xref: /openbmc/qemu/hw/ssi/xilinx_spips.c (revision 135b03cb)
1 /*
2  * QEMU model of the Xilinx Zynq SPI controller
3  *
4  * Copyright (c) 2012 Peter A. G. Crosthwaite
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "hw/sysbus.h"
27 #include "hw/irq.h"
28 #include "hw/ptimer.h"
29 #include "hw/qdev-properties.h"
30 #include "qemu/log.h"
31 #include "qemu/module.h"
32 #include "qemu/bitops.h"
33 #include "hw/ssi/xilinx_spips.h"
34 #include "qapi/error.h"
35 #include "hw/register.h"
36 #include "sysemu/dma.h"
37 #include "migration/blocker.h"
38 #include "migration/vmstate.h"
39 
40 #ifndef XILINX_SPIPS_ERR_DEBUG
41 #define XILINX_SPIPS_ERR_DEBUG 0
42 #endif
43 
44 #define DB_PRINT_L(level, ...) do { \
45     if (XILINX_SPIPS_ERR_DEBUG > (level)) { \
46         fprintf(stderr,  ": %s: ", __func__); \
47         fprintf(stderr, ## __VA_ARGS__); \
48     } \
49 } while (0)
50 
51 /* config register */
52 #define R_CONFIG            (0x00 / 4)
53 #define IFMODE              (1U << 31)
54 #define R_CONFIG_ENDIAN     (1 << 26)
55 #define MODEFAIL_GEN_EN     (1 << 17)
56 #define MAN_START_COM       (1 << 16)
57 #define MAN_START_EN        (1 << 15)
58 #define MANUAL_CS           (1 << 14)
59 #define CS                  (0xF << 10)
60 #define CS_SHIFT            (10)
61 #define PERI_SEL            (1 << 9)
62 #define REF_CLK             (1 << 8)
63 #define FIFO_WIDTH          (3 << 6)
64 #define BAUD_RATE_DIV       (7 << 3)
65 #define CLK_PH              (1 << 2)
66 #define CLK_POL             (1 << 1)
67 #define MODE_SEL            (1 << 0)
68 #define R_CONFIG_RSVD       (0x7bf40000)
69 
70 /* interrupt mechanism */
71 #define R_INTR_STATUS       (0x04 / 4)
72 #define R_INTR_STATUS_RESET (0x104)
73 #define R_INTR_EN           (0x08 / 4)
74 #define R_INTR_DIS          (0x0C / 4)
75 #define R_INTR_MASK         (0x10 / 4)
76 #define IXR_TX_FIFO_UNDERFLOW   (1 << 6)
77 /* Poll timeout not implemented */
78 #define IXR_RX_FIFO_EMPTY       (1 << 11)
79 #define IXR_GENERIC_FIFO_FULL   (1 << 10)
80 #define IXR_GENERIC_FIFO_NOT_FULL (1 << 9)
81 #define IXR_TX_FIFO_EMPTY       (1 << 8)
82 #define IXR_GENERIC_FIFO_EMPTY  (1 << 7)
83 #define IXR_RX_FIFO_FULL        (1 << 5)
84 #define IXR_RX_FIFO_NOT_EMPTY   (1 << 4)
85 #define IXR_TX_FIFO_FULL        (1 << 3)
86 #define IXR_TX_FIFO_NOT_FULL    (1 << 2)
87 #define IXR_TX_FIFO_MODE_FAIL   (1 << 1)
88 #define IXR_RX_FIFO_OVERFLOW    (1 << 0)
89 #define IXR_ALL                 ((1 << 13) - 1)
90 #define GQSPI_IXR_MASK          0xFBE
91 #define IXR_SELF_CLEAR \
92 (IXR_GENERIC_FIFO_EMPTY \
93 | IXR_GENERIC_FIFO_FULL  \
94 | IXR_GENERIC_FIFO_NOT_FULL \
95 | IXR_TX_FIFO_EMPTY \
96 | IXR_TX_FIFO_FULL  \
97 | IXR_TX_FIFO_NOT_FULL \
98 | IXR_RX_FIFO_EMPTY \
99 | IXR_RX_FIFO_FULL  \
100 | IXR_RX_FIFO_NOT_EMPTY)
101 
102 #define R_EN                (0x14 / 4)
103 #define R_DELAY             (0x18 / 4)
104 #define R_TX_DATA           (0x1C / 4)
105 #define R_RX_DATA           (0x20 / 4)
106 #define R_SLAVE_IDLE_COUNT  (0x24 / 4)
107 #define R_TX_THRES          (0x28 / 4)
108 #define R_RX_THRES          (0x2C / 4)
109 #define R_GPIO              (0x30 / 4)
110 #define R_LPBK_DLY_ADJ      (0x38 / 4)
111 #define R_LPBK_DLY_ADJ_RESET (0x33)
112 #define R_TXD1              (0x80 / 4)
113 #define R_TXD2              (0x84 / 4)
114 #define R_TXD3              (0x88 / 4)
115 
116 #define R_LQSPI_CFG         (0xa0 / 4)
117 #define R_LQSPI_CFG_RESET       0x03A002EB
118 #define LQSPI_CFG_LQ_MODE       (1U << 31)
119 #define LQSPI_CFG_TWO_MEM       (1 << 30)
120 #define LQSPI_CFG_SEP_BUS       (1 << 29)
121 #define LQSPI_CFG_U_PAGE        (1 << 28)
122 #define LQSPI_CFG_ADDR4         (1 << 27)
123 #define LQSPI_CFG_MODE_EN       (1 << 25)
124 #define LQSPI_CFG_MODE_WIDTH    8
125 #define LQSPI_CFG_MODE_SHIFT    16
126 #define LQSPI_CFG_DUMMY_WIDTH   3
127 #define LQSPI_CFG_DUMMY_SHIFT   8
128 #define LQSPI_CFG_INST_CODE     0xFF
129 
130 #define R_CMND        (0xc0 / 4)
131     #define R_CMND_RXFIFO_DRAIN   (1 << 19)
132     FIELD(CMND, PARTIAL_BYTE_LEN, 16, 3)
133 #define R_CMND_EXT_ADD        (1 << 15)
134     FIELD(CMND, RX_DISCARD, 8, 7)
135     FIELD(CMND, DUMMY_CYCLES, 2, 6)
136 #define R_CMND_DMA_EN         (1 << 1)
137 #define R_CMND_PUSH_WAIT      (1 << 0)
138 #define R_TRANSFER_SIZE     (0xc4 / 4)
139 #define R_LQSPI_STS         (0xA4 / 4)
140 #define LQSPI_STS_WR_RECVD      (1 << 1)
141 
142 #define R_MOD_ID            (0xFC / 4)
143 
144 #define R_GQSPI_SELECT          (0x144 / 4)
145     FIELD(GQSPI_SELECT, GENERIC_QSPI_EN, 0, 1)
146 #define R_GQSPI_ISR         (0x104 / 4)
147 #define R_GQSPI_IER         (0x108 / 4)
148 #define R_GQSPI_IDR         (0x10c / 4)
149 #define R_GQSPI_IMR         (0x110 / 4)
150 #define R_GQSPI_IMR_RESET   (0xfbe)
151 #define R_GQSPI_TX_THRESH   (0x128 / 4)
152 #define R_GQSPI_RX_THRESH   (0x12c / 4)
153 #define R_GQSPI_GPIO (0x130 / 4)
154 #define R_GQSPI_LPBK_DLY_ADJ (0x138 / 4)
155 #define R_GQSPI_LPBK_DLY_ADJ_RESET (0x33)
156 #define R_GQSPI_CNFG        (0x100 / 4)
157     FIELD(GQSPI_CNFG, MODE_EN, 30, 2)
158     FIELD(GQSPI_CNFG, GEN_FIFO_START_MODE, 29, 1)
159     FIELD(GQSPI_CNFG, GEN_FIFO_START, 28, 1)
160     FIELD(GQSPI_CNFG, ENDIAN, 26, 1)
161     /* Poll timeout not implemented */
162     FIELD(GQSPI_CNFG, EN_POLL_TIMEOUT, 20, 1)
163     /* QEMU doesnt care about any of these last three */
164     FIELD(GQSPI_CNFG, BR, 3, 3)
165     FIELD(GQSPI_CNFG, CPH, 2, 1)
166     FIELD(GQSPI_CNFG, CPL, 1, 1)
167 #define R_GQSPI_GEN_FIFO        (0x140 / 4)
168 #define R_GQSPI_TXD             (0x11c / 4)
169 #define R_GQSPI_RXD             (0x120 / 4)
170 #define R_GQSPI_FIFO_CTRL       (0x14c / 4)
171     FIELD(GQSPI_FIFO_CTRL, RX_FIFO_RESET, 2, 1)
172     FIELD(GQSPI_FIFO_CTRL, TX_FIFO_RESET, 1, 1)
173     FIELD(GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET, 0, 1)
174 #define R_GQSPI_GFIFO_THRESH    (0x150 / 4)
175 #define R_GQSPI_DATA_STS (0x15c / 4)
176 /* We use the snapshot register to hold the core state for the currently
177  * or most recently executed command. So the generic fifo format is defined
178  * for the snapshot register
179  */
180 #define R_GQSPI_GF_SNAPSHOT (0x160 / 4)
181     FIELD(GQSPI_GF_SNAPSHOT, POLL, 19, 1)
182     FIELD(GQSPI_GF_SNAPSHOT, STRIPE, 18, 1)
183     FIELD(GQSPI_GF_SNAPSHOT, RECIEVE, 17, 1)
184     FIELD(GQSPI_GF_SNAPSHOT, TRANSMIT, 16, 1)
185     FIELD(GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT, 14, 2)
186     FIELD(GQSPI_GF_SNAPSHOT, CHIP_SELECT, 12, 2)
187     FIELD(GQSPI_GF_SNAPSHOT, SPI_MODE, 10, 2)
188     FIELD(GQSPI_GF_SNAPSHOT, EXPONENT, 9, 1)
189     FIELD(GQSPI_GF_SNAPSHOT, DATA_XFER, 8, 1)
190     FIELD(GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA, 0, 8)
191 #define R_GQSPI_MOD_ID        (0x1fc / 4)
192 #define R_GQSPI_MOD_ID_RESET  (0x10a0000)
193 
194 #define R_QSPIDMA_DST_CTRL         (0x80c / 4)
195 #define R_QSPIDMA_DST_CTRL_RESET   (0x803ffa00)
196 #define R_QSPIDMA_DST_I_MASK       (0x820 / 4)
197 #define R_QSPIDMA_DST_I_MASK_RESET (0xfe)
198 #define R_QSPIDMA_DST_CTRL2        (0x824 / 4)
199 #define R_QSPIDMA_DST_CTRL2_RESET  (0x081bfff8)
200 
201 /* size of TXRX FIFOs */
202 #define RXFF_A          (128)
203 #define TXFF_A          (128)
204 
205 #define RXFF_A_Q          (64 * 4)
206 #define TXFF_A_Q          (64 * 4)
207 
208 /* 16MB per linear region */
209 #define LQSPI_ADDRESS_BITS 24
210 
211 #define SNOOP_CHECKING 0xFF
212 #define SNOOP_ADDR 0xF0
213 #define SNOOP_NONE 0xEE
214 #define SNOOP_STRIPING 0
215 
216 #define MIN_NUM_BUSSES 1
217 #define MAX_NUM_BUSSES 2
218 
219 static inline int num_effective_busses(XilinxSPIPS *s)
220 {
221     return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
222             s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM) ? s->num_busses : 1;
223 }
224 
225 static void xilinx_spips_update_cs(XilinxSPIPS *s, int field)
226 {
227     int i;
228 
229     for (i = 0; i < s->num_cs * s->num_busses; i++) {
230         bool old_state = s->cs_lines_state[i];
231         bool new_state = field & (1 << i);
232 
233         if (old_state != new_state) {
234             s->cs_lines_state[i] = new_state;
235             s->rx_discard = ARRAY_FIELD_EX32(s->regs, CMND, RX_DISCARD);
236             DB_PRINT_L(1, "%sselecting slave %d\n", new_state ? "" : "de", i);
237         }
238         qemu_set_irq(s->cs_lines[i], !new_state);
239     }
240     if (!(field & ((1 << (s->num_cs * s->num_busses)) - 1))) {
241         s->snoop_state = SNOOP_CHECKING;
242         s->cmd_dummies = 0;
243         s->link_state = 1;
244         s->link_state_next = 1;
245         s->link_state_next_when = 0;
246         DB_PRINT_L(1, "moving to snoop check state\n");
247     }
248 }
249 
250 static void xlnx_zynqmp_qspips_update_cs_lines(XlnxZynqMPQSPIPS *s)
251 {
252     if (s->regs[R_GQSPI_GF_SNAPSHOT]) {
253         int field = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, CHIP_SELECT);
254         bool upper_cs_sel = field & (1 << 1);
255         bool lower_cs_sel = field & 1;
256         bool bus0_enabled;
257         bool bus1_enabled;
258         uint8_t buses;
259         int cs = 0;
260 
261         buses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
262         bus0_enabled = buses & 1;
263         bus1_enabled = buses & (1 << 1);
264 
265         if (bus0_enabled && bus1_enabled) {
266             if (lower_cs_sel) {
267                 cs |= 1;
268             }
269             if (upper_cs_sel) {
270                 cs |= 1 << 3;
271             }
272         } else if (bus0_enabled) {
273             if (lower_cs_sel) {
274                 cs |= 1;
275             }
276             if (upper_cs_sel) {
277                 cs |= 1 << 1;
278             }
279         } else if (bus1_enabled) {
280             if (lower_cs_sel) {
281                 cs |= 1 << 2;
282             }
283             if (upper_cs_sel) {
284                 cs |= 1 << 3;
285             }
286         }
287         xilinx_spips_update_cs(XILINX_SPIPS(s), cs);
288     }
289 }
290 
291 static void xilinx_spips_update_cs_lines(XilinxSPIPS *s)
292 {
293     int field = ~((s->regs[R_CONFIG] & CS) >> CS_SHIFT);
294 
295     /* In dual parallel, mirror low CS to both */
296     if (num_effective_busses(s) == 2) {
297         /* Single bit chip-select for qspi */
298         field &= 0x1;
299         field |= field << 3;
300     /* Dual stack U-Page */
301     } else if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM &&
302                s->regs[R_LQSPI_STS] & LQSPI_CFG_U_PAGE) {
303         /* Single bit chip-select for qspi */
304         field &= 0x1;
305         /* change from CS0 to CS1 */
306         field <<= 1;
307     }
308     /* Auto CS */
309     if (!(s->regs[R_CONFIG] & MANUAL_CS) &&
310         fifo8_is_empty(&s->tx_fifo)) {
311         field = 0;
312     }
313     xilinx_spips_update_cs(s, field);
314 }
315 
316 static void xilinx_spips_update_ixr(XilinxSPIPS *s)
317 {
318     if (!(s->regs[R_LQSPI_CFG] & LQSPI_CFG_LQ_MODE)) {
319         s->regs[R_INTR_STATUS] &= ~IXR_SELF_CLEAR;
320         s->regs[R_INTR_STATUS] |=
321             (fifo8_is_full(&s->rx_fifo) ? IXR_RX_FIFO_FULL : 0) |
322             (s->rx_fifo.num >= s->regs[R_RX_THRES] ?
323                                     IXR_RX_FIFO_NOT_EMPTY : 0) |
324             (fifo8_is_full(&s->tx_fifo) ? IXR_TX_FIFO_FULL : 0) |
325             (fifo8_is_empty(&s->tx_fifo) ? IXR_TX_FIFO_EMPTY : 0) |
326             (s->tx_fifo.num < s->regs[R_TX_THRES] ? IXR_TX_FIFO_NOT_FULL : 0);
327     }
328     int new_irqline = !!(s->regs[R_INTR_MASK] & s->regs[R_INTR_STATUS] &
329                                                                 IXR_ALL);
330     if (new_irqline != s->irqline) {
331         s->irqline = new_irqline;
332         qemu_set_irq(s->irq, s->irqline);
333     }
334 }
335 
336 static void xlnx_zynqmp_qspips_update_ixr(XlnxZynqMPQSPIPS *s)
337 {
338     uint32_t gqspi_int;
339     int new_irqline;
340 
341     s->regs[R_GQSPI_ISR] &= ~IXR_SELF_CLEAR;
342     s->regs[R_GQSPI_ISR] |=
343         (fifo32_is_empty(&s->fifo_g) ? IXR_GENERIC_FIFO_EMPTY : 0) |
344         (fifo32_is_full(&s->fifo_g) ? IXR_GENERIC_FIFO_FULL : 0) |
345         (s->fifo_g.fifo.num < s->regs[R_GQSPI_GFIFO_THRESH] ?
346                                     IXR_GENERIC_FIFO_NOT_FULL : 0) |
347         (fifo8_is_empty(&s->rx_fifo_g) ? IXR_RX_FIFO_EMPTY : 0) |
348         (fifo8_is_full(&s->rx_fifo_g) ? IXR_RX_FIFO_FULL : 0) |
349         (s->rx_fifo_g.num >= s->regs[R_GQSPI_RX_THRESH] ?
350                                     IXR_RX_FIFO_NOT_EMPTY : 0) |
351         (fifo8_is_empty(&s->tx_fifo_g) ? IXR_TX_FIFO_EMPTY : 0) |
352         (fifo8_is_full(&s->tx_fifo_g) ? IXR_TX_FIFO_FULL : 0) |
353         (s->tx_fifo_g.num < s->regs[R_GQSPI_TX_THRESH] ?
354                                     IXR_TX_FIFO_NOT_FULL : 0);
355 
356     /* GQSPI Interrupt Trigger Status */
357     gqspi_int = (~s->regs[R_GQSPI_IMR]) & s->regs[R_GQSPI_ISR] & GQSPI_IXR_MASK;
358     new_irqline = !!(gqspi_int & IXR_ALL);
359 
360     /* drive external interrupt pin */
361     if (new_irqline != s->gqspi_irqline) {
362         s->gqspi_irqline = new_irqline;
363         qemu_set_irq(XILINX_SPIPS(s)->irq, s->gqspi_irqline);
364     }
365 }
366 
367 static void xilinx_spips_reset(DeviceState *d)
368 {
369     XilinxSPIPS *s = XILINX_SPIPS(d);
370 
371     memset(s->regs, 0, sizeof(s->regs));
372 
373     fifo8_reset(&s->rx_fifo);
374     fifo8_reset(&s->rx_fifo);
375     /* non zero resets */
376     s->regs[R_CONFIG] |= MODEFAIL_GEN_EN;
377     s->regs[R_SLAVE_IDLE_COUNT] = 0xFF;
378     s->regs[R_TX_THRES] = 1;
379     s->regs[R_RX_THRES] = 1;
380     /* FIXME: move magic number definition somewhere sensible */
381     s->regs[R_MOD_ID] = 0x01090106;
382     s->regs[R_LQSPI_CFG] = R_LQSPI_CFG_RESET;
383     s->link_state = 1;
384     s->link_state_next = 1;
385     s->link_state_next_when = 0;
386     s->snoop_state = SNOOP_CHECKING;
387     s->cmd_dummies = 0;
388     s->man_start_com = false;
389     xilinx_spips_update_ixr(s);
390     xilinx_spips_update_cs_lines(s);
391 }
392 
393 static void xlnx_zynqmp_qspips_reset(DeviceState *d)
394 {
395     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(d);
396 
397     xilinx_spips_reset(d);
398 
399     memset(s->regs, 0, sizeof(s->regs));
400 
401     fifo8_reset(&s->rx_fifo_g);
402     fifo8_reset(&s->rx_fifo_g);
403     fifo32_reset(&s->fifo_g);
404     s->regs[R_INTR_STATUS] = R_INTR_STATUS_RESET;
405     s->regs[R_GPIO] = 1;
406     s->regs[R_LPBK_DLY_ADJ] = R_LPBK_DLY_ADJ_RESET;
407     s->regs[R_GQSPI_GFIFO_THRESH] = 0x10;
408     s->regs[R_MOD_ID] = 0x01090101;
409     s->regs[R_GQSPI_IMR] = R_GQSPI_IMR_RESET;
410     s->regs[R_GQSPI_TX_THRESH] = 1;
411     s->regs[R_GQSPI_RX_THRESH] = 1;
412     s->regs[R_GQSPI_GPIO] = 1;
413     s->regs[R_GQSPI_LPBK_DLY_ADJ] = R_GQSPI_LPBK_DLY_ADJ_RESET;
414     s->regs[R_GQSPI_MOD_ID] = R_GQSPI_MOD_ID_RESET;
415     s->regs[R_QSPIDMA_DST_CTRL] = R_QSPIDMA_DST_CTRL_RESET;
416     s->regs[R_QSPIDMA_DST_I_MASK] = R_QSPIDMA_DST_I_MASK_RESET;
417     s->regs[R_QSPIDMA_DST_CTRL2] = R_QSPIDMA_DST_CTRL2_RESET;
418     s->man_start_com_g = false;
419     s->gqspi_irqline = 0;
420     xlnx_zynqmp_qspips_update_ixr(s);
421 }
422 
423 /* N way (num) in place bit striper. Lay out row wise bits (MSB to LSB)
424  * column wise (from element 0 to N-1). num is the length of x, and dir
425  * reverses the direction of the transform. Best illustrated by example:
426  * Each digit in the below array is a single bit (num == 3):
427  *
428  * {{ 76543210, }  ----- stripe (dir == false) -----> {{ 741gdaFC, }
429  *  { hgfedcba, }                                      { 630fcHEB, }
430  *  { HGFEDCBA, }} <---- upstripe (dir == true) -----  { 52hebGDA, }}
431  */
432 
433 static inline void stripe8(uint8_t *x, int num, bool dir)
434 {
435     uint8_t r[MAX_NUM_BUSSES];
436     int idx[2] = {0, 0};
437     int bit[2] = {0, 7};
438     int d = dir;
439 
440     assert(num <= MAX_NUM_BUSSES);
441     memset(r, 0, sizeof(uint8_t) * num);
442 
443     for (idx[0] = 0; idx[0] < num; ++idx[0]) {
444         for (bit[0] = 7; bit[0] >= 0; bit[0]--) {
445             r[idx[!d]] |= x[idx[d]] & 1 << bit[d] ? 1 << bit[!d] : 0;
446             idx[1] = (idx[1] + 1) % num;
447             if (!idx[1]) {
448                 bit[1]--;
449             }
450         }
451     }
452     memcpy(x, r, sizeof(uint8_t) * num);
453 }
454 
455 static void xlnx_zynqmp_qspips_flush_fifo_g(XlnxZynqMPQSPIPS *s)
456 {
457     while (s->regs[R_GQSPI_DATA_STS] || !fifo32_is_empty(&s->fifo_g)) {
458         uint8_t tx_rx[2] = { 0 };
459         int num_stripes = 1;
460         uint8_t busses;
461         int i;
462 
463         if (!s->regs[R_GQSPI_DATA_STS]) {
464             uint8_t imm;
465 
466             s->regs[R_GQSPI_GF_SNAPSHOT] = fifo32_pop(&s->fifo_g);
467             DB_PRINT_L(0, "GQSPI command: %x\n", s->regs[R_GQSPI_GF_SNAPSHOT]);
468             if (!s->regs[R_GQSPI_GF_SNAPSHOT]) {
469                 DB_PRINT_L(0, "Dummy GQSPI Delay Command Entry, Do nothing");
470                 continue;
471             }
472             xlnx_zynqmp_qspips_update_cs_lines(s);
473 
474             imm = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
475             if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
476                 /* immedate transfer */
477                 if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
478                     ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
479                     s->regs[R_GQSPI_DATA_STS] = 1;
480                 /* CS setup/hold - do nothing */
481                 } else {
482                     s->regs[R_GQSPI_DATA_STS] = 0;
483                 }
484             } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, EXPONENT)) {
485                 if (imm > 31) {
486                     qemu_log_mask(LOG_UNIMP, "QSPI exponential transfer too"
487                                   " long - 2 ^ %" PRId8 " requested\n", imm);
488                 }
489                 s->regs[R_GQSPI_DATA_STS] = 1ul << imm;
490             } else {
491                 s->regs[R_GQSPI_DATA_STS] = imm;
492             }
493         }
494         /* Zero length transfer check */
495         if (!s->regs[R_GQSPI_DATA_STS]) {
496             continue;
497         }
498         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE) &&
499             fifo8_is_full(&s->rx_fifo_g)) {
500             /* No space in RX fifo for transfer - try again later */
501             return;
502         }
503         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, STRIPE) &&
504             (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
505              ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE))) {
506             num_stripes = 2;
507         }
508         if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
509             tx_rx[0] = ARRAY_FIELD_EX32(s->regs,
510                                         GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
511         } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT)) {
512             for (i = 0; i < num_stripes; ++i) {
513                 if (!fifo8_is_empty(&s->tx_fifo_g)) {
514                     tx_rx[i] = fifo8_pop(&s->tx_fifo_g);
515                     s->tx_fifo_g_align++;
516                 } else {
517                     return;
518                 }
519             }
520         }
521         if (num_stripes == 1) {
522             /* mirror */
523             tx_rx[1] = tx_rx[0];
524         }
525         busses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
526         for (i = 0; i < 2; ++i) {
527             DB_PRINT_L(1, "bus %d tx = %02x\n", i, tx_rx[i]);
528             tx_rx[i] = ssi_transfer(XILINX_SPIPS(s)->spi[i], tx_rx[i]);
529             DB_PRINT_L(1, "bus %d rx = %02x\n", i, tx_rx[i]);
530         }
531         if (s->regs[R_GQSPI_DATA_STS] > 1 &&
532             busses == 0x3 && num_stripes == 2) {
533             s->regs[R_GQSPI_DATA_STS] -= 2;
534         } else if (s->regs[R_GQSPI_DATA_STS] > 0) {
535             s->regs[R_GQSPI_DATA_STS]--;
536         }
537         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
538             for (i = 0; i < 2; ++i) {
539                 if (busses & (1 << i)) {
540                     DB_PRINT_L(1, "bus %d push_byte = %02x\n", i, tx_rx[i]);
541                     fifo8_push(&s->rx_fifo_g, tx_rx[i]);
542                     s->rx_fifo_g_align++;
543                 }
544             }
545         }
546         if (!s->regs[R_GQSPI_DATA_STS]) {
547             for (; s->tx_fifo_g_align % 4; s->tx_fifo_g_align++) {
548                 fifo8_pop(&s->tx_fifo_g);
549             }
550             for (; s->rx_fifo_g_align % 4; s->rx_fifo_g_align++) {
551                 fifo8_push(&s->rx_fifo_g, 0);
552             }
553         }
554     }
555 }
556 
557 static int xilinx_spips_num_dummies(XilinxQSPIPS *qs, uint8_t command)
558 {
559     if (!qs) {
560         /* The SPI device is not a QSPI device */
561         return -1;
562     }
563 
564     switch (command) { /* check for dummies */
565     case READ: /* no dummy bytes/cycles */
566     case PP:
567     case DPP:
568     case QPP:
569     case READ_4:
570     case PP_4:
571     case QPP_4:
572         return 0;
573     case FAST_READ:
574     case DOR:
575     case QOR:
576     case DOR_4:
577     case QOR_4:
578         return 1;
579     case DIOR:
580     case FAST_READ_4:
581     case DIOR_4:
582         return 2;
583     case QIOR:
584     case QIOR_4:
585         return 4;
586     default:
587         return -1;
588     }
589 }
590 
591 static inline uint8_t get_addr_length(XilinxSPIPS *s, uint8_t cmd)
592 {
593    switch (cmd) {
594    case PP_4:
595    case QPP_4:
596    case READ_4:
597    case QIOR_4:
598    case FAST_READ_4:
599    case DOR_4:
600    case QOR_4:
601    case DIOR_4:
602        return 4;
603    default:
604        return (s->regs[R_CMND] & R_CMND_EXT_ADD) ? 4 : 3;
605    }
606 }
607 
608 static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
609 {
610     int debug_level = 0;
611     XilinxQSPIPS *q = (XilinxQSPIPS *) object_dynamic_cast(OBJECT(s),
612                                                            TYPE_XILINX_QSPIPS);
613 
614     for (;;) {
615         int i;
616         uint8_t tx = 0;
617         uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
618         uint8_t dummy_cycles = 0;
619         uint8_t addr_length;
620 
621         if (fifo8_is_empty(&s->tx_fifo)) {
622             xilinx_spips_update_ixr(s);
623             return;
624         } else if (s->snoop_state == SNOOP_STRIPING ||
625                    s->snoop_state == SNOOP_NONE) {
626             for (i = 0; i < num_effective_busses(s); ++i) {
627                 tx_rx[i] = fifo8_pop(&s->tx_fifo);
628             }
629             stripe8(tx_rx, num_effective_busses(s), false);
630         } else if (s->snoop_state >= SNOOP_ADDR) {
631             tx = fifo8_pop(&s->tx_fifo);
632             for (i = 0; i < num_effective_busses(s); ++i) {
633                 tx_rx[i] = tx;
634             }
635         } else {
636             /* Extract a dummy byte and generate dummy cycles according to the
637              * link state */
638             tx = fifo8_pop(&s->tx_fifo);
639             dummy_cycles = 8 / s->link_state;
640         }
641 
642         for (i = 0; i < num_effective_busses(s); ++i) {
643             int bus = num_effective_busses(s) - 1 - i;
644             if (dummy_cycles) {
645                 int d;
646                 for (d = 0; d < dummy_cycles; ++d) {
647                     tx_rx[0] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[0]);
648                 }
649             } else {
650                 DB_PRINT_L(debug_level, "tx = %02x\n", tx_rx[i]);
651                 tx_rx[i] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[i]);
652                 DB_PRINT_L(debug_level, "rx = %02x\n", tx_rx[i]);
653             }
654         }
655 
656         if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
657             DB_PRINT_L(debug_level, "dircarding drained rx byte\n");
658             /* Do nothing */
659         } else if (s->rx_discard) {
660             DB_PRINT_L(debug_level, "dircarding discarded rx byte\n");
661             s->rx_discard -= 8 / s->link_state;
662         } else if (fifo8_is_full(&s->rx_fifo)) {
663             s->regs[R_INTR_STATUS] |= IXR_RX_FIFO_OVERFLOW;
664             DB_PRINT_L(0, "rx FIFO overflow");
665         } else if (s->snoop_state == SNOOP_STRIPING) {
666             stripe8(tx_rx, num_effective_busses(s), true);
667             for (i = 0; i < num_effective_busses(s); ++i) {
668                 fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[i]);
669                 DB_PRINT_L(debug_level, "pushing striped rx byte\n");
670             }
671         } else {
672            DB_PRINT_L(debug_level, "pushing unstriped rx byte\n");
673            fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[0]);
674         }
675 
676         if (s->link_state_next_when) {
677             s->link_state_next_when--;
678             if (!s->link_state_next_when) {
679                 s->link_state = s->link_state_next;
680             }
681         }
682 
683         DB_PRINT_L(debug_level, "initial snoop state: %x\n",
684                    (unsigned)s->snoop_state);
685         switch (s->snoop_state) {
686         case (SNOOP_CHECKING):
687             /* Store the count of dummy bytes in the txfifo */
688             s->cmd_dummies = xilinx_spips_num_dummies(q, tx);
689             addr_length = get_addr_length(s, tx);
690             if (s->cmd_dummies < 0) {
691                 s->snoop_state = SNOOP_NONE;
692             } else {
693                 s->snoop_state = SNOOP_ADDR + addr_length - 1;
694             }
695             switch (tx) {
696             case DPP:
697             case DOR:
698             case DOR_4:
699                 s->link_state_next = 2;
700                 s->link_state_next_when = addr_length + s->cmd_dummies;
701                 break;
702             case QPP:
703             case QPP_4:
704             case QOR:
705             case QOR_4:
706                 s->link_state_next = 4;
707                 s->link_state_next_when = addr_length + s->cmd_dummies;
708                 break;
709             case DIOR:
710             case DIOR_4:
711                 s->link_state = 2;
712                 break;
713             case QIOR:
714             case QIOR_4:
715                 s->link_state = 4;
716                 break;
717             }
718             break;
719         case (SNOOP_ADDR):
720             /* Address has been transmitted, transmit dummy cycles now if
721              * needed */
722             if (s->cmd_dummies < 0) {
723                 s->snoop_state = SNOOP_NONE;
724             } else {
725                 s->snoop_state = s->cmd_dummies;
726             }
727             break;
728         case (SNOOP_STRIPING):
729         case (SNOOP_NONE):
730             /* Once we hit the boring stuff - squelch debug noise */
731             if (!debug_level) {
732                 DB_PRINT_L(0, "squelching debug info ....\n");
733                 debug_level = 1;
734             }
735             break;
736         default:
737             s->snoop_state--;
738         }
739         DB_PRINT_L(debug_level, "final snoop state: %x\n",
740                    (unsigned)s->snoop_state);
741     }
742 }
743 
744 static inline void tx_data_bytes(Fifo8 *fifo, uint32_t value, int num, bool be)
745 {
746     int i;
747     for (i = 0; i < num && !fifo8_is_full(fifo); ++i) {
748         if (be) {
749             fifo8_push(fifo, (uint8_t)(value >> 24));
750             value <<= 8;
751         } else {
752             fifo8_push(fifo, (uint8_t)value);
753             value >>= 8;
754         }
755     }
756 }
757 
758 static void xilinx_spips_check_zero_pump(XilinxSPIPS *s)
759 {
760     if (!s->regs[R_TRANSFER_SIZE]) {
761         return;
762     }
763     if (!fifo8_is_empty(&s->tx_fifo) && s->regs[R_CMND] & R_CMND_PUSH_WAIT) {
764         return;
765     }
766     /*
767      * The zero pump must never fill tx fifo such that rx overflow is
768      * possible
769      */
770     while (s->regs[R_TRANSFER_SIZE] &&
771            s->rx_fifo.num + s->tx_fifo.num < RXFF_A_Q - 3) {
772         /* endianess just doesn't matter when zero pumping */
773         tx_data_bytes(&s->tx_fifo, 0, 4, false);
774         s->regs[R_TRANSFER_SIZE] &= ~0x03ull;
775         s->regs[R_TRANSFER_SIZE] -= 4;
776     }
777 }
778 
779 static void xilinx_spips_check_flush(XilinxSPIPS *s)
780 {
781     if (s->man_start_com ||
782         (!fifo8_is_empty(&s->tx_fifo) &&
783          !(s->regs[R_CONFIG] & MAN_START_EN))) {
784         xilinx_spips_check_zero_pump(s);
785         xilinx_spips_flush_txfifo(s);
786     }
787     if (fifo8_is_empty(&s->tx_fifo) && !s->regs[R_TRANSFER_SIZE]) {
788         s->man_start_com = false;
789     }
790     xilinx_spips_update_ixr(s);
791 }
792 
793 static void xlnx_zynqmp_qspips_check_flush(XlnxZynqMPQSPIPS *s)
794 {
795     bool gqspi_has_work = s->regs[R_GQSPI_DATA_STS] ||
796                           !fifo32_is_empty(&s->fifo_g);
797 
798     if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
799         if (s->man_start_com_g || (gqspi_has_work &&
800              !ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE))) {
801             xlnx_zynqmp_qspips_flush_fifo_g(s);
802         }
803     } else {
804         xilinx_spips_check_flush(XILINX_SPIPS(s));
805     }
806     if (!gqspi_has_work) {
807         s->man_start_com_g = false;
808     }
809     xlnx_zynqmp_qspips_update_ixr(s);
810 }
811 
812 static inline int rx_data_bytes(Fifo8 *fifo, uint8_t *value, int max)
813 {
814     int i;
815 
816     for (i = 0; i < max && !fifo8_is_empty(fifo); ++i) {
817         value[i] = fifo8_pop(fifo);
818     }
819     return max - i;
820 }
821 
822 static const void *pop_buf(Fifo8 *fifo, uint32_t max, uint32_t *num)
823 {
824     void *ret;
825 
826     if (max == 0 || max > fifo->num) {
827         abort();
828     }
829     *num = MIN(fifo->capacity - fifo->head, max);
830     ret = &fifo->data[fifo->head];
831     fifo->head += *num;
832     fifo->head %= fifo->capacity;
833     fifo->num -= *num;
834     return ret;
835 }
836 
837 static void xlnx_zynqmp_qspips_notify(void *opaque)
838 {
839     XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(opaque);
840     XilinxSPIPS *s = XILINX_SPIPS(rq);
841     Fifo8 *recv_fifo;
842 
843     if (ARRAY_FIELD_EX32(rq->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
844         if (!(ARRAY_FIELD_EX32(rq->regs, GQSPI_CNFG, MODE_EN) == 2)) {
845             return;
846         }
847         recv_fifo = &rq->rx_fifo_g;
848     } else {
849         if (!(s->regs[R_CMND] & R_CMND_DMA_EN)) {
850             return;
851         }
852         recv_fifo = &s->rx_fifo;
853     }
854     while (recv_fifo->num >= 4
855            && stream_can_push(rq->dma, xlnx_zynqmp_qspips_notify, rq))
856     {
857         size_t ret;
858         uint32_t num;
859         const void *rxd;
860         int len;
861 
862         len = recv_fifo->num >= rq->dma_burst_size ? rq->dma_burst_size :
863                                                    recv_fifo->num;
864         rxd = pop_buf(recv_fifo, len, &num);
865 
866         memcpy(rq->dma_buf, rxd, num);
867 
868         ret = stream_push(rq->dma, rq->dma_buf, num);
869         assert(ret == num);
870         xlnx_zynqmp_qspips_check_flush(rq);
871     }
872 }
873 
874 static uint64_t xilinx_spips_read(void *opaque, hwaddr addr,
875                                                         unsigned size)
876 {
877     XilinxSPIPS *s = opaque;
878     uint32_t mask = ~0;
879     uint32_t ret;
880     uint8_t rx_buf[4];
881     int shortfall;
882 
883     addr >>= 2;
884     switch (addr) {
885     case R_CONFIG:
886         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
887         break;
888     case R_INTR_STATUS:
889         ret = s->regs[addr] & IXR_ALL;
890         s->regs[addr] = 0;
891         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
892         xilinx_spips_update_ixr(s);
893         return ret;
894     case R_INTR_MASK:
895         mask = IXR_ALL;
896         break;
897     case  R_EN:
898         mask = 0x1;
899         break;
900     case R_SLAVE_IDLE_COUNT:
901         mask = 0xFF;
902         break;
903     case R_MOD_ID:
904         mask = 0x01FFFFFF;
905         break;
906     case R_INTR_EN:
907     case R_INTR_DIS:
908     case R_TX_DATA:
909         mask = 0;
910         break;
911     case R_RX_DATA:
912         memset(rx_buf, 0, sizeof(rx_buf));
913         shortfall = rx_data_bytes(&s->rx_fifo, rx_buf, s->num_txrx_bytes);
914         ret = s->regs[R_CONFIG] & R_CONFIG_ENDIAN ?
915                         cpu_to_be32(*(uint32_t *)rx_buf) :
916                         cpu_to_le32(*(uint32_t *)rx_buf);
917         if (!(s->regs[R_CONFIG] & R_CONFIG_ENDIAN)) {
918             ret <<= 8 * shortfall;
919         }
920         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
921         xilinx_spips_check_flush(s);
922         xilinx_spips_update_ixr(s);
923         return ret;
924     }
925     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4,
926                s->regs[addr] & mask);
927     return s->regs[addr] & mask;
928 
929 }
930 
931 static uint64_t xlnx_zynqmp_qspips_read(void *opaque,
932                                         hwaddr addr, unsigned size)
933 {
934     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
935     uint32_t reg = addr / 4;
936     uint32_t ret;
937     uint8_t rx_buf[4];
938     int shortfall;
939 
940     if (reg <= R_MOD_ID) {
941         return xilinx_spips_read(opaque, addr, size);
942     } else {
943         switch (reg) {
944         case R_GQSPI_RXD:
945             if (fifo8_is_empty(&s->rx_fifo_g)) {
946                 qemu_log_mask(LOG_GUEST_ERROR,
947                               "Read from empty GQSPI RX FIFO\n");
948                 return 0;
949             }
950             memset(rx_buf, 0, sizeof(rx_buf));
951             shortfall = rx_data_bytes(&s->rx_fifo_g, rx_buf,
952                                       XILINX_SPIPS(s)->num_txrx_bytes);
953             ret = ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN) ?
954                   cpu_to_be32(*(uint32_t *)rx_buf) :
955                   cpu_to_le32(*(uint32_t *)rx_buf);
956             if (!ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN)) {
957                 ret <<= 8 * shortfall;
958             }
959             xlnx_zynqmp_qspips_check_flush(s);
960             xlnx_zynqmp_qspips_update_ixr(s);
961             return ret;
962         default:
963             return s->regs[reg];
964         }
965     }
966 }
967 
968 static void xilinx_spips_write(void *opaque, hwaddr addr,
969                                         uint64_t value, unsigned size)
970 {
971     int mask = ~0;
972     XilinxSPIPS *s = opaque;
973 
974     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr, (unsigned)value);
975     addr >>= 2;
976     switch (addr) {
977     case R_CONFIG:
978         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
979         if ((value & MAN_START_COM) && (s->regs[R_CONFIG] & MAN_START_EN)) {
980             s->man_start_com = true;
981         }
982         break;
983     case R_INTR_STATUS:
984         mask = IXR_ALL;
985         s->regs[R_INTR_STATUS] &= ~(mask & value);
986         goto no_reg_update;
987     case R_INTR_DIS:
988         mask = IXR_ALL;
989         s->regs[R_INTR_MASK] &= ~(mask & value);
990         goto no_reg_update;
991     case R_INTR_EN:
992         mask = IXR_ALL;
993         s->regs[R_INTR_MASK] |= mask & value;
994         goto no_reg_update;
995     case R_EN:
996         mask = 0x1;
997         break;
998     case R_SLAVE_IDLE_COUNT:
999         mask = 0xFF;
1000         break;
1001     case R_RX_DATA:
1002     case R_INTR_MASK:
1003     case R_MOD_ID:
1004         mask = 0;
1005         break;
1006     case R_TX_DATA:
1007         tx_data_bytes(&s->tx_fifo, (uint32_t)value, s->num_txrx_bytes,
1008                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1009         goto no_reg_update;
1010     case R_TXD1:
1011         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 1,
1012                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1013         goto no_reg_update;
1014     case R_TXD2:
1015         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 2,
1016                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1017         goto no_reg_update;
1018     case R_TXD3:
1019         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 3,
1020                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1021         goto no_reg_update;
1022     }
1023     s->regs[addr] = (s->regs[addr] & ~mask) | (value & mask);
1024 no_reg_update:
1025     xilinx_spips_update_cs_lines(s);
1026     xilinx_spips_check_flush(s);
1027     xilinx_spips_update_cs_lines(s);
1028     xilinx_spips_update_ixr(s);
1029 }
1030 
1031 static const MemoryRegionOps spips_ops = {
1032     .read = xilinx_spips_read,
1033     .write = xilinx_spips_write,
1034     .endianness = DEVICE_LITTLE_ENDIAN,
1035 };
1036 
1037 static void xilinx_qspips_invalidate_mmio_ptr(XilinxQSPIPS *q)
1038 {
1039     q->lqspi_cached_addr = ~0ULL;
1040 }
1041 
1042 static void xilinx_qspips_write(void *opaque, hwaddr addr,
1043                                 uint64_t value, unsigned size)
1044 {
1045     XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
1046     XilinxSPIPS *s = XILINX_SPIPS(opaque);
1047 
1048     xilinx_spips_write(opaque, addr, value, size);
1049     addr >>= 2;
1050 
1051     if (addr == R_LQSPI_CFG) {
1052         xilinx_qspips_invalidate_mmio_ptr(q);
1053     }
1054     if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
1055         fifo8_reset(&s->rx_fifo);
1056     }
1057 }
1058 
1059 static void xlnx_zynqmp_qspips_write(void *opaque, hwaddr addr,
1060                                         uint64_t value, unsigned size)
1061 {
1062     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
1063     uint32_t reg = addr / 4;
1064 
1065     if (reg <= R_MOD_ID) {
1066         xilinx_qspips_write(opaque, addr, value, size);
1067     } else {
1068         switch (reg) {
1069         case R_GQSPI_CNFG:
1070             if (FIELD_EX32(value, GQSPI_CNFG, GEN_FIFO_START) &&
1071                 ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE)) {
1072                 s->man_start_com_g = true;
1073             }
1074             s->regs[reg] = value & ~(R_GQSPI_CNFG_GEN_FIFO_START_MASK);
1075             break;
1076         case R_GQSPI_GEN_FIFO:
1077             if (!fifo32_is_full(&s->fifo_g)) {
1078                 fifo32_push(&s->fifo_g, value);
1079             }
1080             break;
1081         case R_GQSPI_TXD:
1082             tx_data_bytes(&s->tx_fifo_g, (uint32_t)value, 4,
1083                           ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN));
1084             break;
1085         case R_GQSPI_FIFO_CTRL:
1086             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET)) {
1087                 fifo32_reset(&s->fifo_g);
1088             }
1089             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, TX_FIFO_RESET)) {
1090                 fifo8_reset(&s->tx_fifo_g);
1091             }
1092             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, RX_FIFO_RESET)) {
1093                 fifo8_reset(&s->rx_fifo_g);
1094             }
1095             break;
1096         case R_GQSPI_IDR:
1097             s->regs[R_GQSPI_IMR] |= value;
1098             break;
1099         case R_GQSPI_IER:
1100             s->regs[R_GQSPI_IMR] &= ~value;
1101             break;
1102         case R_GQSPI_ISR:
1103             s->regs[R_GQSPI_ISR] &= ~value;
1104             break;
1105         case R_GQSPI_IMR:
1106         case R_GQSPI_RXD:
1107         case R_GQSPI_GF_SNAPSHOT:
1108         case R_GQSPI_MOD_ID:
1109             break;
1110         default:
1111             s->regs[reg] = value;
1112             break;
1113         }
1114         xlnx_zynqmp_qspips_update_cs_lines(s);
1115         xlnx_zynqmp_qspips_check_flush(s);
1116         xlnx_zynqmp_qspips_update_cs_lines(s);
1117         xlnx_zynqmp_qspips_update_ixr(s);
1118     }
1119     xlnx_zynqmp_qspips_notify(s);
1120 }
1121 
1122 static const MemoryRegionOps qspips_ops = {
1123     .read = xilinx_spips_read,
1124     .write = xilinx_qspips_write,
1125     .endianness = DEVICE_LITTLE_ENDIAN,
1126 };
1127 
1128 static const MemoryRegionOps xlnx_zynqmp_qspips_ops = {
1129     .read = xlnx_zynqmp_qspips_read,
1130     .write = xlnx_zynqmp_qspips_write,
1131     .endianness = DEVICE_LITTLE_ENDIAN,
1132 };
1133 
1134 #define LQSPI_CACHE_SIZE 1024
1135 
1136 static void lqspi_load_cache(void *opaque, hwaddr addr)
1137 {
1138     XilinxQSPIPS *q = opaque;
1139     XilinxSPIPS *s = opaque;
1140     int i;
1141     int flash_addr = ((addr & ~(LQSPI_CACHE_SIZE - 1))
1142                    / num_effective_busses(s));
1143     int slave = flash_addr >> LQSPI_ADDRESS_BITS;
1144     int cache_entry = 0;
1145     uint32_t u_page_save = s->regs[R_LQSPI_STS] & ~LQSPI_CFG_U_PAGE;
1146 
1147     if (addr < q->lqspi_cached_addr ||
1148             addr > q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1149         xilinx_qspips_invalidate_mmio_ptr(q);
1150         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1151         s->regs[R_LQSPI_STS] |= slave ? LQSPI_CFG_U_PAGE : 0;
1152 
1153         DB_PRINT_L(0, "config reg status: %08x\n", s->regs[R_LQSPI_CFG]);
1154 
1155         fifo8_reset(&s->tx_fifo);
1156         fifo8_reset(&s->rx_fifo);
1157 
1158         /* instruction */
1159         DB_PRINT_L(0, "pushing read instruction: %02x\n",
1160                    (unsigned)(uint8_t)(s->regs[R_LQSPI_CFG] &
1161                                        LQSPI_CFG_INST_CODE));
1162         fifo8_push(&s->tx_fifo, s->regs[R_LQSPI_CFG] & LQSPI_CFG_INST_CODE);
1163         /* read address */
1164         DB_PRINT_L(0, "pushing read address %06x\n", flash_addr);
1165         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_ADDR4) {
1166             fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 24));
1167         }
1168         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 16));
1169         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 8));
1170         fifo8_push(&s->tx_fifo, (uint8_t)flash_addr);
1171         /* mode bits */
1172         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_MODE_EN) {
1173             fifo8_push(&s->tx_fifo, extract32(s->regs[R_LQSPI_CFG],
1174                                               LQSPI_CFG_MODE_SHIFT,
1175                                               LQSPI_CFG_MODE_WIDTH));
1176         }
1177         /* dummy bytes */
1178         for (i = 0; i < (extract32(s->regs[R_LQSPI_CFG], LQSPI_CFG_DUMMY_SHIFT,
1179                                    LQSPI_CFG_DUMMY_WIDTH)); ++i) {
1180             DB_PRINT_L(0, "pushing dummy byte\n");
1181             fifo8_push(&s->tx_fifo, 0);
1182         }
1183         xilinx_spips_update_cs_lines(s);
1184         xilinx_spips_flush_txfifo(s);
1185         fifo8_reset(&s->rx_fifo);
1186 
1187         DB_PRINT_L(0, "starting QSPI data read\n");
1188 
1189         while (cache_entry < LQSPI_CACHE_SIZE) {
1190             for (i = 0; i < 64; ++i) {
1191                 tx_data_bytes(&s->tx_fifo, 0, 1, false);
1192             }
1193             xilinx_spips_flush_txfifo(s);
1194             for (i = 0; i < 64; ++i) {
1195                 rx_data_bytes(&s->rx_fifo, &q->lqspi_buf[cache_entry++], 1);
1196             }
1197         }
1198 
1199         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1200         s->regs[R_LQSPI_STS] |= u_page_save;
1201         xilinx_spips_update_cs_lines(s);
1202 
1203         q->lqspi_cached_addr = flash_addr * num_effective_busses(s);
1204     }
1205 }
1206 
1207 static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
1208                               unsigned size, MemTxAttrs attrs)
1209 {
1210     XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
1211 
1212     if (addr >= q->lqspi_cached_addr &&
1213             addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1214         uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
1215         *value = cpu_to_le32(*(uint32_t *)retp);
1216         DB_PRINT_L(1, "addr: %08" HWADDR_PRIx ", data: %08" PRIx64 "\n",
1217                    addr, *value);
1218         return MEMTX_OK;
1219     }
1220 
1221     lqspi_load_cache(opaque, addr);
1222     return lqspi_read(opaque, addr, value, size, attrs);
1223 }
1224 
1225 static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,
1226                                unsigned size, MemTxAttrs attrs)
1227 {
1228     /*
1229      * From UG1085, Chapter 24 (Quad-SPI controllers):
1230      * - Writes are ignored
1231      * - AXI writes generate an external AXI slave error (SLVERR)
1232      */
1233     qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64
1234                                    " (value: 0x%" PRIx64 "\n",
1235                   __func__, size << 3, offset, value);
1236 
1237     return MEMTX_ERROR;
1238 }
1239 
1240 static const MemoryRegionOps lqspi_ops = {
1241     .read_with_attrs = lqspi_read,
1242     .write_with_attrs = lqspi_write,
1243     .endianness = DEVICE_NATIVE_ENDIAN,
1244     .impl = {
1245         .min_access_size = 4,
1246         .max_access_size = 4,
1247     },
1248     .valid = {
1249         .min_access_size = 1,
1250         .max_access_size = 4
1251     }
1252 };
1253 
1254 static void xilinx_spips_realize(DeviceState *dev, Error **errp)
1255 {
1256     XilinxSPIPS *s = XILINX_SPIPS(dev);
1257     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1258     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1259     qemu_irq *cs;
1260     int i;
1261 
1262     DB_PRINT_L(0, "realized spips\n");
1263 
1264     if (s->num_busses > MAX_NUM_BUSSES) {
1265         error_setg(errp,
1266                    "requested number of SPI busses %u exceeds maximum %d",
1267                    s->num_busses, MAX_NUM_BUSSES);
1268         return;
1269     }
1270     if (s->num_busses < MIN_NUM_BUSSES) {
1271         error_setg(errp,
1272                    "requested number of SPI busses %u is below minimum %d",
1273                    s->num_busses, MIN_NUM_BUSSES);
1274         return;
1275     }
1276 
1277     s->spi = g_new(SSIBus *, s->num_busses);
1278     for (i = 0; i < s->num_busses; ++i) {
1279         char bus_name[16];
1280         snprintf(bus_name, 16, "spi%d", i);
1281         s->spi[i] = ssi_create_bus(dev, bus_name);
1282     }
1283 
1284     s->cs_lines = g_new0(qemu_irq, s->num_cs * s->num_busses);
1285     s->cs_lines_state = g_new0(bool, s->num_cs * s->num_busses);
1286     for (i = 0, cs = s->cs_lines; i < s->num_busses; ++i, cs += s->num_cs) {
1287         ssi_auto_connect_slaves(DEVICE(s), cs, s->spi[i]);
1288     }
1289 
1290     sysbus_init_irq(sbd, &s->irq);
1291     for (i = 0; i < s->num_cs * s->num_busses; ++i) {
1292         sysbus_init_irq(sbd, &s->cs_lines[i]);
1293     }
1294 
1295     memory_region_init_io(&s->iomem, OBJECT(s), xsc->reg_ops, s,
1296                           "spi", XLNX_ZYNQMP_SPIPS_R_MAX * 4);
1297     sysbus_init_mmio(sbd, &s->iomem);
1298 
1299     s->irqline = -1;
1300 
1301     fifo8_create(&s->rx_fifo, xsc->rx_fifo_size);
1302     fifo8_create(&s->tx_fifo, xsc->tx_fifo_size);
1303 }
1304 
1305 static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
1306 {
1307     XilinxSPIPS *s = XILINX_SPIPS(dev);
1308     XilinxQSPIPS *q = XILINX_QSPIPS(dev);
1309     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1310 
1311     DB_PRINT_L(0, "realized qspips\n");
1312 
1313     s->num_busses = 2;
1314     s->num_cs = 2;
1315     s->num_txrx_bytes = 4;
1316 
1317     xilinx_spips_realize(dev, errp);
1318     memory_region_init_io(&s->mmlqspi, OBJECT(s), &lqspi_ops, s, "lqspi",
1319                           (1 << LQSPI_ADDRESS_BITS) * 2);
1320     sysbus_init_mmio(sbd, &s->mmlqspi);
1321 
1322     q->lqspi_cached_addr = ~0ULL;
1323 }
1324 
1325 static void xlnx_zynqmp_qspips_realize(DeviceState *dev, Error **errp)
1326 {
1327     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(dev);
1328     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1329 
1330     if (s->dma_burst_size > QSPI_DMA_MAX_BURST_SIZE) {
1331         error_setg(errp,
1332                    "qspi dma burst size %u exceeds maximum limit %d",
1333                    s->dma_burst_size, QSPI_DMA_MAX_BURST_SIZE);
1334         return;
1335     }
1336     xilinx_qspips_realize(dev, errp);
1337     fifo8_create(&s->rx_fifo_g, xsc->rx_fifo_size);
1338     fifo8_create(&s->tx_fifo_g, xsc->tx_fifo_size);
1339     fifo32_create(&s->fifo_g, 32);
1340 }
1341 
1342 static void xlnx_zynqmp_qspips_init(Object *obj)
1343 {
1344     XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(obj);
1345 
1346     object_property_add_link(obj, "stream-connected-dma", TYPE_STREAM_SLAVE,
1347                              (Object **)&rq->dma,
1348                              object_property_allow_set_link,
1349                              OBJ_PROP_LINK_STRONG,
1350                              NULL);
1351 }
1352 
1353 static int xilinx_spips_post_load(void *opaque, int version_id)
1354 {
1355     xilinx_spips_update_ixr((XilinxSPIPS *)opaque);
1356     xilinx_spips_update_cs_lines((XilinxSPIPS *)opaque);
1357     return 0;
1358 }
1359 
1360 static const VMStateDescription vmstate_xilinx_spips = {
1361     .name = "xilinx_spips",
1362     .version_id = 2,
1363     .minimum_version_id = 2,
1364     .post_load = xilinx_spips_post_load,
1365     .fields = (VMStateField[]) {
1366         VMSTATE_FIFO8(tx_fifo, XilinxSPIPS),
1367         VMSTATE_FIFO8(rx_fifo, XilinxSPIPS),
1368         VMSTATE_UINT32_ARRAY(regs, XilinxSPIPS, XLNX_SPIPS_R_MAX),
1369         VMSTATE_UINT8(snoop_state, XilinxSPIPS),
1370         VMSTATE_END_OF_LIST()
1371     }
1372 };
1373 
1374 static int xlnx_zynqmp_qspips_post_load(void *opaque, int version_id)
1375 {
1376     XlnxZynqMPQSPIPS *s = (XlnxZynqMPQSPIPS *)opaque;
1377     XilinxSPIPS *qs = XILINX_SPIPS(s);
1378 
1379     if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN) &&
1380         fifo8_is_empty(&qs->rx_fifo) && fifo8_is_empty(&qs->tx_fifo)) {
1381         xlnx_zynqmp_qspips_update_ixr(s);
1382         xlnx_zynqmp_qspips_update_cs_lines(s);
1383     }
1384     return 0;
1385 }
1386 
1387 static const VMStateDescription vmstate_xilinx_qspips = {
1388     .name = "xilinx_qspips",
1389     .version_id = 1,
1390     .minimum_version_id = 1,
1391     .fields = (VMStateField[]) {
1392         VMSTATE_STRUCT(parent_obj, XilinxQSPIPS, 0,
1393                        vmstate_xilinx_spips, XilinxSPIPS),
1394         VMSTATE_END_OF_LIST()
1395     }
1396 };
1397 
1398 static const VMStateDescription vmstate_xlnx_zynqmp_qspips = {
1399     .name = "xlnx_zynqmp_qspips",
1400     .version_id = 1,
1401     .minimum_version_id = 1,
1402     .post_load = xlnx_zynqmp_qspips_post_load,
1403     .fields = (VMStateField[]) {
1404         VMSTATE_STRUCT(parent_obj, XlnxZynqMPQSPIPS, 0,
1405                        vmstate_xilinx_qspips, XilinxQSPIPS),
1406         VMSTATE_FIFO8(tx_fifo_g, XlnxZynqMPQSPIPS),
1407         VMSTATE_FIFO8(rx_fifo_g, XlnxZynqMPQSPIPS),
1408         VMSTATE_FIFO32(fifo_g, XlnxZynqMPQSPIPS),
1409         VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPQSPIPS, XLNX_ZYNQMP_SPIPS_R_MAX),
1410         VMSTATE_END_OF_LIST()
1411     }
1412 };
1413 
1414 static Property xilinx_zynqmp_qspips_properties[] = {
1415     DEFINE_PROP_UINT32("dma-burst-size", XlnxZynqMPQSPIPS, dma_burst_size, 64),
1416     DEFINE_PROP_END_OF_LIST(),
1417 };
1418 
1419 static Property xilinx_spips_properties[] = {
1420     DEFINE_PROP_UINT8("num-busses", XilinxSPIPS, num_busses, 1),
1421     DEFINE_PROP_UINT8("num-ss-bits", XilinxSPIPS, num_cs, 4),
1422     DEFINE_PROP_UINT8("num-txrx-bytes", XilinxSPIPS, num_txrx_bytes, 1),
1423     DEFINE_PROP_END_OF_LIST(),
1424 };
1425 
1426 static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
1427 {
1428     DeviceClass *dc = DEVICE_CLASS(klass);
1429     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1430 
1431     dc->realize = xilinx_qspips_realize;
1432     xsc->reg_ops = &qspips_ops;
1433     xsc->rx_fifo_size = RXFF_A_Q;
1434     xsc->tx_fifo_size = TXFF_A_Q;
1435 }
1436 
1437 static void xilinx_spips_class_init(ObjectClass *klass, void *data)
1438 {
1439     DeviceClass *dc = DEVICE_CLASS(klass);
1440     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1441 
1442     dc->realize = xilinx_spips_realize;
1443     dc->reset = xilinx_spips_reset;
1444     dc->props = xilinx_spips_properties;
1445     dc->vmsd = &vmstate_xilinx_spips;
1446 
1447     xsc->reg_ops = &spips_ops;
1448     xsc->rx_fifo_size = RXFF_A;
1449     xsc->tx_fifo_size = TXFF_A;
1450 }
1451 
1452 static void xlnx_zynqmp_qspips_class_init(ObjectClass *klass, void * data)
1453 {
1454     DeviceClass *dc = DEVICE_CLASS(klass);
1455     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1456 
1457     dc->realize = xlnx_zynqmp_qspips_realize;
1458     dc->reset = xlnx_zynqmp_qspips_reset;
1459     dc->vmsd = &vmstate_xlnx_zynqmp_qspips;
1460     dc->props = xilinx_zynqmp_qspips_properties;
1461     xsc->reg_ops = &xlnx_zynqmp_qspips_ops;
1462     xsc->rx_fifo_size = RXFF_A_Q;
1463     xsc->tx_fifo_size = TXFF_A_Q;
1464 }
1465 
1466 static const TypeInfo xilinx_spips_info = {
1467     .name  = TYPE_XILINX_SPIPS,
1468     .parent = TYPE_SYS_BUS_DEVICE,
1469     .instance_size  = sizeof(XilinxSPIPS),
1470     .class_init = xilinx_spips_class_init,
1471     .class_size = sizeof(XilinxSPIPSClass),
1472 };
1473 
1474 static const TypeInfo xilinx_qspips_info = {
1475     .name  = TYPE_XILINX_QSPIPS,
1476     .parent = TYPE_XILINX_SPIPS,
1477     .instance_size  = sizeof(XilinxQSPIPS),
1478     .class_init = xilinx_qspips_class_init,
1479 };
1480 
1481 static const TypeInfo xlnx_zynqmp_qspips_info = {
1482     .name  = TYPE_XLNX_ZYNQMP_QSPIPS,
1483     .parent = TYPE_XILINX_QSPIPS,
1484     .instance_size  = sizeof(XlnxZynqMPQSPIPS),
1485     .instance_init  = xlnx_zynqmp_qspips_init,
1486     .class_init = xlnx_zynqmp_qspips_class_init,
1487 };
1488 
1489 static void xilinx_spips_register_types(void)
1490 {
1491     type_register_static(&xilinx_spips_info);
1492     type_register_static(&xilinx_qspips_info);
1493     type_register_static(&xlnx_zynqmp_qspips_info);
1494 }
1495 
1496 type_init(xilinx_spips_register_types)
1497