xref: /openbmc/qemu/hw/ssi/xilinx_spips.c (revision 64552b6b)
1 /*
2  * QEMU model of the Xilinx Zynq SPI controller
3  *
4  * Copyright (c) 2012 Peter A. G. Crosthwaite
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "hw/sysbus.h"
27 #include "sysemu/sysemu.h"
28 #include "hw/irq.h"
29 #include "hw/ptimer.h"
30 #include "qemu/log.h"
31 #include "qemu/module.h"
32 #include "qemu/bitops.h"
33 #include "hw/ssi/xilinx_spips.h"
34 #include "qapi/error.h"
35 #include "hw/register.h"
36 #include "sysemu/dma.h"
37 #include "migration/blocker.h"
38 
39 #ifndef XILINX_SPIPS_ERR_DEBUG
40 #define XILINX_SPIPS_ERR_DEBUG 0
41 #endif
42 
43 #define DB_PRINT_L(level, ...) do { \
44     if (XILINX_SPIPS_ERR_DEBUG > (level)) { \
45         fprintf(stderr,  ": %s: ", __func__); \
46         fprintf(stderr, ## __VA_ARGS__); \
47     } \
48 } while (0)
49 
50 /* config register */
51 #define R_CONFIG            (0x00 / 4)
52 #define IFMODE              (1U << 31)
53 #define R_CONFIG_ENDIAN     (1 << 26)
54 #define MODEFAIL_GEN_EN     (1 << 17)
55 #define MAN_START_COM       (1 << 16)
56 #define MAN_START_EN        (1 << 15)
57 #define MANUAL_CS           (1 << 14)
58 #define CS                  (0xF << 10)
59 #define CS_SHIFT            (10)
60 #define PERI_SEL            (1 << 9)
61 #define REF_CLK             (1 << 8)
62 #define FIFO_WIDTH          (3 << 6)
63 #define BAUD_RATE_DIV       (7 << 3)
64 #define CLK_PH              (1 << 2)
65 #define CLK_POL             (1 << 1)
66 #define MODE_SEL            (1 << 0)
67 #define R_CONFIG_RSVD       (0x7bf40000)
68 
69 /* interrupt mechanism */
70 #define R_INTR_STATUS       (0x04 / 4)
71 #define R_INTR_STATUS_RESET (0x104)
72 #define R_INTR_EN           (0x08 / 4)
73 #define R_INTR_DIS          (0x0C / 4)
74 #define R_INTR_MASK         (0x10 / 4)
75 #define IXR_TX_FIFO_UNDERFLOW   (1 << 6)
76 /* Poll timeout not implemented */
77 #define IXR_RX_FIFO_EMPTY       (1 << 11)
78 #define IXR_GENERIC_FIFO_FULL   (1 << 10)
79 #define IXR_GENERIC_FIFO_NOT_FULL (1 << 9)
80 #define IXR_TX_FIFO_EMPTY       (1 << 8)
81 #define IXR_GENERIC_FIFO_EMPTY  (1 << 7)
82 #define IXR_RX_FIFO_FULL        (1 << 5)
83 #define IXR_RX_FIFO_NOT_EMPTY   (1 << 4)
84 #define IXR_TX_FIFO_FULL        (1 << 3)
85 #define IXR_TX_FIFO_NOT_FULL    (1 << 2)
86 #define IXR_TX_FIFO_MODE_FAIL   (1 << 1)
87 #define IXR_RX_FIFO_OVERFLOW    (1 << 0)
88 #define IXR_ALL                 ((1 << 13) - 1)
89 #define GQSPI_IXR_MASK          0xFBE
90 #define IXR_SELF_CLEAR \
91 (IXR_GENERIC_FIFO_EMPTY \
92 | IXR_GENERIC_FIFO_FULL  \
93 | IXR_GENERIC_FIFO_NOT_FULL \
94 | IXR_TX_FIFO_EMPTY \
95 | IXR_TX_FIFO_FULL  \
96 | IXR_TX_FIFO_NOT_FULL \
97 | IXR_RX_FIFO_EMPTY \
98 | IXR_RX_FIFO_FULL  \
99 | IXR_RX_FIFO_NOT_EMPTY)
100 
101 #define R_EN                (0x14 / 4)
102 #define R_DELAY             (0x18 / 4)
103 #define R_TX_DATA           (0x1C / 4)
104 #define R_RX_DATA           (0x20 / 4)
105 #define R_SLAVE_IDLE_COUNT  (0x24 / 4)
106 #define R_TX_THRES          (0x28 / 4)
107 #define R_RX_THRES          (0x2C / 4)
108 #define R_GPIO              (0x30 / 4)
109 #define R_LPBK_DLY_ADJ      (0x38 / 4)
110 #define R_LPBK_DLY_ADJ_RESET (0x33)
111 #define R_TXD1              (0x80 / 4)
112 #define R_TXD2              (0x84 / 4)
113 #define R_TXD3              (0x88 / 4)
114 
115 #define R_LQSPI_CFG         (0xa0 / 4)
116 #define R_LQSPI_CFG_RESET       0x03A002EB
117 #define LQSPI_CFG_LQ_MODE       (1U << 31)
118 #define LQSPI_CFG_TWO_MEM       (1 << 30)
119 #define LQSPI_CFG_SEP_BUS       (1 << 29)
120 #define LQSPI_CFG_U_PAGE        (1 << 28)
121 #define LQSPI_CFG_ADDR4         (1 << 27)
122 #define LQSPI_CFG_MODE_EN       (1 << 25)
123 #define LQSPI_CFG_MODE_WIDTH    8
124 #define LQSPI_CFG_MODE_SHIFT    16
125 #define LQSPI_CFG_DUMMY_WIDTH   3
126 #define LQSPI_CFG_DUMMY_SHIFT   8
127 #define LQSPI_CFG_INST_CODE     0xFF
128 
129 #define R_CMND        (0xc0 / 4)
130     #define R_CMND_RXFIFO_DRAIN   (1 << 19)
131     FIELD(CMND, PARTIAL_BYTE_LEN, 16, 3)
132 #define R_CMND_EXT_ADD        (1 << 15)
133     FIELD(CMND, RX_DISCARD, 8, 7)
134     FIELD(CMND, DUMMY_CYCLES, 2, 6)
135 #define R_CMND_DMA_EN         (1 << 1)
136 #define R_CMND_PUSH_WAIT      (1 << 0)
137 #define R_TRANSFER_SIZE     (0xc4 / 4)
138 #define R_LQSPI_STS         (0xA4 / 4)
139 #define LQSPI_STS_WR_RECVD      (1 << 1)
140 
141 #define R_MOD_ID            (0xFC / 4)
142 
143 #define R_GQSPI_SELECT          (0x144 / 4)
144     FIELD(GQSPI_SELECT, GENERIC_QSPI_EN, 0, 1)
145 #define R_GQSPI_ISR         (0x104 / 4)
146 #define R_GQSPI_IER         (0x108 / 4)
147 #define R_GQSPI_IDR         (0x10c / 4)
148 #define R_GQSPI_IMR         (0x110 / 4)
149 #define R_GQSPI_IMR_RESET   (0xfbe)
150 #define R_GQSPI_TX_THRESH   (0x128 / 4)
151 #define R_GQSPI_RX_THRESH   (0x12c / 4)
152 #define R_GQSPI_GPIO (0x130 / 4)
153 #define R_GQSPI_LPBK_DLY_ADJ (0x138 / 4)
154 #define R_GQSPI_LPBK_DLY_ADJ_RESET (0x33)
155 #define R_GQSPI_CNFG        (0x100 / 4)
156     FIELD(GQSPI_CNFG, MODE_EN, 30, 2)
157     FIELD(GQSPI_CNFG, GEN_FIFO_START_MODE, 29, 1)
158     FIELD(GQSPI_CNFG, GEN_FIFO_START, 28, 1)
159     FIELD(GQSPI_CNFG, ENDIAN, 26, 1)
160     /* Poll timeout not implemented */
161     FIELD(GQSPI_CNFG, EN_POLL_TIMEOUT, 20, 1)
162     /* QEMU doesnt care about any of these last three */
163     FIELD(GQSPI_CNFG, BR, 3, 3)
164     FIELD(GQSPI_CNFG, CPH, 2, 1)
165     FIELD(GQSPI_CNFG, CPL, 1, 1)
166 #define R_GQSPI_GEN_FIFO        (0x140 / 4)
167 #define R_GQSPI_TXD             (0x11c / 4)
168 #define R_GQSPI_RXD             (0x120 / 4)
169 #define R_GQSPI_FIFO_CTRL       (0x14c / 4)
170     FIELD(GQSPI_FIFO_CTRL, RX_FIFO_RESET, 2, 1)
171     FIELD(GQSPI_FIFO_CTRL, TX_FIFO_RESET, 1, 1)
172     FIELD(GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET, 0, 1)
173 #define R_GQSPI_GFIFO_THRESH    (0x150 / 4)
174 #define R_GQSPI_DATA_STS (0x15c / 4)
175 /* We use the snapshot register to hold the core state for the currently
176  * or most recently executed command. So the generic fifo format is defined
177  * for the snapshot register
178  */
179 #define R_GQSPI_GF_SNAPSHOT (0x160 / 4)
180     FIELD(GQSPI_GF_SNAPSHOT, POLL, 19, 1)
181     FIELD(GQSPI_GF_SNAPSHOT, STRIPE, 18, 1)
182     FIELD(GQSPI_GF_SNAPSHOT, RECIEVE, 17, 1)
183     FIELD(GQSPI_GF_SNAPSHOT, TRANSMIT, 16, 1)
184     FIELD(GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT, 14, 2)
185     FIELD(GQSPI_GF_SNAPSHOT, CHIP_SELECT, 12, 2)
186     FIELD(GQSPI_GF_SNAPSHOT, SPI_MODE, 10, 2)
187     FIELD(GQSPI_GF_SNAPSHOT, EXPONENT, 9, 1)
188     FIELD(GQSPI_GF_SNAPSHOT, DATA_XFER, 8, 1)
189     FIELD(GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA, 0, 8)
190 #define R_GQSPI_MOD_ID        (0x1fc / 4)
191 #define R_GQSPI_MOD_ID_RESET  (0x10a0000)
192 
193 #define R_QSPIDMA_DST_CTRL         (0x80c / 4)
194 #define R_QSPIDMA_DST_CTRL_RESET   (0x803ffa00)
195 #define R_QSPIDMA_DST_I_MASK       (0x820 / 4)
196 #define R_QSPIDMA_DST_I_MASK_RESET (0xfe)
197 #define R_QSPIDMA_DST_CTRL2        (0x824 / 4)
198 #define R_QSPIDMA_DST_CTRL2_RESET  (0x081bfff8)
199 
200 /* size of TXRX FIFOs */
201 #define RXFF_A          (128)
202 #define TXFF_A          (128)
203 
204 #define RXFF_A_Q          (64 * 4)
205 #define TXFF_A_Q          (64 * 4)
206 
207 /* 16MB per linear region */
208 #define LQSPI_ADDRESS_BITS 24
209 
210 #define SNOOP_CHECKING 0xFF
211 #define SNOOP_ADDR 0xF0
212 #define SNOOP_NONE 0xEE
213 #define SNOOP_STRIPING 0
214 
215 #define MIN_NUM_BUSSES 1
216 #define MAX_NUM_BUSSES 2
217 
218 static inline int num_effective_busses(XilinxSPIPS *s)
219 {
220     return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
221             s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM) ? s->num_busses : 1;
222 }
223 
224 static void xilinx_spips_update_cs(XilinxSPIPS *s, int field)
225 {
226     int i;
227 
228     for (i = 0; i < s->num_cs * s->num_busses; i++) {
229         bool old_state = s->cs_lines_state[i];
230         bool new_state = field & (1 << i);
231 
232         if (old_state != new_state) {
233             s->cs_lines_state[i] = new_state;
234             s->rx_discard = ARRAY_FIELD_EX32(s->regs, CMND, RX_DISCARD);
235             DB_PRINT_L(1, "%sselecting slave %d\n", new_state ? "" : "de", i);
236         }
237         qemu_set_irq(s->cs_lines[i], !new_state);
238     }
239     if (!(field & ((1 << (s->num_cs * s->num_busses)) - 1))) {
240         s->snoop_state = SNOOP_CHECKING;
241         s->cmd_dummies = 0;
242         s->link_state = 1;
243         s->link_state_next = 1;
244         s->link_state_next_when = 0;
245         DB_PRINT_L(1, "moving to snoop check state\n");
246     }
247 }
248 
249 static void xlnx_zynqmp_qspips_update_cs_lines(XlnxZynqMPQSPIPS *s)
250 {
251     if (s->regs[R_GQSPI_GF_SNAPSHOT]) {
252         int field = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, CHIP_SELECT);
253         bool upper_cs_sel = field & (1 << 1);
254         bool lower_cs_sel = field & 1;
255         bool bus0_enabled;
256         bool bus1_enabled;
257         uint8_t buses;
258         int cs = 0;
259 
260         buses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
261         bus0_enabled = buses & 1;
262         bus1_enabled = buses & (1 << 1);
263 
264         if (bus0_enabled && bus1_enabled) {
265             if (lower_cs_sel) {
266                 cs |= 1;
267             }
268             if (upper_cs_sel) {
269                 cs |= 1 << 3;
270             }
271         } else if (bus0_enabled) {
272             if (lower_cs_sel) {
273                 cs |= 1;
274             }
275             if (upper_cs_sel) {
276                 cs |= 1 << 1;
277             }
278         } else if (bus1_enabled) {
279             if (lower_cs_sel) {
280                 cs |= 1 << 2;
281             }
282             if (upper_cs_sel) {
283                 cs |= 1 << 3;
284             }
285         }
286         xilinx_spips_update_cs(XILINX_SPIPS(s), cs);
287     }
288 }
289 
290 static void xilinx_spips_update_cs_lines(XilinxSPIPS *s)
291 {
292     int field = ~((s->regs[R_CONFIG] & CS) >> CS_SHIFT);
293 
294     /* In dual parallel, mirror low CS to both */
295     if (num_effective_busses(s) == 2) {
296         /* Single bit chip-select for qspi */
297         field &= 0x1;
298         field |= field << 3;
299     /* Dual stack U-Page */
300     } else if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM &&
301                s->regs[R_LQSPI_STS] & LQSPI_CFG_U_PAGE) {
302         /* Single bit chip-select for qspi */
303         field &= 0x1;
304         /* change from CS0 to CS1 */
305         field <<= 1;
306     }
307     /* Auto CS */
308     if (!(s->regs[R_CONFIG] & MANUAL_CS) &&
309         fifo8_is_empty(&s->tx_fifo)) {
310         field = 0;
311     }
312     xilinx_spips_update_cs(s, field);
313 }
314 
315 static void xilinx_spips_update_ixr(XilinxSPIPS *s)
316 {
317     if (!(s->regs[R_LQSPI_CFG] & LQSPI_CFG_LQ_MODE)) {
318         s->regs[R_INTR_STATUS] &= ~IXR_SELF_CLEAR;
319         s->regs[R_INTR_STATUS] |=
320             (fifo8_is_full(&s->rx_fifo) ? IXR_RX_FIFO_FULL : 0) |
321             (s->rx_fifo.num >= s->regs[R_RX_THRES] ?
322                                     IXR_RX_FIFO_NOT_EMPTY : 0) |
323             (fifo8_is_full(&s->tx_fifo) ? IXR_TX_FIFO_FULL : 0) |
324             (fifo8_is_empty(&s->tx_fifo) ? IXR_TX_FIFO_EMPTY : 0) |
325             (s->tx_fifo.num < s->regs[R_TX_THRES] ? IXR_TX_FIFO_NOT_FULL : 0);
326     }
327     int new_irqline = !!(s->regs[R_INTR_MASK] & s->regs[R_INTR_STATUS] &
328                                                                 IXR_ALL);
329     if (new_irqline != s->irqline) {
330         s->irqline = new_irqline;
331         qemu_set_irq(s->irq, s->irqline);
332     }
333 }
334 
335 static void xlnx_zynqmp_qspips_update_ixr(XlnxZynqMPQSPIPS *s)
336 {
337     uint32_t gqspi_int;
338     int new_irqline;
339 
340     s->regs[R_GQSPI_ISR] &= ~IXR_SELF_CLEAR;
341     s->regs[R_GQSPI_ISR] |=
342         (fifo32_is_empty(&s->fifo_g) ? IXR_GENERIC_FIFO_EMPTY : 0) |
343         (fifo32_is_full(&s->fifo_g) ? IXR_GENERIC_FIFO_FULL : 0) |
344         (s->fifo_g.fifo.num < s->regs[R_GQSPI_GFIFO_THRESH] ?
345                                     IXR_GENERIC_FIFO_NOT_FULL : 0) |
346         (fifo8_is_empty(&s->rx_fifo_g) ? IXR_RX_FIFO_EMPTY : 0) |
347         (fifo8_is_full(&s->rx_fifo_g) ? IXR_RX_FIFO_FULL : 0) |
348         (s->rx_fifo_g.num >= s->regs[R_GQSPI_RX_THRESH] ?
349                                     IXR_RX_FIFO_NOT_EMPTY : 0) |
350         (fifo8_is_empty(&s->tx_fifo_g) ? IXR_TX_FIFO_EMPTY : 0) |
351         (fifo8_is_full(&s->tx_fifo_g) ? IXR_TX_FIFO_FULL : 0) |
352         (s->tx_fifo_g.num < s->regs[R_GQSPI_TX_THRESH] ?
353                                     IXR_TX_FIFO_NOT_FULL : 0);
354 
355     /* GQSPI Interrupt Trigger Status */
356     gqspi_int = (~s->regs[R_GQSPI_IMR]) & s->regs[R_GQSPI_ISR] & GQSPI_IXR_MASK;
357     new_irqline = !!(gqspi_int & IXR_ALL);
358 
359     /* drive external interrupt pin */
360     if (new_irqline != s->gqspi_irqline) {
361         s->gqspi_irqline = new_irqline;
362         qemu_set_irq(XILINX_SPIPS(s)->irq, s->gqspi_irqline);
363     }
364 }
365 
366 static void xilinx_spips_reset(DeviceState *d)
367 {
368     XilinxSPIPS *s = XILINX_SPIPS(d);
369 
370     memset(s->regs, 0, sizeof(s->regs));
371 
372     fifo8_reset(&s->rx_fifo);
373     fifo8_reset(&s->rx_fifo);
374     /* non zero resets */
375     s->regs[R_CONFIG] |= MODEFAIL_GEN_EN;
376     s->regs[R_SLAVE_IDLE_COUNT] = 0xFF;
377     s->regs[R_TX_THRES] = 1;
378     s->regs[R_RX_THRES] = 1;
379     /* FIXME: move magic number definition somewhere sensible */
380     s->regs[R_MOD_ID] = 0x01090106;
381     s->regs[R_LQSPI_CFG] = R_LQSPI_CFG_RESET;
382     s->link_state = 1;
383     s->link_state_next = 1;
384     s->link_state_next_when = 0;
385     s->snoop_state = SNOOP_CHECKING;
386     s->cmd_dummies = 0;
387     s->man_start_com = false;
388     xilinx_spips_update_ixr(s);
389     xilinx_spips_update_cs_lines(s);
390 }
391 
392 static void xlnx_zynqmp_qspips_reset(DeviceState *d)
393 {
394     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(d);
395 
396     xilinx_spips_reset(d);
397 
398     memset(s->regs, 0, sizeof(s->regs));
399 
400     fifo8_reset(&s->rx_fifo_g);
401     fifo8_reset(&s->rx_fifo_g);
402     fifo32_reset(&s->fifo_g);
403     s->regs[R_INTR_STATUS] = R_INTR_STATUS_RESET;
404     s->regs[R_GPIO] = 1;
405     s->regs[R_LPBK_DLY_ADJ] = R_LPBK_DLY_ADJ_RESET;
406     s->regs[R_GQSPI_GFIFO_THRESH] = 0x10;
407     s->regs[R_MOD_ID] = 0x01090101;
408     s->regs[R_GQSPI_IMR] = R_GQSPI_IMR_RESET;
409     s->regs[R_GQSPI_TX_THRESH] = 1;
410     s->regs[R_GQSPI_RX_THRESH] = 1;
411     s->regs[R_GQSPI_GPIO] = 1;
412     s->regs[R_GQSPI_LPBK_DLY_ADJ] = R_GQSPI_LPBK_DLY_ADJ_RESET;
413     s->regs[R_GQSPI_MOD_ID] = R_GQSPI_MOD_ID_RESET;
414     s->regs[R_QSPIDMA_DST_CTRL] = R_QSPIDMA_DST_CTRL_RESET;
415     s->regs[R_QSPIDMA_DST_I_MASK] = R_QSPIDMA_DST_I_MASK_RESET;
416     s->regs[R_QSPIDMA_DST_CTRL2] = R_QSPIDMA_DST_CTRL2_RESET;
417     s->man_start_com_g = false;
418     s->gqspi_irqline = 0;
419     xlnx_zynqmp_qspips_update_ixr(s);
420 }
421 
422 /* N way (num) in place bit striper. Lay out row wise bits (MSB to LSB)
423  * column wise (from element 0 to N-1). num is the length of x, and dir
424  * reverses the direction of the transform. Best illustrated by example:
425  * Each digit in the below array is a single bit (num == 3):
426  *
427  * {{ 76543210, }  ----- stripe (dir == false) -----> {{ 741gdaFC, }
428  *  { hgfedcba, }                                      { 630fcHEB, }
429  *  { HGFEDCBA, }} <---- upstripe (dir == true) -----  { 52hebGDA, }}
430  */
431 
432 static inline void stripe8(uint8_t *x, int num, bool dir)
433 {
434     uint8_t r[MAX_NUM_BUSSES];
435     int idx[2] = {0, 0};
436     int bit[2] = {0, 7};
437     int d = dir;
438 
439     assert(num <= MAX_NUM_BUSSES);
440     memset(r, 0, sizeof(uint8_t) * num);
441 
442     for (idx[0] = 0; idx[0] < num; ++idx[0]) {
443         for (bit[0] = 7; bit[0] >= 0; bit[0]--) {
444             r[idx[!d]] |= x[idx[d]] & 1 << bit[d] ? 1 << bit[!d] : 0;
445             idx[1] = (idx[1] + 1) % num;
446             if (!idx[1]) {
447                 bit[1]--;
448             }
449         }
450     }
451     memcpy(x, r, sizeof(uint8_t) * num);
452 }
453 
454 static void xlnx_zynqmp_qspips_flush_fifo_g(XlnxZynqMPQSPIPS *s)
455 {
456     while (s->regs[R_GQSPI_DATA_STS] || !fifo32_is_empty(&s->fifo_g)) {
457         uint8_t tx_rx[2] = { 0 };
458         int num_stripes = 1;
459         uint8_t busses;
460         int i;
461 
462         if (!s->regs[R_GQSPI_DATA_STS]) {
463             uint8_t imm;
464 
465             s->regs[R_GQSPI_GF_SNAPSHOT] = fifo32_pop(&s->fifo_g);
466             DB_PRINT_L(0, "GQSPI command: %x\n", s->regs[R_GQSPI_GF_SNAPSHOT]);
467             if (!s->regs[R_GQSPI_GF_SNAPSHOT]) {
468                 DB_PRINT_L(0, "Dummy GQSPI Delay Command Entry, Do nothing");
469                 continue;
470             }
471             xlnx_zynqmp_qspips_update_cs_lines(s);
472 
473             imm = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
474             if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
475                 /* immedate transfer */
476                 if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
477                     ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
478                     s->regs[R_GQSPI_DATA_STS] = 1;
479                 /* CS setup/hold - do nothing */
480                 } else {
481                     s->regs[R_GQSPI_DATA_STS] = 0;
482                 }
483             } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, EXPONENT)) {
484                 if (imm > 31) {
485                     qemu_log_mask(LOG_UNIMP, "QSPI exponential transfer too"
486                                   " long - 2 ^ %" PRId8 " requested\n", imm);
487                 }
488                 s->regs[R_GQSPI_DATA_STS] = 1ul << imm;
489             } else {
490                 s->regs[R_GQSPI_DATA_STS] = imm;
491             }
492         }
493         /* Zero length transfer check */
494         if (!s->regs[R_GQSPI_DATA_STS]) {
495             continue;
496         }
497         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE) &&
498             fifo8_is_full(&s->rx_fifo_g)) {
499             /* No space in RX fifo for transfer - try again later */
500             return;
501         }
502         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, STRIPE) &&
503             (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
504              ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE))) {
505             num_stripes = 2;
506         }
507         if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
508             tx_rx[0] = ARRAY_FIELD_EX32(s->regs,
509                                         GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
510         } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT)) {
511             for (i = 0; i < num_stripes; ++i) {
512                 if (!fifo8_is_empty(&s->tx_fifo_g)) {
513                     tx_rx[i] = fifo8_pop(&s->tx_fifo_g);
514                     s->tx_fifo_g_align++;
515                 } else {
516                     return;
517                 }
518             }
519         }
520         if (num_stripes == 1) {
521             /* mirror */
522             tx_rx[1] = tx_rx[0];
523         }
524         busses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
525         for (i = 0; i < 2; ++i) {
526             DB_PRINT_L(1, "bus %d tx = %02x\n", i, tx_rx[i]);
527             tx_rx[i] = ssi_transfer(XILINX_SPIPS(s)->spi[i], tx_rx[i]);
528             DB_PRINT_L(1, "bus %d rx = %02x\n", i, tx_rx[i]);
529         }
530         if (s->regs[R_GQSPI_DATA_STS] > 1 &&
531             busses == 0x3 && num_stripes == 2) {
532             s->regs[R_GQSPI_DATA_STS] -= 2;
533         } else if (s->regs[R_GQSPI_DATA_STS] > 0) {
534             s->regs[R_GQSPI_DATA_STS]--;
535         }
536         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
537             for (i = 0; i < 2; ++i) {
538                 if (busses & (1 << i)) {
539                     DB_PRINT_L(1, "bus %d push_byte = %02x\n", i, tx_rx[i]);
540                     fifo8_push(&s->rx_fifo_g, tx_rx[i]);
541                     s->rx_fifo_g_align++;
542                 }
543             }
544         }
545         if (!s->regs[R_GQSPI_DATA_STS]) {
546             for (; s->tx_fifo_g_align % 4; s->tx_fifo_g_align++) {
547                 fifo8_pop(&s->tx_fifo_g);
548             }
549             for (; s->rx_fifo_g_align % 4; s->rx_fifo_g_align++) {
550                 fifo8_push(&s->rx_fifo_g, 0);
551             }
552         }
553     }
554 }
555 
556 static int xilinx_spips_num_dummies(XilinxQSPIPS *qs, uint8_t command)
557 {
558     if (!qs) {
559         /* The SPI device is not a QSPI device */
560         return -1;
561     }
562 
563     switch (command) { /* check for dummies */
564     case READ: /* no dummy bytes/cycles */
565     case PP:
566     case DPP:
567     case QPP:
568     case READ_4:
569     case PP_4:
570     case QPP_4:
571         return 0;
572     case FAST_READ:
573     case DOR:
574     case QOR:
575     case DOR_4:
576     case QOR_4:
577         return 1;
578     case DIOR:
579     case FAST_READ_4:
580     case DIOR_4:
581         return 2;
582     case QIOR:
583     case QIOR_4:
584         return 4;
585     default:
586         return -1;
587     }
588 }
589 
590 static inline uint8_t get_addr_length(XilinxSPIPS *s, uint8_t cmd)
591 {
592    switch (cmd) {
593    case PP_4:
594    case QPP_4:
595    case READ_4:
596    case QIOR_4:
597    case FAST_READ_4:
598    case DOR_4:
599    case QOR_4:
600    case DIOR_4:
601        return 4;
602    default:
603        return (s->regs[R_CMND] & R_CMND_EXT_ADD) ? 4 : 3;
604    }
605 }
606 
607 static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
608 {
609     int debug_level = 0;
610     XilinxQSPIPS *q = (XilinxQSPIPS *) object_dynamic_cast(OBJECT(s),
611                                                            TYPE_XILINX_QSPIPS);
612 
613     for (;;) {
614         int i;
615         uint8_t tx = 0;
616         uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
617         uint8_t dummy_cycles = 0;
618         uint8_t addr_length;
619 
620         if (fifo8_is_empty(&s->tx_fifo)) {
621             xilinx_spips_update_ixr(s);
622             return;
623         } else if (s->snoop_state == SNOOP_STRIPING ||
624                    s->snoop_state == SNOOP_NONE) {
625             for (i = 0; i < num_effective_busses(s); ++i) {
626                 tx_rx[i] = fifo8_pop(&s->tx_fifo);
627             }
628             stripe8(tx_rx, num_effective_busses(s), false);
629         } else if (s->snoop_state >= SNOOP_ADDR) {
630             tx = fifo8_pop(&s->tx_fifo);
631             for (i = 0; i < num_effective_busses(s); ++i) {
632                 tx_rx[i] = tx;
633             }
634         } else {
635             /* Extract a dummy byte and generate dummy cycles according to the
636              * link state */
637             tx = fifo8_pop(&s->tx_fifo);
638             dummy_cycles = 8 / s->link_state;
639         }
640 
641         for (i = 0; i < num_effective_busses(s); ++i) {
642             int bus = num_effective_busses(s) - 1 - i;
643             if (dummy_cycles) {
644                 int d;
645                 for (d = 0; d < dummy_cycles; ++d) {
646                     tx_rx[0] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[0]);
647                 }
648             } else {
649                 DB_PRINT_L(debug_level, "tx = %02x\n", tx_rx[i]);
650                 tx_rx[i] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[i]);
651                 DB_PRINT_L(debug_level, "rx = %02x\n", tx_rx[i]);
652             }
653         }
654 
655         if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
656             DB_PRINT_L(debug_level, "dircarding drained rx byte\n");
657             /* Do nothing */
658         } else if (s->rx_discard) {
659             DB_PRINT_L(debug_level, "dircarding discarded rx byte\n");
660             s->rx_discard -= 8 / s->link_state;
661         } else if (fifo8_is_full(&s->rx_fifo)) {
662             s->regs[R_INTR_STATUS] |= IXR_RX_FIFO_OVERFLOW;
663             DB_PRINT_L(0, "rx FIFO overflow");
664         } else if (s->snoop_state == SNOOP_STRIPING) {
665             stripe8(tx_rx, num_effective_busses(s), true);
666             for (i = 0; i < num_effective_busses(s); ++i) {
667                 fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[i]);
668                 DB_PRINT_L(debug_level, "pushing striped rx byte\n");
669             }
670         } else {
671            DB_PRINT_L(debug_level, "pushing unstriped rx byte\n");
672            fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[0]);
673         }
674 
675         if (s->link_state_next_when) {
676             s->link_state_next_when--;
677             if (!s->link_state_next_when) {
678                 s->link_state = s->link_state_next;
679             }
680         }
681 
682         DB_PRINT_L(debug_level, "initial snoop state: %x\n",
683                    (unsigned)s->snoop_state);
684         switch (s->snoop_state) {
685         case (SNOOP_CHECKING):
686             /* Store the count of dummy bytes in the txfifo */
687             s->cmd_dummies = xilinx_spips_num_dummies(q, tx);
688             addr_length = get_addr_length(s, tx);
689             if (s->cmd_dummies < 0) {
690                 s->snoop_state = SNOOP_NONE;
691             } else {
692                 s->snoop_state = SNOOP_ADDR + addr_length - 1;
693             }
694             switch (tx) {
695             case DPP:
696             case DOR:
697             case DOR_4:
698                 s->link_state_next = 2;
699                 s->link_state_next_when = addr_length + s->cmd_dummies;
700                 break;
701             case QPP:
702             case QPP_4:
703             case QOR:
704             case QOR_4:
705                 s->link_state_next = 4;
706                 s->link_state_next_when = addr_length + s->cmd_dummies;
707                 break;
708             case DIOR:
709             case DIOR_4:
710                 s->link_state = 2;
711                 break;
712             case QIOR:
713             case QIOR_4:
714                 s->link_state = 4;
715                 break;
716             }
717             break;
718         case (SNOOP_ADDR):
719             /* Address has been transmitted, transmit dummy cycles now if
720              * needed */
721             if (s->cmd_dummies < 0) {
722                 s->snoop_state = SNOOP_NONE;
723             } else {
724                 s->snoop_state = s->cmd_dummies;
725             }
726             break;
727         case (SNOOP_STRIPING):
728         case (SNOOP_NONE):
729             /* Once we hit the boring stuff - squelch debug noise */
730             if (!debug_level) {
731                 DB_PRINT_L(0, "squelching debug info ....\n");
732                 debug_level = 1;
733             }
734             break;
735         default:
736             s->snoop_state--;
737         }
738         DB_PRINT_L(debug_level, "final snoop state: %x\n",
739                    (unsigned)s->snoop_state);
740     }
741 }
742 
743 static inline void tx_data_bytes(Fifo8 *fifo, uint32_t value, int num, bool be)
744 {
745     int i;
746     for (i = 0; i < num && !fifo8_is_full(fifo); ++i) {
747         if (be) {
748             fifo8_push(fifo, (uint8_t)(value >> 24));
749             value <<= 8;
750         } else {
751             fifo8_push(fifo, (uint8_t)value);
752             value >>= 8;
753         }
754     }
755 }
756 
757 static void xilinx_spips_check_zero_pump(XilinxSPIPS *s)
758 {
759     if (!s->regs[R_TRANSFER_SIZE]) {
760         return;
761     }
762     if (!fifo8_is_empty(&s->tx_fifo) && s->regs[R_CMND] & R_CMND_PUSH_WAIT) {
763         return;
764     }
765     /*
766      * The zero pump must never fill tx fifo such that rx overflow is
767      * possible
768      */
769     while (s->regs[R_TRANSFER_SIZE] &&
770            s->rx_fifo.num + s->tx_fifo.num < RXFF_A_Q - 3) {
771         /* endianess just doesn't matter when zero pumping */
772         tx_data_bytes(&s->tx_fifo, 0, 4, false);
773         s->regs[R_TRANSFER_SIZE] &= ~0x03ull;
774         s->regs[R_TRANSFER_SIZE] -= 4;
775     }
776 }
777 
778 static void xilinx_spips_check_flush(XilinxSPIPS *s)
779 {
780     if (s->man_start_com ||
781         (!fifo8_is_empty(&s->tx_fifo) &&
782          !(s->regs[R_CONFIG] & MAN_START_EN))) {
783         xilinx_spips_check_zero_pump(s);
784         xilinx_spips_flush_txfifo(s);
785     }
786     if (fifo8_is_empty(&s->tx_fifo) && !s->regs[R_TRANSFER_SIZE]) {
787         s->man_start_com = false;
788     }
789     xilinx_spips_update_ixr(s);
790 }
791 
792 static void xlnx_zynqmp_qspips_check_flush(XlnxZynqMPQSPIPS *s)
793 {
794     bool gqspi_has_work = s->regs[R_GQSPI_DATA_STS] ||
795                           !fifo32_is_empty(&s->fifo_g);
796 
797     if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
798         if (s->man_start_com_g || (gqspi_has_work &&
799              !ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE))) {
800             xlnx_zynqmp_qspips_flush_fifo_g(s);
801         }
802     } else {
803         xilinx_spips_check_flush(XILINX_SPIPS(s));
804     }
805     if (!gqspi_has_work) {
806         s->man_start_com_g = false;
807     }
808     xlnx_zynqmp_qspips_update_ixr(s);
809 }
810 
811 static inline int rx_data_bytes(Fifo8 *fifo, uint8_t *value, int max)
812 {
813     int i;
814 
815     for (i = 0; i < max && !fifo8_is_empty(fifo); ++i) {
816         value[i] = fifo8_pop(fifo);
817     }
818     return max - i;
819 }
820 
821 static const void *pop_buf(Fifo8 *fifo, uint32_t max, uint32_t *num)
822 {
823     void *ret;
824 
825     if (max == 0 || max > fifo->num) {
826         abort();
827     }
828     *num = MIN(fifo->capacity - fifo->head, max);
829     ret = &fifo->data[fifo->head];
830     fifo->head += *num;
831     fifo->head %= fifo->capacity;
832     fifo->num -= *num;
833     return ret;
834 }
835 
836 static void xlnx_zynqmp_qspips_notify(void *opaque)
837 {
838     XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(opaque);
839     XilinxSPIPS *s = XILINX_SPIPS(rq);
840     Fifo8 *recv_fifo;
841 
842     if (ARRAY_FIELD_EX32(rq->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
843         if (!(ARRAY_FIELD_EX32(rq->regs, GQSPI_CNFG, MODE_EN) == 2)) {
844             return;
845         }
846         recv_fifo = &rq->rx_fifo_g;
847     } else {
848         if (!(s->regs[R_CMND] & R_CMND_DMA_EN)) {
849             return;
850         }
851         recv_fifo = &s->rx_fifo;
852     }
853     while (recv_fifo->num >= 4
854            && stream_can_push(rq->dma, xlnx_zynqmp_qspips_notify, rq))
855     {
856         size_t ret;
857         uint32_t num;
858         const void *rxd;
859         int len;
860 
861         len = recv_fifo->num >= rq->dma_burst_size ? rq->dma_burst_size :
862                                                    recv_fifo->num;
863         rxd = pop_buf(recv_fifo, len, &num);
864 
865         memcpy(rq->dma_buf, rxd, num);
866 
867         ret = stream_push(rq->dma, rq->dma_buf, num);
868         assert(ret == num);
869         xlnx_zynqmp_qspips_check_flush(rq);
870     }
871 }
872 
873 static uint64_t xilinx_spips_read(void *opaque, hwaddr addr,
874                                                         unsigned size)
875 {
876     XilinxSPIPS *s = opaque;
877     uint32_t mask = ~0;
878     uint32_t ret;
879     uint8_t rx_buf[4];
880     int shortfall;
881 
882     addr >>= 2;
883     switch (addr) {
884     case R_CONFIG:
885         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
886         break;
887     case R_INTR_STATUS:
888         ret = s->regs[addr] & IXR_ALL;
889         s->regs[addr] = 0;
890         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
891         xilinx_spips_update_ixr(s);
892         return ret;
893     case R_INTR_MASK:
894         mask = IXR_ALL;
895         break;
896     case  R_EN:
897         mask = 0x1;
898         break;
899     case R_SLAVE_IDLE_COUNT:
900         mask = 0xFF;
901         break;
902     case R_MOD_ID:
903         mask = 0x01FFFFFF;
904         break;
905     case R_INTR_EN:
906     case R_INTR_DIS:
907     case R_TX_DATA:
908         mask = 0;
909         break;
910     case R_RX_DATA:
911         memset(rx_buf, 0, sizeof(rx_buf));
912         shortfall = rx_data_bytes(&s->rx_fifo, rx_buf, s->num_txrx_bytes);
913         ret = s->regs[R_CONFIG] & R_CONFIG_ENDIAN ?
914                         cpu_to_be32(*(uint32_t *)rx_buf) :
915                         cpu_to_le32(*(uint32_t *)rx_buf);
916         if (!(s->regs[R_CONFIG] & R_CONFIG_ENDIAN)) {
917             ret <<= 8 * shortfall;
918         }
919         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
920         xilinx_spips_check_flush(s);
921         xilinx_spips_update_ixr(s);
922         return ret;
923     }
924     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4,
925                s->regs[addr] & mask);
926     return s->regs[addr] & mask;
927 
928 }
929 
930 static uint64_t xlnx_zynqmp_qspips_read(void *opaque,
931                                         hwaddr addr, unsigned size)
932 {
933     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
934     uint32_t reg = addr / 4;
935     uint32_t ret;
936     uint8_t rx_buf[4];
937     int shortfall;
938 
939     if (reg <= R_MOD_ID) {
940         return xilinx_spips_read(opaque, addr, size);
941     } else {
942         switch (reg) {
943         case R_GQSPI_RXD:
944             if (fifo8_is_empty(&s->rx_fifo_g)) {
945                 qemu_log_mask(LOG_GUEST_ERROR,
946                               "Read from empty GQSPI RX FIFO\n");
947                 return 0;
948             }
949             memset(rx_buf, 0, sizeof(rx_buf));
950             shortfall = rx_data_bytes(&s->rx_fifo_g, rx_buf,
951                                       XILINX_SPIPS(s)->num_txrx_bytes);
952             ret = ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN) ?
953                   cpu_to_be32(*(uint32_t *)rx_buf) :
954                   cpu_to_le32(*(uint32_t *)rx_buf);
955             if (!ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN)) {
956                 ret <<= 8 * shortfall;
957             }
958             xlnx_zynqmp_qspips_check_flush(s);
959             xlnx_zynqmp_qspips_update_ixr(s);
960             return ret;
961         default:
962             return s->regs[reg];
963         }
964     }
965 }
966 
967 static void xilinx_spips_write(void *opaque, hwaddr addr,
968                                         uint64_t value, unsigned size)
969 {
970     int mask = ~0;
971     XilinxSPIPS *s = opaque;
972 
973     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr, (unsigned)value);
974     addr >>= 2;
975     switch (addr) {
976     case R_CONFIG:
977         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
978         if ((value & MAN_START_COM) && (s->regs[R_CONFIG] & MAN_START_EN)) {
979             s->man_start_com = true;
980         }
981         break;
982     case R_INTR_STATUS:
983         mask = IXR_ALL;
984         s->regs[R_INTR_STATUS] &= ~(mask & value);
985         goto no_reg_update;
986     case R_INTR_DIS:
987         mask = IXR_ALL;
988         s->regs[R_INTR_MASK] &= ~(mask & value);
989         goto no_reg_update;
990     case R_INTR_EN:
991         mask = IXR_ALL;
992         s->regs[R_INTR_MASK] |= mask & value;
993         goto no_reg_update;
994     case R_EN:
995         mask = 0x1;
996         break;
997     case R_SLAVE_IDLE_COUNT:
998         mask = 0xFF;
999         break;
1000     case R_RX_DATA:
1001     case R_INTR_MASK:
1002     case R_MOD_ID:
1003         mask = 0;
1004         break;
1005     case R_TX_DATA:
1006         tx_data_bytes(&s->tx_fifo, (uint32_t)value, s->num_txrx_bytes,
1007                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1008         goto no_reg_update;
1009     case R_TXD1:
1010         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 1,
1011                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1012         goto no_reg_update;
1013     case R_TXD2:
1014         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 2,
1015                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1016         goto no_reg_update;
1017     case R_TXD3:
1018         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 3,
1019                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1020         goto no_reg_update;
1021     }
1022     s->regs[addr] = (s->regs[addr] & ~mask) | (value & mask);
1023 no_reg_update:
1024     xilinx_spips_update_cs_lines(s);
1025     xilinx_spips_check_flush(s);
1026     xilinx_spips_update_cs_lines(s);
1027     xilinx_spips_update_ixr(s);
1028 }
1029 
1030 static const MemoryRegionOps spips_ops = {
1031     .read = xilinx_spips_read,
1032     .write = xilinx_spips_write,
1033     .endianness = DEVICE_LITTLE_ENDIAN,
1034 };
1035 
1036 static void xilinx_qspips_invalidate_mmio_ptr(XilinxQSPIPS *q)
1037 {
1038     q->lqspi_cached_addr = ~0ULL;
1039 }
1040 
1041 static void xilinx_qspips_write(void *opaque, hwaddr addr,
1042                                 uint64_t value, unsigned size)
1043 {
1044     XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
1045     XilinxSPIPS *s = XILINX_SPIPS(opaque);
1046 
1047     xilinx_spips_write(opaque, addr, value, size);
1048     addr >>= 2;
1049 
1050     if (addr == R_LQSPI_CFG) {
1051         xilinx_qspips_invalidate_mmio_ptr(q);
1052     }
1053     if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
1054         fifo8_reset(&s->rx_fifo);
1055     }
1056 }
1057 
1058 static void xlnx_zynqmp_qspips_write(void *opaque, hwaddr addr,
1059                                         uint64_t value, unsigned size)
1060 {
1061     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
1062     uint32_t reg = addr / 4;
1063 
1064     if (reg <= R_MOD_ID) {
1065         xilinx_qspips_write(opaque, addr, value, size);
1066     } else {
1067         switch (reg) {
1068         case R_GQSPI_CNFG:
1069             if (FIELD_EX32(value, GQSPI_CNFG, GEN_FIFO_START) &&
1070                 ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE)) {
1071                 s->man_start_com_g = true;
1072             }
1073             s->regs[reg] = value & ~(R_GQSPI_CNFG_GEN_FIFO_START_MASK);
1074             break;
1075         case R_GQSPI_GEN_FIFO:
1076             if (!fifo32_is_full(&s->fifo_g)) {
1077                 fifo32_push(&s->fifo_g, value);
1078             }
1079             break;
1080         case R_GQSPI_TXD:
1081             tx_data_bytes(&s->tx_fifo_g, (uint32_t)value, 4,
1082                           ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN));
1083             break;
1084         case R_GQSPI_FIFO_CTRL:
1085             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET)) {
1086                 fifo32_reset(&s->fifo_g);
1087             }
1088             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, TX_FIFO_RESET)) {
1089                 fifo8_reset(&s->tx_fifo_g);
1090             }
1091             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, RX_FIFO_RESET)) {
1092                 fifo8_reset(&s->rx_fifo_g);
1093             }
1094             break;
1095         case R_GQSPI_IDR:
1096             s->regs[R_GQSPI_IMR] |= value;
1097             break;
1098         case R_GQSPI_IER:
1099             s->regs[R_GQSPI_IMR] &= ~value;
1100             break;
1101         case R_GQSPI_ISR:
1102             s->regs[R_GQSPI_ISR] &= ~value;
1103             break;
1104         case R_GQSPI_IMR:
1105         case R_GQSPI_RXD:
1106         case R_GQSPI_GF_SNAPSHOT:
1107         case R_GQSPI_MOD_ID:
1108             break;
1109         default:
1110             s->regs[reg] = value;
1111             break;
1112         }
1113         xlnx_zynqmp_qspips_update_cs_lines(s);
1114         xlnx_zynqmp_qspips_check_flush(s);
1115         xlnx_zynqmp_qspips_update_cs_lines(s);
1116         xlnx_zynqmp_qspips_update_ixr(s);
1117     }
1118     xlnx_zynqmp_qspips_notify(s);
1119 }
1120 
1121 static const MemoryRegionOps qspips_ops = {
1122     .read = xilinx_spips_read,
1123     .write = xilinx_qspips_write,
1124     .endianness = DEVICE_LITTLE_ENDIAN,
1125 };
1126 
1127 static const MemoryRegionOps xlnx_zynqmp_qspips_ops = {
1128     .read = xlnx_zynqmp_qspips_read,
1129     .write = xlnx_zynqmp_qspips_write,
1130     .endianness = DEVICE_LITTLE_ENDIAN,
1131 };
1132 
1133 #define LQSPI_CACHE_SIZE 1024
1134 
1135 static void lqspi_load_cache(void *opaque, hwaddr addr)
1136 {
1137     XilinxQSPIPS *q = opaque;
1138     XilinxSPIPS *s = opaque;
1139     int i;
1140     int flash_addr = ((addr & ~(LQSPI_CACHE_SIZE - 1))
1141                    / num_effective_busses(s));
1142     int slave = flash_addr >> LQSPI_ADDRESS_BITS;
1143     int cache_entry = 0;
1144     uint32_t u_page_save = s->regs[R_LQSPI_STS] & ~LQSPI_CFG_U_PAGE;
1145 
1146     if (addr < q->lqspi_cached_addr ||
1147             addr > q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1148         xilinx_qspips_invalidate_mmio_ptr(q);
1149         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1150         s->regs[R_LQSPI_STS] |= slave ? LQSPI_CFG_U_PAGE : 0;
1151 
1152         DB_PRINT_L(0, "config reg status: %08x\n", s->regs[R_LQSPI_CFG]);
1153 
1154         fifo8_reset(&s->tx_fifo);
1155         fifo8_reset(&s->rx_fifo);
1156 
1157         /* instruction */
1158         DB_PRINT_L(0, "pushing read instruction: %02x\n",
1159                    (unsigned)(uint8_t)(s->regs[R_LQSPI_CFG] &
1160                                        LQSPI_CFG_INST_CODE));
1161         fifo8_push(&s->tx_fifo, s->regs[R_LQSPI_CFG] & LQSPI_CFG_INST_CODE);
1162         /* read address */
1163         DB_PRINT_L(0, "pushing read address %06x\n", flash_addr);
1164         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_ADDR4) {
1165             fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 24));
1166         }
1167         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 16));
1168         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 8));
1169         fifo8_push(&s->tx_fifo, (uint8_t)flash_addr);
1170         /* mode bits */
1171         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_MODE_EN) {
1172             fifo8_push(&s->tx_fifo, extract32(s->regs[R_LQSPI_CFG],
1173                                               LQSPI_CFG_MODE_SHIFT,
1174                                               LQSPI_CFG_MODE_WIDTH));
1175         }
1176         /* dummy bytes */
1177         for (i = 0; i < (extract32(s->regs[R_LQSPI_CFG], LQSPI_CFG_DUMMY_SHIFT,
1178                                    LQSPI_CFG_DUMMY_WIDTH)); ++i) {
1179             DB_PRINT_L(0, "pushing dummy byte\n");
1180             fifo8_push(&s->tx_fifo, 0);
1181         }
1182         xilinx_spips_update_cs_lines(s);
1183         xilinx_spips_flush_txfifo(s);
1184         fifo8_reset(&s->rx_fifo);
1185 
1186         DB_PRINT_L(0, "starting QSPI data read\n");
1187 
1188         while (cache_entry < LQSPI_CACHE_SIZE) {
1189             for (i = 0; i < 64; ++i) {
1190                 tx_data_bytes(&s->tx_fifo, 0, 1, false);
1191             }
1192             xilinx_spips_flush_txfifo(s);
1193             for (i = 0; i < 64; ++i) {
1194                 rx_data_bytes(&s->rx_fifo, &q->lqspi_buf[cache_entry++], 1);
1195             }
1196         }
1197 
1198         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1199         s->regs[R_LQSPI_STS] |= u_page_save;
1200         xilinx_spips_update_cs_lines(s);
1201 
1202         q->lqspi_cached_addr = flash_addr * num_effective_busses(s);
1203     }
1204 }
1205 
1206 static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
1207                               unsigned size, MemTxAttrs attrs)
1208 {
1209     XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
1210 
1211     if (addr >= q->lqspi_cached_addr &&
1212             addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1213         uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
1214         *value = cpu_to_le32(*(uint32_t *)retp);
1215         DB_PRINT_L(1, "addr: %08" HWADDR_PRIx ", data: %08" PRIx64 "\n",
1216                    addr, *value);
1217         return MEMTX_OK;
1218     }
1219 
1220     lqspi_load_cache(opaque, addr);
1221     return lqspi_read(opaque, addr, value, size, attrs);
1222 }
1223 
1224 static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,
1225                                unsigned size, MemTxAttrs attrs)
1226 {
1227     /*
1228      * From UG1085, Chapter 24 (Quad-SPI controllers):
1229      * - Writes are ignored
1230      * - AXI writes generate an external AXI slave error (SLVERR)
1231      */
1232     qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64
1233                                    " (value: 0x%" PRIx64 "\n",
1234                   __func__, size << 3, offset, value);
1235 
1236     return MEMTX_ERROR;
1237 }
1238 
1239 static const MemoryRegionOps lqspi_ops = {
1240     .read_with_attrs = lqspi_read,
1241     .write_with_attrs = lqspi_write,
1242     .endianness = DEVICE_NATIVE_ENDIAN,
1243     .impl = {
1244         .min_access_size = 4,
1245         .max_access_size = 4,
1246     },
1247     .valid = {
1248         .min_access_size = 1,
1249         .max_access_size = 4
1250     }
1251 };
1252 
1253 static void xilinx_spips_realize(DeviceState *dev, Error **errp)
1254 {
1255     XilinxSPIPS *s = XILINX_SPIPS(dev);
1256     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1257     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1258     qemu_irq *cs;
1259     int i;
1260 
1261     DB_PRINT_L(0, "realized spips\n");
1262 
1263     if (s->num_busses > MAX_NUM_BUSSES) {
1264         error_setg(errp,
1265                    "requested number of SPI busses %u exceeds maximum %d",
1266                    s->num_busses, MAX_NUM_BUSSES);
1267         return;
1268     }
1269     if (s->num_busses < MIN_NUM_BUSSES) {
1270         error_setg(errp,
1271                    "requested number of SPI busses %u is below minimum %d",
1272                    s->num_busses, MIN_NUM_BUSSES);
1273         return;
1274     }
1275 
1276     s->spi = g_new(SSIBus *, s->num_busses);
1277     for (i = 0; i < s->num_busses; ++i) {
1278         char bus_name[16];
1279         snprintf(bus_name, 16, "spi%d", i);
1280         s->spi[i] = ssi_create_bus(dev, bus_name);
1281     }
1282 
1283     s->cs_lines = g_new0(qemu_irq, s->num_cs * s->num_busses);
1284     s->cs_lines_state = g_new0(bool, s->num_cs * s->num_busses);
1285     for (i = 0, cs = s->cs_lines; i < s->num_busses; ++i, cs += s->num_cs) {
1286         ssi_auto_connect_slaves(DEVICE(s), cs, s->spi[i]);
1287     }
1288 
1289     sysbus_init_irq(sbd, &s->irq);
1290     for (i = 0; i < s->num_cs * s->num_busses; ++i) {
1291         sysbus_init_irq(sbd, &s->cs_lines[i]);
1292     }
1293 
1294     memory_region_init_io(&s->iomem, OBJECT(s), xsc->reg_ops, s,
1295                           "spi", XLNX_ZYNQMP_SPIPS_R_MAX * 4);
1296     sysbus_init_mmio(sbd, &s->iomem);
1297 
1298     s->irqline = -1;
1299 
1300     fifo8_create(&s->rx_fifo, xsc->rx_fifo_size);
1301     fifo8_create(&s->tx_fifo, xsc->tx_fifo_size);
1302 }
1303 
1304 static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
1305 {
1306     XilinxSPIPS *s = XILINX_SPIPS(dev);
1307     XilinxQSPIPS *q = XILINX_QSPIPS(dev);
1308     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1309 
1310     DB_PRINT_L(0, "realized qspips\n");
1311 
1312     s->num_busses = 2;
1313     s->num_cs = 2;
1314     s->num_txrx_bytes = 4;
1315 
1316     xilinx_spips_realize(dev, errp);
1317     memory_region_init_io(&s->mmlqspi, OBJECT(s), &lqspi_ops, s, "lqspi",
1318                           (1 << LQSPI_ADDRESS_BITS) * 2);
1319     sysbus_init_mmio(sbd, &s->mmlqspi);
1320 
1321     q->lqspi_cached_addr = ~0ULL;
1322 }
1323 
1324 static void xlnx_zynqmp_qspips_realize(DeviceState *dev, Error **errp)
1325 {
1326     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(dev);
1327     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1328 
1329     if (s->dma_burst_size > QSPI_DMA_MAX_BURST_SIZE) {
1330         error_setg(errp,
1331                    "qspi dma burst size %u exceeds maximum limit %d",
1332                    s->dma_burst_size, QSPI_DMA_MAX_BURST_SIZE);
1333         return;
1334     }
1335     xilinx_qspips_realize(dev, errp);
1336     fifo8_create(&s->rx_fifo_g, xsc->rx_fifo_size);
1337     fifo8_create(&s->tx_fifo_g, xsc->tx_fifo_size);
1338     fifo32_create(&s->fifo_g, 32);
1339 }
1340 
1341 static void xlnx_zynqmp_qspips_init(Object *obj)
1342 {
1343     XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(obj);
1344 
1345     object_property_add_link(obj, "stream-connected-dma", TYPE_STREAM_SLAVE,
1346                              (Object **)&rq->dma,
1347                              object_property_allow_set_link,
1348                              OBJ_PROP_LINK_STRONG,
1349                              NULL);
1350 }
1351 
1352 static int xilinx_spips_post_load(void *opaque, int version_id)
1353 {
1354     xilinx_spips_update_ixr((XilinxSPIPS *)opaque);
1355     xilinx_spips_update_cs_lines((XilinxSPIPS *)opaque);
1356     return 0;
1357 }
1358 
1359 static const VMStateDescription vmstate_xilinx_spips = {
1360     .name = "xilinx_spips",
1361     .version_id = 2,
1362     .minimum_version_id = 2,
1363     .post_load = xilinx_spips_post_load,
1364     .fields = (VMStateField[]) {
1365         VMSTATE_FIFO8(tx_fifo, XilinxSPIPS),
1366         VMSTATE_FIFO8(rx_fifo, XilinxSPIPS),
1367         VMSTATE_UINT32_ARRAY(regs, XilinxSPIPS, XLNX_SPIPS_R_MAX),
1368         VMSTATE_UINT8(snoop_state, XilinxSPIPS),
1369         VMSTATE_END_OF_LIST()
1370     }
1371 };
1372 
1373 static int xlnx_zynqmp_qspips_post_load(void *opaque, int version_id)
1374 {
1375     XlnxZynqMPQSPIPS *s = (XlnxZynqMPQSPIPS *)opaque;
1376     XilinxSPIPS *qs = XILINX_SPIPS(s);
1377 
1378     if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN) &&
1379         fifo8_is_empty(&qs->rx_fifo) && fifo8_is_empty(&qs->tx_fifo)) {
1380         xlnx_zynqmp_qspips_update_ixr(s);
1381         xlnx_zynqmp_qspips_update_cs_lines(s);
1382     }
1383     return 0;
1384 }
1385 
1386 static const VMStateDescription vmstate_xilinx_qspips = {
1387     .name = "xilinx_qspips",
1388     .version_id = 1,
1389     .minimum_version_id = 1,
1390     .fields = (VMStateField[]) {
1391         VMSTATE_STRUCT(parent_obj, XilinxQSPIPS, 0,
1392                        vmstate_xilinx_spips, XilinxSPIPS),
1393         VMSTATE_END_OF_LIST()
1394     }
1395 };
1396 
1397 static const VMStateDescription vmstate_xlnx_zynqmp_qspips = {
1398     .name = "xlnx_zynqmp_qspips",
1399     .version_id = 1,
1400     .minimum_version_id = 1,
1401     .post_load = xlnx_zynqmp_qspips_post_load,
1402     .fields = (VMStateField[]) {
1403         VMSTATE_STRUCT(parent_obj, XlnxZynqMPQSPIPS, 0,
1404                        vmstate_xilinx_qspips, XilinxQSPIPS),
1405         VMSTATE_FIFO8(tx_fifo_g, XlnxZynqMPQSPIPS),
1406         VMSTATE_FIFO8(rx_fifo_g, XlnxZynqMPQSPIPS),
1407         VMSTATE_FIFO32(fifo_g, XlnxZynqMPQSPIPS),
1408         VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPQSPIPS, XLNX_ZYNQMP_SPIPS_R_MAX),
1409         VMSTATE_END_OF_LIST()
1410     }
1411 };
1412 
1413 static Property xilinx_zynqmp_qspips_properties[] = {
1414     DEFINE_PROP_UINT32("dma-burst-size", XlnxZynqMPQSPIPS, dma_burst_size, 64),
1415     DEFINE_PROP_END_OF_LIST(),
1416 };
1417 
1418 static Property xilinx_spips_properties[] = {
1419     DEFINE_PROP_UINT8("num-busses", XilinxSPIPS, num_busses, 1),
1420     DEFINE_PROP_UINT8("num-ss-bits", XilinxSPIPS, num_cs, 4),
1421     DEFINE_PROP_UINT8("num-txrx-bytes", XilinxSPIPS, num_txrx_bytes, 1),
1422     DEFINE_PROP_END_OF_LIST(),
1423 };
1424 
1425 static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
1426 {
1427     DeviceClass *dc = DEVICE_CLASS(klass);
1428     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1429 
1430     dc->realize = xilinx_qspips_realize;
1431     xsc->reg_ops = &qspips_ops;
1432     xsc->rx_fifo_size = RXFF_A_Q;
1433     xsc->tx_fifo_size = TXFF_A_Q;
1434 }
1435 
1436 static void xilinx_spips_class_init(ObjectClass *klass, void *data)
1437 {
1438     DeviceClass *dc = DEVICE_CLASS(klass);
1439     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1440 
1441     dc->realize = xilinx_spips_realize;
1442     dc->reset = xilinx_spips_reset;
1443     dc->props = xilinx_spips_properties;
1444     dc->vmsd = &vmstate_xilinx_spips;
1445 
1446     xsc->reg_ops = &spips_ops;
1447     xsc->rx_fifo_size = RXFF_A;
1448     xsc->tx_fifo_size = TXFF_A;
1449 }
1450 
1451 static void xlnx_zynqmp_qspips_class_init(ObjectClass *klass, void * data)
1452 {
1453     DeviceClass *dc = DEVICE_CLASS(klass);
1454     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1455 
1456     dc->realize = xlnx_zynqmp_qspips_realize;
1457     dc->reset = xlnx_zynqmp_qspips_reset;
1458     dc->vmsd = &vmstate_xlnx_zynqmp_qspips;
1459     dc->props = xilinx_zynqmp_qspips_properties;
1460     xsc->reg_ops = &xlnx_zynqmp_qspips_ops;
1461     xsc->rx_fifo_size = RXFF_A_Q;
1462     xsc->tx_fifo_size = TXFF_A_Q;
1463 }
1464 
1465 static const TypeInfo xilinx_spips_info = {
1466     .name  = TYPE_XILINX_SPIPS,
1467     .parent = TYPE_SYS_BUS_DEVICE,
1468     .instance_size  = sizeof(XilinxSPIPS),
1469     .class_init = xilinx_spips_class_init,
1470     .class_size = sizeof(XilinxSPIPSClass),
1471 };
1472 
1473 static const TypeInfo xilinx_qspips_info = {
1474     .name  = TYPE_XILINX_QSPIPS,
1475     .parent = TYPE_XILINX_SPIPS,
1476     .instance_size  = sizeof(XilinxQSPIPS),
1477     .class_init = xilinx_qspips_class_init,
1478 };
1479 
1480 static const TypeInfo xlnx_zynqmp_qspips_info = {
1481     .name  = TYPE_XLNX_ZYNQMP_QSPIPS,
1482     .parent = TYPE_XILINX_QSPIPS,
1483     .instance_size  = sizeof(XlnxZynqMPQSPIPS),
1484     .instance_init  = xlnx_zynqmp_qspips_init,
1485     .class_init = xlnx_zynqmp_qspips_class_init,
1486 };
1487 
1488 static void xilinx_spips_register_types(void)
1489 {
1490     type_register_static(&xilinx_spips_info);
1491     type_register_static(&xilinx_qspips_info);
1492     type_register_static(&xlnx_zynqmp_qspips_info);
1493 }
1494 
1495 type_init(xilinx_spips_register_types)
1496