1 /* 2 * ASPEED AST2400 SMC Controller (SPI Flash Only) 3 * 4 * Copyright (C) 2016 IBM Corp. 5 * 6 * Permission is hereby granted, free of charge, to any person obtaining a copy 7 * of this software and associated documentation files (the "Software"), to deal 8 * in the Software without restriction, including without limitation the rights 9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 * copies of the Software, and to permit persons to whom the Software is 11 * furnished to do so, subject to the following conditions: 12 * 13 * The above copyright notice and this permission notice shall be included in 14 * all copies or substantial portions of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 * THE SOFTWARE. 23 */ 24 25 #include "qemu/osdep.h" 26 #include "hw/sysbus.h" 27 #include "migration/vmstate.h" 28 #include "qemu/log.h" 29 #include "qemu/module.h" 30 #include "qemu/error-report.h" 31 #include "qapi/error.h" 32 #include "exec/address-spaces.h" 33 #include "qemu/units.h" 34 #include "trace.h" 35 36 #include "hw/irq.h" 37 #include "hw/qdev-properties.h" 38 #include "hw/ssi/aspeed_smc.h" 39 40 /* CE Type Setting Register */ 41 #define R_CONF (0x00 / 4) 42 #define CONF_LEGACY_DISABLE (1 << 31) 43 #define CONF_ENABLE_W4 20 44 #define CONF_ENABLE_W3 19 45 #define CONF_ENABLE_W2 18 46 #define CONF_ENABLE_W1 17 47 #define CONF_ENABLE_W0 16 48 #define CONF_FLASH_TYPE4 8 49 #define CONF_FLASH_TYPE3 6 50 #define CONF_FLASH_TYPE2 4 51 #define CONF_FLASH_TYPE1 2 52 #define CONF_FLASH_TYPE0 0 53 #define CONF_FLASH_TYPE_NOR 0x0 54 #define CONF_FLASH_TYPE_NAND 0x1 55 #define CONF_FLASH_TYPE_SPI 0x2 /* AST2600 is SPI only */ 56 57 /* CE Control Register */ 58 #define R_CE_CTRL (0x04 / 4) 59 #define CTRL_EXTENDED4 4 /* 32 bit addressing for SPI */ 60 #define CTRL_EXTENDED3 3 /* 32 bit addressing for SPI */ 61 #define CTRL_EXTENDED2 2 /* 32 bit addressing for SPI */ 62 #define CTRL_EXTENDED1 1 /* 32 bit addressing for SPI */ 63 #define CTRL_EXTENDED0 0 /* 32 bit addressing for SPI */ 64 65 /* Interrupt Control and Status Register */ 66 #define R_INTR_CTRL (0x08 / 4) 67 #define INTR_CTRL_DMA_STATUS (1 << 11) 68 #define INTR_CTRL_CMD_ABORT_STATUS (1 << 10) 69 #define INTR_CTRL_WRITE_PROTECT_STATUS (1 << 9) 70 #define INTR_CTRL_DMA_EN (1 << 3) 71 #define INTR_CTRL_CMD_ABORT_EN (1 << 2) 72 #define INTR_CTRL_WRITE_PROTECT_EN (1 << 1) 73 74 /* Command Control Register */ 75 #define R_CE_CMD_CTRL (0x0C / 4) 76 #define CTRL_ADDR_BYTE0_DISABLE_SHIFT 4 77 #define CTRL_DATA_BYTE0_DISABLE_SHIFT 0 78 79 #define aspeed_smc_addr_byte_enabled(s, i) \ 80 (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_ADDR_BYTE0_DISABLE_SHIFT + (i))))) 81 #define aspeed_smc_data_byte_enabled(s, i) \ 82 (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_DATA_BYTE0_DISABLE_SHIFT + (i))))) 83 84 /* CEx Control Register */ 85 #define R_CTRL0 (0x10 / 4) 86 #define CTRL_IO_QPI (1 << 31) 87 #define CTRL_IO_QUAD_DATA (1 << 30) 88 #define CTRL_IO_DUAL_DATA (1 << 29) 89 #define CTRL_IO_DUAL_ADDR_DATA (1 << 28) /* Includes dummies */ 90 #define CTRL_IO_QUAD_ADDR_DATA (1 << 28) /* Includes dummies */ 91 #define CTRL_CMD_SHIFT 16 92 #define CTRL_CMD_MASK 0xff 93 #define CTRL_DUMMY_HIGH_SHIFT 14 94 #define CTRL_AST2400_SPI_4BYTE (1 << 13) 95 #define CE_CTRL_CLOCK_FREQ_SHIFT 8 96 #define CE_CTRL_CLOCK_FREQ_MASK 0xf 97 #define CE_CTRL_CLOCK_FREQ(div) \ 98 (((div) & CE_CTRL_CLOCK_FREQ_MASK) << CE_CTRL_CLOCK_FREQ_SHIFT) 99 #define CTRL_DUMMY_LOW_SHIFT 6 /* 2 bits [7:6] */ 100 #define CTRL_CE_STOP_ACTIVE (1 << 2) 101 #define CTRL_CMD_MODE_MASK 0x3 102 #define CTRL_READMODE 0x0 103 #define CTRL_FREADMODE 0x1 104 #define CTRL_WRITEMODE 0x2 105 #define CTRL_USERMODE 0x3 106 #define R_CTRL1 (0x14 / 4) 107 #define R_CTRL2 (0x18 / 4) 108 #define R_CTRL3 (0x1C / 4) 109 #define R_CTRL4 (0x20 / 4) 110 111 /* CEx Segment Address Register */ 112 #define R_SEG_ADDR0 (0x30 / 4) 113 #define SEG_END_SHIFT 24 /* 8MB units */ 114 #define SEG_END_MASK 0xff 115 #define SEG_START_SHIFT 16 /* address bit [A29-A23] */ 116 #define SEG_START_MASK 0xff 117 #define R_SEG_ADDR1 (0x34 / 4) 118 #define R_SEG_ADDR2 (0x38 / 4) 119 #define R_SEG_ADDR3 (0x3C / 4) 120 #define R_SEG_ADDR4 (0x40 / 4) 121 122 /* Misc Control Register #1 */ 123 #define R_MISC_CTRL1 (0x50 / 4) 124 125 /* SPI dummy cycle data */ 126 #define R_DUMMY_DATA (0x54 / 4) 127 128 /* DMA Control/Status Register */ 129 #define R_DMA_CTRL (0x80 / 4) 130 #define DMA_CTRL_DELAY_MASK 0xf 131 #define DMA_CTRL_DELAY_SHIFT 8 132 #define DMA_CTRL_FREQ_MASK 0xf 133 #define DMA_CTRL_FREQ_SHIFT 4 134 #define DMA_CTRL_CALIB (1 << 3) 135 #define DMA_CTRL_CKSUM (1 << 2) 136 #define DMA_CTRL_WRITE (1 << 1) 137 #define DMA_CTRL_ENABLE (1 << 0) 138 139 /* DMA Flash Side Address */ 140 #define R_DMA_FLASH_ADDR (0x84 / 4) 141 142 /* DMA DRAM Side Address */ 143 #define R_DMA_DRAM_ADDR (0x88 / 4) 144 145 /* DMA Length Register */ 146 #define R_DMA_LEN (0x8C / 4) 147 148 /* Checksum Calculation Result */ 149 #define R_DMA_CHECKSUM (0x90 / 4) 150 151 /* Read Timing Compensation Register */ 152 #define R_TIMINGS (0x94 / 4) 153 154 /* SPI controller registers and bits (AST2400) */ 155 #define R_SPI_CONF (0x00 / 4) 156 #define SPI_CONF_ENABLE_W0 0 157 #define R_SPI_CTRL0 (0x4 / 4) 158 #define R_SPI_MISC_CTRL (0x10 / 4) 159 #define R_SPI_TIMINGS (0x14 / 4) 160 161 #define ASPEED_SMC_R_SPI_MAX (0x20 / 4) 162 #define ASPEED_SMC_R_SMC_MAX (0x20 / 4) 163 164 #define ASPEED_SOC_SMC_FLASH_BASE 0x10000000 165 #define ASPEED_SOC_FMC_FLASH_BASE 0x20000000 166 #define ASPEED_SOC_SPI_FLASH_BASE 0x30000000 167 #define ASPEED_SOC_SPI2_FLASH_BASE 0x38000000 168 169 /* 170 * DMA DRAM addresses should be 4 bytes aligned and the valid address 171 * range is 0x40000000 - 0x5FFFFFFF (AST2400) 172 * 0x80000000 - 0xBFFFFFFF (AST2500) 173 * 174 * DMA flash addresses should be 4 bytes aligned and the valid address 175 * range is 0x20000000 - 0x2FFFFFFF. 176 * 177 * DMA length is from 4 bytes to 32MB 178 * 0: 4 bytes 179 * 0x7FFFFF: 32M bytes 180 */ 181 #define DMA_DRAM_ADDR(s, val) ((val) & (s)->ctrl->dma_dram_mask) 182 #define DMA_FLASH_ADDR(s, val) ((val) & (s)->ctrl->dma_flash_mask) 183 #define DMA_LENGTH(val) ((val) & 0x01FFFFFC) 184 185 /* Flash opcodes. */ 186 #define SPI_OP_READ 0x03 /* Read data bytes (low frequency) */ 187 188 #define SNOOP_OFF 0xFF 189 #define SNOOP_START 0x0 190 191 /* 192 * Default segments mapping addresses and size for each peripheral per 193 * controller. These can be changed when board is initialized with the 194 * Segment Address Registers. 195 */ 196 static const AspeedSegments aspeed_segments_legacy[] = { 197 { 0x10000000, 32 * 1024 * 1024 }, 198 }; 199 200 static const AspeedSegments aspeed_segments_fmc[] = { 201 { 0x20000000, 64 * 1024 * 1024 }, /* start address is readonly */ 202 { 0x24000000, 32 * 1024 * 1024 }, 203 { 0x26000000, 32 * 1024 * 1024 }, 204 { 0x28000000, 32 * 1024 * 1024 }, 205 { 0x2A000000, 32 * 1024 * 1024 } 206 }; 207 208 static const AspeedSegments aspeed_segments_spi[] = { 209 { 0x30000000, 64 * 1024 * 1024 }, 210 }; 211 212 static const AspeedSegments aspeed_segments_ast2500_fmc[] = { 213 { 0x20000000, 128 * 1024 * 1024 }, /* start address is readonly */ 214 { 0x28000000, 32 * 1024 * 1024 }, 215 { 0x2A000000, 32 * 1024 * 1024 }, 216 }; 217 218 static const AspeedSegments aspeed_segments_ast2500_spi1[] = { 219 { 0x30000000, 32 * 1024 * 1024 }, /* start address is readonly */ 220 { 0x32000000, 96 * 1024 * 1024 }, /* end address is readonly */ 221 }; 222 223 static const AspeedSegments aspeed_segments_ast2500_spi2[] = { 224 { 0x38000000, 32 * 1024 * 1024 }, /* start address is readonly */ 225 { 0x3A000000, 96 * 1024 * 1024 }, /* end address is readonly */ 226 }; 227 static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s, 228 const AspeedSegments *seg); 229 static void aspeed_smc_reg_to_segment(const AspeedSMCState *s, uint32_t reg, 230 AspeedSegments *seg); 231 232 /* 233 * AST2600 definitions 234 */ 235 #define ASPEED26_SOC_FMC_FLASH_BASE 0x20000000 236 #define ASPEED26_SOC_SPI_FLASH_BASE 0x30000000 237 #define ASPEED26_SOC_SPI2_FLASH_BASE 0x50000000 238 239 static const AspeedSegments aspeed_segments_ast2600_fmc[] = { 240 { 0x0, 128 * MiB }, /* start address is readonly */ 241 { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */ 242 { 0x0, 0 }, /* disabled */ 243 }; 244 245 static const AspeedSegments aspeed_segments_ast2600_spi1[] = { 246 { 0x0, 128 * MiB }, /* start address is readonly */ 247 { 0x0, 0 }, /* disabled */ 248 }; 249 250 static const AspeedSegments aspeed_segments_ast2600_spi2[] = { 251 { 0x0, 128 * MiB }, /* start address is readonly */ 252 { 0x0, 0 }, /* disabled */ 253 { 0x0, 0 }, /* disabled */ 254 }; 255 256 static uint32_t aspeed_2600_smc_segment_to_reg(const AspeedSMCState *s, 257 const AspeedSegments *seg); 258 static void aspeed_2600_smc_reg_to_segment(const AspeedSMCState *s, 259 uint32_t reg, AspeedSegments *seg); 260 261 static const AspeedSMCController controllers[] = { 262 { 263 .name = "aspeed.smc-ast2400", 264 .r_conf = R_CONF, 265 .r_ce_ctrl = R_CE_CTRL, 266 .r_ctrl0 = R_CTRL0, 267 .r_timings = R_TIMINGS, 268 .nregs_timings = 1, 269 .conf_enable_w0 = CONF_ENABLE_W0, 270 .max_peripherals = 1, 271 .segments = aspeed_segments_legacy, 272 .flash_window_base = ASPEED_SOC_SMC_FLASH_BASE, 273 .flash_window_size = 0x6000000, 274 .has_dma = false, 275 .nregs = ASPEED_SMC_R_SMC_MAX, 276 .segment_to_reg = aspeed_smc_segment_to_reg, 277 .reg_to_segment = aspeed_smc_reg_to_segment, 278 }, { 279 .name = "aspeed.fmc-ast2400", 280 .r_conf = R_CONF, 281 .r_ce_ctrl = R_CE_CTRL, 282 .r_ctrl0 = R_CTRL0, 283 .r_timings = R_TIMINGS, 284 .nregs_timings = 1, 285 .conf_enable_w0 = CONF_ENABLE_W0, 286 .max_peripherals = 5, 287 .segments = aspeed_segments_fmc, 288 .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE, 289 .flash_window_size = 0x10000000, 290 .has_dma = true, 291 .dma_flash_mask = 0x0FFFFFFC, 292 .dma_dram_mask = 0x1FFFFFFC, 293 .nregs = ASPEED_SMC_R_MAX, 294 .segment_to_reg = aspeed_smc_segment_to_reg, 295 .reg_to_segment = aspeed_smc_reg_to_segment, 296 }, { 297 .name = "aspeed.spi1-ast2400", 298 .r_conf = R_SPI_CONF, 299 .r_ce_ctrl = 0xff, 300 .r_ctrl0 = R_SPI_CTRL0, 301 .r_timings = R_SPI_TIMINGS, 302 .nregs_timings = 1, 303 .conf_enable_w0 = SPI_CONF_ENABLE_W0, 304 .max_peripherals = 1, 305 .segments = aspeed_segments_spi, 306 .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE, 307 .flash_window_size = 0x10000000, 308 .has_dma = false, 309 .nregs = ASPEED_SMC_R_SPI_MAX, 310 .segment_to_reg = aspeed_smc_segment_to_reg, 311 .reg_to_segment = aspeed_smc_reg_to_segment, 312 }, { 313 .name = "aspeed.fmc-ast2500", 314 .r_conf = R_CONF, 315 .r_ce_ctrl = R_CE_CTRL, 316 .r_ctrl0 = R_CTRL0, 317 .r_timings = R_TIMINGS, 318 .nregs_timings = 1, 319 .conf_enable_w0 = CONF_ENABLE_W0, 320 .max_peripherals = 3, 321 .segments = aspeed_segments_ast2500_fmc, 322 .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE, 323 .flash_window_size = 0x10000000, 324 .has_dma = true, 325 .dma_flash_mask = 0x0FFFFFFC, 326 .dma_dram_mask = 0x3FFFFFFC, 327 .nregs = ASPEED_SMC_R_MAX, 328 .segment_to_reg = aspeed_smc_segment_to_reg, 329 .reg_to_segment = aspeed_smc_reg_to_segment, 330 }, { 331 .name = "aspeed.spi1-ast2500", 332 .r_conf = R_CONF, 333 .r_ce_ctrl = R_CE_CTRL, 334 .r_ctrl0 = R_CTRL0, 335 .r_timings = R_TIMINGS, 336 .nregs_timings = 1, 337 .conf_enable_w0 = CONF_ENABLE_W0, 338 .max_peripherals = 2, 339 .segments = aspeed_segments_ast2500_spi1, 340 .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE, 341 .flash_window_size = 0x8000000, 342 .has_dma = false, 343 .nregs = ASPEED_SMC_R_MAX, 344 .segment_to_reg = aspeed_smc_segment_to_reg, 345 .reg_to_segment = aspeed_smc_reg_to_segment, 346 }, { 347 .name = "aspeed.spi2-ast2500", 348 .r_conf = R_CONF, 349 .r_ce_ctrl = R_CE_CTRL, 350 .r_ctrl0 = R_CTRL0, 351 .r_timings = R_TIMINGS, 352 .nregs_timings = 1, 353 .conf_enable_w0 = CONF_ENABLE_W0, 354 .max_peripherals = 2, 355 .segments = aspeed_segments_ast2500_spi2, 356 .flash_window_base = ASPEED_SOC_SPI2_FLASH_BASE, 357 .flash_window_size = 0x8000000, 358 .has_dma = false, 359 .nregs = ASPEED_SMC_R_MAX, 360 .segment_to_reg = aspeed_smc_segment_to_reg, 361 .reg_to_segment = aspeed_smc_reg_to_segment, 362 }, { 363 .name = "aspeed.fmc-ast2600", 364 .r_conf = R_CONF, 365 .r_ce_ctrl = R_CE_CTRL, 366 .r_ctrl0 = R_CTRL0, 367 .r_timings = R_TIMINGS, 368 .nregs_timings = 1, 369 .conf_enable_w0 = CONF_ENABLE_W0, 370 .max_peripherals = 3, 371 .segments = aspeed_segments_ast2600_fmc, 372 .flash_window_base = ASPEED26_SOC_FMC_FLASH_BASE, 373 .flash_window_size = 0x10000000, 374 .has_dma = true, 375 .dma_flash_mask = 0x0FFFFFFC, 376 .dma_dram_mask = 0x3FFFFFFC, 377 .nregs = ASPEED_SMC_R_MAX, 378 .segment_to_reg = aspeed_2600_smc_segment_to_reg, 379 .reg_to_segment = aspeed_2600_smc_reg_to_segment, 380 }, { 381 .name = "aspeed.spi1-ast2600", 382 .r_conf = R_CONF, 383 .r_ce_ctrl = R_CE_CTRL, 384 .r_ctrl0 = R_CTRL0, 385 .r_timings = R_TIMINGS, 386 .nregs_timings = 2, 387 .conf_enable_w0 = CONF_ENABLE_W0, 388 .max_peripherals = 2, 389 .segments = aspeed_segments_ast2600_spi1, 390 .flash_window_base = ASPEED26_SOC_SPI_FLASH_BASE, 391 .flash_window_size = 0x10000000, 392 .has_dma = true, 393 .dma_flash_mask = 0x0FFFFFFC, 394 .dma_dram_mask = 0x3FFFFFFC, 395 .nregs = ASPEED_SMC_R_MAX, 396 .segment_to_reg = aspeed_2600_smc_segment_to_reg, 397 .reg_to_segment = aspeed_2600_smc_reg_to_segment, 398 }, { 399 .name = "aspeed.spi2-ast2600", 400 .r_conf = R_CONF, 401 .r_ce_ctrl = R_CE_CTRL, 402 .r_ctrl0 = R_CTRL0, 403 .r_timings = R_TIMINGS, 404 .nregs_timings = 3, 405 .conf_enable_w0 = CONF_ENABLE_W0, 406 .max_peripherals = 3, 407 .segments = aspeed_segments_ast2600_spi2, 408 .flash_window_base = ASPEED26_SOC_SPI2_FLASH_BASE, 409 .flash_window_size = 0x10000000, 410 .has_dma = true, 411 .dma_flash_mask = 0x0FFFFFFC, 412 .dma_dram_mask = 0x3FFFFFFC, 413 .nregs = ASPEED_SMC_R_MAX, 414 .segment_to_reg = aspeed_2600_smc_segment_to_reg, 415 .reg_to_segment = aspeed_2600_smc_reg_to_segment, 416 }, 417 }; 418 419 /* 420 * The Segment Registers of the AST2400 and AST2500 have a 8MB 421 * unit. The address range of a flash SPI peripheral is encoded with 422 * absolute addresses which should be part of the overall controller 423 * window. 424 */ 425 static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s, 426 const AspeedSegments *seg) 427 { 428 uint32_t reg = 0; 429 reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT; 430 reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT; 431 return reg; 432 } 433 434 static void aspeed_smc_reg_to_segment(const AspeedSMCState *s, 435 uint32_t reg, AspeedSegments *seg) 436 { 437 seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23; 438 seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr; 439 } 440 441 /* 442 * The Segment Registers of the AST2600 have a 1MB unit. The address 443 * range of a flash SPI peripheral is encoded with offsets in the overall 444 * controller window. The previous SoC AST2400 and AST2500 used 445 * absolute addresses. Only bits [27:20] are relevant and the end 446 * address is an upper bound limit. 447 */ 448 #define AST2600_SEG_ADDR_MASK 0x0ff00000 449 450 static uint32_t aspeed_2600_smc_segment_to_reg(const AspeedSMCState *s, 451 const AspeedSegments *seg) 452 { 453 uint32_t reg = 0; 454 455 /* Disabled segments have a nil register */ 456 if (!seg->size) { 457 return 0; 458 } 459 460 reg |= (seg->addr & AST2600_SEG_ADDR_MASK) >> 16; /* start offset */ 461 reg |= (seg->addr + seg->size - 1) & AST2600_SEG_ADDR_MASK; /* end offset */ 462 return reg; 463 } 464 465 static void aspeed_2600_smc_reg_to_segment(const AspeedSMCState *s, 466 uint32_t reg, AspeedSegments *seg) 467 { 468 uint32_t start_offset = (reg << 16) & AST2600_SEG_ADDR_MASK; 469 uint32_t end_offset = reg & AST2600_SEG_ADDR_MASK; 470 471 if (reg) { 472 seg->addr = s->ctrl->flash_window_base + start_offset; 473 seg->size = end_offset + MiB - start_offset; 474 } else { 475 seg->addr = s->ctrl->flash_window_base; 476 seg->size = 0; 477 } 478 } 479 480 static bool aspeed_smc_flash_overlap(const AspeedSMCState *s, 481 const AspeedSegments *new, 482 int cs) 483 { 484 AspeedSegments seg; 485 int i; 486 487 for (i = 0; i < s->ctrl->max_peripherals; i++) { 488 if (i == cs) { 489 continue; 490 } 491 492 s->ctrl->reg_to_segment(s, s->regs[R_SEG_ADDR0 + i], &seg); 493 494 if (new->addr + new->size > seg.addr && 495 new->addr < seg.addr + seg.size) { 496 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment CS%d [ 0x%" 497 HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with " 498 "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 499 s->ctrl->name, cs, new->addr, new->addr + new->size, 500 i, seg.addr, seg.addr + seg.size); 501 return true; 502 } 503 } 504 return false; 505 } 506 507 static void aspeed_smc_flash_set_segment_region(AspeedSMCState *s, int cs, 508 uint64_t regval) 509 { 510 AspeedSMCFlash *fl = &s->flashes[cs]; 511 AspeedSegments seg; 512 513 s->ctrl->reg_to_segment(s, regval, &seg); 514 515 memory_region_transaction_begin(); 516 memory_region_set_size(&fl->mmio, seg.size); 517 memory_region_set_address(&fl->mmio, seg.addr - s->ctrl->flash_window_base); 518 memory_region_set_enabled(&fl->mmio, !!seg.size); 519 memory_region_transaction_commit(); 520 521 s->regs[R_SEG_ADDR0 + cs] = regval; 522 } 523 524 static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs, 525 uint64_t new) 526 { 527 AspeedSegments seg; 528 529 s->ctrl->reg_to_segment(s, new, &seg); 530 531 trace_aspeed_smc_flash_set_segment(cs, new, seg.addr, seg.addr + seg.size); 532 533 /* The start address of CS0 is read-only */ 534 if (cs == 0 && seg.addr != s->ctrl->flash_window_base) { 535 qemu_log_mask(LOG_GUEST_ERROR, 536 "%s: Tried to change CS0 start address to 0x%" 537 HWADDR_PRIx "\n", s->ctrl->name, seg.addr); 538 seg.addr = s->ctrl->flash_window_base; 539 new = s->ctrl->segment_to_reg(s, &seg); 540 } 541 542 /* 543 * The end address of the AST2500 spi controllers is also 544 * read-only. 545 */ 546 if ((s->ctrl->segments == aspeed_segments_ast2500_spi1 || 547 s->ctrl->segments == aspeed_segments_ast2500_spi2) && 548 cs == s->ctrl->max_peripherals && 549 seg.addr + seg.size != s->ctrl->segments[cs].addr + 550 s->ctrl->segments[cs].size) { 551 qemu_log_mask(LOG_GUEST_ERROR, 552 "%s: Tried to change CS%d end address to 0x%" 553 HWADDR_PRIx "\n", s->ctrl->name, cs, seg.addr + seg.size); 554 seg.size = s->ctrl->segments[cs].addr + s->ctrl->segments[cs].size - 555 seg.addr; 556 new = s->ctrl->segment_to_reg(s, &seg); 557 } 558 559 /* Keep the segment in the overall flash window */ 560 if (seg.size && 561 (seg.addr + seg.size <= s->ctrl->flash_window_base || 562 seg.addr > s->ctrl->flash_window_base + s->ctrl->flash_window_size)) { 563 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is invalid : " 564 "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 565 s->ctrl->name, cs, seg.addr, seg.addr + seg.size); 566 return; 567 } 568 569 /* Check start address vs. alignment */ 570 if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) { 571 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is not " 572 "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 573 s->ctrl->name, cs, seg.addr, seg.addr + seg.size); 574 } 575 576 /* And segments should not overlap (in the specs) */ 577 aspeed_smc_flash_overlap(s, &seg, cs); 578 579 /* All should be fine now to move the region */ 580 aspeed_smc_flash_set_segment_region(s, cs, new); 581 } 582 583 static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr, 584 unsigned size) 585 { 586 qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u" 587 PRIx64 "\n", __func__, addr, size); 588 return 0; 589 } 590 591 static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr, 592 uint64_t data, unsigned size) 593 { 594 qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u: 0x%" 595 PRIx64 "\n", __func__, addr, size, data); 596 } 597 598 static const MemoryRegionOps aspeed_smc_flash_default_ops = { 599 .read = aspeed_smc_flash_default_read, 600 .write = aspeed_smc_flash_default_write, 601 .endianness = DEVICE_LITTLE_ENDIAN, 602 .valid = { 603 .min_access_size = 1, 604 .max_access_size = 4, 605 }, 606 }; 607 608 static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl) 609 { 610 const AspeedSMCState *s = fl->controller; 611 612 return s->regs[s->r_ctrl0 + fl->id] & CTRL_CMD_MODE_MASK; 613 } 614 615 static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl) 616 { 617 const AspeedSMCState *s = fl->controller; 618 619 return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->id)); 620 } 621 622 static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl) 623 { 624 const AspeedSMCState *s = fl->controller; 625 int cmd = (s->regs[s->r_ctrl0 + fl->id] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK; 626 627 /* 628 * In read mode, the default SPI command is READ (0x3). In other 629 * modes, the command should necessarily be defined 630 * 631 * TODO: add support for READ4 (0x13) on AST2600 632 */ 633 if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) { 634 cmd = SPI_OP_READ; 635 } 636 637 if (!cmd) { 638 qemu_log_mask(LOG_GUEST_ERROR, "%s: no command defined for mode %d\n", 639 __func__, aspeed_smc_flash_mode(fl)); 640 } 641 642 return cmd; 643 } 644 645 static inline int aspeed_smc_flash_is_4byte(const AspeedSMCFlash *fl) 646 { 647 const AspeedSMCState *s = fl->controller; 648 649 if (s->ctrl->segments == aspeed_segments_spi) { 650 return s->regs[s->r_ctrl0] & CTRL_AST2400_SPI_4BYTE; 651 } else { 652 return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->id)); 653 } 654 } 655 656 static void aspeed_smc_flash_do_select(AspeedSMCFlash *fl, bool unselect) 657 { 658 AspeedSMCState *s = fl->controller; 659 660 trace_aspeed_smc_flash_select(fl->id, unselect ? "un" : ""); 661 662 qemu_set_irq(s->cs_lines[fl->id], unselect); 663 } 664 665 static void aspeed_smc_flash_select(AspeedSMCFlash *fl) 666 { 667 aspeed_smc_flash_do_select(fl, false); 668 } 669 670 static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl) 671 { 672 aspeed_smc_flash_do_select(fl, true); 673 } 674 675 static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl, 676 uint32_t addr) 677 { 678 const AspeedSMCState *s = fl->controller; 679 AspeedSegments seg; 680 681 s->ctrl->reg_to_segment(s, s->regs[R_SEG_ADDR0 + fl->id], &seg); 682 if ((addr % seg.size) != addr) { 683 qemu_log_mask(LOG_GUEST_ERROR, 684 "%s: invalid address 0x%08x for CS%d segment : " 685 "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 686 s->ctrl->name, addr, fl->id, seg.addr, 687 seg.addr + seg.size); 688 addr %= seg.size; 689 } 690 691 return addr; 692 } 693 694 static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl) 695 { 696 const AspeedSMCState *s = fl->controller; 697 uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->id]; 698 uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1; 699 uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3; 700 uint32_t dummies = ((dummy_high << 2) | dummy_low) * 8; 701 702 if (r_ctrl0 & CTRL_IO_DUAL_ADDR_DATA) { 703 dummies /= 2; 704 } 705 706 return dummies; 707 } 708 709 static void aspeed_smc_flash_setup(AspeedSMCFlash *fl, uint32_t addr) 710 { 711 const AspeedSMCState *s = fl->controller; 712 uint8_t cmd = aspeed_smc_flash_cmd(fl); 713 int i = aspeed_smc_flash_is_4byte(fl) ? 4 : 3; 714 715 /* Flash access can not exceed CS segment */ 716 addr = aspeed_smc_check_segment_addr(fl, addr); 717 718 ssi_transfer(s->spi, cmd); 719 while (i--) { 720 if (aspeed_smc_addr_byte_enabled(s, i)) { 721 ssi_transfer(s->spi, (addr >> (i * 8)) & 0xff); 722 } 723 } 724 725 /* 726 * Use fake transfers to model dummy bytes. The value should 727 * be configured to some non-zero value in fast read mode and 728 * zero in read mode. But, as the HW allows inconsistent 729 * settings, let's check for fast read mode. 730 */ 731 if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) { 732 for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) { 733 ssi_transfer(fl->controller->spi, s->regs[R_DUMMY_DATA] & 0xff); 734 } 735 } 736 } 737 738 static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size) 739 { 740 AspeedSMCFlash *fl = opaque; 741 AspeedSMCState *s = fl->controller; 742 uint64_t ret = 0; 743 int i; 744 745 switch (aspeed_smc_flash_mode(fl)) { 746 case CTRL_USERMODE: 747 for (i = 0; i < size; i++) { 748 ret |= ssi_transfer(s->spi, 0x0) << (8 * i); 749 } 750 break; 751 case CTRL_READMODE: 752 case CTRL_FREADMODE: 753 aspeed_smc_flash_select(fl); 754 aspeed_smc_flash_setup(fl, addr); 755 756 for (i = 0; i < size; i++) { 757 ret |= ssi_transfer(s->spi, 0x0) << (8 * i); 758 } 759 760 aspeed_smc_flash_unselect(fl); 761 break; 762 default: 763 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n", 764 __func__, aspeed_smc_flash_mode(fl)); 765 } 766 767 trace_aspeed_smc_flash_read(fl->id, addr, size, ret, 768 aspeed_smc_flash_mode(fl)); 769 return ret; 770 } 771 772 /* 773 * TODO (clg@kaod.org): stolen from xilinx_spips.c. Should move to a 774 * common include header. 775 */ 776 typedef enum { 777 READ = 0x3, READ_4 = 0x13, 778 FAST_READ = 0xb, FAST_READ_4 = 0x0c, 779 DOR = 0x3b, DOR_4 = 0x3c, 780 QOR = 0x6b, QOR_4 = 0x6c, 781 DIOR = 0xbb, DIOR_4 = 0xbc, 782 QIOR = 0xeb, QIOR_4 = 0xec, 783 784 PP = 0x2, PP_4 = 0x12, 785 DPP = 0xa2, 786 QPP = 0x32, QPP_4 = 0x34, 787 } FlashCMD; 788 789 static int aspeed_smc_num_dummies(uint8_t command) 790 { 791 switch (command) { /* check for dummies */ 792 case READ: /* no dummy bytes/cycles */ 793 case PP: 794 case DPP: 795 case QPP: 796 case READ_4: 797 case PP_4: 798 case QPP_4: 799 return 0; 800 case FAST_READ: 801 case DOR: 802 case QOR: 803 case FAST_READ_4: 804 case DOR_4: 805 case QOR_4: 806 return 1; 807 case DIOR: 808 case DIOR_4: 809 return 2; 810 case QIOR: 811 case QIOR_4: 812 return 4; 813 default: 814 return -1; 815 } 816 } 817 818 static bool aspeed_smc_do_snoop(AspeedSMCFlash *fl, uint64_t data, 819 unsigned size) 820 { 821 AspeedSMCState *s = fl->controller; 822 uint8_t addr_width = aspeed_smc_flash_is_4byte(fl) ? 4 : 3; 823 824 trace_aspeed_smc_do_snoop(fl->id, s->snoop_index, s->snoop_dummies, 825 (uint8_t) data & 0xff); 826 827 if (s->snoop_index == SNOOP_OFF) { 828 return false; /* Do nothing */ 829 830 } else if (s->snoop_index == SNOOP_START) { 831 uint8_t cmd = data & 0xff; 832 int ndummies = aspeed_smc_num_dummies(cmd); 833 834 /* 835 * No dummy cycles are expected with the current command. Turn 836 * off snooping and let the transfer proceed normally. 837 */ 838 if (ndummies <= 0) { 839 s->snoop_index = SNOOP_OFF; 840 return false; 841 } 842 843 s->snoop_dummies = ndummies * 8; 844 845 } else if (s->snoop_index >= addr_width + 1) { 846 847 /* The SPI transfer has reached the dummy cycles sequence */ 848 for (; s->snoop_dummies; s->snoop_dummies--) { 849 ssi_transfer(s->spi, s->regs[R_DUMMY_DATA] & 0xff); 850 } 851 852 /* If no more dummy cycles are expected, turn off snooping */ 853 if (!s->snoop_dummies) { 854 s->snoop_index = SNOOP_OFF; 855 } else { 856 s->snoop_index += size; 857 } 858 859 /* 860 * Dummy cycles have been faked already. Ignore the current 861 * SPI transfer 862 */ 863 return true; 864 } 865 866 s->snoop_index += size; 867 return false; 868 } 869 870 static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data, 871 unsigned size) 872 { 873 AspeedSMCFlash *fl = opaque; 874 AspeedSMCState *s = fl->controller; 875 int i; 876 877 trace_aspeed_smc_flash_write(fl->id, addr, size, data, 878 aspeed_smc_flash_mode(fl)); 879 880 if (!aspeed_smc_is_writable(fl)) { 881 qemu_log_mask(LOG_GUEST_ERROR, "%s: flash is not writable at 0x%" 882 HWADDR_PRIx "\n", __func__, addr); 883 return; 884 } 885 886 switch (aspeed_smc_flash_mode(fl)) { 887 case CTRL_USERMODE: 888 if (aspeed_smc_do_snoop(fl, data, size)) { 889 break; 890 } 891 892 for (i = 0; i < size; i++) { 893 ssi_transfer(s->spi, (data >> (8 * i)) & 0xff); 894 } 895 break; 896 case CTRL_WRITEMODE: 897 aspeed_smc_flash_select(fl); 898 aspeed_smc_flash_setup(fl, addr); 899 900 for (i = 0; i < size; i++) { 901 ssi_transfer(s->spi, (data >> (8 * i)) & 0xff); 902 } 903 904 aspeed_smc_flash_unselect(fl); 905 break; 906 default: 907 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n", 908 __func__, aspeed_smc_flash_mode(fl)); 909 } 910 } 911 912 static const MemoryRegionOps aspeed_smc_flash_ops = { 913 .read = aspeed_smc_flash_read, 914 .write = aspeed_smc_flash_write, 915 .endianness = DEVICE_LITTLE_ENDIAN, 916 .valid = { 917 .min_access_size = 1, 918 .max_access_size = 4, 919 }, 920 }; 921 922 static void aspeed_smc_flash_update_ctrl(AspeedSMCFlash *fl, uint32_t value) 923 { 924 AspeedSMCState *s = fl->controller; 925 bool unselect; 926 927 /* User mode selects the CS, other modes unselect */ 928 unselect = (value & CTRL_CMD_MODE_MASK) != CTRL_USERMODE; 929 930 /* A change of CTRL_CE_STOP_ACTIVE from 0 to 1, unselects the CS */ 931 if (!(s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE) && 932 value & CTRL_CE_STOP_ACTIVE) { 933 unselect = true; 934 } 935 936 s->regs[s->r_ctrl0 + fl->id] = value; 937 938 s->snoop_index = unselect ? SNOOP_OFF : SNOOP_START; 939 940 aspeed_smc_flash_do_select(fl, unselect); 941 } 942 943 static void aspeed_smc_reset(DeviceState *d) 944 { 945 AspeedSMCState *s = ASPEED_SMC(d); 946 int i; 947 948 memset(s->regs, 0, sizeof s->regs); 949 950 /* Unselect all peripherals */ 951 for (i = 0; i < s->num_cs; ++i) { 952 s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE; 953 qemu_set_irq(s->cs_lines[i], true); 954 } 955 956 /* setup the default segment register values and regions for all */ 957 for (i = 0; i < s->ctrl->max_peripherals; ++i) { 958 aspeed_smc_flash_set_segment_region(s, i, 959 s->ctrl->segment_to_reg(s, &s->ctrl->segments[i])); 960 } 961 962 /* HW strapping flash type for the AST2600 controllers */ 963 if (s->ctrl->segments == aspeed_segments_ast2600_fmc) { 964 /* flash type is fixed to SPI for all */ 965 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0); 966 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1); 967 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE2); 968 } 969 970 /* HW strapping flash type for FMC controllers */ 971 if (s->ctrl->segments == aspeed_segments_ast2500_fmc) { 972 /* flash type is fixed to SPI for CE0 and CE1 */ 973 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0); 974 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1); 975 } 976 977 /* HW strapping for AST2400 FMC controllers (SCU70). Let's use the 978 * configuration of the palmetto-bmc machine */ 979 if (s->ctrl->segments == aspeed_segments_fmc) { 980 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0); 981 } 982 983 s->snoop_index = SNOOP_OFF; 984 s->snoop_dummies = 0; 985 } 986 987 static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size) 988 { 989 AspeedSMCState *s = ASPEED_SMC(opaque); 990 991 addr >>= 2; 992 993 if (addr == s->r_conf || 994 (addr >= s->r_timings && 995 addr < s->r_timings + s->ctrl->nregs_timings) || 996 addr == s->r_ce_ctrl || 997 addr == R_CE_CMD_CTRL || 998 addr == R_INTR_CTRL || 999 addr == R_DUMMY_DATA || 1000 (s->ctrl->has_dma && addr == R_DMA_CTRL) || 1001 (s->ctrl->has_dma && addr == R_DMA_FLASH_ADDR) || 1002 (s->ctrl->has_dma && addr == R_DMA_DRAM_ADDR) || 1003 (s->ctrl->has_dma && addr == R_DMA_LEN) || 1004 (s->ctrl->has_dma && addr == R_DMA_CHECKSUM) || 1005 (addr >= R_SEG_ADDR0 && 1006 addr < R_SEG_ADDR0 + s->ctrl->max_peripherals) || 1007 (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->ctrl->max_peripherals)) { 1008 1009 trace_aspeed_smc_read(addr, size, s->regs[addr]); 1010 1011 return s->regs[addr]; 1012 } else { 1013 qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n", 1014 __func__, addr); 1015 return -1; 1016 } 1017 } 1018 1019 static uint8_t aspeed_smc_hclk_divisor(uint8_t hclk_mask) 1020 { 1021 /* HCLK/1 .. HCLK/16 */ 1022 const uint8_t hclk_divisors[] = { 1023 15, 7, 14, 6, 13, 5, 12, 4, 11, 3, 10, 2, 9, 1, 8, 0 1024 }; 1025 int i; 1026 1027 for (i = 0; i < ARRAY_SIZE(hclk_divisors); i++) { 1028 if (hclk_mask == hclk_divisors[i]) { 1029 return i + 1; 1030 } 1031 } 1032 1033 qemu_log_mask(LOG_GUEST_ERROR, "invalid HCLK mask %x", hclk_mask); 1034 return 0; 1035 } 1036 1037 /* 1038 * When doing calibration, the SPI clock rate in the CE0 Control 1039 * Register and the read delay cycles in the Read Timing Compensation 1040 * Register are set using bit[11:4] of the DMA Control Register. 1041 */ 1042 static void aspeed_smc_dma_calibration(AspeedSMCState *s) 1043 { 1044 uint8_t delay = 1045 (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK; 1046 uint8_t hclk_mask = 1047 (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK; 1048 uint8_t hclk_div = aspeed_smc_hclk_divisor(hclk_mask); 1049 uint32_t hclk_shift = (hclk_div - 1) << 2; 1050 uint8_t cs; 1051 1052 /* 1053 * The Read Timing Compensation Register values apply to all CS on 1054 * the SPI bus and only HCLK/1 - HCLK/5 can have tunable delays 1055 */ 1056 if (hclk_div && hclk_div < 6) { 1057 s->regs[s->r_timings] &= ~(0xf << hclk_shift); 1058 s->regs[s->r_timings] |= delay << hclk_shift; 1059 } 1060 1061 /* 1062 * TODO: compute the CS from the DMA address and the segment 1063 * registers. This is not really a problem for now because the 1064 * Timing Register values apply to all CS and software uses CS0 to 1065 * do calibration. 1066 */ 1067 cs = 0; 1068 s->regs[s->r_ctrl0 + cs] &= 1069 ~(CE_CTRL_CLOCK_FREQ_MASK << CE_CTRL_CLOCK_FREQ_SHIFT); 1070 s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div); 1071 } 1072 1073 /* 1074 * Emulate read errors in the DMA Checksum Register for high 1075 * frequencies and optimistic settings of the Read Timing Compensation 1076 * Register. This will help in tuning the SPI timing calibration 1077 * algorithm. 1078 */ 1079 static bool aspeed_smc_inject_read_failure(AspeedSMCState *s) 1080 { 1081 uint8_t delay = 1082 (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK; 1083 uint8_t hclk_mask = 1084 (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK; 1085 1086 /* 1087 * Typical values of a palmetto-bmc machine. 1088 */ 1089 switch (aspeed_smc_hclk_divisor(hclk_mask)) { 1090 case 4 ... 16: 1091 return false; 1092 case 3: /* at least one HCLK cycle delay */ 1093 return (delay & 0x7) < 1; 1094 case 2: /* at least two HCLK cycle delay */ 1095 return (delay & 0x7) < 2; 1096 case 1: /* (> 100MHz) is above the max freq of the controller */ 1097 return true; 1098 default: 1099 g_assert_not_reached(); 1100 } 1101 } 1102 1103 /* 1104 * Accumulate the result of the reads to provide a checksum that will 1105 * be used to validate the read timing settings. 1106 */ 1107 static void aspeed_smc_dma_checksum(AspeedSMCState *s) 1108 { 1109 MemTxResult result; 1110 uint32_t data; 1111 1112 if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) { 1113 qemu_log_mask(LOG_GUEST_ERROR, 1114 "%s: invalid direction for DMA checksum\n", __func__); 1115 return; 1116 } 1117 1118 if (s->regs[R_DMA_CTRL] & DMA_CTRL_CALIB) { 1119 aspeed_smc_dma_calibration(s); 1120 } 1121 1122 while (s->regs[R_DMA_LEN]) { 1123 data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR], 1124 MEMTXATTRS_UNSPECIFIED, &result); 1125 if (result != MEMTX_OK) { 1126 qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash read failed @%08x\n", 1127 __func__, s->regs[R_DMA_FLASH_ADDR]); 1128 return; 1129 } 1130 trace_aspeed_smc_dma_checksum(s->regs[R_DMA_FLASH_ADDR], data); 1131 1132 /* 1133 * When the DMA is on-going, the DMA registers are updated 1134 * with the current working addresses and length. 1135 */ 1136 s->regs[R_DMA_CHECKSUM] += data; 1137 s->regs[R_DMA_FLASH_ADDR] += 4; 1138 s->regs[R_DMA_LEN] -= 4; 1139 } 1140 1141 if (s->inject_failure && aspeed_smc_inject_read_failure(s)) { 1142 s->regs[R_DMA_CHECKSUM] = 0xbadc0de; 1143 } 1144 1145 } 1146 1147 static void aspeed_smc_dma_rw(AspeedSMCState *s) 1148 { 1149 MemTxResult result; 1150 uint32_t data; 1151 1152 trace_aspeed_smc_dma_rw(s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE ? 1153 "write" : "read", 1154 s->regs[R_DMA_FLASH_ADDR], 1155 s->regs[R_DMA_DRAM_ADDR], 1156 s->regs[R_DMA_LEN]); 1157 while (s->regs[R_DMA_LEN]) { 1158 if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) { 1159 data = address_space_ldl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR], 1160 MEMTXATTRS_UNSPECIFIED, &result); 1161 if (result != MEMTX_OK) { 1162 qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM read failed @%08x\n", 1163 __func__, s->regs[R_DMA_DRAM_ADDR]); 1164 return; 1165 } 1166 1167 address_space_stl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR], 1168 data, MEMTXATTRS_UNSPECIFIED, &result); 1169 if (result != MEMTX_OK) { 1170 qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash write failed @%08x\n", 1171 __func__, s->regs[R_DMA_FLASH_ADDR]); 1172 return; 1173 } 1174 } else { 1175 data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR], 1176 MEMTXATTRS_UNSPECIFIED, &result); 1177 if (result != MEMTX_OK) { 1178 qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash read failed @%08x\n", 1179 __func__, s->regs[R_DMA_FLASH_ADDR]); 1180 return; 1181 } 1182 1183 address_space_stl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR], 1184 data, MEMTXATTRS_UNSPECIFIED, &result); 1185 if (result != MEMTX_OK) { 1186 qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM write failed @%08x\n", 1187 __func__, s->regs[R_DMA_DRAM_ADDR]); 1188 return; 1189 } 1190 } 1191 1192 /* 1193 * When the DMA is on-going, the DMA registers are updated 1194 * with the current working addresses and length. 1195 */ 1196 s->regs[R_DMA_FLASH_ADDR] += 4; 1197 s->regs[R_DMA_DRAM_ADDR] += 4; 1198 s->regs[R_DMA_LEN] -= 4; 1199 s->regs[R_DMA_CHECKSUM] += data; 1200 } 1201 } 1202 1203 static void aspeed_smc_dma_stop(AspeedSMCState *s) 1204 { 1205 /* 1206 * When the DMA is disabled, INTR_CTRL_DMA_STATUS=0 means the 1207 * engine is idle 1208 */ 1209 s->regs[R_INTR_CTRL] &= ~INTR_CTRL_DMA_STATUS; 1210 s->regs[R_DMA_CHECKSUM] = 0; 1211 1212 /* 1213 * Lower the DMA irq in any case. The IRQ control register could 1214 * have been cleared before disabling the DMA. 1215 */ 1216 qemu_irq_lower(s->irq); 1217 } 1218 1219 /* 1220 * When INTR_CTRL_DMA_STATUS=1, the DMA has completed and a new DMA 1221 * can start even if the result of the previous was not collected. 1222 */ 1223 static bool aspeed_smc_dma_in_progress(AspeedSMCState *s) 1224 { 1225 return s->regs[R_DMA_CTRL] & DMA_CTRL_ENABLE && 1226 !(s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_STATUS); 1227 } 1228 1229 static void aspeed_smc_dma_done(AspeedSMCState *s) 1230 { 1231 s->regs[R_INTR_CTRL] |= INTR_CTRL_DMA_STATUS; 1232 if (s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_EN) { 1233 qemu_irq_raise(s->irq); 1234 } 1235 } 1236 1237 static void aspeed_smc_dma_ctrl(AspeedSMCState *s, uint64_t dma_ctrl) 1238 { 1239 if (!(dma_ctrl & DMA_CTRL_ENABLE)) { 1240 s->regs[R_DMA_CTRL] = dma_ctrl; 1241 1242 aspeed_smc_dma_stop(s); 1243 return; 1244 } 1245 1246 if (aspeed_smc_dma_in_progress(s)) { 1247 qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA in progress\n", __func__); 1248 return; 1249 } 1250 1251 s->regs[R_DMA_CTRL] = dma_ctrl; 1252 1253 if (s->regs[R_DMA_CTRL] & DMA_CTRL_CKSUM) { 1254 aspeed_smc_dma_checksum(s); 1255 } else { 1256 aspeed_smc_dma_rw(s); 1257 } 1258 1259 aspeed_smc_dma_done(s); 1260 } 1261 1262 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data, 1263 unsigned int size) 1264 { 1265 AspeedSMCState *s = ASPEED_SMC(opaque); 1266 uint32_t value = data; 1267 1268 addr >>= 2; 1269 1270 trace_aspeed_smc_write(addr, size, data); 1271 1272 if (addr == s->r_conf || 1273 (addr >= s->r_timings && 1274 addr < s->r_timings + s->ctrl->nregs_timings) || 1275 addr == s->r_ce_ctrl) { 1276 s->regs[addr] = value; 1277 } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) { 1278 int cs = addr - s->r_ctrl0; 1279 aspeed_smc_flash_update_ctrl(&s->flashes[cs], value); 1280 } else if (addr >= R_SEG_ADDR0 && 1281 addr < R_SEG_ADDR0 + s->ctrl->max_peripherals) { 1282 int cs = addr - R_SEG_ADDR0; 1283 1284 if (value != s->regs[R_SEG_ADDR0 + cs]) { 1285 aspeed_smc_flash_set_segment(s, cs, value); 1286 } 1287 } else if (addr == R_CE_CMD_CTRL) { 1288 s->regs[addr] = value & 0xff; 1289 } else if (addr == R_DUMMY_DATA) { 1290 s->regs[addr] = value & 0xff; 1291 } else if (addr == R_INTR_CTRL) { 1292 s->regs[addr] = value; 1293 } else if (s->ctrl->has_dma && addr == R_DMA_CTRL) { 1294 aspeed_smc_dma_ctrl(s, value); 1295 } else if (s->ctrl->has_dma && addr == R_DMA_DRAM_ADDR) { 1296 s->regs[addr] = DMA_DRAM_ADDR(s, value); 1297 } else if (s->ctrl->has_dma && addr == R_DMA_FLASH_ADDR) { 1298 s->regs[addr] = DMA_FLASH_ADDR(s, value); 1299 } else if (s->ctrl->has_dma && addr == R_DMA_LEN) { 1300 s->regs[addr] = DMA_LENGTH(value); 1301 } else { 1302 qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n", 1303 __func__, addr); 1304 return; 1305 } 1306 } 1307 1308 static const MemoryRegionOps aspeed_smc_ops = { 1309 .read = aspeed_smc_read, 1310 .write = aspeed_smc_write, 1311 .endianness = DEVICE_LITTLE_ENDIAN, 1312 }; 1313 1314 /* 1315 * Initialize the custom address spaces for DMAs 1316 */ 1317 static void aspeed_smc_dma_setup(AspeedSMCState *s, Error **errp) 1318 { 1319 char *name; 1320 1321 if (!s->dram_mr) { 1322 error_setg(errp, TYPE_ASPEED_SMC ": 'dram' link not set"); 1323 return; 1324 } 1325 1326 name = g_strdup_printf("%s-dma-flash", s->ctrl->name); 1327 address_space_init(&s->flash_as, &s->mmio_flash, name); 1328 g_free(name); 1329 1330 name = g_strdup_printf("%s-dma-dram", s->ctrl->name); 1331 address_space_init(&s->dram_as, s->dram_mr, name); 1332 g_free(name); 1333 } 1334 1335 static void aspeed_smc_realize(DeviceState *dev, Error **errp) 1336 { 1337 SysBusDevice *sbd = SYS_BUS_DEVICE(dev); 1338 AspeedSMCState *s = ASPEED_SMC(dev); 1339 AspeedSMCClass *mc = ASPEED_SMC_GET_CLASS(s); 1340 int i; 1341 char name[32]; 1342 hwaddr offset = 0; 1343 1344 s->ctrl = mc->ctrl; 1345 1346 /* keep a copy under AspeedSMCState to speed up accesses */ 1347 s->r_conf = s->ctrl->r_conf; 1348 s->r_ce_ctrl = s->ctrl->r_ce_ctrl; 1349 s->r_ctrl0 = s->ctrl->r_ctrl0; 1350 s->r_timings = s->ctrl->r_timings; 1351 s->conf_enable_w0 = s->ctrl->conf_enable_w0; 1352 1353 /* Enforce some real HW limits */ 1354 if (s->num_cs > s->ctrl->max_peripherals) { 1355 qemu_log_mask(LOG_GUEST_ERROR, "%s: num_cs cannot exceed: %d\n", 1356 __func__, s->ctrl->max_peripherals); 1357 s->num_cs = s->ctrl->max_peripherals; 1358 } 1359 1360 /* DMA irq. Keep it first for the initialization in the SoC */ 1361 sysbus_init_irq(sbd, &s->irq); 1362 1363 s->spi = ssi_create_bus(dev, "spi"); 1364 1365 /* Setup cs_lines for peripherals */ 1366 s->cs_lines = g_new0(qemu_irq, s->num_cs); 1367 1368 for (i = 0; i < s->num_cs; ++i) { 1369 sysbus_init_irq(sbd, &s->cs_lines[i]); 1370 } 1371 1372 /* The memory region for the controller registers */ 1373 memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s, 1374 s->ctrl->name, s->ctrl->nregs * 4); 1375 sysbus_init_mmio(sbd, &s->mmio); 1376 1377 /* 1378 * The container memory region representing the address space 1379 * window in which the flash modules are mapped. The size and 1380 * address depends on the SoC model and controller type. 1381 */ 1382 snprintf(name, sizeof(name), "%s.flash", s->ctrl->name); 1383 1384 memory_region_init_io(&s->mmio_flash, OBJECT(s), 1385 &aspeed_smc_flash_default_ops, s, name, 1386 s->ctrl->flash_window_size); 1387 memory_region_init_alias(&s->mmio_flash_alias, OBJECT(s), name, 1388 &s->mmio_flash, 0, s->ctrl->flash_window_size); 1389 sysbus_init_mmio(sbd, &s->mmio_flash_alias); 1390 1391 s->flashes = g_new0(AspeedSMCFlash, s->ctrl->max_peripherals); 1392 1393 /* 1394 * Let's create a sub memory region for each possible peripheral. All 1395 * have a configurable memory segment in the overall flash mapping 1396 * window of the controller but, there is not necessarily a flash 1397 * module behind to handle the memory accesses. This depends on 1398 * the board configuration. 1399 */ 1400 for (i = 0; i < s->ctrl->max_peripherals; ++i) { 1401 AspeedSMCFlash *fl = &s->flashes[i]; 1402 1403 snprintf(name, sizeof(name), "%s.%d", s->ctrl->name, i); 1404 1405 fl->id = i; 1406 fl->controller = s; 1407 fl->size = s->ctrl->segments[i].size; 1408 memory_region_init_io(&fl->mmio, OBJECT(s), &aspeed_smc_flash_ops, 1409 fl, name, fl->size); 1410 memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio); 1411 offset += fl->size; 1412 } 1413 1414 /* DMA support */ 1415 if (s->ctrl->has_dma) { 1416 aspeed_smc_dma_setup(s, errp); 1417 } 1418 } 1419 1420 static const VMStateDescription vmstate_aspeed_smc = { 1421 .name = "aspeed.smc", 1422 .version_id = 2, 1423 .minimum_version_id = 2, 1424 .fields = (VMStateField[]) { 1425 VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX), 1426 VMSTATE_UINT8(snoop_index, AspeedSMCState), 1427 VMSTATE_UINT8(snoop_dummies, AspeedSMCState), 1428 VMSTATE_END_OF_LIST() 1429 } 1430 }; 1431 1432 static Property aspeed_smc_properties[] = { 1433 DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1), 1434 DEFINE_PROP_BOOL("inject-failure", AspeedSMCState, inject_failure, false), 1435 DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr, 1436 TYPE_MEMORY_REGION, MemoryRegion *), 1437 DEFINE_PROP_END_OF_LIST(), 1438 }; 1439 1440 static void aspeed_smc_class_init(ObjectClass *klass, void *data) 1441 { 1442 DeviceClass *dc = DEVICE_CLASS(klass); 1443 AspeedSMCClass *mc = ASPEED_SMC_CLASS(klass); 1444 1445 dc->realize = aspeed_smc_realize; 1446 dc->reset = aspeed_smc_reset; 1447 device_class_set_props(dc, aspeed_smc_properties); 1448 dc->vmsd = &vmstate_aspeed_smc; 1449 mc->ctrl = data; 1450 } 1451 1452 static const TypeInfo aspeed_smc_info = { 1453 .name = TYPE_ASPEED_SMC, 1454 .parent = TYPE_SYS_BUS_DEVICE, 1455 .instance_size = sizeof(AspeedSMCState), 1456 .class_size = sizeof(AspeedSMCClass), 1457 .abstract = true, 1458 }; 1459 1460 static void aspeed_smc_register_types(void) 1461 { 1462 int i; 1463 1464 type_register_static(&aspeed_smc_info); 1465 for (i = 0; i < ARRAY_SIZE(controllers); ++i) { 1466 TypeInfo ti = { 1467 .name = controllers[i].name, 1468 .parent = TYPE_ASPEED_SMC, 1469 .class_init = aspeed_smc_class_init, 1470 .class_data = (void *)&controllers[i], 1471 }; 1472 type_register(&ti); 1473 } 1474 } 1475 1476 type_init(aspeed_smc_register_types) 1477