xref: /openbmc/qemu/hw/ssi/aspeed_smc.c (revision d481cec7)
1 /*
2  * ASPEED AST2400 SMC Controller (SPI Flash Only)
3  *
4  * Copyright (C) 2016 IBM Corp.
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "hw/block/flash.h"
27 #include "hw/sysbus.h"
28 #include "migration/vmstate.h"
29 #include "qemu/log.h"
30 #include "qemu/module.h"
31 #include "qemu/error-report.h"
32 #include "qapi/error.h"
33 #include "qemu/units.h"
34 #include "trace.h"
35 
36 #include "hw/irq.h"
37 #include "hw/qdev-properties.h"
38 #include "hw/ssi/aspeed_smc.h"
39 
40 /* CE Type Setting Register */
41 #define R_CONF            (0x00 / 4)
42 #define   CONF_LEGACY_DISABLE  (1 << 31)
43 #define   CONF_ENABLE_W4       20
44 #define   CONF_ENABLE_W3       19
45 #define   CONF_ENABLE_W2       18
46 #define   CONF_ENABLE_W1       17
47 #define   CONF_ENABLE_W0       16
48 #define   CONF_FLASH_TYPE4     8
49 #define   CONF_FLASH_TYPE3     6
50 #define   CONF_FLASH_TYPE2     4
51 #define   CONF_FLASH_TYPE1     2
52 #define   CONF_FLASH_TYPE0     0
53 #define      CONF_FLASH_TYPE_NOR   0x0
54 #define      CONF_FLASH_TYPE_NAND  0x1
55 #define      CONF_FLASH_TYPE_SPI   0x2 /* AST2600 is SPI only */
56 
57 /* CE Control Register */
58 #define R_CE_CTRL            (0x04 / 4)
59 #define   CTRL_EXTENDED4       4  /* 32 bit addressing for SPI */
60 #define   CTRL_EXTENDED3       3  /* 32 bit addressing for SPI */
61 #define   CTRL_EXTENDED2       2  /* 32 bit addressing for SPI */
62 #define   CTRL_EXTENDED1       1  /* 32 bit addressing for SPI */
63 #define   CTRL_EXTENDED0       0  /* 32 bit addressing for SPI */
64 
65 /* Interrupt Control and Status Register */
66 #define R_INTR_CTRL       (0x08 / 4)
67 #define   INTR_CTRL_DMA_STATUS            (1 << 11)
68 #define   INTR_CTRL_CMD_ABORT_STATUS      (1 << 10)
69 #define   INTR_CTRL_WRITE_PROTECT_STATUS  (1 << 9)
70 #define   INTR_CTRL_DMA_EN                (1 << 3)
71 #define   INTR_CTRL_CMD_ABORT_EN          (1 << 2)
72 #define   INTR_CTRL_WRITE_PROTECT_EN      (1 << 1)
73 
74 /* Command Control Register */
75 #define R_CE_CMD_CTRL      (0x0C / 4)
76 #define   CTRL_ADDR_BYTE0_DISABLE_SHIFT       4
77 #define   CTRL_DATA_BYTE0_DISABLE_SHIFT       0
78 
79 #define aspeed_smc_addr_byte_enabled(s, i)                               \
80     (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_ADDR_BYTE0_DISABLE_SHIFT + (i)))))
81 #define aspeed_smc_data_byte_enabled(s, i)                               \
82     (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_DATA_BYTE0_DISABLE_SHIFT + (i)))))
83 
84 /* CEx Control Register */
85 #define R_CTRL0           (0x10 / 4)
86 #define   CTRL_IO_QPI              (1 << 31)
87 #define   CTRL_IO_QUAD_DATA        (1 << 30)
88 #define   CTRL_IO_DUAL_DATA        (1 << 29)
89 #define   CTRL_IO_DUAL_ADDR_DATA   (1 << 28) /* Includes dummies */
90 #define   CTRL_IO_QUAD_ADDR_DATA   (1 << 28) /* Includes dummies */
91 #define   CTRL_CMD_SHIFT           16
92 #define   CTRL_CMD_MASK            0xff
93 #define   CTRL_DUMMY_HIGH_SHIFT    14
94 #define   CTRL_AST2400_SPI_4BYTE   (1 << 13)
95 #define CE_CTRL_CLOCK_FREQ_SHIFT   8
96 #define CE_CTRL_CLOCK_FREQ_MASK    0xf
97 #define CE_CTRL_CLOCK_FREQ(div)                                         \
98     (((div) & CE_CTRL_CLOCK_FREQ_MASK) << CE_CTRL_CLOCK_FREQ_SHIFT)
99 #define   CTRL_DUMMY_LOW_SHIFT     6 /* 2 bits [7:6] */
100 #define   CTRL_CE_STOP_ACTIVE      (1 << 2)
101 #define   CTRL_CMD_MODE_MASK       0x3
102 #define     CTRL_READMODE          0x0
103 #define     CTRL_FREADMODE         0x1
104 #define     CTRL_WRITEMODE         0x2
105 #define     CTRL_USERMODE          0x3
106 #define R_CTRL1           (0x14 / 4)
107 #define R_CTRL2           (0x18 / 4)
108 #define R_CTRL3           (0x1C / 4)
109 #define R_CTRL4           (0x20 / 4)
110 
111 /* CEx Segment Address Register */
112 #define R_SEG_ADDR0       (0x30 / 4)
113 #define   SEG_END_SHIFT        24   /* 8MB units */
114 #define   SEG_END_MASK         0xff
115 #define   SEG_START_SHIFT      16   /* address bit [A29-A23] */
116 #define   SEG_START_MASK       0xff
117 #define R_SEG_ADDR1       (0x34 / 4)
118 #define R_SEG_ADDR2       (0x38 / 4)
119 #define R_SEG_ADDR3       (0x3C / 4)
120 #define R_SEG_ADDR4       (0x40 / 4)
121 
122 /* Misc Control Register #1 */
123 #define R_MISC_CTRL1      (0x50 / 4)
124 
125 /* SPI dummy cycle data */
126 #define R_DUMMY_DATA      (0x54 / 4)
127 
128 /* FMC_WDT2 Control/Status Register for Alternate Boot (AST2600) */
129 #define R_FMC_WDT2_CTRL   (0x64 / 4)
130 #define   FMC_WDT2_CTRL_ALT_BOOT_MODE    BIT(6) /* O: 2 chips 1: 1 chip */
131 #define   FMC_WDT2_CTRL_SINGLE_BOOT_MODE BIT(5)
132 #define   FMC_WDT2_CTRL_BOOT_SOURCE      BIT(4) /* O: primary 1: alternate */
133 #define   FMC_WDT2_CTRL_EN               BIT(0)
134 
135 /* DMA DRAM Side Address High Part (AST2700) */
136 #define R_DMA_DRAM_ADDR_HIGH   (0x7c / 4)
137 
138 /* DMA Control/Status Register */
139 #define R_DMA_CTRL        (0x80 / 4)
140 #define   DMA_CTRL_REQUEST      (1 << 31)
141 #define   DMA_CTRL_GRANT        (1 << 30)
142 #define   DMA_CTRL_DELAY_MASK   0xf
143 #define   DMA_CTRL_DELAY_SHIFT  8
144 #define   DMA_CTRL_FREQ_MASK    0xf
145 #define   DMA_CTRL_FREQ_SHIFT   4
146 #define   DMA_CTRL_CALIB        (1 << 3)
147 #define   DMA_CTRL_CKSUM        (1 << 2)
148 #define   DMA_CTRL_WRITE        (1 << 1)
149 #define   DMA_CTRL_ENABLE       (1 << 0)
150 
151 /* DMA Flash Side Address */
152 #define R_DMA_FLASH_ADDR  (0x84 / 4)
153 
154 /* DMA DRAM Side Address */
155 #define R_DMA_DRAM_ADDR   (0x88 / 4)
156 
157 /* DMA Length Register */
158 #define R_DMA_LEN         (0x8C / 4)
159 
160 /* Checksum Calculation Result */
161 #define R_DMA_CHECKSUM    (0x90 / 4)
162 
163 /* Read Timing Compensation Register */
164 #define R_TIMINGS         (0x94 / 4)
165 
166 /* SPI controller registers and bits (AST2400) */
167 #define R_SPI_CONF        (0x00 / 4)
168 #define   SPI_CONF_ENABLE_W0   0
169 #define R_SPI_CTRL0       (0x4 / 4)
170 #define R_SPI_MISC_CTRL   (0x10 / 4)
171 #define R_SPI_TIMINGS     (0x14 / 4)
172 
173 #define ASPEED_SMC_R_SPI_MAX (0x20 / 4)
174 #define ASPEED_SMC_R_SMC_MAX (0x20 / 4)
175 
176 /*
177  * DMA DRAM addresses should be 4 bytes aligned and the valid address
178  * range is 0x40000000 - 0x5FFFFFFF (AST2400)
179  *          0x80000000 - 0xBFFFFFFF (AST2500)
180  *
181  * DMA flash addresses should be 4 bytes aligned and the valid address
182  * range is 0x20000000 - 0x2FFFFFFF.
183  *
184  * DMA length is from 4 bytes to 32MB (AST2500)
185  *   0: 4 bytes
186  *   0x1FFFFFC: 32M bytes
187  *
188  * DMA length is from 1 byte to 32MB (AST2600, AST10x0 and AST2700)
189  *   0: 1 byte
190  *   0x1FFFFFF: 32M bytes
191  */
192 #define DMA_DRAM_ADDR(asc, val)   ((val) & (asc)->dma_dram_mask)
193 #define DMA_DRAM_ADDR_HIGH(val)   ((val) & 0xf)
194 #define DMA_FLASH_ADDR(asc, val)  ((val) & (asc)->dma_flash_mask)
195 #define DMA_LENGTH(val)         ((val) & 0x01FFFFFF)
196 
197 /* Flash opcodes. */
198 #define SPI_OP_READ       0x03    /* Read data bytes (low frequency) */
199 
200 #define SNOOP_OFF         0xFF
201 #define SNOOP_START       0x0
202 
203 /*
204  * Default segments mapping addresses and size for each peripheral per
205  * controller. These can be changed when board is initialized with the
206  * Segment Address Registers.
207  */
208 static const AspeedSegments aspeed_2500_spi1_segments[];
209 static const AspeedSegments aspeed_2500_spi2_segments[];
210 
211 #define ASPEED_SMC_FEATURE_DMA       0x1
212 #define ASPEED_SMC_FEATURE_DMA_GRANT 0x2
213 #define ASPEED_SMC_FEATURE_WDT_CONTROL 0x4
214 #define ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH 0x08
215 
216 static inline bool aspeed_smc_has_dma(const AspeedSMCClass *asc)
217 {
218     return !!(asc->features & ASPEED_SMC_FEATURE_DMA);
219 }
220 
221 static inline bool aspeed_smc_has_wdt_control(const AspeedSMCClass *asc)
222 {
223     return !!(asc->features & ASPEED_SMC_FEATURE_WDT_CONTROL);
224 }
225 
226 static inline bool aspeed_smc_has_dma64(const AspeedSMCClass *asc)
227 {
228     return !!(asc->features & ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH);
229 }
230 
231 #define aspeed_smc_error(fmt, ...)                                      \
232     qemu_log_mask(LOG_GUEST_ERROR, "%s: " fmt "\n", __func__, ## __VA_ARGS__)
233 
234 static bool aspeed_smc_flash_overlap(const AspeedSMCState *s,
235                                      const AspeedSegments *new,
236                                      int cs)
237 {
238     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
239     AspeedSegments seg;
240     int i;
241 
242     for (i = 0; i < asc->cs_num_max; i++) {
243         if (i == cs) {
244             continue;
245         }
246 
247         asc->reg_to_segment(s, s->regs[R_SEG_ADDR0 + i], &seg);
248 
249         if (new->addr + new->size > seg.addr &&
250             new->addr < seg.addr + seg.size) {
251             aspeed_smc_error("new segment CS%d [ 0x%"
252                              HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with "
253                              "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
254                              cs, new->addr, new->addr + new->size,
255                              i, seg.addr, seg.addr + seg.size);
256             return true;
257         }
258     }
259     return false;
260 }
261 
262 static void aspeed_smc_flash_set_segment_region(AspeedSMCState *s, int cs,
263                                                 uint64_t regval)
264 {
265     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
266     AspeedSMCFlash *fl = &s->flashes[cs];
267     AspeedSegments seg;
268 
269     asc->reg_to_segment(s, regval, &seg);
270 
271     memory_region_transaction_begin();
272     memory_region_set_size(&fl->mmio, seg.size);
273     memory_region_set_address(&fl->mmio, seg.addr - asc->flash_window_base);
274     memory_region_set_enabled(&fl->mmio, !!seg.size);
275     memory_region_transaction_commit();
276 
277     if (asc->segment_addr_mask) {
278         regval &= asc->segment_addr_mask;
279     }
280 
281     s->regs[R_SEG_ADDR0 + cs] = regval;
282 }
283 
284 static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
285                                          uint64_t new)
286 {
287     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
288     AspeedSegments seg;
289 
290     asc->reg_to_segment(s, new, &seg);
291 
292     trace_aspeed_smc_flash_set_segment(cs, new, seg.addr, seg.addr + seg.size);
293 
294     /* The start address of CS0 is read-only */
295     if (cs == 0 && seg.addr != asc->flash_window_base) {
296         aspeed_smc_error("Tried to change CS0 start address to 0x%"
297                          HWADDR_PRIx, seg.addr);
298         seg.addr = asc->flash_window_base;
299         new = asc->segment_to_reg(s, &seg);
300     }
301 
302     /*
303      * The end address of the AST2500 spi controllers is also
304      * read-only.
305      */
306     if ((asc->segments == aspeed_2500_spi1_segments ||
307          asc->segments == aspeed_2500_spi2_segments) &&
308         cs == asc->cs_num_max &&
309         seg.addr + seg.size != asc->segments[cs].addr +
310         asc->segments[cs].size) {
311         aspeed_smc_error("Tried to change CS%d end address to 0x%"
312                          HWADDR_PRIx, cs, seg.addr + seg.size);
313         seg.size = asc->segments[cs].addr + asc->segments[cs].size -
314             seg.addr;
315         new = asc->segment_to_reg(s, &seg);
316     }
317 
318     /* Keep the segment in the overall flash window */
319     if (seg.size &&
320         (seg.addr + seg.size <= asc->flash_window_base ||
321          seg.addr > asc->flash_window_base + asc->flash_window_size)) {
322         aspeed_smc_error("new segment for CS%d is invalid : "
323                          "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
324                          cs, seg.addr, seg.addr + seg.size);
325         return;
326     }
327 
328     /* Check start address vs. alignment */
329     if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) {
330         aspeed_smc_error("new segment for CS%d is not "
331                          "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
332                          cs, seg.addr, seg.addr + seg.size);
333     }
334 
335     /* And segments should not overlap (in the specs) */
336     aspeed_smc_flash_overlap(s, &seg, cs);
337 
338     /* All should be fine now to move the region */
339     aspeed_smc_flash_set_segment_region(s, cs, new);
340 }
341 
342 static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr,
343                                               unsigned size)
344 {
345     aspeed_smc_error("To 0x%" HWADDR_PRIx " of size %u", addr, size);
346     return 0;
347 }
348 
349 static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr,
350                                            uint64_t data, unsigned size)
351 {
352     aspeed_smc_error("To 0x%" HWADDR_PRIx " of size %u: 0x%" PRIx64,
353                      addr, size, data);
354 }
355 
356 static const MemoryRegionOps aspeed_smc_flash_default_ops = {
357     .read = aspeed_smc_flash_default_read,
358     .write = aspeed_smc_flash_default_write,
359     .endianness = DEVICE_LITTLE_ENDIAN,
360     .valid = {
361         .min_access_size = 1,
362         .max_access_size = 4,
363     },
364 };
365 
366 static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl)
367 {
368     const AspeedSMCState *s = fl->controller;
369 
370     return s->regs[s->r_ctrl0 + fl->cs] & CTRL_CMD_MODE_MASK;
371 }
372 
373 static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl)
374 {
375     const AspeedSMCState *s = fl->controller;
376 
377     return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->cs));
378 }
379 
380 static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl)
381 {
382     const AspeedSMCState *s = fl->controller;
383     int cmd = (s->regs[s->r_ctrl0 + fl->cs] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK;
384 
385     /*
386      * In read mode, the default SPI command is READ (0x3). In other
387      * modes, the command should necessarily be defined
388      *
389      * TODO: add support for READ4 (0x13) on AST2600
390      */
391     if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) {
392         cmd = SPI_OP_READ;
393     }
394 
395     if (!cmd) {
396         aspeed_smc_error("no command defined for mode %d",
397                          aspeed_smc_flash_mode(fl));
398     }
399 
400     return cmd;
401 }
402 
403 static inline int aspeed_smc_flash_addr_width(const AspeedSMCFlash *fl)
404 {
405     const AspeedSMCState *s = fl->controller;
406     AspeedSMCClass *asc = fl->asc;
407 
408     if (asc->addr_width) {
409         return asc->addr_width(s);
410     } else {
411         return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->cs)) ? 4 : 3;
412     }
413 }
414 
415 static void aspeed_smc_flash_do_select(AspeedSMCFlash *fl, bool unselect)
416 {
417     AspeedSMCState *s = fl->controller;
418 
419     trace_aspeed_smc_flash_select(fl->cs, unselect ? "un" : "");
420     s->unselect = unselect;
421     qemu_set_irq(s->cs_lines[fl->cs], unselect);
422 }
423 
424 static void aspeed_smc_flash_select(AspeedSMCFlash *fl)
425 {
426     aspeed_smc_flash_do_select(fl, false);
427 }
428 
429 static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl)
430 {
431     aspeed_smc_flash_do_select(fl, true);
432 }
433 
434 static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
435                                               uint32_t addr)
436 {
437     const AspeedSMCState *s = fl->controller;
438     AspeedSMCClass *asc = fl->asc;
439     AspeedSegments seg;
440 
441     asc->reg_to_segment(s, s->regs[R_SEG_ADDR0 + fl->cs], &seg);
442     if ((addr % seg.size) != addr) {
443         aspeed_smc_error("invalid address 0x%08x for CS%d segment : "
444                          "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
445                          addr, fl->cs, seg.addr, seg.addr + seg.size);
446         addr %= seg.size;
447     }
448 
449     return addr;
450 }
451 
452 static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl)
453 {
454     const AspeedSMCState *s = fl->controller;
455     uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->cs];
456     uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1;
457     uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3;
458     uint32_t dummies = ((dummy_high << 2) | dummy_low) * 8;
459 
460     if (r_ctrl0 & CTRL_IO_DUAL_ADDR_DATA) {
461         dummies /= 2;
462     }
463 
464     return dummies;
465 }
466 
467 static void aspeed_smc_flash_setup(AspeedSMCFlash *fl, uint32_t addr)
468 {
469     const AspeedSMCState *s = fl->controller;
470     uint8_t cmd = aspeed_smc_flash_cmd(fl);
471     int i = aspeed_smc_flash_addr_width(fl);
472 
473     /* Flash access can not exceed CS segment */
474     addr = aspeed_smc_check_segment_addr(fl, addr);
475 
476     ssi_transfer(s->spi, cmd);
477     while (i--) {
478         if (aspeed_smc_addr_byte_enabled(s, i)) {
479             ssi_transfer(s->spi, (addr >> (i * 8)) & 0xff);
480         }
481     }
482 
483     /*
484      * Use fake transfers to model dummy bytes. The value should
485      * be configured to some non-zero value in fast read mode and
486      * zero in read mode. But, as the HW allows inconsistent
487      * settings, let's check for fast read mode.
488      */
489     if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) {
490         for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) {
491             ssi_transfer(fl->controller->spi, s->regs[R_DUMMY_DATA] & 0xff);
492         }
493     }
494 }
495 
496 static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
497 {
498     AspeedSMCFlash *fl = opaque;
499     AspeedSMCState *s = fl->controller;
500     uint64_t ret = 0;
501     int i;
502 
503     switch (aspeed_smc_flash_mode(fl)) {
504     case CTRL_USERMODE:
505         for (i = 0; i < size; i++) {
506             ret |= (uint64_t) ssi_transfer(s->spi, 0x0) << (8 * i);
507         }
508         break;
509     case CTRL_READMODE:
510     case CTRL_FREADMODE:
511         aspeed_smc_flash_select(fl);
512         aspeed_smc_flash_setup(fl, addr);
513 
514         for (i = 0; i < size; i++) {
515             ret |= (uint64_t) ssi_transfer(s->spi, 0x0) << (8 * i);
516         }
517 
518         aspeed_smc_flash_unselect(fl);
519         break;
520     default:
521         aspeed_smc_error("invalid flash mode %d", aspeed_smc_flash_mode(fl));
522     }
523 
524     trace_aspeed_smc_flash_read(fl->cs, addr, size, ret,
525                                 aspeed_smc_flash_mode(fl));
526     return ret;
527 }
528 
529 /*
530  * TODO (clg@kaod.org): stolen from xilinx_spips.c. Should move to a
531  * common include header.
532  */
533 typedef enum {
534     READ = 0x3,         READ_4 = 0x13,
535     FAST_READ = 0xb,    FAST_READ_4 = 0x0c,
536     DOR = 0x3b,         DOR_4 = 0x3c,
537     QOR = 0x6b,         QOR_4 = 0x6c,
538     DIOR = 0xbb,        DIOR_4 = 0xbc,
539     QIOR = 0xeb,        QIOR_4 = 0xec,
540 
541     PP = 0x2,           PP_4 = 0x12,
542     DPP = 0xa2,
543     QPP = 0x32,         QPP_4 = 0x34,
544 } FlashCMD;
545 
546 static int aspeed_smc_num_dummies(uint8_t command)
547 {
548     switch (command) { /* check for dummies */
549     case READ: /* no dummy bytes/cycles */
550     case PP:
551     case DPP:
552     case QPP:
553     case READ_4:
554     case PP_4:
555     case QPP_4:
556         return 0;
557     case FAST_READ:
558     case DOR:
559     case QOR:
560     case FAST_READ_4:
561     case DOR_4:
562     case QOR_4:
563         return 1;
564     case DIOR:
565     case DIOR_4:
566         return 2;
567     case QIOR:
568     case QIOR_4:
569         return 4;
570     default:
571         return -1;
572     }
573 }
574 
575 static bool aspeed_smc_do_snoop(AspeedSMCFlash *fl,  uint64_t data,
576                                 unsigned size)
577 {
578     AspeedSMCState *s = fl->controller;
579     uint8_t addr_width = aspeed_smc_flash_addr_width(fl);
580 
581     trace_aspeed_smc_do_snoop(fl->cs, s->snoop_index, s->snoop_dummies,
582                               (uint8_t) data & 0xff);
583 
584     if (s->snoop_index == SNOOP_OFF) {
585         return false; /* Do nothing */
586 
587     } else if (s->snoop_index == SNOOP_START) {
588         uint8_t cmd = data & 0xff;
589         int ndummies = aspeed_smc_num_dummies(cmd);
590 
591         /*
592          * No dummy cycles are expected with the current command. Turn
593          * off snooping and let the transfer proceed normally.
594          */
595         if (ndummies <= 0) {
596             s->snoop_index = SNOOP_OFF;
597             return false;
598         }
599 
600         s->snoop_dummies = ndummies * 8;
601 
602     } else if (s->snoop_index >= addr_width + 1) {
603 
604         /* The SPI transfer has reached the dummy cycles sequence */
605         for (; s->snoop_dummies; s->snoop_dummies--) {
606             ssi_transfer(s->spi, s->regs[R_DUMMY_DATA] & 0xff);
607         }
608 
609         /* If no more dummy cycles are expected, turn off snooping */
610         if (!s->snoop_dummies) {
611             s->snoop_index = SNOOP_OFF;
612         } else {
613             s->snoop_index += size;
614         }
615 
616         /*
617          * Dummy cycles have been faked already. Ignore the current
618          * SPI transfer
619          */
620         return true;
621     }
622 
623     s->snoop_index += size;
624     return false;
625 }
626 
627 static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,
628                                    unsigned size)
629 {
630     AspeedSMCFlash *fl = opaque;
631     AspeedSMCState *s = fl->controller;
632     int i;
633 
634     trace_aspeed_smc_flash_write(fl->cs, addr, size, data,
635                                  aspeed_smc_flash_mode(fl));
636 
637     if (!aspeed_smc_is_writable(fl)) {
638         aspeed_smc_error("flash is not writable at 0x%" HWADDR_PRIx, addr);
639         return;
640     }
641 
642     switch (aspeed_smc_flash_mode(fl)) {
643     case CTRL_USERMODE:
644         if (aspeed_smc_do_snoop(fl, data, size)) {
645             break;
646         }
647 
648         for (i = 0; i < size; i++) {
649             ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
650         }
651         break;
652     case CTRL_WRITEMODE:
653         aspeed_smc_flash_select(fl);
654         aspeed_smc_flash_setup(fl, addr);
655 
656         for (i = 0; i < size; i++) {
657             ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
658         }
659 
660         aspeed_smc_flash_unselect(fl);
661         break;
662     default:
663         aspeed_smc_error("invalid flash mode %d", aspeed_smc_flash_mode(fl));
664     }
665 }
666 
667 static const MemoryRegionOps aspeed_smc_flash_ops = {
668     .read = aspeed_smc_flash_read,
669     .write = aspeed_smc_flash_write,
670     .endianness = DEVICE_LITTLE_ENDIAN,
671     .valid = {
672         .min_access_size = 1,
673         .max_access_size = 4,
674     },
675 };
676 
677 static void aspeed_smc_flash_update_ctrl(AspeedSMCFlash *fl, uint32_t value)
678 {
679     AspeedSMCState *s = fl->controller;
680     bool unselect = false;
681     uint32_t old_mode;
682     uint32_t new_mode;
683 
684     old_mode = s->regs[s->r_ctrl0 + fl->cs] & CTRL_CMD_MODE_MASK;
685     new_mode = value & CTRL_CMD_MODE_MASK;
686 
687     if (old_mode == CTRL_USERMODE) {
688         if (new_mode != CTRL_USERMODE) {
689             unselect = true;
690         }
691 
692         /* A change of CTRL_CE_STOP_ACTIVE from 0 to 1, unselects the CS */
693         if (!(s->regs[s->r_ctrl0 + fl->cs] & CTRL_CE_STOP_ACTIVE) &&
694             value & CTRL_CE_STOP_ACTIVE) {
695             unselect = true;
696         }
697     } else {
698         if (new_mode != CTRL_USERMODE) {
699             unselect = true;
700         }
701     }
702 
703     s->regs[s->r_ctrl0 + fl->cs] = value;
704 
705     if (unselect != s->unselect) {
706         s->snoop_index = unselect ? SNOOP_OFF : SNOOP_START;
707         aspeed_smc_flash_do_select(fl, unselect);
708     }
709 }
710 
711 static void aspeed_smc_reset(DeviceState *d)
712 {
713     AspeedSMCState *s = ASPEED_SMC(d);
714     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
715     int i;
716 
717     if (asc->resets) {
718         memcpy(s->regs, asc->resets, sizeof s->regs);
719     } else {
720         memset(s->regs, 0, sizeof s->regs);
721     }
722 
723     for (i = 0; i < asc->cs_num_max; i++) {
724         DeviceState *dev = ssi_get_cs(s->spi, i);
725         if (dev) {
726             Object *o = OBJECT(dev);
727 
728             if (!object_dynamic_cast(o, TYPE_M25P80)) {
729                 warn_report("Aspeed SMC %s.%d : Invalid %s device type",
730                             BUS(s->spi)->name, i, object_get_typename(o));
731                 continue;
732             }
733 
734             qemu_irq cs_line = qdev_get_gpio_in_named(dev, SSI_GPIO_CS, 0);
735             qdev_connect_gpio_out_named(DEVICE(s), "cs", i, cs_line);
736         }
737     }
738 
739     /* Unselect all peripherals */
740     for (i = 0; i < asc->cs_num_max; ++i) {
741         s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE;
742         qemu_set_irq(s->cs_lines[i], true);
743     }
744 
745     s->unselect = true;
746 
747     /* setup the default segment register values and regions for all */
748     for (i = 0; i < asc->cs_num_max; ++i) {
749         aspeed_smc_flash_set_segment_region(s, i,
750                     asc->segment_to_reg(s, &asc->segments[i]));
751     }
752 
753     s->snoop_index = SNOOP_OFF;
754     s->snoop_dummies = 0;
755 }
756 
757 static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
758 {
759     AspeedSMCState *s = ASPEED_SMC(opaque);
760     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(opaque);
761 
762     addr >>= 2;
763 
764     if (addr == s->r_conf ||
765         (addr >= s->r_timings &&
766          addr < s->r_timings + asc->nregs_timings) ||
767         addr == s->r_ce_ctrl ||
768         addr == R_CE_CMD_CTRL ||
769         addr == R_INTR_CTRL ||
770         addr == R_DUMMY_DATA ||
771         (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_CTRL) ||
772         (aspeed_smc_has_dma(asc) && addr == R_DMA_CTRL) ||
773         (aspeed_smc_has_dma(asc) && addr == R_DMA_FLASH_ADDR) ||
774         (aspeed_smc_has_dma(asc) && addr == R_DMA_DRAM_ADDR) ||
775         (aspeed_smc_has_dma(asc) && aspeed_smc_has_dma64(asc) &&
776          addr == R_DMA_DRAM_ADDR_HIGH) ||
777         (aspeed_smc_has_dma(asc) && addr == R_DMA_LEN) ||
778         (aspeed_smc_has_dma(asc) && addr == R_DMA_CHECKSUM) ||
779         (addr >= R_SEG_ADDR0 &&
780          addr < R_SEG_ADDR0 + asc->cs_num_max) ||
781         (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + asc->cs_num_max)) {
782 
783         trace_aspeed_smc_read(addr << 2, size, s->regs[addr]);
784 
785         return s->regs[addr];
786     } else {
787         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
788                       __func__, addr);
789         return -1;
790     }
791 }
792 
793 static uint8_t aspeed_smc_hclk_divisor(uint8_t hclk_mask)
794 {
795     /* HCLK/1 .. HCLK/16 */
796     const uint8_t hclk_divisors[] = {
797         15, 7, 14, 6, 13, 5, 12, 4, 11, 3, 10, 2, 9, 1, 8, 0
798     };
799     int i;
800 
801     for (i = 0; i < ARRAY_SIZE(hclk_divisors); i++) {
802         if (hclk_mask == hclk_divisors[i]) {
803             return i + 1;
804         }
805     }
806 
807     g_assert_not_reached();
808 }
809 
810 /*
811  * When doing calibration, the SPI clock rate in the CE0 Control
812  * Register and the read delay cycles in the Read Timing Compensation
813  * Register are set using bit[11:4] of the DMA Control Register.
814  */
815 static void aspeed_smc_dma_calibration(AspeedSMCState *s)
816 {
817     uint8_t delay =
818         (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
819     uint8_t hclk_mask =
820         (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
821     uint8_t hclk_div = aspeed_smc_hclk_divisor(hclk_mask);
822     uint32_t hclk_shift = (hclk_div - 1) << 2;
823     uint8_t cs;
824 
825     /*
826      * The Read Timing Compensation Register values apply to all CS on
827      * the SPI bus and only HCLK/1 - HCLK/5 can have tunable delays
828      */
829     if (hclk_div && hclk_div < 6) {
830         s->regs[s->r_timings] &= ~(0xf << hclk_shift);
831         s->regs[s->r_timings] |= delay << hclk_shift;
832     }
833 
834     /*
835      * TODO: compute the CS from the DMA address and the segment
836      * registers. This is not really a problem for now because the
837      * Timing Register values apply to all CS and software uses CS0 to
838      * do calibration.
839      */
840     cs = 0;
841     s->regs[s->r_ctrl0 + cs] &=
842         ~(CE_CTRL_CLOCK_FREQ_MASK << CE_CTRL_CLOCK_FREQ_SHIFT);
843     s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
844 }
845 
846 /*
847  * Emulate read errors in the DMA Checksum Register for high
848  * frequencies and optimistic settings of the Read Timing Compensation
849  * Register. This will help in tuning the SPI timing calibration
850  * algorithm.
851  */
852 static bool aspeed_smc_inject_read_failure(AspeedSMCState *s)
853 {
854     uint8_t delay =
855         (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
856     uint8_t hclk_mask =
857         (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
858 
859     /*
860      * Typical values of a palmetto-bmc machine.
861      */
862     switch (aspeed_smc_hclk_divisor(hclk_mask)) {
863     case 4 ... 16:
864         return false;
865     case 3: /* at least one HCLK cycle delay */
866         return (delay & 0x7) < 1;
867     case 2: /* at least two HCLK cycle delay */
868         return (delay & 0x7) < 2;
869     case 1: /* (> 100MHz) is above the max freq of the controller */
870         return true;
871     default:
872         g_assert_not_reached();
873     }
874 }
875 
876 static uint64_t aspeed_smc_dma_dram_addr(AspeedSMCState *s)
877 {
878     return s->regs[R_DMA_DRAM_ADDR] |
879         ((uint64_t) s->regs[R_DMA_DRAM_ADDR_HIGH] << 32);
880 }
881 
882 static uint32_t aspeed_smc_dma_len(AspeedSMCState *s)
883 {
884     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
885 
886     return QEMU_ALIGN_UP(s->regs[R_DMA_LEN] + asc->dma_start_length, 4);
887 }
888 
889 /*
890  * Accumulate the result of the reads to provide a checksum that will
891  * be used to validate the read timing settings.
892  */
893 static void aspeed_smc_dma_checksum(AspeedSMCState *s)
894 {
895     MemTxResult result;
896     uint32_t dma_len;
897     uint32_t data;
898 
899     if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
900         aspeed_smc_error("invalid direction for DMA checksum");
901         return;
902     }
903 
904     if (s->regs[R_DMA_CTRL] & DMA_CTRL_CALIB) {
905         aspeed_smc_dma_calibration(s);
906     }
907 
908     dma_len = aspeed_smc_dma_len(s);
909 
910     while (dma_len) {
911         data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
912                                     MEMTXATTRS_UNSPECIFIED, &result);
913         if (result != MEMTX_OK) {
914             aspeed_smc_error("Flash read failed @%08x",
915                              s->regs[R_DMA_FLASH_ADDR]);
916             return;
917         }
918         trace_aspeed_smc_dma_checksum(s->regs[R_DMA_FLASH_ADDR], data);
919 
920         /*
921          * When the DMA is on-going, the DMA registers are updated
922          * with the current working addresses and length.
923          */
924         s->regs[R_DMA_CHECKSUM] += data;
925         s->regs[R_DMA_FLASH_ADDR] += 4;
926         dma_len -= 4;
927         s->regs[R_DMA_LEN] = dma_len;
928     }
929 
930     if (s->inject_failure && aspeed_smc_inject_read_failure(s)) {
931         s->regs[R_DMA_CHECKSUM] = 0xbadc0de;
932     }
933 
934 }
935 
936 static void aspeed_smc_dma_rw(AspeedSMCState *s)
937 {
938     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
939     uint64_t dma_dram_offset;
940     uint64_t dma_dram_addr;
941     MemTxResult result;
942     uint32_t dma_len;
943     uint32_t data;
944 
945     dma_len = aspeed_smc_dma_len(s);
946     dma_dram_addr = aspeed_smc_dma_dram_addr(s);
947 
948     if (aspeed_smc_has_dma64(asc)) {
949         dma_dram_offset = dma_dram_addr - s->dram_base;
950     } else {
951         dma_dram_offset = dma_dram_addr;
952     }
953 
954     trace_aspeed_smc_dma_rw(s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE ?
955                             "write" : "read",
956                             s->regs[R_DMA_FLASH_ADDR],
957                             dma_dram_offset,
958                             dma_len);
959     while (dma_len) {
960         if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
961             data = address_space_ldl_le(&s->dram_as, dma_dram_offset,
962                                         MEMTXATTRS_UNSPECIFIED, &result);
963             if (result != MEMTX_OK) {
964                 aspeed_smc_error("DRAM read failed @%" PRIx64,
965                                  dma_dram_offset);
966                 return;
967             }
968 
969             address_space_stl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
970                                  data, MEMTXATTRS_UNSPECIFIED, &result);
971             if (result != MEMTX_OK) {
972                 aspeed_smc_error("Flash write failed @%08x",
973                                  s->regs[R_DMA_FLASH_ADDR]);
974                 return;
975             }
976         } else {
977             data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
978                                         MEMTXATTRS_UNSPECIFIED, &result);
979             if (result != MEMTX_OK) {
980                 aspeed_smc_error("Flash read failed @%08x",
981                                  s->regs[R_DMA_FLASH_ADDR]);
982                 return;
983             }
984 
985             address_space_stl_le(&s->dram_as, dma_dram_offset,
986                                  data, MEMTXATTRS_UNSPECIFIED, &result);
987             if (result != MEMTX_OK) {
988                 aspeed_smc_error("DRAM write failed @%" PRIx64,
989                                  dma_dram_offset);
990                 return;
991             }
992         }
993 
994         /*
995          * When the DMA is on-going, the DMA registers are updated
996          * with the current working addresses and length.
997          */
998         dma_dram_offset += 4;
999         dma_dram_addr += 4;
1000 
1001         s->regs[R_DMA_DRAM_ADDR_HIGH] = dma_dram_addr >> 32;
1002         s->regs[R_DMA_DRAM_ADDR] = dma_dram_addr & 0xffffffff;
1003         s->regs[R_DMA_FLASH_ADDR] += 4;
1004         dma_len -= 4;
1005         s->regs[R_DMA_LEN] = dma_len;
1006         s->regs[R_DMA_CHECKSUM] += data;
1007     }
1008 }
1009 
1010 static void aspeed_smc_dma_stop(AspeedSMCState *s)
1011 {
1012     /*
1013      * When the DMA is disabled, INTR_CTRL_DMA_STATUS=0 means the
1014      * engine is idle
1015      */
1016     s->regs[R_INTR_CTRL] &= ~INTR_CTRL_DMA_STATUS;
1017     s->regs[R_DMA_CHECKSUM] = 0;
1018 
1019     /*
1020      * Lower the DMA irq in any case. The IRQ control register could
1021      * have been cleared before disabling the DMA.
1022      */
1023     qemu_irq_lower(s->irq);
1024 }
1025 
1026 /*
1027  * When INTR_CTRL_DMA_STATUS=1, the DMA has completed and a new DMA
1028  * can start even if the result of the previous was not collected.
1029  */
1030 static bool aspeed_smc_dma_in_progress(AspeedSMCState *s)
1031 {
1032     return s->regs[R_DMA_CTRL] & DMA_CTRL_ENABLE &&
1033         !(s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_STATUS);
1034 }
1035 
1036 static void aspeed_smc_dma_done(AspeedSMCState *s)
1037 {
1038     s->regs[R_INTR_CTRL] |= INTR_CTRL_DMA_STATUS;
1039     if (s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_EN) {
1040         qemu_irq_raise(s->irq);
1041     }
1042 }
1043 
1044 static void aspeed_smc_dma_ctrl(AspeedSMCState *s, uint32_t dma_ctrl)
1045 {
1046     if (!(dma_ctrl & DMA_CTRL_ENABLE)) {
1047         s->regs[R_DMA_CTRL] = dma_ctrl;
1048 
1049         aspeed_smc_dma_stop(s);
1050         return;
1051     }
1052 
1053     if (aspeed_smc_dma_in_progress(s)) {
1054         aspeed_smc_error("DMA in progress !");
1055         return;
1056     }
1057 
1058     s->regs[R_DMA_CTRL] = dma_ctrl;
1059 
1060     if (s->regs[R_DMA_CTRL] & DMA_CTRL_CKSUM) {
1061         aspeed_smc_dma_checksum(s);
1062     } else {
1063         aspeed_smc_dma_rw(s);
1064     }
1065 
1066     aspeed_smc_dma_done(s);
1067 }
1068 
1069 static inline bool aspeed_smc_dma_granted(AspeedSMCState *s)
1070 {
1071     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1072 
1073     if (!(asc->features & ASPEED_SMC_FEATURE_DMA_GRANT)) {
1074         return true;
1075     }
1076 
1077     if (!(s->regs[R_DMA_CTRL] & DMA_CTRL_GRANT)) {
1078         aspeed_smc_error("DMA not granted");
1079         return false;
1080     }
1081 
1082     return true;
1083 }
1084 
1085 static void aspeed_2600_smc_dma_ctrl(AspeedSMCState *s, uint32_t dma_ctrl)
1086 {
1087     /* Preserve DMA bits  */
1088     dma_ctrl |= s->regs[R_DMA_CTRL] & (DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1089 
1090     if (dma_ctrl == 0xAEED0000) {
1091         /* automatically grant request */
1092         s->regs[R_DMA_CTRL] |= (DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1093         return;
1094     }
1095 
1096     /* clear request */
1097     if (dma_ctrl == 0xDEEA0000) {
1098         s->regs[R_DMA_CTRL] &= ~(DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1099         return;
1100     }
1101 
1102     if (!aspeed_smc_dma_granted(s)) {
1103         aspeed_smc_error("DMA not granted");
1104         return;
1105     }
1106 
1107     aspeed_smc_dma_ctrl(s, dma_ctrl);
1108     s->regs[R_DMA_CTRL] &= ~(DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1109 }
1110 
1111 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
1112                              unsigned int size)
1113 {
1114     AspeedSMCState *s = ASPEED_SMC(opaque);
1115     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1116     uint32_t value = data;
1117 
1118     trace_aspeed_smc_write(addr, size, data);
1119 
1120     addr >>= 2;
1121 
1122     if (addr == s->r_conf ||
1123         (addr >= s->r_timings &&
1124          addr < s->r_timings + asc->nregs_timings) ||
1125         addr == s->r_ce_ctrl) {
1126         s->regs[addr] = value;
1127     } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + asc->cs_num_max) {
1128         int cs = addr - s->r_ctrl0;
1129         aspeed_smc_flash_update_ctrl(&s->flashes[cs], value);
1130     } else if (addr >= R_SEG_ADDR0 &&
1131                addr < R_SEG_ADDR0 + asc->cs_num_max) {
1132         int cs = addr - R_SEG_ADDR0;
1133 
1134         if (value != s->regs[R_SEG_ADDR0 + cs]) {
1135             aspeed_smc_flash_set_segment(s, cs, value);
1136         }
1137     } else if (addr == R_CE_CMD_CTRL) {
1138         s->regs[addr] = value & 0xff;
1139     } else if (addr == R_DUMMY_DATA) {
1140         s->regs[addr] = value & 0xff;
1141     } else if (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_CTRL) {
1142         s->regs[addr] = value & FMC_WDT2_CTRL_EN;
1143     } else if (addr == R_INTR_CTRL) {
1144         s->regs[addr] = value;
1145     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_CTRL) {
1146         asc->dma_ctrl(s, value);
1147     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_DRAM_ADDR &&
1148                aspeed_smc_dma_granted(s)) {
1149         s->regs[addr] = DMA_DRAM_ADDR(asc, value);
1150     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_FLASH_ADDR &&
1151                aspeed_smc_dma_granted(s)) {
1152         s->regs[addr] = DMA_FLASH_ADDR(asc, value);
1153     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_LEN &&
1154                aspeed_smc_dma_granted(s)) {
1155         s->regs[addr] = DMA_LENGTH(value);
1156     } else if (aspeed_smc_has_dma(asc) && aspeed_smc_has_dma64(asc) &&
1157                addr == R_DMA_DRAM_ADDR_HIGH) {
1158         s->regs[addr] = DMA_DRAM_ADDR_HIGH(value);
1159     } else {
1160         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
1161                       __func__, addr);
1162         return;
1163     }
1164 }
1165 
1166 static const MemoryRegionOps aspeed_smc_ops = {
1167     .read = aspeed_smc_read,
1168     .write = aspeed_smc_write,
1169     .endianness = DEVICE_LITTLE_ENDIAN,
1170 };
1171 
1172 static void aspeed_smc_instance_init(Object *obj)
1173 {
1174     AspeedSMCState *s = ASPEED_SMC(obj);
1175     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1176     int i;
1177 
1178     for (i = 0; i < asc->cs_num_max; i++) {
1179         object_initialize_child(obj, "flash[*]", &s->flashes[i],
1180                                 TYPE_ASPEED_SMC_FLASH);
1181     }
1182 }
1183 
1184 /*
1185  * Initialize the custom address spaces for DMAs
1186  */
1187 static void aspeed_smc_dma_setup(AspeedSMCState *s, Error **errp)
1188 {
1189     if (!s->dram_mr) {
1190         error_setg(errp, TYPE_ASPEED_SMC ": 'dram' link not set");
1191         return;
1192     }
1193 
1194     address_space_init(&s->flash_as, &s->mmio_flash,
1195                        TYPE_ASPEED_SMC ".dma-flash");
1196     address_space_init(&s->dram_as, s->dram_mr,
1197                        TYPE_ASPEED_SMC ".dma-dram");
1198 }
1199 
1200 static void aspeed_smc_realize(DeviceState *dev, Error **errp)
1201 {
1202     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1203     AspeedSMCState *s = ASPEED_SMC(dev);
1204     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1205     int i;
1206     hwaddr offset = 0;
1207 
1208     /* keep a copy under AspeedSMCState to speed up accesses */
1209     s->r_conf = asc->r_conf;
1210     s->r_ce_ctrl = asc->r_ce_ctrl;
1211     s->r_ctrl0 = asc->r_ctrl0;
1212     s->r_timings = asc->r_timings;
1213     s->conf_enable_w0 = asc->conf_enable_w0;
1214 
1215     /* DMA irq. Keep it first for the initialization in the SoC */
1216     sysbus_init_irq(sbd, &s->irq);
1217 
1218     s->spi = ssi_create_bus(dev, NULL);
1219 
1220     /* Setup cs_lines for peripherals */
1221     s->cs_lines = g_new0(qemu_irq, asc->cs_num_max);
1222     qdev_init_gpio_out_named(DEVICE(s), s->cs_lines, "cs", asc->cs_num_max);
1223 
1224     /* The memory region for the controller registers */
1225     memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s,
1226                           TYPE_ASPEED_SMC, asc->nregs * 4);
1227     sysbus_init_mmio(sbd, &s->mmio);
1228 
1229     /*
1230      * The container memory region representing the address space
1231      * window in which the flash modules are mapped. The size and
1232      * address depends on the SoC model and controller type.
1233      */
1234     memory_region_init(&s->mmio_flash_container, OBJECT(s),
1235                        TYPE_ASPEED_SMC ".container",
1236                        asc->flash_window_size);
1237     sysbus_init_mmio(sbd, &s->mmio_flash_container);
1238 
1239     memory_region_init_io(&s->mmio_flash, OBJECT(s),
1240                           &aspeed_smc_flash_default_ops, s,
1241                           TYPE_ASPEED_SMC ".flash",
1242                           asc->flash_window_size);
1243     memory_region_add_subregion(&s->mmio_flash_container, 0x0,
1244                                 &s->mmio_flash);
1245 
1246     /*
1247      * Let's create a sub memory region for each possible peripheral. All
1248      * have a configurable memory segment in the overall flash mapping
1249      * window of the controller but, there is not necessarily a flash
1250      * module behind to handle the memory accesses. This depends on
1251      * the board configuration.
1252      */
1253     for (i = 0; i < asc->cs_num_max; ++i) {
1254         AspeedSMCFlash *fl = &s->flashes[i];
1255 
1256         if (!object_property_set_link(OBJECT(fl), "controller", OBJECT(s),
1257                                       errp)) {
1258             return;
1259         }
1260         if (!object_property_set_uint(OBJECT(fl), "cs", i, errp)) {
1261             return;
1262         }
1263         if (!sysbus_realize(SYS_BUS_DEVICE(fl), errp)) {
1264             return;
1265         }
1266 
1267         memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio);
1268         offset += asc->segments[i].size;
1269     }
1270 
1271     /* DMA support */
1272     if (aspeed_smc_has_dma(asc)) {
1273         aspeed_smc_dma_setup(s, errp);
1274     }
1275 }
1276 
1277 static const VMStateDescription vmstate_aspeed_smc = {
1278     .name = "aspeed.smc",
1279     .version_id = 3,
1280     .minimum_version_id = 2,
1281     .fields = (const VMStateField[]) {
1282         VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX),
1283         VMSTATE_UINT8(snoop_index, AspeedSMCState),
1284         VMSTATE_UINT8(snoop_dummies, AspeedSMCState),
1285         VMSTATE_BOOL_V(unselect, AspeedSMCState, 3),
1286         VMSTATE_END_OF_LIST()
1287     }
1288 };
1289 
1290 static Property aspeed_smc_properties[] = {
1291     DEFINE_PROP_BOOL("inject-failure", AspeedSMCState, inject_failure, false),
1292     DEFINE_PROP_UINT64("dram-base", AspeedSMCState, dram_base, 0),
1293     DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
1294                      TYPE_MEMORY_REGION, MemoryRegion *),
1295     DEFINE_PROP_END_OF_LIST(),
1296 };
1297 
1298 static void aspeed_smc_class_init(ObjectClass *klass, void *data)
1299 {
1300     DeviceClass *dc = DEVICE_CLASS(klass);
1301 
1302     dc->realize = aspeed_smc_realize;
1303     device_class_set_legacy_reset(dc, aspeed_smc_reset);
1304     device_class_set_props(dc, aspeed_smc_properties);
1305     dc->vmsd = &vmstate_aspeed_smc;
1306 }
1307 
1308 static const TypeInfo aspeed_smc_info = {
1309     .name           = TYPE_ASPEED_SMC,
1310     .parent         = TYPE_SYS_BUS_DEVICE,
1311     .instance_init  = aspeed_smc_instance_init,
1312     .instance_size  = sizeof(AspeedSMCState),
1313     .class_size     = sizeof(AspeedSMCClass),
1314     .class_init     = aspeed_smc_class_init,
1315     .abstract       = true,
1316 };
1317 
1318 static void aspeed_smc_flash_realize(DeviceState *dev, Error **errp)
1319 {
1320     AspeedSMCFlash *s = ASPEED_SMC_FLASH(dev);
1321     g_autofree char *name = g_strdup_printf(TYPE_ASPEED_SMC_FLASH ".%d", s->cs);
1322 
1323     if (!s->controller) {
1324         error_setg(errp, TYPE_ASPEED_SMC_FLASH ": 'controller' link not set");
1325         return;
1326     }
1327 
1328     s->asc = ASPEED_SMC_GET_CLASS(s->controller);
1329 
1330     /*
1331      * Use the default segment value to size the memory region. This
1332      * can be changed by FW at runtime.
1333      */
1334     memory_region_init_io(&s->mmio, OBJECT(s), s->asc->reg_ops,
1335                           s, name, s->asc->segments[s->cs].size);
1336     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
1337 }
1338 
1339 static Property aspeed_smc_flash_properties[] = {
1340     DEFINE_PROP_UINT8("cs", AspeedSMCFlash, cs, 0),
1341     DEFINE_PROP_LINK("controller", AspeedSMCFlash, controller, TYPE_ASPEED_SMC,
1342                      AspeedSMCState *),
1343     DEFINE_PROP_END_OF_LIST(),
1344 };
1345 
1346 static void aspeed_smc_flash_class_init(ObjectClass *klass, void *data)
1347 {
1348     DeviceClass *dc = DEVICE_CLASS(klass);
1349 
1350     dc->desc = "Aspeed SMC Flash device region";
1351     dc->realize = aspeed_smc_flash_realize;
1352     device_class_set_props(dc, aspeed_smc_flash_properties);
1353 }
1354 
1355 static const TypeInfo aspeed_smc_flash_info = {
1356     .name           = TYPE_ASPEED_SMC_FLASH,
1357     .parent         = TYPE_SYS_BUS_DEVICE,
1358     .instance_size  = sizeof(AspeedSMCFlash),
1359     .class_init     = aspeed_smc_flash_class_init,
1360 };
1361 
1362 /*
1363  * The Segment Registers of the AST2400 and AST2500 have a 8MB
1364  * unit. The address range of a flash SPI peripheral is encoded with
1365  * absolute addresses which should be part of the overall controller
1366  * window.
1367  */
1368 static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s,
1369                                           const AspeedSegments *seg)
1370 {
1371     uint32_t reg = 0;
1372     reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT;
1373     reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT;
1374     return reg;
1375 }
1376 
1377 static void aspeed_smc_reg_to_segment(const AspeedSMCState *s,
1378                                       uint32_t reg, AspeedSegments *seg)
1379 {
1380     seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23;
1381     seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr;
1382 }
1383 
1384 static const AspeedSegments aspeed_2400_smc_segments[] = {
1385     { 0x10000000, 32 * MiB },
1386 };
1387 
1388 static void aspeed_2400_smc_class_init(ObjectClass *klass, void *data)
1389 {
1390     DeviceClass *dc = DEVICE_CLASS(klass);
1391     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1392 
1393     dc->desc               = "Aspeed 2400 SMC Controller";
1394     asc->r_conf            = R_CONF;
1395     asc->r_ce_ctrl         = R_CE_CTRL;
1396     asc->r_ctrl0           = R_CTRL0;
1397     asc->r_timings         = R_TIMINGS;
1398     asc->nregs_timings     = 1;
1399     asc->conf_enable_w0    = CONF_ENABLE_W0;
1400     asc->cs_num_max        = 1;
1401     asc->segments          = aspeed_2400_smc_segments;
1402     asc->flash_window_base = 0x10000000;
1403     asc->flash_window_size = 0x6000000;
1404     asc->features          = 0x0;
1405     asc->nregs             = ASPEED_SMC_R_SMC_MAX;
1406     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1407     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1408     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1409     asc->reg_ops           = &aspeed_smc_flash_ops;
1410 }
1411 
1412 static const TypeInfo aspeed_2400_smc_info = {
1413     .name =  "aspeed.smc-ast2400",
1414     .parent = TYPE_ASPEED_SMC,
1415     .class_init = aspeed_2400_smc_class_init,
1416 };
1417 
1418 static const uint32_t aspeed_2400_fmc_resets[ASPEED_SMC_R_MAX] = {
1419     /*
1420      * CE0 and CE1 types are HW strapped in SCU70. Do it here to
1421      * simplify the model.
1422      */
1423     [R_CONF] = CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0,
1424 };
1425 
1426 static const AspeedSegments aspeed_2400_fmc_segments[] = {
1427     { 0x20000000, 64 * MiB }, /* start address is readonly */
1428     { 0x24000000, 32 * MiB },
1429     { 0x26000000, 32 * MiB },
1430     { 0x28000000, 32 * MiB },
1431     { 0x2A000000, 32 * MiB }
1432 };
1433 
1434 static void aspeed_2400_fmc_class_init(ObjectClass *klass, void *data)
1435 {
1436     DeviceClass *dc = DEVICE_CLASS(klass);
1437     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1438 
1439     dc->desc               = "Aspeed 2400 FMC Controller";
1440     asc->r_conf            = R_CONF;
1441     asc->r_ce_ctrl         = R_CE_CTRL;
1442     asc->r_ctrl0           = R_CTRL0;
1443     asc->r_timings         = R_TIMINGS;
1444     asc->nregs_timings     = 1;
1445     asc->conf_enable_w0    = CONF_ENABLE_W0;
1446     asc->cs_num_max        = 5;
1447     asc->segments          = aspeed_2400_fmc_segments;
1448     asc->segment_addr_mask = 0xffff0000;
1449     asc->resets            = aspeed_2400_fmc_resets;
1450     asc->flash_window_base = 0x20000000;
1451     asc->flash_window_size = 0x10000000;
1452     asc->features          = ASPEED_SMC_FEATURE_DMA;
1453     asc->dma_flash_mask    = 0x0FFFFFFC;
1454     asc->dma_dram_mask     = 0x1FFFFFFC;
1455     asc->dma_start_length  = 4;
1456     asc->nregs             = ASPEED_SMC_R_MAX;
1457     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1458     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1459     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1460     asc->reg_ops           = &aspeed_smc_flash_ops;
1461 }
1462 
1463 static const TypeInfo aspeed_2400_fmc_info = {
1464     .name =  "aspeed.fmc-ast2400",
1465     .parent = TYPE_ASPEED_SMC,
1466     .class_init = aspeed_2400_fmc_class_init,
1467 };
1468 
1469 static const AspeedSegments aspeed_2400_spi1_segments[] = {
1470     { 0x30000000, 64 * MiB },
1471 };
1472 
1473 static int aspeed_2400_spi1_addr_width(const AspeedSMCState *s)
1474 {
1475     return s->regs[R_SPI_CTRL0] & CTRL_AST2400_SPI_4BYTE ? 4 : 3;
1476 }
1477 
1478 static void aspeed_2400_spi1_class_init(ObjectClass *klass, void *data)
1479 {
1480     DeviceClass *dc = DEVICE_CLASS(klass);
1481     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1482 
1483     dc->desc               = "Aspeed 2400 SPI1 Controller";
1484     asc->r_conf            = R_SPI_CONF;
1485     asc->r_ce_ctrl         = 0xff;
1486     asc->r_ctrl0           = R_SPI_CTRL0;
1487     asc->r_timings         = R_SPI_TIMINGS;
1488     asc->nregs_timings     = 1;
1489     asc->conf_enable_w0    = SPI_CONF_ENABLE_W0;
1490     asc->cs_num_max        = 1;
1491     asc->segments          = aspeed_2400_spi1_segments;
1492     asc->flash_window_base = 0x30000000;
1493     asc->flash_window_size = 0x10000000;
1494     asc->features          = 0x0;
1495     asc->nregs             = ASPEED_SMC_R_SPI_MAX;
1496     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1497     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1498     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1499     asc->addr_width        = aspeed_2400_spi1_addr_width;
1500     asc->reg_ops           = &aspeed_smc_flash_ops;
1501 }
1502 
1503 static const TypeInfo aspeed_2400_spi1_info = {
1504     .name =  "aspeed.spi1-ast2400",
1505     .parent = TYPE_ASPEED_SMC,
1506     .class_init = aspeed_2400_spi1_class_init,
1507 };
1508 
1509 static const uint32_t aspeed_2500_fmc_resets[ASPEED_SMC_R_MAX] = {
1510     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1511                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
1512 };
1513 
1514 static const AspeedSegments aspeed_2500_fmc_segments[] = {
1515     { 0x20000000, 128 * MiB }, /* start address is readonly */
1516     { 0x28000000,  32 * MiB },
1517     { 0x2A000000,  32 * MiB },
1518 };
1519 
1520 static void aspeed_2500_fmc_class_init(ObjectClass *klass, void *data)
1521 {
1522     DeviceClass *dc = DEVICE_CLASS(klass);
1523     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1524 
1525     dc->desc               = "Aspeed 2500 FMC Controller";
1526     asc->r_conf            = R_CONF;
1527     asc->r_ce_ctrl         = R_CE_CTRL;
1528     asc->r_ctrl0           = R_CTRL0;
1529     asc->r_timings         = R_TIMINGS;
1530     asc->nregs_timings     = 1;
1531     asc->conf_enable_w0    = CONF_ENABLE_W0;
1532     asc->cs_num_max        = 3;
1533     asc->segments          = aspeed_2500_fmc_segments;
1534     asc->segment_addr_mask = 0xffff0000;
1535     asc->resets            = aspeed_2500_fmc_resets;
1536     asc->flash_window_base = 0x20000000;
1537     asc->flash_window_size = 0x10000000;
1538     asc->features          = ASPEED_SMC_FEATURE_DMA;
1539     asc->dma_flash_mask    = 0x0FFFFFFC;
1540     asc->dma_dram_mask     = 0x3FFFFFFC;
1541     asc->dma_start_length  = 4;
1542     asc->nregs             = ASPEED_SMC_R_MAX;
1543     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1544     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1545     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1546     asc->reg_ops           = &aspeed_smc_flash_ops;
1547 }
1548 
1549 static const TypeInfo aspeed_2500_fmc_info = {
1550     .name =  "aspeed.fmc-ast2500",
1551     .parent = TYPE_ASPEED_SMC,
1552     .class_init = aspeed_2500_fmc_class_init,
1553 };
1554 
1555 static const AspeedSegments aspeed_2500_spi1_segments[] = {
1556     { 0x30000000, 32 * MiB }, /* start address is readonly */
1557     { 0x32000000, 96 * MiB }, /* end address is readonly */
1558 };
1559 
1560 static void aspeed_2500_spi1_class_init(ObjectClass *klass, void *data)
1561 {
1562     DeviceClass *dc = DEVICE_CLASS(klass);
1563     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1564 
1565     dc->desc               = "Aspeed 2500 SPI1 Controller";
1566     asc->r_conf            = R_CONF;
1567     asc->r_ce_ctrl         = R_CE_CTRL;
1568     asc->r_ctrl0           = R_CTRL0;
1569     asc->r_timings         = R_TIMINGS;
1570     asc->nregs_timings     = 1;
1571     asc->conf_enable_w0    = CONF_ENABLE_W0;
1572     asc->cs_num_max        = 2;
1573     asc->segments          = aspeed_2500_spi1_segments;
1574     asc->segment_addr_mask = 0xffff0000;
1575     asc->flash_window_base = 0x30000000;
1576     asc->flash_window_size = 0x8000000;
1577     asc->features          = 0x0;
1578     asc->nregs             = ASPEED_SMC_R_MAX;
1579     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1580     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1581     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1582     asc->reg_ops           = &aspeed_smc_flash_ops;
1583 }
1584 
1585 static const TypeInfo aspeed_2500_spi1_info = {
1586     .name =  "aspeed.spi1-ast2500",
1587     .parent = TYPE_ASPEED_SMC,
1588     .class_init = aspeed_2500_spi1_class_init,
1589 };
1590 
1591 static const AspeedSegments aspeed_2500_spi2_segments[] = {
1592     { 0x38000000, 32 * MiB }, /* start address is readonly */
1593     { 0x3A000000, 96 * MiB }, /* end address is readonly */
1594 };
1595 
1596 static void aspeed_2500_spi2_class_init(ObjectClass *klass, void *data)
1597 {
1598     DeviceClass *dc = DEVICE_CLASS(klass);
1599     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1600 
1601     dc->desc               = "Aspeed 2500 SPI2 Controller";
1602     asc->r_conf            = R_CONF;
1603     asc->r_ce_ctrl         = R_CE_CTRL;
1604     asc->r_ctrl0           = R_CTRL0;
1605     asc->r_timings         = R_TIMINGS;
1606     asc->nregs_timings     = 1;
1607     asc->conf_enable_w0    = CONF_ENABLE_W0;
1608     asc->cs_num_max        = 2;
1609     asc->segments          = aspeed_2500_spi2_segments;
1610     asc->segment_addr_mask = 0xffff0000;
1611     asc->flash_window_base = 0x38000000;
1612     asc->flash_window_size = 0x8000000;
1613     asc->features          = 0x0;
1614     asc->nregs             = ASPEED_SMC_R_MAX;
1615     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1616     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1617     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1618     asc->reg_ops           = &aspeed_smc_flash_ops;
1619 }
1620 
1621 static const TypeInfo aspeed_2500_spi2_info = {
1622     .name =  "aspeed.spi2-ast2500",
1623     .parent = TYPE_ASPEED_SMC,
1624     .class_init = aspeed_2500_spi2_class_init,
1625 };
1626 
1627 /*
1628  * The Segment Registers of the AST2600 have a 1MB unit. The address
1629  * range of a flash SPI peripheral is encoded with offsets in the overall
1630  * controller window. The previous SoC AST2400 and AST2500 used
1631  * absolute addresses. Only bits [27:20] are relevant and the end
1632  * address is an upper bound limit.
1633  */
1634 #define AST2600_SEG_ADDR_MASK 0x0ff00000
1635 
1636 static uint32_t aspeed_2600_smc_segment_to_reg(const AspeedSMCState *s,
1637                                                const AspeedSegments *seg)
1638 {
1639     uint32_t reg = 0;
1640 
1641     /* Disabled segments have a nil register */
1642     if (!seg->size) {
1643         return 0;
1644     }
1645 
1646     reg |= (seg->addr & AST2600_SEG_ADDR_MASK) >> 16; /* start offset */
1647     reg |= (seg->addr + seg->size - 1) & AST2600_SEG_ADDR_MASK; /* end offset */
1648     return reg;
1649 }
1650 
1651 static void aspeed_2600_smc_reg_to_segment(const AspeedSMCState *s,
1652                                            uint32_t reg, AspeedSegments *seg)
1653 {
1654     uint32_t start_offset = (reg << 16) & AST2600_SEG_ADDR_MASK;
1655     uint32_t end_offset = reg & AST2600_SEG_ADDR_MASK;
1656     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1657 
1658     if (reg) {
1659         seg->addr = asc->flash_window_base + start_offset;
1660         seg->size = end_offset + MiB - start_offset;
1661     } else {
1662         seg->addr = asc->flash_window_base;
1663         seg->size = 0;
1664     }
1665 }
1666 
1667 static const uint32_t aspeed_2600_fmc_resets[ASPEED_SMC_R_MAX] = {
1668     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1669                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1 |
1670                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE2),
1671 };
1672 
1673 static const AspeedSegments aspeed_2600_fmc_segments[] = {
1674     { 0x0, 128 * MiB }, /* start address is readonly */
1675     { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
1676     { 0x0, 0 }, /* disabled */
1677 };
1678 
1679 static void aspeed_2600_fmc_class_init(ObjectClass *klass, void *data)
1680 {
1681     DeviceClass *dc = DEVICE_CLASS(klass);
1682     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1683 
1684     dc->desc               = "Aspeed 2600 FMC Controller";
1685     asc->r_conf            = R_CONF;
1686     asc->r_ce_ctrl         = R_CE_CTRL;
1687     asc->r_ctrl0           = R_CTRL0;
1688     asc->r_timings         = R_TIMINGS;
1689     asc->nregs_timings     = 1;
1690     asc->conf_enable_w0    = CONF_ENABLE_W0;
1691     asc->cs_num_max        = 3;
1692     asc->segments          = aspeed_2600_fmc_segments;
1693     asc->segment_addr_mask = 0x0ff00ff0;
1694     asc->resets            = aspeed_2600_fmc_resets;
1695     asc->flash_window_base = 0x20000000;
1696     asc->flash_window_size = 0x10000000;
1697     asc->features          = ASPEED_SMC_FEATURE_DMA |
1698                              ASPEED_SMC_FEATURE_WDT_CONTROL;
1699     asc->dma_flash_mask    = 0x0FFFFFFC;
1700     asc->dma_dram_mask     = 0x3FFFFFFC;
1701     asc->dma_start_length  = 1;
1702     asc->nregs             = ASPEED_SMC_R_MAX;
1703     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1704     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1705     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1706     asc->reg_ops           = &aspeed_smc_flash_ops;
1707 }
1708 
1709 static const TypeInfo aspeed_2600_fmc_info = {
1710     .name =  "aspeed.fmc-ast2600",
1711     .parent = TYPE_ASPEED_SMC,
1712     .class_init = aspeed_2600_fmc_class_init,
1713 };
1714 
1715 static const AspeedSegments aspeed_2600_spi1_segments[] = {
1716     { 0x0, 128 * MiB }, /* start address is readonly */
1717     { 0x0, 0 }, /* disabled */
1718 };
1719 
1720 static void aspeed_2600_spi1_class_init(ObjectClass *klass, void *data)
1721 {
1722     DeviceClass *dc = DEVICE_CLASS(klass);
1723     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1724 
1725     dc->desc               = "Aspeed 2600 SPI1 Controller";
1726     asc->r_conf            = R_CONF;
1727     asc->r_ce_ctrl         = R_CE_CTRL;
1728     asc->r_ctrl0           = R_CTRL0;
1729     asc->r_timings         = R_TIMINGS;
1730     asc->nregs_timings     = 2;
1731     asc->conf_enable_w0    = CONF_ENABLE_W0;
1732     asc->cs_num_max        = 2;
1733     asc->segments          = aspeed_2600_spi1_segments;
1734     asc->segment_addr_mask = 0x0ff00ff0;
1735     asc->flash_window_base = 0x30000000;
1736     asc->flash_window_size = 0x10000000;
1737     asc->features          = ASPEED_SMC_FEATURE_DMA |
1738                              ASPEED_SMC_FEATURE_DMA_GRANT;
1739     asc->dma_flash_mask    = 0x0FFFFFFC;
1740     asc->dma_dram_mask     = 0x3FFFFFFC;
1741     asc->dma_start_length  = 1;
1742     asc->nregs             = ASPEED_SMC_R_MAX;
1743     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1744     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1745     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1746     asc->reg_ops           = &aspeed_smc_flash_ops;
1747 }
1748 
1749 static const TypeInfo aspeed_2600_spi1_info = {
1750     .name =  "aspeed.spi1-ast2600",
1751     .parent = TYPE_ASPEED_SMC,
1752     .class_init = aspeed_2600_spi1_class_init,
1753 };
1754 
1755 static const AspeedSegments aspeed_2600_spi2_segments[] = {
1756     { 0x0, 128 * MiB }, /* start address is readonly */
1757     { 0x0, 0 }, /* disabled */
1758     { 0x0, 0 }, /* disabled */
1759 };
1760 
1761 static void aspeed_2600_spi2_class_init(ObjectClass *klass, void *data)
1762 {
1763     DeviceClass *dc = DEVICE_CLASS(klass);
1764     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1765 
1766     dc->desc               = "Aspeed 2600 SPI2 Controller";
1767     asc->r_conf            = R_CONF;
1768     asc->r_ce_ctrl         = R_CE_CTRL;
1769     asc->r_ctrl0           = R_CTRL0;
1770     asc->r_timings         = R_TIMINGS;
1771     asc->nregs_timings     = 3;
1772     asc->conf_enable_w0    = CONF_ENABLE_W0;
1773     asc->cs_num_max        = 3;
1774     asc->segments          = aspeed_2600_spi2_segments;
1775     asc->segment_addr_mask = 0x0ff00ff0;
1776     asc->flash_window_base = 0x50000000;
1777     asc->flash_window_size = 0x10000000;
1778     asc->features          = ASPEED_SMC_FEATURE_DMA |
1779                              ASPEED_SMC_FEATURE_DMA_GRANT;
1780     asc->dma_flash_mask    = 0x0FFFFFFC;
1781     asc->dma_dram_mask     = 0x3FFFFFFC;
1782     asc->dma_start_length  = 1;
1783     asc->nregs             = ASPEED_SMC_R_MAX;
1784     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1785     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1786     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1787     asc->reg_ops           = &aspeed_smc_flash_ops;
1788 }
1789 
1790 static const TypeInfo aspeed_2600_spi2_info = {
1791     .name =  "aspeed.spi2-ast2600",
1792     .parent = TYPE_ASPEED_SMC,
1793     .class_init = aspeed_2600_spi2_class_init,
1794 };
1795 
1796 /*
1797  * The FMC Segment Registers of the AST1030 have a 512KB unit.
1798  * Only bits [27:19] are used for decoding.
1799  */
1800 #define AST1030_SEG_ADDR_MASK 0x0ff80000
1801 
1802 static uint32_t aspeed_1030_smc_segment_to_reg(const AspeedSMCState *s,
1803         const AspeedSegments *seg)
1804 {
1805     uint32_t reg = 0;
1806 
1807     /* Disabled segments have a nil register */
1808     if (!seg->size) {
1809         return 0;
1810     }
1811 
1812     reg |= (seg->addr & AST1030_SEG_ADDR_MASK) >> 16; /* start offset */
1813     reg |= (seg->addr + seg->size - 1) & AST1030_SEG_ADDR_MASK; /* end offset */
1814     return reg;
1815 }
1816 
1817 static void aspeed_1030_smc_reg_to_segment(const AspeedSMCState *s,
1818         uint32_t reg, AspeedSegments *seg)
1819 {
1820     uint32_t start_offset = (reg << 16) & AST1030_SEG_ADDR_MASK;
1821     uint32_t end_offset = reg & AST1030_SEG_ADDR_MASK;
1822     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1823 
1824     if (reg) {
1825         seg->addr = asc->flash_window_base + start_offset;
1826         seg->size = end_offset + (512 * KiB) - start_offset;
1827     } else {
1828         seg->addr = asc->flash_window_base;
1829         seg->size = 0;
1830     }
1831 }
1832 
1833 static const uint32_t aspeed_1030_fmc_resets[ASPEED_SMC_R_MAX] = {
1834     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1835                             CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
1836 };
1837 
1838 static const AspeedSegments aspeed_1030_fmc_segments[] = {
1839     { 0x0, 128 * MiB }, /* start address is readonly */
1840     { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
1841     { 0x0, 0 }, /* disabled */
1842 };
1843 
1844 static void aspeed_1030_fmc_class_init(ObjectClass *klass, void *data)
1845 {
1846     DeviceClass *dc = DEVICE_CLASS(klass);
1847     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1848 
1849     dc->desc               = "Aspeed 1030 FMC Controller";
1850     asc->r_conf            = R_CONF;
1851     asc->r_ce_ctrl         = R_CE_CTRL;
1852     asc->r_ctrl0           = R_CTRL0;
1853     asc->r_timings         = R_TIMINGS;
1854     asc->nregs_timings     = 2;
1855     asc->conf_enable_w0    = CONF_ENABLE_W0;
1856     asc->cs_num_max        = 2;
1857     asc->segments          = aspeed_1030_fmc_segments;
1858     asc->segment_addr_mask = 0x0ff80ff8;
1859     asc->resets            = aspeed_1030_fmc_resets;
1860     asc->flash_window_base = 0x80000000;
1861     asc->flash_window_size = 0x10000000;
1862     asc->features          = ASPEED_SMC_FEATURE_DMA;
1863     asc->dma_flash_mask    = 0x0FFFFFFC;
1864     asc->dma_dram_mask     = 0x000BFFFC;
1865     asc->dma_start_length  = 1;
1866     asc->nregs             = ASPEED_SMC_R_MAX;
1867     asc->segment_to_reg    = aspeed_1030_smc_segment_to_reg;
1868     asc->reg_to_segment    = aspeed_1030_smc_reg_to_segment;
1869     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1870     asc->reg_ops           = &aspeed_smc_flash_ops;
1871 }
1872 
1873 static const TypeInfo aspeed_1030_fmc_info = {
1874     .name =  "aspeed.fmc-ast1030",
1875     .parent = TYPE_ASPEED_SMC,
1876     .class_init = aspeed_1030_fmc_class_init,
1877 };
1878 
1879 static const AspeedSegments aspeed_1030_spi1_segments[] = {
1880     { 0x0, 128 * MiB }, /* start address is readonly */
1881     { 0x0, 0 }, /* disabled */
1882 };
1883 
1884 static void aspeed_1030_spi1_class_init(ObjectClass *klass, void *data)
1885 {
1886     DeviceClass *dc = DEVICE_CLASS(klass);
1887     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1888 
1889     dc->desc               = "Aspeed 1030 SPI1 Controller";
1890     asc->r_conf            = R_CONF;
1891     asc->r_ce_ctrl         = R_CE_CTRL;
1892     asc->r_ctrl0           = R_CTRL0;
1893     asc->r_timings         = R_TIMINGS;
1894     asc->nregs_timings     = 2;
1895     asc->conf_enable_w0    = CONF_ENABLE_W0;
1896     asc->cs_num_max        = 2;
1897     asc->segments          = aspeed_1030_spi1_segments;
1898     asc->segment_addr_mask = 0x0ff00ff0;
1899     asc->flash_window_base = 0x90000000;
1900     asc->flash_window_size = 0x10000000;
1901     asc->features          = ASPEED_SMC_FEATURE_DMA;
1902     asc->dma_flash_mask    = 0x0FFFFFFC;
1903     asc->dma_dram_mask     = 0x000BFFFC;
1904     asc->dma_start_length  = 1;
1905     asc->nregs             = ASPEED_SMC_R_MAX;
1906     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1907     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1908     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1909     asc->reg_ops           = &aspeed_smc_flash_ops;
1910 }
1911 
1912 static const TypeInfo aspeed_1030_spi1_info = {
1913     .name =  "aspeed.spi1-ast1030",
1914     .parent = TYPE_ASPEED_SMC,
1915     .class_init = aspeed_1030_spi1_class_init,
1916 };
1917 static const AspeedSegments aspeed_1030_spi2_segments[] = {
1918     { 0x0, 128 * MiB }, /* start address is readonly */
1919     { 0x0, 0 }, /* disabled */
1920 };
1921 
1922 static void aspeed_1030_spi2_class_init(ObjectClass *klass, void *data)
1923 {
1924     DeviceClass *dc = DEVICE_CLASS(klass);
1925     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1926 
1927     dc->desc               = "Aspeed 1030 SPI2 Controller";
1928     asc->r_conf            = R_CONF;
1929     asc->r_ce_ctrl         = R_CE_CTRL;
1930     asc->r_ctrl0           = R_CTRL0;
1931     asc->r_timings         = R_TIMINGS;
1932     asc->nregs_timings     = 2;
1933     asc->conf_enable_w0    = CONF_ENABLE_W0;
1934     asc->cs_num_max        = 2;
1935     asc->segments          = aspeed_1030_spi2_segments;
1936     asc->segment_addr_mask = 0x0ff00ff0;
1937     asc->flash_window_base = 0xb0000000;
1938     asc->flash_window_size = 0x10000000;
1939     asc->features          = ASPEED_SMC_FEATURE_DMA;
1940     asc->dma_flash_mask    = 0x0FFFFFFC;
1941     asc->dma_dram_mask     = 0x000BFFFC;
1942     asc->dma_start_length  = 1;
1943     asc->nregs             = ASPEED_SMC_R_MAX;
1944     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1945     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1946     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1947     asc->reg_ops           = &aspeed_smc_flash_ops;
1948 }
1949 
1950 static const TypeInfo aspeed_1030_spi2_info = {
1951     .name =  "aspeed.spi2-ast1030",
1952     .parent = TYPE_ASPEED_SMC,
1953     .class_init = aspeed_1030_spi2_class_init,
1954 };
1955 
1956 /*
1957  * The FMC Segment Registers of the AST2700 have a 64KB unit.
1958  * Only bits [31:16] are used for decoding.
1959  */
1960 #define AST2700_SEG_ADDR_MASK 0xffff0000
1961 
1962 static uint32_t aspeed_2700_smc_segment_to_reg(const AspeedSMCState *s,
1963                                                const AspeedSegments *seg)
1964 {
1965     uint32_t reg = 0;
1966 
1967     /* Disabled segments have a nil register */
1968     if (!seg->size) {
1969         return 0;
1970     }
1971 
1972     reg |= (seg->addr & AST2700_SEG_ADDR_MASK) >> 16; /* start offset */
1973     reg |= (seg->addr + seg->size - 1) & AST2700_SEG_ADDR_MASK; /* end offset */
1974     return reg;
1975 }
1976 
1977 static void aspeed_2700_smc_reg_to_segment(const AspeedSMCState *s,
1978                                            uint32_t reg, AspeedSegments *seg)
1979 {
1980     uint32_t start_offset = (reg << 16) & AST2700_SEG_ADDR_MASK;
1981     uint32_t end_offset = reg & AST2700_SEG_ADDR_MASK;
1982     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1983 
1984     if (reg) {
1985         seg->addr = asc->flash_window_base + start_offset;
1986         seg->size = end_offset + (64 * KiB) - start_offset;
1987     } else {
1988         seg->addr = asc->flash_window_base;
1989         seg->size = 0;
1990     }
1991 }
1992 
1993 static const uint32_t aspeed_2700_fmc_resets[ASPEED_SMC_R_MAX] = {
1994     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1995             CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
1996     [R_CE_CTRL] = 0x0000aa00,
1997     [R_CTRL0] = 0x406b0641,
1998     [R_CTRL1] = 0x00000400,
1999     [R_CTRL2] = 0x00000400,
2000     [R_CTRL3] = 0x00000400,
2001     [R_SEG_ADDR0] = 0x08000000,
2002     [R_SEG_ADDR1] = 0x10000800,
2003     [R_SEG_ADDR2] = 0x00000000,
2004     [R_SEG_ADDR3] = 0x00000000,
2005     [R_DUMMY_DATA] = 0x00010000,
2006     [R_DMA_DRAM_ADDR_HIGH] = 0x00000000,
2007     [R_TIMINGS] = 0x007b0000,
2008 };
2009 
2010 static const MemoryRegionOps aspeed_2700_smc_flash_ops = {
2011     .read = aspeed_smc_flash_read,
2012     .write = aspeed_smc_flash_write,
2013     .endianness = DEVICE_LITTLE_ENDIAN,
2014     .valid = {
2015         .min_access_size = 1,
2016         .max_access_size = 8,
2017     },
2018 };
2019 
2020 static const AspeedSegments aspeed_2700_fmc_segments[] = {
2021     { 0x0, 128 * MiB }, /* start address is readonly */
2022     { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
2023     { 256 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
2024     { 0x0, 0 }, /* disabled */
2025 };
2026 
2027 static void aspeed_2700_fmc_class_init(ObjectClass *klass, void *data)
2028 {
2029     DeviceClass *dc = DEVICE_CLASS(klass);
2030     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2031 
2032     dc->desc               = "Aspeed 2700 FMC Controller";
2033     asc->r_conf            = R_CONF;
2034     asc->r_ce_ctrl         = R_CE_CTRL;
2035     asc->r_ctrl0           = R_CTRL0;
2036     asc->r_timings         = R_TIMINGS;
2037     asc->nregs_timings     = 3;
2038     asc->conf_enable_w0    = CONF_ENABLE_W0;
2039     asc->cs_num_max        = 3;
2040     asc->segments          = aspeed_2700_fmc_segments;
2041     asc->segment_addr_mask = 0xffffffff;
2042     asc->resets            = aspeed_2700_fmc_resets;
2043     asc->flash_window_base = 0x100000000;
2044     asc->flash_window_size = 1 * GiB;
2045     asc->features          = ASPEED_SMC_FEATURE_DMA |
2046                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2047     asc->dma_flash_mask    = 0x2FFFFFFC;
2048     asc->dma_dram_mask     = 0xFFFFFFFC;
2049     asc->dma_start_length  = 1;
2050     asc->nregs             = ASPEED_SMC_R_MAX;
2051     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2052     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2053     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2054     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2055 }
2056 
2057 static const TypeInfo aspeed_2700_fmc_info = {
2058     .name =  "aspeed.fmc-ast2700",
2059     .parent = TYPE_ASPEED_SMC,
2060     .class_init = aspeed_2700_fmc_class_init,
2061 };
2062 
2063 static const AspeedSegments aspeed_2700_spi0_segments[] = {
2064     { 0x0, 128 * MiB }, /* start address is readonly */
2065     { 128 * MiB, 128 * MiB }, /* start address is readonly */
2066     { 0x0, 0 }, /* disabled */
2067 };
2068 
2069 static void aspeed_2700_spi0_class_init(ObjectClass *klass, void *data)
2070 {
2071     DeviceClass *dc = DEVICE_CLASS(klass);
2072     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2073 
2074     dc->desc               = "Aspeed 2700 SPI0 Controller";
2075     asc->r_conf            = R_CONF;
2076     asc->r_ce_ctrl         = R_CE_CTRL;
2077     asc->r_ctrl0           = R_CTRL0;
2078     asc->r_timings         = R_TIMINGS;
2079     asc->nregs_timings     = 2;
2080     asc->conf_enable_w0    = CONF_ENABLE_W0;
2081     asc->cs_num_max        = 2;
2082     asc->segments          = aspeed_2700_spi0_segments;
2083     asc->segment_addr_mask = 0xffffffff;
2084     asc->flash_window_base = 0x180000000;
2085     asc->flash_window_size = 1 * GiB;
2086     asc->features          = ASPEED_SMC_FEATURE_DMA |
2087                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2088     asc->dma_flash_mask    = 0x2FFFFFFC;
2089     asc->dma_dram_mask     = 0xFFFFFFFC;
2090     asc->dma_start_length  = 1;
2091     asc->nregs             = ASPEED_SMC_R_MAX;
2092     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2093     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2094     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2095     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2096 }
2097 
2098 static const TypeInfo aspeed_2700_spi0_info = {
2099     .name =  "aspeed.spi0-ast2700",
2100     .parent = TYPE_ASPEED_SMC,
2101     .class_init = aspeed_2700_spi0_class_init,
2102 };
2103 
2104 static const AspeedSegments aspeed_2700_spi1_segments[] = {
2105     { 0x0, 128 * MiB }, /* start address is readonly */
2106     { 0x0, 0 }, /* disabled */
2107 };
2108 
2109 static void aspeed_2700_spi1_class_init(ObjectClass *klass, void *data)
2110 {
2111     DeviceClass *dc = DEVICE_CLASS(klass);
2112     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2113 
2114     dc->desc               = "Aspeed 2700 SPI1 Controller";
2115     asc->r_conf            = R_CONF;
2116     asc->r_ce_ctrl         = R_CE_CTRL;
2117     asc->r_ctrl0           = R_CTRL0;
2118     asc->r_timings         = R_TIMINGS;
2119     asc->nregs_timings     = 2;
2120     asc->conf_enable_w0    = CONF_ENABLE_W0;
2121     asc->cs_num_max        = 2;
2122     asc->segments          = aspeed_2700_spi1_segments;
2123     asc->segment_addr_mask = 0xffffffff;
2124     asc->flash_window_base = 0x200000000;
2125     asc->flash_window_size = 1 * GiB;
2126     asc->features          = ASPEED_SMC_FEATURE_DMA |
2127                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2128     asc->dma_flash_mask    = 0x2FFFFFFC;
2129     asc->dma_dram_mask     = 0xFFFFFFFC;
2130     asc->dma_start_length  = 1;
2131     asc->nregs             = ASPEED_SMC_R_MAX;
2132     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2133     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2134     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2135     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2136 }
2137 
2138 static const TypeInfo aspeed_2700_spi1_info = {
2139         .name =  "aspeed.spi1-ast2700",
2140         .parent = TYPE_ASPEED_SMC,
2141         .class_init = aspeed_2700_spi1_class_init,
2142 };
2143 
2144 static const AspeedSegments aspeed_2700_spi2_segments[] = {
2145     { 0x0, 128 * MiB }, /* start address is readonly */
2146     { 0x0, 0 }, /* disabled */
2147 };
2148 
2149 static void aspeed_2700_spi2_class_init(ObjectClass *klass, void *data)
2150 {
2151     DeviceClass *dc = DEVICE_CLASS(klass);
2152     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2153 
2154     dc->desc               = "Aspeed 2700 SPI2 Controller";
2155     asc->r_conf            = R_CONF;
2156     asc->r_ce_ctrl         = R_CE_CTRL;
2157     asc->r_ctrl0           = R_CTRL0;
2158     asc->r_timings         = R_TIMINGS;
2159     asc->nregs_timings     = 2;
2160     asc->conf_enable_w0    = CONF_ENABLE_W0;
2161     asc->cs_num_max        = 2;
2162     asc->segments          = aspeed_2700_spi2_segments;
2163     asc->segment_addr_mask = 0xffffffff;
2164     asc->flash_window_base = 0x280000000;
2165     asc->flash_window_size = 1 * GiB;
2166     asc->features          = ASPEED_SMC_FEATURE_DMA |
2167                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2168     asc->dma_flash_mask    = 0x0FFFFFFC;
2169     asc->dma_dram_mask     = 0xFFFFFFFC;
2170     asc->dma_start_length  = 1;
2171     asc->nregs             = ASPEED_SMC_R_MAX;
2172     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2173     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2174     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2175     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2176 }
2177 
2178 static const TypeInfo aspeed_2700_spi2_info = {
2179         .name =  "aspeed.spi2-ast2700",
2180         .parent = TYPE_ASPEED_SMC,
2181         .class_init = aspeed_2700_spi2_class_init,
2182 };
2183 
2184 static void aspeed_smc_register_types(void)
2185 {
2186     type_register_static(&aspeed_smc_flash_info);
2187     type_register_static(&aspeed_smc_info);
2188     type_register_static(&aspeed_2400_smc_info);
2189     type_register_static(&aspeed_2400_fmc_info);
2190     type_register_static(&aspeed_2400_spi1_info);
2191     type_register_static(&aspeed_2500_fmc_info);
2192     type_register_static(&aspeed_2500_spi1_info);
2193     type_register_static(&aspeed_2500_spi2_info);
2194     type_register_static(&aspeed_2600_fmc_info);
2195     type_register_static(&aspeed_2600_spi1_info);
2196     type_register_static(&aspeed_2600_spi2_info);
2197     type_register_static(&aspeed_1030_fmc_info);
2198     type_register_static(&aspeed_1030_spi1_info);
2199     type_register_static(&aspeed_1030_spi2_info);
2200     type_register_static(&aspeed_2700_fmc_info);
2201     type_register_static(&aspeed_2700_spi0_info);
2202     type_register_static(&aspeed_2700_spi1_info);
2203     type_register_static(&aspeed_2700_spi2_info);
2204 }
2205 
2206 type_init(aspeed_smc_register_types)
2207