1 /* 2 * ASPEED AST2400 SMC Controller (SPI Flash Only) 3 * 4 * Copyright (C) 2016 IBM Corp. 5 * 6 * Permission is hereby granted, free of charge, to any person obtaining a copy 7 * of this software and associated documentation files (the "Software"), to deal 8 * in the Software without restriction, including without limitation the rights 9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 * copies of the Software, and to permit persons to whom the Software is 11 * furnished to do so, subject to the following conditions: 12 * 13 * The above copyright notice and this permission notice shall be included in 14 * all copies or substantial portions of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 * THE SOFTWARE. 23 */ 24 25 #include "qemu/osdep.h" 26 #include "hw/sysbus.h" 27 #include "sysemu/sysemu.h" 28 #include "qemu/log.h" 29 #include "include/qemu/error-report.h" 30 #include "exec/address-spaces.h" 31 32 #include "hw/ssi/aspeed_smc.h" 33 34 /* CE Type Setting Register */ 35 #define R_CONF (0x00 / 4) 36 #define CONF_LEGACY_DISABLE (1 << 31) 37 #define CONF_ENABLE_W4 20 38 #define CONF_ENABLE_W3 19 39 #define CONF_ENABLE_W2 18 40 #define CONF_ENABLE_W1 17 41 #define CONF_ENABLE_W0 16 42 #define CONF_FLASH_TYPE4 8 43 #define CONF_FLASH_TYPE3 6 44 #define CONF_FLASH_TYPE2 4 45 #define CONF_FLASH_TYPE1 2 46 #define CONF_FLASH_TYPE0 0 47 #define CONF_FLASH_TYPE_NOR 0x0 48 #define CONF_FLASH_TYPE_NAND 0x1 49 #define CONF_FLASH_TYPE_SPI 0x2 50 51 /* CE Control Register */ 52 #define R_CE_CTRL (0x04 / 4) 53 #define CTRL_EXTENDED4 4 /* 32 bit addressing for SPI */ 54 #define CTRL_EXTENDED3 3 /* 32 bit addressing for SPI */ 55 #define CTRL_EXTENDED2 2 /* 32 bit addressing for SPI */ 56 #define CTRL_EXTENDED1 1 /* 32 bit addressing for SPI */ 57 #define CTRL_EXTENDED0 0 /* 32 bit addressing for SPI */ 58 59 /* Interrupt Control and Status Register */ 60 #define R_INTR_CTRL (0x08 / 4) 61 #define INTR_CTRL_DMA_STATUS (1 << 11) 62 #define INTR_CTRL_CMD_ABORT_STATUS (1 << 10) 63 #define INTR_CTRL_WRITE_PROTECT_STATUS (1 << 9) 64 #define INTR_CTRL_DMA_EN (1 << 3) 65 #define INTR_CTRL_CMD_ABORT_EN (1 << 2) 66 #define INTR_CTRL_WRITE_PROTECT_EN (1 << 1) 67 68 /* CEx Control Register */ 69 #define R_CTRL0 (0x10 / 4) 70 #define CTRL_CMD_SHIFT 16 71 #define CTRL_CMD_MASK 0xff 72 #define CTRL_DUMMY_HIGH_SHIFT 14 73 #define CTRL_AST2400_SPI_4BYTE (1 << 13) 74 #define CTRL_DUMMY_LOW_SHIFT 6 /* 2 bits [7:6] */ 75 #define CTRL_CE_STOP_ACTIVE (1 << 2) 76 #define CTRL_CMD_MODE_MASK 0x3 77 #define CTRL_READMODE 0x0 78 #define CTRL_FREADMODE 0x1 79 #define CTRL_WRITEMODE 0x2 80 #define CTRL_USERMODE 0x3 81 #define R_CTRL1 (0x14 / 4) 82 #define R_CTRL2 (0x18 / 4) 83 #define R_CTRL3 (0x1C / 4) 84 #define R_CTRL4 (0x20 / 4) 85 86 /* CEx Segment Address Register */ 87 #define R_SEG_ADDR0 (0x30 / 4) 88 #define SEG_END_SHIFT 24 /* 8MB units */ 89 #define SEG_END_MASK 0xff 90 #define SEG_START_SHIFT 16 /* address bit [A29-A23] */ 91 #define SEG_START_MASK 0xff 92 #define R_SEG_ADDR1 (0x34 / 4) 93 #define R_SEG_ADDR2 (0x38 / 4) 94 #define R_SEG_ADDR3 (0x3C / 4) 95 #define R_SEG_ADDR4 (0x40 / 4) 96 97 /* Misc Control Register #1 */ 98 #define R_MISC_CTRL1 (0x50 / 4) 99 100 /* Misc Control Register #2 */ 101 #define R_MISC_CTRL2 (0x54 / 4) 102 103 /* DMA Control/Status Register */ 104 #define R_DMA_CTRL (0x80 / 4) 105 #define DMA_CTRL_DELAY_MASK 0xf 106 #define DMA_CTRL_DELAY_SHIFT 8 107 #define DMA_CTRL_FREQ_MASK 0xf 108 #define DMA_CTRL_FREQ_SHIFT 4 109 #define DMA_CTRL_MODE (1 << 3) 110 #define DMA_CTRL_CKSUM (1 << 2) 111 #define DMA_CTRL_DIR (1 << 1) 112 #define DMA_CTRL_EN (1 << 0) 113 114 /* DMA Flash Side Address */ 115 #define R_DMA_FLASH_ADDR (0x84 / 4) 116 117 /* DMA DRAM Side Address */ 118 #define R_DMA_DRAM_ADDR (0x88 / 4) 119 120 /* DMA Length Register */ 121 #define R_DMA_LEN (0x8C / 4) 122 123 /* Checksum Calculation Result */ 124 #define R_DMA_CHECKSUM (0x90 / 4) 125 126 /* Misc Control Register #2 */ 127 #define R_TIMINGS (0x94 / 4) 128 129 /* SPI controller registers and bits */ 130 #define R_SPI_CONF (0x00 / 4) 131 #define SPI_CONF_ENABLE_W0 0 132 #define R_SPI_CTRL0 (0x4 / 4) 133 #define R_SPI_MISC_CTRL (0x10 / 4) 134 #define R_SPI_TIMINGS (0x14 / 4) 135 136 #define ASPEED_SMC_R_SPI_MAX (0x20 / 4) 137 #define ASPEED_SMC_R_SMC_MAX (0x20 / 4) 138 139 #define ASPEED_SOC_SMC_FLASH_BASE 0x10000000 140 #define ASPEED_SOC_FMC_FLASH_BASE 0x20000000 141 #define ASPEED_SOC_SPI_FLASH_BASE 0x30000000 142 #define ASPEED_SOC_SPI2_FLASH_BASE 0x38000000 143 144 /* Flash opcodes. */ 145 #define SPI_OP_READ 0x03 /* Read data bytes (low frequency) */ 146 147 /* 148 * Default segments mapping addresses and size for each slave per 149 * controller. These can be changed when board is initialized with the 150 * Segment Address Registers. 151 */ 152 static const AspeedSegments aspeed_segments_legacy[] = { 153 { 0x10000000, 32 * 1024 * 1024 }, 154 }; 155 156 static const AspeedSegments aspeed_segments_fmc[] = { 157 { 0x20000000, 64 * 1024 * 1024 }, /* start address is readonly */ 158 { 0x24000000, 32 * 1024 * 1024 }, 159 { 0x26000000, 32 * 1024 * 1024 }, 160 { 0x28000000, 32 * 1024 * 1024 }, 161 { 0x2A000000, 32 * 1024 * 1024 } 162 }; 163 164 static const AspeedSegments aspeed_segments_spi[] = { 165 { 0x30000000, 64 * 1024 * 1024 }, 166 }; 167 168 static const AspeedSegments aspeed_segments_ast2500_fmc[] = { 169 { 0x20000000, 128 * 1024 * 1024 }, /* start address is readonly */ 170 { 0x28000000, 32 * 1024 * 1024 }, 171 { 0x2A000000, 32 * 1024 * 1024 }, 172 }; 173 174 static const AspeedSegments aspeed_segments_ast2500_spi1[] = { 175 { 0x30000000, 32 * 1024 * 1024 }, /* start address is readonly */ 176 { 0x32000000, 96 * 1024 * 1024 }, /* end address is readonly */ 177 }; 178 179 static const AspeedSegments aspeed_segments_ast2500_spi2[] = { 180 { 0x38000000, 32 * 1024 * 1024 }, /* start address is readonly */ 181 { 0x3A000000, 96 * 1024 * 1024 }, /* end address is readonly */ 182 }; 183 184 static const AspeedSMCController controllers[] = { 185 { 186 .name = "aspeed.smc.smc", 187 .r_conf = R_CONF, 188 .r_ce_ctrl = R_CE_CTRL, 189 .r_ctrl0 = R_CTRL0, 190 .r_timings = R_TIMINGS, 191 .conf_enable_w0 = CONF_ENABLE_W0, 192 .max_slaves = 5, 193 .segments = aspeed_segments_legacy, 194 .flash_window_base = ASPEED_SOC_SMC_FLASH_BASE, 195 .flash_window_size = 0x6000000, 196 .has_dma = false, 197 .nregs = ASPEED_SMC_R_SMC_MAX, 198 }, { 199 .name = "aspeed.smc.fmc", 200 .r_conf = R_CONF, 201 .r_ce_ctrl = R_CE_CTRL, 202 .r_ctrl0 = R_CTRL0, 203 .r_timings = R_TIMINGS, 204 .conf_enable_w0 = CONF_ENABLE_W0, 205 .max_slaves = 5, 206 .segments = aspeed_segments_fmc, 207 .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE, 208 .flash_window_size = 0x10000000, 209 .has_dma = true, 210 .nregs = ASPEED_SMC_R_MAX, 211 }, { 212 .name = "aspeed.smc.spi", 213 .r_conf = R_SPI_CONF, 214 .r_ce_ctrl = 0xff, 215 .r_ctrl0 = R_SPI_CTRL0, 216 .r_timings = R_SPI_TIMINGS, 217 .conf_enable_w0 = SPI_CONF_ENABLE_W0, 218 .max_slaves = 1, 219 .segments = aspeed_segments_spi, 220 .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE, 221 .flash_window_size = 0x10000000, 222 .has_dma = false, 223 .nregs = ASPEED_SMC_R_SPI_MAX, 224 }, { 225 .name = "aspeed.smc.ast2500-fmc", 226 .r_conf = R_CONF, 227 .r_ce_ctrl = R_CE_CTRL, 228 .r_ctrl0 = R_CTRL0, 229 .r_timings = R_TIMINGS, 230 .conf_enable_w0 = CONF_ENABLE_W0, 231 .max_slaves = 3, 232 .segments = aspeed_segments_ast2500_fmc, 233 .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE, 234 .flash_window_size = 0x10000000, 235 .has_dma = true, 236 .nregs = ASPEED_SMC_R_MAX, 237 }, { 238 .name = "aspeed.smc.ast2500-spi1", 239 .r_conf = R_CONF, 240 .r_ce_ctrl = R_CE_CTRL, 241 .r_ctrl0 = R_CTRL0, 242 .r_timings = R_TIMINGS, 243 .conf_enable_w0 = CONF_ENABLE_W0, 244 .max_slaves = 2, 245 .segments = aspeed_segments_ast2500_spi1, 246 .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE, 247 .flash_window_size = 0x8000000, 248 .has_dma = false, 249 .nregs = ASPEED_SMC_R_MAX, 250 }, { 251 .name = "aspeed.smc.ast2500-spi2", 252 .r_conf = R_CONF, 253 .r_ce_ctrl = R_CE_CTRL, 254 .r_ctrl0 = R_CTRL0, 255 .r_timings = R_TIMINGS, 256 .conf_enable_w0 = CONF_ENABLE_W0, 257 .max_slaves = 2, 258 .segments = aspeed_segments_ast2500_spi2, 259 .flash_window_base = ASPEED_SOC_SPI2_FLASH_BASE, 260 .flash_window_size = 0x8000000, 261 .has_dma = false, 262 .nregs = ASPEED_SMC_R_MAX, 263 }, 264 }; 265 266 /* 267 * The Segment Register uses a 8MB unit to encode the start address 268 * and the end address of the mapping window of a flash SPI slave : 269 * 270 * | byte 1 | byte 2 | byte 3 | byte 4 | 271 * +--------+--------+--------+--------+ 272 * | end | start | 0 | 0 | 273 * 274 */ 275 static inline uint32_t aspeed_smc_segment_to_reg(const AspeedSegments *seg) 276 { 277 uint32_t reg = 0; 278 reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT; 279 reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT; 280 return reg; 281 } 282 283 static inline void aspeed_smc_reg_to_segment(uint32_t reg, AspeedSegments *seg) 284 { 285 seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23; 286 seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr; 287 } 288 289 static bool aspeed_smc_flash_overlap(const AspeedSMCState *s, 290 const AspeedSegments *new, 291 int cs) 292 { 293 AspeedSegments seg; 294 int i; 295 296 for (i = 0; i < s->ctrl->max_slaves; i++) { 297 if (i == cs) { 298 continue; 299 } 300 301 aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + i], &seg); 302 303 if (new->addr + new->size > seg.addr && 304 new->addr < seg.addr + seg.size) { 305 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment CS%d [ 0x%" 306 HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with " 307 "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 308 s->ctrl->name, cs, new->addr, new->addr + new->size, 309 i, seg.addr, seg.addr + seg.size); 310 return true; 311 } 312 } 313 return false; 314 } 315 316 static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs, 317 uint64_t new) 318 { 319 AspeedSMCFlash *fl = &s->flashes[cs]; 320 AspeedSegments seg; 321 322 aspeed_smc_reg_to_segment(new, &seg); 323 324 /* The start address of CS0 is read-only */ 325 if (cs == 0 && seg.addr != s->ctrl->flash_window_base) { 326 qemu_log_mask(LOG_GUEST_ERROR, 327 "%s: Tried to change CS0 start address to 0x%" 328 HWADDR_PRIx "\n", s->ctrl->name, seg.addr); 329 seg.addr = s->ctrl->flash_window_base; 330 new = aspeed_smc_segment_to_reg(&seg); 331 } 332 333 /* 334 * The end address of the AST2500 spi controllers is also 335 * read-only. 336 */ 337 if ((s->ctrl->segments == aspeed_segments_ast2500_spi1 || 338 s->ctrl->segments == aspeed_segments_ast2500_spi2) && 339 cs == s->ctrl->max_slaves && 340 seg.addr + seg.size != s->ctrl->segments[cs].addr + 341 s->ctrl->segments[cs].size) { 342 qemu_log_mask(LOG_GUEST_ERROR, 343 "%s: Tried to change CS%d end address to 0x%" 344 HWADDR_PRIx "\n", s->ctrl->name, cs, seg.addr + seg.size); 345 seg.size = s->ctrl->segments[cs].addr + s->ctrl->segments[cs].size - 346 seg.addr; 347 new = aspeed_smc_segment_to_reg(&seg); 348 } 349 350 /* Keep the segment in the overall flash window */ 351 if (seg.addr + seg.size <= s->ctrl->flash_window_base || 352 seg.addr > s->ctrl->flash_window_base + s->ctrl->flash_window_size) { 353 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is invalid : " 354 "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 355 s->ctrl->name, cs, seg.addr, seg.addr + seg.size); 356 return; 357 } 358 359 /* Check start address vs. alignment */ 360 if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) { 361 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is not " 362 "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 363 s->ctrl->name, cs, seg.addr, seg.addr + seg.size); 364 } 365 366 /* And segments should not overlap (in the specs) */ 367 aspeed_smc_flash_overlap(s, &seg, cs); 368 369 /* All should be fine now to move the region */ 370 memory_region_transaction_begin(); 371 memory_region_set_size(&fl->mmio, seg.size); 372 memory_region_set_address(&fl->mmio, seg.addr - s->ctrl->flash_window_base); 373 memory_region_set_enabled(&fl->mmio, true); 374 memory_region_transaction_commit(); 375 376 s->regs[R_SEG_ADDR0 + cs] = new; 377 } 378 379 static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr, 380 unsigned size) 381 { 382 qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u" 383 PRIx64 "\n", __func__, addr, size); 384 return 0; 385 } 386 387 static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr, 388 uint64_t data, unsigned size) 389 { 390 qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u: 0x%" 391 PRIx64 "\n", __func__, addr, size, data); 392 } 393 394 static const MemoryRegionOps aspeed_smc_flash_default_ops = { 395 .read = aspeed_smc_flash_default_read, 396 .write = aspeed_smc_flash_default_write, 397 .endianness = DEVICE_LITTLE_ENDIAN, 398 .valid = { 399 .min_access_size = 1, 400 .max_access_size = 4, 401 }, 402 }; 403 404 static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl) 405 { 406 const AspeedSMCState *s = fl->controller; 407 408 return s->regs[s->r_ctrl0 + fl->id] & CTRL_CMD_MODE_MASK; 409 } 410 411 static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl) 412 { 413 const AspeedSMCState *s = fl->controller; 414 415 return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->id)); 416 } 417 418 static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl) 419 { 420 const AspeedSMCState *s = fl->controller; 421 int cmd = (s->regs[s->r_ctrl0 + fl->id] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK; 422 423 /* In read mode, the default SPI command is READ (0x3). In other 424 * modes, the command should necessarily be defined */ 425 if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) { 426 cmd = SPI_OP_READ; 427 } 428 429 if (!cmd) { 430 qemu_log_mask(LOG_GUEST_ERROR, "%s: no command defined for mode %d\n", 431 __func__, aspeed_smc_flash_mode(fl)); 432 } 433 434 return cmd; 435 } 436 437 static inline int aspeed_smc_flash_is_4byte(const AspeedSMCFlash *fl) 438 { 439 const AspeedSMCState *s = fl->controller; 440 441 if (s->ctrl->segments == aspeed_segments_spi) { 442 return s->regs[s->r_ctrl0] & CTRL_AST2400_SPI_4BYTE; 443 } else { 444 return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->id)); 445 } 446 } 447 448 static inline bool aspeed_smc_is_ce_stop_active(const AspeedSMCFlash *fl) 449 { 450 const AspeedSMCState *s = fl->controller; 451 452 return s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE; 453 } 454 455 static void aspeed_smc_flash_select(AspeedSMCFlash *fl) 456 { 457 AspeedSMCState *s = fl->controller; 458 459 s->regs[s->r_ctrl0 + fl->id] &= ~CTRL_CE_STOP_ACTIVE; 460 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 461 } 462 463 static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl) 464 { 465 AspeedSMCState *s = fl->controller; 466 467 s->regs[s->r_ctrl0 + fl->id] |= CTRL_CE_STOP_ACTIVE; 468 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 469 } 470 471 static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl, 472 uint32_t addr) 473 { 474 const AspeedSMCState *s = fl->controller; 475 AspeedSegments seg; 476 477 aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + fl->id], &seg); 478 if ((addr & (seg.size - 1)) != addr) { 479 qemu_log_mask(LOG_GUEST_ERROR, 480 "%s: invalid address 0x%08x for CS%d segment : " 481 "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 482 s->ctrl->name, addr, fl->id, seg.addr, 483 seg.addr + seg.size); 484 } 485 486 addr &= seg.size - 1; 487 return addr; 488 } 489 490 static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl) 491 { 492 const AspeedSMCState *s = fl->controller; 493 uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->id]; 494 uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1; 495 uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3; 496 497 return ((dummy_high << 2) | dummy_low) * 8; 498 } 499 500 static void aspeed_smc_flash_send_addr(AspeedSMCFlash *fl, uint32_t addr) 501 { 502 const AspeedSMCState *s = fl->controller; 503 uint8_t cmd = aspeed_smc_flash_cmd(fl); 504 505 /* Flash access can not exceed CS segment */ 506 addr = aspeed_smc_check_segment_addr(fl, addr); 507 508 ssi_transfer(s->spi, cmd); 509 510 if (aspeed_smc_flash_is_4byte(fl)) { 511 ssi_transfer(s->spi, (addr >> 24) & 0xff); 512 } 513 ssi_transfer(s->spi, (addr >> 16) & 0xff); 514 ssi_transfer(s->spi, (addr >> 8) & 0xff); 515 ssi_transfer(s->spi, (addr & 0xff)); 516 } 517 518 static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size) 519 { 520 AspeedSMCFlash *fl = opaque; 521 AspeedSMCState *s = fl->controller; 522 uint64_t ret = 0; 523 int i; 524 525 switch (aspeed_smc_flash_mode(fl)) { 526 case CTRL_USERMODE: 527 for (i = 0; i < size; i++) { 528 ret |= ssi_transfer(s->spi, 0x0) << (8 * i); 529 } 530 break; 531 case CTRL_READMODE: 532 case CTRL_FREADMODE: 533 aspeed_smc_flash_select(fl); 534 aspeed_smc_flash_send_addr(fl, addr); 535 536 /* 537 * Use fake transfers to model dummy bytes. The value should 538 * be configured to some non-zero value in fast read mode and 539 * zero in read mode. 540 */ 541 for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) { 542 ssi_transfer(fl->controller->spi, 0xFF); 543 } 544 545 for (i = 0; i < size; i++) { 546 ret |= ssi_transfer(s->spi, 0x0) << (8 * i); 547 } 548 549 aspeed_smc_flash_unselect(fl); 550 break; 551 default: 552 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n", 553 __func__, aspeed_smc_flash_mode(fl)); 554 } 555 556 return ret; 557 } 558 559 static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data, 560 unsigned size) 561 { 562 AspeedSMCFlash *fl = opaque; 563 AspeedSMCState *s = fl->controller; 564 int i; 565 566 if (!aspeed_smc_is_writable(fl)) { 567 qemu_log_mask(LOG_GUEST_ERROR, "%s: flash is not writable at 0x%" 568 HWADDR_PRIx "\n", __func__, addr); 569 return; 570 } 571 572 switch (aspeed_smc_flash_mode(fl)) { 573 case CTRL_USERMODE: 574 for (i = 0; i < size; i++) { 575 ssi_transfer(s->spi, (data >> (8 * i)) & 0xff); 576 } 577 break; 578 case CTRL_WRITEMODE: 579 aspeed_smc_flash_select(fl); 580 aspeed_smc_flash_send_addr(fl, addr); 581 582 for (i = 0; i < size; i++) { 583 ssi_transfer(s->spi, (data >> (8 * i)) & 0xff); 584 } 585 586 aspeed_smc_flash_unselect(fl); 587 break; 588 default: 589 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n", 590 __func__, aspeed_smc_flash_mode(fl)); 591 } 592 } 593 594 static const MemoryRegionOps aspeed_smc_flash_ops = { 595 .read = aspeed_smc_flash_read, 596 .write = aspeed_smc_flash_write, 597 .endianness = DEVICE_LITTLE_ENDIAN, 598 .valid = { 599 .min_access_size = 1, 600 .max_access_size = 4, 601 }, 602 }; 603 604 static void aspeed_smc_flash_update_cs(AspeedSMCFlash *fl) 605 { 606 const AspeedSMCState *s = fl->controller; 607 608 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 609 } 610 611 static void aspeed_smc_reset(DeviceState *d) 612 { 613 AspeedSMCState *s = ASPEED_SMC(d); 614 int i; 615 616 memset(s->regs, 0, sizeof s->regs); 617 618 /* Pretend DMA is done (u-boot initialization) */ 619 s->regs[R_INTR_CTRL] = INTR_CTRL_DMA_STATUS; 620 621 /* Unselect all slaves */ 622 for (i = 0; i < s->num_cs; ++i) { 623 s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE; 624 qemu_set_irq(s->cs_lines[i], true); 625 } 626 627 /* setup default segment register values for all */ 628 for (i = 0; i < s->ctrl->max_slaves; ++i) { 629 s->regs[R_SEG_ADDR0 + i] = 630 aspeed_smc_segment_to_reg(&s->ctrl->segments[i]); 631 } 632 633 /* HW strapping for AST2500 FMC controllers */ 634 if (s->ctrl->segments == aspeed_segments_ast2500_fmc) { 635 /* flash type is fixed to SPI for CE0 and CE1 */ 636 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0); 637 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1); 638 639 /* 4BYTE mode is autodetected for CE0. Let's force it to 1 for 640 * now */ 641 s->regs[s->r_ce_ctrl] |= (1 << (CTRL_EXTENDED0)); 642 } 643 644 /* HW strapping for AST2400 FMC controllers (SCU70). Let's use the 645 * configuration of the palmetto-bmc machine */ 646 if (s->ctrl->segments == aspeed_segments_fmc) { 647 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0); 648 649 s->regs[s->r_ce_ctrl] |= (1 << (CTRL_EXTENDED0)); 650 } 651 } 652 653 static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size) 654 { 655 AspeedSMCState *s = ASPEED_SMC(opaque); 656 657 addr >>= 2; 658 659 if (addr == s->r_conf || 660 addr == s->r_timings || 661 addr == s->r_ce_ctrl || 662 addr == R_INTR_CTRL || 663 (addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) || 664 (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs)) { 665 return s->regs[addr]; 666 } else { 667 qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n", 668 __func__, addr); 669 return 0; 670 } 671 } 672 673 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data, 674 unsigned int size) 675 { 676 AspeedSMCState *s = ASPEED_SMC(opaque); 677 uint32_t value = data; 678 679 addr >>= 2; 680 681 if (addr == s->r_conf || 682 addr == s->r_timings || 683 addr == s->r_ce_ctrl) { 684 s->regs[addr] = value; 685 } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) { 686 int cs = addr - s->r_ctrl0; 687 s->regs[addr] = value; 688 aspeed_smc_flash_update_cs(&s->flashes[cs]); 689 } else if (addr >= R_SEG_ADDR0 && 690 addr < R_SEG_ADDR0 + s->ctrl->max_slaves) { 691 int cs = addr - R_SEG_ADDR0; 692 693 if (value != s->regs[R_SEG_ADDR0 + cs]) { 694 aspeed_smc_flash_set_segment(s, cs, value); 695 } 696 } else { 697 qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n", 698 __func__, addr); 699 return; 700 } 701 } 702 703 static const MemoryRegionOps aspeed_smc_ops = { 704 .read = aspeed_smc_read, 705 .write = aspeed_smc_write, 706 .endianness = DEVICE_LITTLE_ENDIAN, 707 .valid.unaligned = true, 708 }; 709 710 static void aspeed_smc_realize(DeviceState *dev, Error **errp) 711 { 712 SysBusDevice *sbd = SYS_BUS_DEVICE(dev); 713 AspeedSMCState *s = ASPEED_SMC(dev); 714 AspeedSMCClass *mc = ASPEED_SMC_GET_CLASS(s); 715 int i; 716 char name[32]; 717 hwaddr offset = 0; 718 719 s->ctrl = mc->ctrl; 720 721 /* keep a copy under AspeedSMCState to speed up accesses */ 722 s->r_conf = s->ctrl->r_conf; 723 s->r_ce_ctrl = s->ctrl->r_ce_ctrl; 724 s->r_ctrl0 = s->ctrl->r_ctrl0; 725 s->r_timings = s->ctrl->r_timings; 726 s->conf_enable_w0 = s->ctrl->conf_enable_w0; 727 728 /* Enforce some real HW limits */ 729 if (s->num_cs > s->ctrl->max_slaves) { 730 qemu_log_mask(LOG_GUEST_ERROR, "%s: num_cs cannot exceed: %d\n", 731 __func__, s->ctrl->max_slaves); 732 s->num_cs = s->ctrl->max_slaves; 733 } 734 735 s->spi = ssi_create_bus(dev, "spi"); 736 737 /* Setup cs_lines for slaves */ 738 sysbus_init_irq(sbd, &s->irq); 739 s->cs_lines = g_new0(qemu_irq, s->num_cs); 740 ssi_auto_connect_slaves(dev, s->cs_lines, s->spi); 741 742 for (i = 0; i < s->num_cs; ++i) { 743 sysbus_init_irq(sbd, &s->cs_lines[i]); 744 } 745 746 /* The memory region for the controller registers */ 747 memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s, 748 s->ctrl->name, s->ctrl->nregs * 4); 749 sysbus_init_mmio(sbd, &s->mmio); 750 751 /* 752 * The container memory region representing the address space 753 * window in which the flash modules are mapped. The size and 754 * address depends on the SoC model and controller type. 755 */ 756 snprintf(name, sizeof(name), "%s.flash", s->ctrl->name); 757 758 memory_region_init_io(&s->mmio_flash, OBJECT(s), 759 &aspeed_smc_flash_default_ops, s, name, 760 s->ctrl->flash_window_size); 761 sysbus_init_mmio(sbd, &s->mmio_flash); 762 763 s->flashes = g_new0(AspeedSMCFlash, s->ctrl->max_slaves); 764 765 /* 766 * Let's create a sub memory region for each possible slave. All 767 * have a configurable memory segment in the overall flash mapping 768 * window of the controller but, there is not necessarily a flash 769 * module behind to handle the memory accesses. This depends on 770 * the board configuration. 771 */ 772 for (i = 0; i < s->ctrl->max_slaves; ++i) { 773 AspeedSMCFlash *fl = &s->flashes[i]; 774 775 snprintf(name, sizeof(name), "%s.%d", s->ctrl->name, i); 776 777 fl->id = i; 778 fl->controller = s; 779 fl->size = s->ctrl->segments[i].size; 780 memory_region_init_io(&fl->mmio, OBJECT(s), &aspeed_smc_flash_ops, 781 fl, name, fl->size); 782 memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio); 783 offset += fl->size; 784 } 785 } 786 787 static const VMStateDescription vmstate_aspeed_smc = { 788 .name = "aspeed.smc", 789 .version_id = 1, 790 .minimum_version_id = 1, 791 .fields = (VMStateField[]) { 792 VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX), 793 VMSTATE_END_OF_LIST() 794 } 795 }; 796 797 static Property aspeed_smc_properties[] = { 798 DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1), 799 DEFINE_PROP_END_OF_LIST(), 800 }; 801 802 static void aspeed_smc_class_init(ObjectClass *klass, void *data) 803 { 804 DeviceClass *dc = DEVICE_CLASS(klass); 805 AspeedSMCClass *mc = ASPEED_SMC_CLASS(klass); 806 807 dc->realize = aspeed_smc_realize; 808 dc->reset = aspeed_smc_reset; 809 dc->props = aspeed_smc_properties; 810 dc->vmsd = &vmstate_aspeed_smc; 811 mc->ctrl = data; 812 } 813 814 static const TypeInfo aspeed_smc_info = { 815 .name = TYPE_ASPEED_SMC, 816 .parent = TYPE_SYS_BUS_DEVICE, 817 .instance_size = sizeof(AspeedSMCState), 818 .class_size = sizeof(AspeedSMCClass), 819 .abstract = true, 820 }; 821 822 static void aspeed_smc_register_types(void) 823 { 824 int i; 825 826 type_register_static(&aspeed_smc_info); 827 for (i = 0; i < ARRAY_SIZE(controllers); ++i) { 828 TypeInfo ti = { 829 .name = controllers[i].name, 830 .parent = TYPE_ASPEED_SMC, 831 .class_init = aspeed_smc_class_init, 832 .class_data = (void *)&controllers[i], 833 }; 834 type_register(&ti); 835 } 836 } 837 838 type_init(aspeed_smc_register_types) 839