessarily be defined */ 424 if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) { 425 cmd = SPI_OP_READ; 426 } 427 428 if (!cmd) { 429 qemu_log_mask(LOG_GUEST_ERROR, "%s: no command defined for mode %d\n", 430 __func__, aspeed_smc_flash_mode(fl)); 431 } 432 433 return cmd; 434 } 435 436 static inline int aspeed_smc_flash_is_4byte(const AspeedSMCFlash *fl) 437 { 438 const AspeedSMCState *s = fl->controller; 439 440 if (s->ctrl->segments == aspeed_segments_spi) { 441 return s->regs[s->r_ctrl0] & CTRL_AST2400_SPI_4BYTE; 442 } else { 443 return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->id)); 444 } 445 } 446 447 static inline bool aspeed_smc_is_ce_stop_active(const AspeedSMCFlash *fl) 448 { 449 const AspeedSMCState *s = fl->controller; 450 451 return s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE; 452 } 453 454 static void aspeed_smc_flash_select(AspeedSMCFlash *fl) 455 { 456 AspeedSMCState *s = fl->controller; 457 458 s->regs[s->r_ctrl0 + fl->id] &= ~CTRL_CE_STOP_ACTIVE; 459 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 460 } 461 462 static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl) 463 { 464 AspeedSMCState *s = fl->controller; 465 466 s->regs[s->r_ctrl0 + fl->id] |= CTRL_CE_STOP_ACTIVE; 467 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 468 } 469 470 static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl, 471 uint32_t addr) 472 { 473 const AspeedSMCState *s = fl->controller; 474 AspeedSegments seg; 475 476 aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + fl->id], &seg); 477 if ((addr % seg.size) != addr) { 478 qemu_log_mask(LOG_GUEST_ERROR, 479 "%s: invalid address 0x%08x for CS%d segment : " 480 "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 481 s->ctrl->name, addr, fl->id, seg.addr, 482 seg.addr + seg.size); 483 addr %= seg.size; 484 } 485 486 return addr; 487 } 488 489 static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl) 490 { 491 const AspeedSMCState *s = fl->controller; 492 uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->id]; 493 uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1; 494 uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3; 495 496 return ((dummy_high << 2) | dummy_low) * 8; 497 } 498 499 static void aspeed_smc_flash_send_addr(AspeedSMCFlash *fl, uint32_t addr) 500 { 501 const AspeedSMCState *s = fl->controller; 502 uint8_t cmd = aspeed_smc_flash_cmd(fl); 503 504 /* Flash access can not exceed CS segment */ 505 addr = aspeed_smc_check_segment_addr(fl, addr); 506 507 ssi_transfer(s->spi, cmd); 508 509 if (aspeed_smc_flash_is_4byte(fl)) { 510 ssi_transfer(s->spi, (addr >> 24) & 0xff); 511 } 512 ssi_transfer(s->spi, (addr >> 16) & 0xff); 513 ssi_transfer(s->spi, (addr >> 8) & 0xff); 514 ssi_transfer(s->spi, (addr & 0xff)); 515 } 516 517 static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size) 518 { 519 AspeedSMCFlash *fl = opaque; 520 AspeedSMCState *s = fl->controller; 521 uint64_t ret = 0; 522 int i; 523 524 switch (aspeed_smc_flash_mode(fl)) { 525 case CTRL_USERMODE: 526 for (i = 0; i < size; i++) { 527 ret |= ssi_transfer(s->spi, 0x0) << (8 * i); 528 } 529 break; 530 case CTRL_READMODE: 531 case CTRL_FREADMODE: 532 aspeed_smc_flash_select(fl); 533 aspeed_smc_flash_send_addr(fl, addr); 534 535 /* 536 * Use fake transfers to model dummy bytes. The value should 537 * be configured to some non-zero value in fast read mode and 538 * zero in read mode. But, as the HW allows inconsistent 539 * settings, let's check for fast read mode. 540 */ 541 if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) { 542 for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) { 543 ssi_transfer(fl->controller->spi, 0xFF); 544 } 545 } 546 547 for (i = 0; i < size; i++) { 548 ret |= ssi_transfer(s->spi, 0x0) << (8 * i); 549 } 550 551 aspeed_smc_flash_unselect(fl); 552 break; 553 default: 554 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n", 555 __func__, aspeed_smc_flash_mode(fl)); 556 } 557 558 return ret; 559 } 560 561 static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data, 562 unsigned size) 563 { 564 AspeedSMCFlash *fl = opaque; 565 AspeedSMCState *s = fl->controller; 566 int i; 567 568 if (!aspeed_smc_is_writable(fl)) { 569 qemu_log_mask(LOG_GUEST_ERROR, "%s: flash is not writable at 0x%" 570 HWADDR_PRIx "\n", __func__, addr); 571 return; 572 } 573 574 switch (aspeed_smc_flash_mode(fl)) { 575 case CTRL_USERMODE: 576 for (i = 0; i < size; i++) { 577 ssi_transfer(s->spi, (data >> (8 * i)) & 0xff); 578 } 579 break; 580 case CTRL_WRITEMODE: 581 aspeed_smc_flash_select(fl); 582 aspeed_smc_flash_send_addr(fl, addr); 583 584 for (i = 0; i < size; i++) { 585 ssi_transfer(s->spi, (data >> (8 * i)) & 0xff); 586 } 587 588 aspeed_smc_flash_unselect(fl); 589 break; 590 default: 591 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n", 592 __func__, aspeed_smc_flash_mode(fl)); 593 } 594 } 595 596 static const MemoryRegionOps aspeed_smc_flash_ops = { 597 .read = aspeed_smc_flash_read, 598 .write = aspeed_smc_flash_write, 599 .endianness = DEVICE_LITTLE_ENDIAN, 600 .valid = { 601 .min_access_size = 1, 602 .max_access_size = 4, 603 }, 604 }; 605 606 static void aspeed_smc_flash_update_cs(AspeedSMCFlash *fl) 607 { 608 const AspeedSMCState *s = fl->controller; 609 610 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 611 } 612 613 static void aspeed_smc_reset(DeviceState *d) 614 { 615 AspeedSMCState *s = ASPEED_SMC(d); 616 int i; 617 618 memset(s->regs, 0, sizeof s->regs); 619 620 /* Pretend DMA is done (u-boot initialization) */ 621 s->regs[R_INTR_CTRL] = INTR_CTRL_DMA_STATUS; 622 623 /* Unselect all slaves */ 624 for (i = 0; i < s->num_cs; ++i) { 625 s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE; 626 qemu_set_irq(s->cs_lines[i], true); 627 } 628 629 /* setup default segment register values for all */ 630 for (i = 0; i < s->ctrl->max_slaves; ++i) { 631 s->regs[R_SEG_ADDR0 + i] = 632 aspeed_smc_segment_to_reg(&s->ctrl->segments[i]); 633 } 634 635 /* HW strapping for AST2500 FMC controllers */ 636 if (s->ctrl->segments == aspeed_segments_ast2500_fmc) { 637 /* flash type is fixed to SPI for CE0 and CE1 */ 638 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0); 639 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1); 640 641 /* 4BYTE mode is autodetected for CE0. Let's force it to 1 for 642 * now */ 643 s->regs[s->r_ce_ctrl] |= (1 << (CTRL_EXTENDED0)); 644 } 645 646 /* HW strapping for AST2400 FMC controllers (SCU70). Let's use the 647 * configuration of the palmetto-bmc machine */ 648 if (s->ctrl->segments == aspeed_segments_fmc) { 649 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0); 650 651 s->regs[s->r_ce_ctrl] |= (1 << (CTRL_EXTENDED0)); 652 } 653 } 654 655 static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size) 656 { 657 AspeedSMCState *s = ASPEED_SMC(opaque); 658 659 addr >>= 2; 660 661 if (addr == s->r_conf || 662 addr == s->r_timings || 663 addr == s->r_ce_ctrl || 664 addr == R_INTR_CTRL || 665 (addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) || 666 (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs)) { 667 return s->regs[addr]; 668 } else { 669 qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n", 670 __func__, addr); 671 return 0; 672 } 673 } 674 675 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data, 676 unsigned int size) 677 { 678 AspeedSMCState *s = ASPEED_SMC(opaque); 679 uint32_t value = data; 680 681 addr >>= 2; 682 683 if (addr == s->r_conf || 684 addr == s->r_timings || 685 addr == s->r_ce_ctrl) { 686 s->regs[addr] = value; 687 } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) { 688 int cs = addr - s->r_ctrl0; 689 s->regs[addr] = value; 690 aspeed_smc_flash_update_cs(&s->flashes[cs]); 691 } else if (addr >= R_SEG_ADDR0 && 692 addr < R_SEG_ADDR0 + s->ctrl->max_slaves) { 693 int cs = addr - R_SEG_ADDR0; 694 695 if (value != s->regs[R_SEG_ADDR0 + cs]) { 696 aspeed_smc_flash_set_segment(s, cs, value); 697 } 698 } else { 699 qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n", 700 __func__, addr); 701 return; 702 } 703 } 704 705 static const MemoryRegionOps aspeed_smc_ops = { 706 .read = aspeed_smc_read, 707 .write = aspeed_smc_write, 708 .endianness = DEVICE_LITTLE_ENDIAN, 709 .valid.unaligned = true, 710 }; 711 712 static void aspeed_smc_realize(DeviceState *dev, Error **errp) 713 { 714 SysBusDevice *sbd = SYS_BUS_DEVICE(dev); 715 AspeedSMCState *s = ASPEED_SMC(dev); 716 AspeedSMCClass *mc = ASPEED_SMC_GET_CLASS(s); 717 int i; 718 char name[32]; 719 hwaddr offset = 0; 720 721 s->ctrl = mc->ctrl; 722 723 /* keep a copy under AspeedSMCState to speed up accesses */ 724 s->r_conf = s->ctrl->r_conf; 725 s->r_ce_ctrl = s->ctrl->r_ce_ctrl; 726 s->r_ctrl0 = s->ctrl->r_ctrl0; 727 s->r_timings = s->ctrl->r_timings; 728 s->conf_enable_w0 = s->ctrl->conf_enable_w0; 729 730 /* Enforce some real HW limits */ 731 if (s->num_cs > s->ctrl->max_slaves) { 732 qemu_log_mask(LOG_GUEST_ERROR, "%s: num_cs cannot exceed: %d\n", 733 __func__, s->ctrl->max_slaves); 734 s->num_cs = s->ctrl->max_slaves; 735 } 736 737 s->spi = ssi_create_bus(dev, "spi"); 738 739 /* Setup cs_lines for slaves */ 740 sysbus_init_irq(sbd, &s->irq); 741 s->cs_lines = g_new0(qemu_irq, s->num_cs); 742 ssi_auto_connect_slaves(dev, s->cs_lines, s->spi); 743 744 for (i = 0; i < s->num_cs; ++i) { 745 sysbus_init_irq(sbd, &s->cs_lines[i]); 746 } 747 748 /* The memory region for the controller registers */ 749 memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s, 750 s->ctrl->name, s->ctrl->nregs * 4); 751 sysbus_init_mmio(sbd, &s->mmio); 752 753 /* 754 * The container memory region representing the address space 755 * window in which the flash modules are mapped. The size and 756 * address depends on the SoC model and controller type. 757 */ 758 snprintf(name, sizeof(name), "%s.flash", s->ctrl->name); 759 760 memory_region_init_io(&s->mmio_flash, OBJECT(s), 761 &aspeed_smc_flash_default_ops, s, name, 762 s->ctrl->flash_window_size); 763 sysbus_init_mmio(sbd, &s->mmio_flash); 764 765 s->flashes = g_new0(AspeedSMCFlash, s->ctrl->max_slaves); 766 767 /* 768 * Let's create a sub memory region for each possible slave. All 769 * have a configurable memory segment in the overall flash mapping 770 * window of the controller but, there is not necessarily a flash 771 * module behind to handle the memory accesses. This depends on 772 * the board configuration. 773 */ 774 for (i = 0; i < s->ctrl->max_slaves; ++i) { 775 AspeedSMCFlash *fl = &s->flashes[i]; 776 777 snprintf(name, sizeof(name), "%s.%d", s->ctrl->name, i); 778 779 fl->id = i; 780 fl->controller = s; 781 fl->size = s->ctrl->segments[i].size; 782 memory_region_init_io(&fl->mmio, OBJECT(s), &aspeed_smc_flash_ops, 783 fl, name, fl->size); 784 memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio); 785 offset += fl->size; 786 } 787 } 788 789 static const VMStateDescription vmstate_aspeed_smc = { 790 .name = "aspeed.smc", 791 .version_id = 1, 792 .minimum_version_id = 1, 793 .fields = (VMStateField[]) { 794 VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX), 795 VMSTATE_END_OF_LIST() 796 } 797 }; 798 799 static Property aspeed_smc_properties[] = { 800 DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1), 801 DEFINE_PROP_END_OF_LIST(), 802 }; 803 804 static void aspeed_smc_class_init(ObjectClass *klass, void *data) 805 { 806 DeviceClass *dc = DEVICE_CLASS(klass); 807 AspeedSMCClass *mc = ASPEED_SMC_CLASS(klass); 808 809 dc->realize = aspeed_smc_realize; 810 dc->reset = aspeed_smc_reset; 811 dc->props = aspeed_smc_properties; 812 dc->vmsd = &vmstate_aspeed_smc; 813 mc->ctrl = data; 814 } 815 816 static const TypeInfo aspeed_smc_info = { 817 .name = TYPE_ASPEED_SMC, 818 .parent = TYPE_SYS_BUS_DEVICE, 819 .instance_size = sizeof(AspeedSMCState), 820 .class_size = sizeof(AspeedSMCClass), 821 .abstract = true, 822 }; 823 824 static void aspeed_smc_register_types(void) 825 { 826 int i; 827 828 type_register_static(&aspeed_smc_info); 829 for (i = 0; i < ARRAY_SIZE(controllers); ++i) { 830 TypeInfo ti = { 831 .name = controllers[i].name, 832 .parent = TYPE_ASPEED_SMC, 833 .class_init = aspeed_smc_class_init, 834 .class_data = (void *)&controllers[i], 835 }; 836 type_register(&ti); 837 } 838 } 839 840 type_init(aspeed_smc_register_types) 841