xref: /openbmc/qemu/hw/ssi/xilinx_spips.c (revision 4fe6d78b)
1 /*
2  * QEMU model of the Xilinx Zynq SPI controller
3  *
4  * Copyright (c) 2012 Peter A. G. Crosthwaite
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "hw/sysbus.h"
27 #include "sysemu/sysemu.h"
28 #include "hw/ptimer.h"
29 #include "qemu/log.h"
30 #include "qemu/bitops.h"
31 #include "hw/ssi/xilinx_spips.h"
32 #include "qapi/error.h"
33 #include "hw/register.h"
34 #include "sysemu/dma.h"
35 #include "migration/blocker.h"
36 
37 #ifndef XILINX_SPIPS_ERR_DEBUG
38 #define XILINX_SPIPS_ERR_DEBUG 0
39 #endif
40 
41 #define DB_PRINT_L(level, ...) do { \
42     if (XILINX_SPIPS_ERR_DEBUG > (level)) { \
43         fprintf(stderr,  ": %s: ", __func__); \
44         fprintf(stderr, ## __VA_ARGS__); \
45     } \
46 } while (0)
47 
48 /* config register */
49 #define R_CONFIG            (0x00 / 4)
50 #define IFMODE              (1U << 31)
51 #define R_CONFIG_ENDIAN     (1 << 26)
52 #define MODEFAIL_GEN_EN     (1 << 17)
53 #define MAN_START_COM       (1 << 16)
54 #define MAN_START_EN        (1 << 15)
55 #define MANUAL_CS           (1 << 14)
56 #define CS                  (0xF << 10)
57 #define CS_SHIFT            (10)
58 #define PERI_SEL            (1 << 9)
59 #define REF_CLK             (1 << 8)
60 #define FIFO_WIDTH          (3 << 6)
61 #define BAUD_RATE_DIV       (7 << 3)
62 #define CLK_PH              (1 << 2)
63 #define CLK_POL             (1 << 1)
64 #define MODE_SEL            (1 << 0)
65 #define R_CONFIG_RSVD       (0x7bf40000)
66 
67 /* interrupt mechanism */
68 #define R_INTR_STATUS       (0x04 / 4)
69 #define R_INTR_STATUS_RESET (0x104)
70 #define R_INTR_EN           (0x08 / 4)
71 #define R_INTR_DIS          (0x0C / 4)
72 #define R_INTR_MASK         (0x10 / 4)
73 #define IXR_TX_FIFO_UNDERFLOW   (1 << 6)
74 /* Poll timeout not implemented */
75 #define IXR_RX_FIFO_EMPTY       (1 << 11)
76 #define IXR_GENERIC_FIFO_FULL   (1 << 10)
77 #define IXR_GENERIC_FIFO_NOT_FULL (1 << 9)
78 #define IXR_TX_FIFO_EMPTY       (1 << 8)
79 #define IXR_GENERIC_FIFO_EMPTY  (1 << 7)
80 #define IXR_RX_FIFO_FULL        (1 << 5)
81 #define IXR_RX_FIFO_NOT_EMPTY   (1 << 4)
82 #define IXR_TX_FIFO_FULL        (1 << 3)
83 #define IXR_TX_FIFO_NOT_FULL    (1 << 2)
84 #define IXR_TX_FIFO_MODE_FAIL   (1 << 1)
85 #define IXR_RX_FIFO_OVERFLOW    (1 << 0)
86 #define IXR_ALL                 ((1 << 13) - 1)
87 #define GQSPI_IXR_MASK          0xFBE
88 #define IXR_SELF_CLEAR \
89 (IXR_GENERIC_FIFO_EMPTY \
90 | IXR_GENERIC_FIFO_FULL  \
91 | IXR_GENERIC_FIFO_NOT_FULL \
92 | IXR_TX_FIFO_EMPTY \
93 | IXR_TX_FIFO_FULL  \
94 | IXR_TX_FIFO_NOT_FULL \
95 | IXR_RX_FIFO_EMPTY \
96 | IXR_RX_FIFO_FULL  \
97 | IXR_RX_FIFO_NOT_EMPTY)
98 
99 #define R_EN                (0x14 / 4)
100 #define R_DELAY             (0x18 / 4)
101 #define R_TX_DATA           (0x1C / 4)
102 #define R_RX_DATA           (0x20 / 4)
103 #define R_SLAVE_IDLE_COUNT  (0x24 / 4)
104 #define R_TX_THRES          (0x28 / 4)
105 #define R_RX_THRES          (0x2C / 4)
106 #define R_GPIO              (0x30 / 4)
107 #define R_LPBK_DLY_ADJ      (0x38 / 4)
108 #define R_LPBK_DLY_ADJ_RESET (0x33)
109 #define R_TXD1              (0x80 / 4)
110 #define R_TXD2              (0x84 / 4)
111 #define R_TXD3              (0x88 / 4)
112 
113 #define R_LQSPI_CFG         (0xa0 / 4)
114 #define R_LQSPI_CFG_RESET       0x03A002EB
115 #define LQSPI_CFG_LQ_MODE       (1U << 31)
116 #define LQSPI_CFG_TWO_MEM       (1 << 30)
117 #define LQSPI_CFG_SEP_BUS       (1 << 29)
118 #define LQSPI_CFG_U_PAGE        (1 << 28)
119 #define LQSPI_CFG_ADDR4         (1 << 27)
120 #define LQSPI_CFG_MODE_EN       (1 << 25)
121 #define LQSPI_CFG_MODE_WIDTH    8
122 #define LQSPI_CFG_MODE_SHIFT    16
123 #define LQSPI_CFG_DUMMY_WIDTH   3
124 #define LQSPI_CFG_DUMMY_SHIFT   8
125 #define LQSPI_CFG_INST_CODE     0xFF
126 
127 #define R_CMND        (0xc0 / 4)
128     #define R_CMND_RXFIFO_DRAIN   (1 << 19)
129     FIELD(CMND, PARTIAL_BYTE_LEN, 16, 3)
130 #define R_CMND_EXT_ADD        (1 << 15)
131     FIELD(CMND, RX_DISCARD, 8, 7)
132     FIELD(CMND, DUMMY_CYCLES, 2, 6)
133 #define R_CMND_DMA_EN         (1 << 1)
134 #define R_CMND_PUSH_WAIT      (1 << 0)
135 #define R_TRANSFER_SIZE     (0xc4 / 4)
136 #define R_LQSPI_STS         (0xA4 / 4)
137 #define LQSPI_STS_WR_RECVD      (1 << 1)
138 
139 #define R_MOD_ID            (0xFC / 4)
140 
141 #define R_GQSPI_SELECT          (0x144 / 4)
142     FIELD(GQSPI_SELECT, GENERIC_QSPI_EN, 0, 1)
143 #define R_GQSPI_ISR         (0x104 / 4)
144 #define R_GQSPI_IER         (0x108 / 4)
145 #define R_GQSPI_IDR         (0x10c / 4)
146 #define R_GQSPI_IMR         (0x110 / 4)
147 #define R_GQSPI_IMR_RESET   (0xfbe)
148 #define R_GQSPI_TX_THRESH   (0x128 / 4)
149 #define R_GQSPI_RX_THRESH   (0x12c / 4)
150 #define R_GQSPI_GPIO (0x130 / 4)
151 #define R_GQSPI_LPBK_DLY_ADJ (0x138 / 4)
152 #define R_GQSPI_LPBK_DLY_ADJ_RESET (0x33)
153 #define R_GQSPI_CNFG        (0x100 / 4)
154     FIELD(GQSPI_CNFG, MODE_EN, 30, 2)
155     FIELD(GQSPI_CNFG, GEN_FIFO_START_MODE, 29, 1)
156     FIELD(GQSPI_CNFG, GEN_FIFO_START, 28, 1)
157     FIELD(GQSPI_CNFG, ENDIAN, 26, 1)
158     /* Poll timeout not implemented */
159     FIELD(GQSPI_CNFG, EN_POLL_TIMEOUT, 20, 1)
160     /* QEMU doesnt care about any of these last three */
161     FIELD(GQSPI_CNFG, BR, 3, 3)
162     FIELD(GQSPI_CNFG, CPH, 2, 1)
163     FIELD(GQSPI_CNFG, CPL, 1, 1)
164 #define R_GQSPI_GEN_FIFO        (0x140 / 4)
165 #define R_GQSPI_TXD             (0x11c / 4)
166 #define R_GQSPI_RXD             (0x120 / 4)
167 #define R_GQSPI_FIFO_CTRL       (0x14c / 4)
168     FIELD(GQSPI_FIFO_CTRL, RX_FIFO_RESET, 2, 1)
169     FIELD(GQSPI_FIFO_CTRL, TX_FIFO_RESET, 1, 1)
170     FIELD(GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET, 0, 1)
171 #define R_GQSPI_GFIFO_THRESH    (0x150 / 4)
172 #define R_GQSPI_DATA_STS (0x15c / 4)
173 /* We use the snapshot register to hold the core state for the currently
174  * or most recently executed command. So the generic fifo format is defined
175  * for the snapshot register
176  */
177 #define R_GQSPI_GF_SNAPSHOT (0x160 / 4)
178     FIELD(GQSPI_GF_SNAPSHOT, POLL, 19, 1)
179     FIELD(GQSPI_GF_SNAPSHOT, STRIPE, 18, 1)
180     FIELD(GQSPI_GF_SNAPSHOT, RECIEVE, 17, 1)
181     FIELD(GQSPI_GF_SNAPSHOT, TRANSMIT, 16, 1)
182     FIELD(GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT, 14, 2)
183     FIELD(GQSPI_GF_SNAPSHOT, CHIP_SELECT, 12, 2)
184     FIELD(GQSPI_GF_SNAPSHOT, SPI_MODE, 10, 2)
185     FIELD(GQSPI_GF_SNAPSHOT, EXPONENT, 9, 1)
186     FIELD(GQSPI_GF_SNAPSHOT, DATA_XFER, 8, 1)
187     FIELD(GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA, 0, 8)
188 #define R_GQSPI_MOD_ID        (0x1fc / 4)
189 #define R_GQSPI_MOD_ID_RESET  (0x10a0000)
190 
191 #define R_QSPIDMA_DST_CTRL         (0x80c / 4)
192 #define R_QSPIDMA_DST_CTRL_RESET   (0x803ffa00)
193 #define R_QSPIDMA_DST_I_MASK       (0x820 / 4)
194 #define R_QSPIDMA_DST_I_MASK_RESET (0xfe)
195 #define R_QSPIDMA_DST_CTRL2        (0x824 / 4)
196 #define R_QSPIDMA_DST_CTRL2_RESET  (0x081bfff8)
197 
198 /* size of TXRX FIFOs */
199 #define RXFF_A          (128)
200 #define TXFF_A          (128)
201 
202 #define RXFF_A_Q          (64 * 4)
203 #define TXFF_A_Q          (64 * 4)
204 
205 /* 16MB per linear region */
206 #define LQSPI_ADDRESS_BITS 24
207 
208 #define SNOOP_CHECKING 0xFF
209 #define SNOOP_ADDR 0xF0
210 #define SNOOP_NONE 0xEE
211 #define SNOOP_STRIPING 0
212 
213 static inline int num_effective_busses(XilinxSPIPS *s)
214 {
215     return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
216             s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM) ? s->num_busses : 1;
217 }
218 
219 static void xilinx_spips_update_cs(XilinxSPIPS *s, int field)
220 {
221     int i;
222 
223     for (i = 0; i < s->num_cs; i++) {
224         bool old_state = s->cs_lines_state[i];
225         bool new_state = field & (1 << i);
226 
227         if (old_state != new_state) {
228             s->cs_lines_state[i] = new_state;
229             s->rx_discard = ARRAY_FIELD_EX32(s->regs, CMND, RX_DISCARD);
230             DB_PRINT_L(1, "%sselecting slave %d\n", new_state ? "" : "de", i);
231         }
232         qemu_set_irq(s->cs_lines[i], !new_state);
233     }
234     if (!(field & ((1 << s->num_cs) - 1))) {
235         s->snoop_state = SNOOP_CHECKING;
236         s->cmd_dummies = 0;
237         s->link_state = 1;
238         s->link_state_next = 1;
239         s->link_state_next_when = 0;
240         DB_PRINT_L(1, "moving to snoop check state\n");
241     }
242 }
243 
244 static void xlnx_zynqmp_qspips_update_cs_lines(XlnxZynqMPQSPIPS *s)
245 {
246     if (s->regs[R_GQSPI_GF_SNAPSHOT]) {
247         int field = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, CHIP_SELECT);
248         xilinx_spips_update_cs(XILINX_SPIPS(s), field);
249     }
250 }
251 
252 static void xilinx_spips_update_cs_lines(XilinxSPIPS *s)
253 {
254     int field = ~((s->regs[R_CONFIG] & CS) >> CS_SHIFT);
255 
256     /* In dual parallel, mirror low CS to both */
257     if (num_effective_busses(s) == 2) {
258         /* Single bit chip-select for qspi */
259         field &= 0x1;
260         field |= field << 1;
261     /* Dual stack U-Page */
262     } else if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM &&
263                s->regs[R_LQSPI_STS] & LQSPI_CFG_U_PAGE) {
264         /* Single bit chip-select for qspi */
265         field &= 0x1;
266         /* change from CS0 to CS1 */
267         field <<= 1;
268     }
269     /* Auto CS */
270     if (!(s->regs[R_CONFIG] & MANUAL_CS) &&
271         fifo8_is_empty(&s->tx_fifo)) {
272         field = 0;
273     }
274     xilinx_spips_update_cs(s, field);
275 }
276 
277 static void xilinx_spips_update_ixr(XilinxSPIPS *s)
278 {
279     if (!(s->regs[R_LQSPI_CFG] & LQSPI_CFG_LQ_MODE)) {
280         s->regs[R_INTR_STATUS] &= ~IXR_SELF_CLEAR;
281         s->regs[R_INTR_STATUS] |=
282             (fifo8_is_full(&s->rx_fifo) ? IXR_RX_FIFO_FULL : 0) |
283             (s->rx_fifo.num >= s->regs[R_RX_THRES] ?
284                                     IXR_RX_FIFO_NOT_EMPTY : 0) |
285             (fifo8_is_full(&s->tx_fifo) ? IXR_TX_FIFO_FULL : 0) |
286             (fifo8_is_empty(&s->tx_fifo) ? IXR_TX_FIFO_EMPTY : 0) |
287             (s->tx_fifo.num < s->regs[R_TX_THRES] ? IXR_TX_FIFO_NOT_FULL : 0);
288     }
289     int new_irqline = !!(s->regs[R_INTR_MASK] & s->regs[R_INTR_STATUS] &
290                                                                 IXR_ALL);
291     if (new_irqline != s->irqline) {
292         s->irqline = new_irqline;
293         qemu_set_irq(s->irq, s->irqline);
294     }
295 }
296 
297 static void xlnx_zynqmp_qspips_update_ixr(XlnxZynqMPQSPIPS *s)
298 {
299     uint32_t gqspi_int;
300     int new_irqline;
301 
302     s->regs[R_GQSPI_ISR] &= ~IXR_SELF_CLEAR;
303     s->regs[R_GQSPI_ISR] |=
304         (fifo32_is_empty(&s->fifo_g) ? IXR_GENERIC_FIFO_EMPTY : 0) |
305         (fifo32_is_full(&s->fifo_g) ? IXR_GENERIC_FIFO_FULL : 0) |
306         (s->fifo_g.fifo.num < s->regs[R_GQSPI_GFIFO_THRESH] ?
307                                     IXR_GENERIC_FIFO_NOT_FULL : 0) |
308         (fifo8_is_empty(&s->rx_fifo_g) ? IXR_RX_FIFO_EMPTY : 0) |
309         (fifo8_is_full(&s->rx_fifo_g) ? IXR_RX_FIFO_FULL : 0) |
310         (s->rx_fifo_g.num >= s->regs[R_GQSPI_RX_THRESH] ?
311                                     IXR_RX_FIFO_NOT_EMPTY : 0) |
312         (fifo8_is_empty(&s->tx_fifo_g) ? IXR_TX_FIFO_EMPTY : 0) |
313         (fifo8_is_full(&s->tx_fifo_g) ? IXR_TX_FIFO_FULL : 0) |
314         (s->tx_fifo_g.num < s->regs[R_GQSPI_TX_THRESH] ?
315                                     IXR_TX_FIFO_NOT_FULL : 0);
316 
317     /* GQSPI Interrupt Trigger Status */
318     gqspi_int = (~s->regs[R_GQSPI_IMR]) & s->regs[R_GQSPI_ISR] & GQSPI_IXR_MASK;
319     new_irqline = !!(gqspi_int & IXR_ALL);
320 
321     /* drive external interrupt pin */
322     if (new_irqline != s->gqspi_irqline) {
323         s->gqspi_irqline = new_irqline;
324         qemu_set_irq(XILINX_SPIPS(s)->irq, s->gqspi_irqline);
325     }
326 }
327 
328 static void xilinx_spips_reset(DeviceState *d)
329 {
330     XilinxSPIPS *s = XILINX_SPIPS(d);
331 
332     memset(s->regs, 0, sizeof(s->regs));
333 
334     fifo8_reset(&s->rx_fifo);
335     fifo8_reset(&s->rx_fifo);
336     /* non zero resets */
337     s->regs[R_CONFIG] |= MODEFAIL_GEN_EN;
338     s->regs[R_SLAVE_IDLE_COUNT] = 0xFF;
339     s->regs[R_TX_THRES] = 1;
340     s->regs[R_RX_THRES] = 1;
341     /* FIXME: move magic number definition somewhere sensible */
342     s->regs[R_MOD_ID] = 0x01090106;
343     s->regs[R_LQSPI_CFG] = R_LQSPI_CFG_RESET;
344     s->link_state = 1;
345     s->link_state_next = 1;
346     s->link_state_next_when = 0;
347     s->snoop_state = SNOOP_CHECKING;
348     s->cmd_dummies = 0;
349     s->man_start_com = false;
350     xilinx_spips_update_ixr(s);
351     xilinx_spips_update_cs_lines(s);
352 }
353 
354 static void xlnx_zynqmp_qspips_reset(DeviceState *d)
355 {
356     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(d);
357 
358     xilinx_spips_reset(d);
359 
360     memset(s->regs, 0, sizeof(s->regs));
361 
362     fifo8_reset(&s->rx_fifo_g);
363     fifo8_reset(&s->rx_fifo_g);
364     fifo32_reset(&s->fifo_g);
365     s->regs[R_INTR_STATUS] = R_INTR_STATUS_RESET;
366     s->regs[R_GPIO] = 1;
367     s->regs[R_LPBK_DLY_ADJ] = R_LPBK_DLY_ADJ_RESET;
368     s->regs[R_GQSPI_GFIFO_THRESH] = 0x10;
369     s->regs[R_MOD_ID] = 0x01090101;
370     s->regs[R_GQSPI_IMR] = R_GQSPI_IMR_RESET;
371     s->regs[R_GQSPI_TX_THRESH] = 1;
372     s->regs[R_GQSPI_RX_THRESH] = 1;
373     s->regs[R_GQSPI_GPIO] = 1;
374     s->regs[R_GQSPI_LPBK_DLY_ADJ] = R_GQSPI_LPBK_DLY_ADJ_RESET;
375     s->regs[R_GQSPI_MOD_ID] = R_GQSPI_MOD_ID_RESET;
376     s->regs[R_QSPIDMA_DST_CTRL] = R_QSPIDMA_DST_CTRL_RESET;
377     s->regs[R_QSPIDMA_DST_I_MASK] = R_QSPIDMA_DST_I_MASK_RESET;
378     s->regs[R_QSPIDMA_DST_CTRL2] = R_QSPIDMA_DST_CTRL2_RESET;
379     s->man_start_com_g = false;
380     s->gqspi_irqline = 0;
381     xlnx_zynqmp_qspips_update_ixr(s);
382 }
383 
384 /* N way (num) in place bit striper. Lay out row wise bits (MSB to LSB)
385  * column wise (from element 0 to N-1). num is the length of x, and dir
386  * reverses the direction of the transform. Best illustrated by example:
387  * Each digit in the below array is a single bit (num == 3):
388  *
389  * {{ 76543210, }  ----- stripe (dir == false) -----> {{ 741gdaFC, }
390  *  { hgfedcba, }                                      { 630fcHEB, }
391  *  { HGFEDCBA, }} <---- upstripe (dir == true) -----  { 52hebGDA, }}
392  */
393 
394 static inline void stripe8(uint8_t *x, int num, bool dir)
395 {
396     uint8_t r[num];
397     memset(r, 0, sizeof(uint8_t) * num);
398     int idx[2] = {0, 0};
399     int bit[2] = {0, 7};
400     int d = dir;
401 
402     for (idx[0] = 0; idx[0] < num; ++idx[0]) {
403         for (bit[0] = 7; bit[0] >= 0; bit[0]--) {
404             r[idx[!d]] |= x[idx[d]] & 1 << bit[d] ? 1 << bit[!d] : 0;
405             idx[1] = (idx[1] + 1) % num;
406             if (!idx[1]) {
407                 bit[1]--;
408             }
409         }
410     }
411     memcpy(x, r, sizeof(uint8_t) * num);
412 }
413 
414 static void xlnx_zynqmp_qspips_flush_fifo_g(XlnxZynqMPQSPIPS *s)
415 {
416     while (s->regs[R_GQSPI_DATA_STS] || !fifo32_is_empty(&s->fifo_g)) {
417         uint8_t tx_rx[2] = { 0 };
418         int num_stripes = 1;
419         uint8_t busses;
420         int i;
421 
422         if (!s->regs[R_GQSPI_DATA_STS]) {
423             uint8_t imm;
424 
425             s->regs[R_GQSPI_GF_SNAPSHOT] = fifo32_pop(&s->fifo_g);
426             DB_PRINT_L(0, "GQSPI command: %x\n", s->regs[R_GQSPI_GF_SNAPSHOT]);
427             if (!s->regs[R_GQSPI_GF_SNAPSHOT]) {
428                 DB_PRINT_L(0, "Dummy GQSPI Delay Command Entry, Do nothing");
429                 continue;
430             }
431             xlnx_zynqmp_qspips_update_cs_lines(s);
432 
433             imm = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
434             if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
435                 /* immedate transfer */
436                 if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
437                     ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
438                     s->regs[R_GQSPI_DATA_STS] = 1;
439                 /* CS setup/hold - do nothing */
440                 } else {
441                     s->regs[R_GQSPI_DATA_STS] = 0;
442                 }
443             } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, EXPONENT)) {
444                 if (imm > 31) {
445                     qemu_log_mask(LOG_UNIMP, "QSPI exponential transfer too"
446                                   " long - 2 ^ %" PRId8 " requested\n", imm);
447                 }
448                 s->regs[R_GQSPI_DATA_STS] = 1ul << imm;
449             } else {
450                 s->regs[R_GQSPI_DATA_STS] = imm;
451             }
452         }
453         /* Zero length transfer check */
454         if (!s->regs[R_GQSPI_DATA_STS]) {
455             continue;
456         }
457         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE) &&
458             fifo8_is_full(&s->rx_fifo_g)) {
459             /* No space in RX fifo for transfer - try again later */
460             return;
461         }
462         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, STRIPE) &&
463             (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
464              ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE))) {
465             num_stripes = 2;
466         }
467         if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
468             tx_rx[0] = ARRAY_FIELD_EX32(s->regs,
469                                         GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
470         } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT)) {
471             for (i = 0; i < num_stripes; ++i) {
472                 if (!fifo8_is_empty(&s->tx_fifo_g)) {
473                     tx_rx[i] = fifo8_pop(&s->tx_fifo_g);
474                     s->tx_fifo_g_align++;
475                 } else {
476                     return;
477                 }
478             }
479         }
480         if (num_stripes == 1) {
481             /* mirror */
482             tx_rx[1] = tx_rx[0];
483         }
484         busses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
485         for (i = 0; i < 2; ++i) {
486             DB_PRINT_L(1, "bus %d tx = %02x\n", i, tx_rx[i]);
487             tx_rx[i] = ssi_transfer(XILINX_SPIPS(s)->spi[i], tx_rx[i]);
488             DB_PRINT_L(1, "bus %d rx = %02x\n", i, tx_rx[i]);
489         }
490         if (s->regs[R_GQSPI_DATA_STS] > 1 &&
491             busses == 0x3 && num_stripes == 2) {
492             s->regs[R_GQSPI_DATA_STS] -= 2;
493         } else if (s->regs[R_GQSPI_DATA_STS] > 0) {
494             s->regs[R_GQSPI_DATA_STS]--;
495         }
496         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
497             for (i = 0; i < 2; ++i) {
498                 if (busses & (1 << i)) {
499                     DB_PRINT_L(1, "bus %d push_byte = %02x\n", i, tx_rx[i]);
500                     fifo8_push(&s->rx_fifo_g, tx_rx[i]);
501                     s->rx_fifo_g_align++;
502                 }
503             }
504         }
505         if (!s->regs[R_GQSPI_DATA_STS]) {
506             for (; s->tx_fifo_g_align % 4; s->tx_fifo_g_align++) {
507                 fifo8_pop(&s->tx_fifo_g);
508             }
509             for (; s->rx_fifo_g_align % 4; s->rx_fifo_g_align++) {
510                 fifo8_push(&s->rx_fifo_g, 0);
511             }
512         }
513     }
514 }
515 
516 static int xilinx_spips_num_dummies(XilinxQSPIPS *qs, uint8_t command)
517 {
518     if (!qs) {
519         /* The SPI device is not a QSPI device */
520         return -1;
521     }
522 
523     switch (command) { /* check for dummies */
524     case READ: /* no dummy bytes/cycles */
525     case PP:
526     case DPP:
527     case QPP:
528     case READ_4:
529     case PP_4:
530     case QPP_4:
531         return 0;
532     case FAST_READ:
533     case DOR:
534     case QOR:
535     case DOR_4:
536     case QOR_4:
537         return 1;
538     case DIOR:
539     case FAST_READ_4:
540     case DIOR_4:
541         return 2;
542     case QIOR:
543     case QIOR_4:
544         return 5;
545     default:
546         return -1;
547     }
548 }
549 
550 static inline uint8_t get_addr_length(XilinxSPIPS *s, uint8_t cmd)
551 {
552    switch (cmd) {
553    case PP_4:
554    case QPP_4:
555    case READ_4:
556    case QIOR_4:
557    case FAST_READ_4:
558    case DOR_4:
559    case QOR_4:
560    case DIOR_4:
561        return 4;
562    default:
563        return (s->regs[R_CMND] & R_CMND_EXT_ADD) ? 4 : 3;
564    }
565 }
566 
567 static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
568 {
569     int debug_level = 0;
570     XilinxQSPIPS *q = (XilinxQSPIPS *) object_dynamic_cast(OBJECT(s),
571                                                            TYPE_XILINX_QSPIPS);
572 
573     for (;;) {
574         int i;
575         uint8_t tx = 0;
576         uint8_t tx_rx[num_effective_busses(s)];
577         uint8_t dummy_cycles = 0;
578         uint8_t addr_length;
579 
580         if (fifo8_is_empty(&s->tx_fifo)) {
581             xilinx_spips_update_ixr(s);
582             return;
583         } else if (s->snoop_state == SNOOP_STRIPING) {
584             for (i = 0; i < num_effective_busses(s); ++i) {
585                 tx_rx[i] = fifo8_pop(&s->tx_fifo);
586             }
587             stripe8(tx_rx, num_effective_busses(s), false);
588         } else if (s->snoop_state >= SNOOP_ADDR) {
589             tx = fifo8_pop(&s->tx_fifo);
590             for (i = 0; i < num_effective_busses(s); ++i) {
591                 tx_rx[i] = tx;
592             }
593         } else {
594             /* Extract a dummy byte and generate dummy cycles according to the
595              * link state */
596             tx = fifo8_pop(&s->tx_fifo);
597             dummy_cycles = 8 / s->link_state;
598         }
599 
600         for (i = 0; i < num_effective_busses(s); ++i) {
601             int bus = num_effective_busses(s) - 1 - i;
602             if (dummy_cycles) {
603                 int d;
604                 for (d = 0; d < dummy_cycles; ++d) {
605                     tx_rx[0] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[0]);
606                 }
607             } else {
608                 DB_PRINT_L(debug_level, "tx = %02x\n", tx_rx[i]);
609                 tx_rx[i] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[i]);
610                 DB_PRINT_L(debug_level, "rx = %02x\n", tx_rx[i]);
611             }
612         }
613 
614         if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
615             DB_PRINT_L(debug_level, "dircarding drained rx byte\n");
616             /* Do nothing */
617         } else if (s->rx_discard) {
618             DB_PRINT_L(debug_level, "dircarding discarded rx byte\n");
619             s->rx_discard -= 8 / s->link_state;
620         } else if (fifo8_is_full(&s->rx_fifo)) {
621             s->regs[R_INTR_STATUS] |= IXR_RX_FIFO_OVERFLOW;
622             DB_PRINT_L(0, "rx FIFO overflow");
623         } else if (s->snoop_state == SNOOP_STRIPING) {
624             stripe8(tx_rx, num_effective_busses(s), true);
625             for (i = 0; i < num_effective_busses(s); ++i) {
626                 fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[i]);
627                 DB_PRINT_L(debug_level, "pushing striped rx byte\n");
628             }
629         } else {
630            DB_PRINT_L(debug_level, "pushing unstriped rx byte\n");
631            fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[0]);
632         }
633 
634         if (s->link_state_next_when) {
635             s->link_state_next_when--;
636             if (!s->link_state_next_when) {
637                 s->link_state = s->link_state_next;
638             }
639         }
640 
641         DB_PRINT_L(debug_level, "initial snoop state: %x\n",
642                    (unsigned)s->snoop_state);
643         switch (s->snoop_state) {
644         case (SNOOP_CHECKING):
645             /* Store the count of dummy bytes in the txfifo */
646             s->cmd_dummies = xilinx_spips_num_dummies(q, tx);
647             addr_length = get_addr_length(s, tx);
648             if (s->cmd_dummies < 0) {
649                 s->snoop_state = SNOOP_NONE;
650             } else {
651                 s->snoop_state = SNOOP_ADDR + addr_length - 1;
652             }
653             switch (tx) {
654             case DPP:
655             case DOR:
656             case DOR_4:
657                 s->link_state_next = 2;
658                 s->link_state_next_when = addr_length + s->cmd_dummies;
659                 break;
660             case QPP:
661             case QPP_4:
662             case QOR:
663             case QOR_4:
664                 s->link_state_next = 4;
665                 s->link_state_next_when = addr_length + s->cmd_dummies;
666                 break;
667             case DIOR:
668             case DIOR_4:
669                 s->link_state = 2;
670                 break;
671             case QIOR:
672             case QIOR_4:
673                 s->link_state = 4;
674                 break;
675             }
676             break;
677         case (SNOOP_ADDR):
678             /* Address has been transmitted, transmit dummy cycles now if
679              * needed */
680             if (s->cmd_dummies < 0) {
681                 s->snoop_state = SNOOP_NONE;
682             } else {
683                 s->snoop_state = s->cmd_dummies;
684             }
685             break;
686         case (SNOOP_STRIPING):
687         case (SNOOP_NONE):
688             /* Once we hit the boring stuff - squelch debug noise */
689             if (!debug_level) {
690                 DB_PRINT_L(0, "squelching debug info ....\n");
691                 debug_level = 1;
692             }
693             break;
694         default:
695             s->snoop_state--;
696         }
697         DB_PRINT_L(debug_level, "final snoop state: %x\n",
698                    (unsigned)s->snoop_state);
699     }
700 }
701 
702 static inline void tx_data_bytes(Fifo8 *fifo, uint32_t value, int num, bool be)
703 {
704     int i;
705     for (i = 0; i < num && !fifo8_is_full(fifo); ++i) {
706         if (be) {
707             fifo8_push(fifo, (uint8_t)(value >> 24));
708             value <<= 8;
709         } else {
710             fifo8_push(fifo, (uint8_t)value);
711             value >>= 8;
712         }
713     }
714 }
715 
716 static void xilinx_spips_check_zero_pump(XilinxSPIPS *s)
717 {
718     if (!s->regs[R_TRANSFER_SIZE]) {
719         return;
720     }
721     if (!fifo8_is_empty(&s->tx_fifo) && s->regs[R_CMND] & R_CMND_PUSH_WAIT) {
722         return;
723     }
724     /*
725      * The zero pump must never fill tx fifo such that rx overflow is
726      * possible
727      */
728     while (s->regs[R_TRANSFER_SIZE] &&
729            s->rx_fifo.num + s->tx_fifo.num < RXFF_A_Q - 3) {
730         /* endianess just doesn't matter when zero pumping */
731         tx_data_bytes(&s->tx_fifo, 0, 4, false);
732         s->regs[R_TRANSFER_SIZE] &= ~0x03ull;
733         s->regs[R_TRANSFER_SIZE] -= 4;
734     }
735 }
736 
737 static void xilinx_spips_check_flush(XilinxSPIPS *s)
738 {
739     if (s->man_start_com ||
740         (!fifo8_is_empty(&s->tx_fifo) &&
741          !(s->regs[R_CONFIG] & MAN_START_EN))) {
742         xilinx_spips_check_zero_pump(s);
743         xilinx_spips_flush_txfifo(s);
744     }
745     if (fifo8_is_empty(&s->tx_fifo) && !s->regs[R_TRANSFER_SIZE]) {
746         s->man_start_com = false;
747     }
748     xilinx_spips_update_ixr(s);
749 }
750 
751 static void xlnx_zynqmp_qspips_check_flush(XlnxZynqMPQSPIPS *s)
752 {
753     bool gqspi_has_work = s->regs[R_GQSPI_DATA_STS] ||
754                           !fifo32_is_empty(&s->fifo_g);
755 
756     if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
757         if (s->man_start_com_g || (gqspi_has_work &&
758              !ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE))) {
759             xlnx_zynqmp_qspips_flush_fifo_g(s);
760         }
761     } else {
762         xilinx_spips_check_flush(XILINX_SPIPS(s));
763     }
764     if (!gqspi_has_work) {
765         s->man_start_com_g = false;
766     }
767     xlnx_zynqmp_qspips_update_ixr(s);
768 }
769 
770 static inline int rx_data_bytes(Fifo8 *fifo, uint8_t *value, int max)
771 {
772     int i;
773 
774     for (i = 0; i < max && !fifo8_is_empty(fifo); ++i) {
775         value[i] = fifo8_pop(fifo);
776     }
777     return max - i;
778 }
779 
780 static const void *pop_buf(Fifo8 *fifo, uint32_t max, uint32_t *num)
781 {
782     void *ret;
783 
784     if (max == 0 || max > fifo->num) {
785         abort();
786     }
787     *num = MIN(fifo->capacity - fifo->head, max);
788     ret = &fifo->data[fifo->head];
789     fifo->head += *num;
790     fifo->head %= fifo->capacity;
791     fifo->num -= *num;
792     return ret;
793 }
794 
795 static void xlnx_zynqmp_qspips_notify(void *opaque)
796 {
797     XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(opaque);
798     XilinxSPIPS *s = XILINX_SPIPS(rq);
799     Fifo8 *recv_fifo;
800 
801     if (ARRAY_FIELD_EX32(rq->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
802         if (!(ARRAY_FIELD_EX32(rq->regs, GQSPI_CNFG, MODE_EN) == 2)) {
803             return;
804         }
805         recv_fifo = &rq->rx_fifo_g;
806     } else {
807         if (!(s->regs[R_CMND] & R_CMND_DMA_EN)) {
808             return;
809         }
810         recv_fifo = &s->rx_fifo;
811     }
812     while (recv_fifo->num >= 4
813            && stream_can_push(rq->dma, xlnx_zynqmp_qspips_notify, rq))
814     {
815         size_t ret;
816         uint32_t num;
817         const void *rxd = pop_buf(recv_fifo, 4, &num);
818 
819         memcpy(rq->dma_buf, rxd, num);
820 
821         ret = stream_push(rq->dma, rq->dma_buf, 4);
822         assert(ret == 4);
823         xlnx_zynqmp_qspips_check_flush(rq);
824     }
825 }
826 
827 static uint64_t xilinx_spips_read(void *opaque, hwaddr addr,
828                                                         unsigned size)
829 {
830     XilinxSPIPS *s = opaque;
831     uint32_t mask = ~0;
832     uint32_t ret;
833     uint8_t rx_buf[4];
834     int shortfall;
835 
836     addr >>= 2;
837     switch (addr) {
838     case R_CONFIG:
839         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
840         break;
841     case R_INTR_STATUS:
842         ret = s->regs[addr] & IXR_ALL;
843         s->regs[addr] = 0;
844         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
845         xilinx_spips_update_ixr(s);
846         return ret;
847     case R_INTR_MASK:
848         mask = IXR_ALL;
849         break;
850     case  R_EN:
851         mask = 0x1;
852         break;
853     case R_SLAVE_IDLE_COUNT:
854         mask = 0xFF;
855         break;
856     case R_MOD_ID:
857         mask = 0x01FFFFFF;
858         break;
859     case R_INTR_EN:
860     case R_INTR_DIS:
861     case R_TX_DATA:
862         mask = 0;
863         break;
864     case R_RX_DATA:
865         memset(rx_buf, 0, sizeof(rx_buf));
866         shortfall = rx_data_bytes(&s->rx_fifo, rx_buf, s->num_txrx_bytes);
867         ret = s->regs[R_CONFIG] & R_CONFIG_ENDIAN ?
868                         cpu_to_be32(*(uint32_t *)rx_buf) :
869                         cpu_to_le32(*(uint32_t *)rx_buf);
870         if (!(s->regs[R_CONFIG] & R_CONFIG_ENDIAN)) {
871             ret <<= 8 * shortfall;
872         }
873         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
874         xilinx_spips_check_flush(s);
875         xilinx_spips_update_ixr(s);
876         return ret;
877     }
878     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4,
879                s->regs[addr] & mask);
880     return s->regs[addr] & mask;
881 
882 }
883 
884 static uint64_t xlnx_zynqmp_qspips_read(void *opaque,
885                                         hwaddr addr, unsigned size)
886 {
887     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
888     uint32_t reg = addr / 4;
889     uint32_t ret;
890     uint8_t rx_buf[4];
891     int shortfall;
892 
893     if (reg <= R_MOD_ID) {
894         return xilinx_spips_read(opaque, addr, size);
895     } else {
896         switch (reg) {
897         case R_GQSPI_RXD:
898             if (fifo8_is_empty(&s->rx_fifo_g)) {
899                 qemu_log_mask(LOG_GUEST_ERROR,
900                               "Read from empty GQSPI RX FIFO\n");
901                 return 0;
902             }
903             memset(rx_buf, 0, sizeof(rx_buf));
904             shortfall = rx_data_bytes(&s->rx_fifo_g, rx_buf,
905                                       XILINX_SPIPS(s)->num_txrx_bytes);
906             ret = ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN) ?
907                   cpu_to_be32(*(uint32_t *)rx_buf) :
908                   cpu_to_le32(*(uint32_t *)rx_buf);
909             if (!ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN)) {
910                 ret <<= 8 * shortfall;
911             }
912             xlnx_zynqmp_qspips_check_flush(s);
913             xlnx_zynqmp_qspips_update_ixr(s);
914             return ret;
915         default:
916             return s->regs[reg];
917         }
918     }
919 }
920 
921 static void xilinx_spips_write(void *opaque, hwaddr addr,
922                                         uint64_t value, unsigned size)
923 {
924     int mask = ~0;
925     XilinxSPIPS *s = opaque;
926 
927     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr, (unsigned)value);
928     addr >>= 2;
929     switch (addr) {
930     case R_CONFIG:
931         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
932         if ((value & MAN_START_COM) && (s->regs[R_CONFIG] & MAN_START_EN)) {
933             s->man_start_com = true;
934         }
935         break;
936     case R_INTR_STATUS:
937         mask = IXR_ALL;
938         s->regs[R_INTR_STATUS] &= ~(mask & value);
939         goto no_reg_update;
940     case R_INTR_DIS:
941         mask = IXR_ALL;
942         s->regs[R_INTR_MASK] &= ~(mask & value);
943         goto no_reg_update;
944     case R_INTR_EN:
945         mask = IXR_ALL;
946         s->regs[R_INTR_MASK] |= mask & value;
947         goto no_reg_update;
948     case R_EN:
949         mask = 0x1;
950         break;
951     case R_SLAVE_IDLE_COUNT:
952         mask = 0xFF;
953         break;
954     case R_RX_DATA:
955     case R_INTR_MASK:
956     case R_MOD_ID:
957         mask = 0;
958         break;
959     case R_TX_DATA:
960         tx_data_bytes(&s->tx_fifo, (uint32_t)value, s->num_txrx_bytes,
961                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
962         goto no_reg_update;
963     case R_TXD1:
964         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 1,
965                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
966         goto no_reg_update;
967     case R_TXD2:
968         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 2,
969                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
970         goto no_reg_update;
971     case R_TXD3:
972         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 3,
973                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
974         goto no_reg_update;
975     }
976     s->regs[addr] = (s->regs[addr] & ~mask) | (value & mask);
977 no_reg_update:
978     xilinx_spips_update_cs_lines(s);
979     xilinx_spips_check_flush(s);
980     xilinx_spips_update_cs_lines(s);
981     xilinx_spips_update_ixr(s);
982 }
983 
984 static const MemoryRegionOps spips_ops = {
985     .read = xilinx_spips_read,
986     .write = xilinx_spips_write,
987     .endianness = DEVICE_LITTLE_ENDIAN,
988 };
989 
990 static void xilinx_qspips_invalidate_mmio_ptr(XilinxQSPIPS *q)
991 {
992     XilinxSPIPS *s = &q->parent_obj;
993 
994     if ((q->mmio_execution_enabled) && (q->lqspi_cached_addr != ~0ULL)) {
995         /* Invalidate the current mapped mmio */
996         memory_region_invalidate_mmio_ptr(&s->mmlqspi, q->lqspi_cached_addr,
997                                           LQSPI_CACHE_SIZE);
998     }
999 
1000     q->lqspi_cached_addr = ~0ULL;
1001 }
1002 
1003 static void xilinx_qspips_write(void *opaque, hwaddr addr,
1004                                 uint64_t value, unsigned size)
1005 {
1006     XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
1007     XilinxSPIPS *s = XILINX_SPIPS(opaque);
1008 
1009     xilinx_spips_write(opaque, addr, value, size);
1010     addr >>= 2;
1011 
1012     if (addr == R_LQSPI_CFG) {
1013         xilinx_qspips_invalidate_mmio_ptr(q);
1014     }
1015     if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
1016         fifo8_reset(&s->rx_fifo);
1017     }
1018 }
1019 
1020 static void xlnx_zynqmp_qspips_write(void *opaque, hwaddr addr,
1021                                         uint64_t value, unsigned size)
1022 {
1023     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
1024     uint32_t reg = addr / 4;
1025 
1026     if (reg <= R_MOD_ID) {
1027         xilinx_qspips_write(opaque, addr, value, size);
1028     } else {
1029         switch (reg) {
1030         case R_GQSPI_CNFG:
1031             if (FIELD_EX32(value, GQSPI_CNFG, GEN_FIFO_START) &&
1032                 ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE)) {
1033                 s->man_start_com_g = true;
1034             }
1035             s->regs[reg] = value & ~(R_GQSPI_CNFG_GEN_FIFO_START_MASK);
1036             break;
1037         case R_GQSPI_GEN_FIFO:
1038             if (!fifo32_is_full(&s->fifo_g)) {
1039                 fifo32_push(&s->fifo_g, value);
1040             }
1041             break;
1042         case R_GQSPI_TXD:
1043             tx_data_bytes(&s->tx_fifo_g, (uint32_t)value, 4,
1044                           ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN));
1045             break;
1046         case R_GQSPI_FIFO_CTRL:
1047             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET)) {
1048                 fifo32_reset(&s->fifo_g);
1049             }
1050             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, TX_FIFO_RESET)) {
1051                 fifo8_reset(&s->tx_fifo_g);
1052             }
1053             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, RX_FIFO_RESET)) {
1054                 fifo8_reset(&s->rx_fifo_g);
1055             }
1056             break;
1057         case R_GQSPI_IDR:
1058             s->regs[R_GQSPI_IMR] |= value;
1059             break;
1060         case R_GQSPI_IER:
1061             s->regs[R_GQSPI_IMR] &= ~value;
1062             break;
1063         case R_GQSPI_ISR:
1064             s->regs[R_GQSPI_ISR] &= ~value;
1065             break;
1066         case R_GQSPI_IMR:
1067         case R_GQSPI_RXD:
1068         case R_GQSPI_GF_SNAPSHOT:
1069         case R_GQSPI_MOD_ID:
1070             break;
1071         default:
1072             s->regs[reg] = value;
1073             break;
1074         }
1075         xlnx_zynqmp_qspips_update_cs_lines(s);
1076         xlnx_zynqmp_qspips_check_flush(s);
1077         xlnx_zynqmp_qspips_update_cs_lines(s);
1078         xlnx_zynqmp_qspips_update_ixr(s);
1079     }
1080     xlnx_zynqmp_qspips_notify(s);
1081 }
1082 
1083 static const MemoryRegionOps qspips_ops = {
1084     .read = xilinx_spips_read,
1085     .write = xilinx_qspips_write,
1086     .endianness = DEVICE_LITTLE_ENDIAN,
1087 };
1088 
1089 static const MemoryRegionOps xlnx_zynqmp_qspips_ops = {
1090     .read = xlnx_zynqmp_qspips_read,
1091     .write = xlnx_zynqmp_qspips_write,
1092     .endianness = DEVICE_LITTLE_ENDIAN,
1093 };
1094 
1095 #define LQSPI_CACHE_SIZE 1024
1096 
1097 static void lqspi_load_cache(void *opaque, hwaddr addr)
1098 {
1099     XilinxQSPIPS *q = opaque;
1100     XilinxSPIPS *s = opaque;
1101     int i;
1102     int flash_addr = ((addr & ~(LQSPI_CACHE_SIZE - 1))
1103                    / num_effective_busses(s));
1104     int slave = flash_addr >> LQSPI_ADDRESS_BITS;
1105     int cache_entry = 0;
1106     uint32_t u_page_save = s->regs[R_LQSPI_STS] & ~LQSPI_CFG_U_PAGE;
1107 
1108     if (addr < q->lqspi_cached_addr ||
1109             addr > q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1110         xilinx_qspips_invalidate_mmio_ptr(q);
1111         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1112         s->regs[R_LQSPI_STS] |= slave ? LQSPI_CFG_U_PAGE : 0;
1113 
1114         DB_PRINT_L(0, "config reg status: %08x\n", s->regs[R_LQSPI_CFG]);
1115 
1116         fifo8_reset(&s->tx_fifo);
1117         fifo8_reset(&s->rx_fifo);
1118 
1119         /* instruction */
1120         DB_PRINT_L(0, "pushing read instruction: %02x\n",
1121                    (unsigned)(uint8_t)(s->regs[R_LQSPI_CFG] &
1122                                        LQSPI_CFG_INST_CODE));
1123         fifo8_push(&s->tx_fifo, s->regs[R_LQSPI_CFG] & LQSPI_CFG_INST_CODE);
1124         /* read address */
1125         DB_PRINT_L(0, "pushing read address %06x\n", flash_addr);
1126         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_ADDR4) {
1127             fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 24));
1128         }
1129         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 16));
1130         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 8));
1131         fifo8_push(&s->tx_fifo, (uint8_t)flash_addr);
1132         /* mode bits */
1133         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_MODE_EN) {
1134             fifo8_push(&s->tx_fifo, extract32(s->regs[R_LQSPI_CFG],
1135                                               LQSPI_CFG_MODE_SHIFT,
1136                                               LQSPI_CFG_MODE_WIDTH));
1137         }
1138         /* dummy bytes */
1139         for (i = 0; i < (extract32(s->regs[R_LQSPI_CFG], LQSPI_CFG_DUMMY_SHIFT,
1140                                    LQSPI_CFG_DUMMY_WIDTH)); ++i) {
1141             DB_PRINT_L(0, "pushing dummy byte\n");
1142             fifo8_push(&s->tx_fifo, 0);
1143         }
1144         xilinx_spips_update_cs_lines(s);
1145         xilinx_spips_flush_txfifo(s);
1146         fifo8_reset(&s->rx_fifo);
1147 
1148         DB_PRINT_L(0, "starting QSPI data read\n");
1149 
1150         while (cache_entry < LQSPI_CACHE_SIZE) {
1151             for (i = 0; i < 64; ++i) {
1152                 tx_data_bytes(&s->tx_fifo, 0, 1, false);
1153             }
1154             xilinx_spips_flush_txfifo(s);
1155             for (i = 0; i < 64; ++i) {
1156                 rx_data_bytes(&s->rx_fifo, &q->lqspi_buf[cache_entry++], 1);
1157             }
1158         }
1159 
1160         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1161         s->regs[R_LQSPI_STS] |= u_page_save;
1162         xilinx_spips_update_cs_lines(s);
1163 
1164         q->lqspi_cached_addr = flash_addr * num_effective_busses(s);
1165     }
1166 }
1167 
1168 static void *lqspi_request_mmio_ptr(void *opaque, hwaddr addr, unsigned *size,
1169                                     unsigned *offset)
1170 {
1171     XilinxQSPIPS *q = opaque;
1172     hwaddr offset_within_the_region;
1173 
1174     if (!q->mmio_execution_enabled) {
1175         return NULL;
1176     }
1177 
1178     offset_within_the_region = addr & ~(LQSPI_CACHE_SIZE - 1);
1179     lqspi_load_cache(opaque, offset_within_the_region);
1180     *size = LQSPI_CACHE_SIZE;
1181     *offset = offset_within_the_region;
1182     return q->lqspi_buf;
1183 }
1184 
1185 static uint64_t
1186 lqspi_read(void *opaque, hwaddr addr, unsigned int size)
1187 {
1188     XilinxQSPIPS *q = opaque;
1189     uint32_t ret;
1190 
1191     if (addr >= q->lqspi_cached_addr &&
1192             addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1193         uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
1194         ret = cpu_to_le32(*(uint32_t *)retp);
1195         DB_PRINT_L(1, "addr: %08x, data: %08x\n", (unsigned)addr,
1196                    (unsigned)ret);
1197         return ret;
1198     } else {
1199         lqspi_load_cache(opaque, addr);
1200         return lqspi_read(opaque, addr, size);
1201     }
1202 }
1203 
1204 static const MemoryRegionOps lqspi_ops = {
1205     .read = lqspi_read,
1206     .request_ptr = lqspi_request_mmio_ptr,
1207     .endianness = DEVICE_NATIVE_ENDIAN,
1208     .valid = {
1209         .min_access_size = 1,
1210         .max_access_size = 4
1211     }
1212 };
1213 
1214 static void xilinx_spips_realize(DeviceState *dev, Error **errp)
1215 {
1216     XilinxSPIPS *s = XILINX_SPIPS(dev);
1217     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1218     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1219     qemu_irq *cs;
1220     int i;
1221 
1222     DB_PRINT_L(0, "realized spips\n");
1223 
1224     s->spi = g_new(SSIBus *, s->num_busses);
1225     for (i = 0; i < s->num_busses; ++i) {
1226         char bus_name[16];
1227         snprintf(bus_name, 16, "spi%d", i);
1228         s->spi[i] = ssi_create_bus(dev, bus_name);
1229     }
1230 
1231     s->cs_lines = g_new0(qemu_irq, s->num_cs * s->num_busses);
1232     s->cs_lines_state = g_new0(bool, s->num_cs * s->num_busses);
1233     for (i = 0, cs = s->cs_lines; i < s->num_busses; ++i, cs += s->num_cs) {
1234         ssi_auto_connect_slaves(DEVICE(s), cs, s->spi[i]);
1235     }
1236 
1237     sysbus_init_irq(sbd, &s->irq);
1238     for (i = 0; i < s->num_cs * s->num_busses; ++i) {
1239         sysbus_init_irq(sbd, &s->cs_lines[i]);
1240     }
1241 
1242     memory_region_init_io(&s->iomem, OBJECT(s), xsc->reg_ops, s,
1243                           "spi", XLNX_ZYNQMP_SPIPS_R_MAX * 4);
1244     sysbus_init_mmio(sbd, &s->iomem);
1245 
1246     s->irqline = -1;
1247 
1248     fifo8_create(&s->rx_fifo, xsc->rx_fifo_size);
1249     fifo8_create(&s->tx_fifo, xsc->tx_fifo_size);
1250 }
1251 
1252 static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
1253 {
1254     XilinxSPIPS *s = XILINX_SPIPS(dev);
1255     XilinxQSPIPS *q = XILINX_QSPIPS(dev);
1256     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1257 
1258     DB_PRINT_L(0, "realized qspips\n");
1259 
1260     s->num_busses = 2;
1261     s->num_cs = 2;
1262     s->num_txrx_bytes = 4;
1263 
1264     xilinx_spips_realize(dev, errp);
1265     memory_region_init_io(&s->mmlqspi, OBJECT(s), &lqspi_ops, s, "lqspi",
1266                           (1 << LQSPI_ADDRESS_BITS) * 2);
1267     sysbus_init_mmio(sbd, &s->mmlqspi);
1268 
1269     q->lqspi_cached_addr = ~0ULL;
1270 
1271     /* mmio_execution breaks migration better aborting than having strange
1272      * bugs.
1273      */
1274     if (q->mmio_execution_enabled) {
1275         error_setg(&q->migration_blocker,
1276                    "enabling mmio_execution breaks migration");
1277         migrate_add_blocker(q->migration_blocker, &error_fatal);
1278     }
1279 }
1280 
1281 static void xlnx_zynqmp_qspips_realize(DeviceState *dev, Error **errp)
1282 {
1283     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(dev);
1284     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1285 
1286     xilinx_qspips_realize(dev, errp);
1287     fifo8_create(&s->rx_fifo_g, xsc->rx_fifo_size);
1288     fifo8_create(&s->tx_fifo_g, xsc->tx_fifo_size);
1289     fifo32_create(&s->fifo_g, 32);
1290 }
1291 
1292 static void xlnx_zynqmp_qspips_init(Object *obj)
1293 {
1294     XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(obj);
1295 
1296     object_property_add_link(obj, "stream-connected-dma", TYPE_STREAM_SLAVE,
1297                              (Object **)&rq->dma,
1298                              object_property_allow_set_link,
1299                              OBJ_PROP_LINK_UNREF_ON_RELEASE,
1300                              NULL);
1301 }
1302 
1303 static int xilinx_spips_post_load(void *opaque, int version_id)
1304 {
1305     xilinx_spips_update_ixr((XilinxSPIPS *)opaque);
1306     xilinx_spips_update_cs_lines((XilinxSPIPS *)opaque);
1307     return 0;
1308 }
1309 
1310 static const VMStateDescription vmstate_xilinx_spips = {
1311     .name = "xilinx_spips",
1312     .version_id = 2,
1313     .minimum_version_id = 2,
1314     .post_load = xilinx_spips_post_load,
1315     .fields = (VMStateField[]) {
1316         VMSTATE_FIFO8(tx_fifo, XilinxSPIPS),
1317         VMSTATE_FIFO8(rx_fifo, XilinxSPIPS),
1318         VMSTATE_UINT32_ARRAY(regs, XilinxSPIPS, XLNX_SPIPS_R_MAX),
1319         VMSTATE_UINT8(snoop_state, XilinxSPIPS),
1320         VMSTATE_END_OF_LIST()
1321     }
1322 };
1323 
1324 static int xlnx_zynqmp_qspips_post_load(void *opaque, int version_id)
1325 {
1326     XlnxZynqMPQSPIPS *s = (XlnxZynqMPQSPIPS *)opaque;
1327     XilinxSPIPS *qs = XILINX_SPIPS(s);
1328 
1329     if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN) &&
1330         fifo8_is_empty(&qs->rx_fifo) && fifo8_is_empty(&qs->tx_fifo)) {
1331         xlnx_zynqmp_qspips_update_ixr(s);
1332         xlnx_zynqmp_qspips_update_cs_lines(s);
1333     }
1334     return 0;
1335 }
1336 
1337 static const VMStateDescription vmstate_xilinx_qspips = {
1338     .name = "xilinx_qspips",
1339     .version_id = 1,
1340     .minimum_version_id = 1,
1341     .fields = (VMStateField[]) {
1342         VMSTATE_STRUCT(parent_obj, XilinxQSPIPS, 0,
1343                        vmstate_xilinx_spips, XilinxSPIPS),
1344         VMSTATE_END_OF_LIST()
1345     }
1346 };
1347 
1348 static const VMStateDescription vmstate_xlnx_zynqmp_qspips = {
1349     .name = "xlnx_zynqmp_qspips",
1350     .version_id = 1,
1351     .minimum_version_id = 1,
1352     .post_load = xlnx_zynqmp_qspips_post_load,
1353     .fields = (VMStateField[]) {
1354         VMSTATE_STRUCT(parent_obj, XlnxZynqMPQSPIPS, 0,
1355                        vmstate_xilinx_qspips, XilinxQSPIPS),
1356         VMSTATE_FIFO8(tx_fifo_g, XlnxZynqMPQSPIPS),
1357         VMSTATE_FIFO8(rx_fifo_g, XlnxZynqMPQSPIPS),
1358         VMSTATE_FIFO32(fifo_g, XlnxZynqMPQSPIPS),
1359         VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPQSPIPS, XLNX_ZYNQMP_SPIPS_R_MAX),
1360         VMSTATE_END_OF_LIST()
1361     }
1362 };
1363 
1364 static Property xilinx_qspips_properties[] = {
1365     /* We had to turn this off for 2.10 as it is not compatible with migration.
1366      * It can be enabled but will prevent the device to be migrated.
1367      * This will go aways when a fix will be released.
1368      */
1369     DEFINE_PROP_BOOL("x-mmio-exec", XilinxQSPIPS, mmio_execution_enabled,
1370                      false),
1371     DEFINE_PROP_END_OF_LIST(),
1372 };
1373 
1374 static Property xilinx_spips_properties[] = {
1375     DEFINE_PROP_UINT8("num-busses", XilinxSPIPS, num_busses, 1),
1376     DEFINE_PROP_UINT8("num-ss-bits", XilinxSPIPS, num_cs, 4),
1377     DEFINE_PROP_UINT8("num-txrx-bytes", XilinxSPIPS, num_txrx_bytes, 1),
1378     DEFINE_PROP_END_OF_LIST(),
1379 };
1380 
1381 static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
1382 {
1383     DeviceClass *dc = DEVICE_CLASS(klass);
1384     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1385 
1386     dc->realize = xilinx_qspips_realize;
1387     dc->props = xilinx_qspips_properties;
1388     xsc->reg_ops = &qspips_ops;
1389     xsc->rx_fifo_size = RXFF_A_Q;
1390     xsc->tx_fifo_size = TXFF_A_Q;
1391 }
1392 
1393 static void xilinx_spips_class_init(ObjectClass *klass, void *data)
1394 {
1395     DeviceClass *dc = DEVICE_CLASS(klass);
1396     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1397 
1398     dc->realize = xilinx_spips_realize;
1399     dc->reset = xilinx_spips_reset;
1400     dc->props = xilinx_spips_properties;
1401     dc->vmsd = &vmstate_xilinx_spips;
1402 
1403     xsc->reg_ops = &spips_ops;
1404     xsc->rx_fifo_size = RXFF_A;
1405     xsc->tx_fifo_size = TXFF_A;
1406 }
1407 
1408 static void xlnx_zynqmp_qspips_class_init(ObjectClass *klass, void * data)
1409 {
1410     DeviceClass *dc = DEVICE_CLASS(klass);
1411     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1412 
1413     dc->realize = xlnx_zynqmp_qspips_realize;
1414     dc->reset = xlnx_zynqmp_qspips_reset;
1415     dc->vmsd = &vmstate_xlnx_zynqmp_qspips;
1416     xsc->reg_ops = &xlnx_zynqmp_qspips_ops;
1417     xsc->rx_fifo_size = RXFF_A_Q;
1418     xsc->tx_fifo_size = TXFF_A_Q;
1419 }
1420 
1421 static const TypeInfo xilinx_spips_info = {
1422     .name  = TYPE_XILINX_SPIPS,
1423     .parent = TYPE_SYS_BUS_DEVICE,
1424     .instance_size  = sizeof(XilinxSPIPS),
1425     .class_init = xilinx_spips_class_init,
1426     .class_size = sizeof(XilinxSPIPSClass),
1427 };
1428 
1429 static const TypeInfo xilinx_qspips_info = {
1430     .name  = TYPE_XILINX_QSPIPS,
1431     .parent = TYPE_XILINX_SPIPS,
1432     .instance_size  = sizeof(XilinxQSPIPS),
1433     .class_init = xilinx_qspips_class_init,
1434 };
1435 
1436 static const TypeInfo xlnx_zynqmp_qspips_info = {
1437     .name  = TYPE_XLNX_ZYNQMP_QSPIPS,
1438     .parent = TYPE_XILINX_QSPIPS,
1439     .instance_size  = sizeof(XlnxZynqMPQSPIPS),
1440     .instance_init  = xlnx_zynqmp_qspips_init,
1441     .class_init = xlnx_zynqmp_qspips_class_init,
1442 };
1443 
1444 static void xilinx_spips_register_types(void)
1445 {
1446     type_register_static(&xilinx_spips_info);
1447     type_register_static(&xilinx_qspips_info);
1448     type_register_static(&xlnx_zynqmp_qspips_info);
1449 }
1450 
1451 type_init(xilinx_spips_register_types)
1452