xref: /qemu/hw/ssi/aspeed_smc.c (revision bdb3748d)
1 /*
2  * ASPEED AST2400 SMC Controller (SPI Flash Only)
3  *
4  * Copyright (C) 2016 IBM Corp.
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "hw/block/flash.h"
27 #include "hw/sysbus.h"
28 #include "migration/vmstate.h"
29 #include "qemu/log.h"
30 #include "qemu/module.h"
31 #include "qemu/error-report.h"
32 #include "qapi/error.h"
33 #include "qemu/units.h"
34 #include "trace.h"
35 
36 #include "hw/irq.h"
37 #include "hw/qdev-properties.h"
38 #include "hw/ssi/aspeed_smc.h"
39 
40 /* CE Type Setting Register */
41 #define R_CONF            (0x00 / 4)
42 #define   CONF_LEGACY_DISABLE  (1 << 31)
43 #define   CONF_ENABLE_W4       20
44 #define   CONF_ENABLE_W3       19
45 #define   CONF_ENABLE_W2       18
46 #define   CONF_ENABLE_W1       17
47 #define   CONF_ENABLE_W0       16
48 #define   CONF_FLASH_TYPE4     8
49 #define   CONF_FLASH_TYPE3     6
50 #define   CONF_FLASH_TYPE2     4
51 #define   CONF_FLASH_TYPE1     2
52 #define   CONF_FLASH_TYPE0     0
53 #define      CONF_FLASH_TYPE_NOR   0x0
54 #define      CONF_FLASH_TYPE_NAND  0x1
55 #define      CONF_FLASH_TYPE_SPI   0x2 /* AST2600 is SPI only */
56 
57 /* CE Control Register */
58 #define R_CE_CTRL            (0x04 / 4)
59 #define   CTRL_EXTENDED4       4  /* 32 bit addressing for SPI */
60 #define   CTRL_EXTENDED3       3  /* 32 bit addressing for SPI */
61 #define   CTRL_EXTENDED2       2  /* 32 bit addressing for SPI */
62 #define   CTRL_EXTENDED1       1  /* 32 bit addressing for SPI */
63 #define   CTRL_EXTENDED0       0  /* 32 bit addressing for SPI */
64 
65 /* Interrupt Control and Status Register */
66 #define R_INTR_CTRL       (0x08 / 4)
67 #define   INTR_CTRL_DMA_STATUS            (1 << 11)
68 #define   INTR_CTRL_CMD_ABORT_STATUS      (1 << 10)
69 #define   INTR_CTRL_WRITE_PROTECT_STATUS  (1 << 9)
70 #define   INTR_CTRL_DMA_EN                (1 << 3)
71 #define   INTR_CTRL_CMD_ABORT_EN          (1 << 2)
72 #define   INTR_CTRL_WRITE_PROTECT_EN      (1 << 1)
73 
74 /* Command Control Register */
75 #define R_CE_CMD_CTRL      (0x0C / 4)
76 #define   CTRL_ADDR_BYTE0_DISABLE_SHIFT       4
77 #define   CTRL_DATA_BYTE0_DISABLE_SHIFT       0
78 
79 #define aspeed_smc_addr_byte_enabled(s, i)                               \
80     (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_ADDR_BYTE0_DISABLE_SHIFT + (i)))))
81 #define aspeed_smc_data_byte_enabled(s, i)                               \
82     (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_DATA_BYTE0_DISABLE_SHIFT + (i)))))
83 
84 /* CEx Control Register */
85 #define R_CTRL0           (0x10 / 4)
86 #define   CTRL_IO_QPI              (1 << 31)
87 #define   CTRL_IO_QUAD_DATA        (1 << 30)
88 #define   CTRL_IO_DUAL_DATA        (1 << 29)
89 #define   CTRL_IO_DUAL_ADDR_DATA   (1 << 28) /* Includes dummies */
90 #define   CTRL_IO_QUAD_ADDR_DATA   (1 << 28) /* Includes dummies */
91 #define   CTRL_CMD_SHIFT           16
92 #define   CTRL_CMD_MASK            0xff
93 #define   CTRL_DUMMY_HIGH_SHIFT    14
94 #define   CTRL_AST2400_SPI_4BYTE   (1 << 13)
95 #define CE_CTRL_CLOCK_FREQ_SHIFT   8
96 #define CE_CTRL_CLOCK_FREQ_MASK    0xf
97 #define CE_CTRL_CLOCK_FREQ(div)                                         \
98     (((div) & CE_CTRL_CLOCK_FREQ_MASK) << CE_CTRL_CLOCK_FREQ_SHIFT)
99 #define   CTRL_DUMMY_LOW_SHIFT     6 /* 2 bits [7:6] */
100 #define   CTRL_CE_STOP_ACTIVE      (1 << 2)
101 #define   CTRL_CMD_MODE_MASK       0x3
102 #define     CTRL_READMODE          0x0
103 #define     CTRL_FREADMODE         0x1
104 #define     CTRL_WRITEMODE         0x2
105 #define     CTRL_USERMODE          0x3
106 #define R_CTRL1           (0x14 / 4)
107 #define R_CTRL2           (0x18 / 4)
108 #define R_CTRL3           (0x1C / 4)
109 #define R_CTRL4           (0x20 / 4)
110 
111 /* CEx Segment Address Register */
112 #define R_SEG_ADDR0       (0x30 / 4)
113 #define   SEG_END_SHIFT        24   /* 8MB units */
114 #define   SEG_END_MASK         0xff
115 #define   SEG_START_SHIFT      16   /* address bit [A29-A23] */
116 #define   SEG_START_MASK       0xff
117 #define R_SEG_ADDR1       (0x34 / 4)
118 #define R_SEG_ADDR2       (0x38 / 4)
119 #define R_SEG_ADDR3       (0x3C / 4)
120 #define R_SEG_ADDR4       (0x40 / 4)
121 
122 /* Misc Control Register #1 */
123 #define R_MISC_CTRL1      (0x50 / 4)
124 
125 /* SPI dummy cycle data */
126 #define R_DUMMY_DATA      (0x54 / 4)
127 
128 /* FMC_WDT2 Control/Status Register for Alternate Boot (AST2600) */
129 #define R_FMC_WDT2_CTRL   (0x64 / 4)
130 #define   FMC_WDT2_CTRL_ALT_BOOT_MODE    BIT(6) /* O: 2 chips 1: 1 chip */
131 #define   FMC_WDT2_CTRL_SINGLE_BOOT_MODE BIT(5)
132 #define   FMC_WDT2_CTRL_BOOT_SOURCE      BIT(4) /* O: primary 1: alternate */
133 #define   FMC_WDT2_CTRL_EN               BIT(0)
134 
135 /* DMA DRAM Side Address High Part (AST2700) */
136 #define R_DMA_DRAM_ADDR_HIGH   (0x7c / 4)
137 
138 /* DMA Control/Status Register */
139 #define R_DMA_CTRL        (0x80 / 4)
140 #define   DMA_CTRL_REQUEST      (1 << 31)
141 #define   DMA_CTRL_GRANT        (1 << 30)
142 #define   DMA_CTRL_DELAY_MASK   0xf
143 #define   DMA_CTRL_DELAY_SHIFT  8
144 #define   DMA_CTRL_FREQ_MASK    0xf
145 #define   DMA_CTRL_FREQ_SHIFT   4
146 #define   DMA_CTRL_CALIB        (1 << 3)
147 #define   DMA_CTRL_CKSUM        (1 << 2)
148 #define   DMA_CTRL_WRITE        (1 << 1)
149 #define   DMA_CTRL_ENABLE       (1 << 0)
150 
151 /* DMA Flash Side Address */
152 #define R_DMA_FLASH_ADDR  (0x84 / 4)
153 
154 /* DMA DRAM Side Address */
155 #define R_DMA_DRAM_ADDR   (0x88 / 4)
156 
157 /* DMA Length Register */
158 #define R_DMA_LEN         (0x8C / 4)
159 
160 /* Checksum Calculation Result */
161 #define R_DMA_CHECKSUM    (0x90 / 4)
162 
163 /* Read Timing Compensation Register */
164 #define R_TIMINGS         (0x94 / 4)
165 
166 /* SPI controller registers and bits (AST2400) */
167 #define R_SPI_CONF        (0x00 / 4)
168 #define   SPI_CONF_ENABLE_W0   0
169 #define R_SPI_CTRL0       (0x4 / 4)
170 #define R_SPI_MISC_CTRL   (0x10 / 4)
171 #define R_SPI_TIMINGS     (0x14 / 4)
172 
173 #define ASPEED_SMC_R_SPI_MAX (0x20 / 4)
174 #define ASPEED_SMC_R_SMC_MAX (0x20 / 4)
175 
176 /*
177  * DMA DRAM addresses should be 4 bytes aligned and the valid address
178  * range is 0x40000000 - 0x5FFFFFFF (AST2400)
179  *          0x80000000 - 0xBFFFFFFF (AST2500)
180  *
181  * DMA flash addresses should be 4 bytes aligned and the valid address
182  * range is 0x20000000 - 0x2FFFFFFF.
183  *
184  * DMA length is from 4 bytes to 32MB (AST2500)
185  *   0: 4 bytes
186  *   0x1FFFFFC: 32M bytes
187  *
188  * DMA length is from 1 byte to 32MB (AST2600, AST10x0 and AST2700)
189  *   0: 1 byte
190  *   0x1FFFFFF: 32M bytes
191  */
192 #define DMA_DRAM_ADDR(asc, val)   ((val) & (asc)->dma_dram_mask)
193 #define DMA_DRAM_ADDR_HIGH(val)   ((val) & 0xf)
194 #define DMA_FLASH_ADDR(asc, val)  ((val) & (asc)->dma_flash_mask)
195 #define DMA_LENGTH(val)         ((val) & 0x01FFFFFF)
196 
197 /* Flash opcodes. */
198 #define SPI_OP_READ       0x03    /* Read data bytes (low frequency) */
199 
200 #define SNOOP_OFF         0xFF
201 #define SNOOP_START       0x0
202 
203 /*
204  * Default segments mapping addresses and size for each peripheral per
205  * controller. These can be changed when board is initialized with the
206  * Segment Address Registers.
207  */
208 static const AspeedSegments aspeed_2500_spi1_segments[];
209 static const AspeedSegments aspeed_2500_spi2_segments[];
210 
211 #define ASPEED_SMC_FEATURE_DMA       0x1
212 #define ASPEED_SMC_FEATURE_DMA_GRANT 0x2
213 #define ASPEED_SMC_FEATURE_WDT_CONTROL 0x4
214 #define ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH 0x08
215 
216 static inline bool aspeed_smc_has_dma(const AspeedSMCClass *asc)
217 {
218     return !!(asc->features & ASPEED_SMC_FEATURE_DMA);
219 }
220 
221 static inline bool aspeed_smc_has_wdt_control(const AspeedSMCClass *asc)
222 {
223     return !!(asc->features & ASPEED_SMC_FEATURE_WDT_CONTROL);
224 }
225 
226 static inline bool aspeed_smc_has_dma64(const AspeedSMCClass *asc)
227 {
228     return !!(asc->features & ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH);
229 }
230 
231 #define aspeed_smc_error(fmt, ...)                                      \
232     qemu_log_mask(LOG_GUEST_ERROR, "%s: " fmt "\n", __func__, ## __VA_ARGS__)
233 
234 static bool aspeed_smc_flash_overlap(const AspeedSMCState *s,
235                                      const AspeedSegments *new,
236                                      int cs)
237 {
238     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
239     AspeedSegments seg;
240     int i;
241 
242     for (i = 0; i < asc->cs_num_max; i++) {
243         if (i == cs) {
244             continue;
245         }
246 
247         asc->reg_to_segment(s, s->regs[R_SEG_ADDR0 + i], &seg);
248 
249         if (new->addr + new->size > seg.addr &&
250             new->addr < seg.addr + seg.size) {
251             aspeed_smc_error("new segment CS%d [ 0x%"
252                              HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with "
253                              "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
254                              cs, new->addr, new->addr + new->size,
255                              i, seg.addr, seg.addr + seg.size);
256             return true;
257         }
258     }
259     return false;
260 }
261 
262 static void aspeed_smc_flash_set_segment_region(AspeedSMCState *s, int cs,
263                                                 uint64_t regval)
264 {
265     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
266     AspeedSMCFlash *fl = &s->flashes[cs];
267     AspeedSegments seg;
268 
269     asc->reg_to_segment(s, regval, &seg);
270 
271     memory_region_transaction_begin();
272     memory_region_set_size(&fl->mmio, seg.size);
273     memory_region_set_address(&fl->mmio, seg.addr - asc->flash_window_base);
274     memory_region_set_enabled(&fl->mmio, !!seg.size);
275     memory_region_transaction_commit();
276 
277     if (asc->segment_addr_mask) {
278         regval &= asc->segment_addr_mask;
279     }
280 
281     s->regs[R_SEG_ADDR0 + cs] = regval;
282 }
283 
284 static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
285                                          uint64_t new)
286 {
287     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
288     AspeedSegments seg;
289 
290     asc->reg_to_segment(s, new, &seg);
291 
292     trace_aspeed_smc_flash_set_segment(cs, new, seg.addr, seg.addr + seg.size);
293 
294     /* The start address of CS0 is read-only */
295     if (cs == 0 && seg.addr != asc->flash_window_base) {
296         aspeed_smc_error("Tried to change CS0 start address to 0x%"
297                          HWADDR_PRIx, seg.addr);
298         seg.addr = asc->flash_window_base;
299         new = asc->segment_to_reg(s, &seg);
300     }
301 
302     /*
303      * The end address of the AST2500 spi controllers is also
304      * read-only.
305      */
306     if ((asc->segments == aspeed_2500_spi1_segments ||
307          asc->segments == aspeed_2500_spi2_segments) &&
308         cs == asc->cs_num_max &&
309         seg.addr + seg.size != asc->segments[cs].addr +
310         asc->segments[cs].size) {
311         aspeed_smc_error("Tried to change CS%d end address to 0x%"
312                          HWADDR_PRIx, cs, seg.addr + seg.size);
313         seg.size = asc->segments[cs].addr + asc->segments[cs].size -
314             seg.addr;
315         new = asc->segment_to_reg(s, &seg);
316     }
317 
318     /* Keep the segment in the overall flash window */
319     if (seg.size &&
320         (seg.addr + seg.size <= asc->flash_window_base ||
321          seg.addr > asc->flash_window_base + asc->flash_window_size)) {
322         aspeed_smc_error("new segment for CS%d is invalid : "
323                          "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
324                          cs, seg.addr, seg.addr + seg.size);
325         return;
326     }
327 
328     /* Check start address vs. alignment */
329     if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) {
330         aspeed_smc_error("new segment for CS%d is not "
331                          "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
332                          cs, seg.addr, seg.addr + seg.size);
333     }
334 
335     /* And segments should not overlap (in the specs) */
336     aspeed_smc_flash_overlap(s, &seg, cs);
337 
338     /* All should be fine now to move the region */
339     aspeed_smc_flash_set_segment_region(s, cs, new);
340 }
341 
342 static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr,
343                                               unsigned size)
344 {
345     aspeed_smc_error("To 0x%" HWADDR_PRIx " of size %u", addr, size);
346     return 0;
347 }
348 
349 static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr,
350                                            uint64_t data, unsigned size)
351 {
352     aspeed_smc_error("To 0x%" HWADDR_PRIx " of size %u: 0x%" PRIx64,
353                      addr, size, data);
354 }
355 
356 static const MemoryRegionOps aspeed_smc_flash_default_ops = {
357     .read = aspeed_smc_flash_default_read,
358     .write = aspeed_smc_flash_default_write,
359     .endianness = DEVICE_LITTLE_ENDIAN,
360     .valid = {
361         .min_access_size = 1,
362         .max_access_size = 4,
363     },
364 };
365 
366 static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl)
367 {
368     const AspeedSMCState *s = fl->controller;
369 
370     return s->regs[s->r_ctrl0 + fl->cs] & CTRL_CMD_MODE_MASK;
371 }
372 
373 static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl)
374 {
375     const AspeedSMCState *s = fl->controller;
376 
377     return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->cs));
378 }
379 
380 static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl)
381 {
382     const AspeedSMCState *s = fl->controller;
383     int cmd = (s->regs[s->r_ctrl0 + fl->cs] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK;
384 
385     /*
386      * In read mode, the default SPI command is READ (0x3). In other
387      * modes, the command should necessarily be defined
388      *
389      * TODO: add support for READ4 (0x13) on AST2600
390      */
391     if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) {
392         cmd = SPI_OP_READ;
393     }
394 
395     if (!cmd) {
396         aspeed_smc_error("no command defined for mode %d",
397                          aspeed_smc_flash_mode(fl));
398     }
399 
400     return cmd;
401 }
402 
403 static inline int aspeed_smc_flash_addr_width(const AspeedSMCFlash *fl)
404 {
405     const AspeedSMCState *s = fl->controller;
406     AspeedSMCClass *asc = fl->asc;
407 
408     if (asc->addr_width) {
409         return asc->addr_width(s);
410     } else {
411         return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->cs)) ? 4 : 3;
412     }
413 }
414 
415 static void aspeed_smc_flash_do_select(AspeedSMCFlash *fl, bool unselect)
416 {
417     AspeedSMCState *s = fl->controller;
418 
419     trace_aspeed_smc_flash_select(fl->cs, unselect ? "un" : "");
420 
421     qemu_set_irq(s->cs_lines[fl->cs], unselect);
422 }
423 
424 static void aspeed_smc_flash_select(AspeedSMCFlash *fl)
425 {
426     aspeed_smc_flash_do_select(fl, false);
427 }
428 
429 static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl)
430 {
431     aspeed_smc_flash_do_select(fl, true);
432 }
433 
434 static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
435                                               uint32_t addr)
436 {
437     const AspeedSMCState *s = fl->controller;
438     AspeedSMCClass *asc = fl->asc;
439     AspeedSegments seg;
440 
441     asc->reg_to_segment(s, s->regs[R_SEG_ADDR0 + fl->cs], &seg);
442     if ((addr % seg.size) != addr) {
443         aspeed_smc_error("invalid address 0x%08x for CS%d segment : "
444                          "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
445                          addr, fl->cs, seg.addr, seg.addr + seg.size);
446         addr %= seg.size;
447     }
448 
449     return addr;
450 }
451 
452 static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl)
453 {
454     const AspeedSMCState *s = fl->controller;
455     uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->cs];
456     uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1;
457     uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3;
458     uint32_t dummies = ((dummy_high << 2) | dummy_low) * 8;
459 
460     if (r_ctrl0 & CTRL_IO_DUAL_ADDR_DATA) {
461         dummies /= 2;
462     }
463 
464     return dummies;
465 }
466 
467 static void aspeed_smc_flash_setup(AspeedSMCFlash *fl, uint32_t addr)
468 {
469     const AspeedSMCState *s = fl->controller;
470     uint8_t cmd = aspeed_smc_flash_cmd(fl);
471     int i = aspeed_smc_flash_addr_width(fl);
472 
473     /* Flash access can not exceed CS segment */
474     addr = aspeed_smc_check_segment_addr(fl, addr);
475 
476     ssi_transfer(s->spi, cmd);
477     while (i--) {
478         if (aspeed_smc_addr_byte_enabled(s, i)) {
479             ssi_transfer(s->spi, (addr >> (i * 8)) & 0xff);
480         }
481     }
482 
483     /*
484      * Use fake transfers to model dummy bytes. The value should
485      * be configured to some non-zero value in fast read mode and
486      * zero in read mode. But, as the HW allows inconsistent
487      * settings, let's check for fast read mode.
488      */
489     if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) {
490         for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) {
491             ssi_transfer(fl->controller->spi, s->regs[R_DUMMY_DATA] & 0xff);
492         }
493     }
494 }
495 
496 static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
497 {
498     AspeedSMCFlash *fl = opaque;
499     AspeedSMCState *s = fl->controller;
500     uint64_t ret = 0;
501     int i;
502 
503     switch (aspeed_smc_flash_mode(fl)) {
504     case CTRL_USERMODE:
505         for (i = 0; i < size; i++) {
506             ret |= (uint64_t) ssi_transfer(s->spi, 0x0) << (8 * i);
507         }
508         break;
509     case CTRL_READMODE:
510     case CTRL_FREADMODE:
511         aspeed_smc_flash_select(fl);
512         aspeed_smc_flash_setup(fl, addr);
513 
514         for (i = 0; i < size; i++) {
515             ret |= (uint64_t) ssi_transfer(s->spi, 0x0) << (8 * i);
516         }
517 
518         aspeed_smc_flash_unselect(fl);
519         break;
520     default:
521         aspeed_smc_error("invalid flash mode %d", aspeed_smc_flash_mode(fl));
522     }
523 
524     trace_aspeed_smc_flash_read(fl->cs, addr, size, ret,
525                                 aspeed_smc_flash_mode(fl));
526     return ret;
527 }
528 
529 /*
530  * TODO (clg@kaod.org): stolen from xilinx_spips.c. Should move to a
531  * common include header.
532  */
533 typedef enum {
534     READ = 0x3,         READ_4 = 0x13,
535     FAST_READ = 0xb,    FAST_READ_4 = 0x0c,
536     DOR = 0x3b,         DOR_4 = 0x3c,
537     QOR = 0x6b,         QOR_4 = 0x6c,
538     DIOR = 0xbb,        DIOR_4 = 0xbc,
539     QIOR = 0xeb,        QIOR_4 = 0xec,
540 
541     PP = 0x2,           PP_4 = 0x12,
542     DPP = 0xa2,
543     QPP = 0x32,         QPP_4 = 0x34,
544 } FlashCMD;
545 
546 static int aspeed_smc_num_dummies(uint8_t command)
547 {
548     switch (command) { /* check for dummies */
549     case READ: /* no dummy bytes/cycles */
550     case PP:
551     case DPP:
552     case QPP:
553     case READ_4:
554     case PP_4:
555     case QPP_4:
556         return 0;
557     case FAST_READ:
558     case DOR:
559     case QOR:
560     case FAST_READ_4:
561     case DOR_4:
562     case QOR_4:
563         return 1;
564     case DIOR:
565     case DIOR_4:
566         return 2;
567     case QIOR:
568     case QIOR_4:
569         return 4;
570     default:
571         return -1;
572     }
573 }
574 
575 static bool aspeed_smc_do_snoop(AspeedSMCFlash *fl,  uint64_t data,
576                                 unsigned size)
577 {
578     AspeedSMCState *s = fl->controller;
579     uint8_t addr_width = aspeed_smc_flash_addr_width(fl);
580 
581     trace_aspeed_smc_do_snoop(fl->cs, s->snoop_index, s->snoop_dummies,
582                               (uint8_t) data & 0xff);
583 
584     if (s->snoop_index == SNOOP_OFF) {
585         return false; /* Do nothing */
586 
587     } else if (s->snoop_index == SNOOP_START) {
588         uint8_t cmd = data & 0xff;
589         int ndummies = aspeed_smc_num_dummies(cmd);
590 
591         /*
592          * No dummy cycles are expected with the current command. Turn
593          * off snooping and let the transfer proceed normally.
594          */
595         if (ndummies <= 0) {
596             s->snoop_index = SNOOP_OFF;
597             return false;
598         }
599 
600         s->snoop_dummies = ndummies * 8;
601 
602     } else if (s->snoop_index >= addr_width + 1) {
603 
604         /* The SPI transfer has reached the dummy cycles sequence */
605         for (; s->snoop_dummies; s->snoop_dummies--) {
606             ssi_transfer(s->spi, s->regs[R_DUMMY_DATA] & 0xff);
607         }
608 
609         /* If no more dummy cycles are expected, turn off snooping */
610         if (!s->snoop_dummies) {
611             s->snoop_index = SNOOP_OFF;
612         } else {
613             s->snoop_index += size;
614         }
615 
616         /*
617          * Dummy cycles have been faked already. Ignore the current
618          * SPI transfer
619          */
620         return true;
621     }
622 
623     s->snoop_index += size;
624     return false;
625 }
626 
627 static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,
628                                    unsigned size)
629 {
630     AspeedSMCFlash *fl = opaque;
631     AspeedSMCState *s = fl->controller;
632     int i;
633 
634     trace_aspeed_smc_flash_write(fl->cs, addr, size, data,
635                                  aspeed_smc_flash_mode(fl));
636 
637     if (!aspeed_smc_is_writable(fl)) {
638         aspeed_smc_error("flash is not writable at 0x%" HWADDR_PRIx, addr);
639         return;
640     }
641 
642     switch (aspeed_smc_flash_mode(fl)) {
643     case CTRL_USERMODE:
644         if (aspeed_smc_do_snoop(fl, data, size)) {
645             break;
646         }
647 
648         for (i = 0; i < size; i++) {
649             ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
650         }
651         break;
652     case CTRL_WRITEMODE:
653         aspeed_smc_flash_select(fl);
654         aspeed_smc_flash_setup(fl, addr);
655 
656         for (i = 0; i < size; i++) {
657             ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
658         }
659 
660         aspeed_smc_flash_unselect(fl);
661         break;
662     default:
663         aspeed_smc_error("invalid flash mode %d", aspeed_smc_flash_mode(fl));
664     }
665 }
666 
667 static const MemoryRegionOps aspeed_smc_flash_ops = {
668     .read = aspeed_smc_flash_read,
669     .write = aspeed_smc_flash_write,
670     .endianness = DEVICE_LITTLE_ENDIAN,
671     .valid = {
672         .min_access_size = 1,
673         .max_access_size = 4,
674     },
675 };
676 
677 static void aspeed_smc_flash_update_ctrl(AspeedSMCFlash *fl, uint32_t value)
678 {
679     AspeedSMCState *s = fl->controller;
680     bool unselect;
681 
682     /* User mode selects the CS, other modes unselect */
683     unselect = (value & CTRL_CMD_MODE_MASK) != CTRL_USERMODE;
684 
685     /* A change of CTRL_CE_STOP_ACTIVE from 0 to 1, unselects the CS */
686     if (!(s->regs[s->r_ctrl0 + fl->cs] & CTRL_CE_STOP_ACTIVE) &&
687         value & CTRL_CE_STOP_ACTIVE) {
688         unselect = true;
689     }
690 
691     s->regs[s->r_ctrl0 + fl->cs] = value;
692 
693     s->snoop_index = unselect ? SNOOP_OFF : SNOOP_START;
694 
695     aspeed_smc_flash_do_select(fl, unselect);
696 }
697 
698 static void aspeed_smc_reset(DeviceState *d)
699 {
700     AspeedSMCState *s = ASPEED_SMC(d);
701     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
702     int i;
703 
704     if (asc->resets) {
705         memcpy(s->regs, asc->resets, sizeof s->regs);
706     } else {
707         memset(s->regs, 0, sizeof s->regs);
708     }
709 
710     for (i = 0; i < asc->cs_num_max; i++) {
711         DeviceState *dev = ssi_get_cs(s->spi, i);
712         if (dev) {
713             Object *o = OBJECT(dev);
714 
715             if (!object_dynamic_cast(o, TYPE_M25P80)) {
716                 warn_report("Aspeed SMC %s.%d : Invalid %s device type",
717                             BUS(s->spi)->name, i, object_get_typename(o));
718                 continue;
719             }
720 
721             qemu_irq cs_line = qdev_get_gpio_in_named(dev, SSI_GPIO_CS, 0);
722             qdev_connect_gpio_out_named(DEVICE(s), "cs", i, cs_line);
723         }
724     }
725 
726     /* Unselect all peripherals */
727     for (i = 0; i < asc->cs_num_max; ++i) {
728         s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE;
729         qemu_set_irq(s->cs_lines[i], true);
730     }
731 
732     /* setup the default segment register values and regions for all */
733     for (i = 0; i < asc->cs_num_max; ++i) {
734         aspeed_smc_flash_set_segment_region(s, i,
735                     asc->segment_to_reg(s, &asc->segments[i]));
736     }
737 
738     s->snoop_index = SNOOP_OFF;
739     s->snoop_dummies = 0;
740 }
741 
742 static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
743 {
744     AspeedSMCState *s = ASPEED_SMC(opaque);
745     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(opaque);
746 
747     addr >>= 2;
748 
749     if (addr == s->r_conf ||
750         (addr >= s->r_timings &&
751          addr < s->r_timings + asc->nregs_timings) ||
752         addr == s->r_ce_ctrl ||
753         addr == R_CE_CMD_CTRL ||
754         addr == R_INTR_CTRL ||
755         addr == R_DUMMY_DATA ||
756         (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_CTRL) ||
757         (aspeed_smc_has_dma(asc) && addr == R_DMA_CTRL) ||
758         (aspeed_smc_has_dma(asc) && addr == R_DMA_FLASH_ADDR) ||
759         (aspeed_smc_has_dma(asc) && addr == R_DMA_DRAM_ADDR) ||
760         (aspeed_smc_has_dma(asc) && aspeed_smc_has_dma64(asc) &&
761          addr == R_DMA_DRAM_ADDR_HIGH) ||
762         (aspeed_smc_has_dma(asc) && addr == R_DMA_LEN) ||
763         (aspeed_smc_has_dma(asc) && addr == R_DMA_CHECKSUM) ||
764         (addr >= R_SEG_ADDR0 &&
765          addr < R_SEG_ADDR0 + asc->cs_num_max) ||
766         (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + asc->cs_num_max)) {
767 
768         trace_aspeed_smc_read(addr << 2, size, s->regs[addr]);
769 
770         return s->regs[addr];
771     } else {
772         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
773                       __func__, addr);
774         return -1;
775     }
776 }
777 
778 static uint8_t aspeed_smc_hclk_divisor(uint8_t hclk_mask)
779 {
780     /* HCLK/1 .. HCLK/16 */
781     const uint8_t hclk_divisors[] = {
782         15, 7, 14, 6, 13, 5, 12, 4, 11, 3, 10, 2, 9, 1, 8, 0
783     };
784     int i;
785 
786     for (i = 0; i < ARRAY_SIZE(hclk_divisors); i++) {
787         if (hclk_mask == hclk_divisors[i]) {
788             return i + 1;
789         }
790     }
791 
792     aspeed_smc_error("invalid HCLK mask %x", hclk_mask);
793     return 0;
794 }
795 
796 /*
797  * When doing calibration, the SPI clock rate in the CE0 Control
798  * Register and the read delay cycles in the Read Timing Compensation
799  * Register are set using bit[11:4] of the DMA Control Register.
800  */
801 static void aspeed_smc_dma_calibration(AspeedSMCState *s)
802 {
803     uint8_t delay =
804         (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
805     uint8_t hclk_mask =
806         (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
807     uint8_t hclk_div = aspeed_smc_hclk_divisor(hclk_mask);
808     uint32_t hclk_shift = (hclk_div - 1) << 2;
809     uint8_t cs;
810 
811     /*
812      * The Read Timing Compensation Register values apply to all CS on
813      * the SPI bus and only HCLK/1 - HCLK/5 can have tunable delays
814      */
815     if (hclk_div && hclk_div < 6) {
816         s->regs[s->r_timings] &= ~(0xf << hclk_shift);
817         s->regs[s->r_timings] |= delay << hclk_shift;
818     }
819 
820     /*
821      * TODO: compute the CS from the DMA address and the segment
822      * registers. This is not really a problem for now because the
823      * Timing Register values apply to all CS and software uses CS0 to
824      * do calibration.
825      */
826     cs = 0;
827     s->regs[s->r_ctrl0 + cs] &=
828         ~(CE_CTRL_CLOCK_FREQ_MASK << CE_CTRL_CLOCK_FREQ_SHIFT);
829     s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
830 }
831 
832 /*
833  * Emulate read errors in the DMA Checksum Register for high
834  * frequencies and optimistic settings of the Read Timing Compensation
835  * Register. This will help in tuning the SPI timing calibration
836  * algorithm.
837  */
838 static bool aspeed_smc_inject_read_failure(AspeedSMCState *s)
839 {
840     uint8_t delay =
841         (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
842     uint8_t hclk_mask =
843         (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
844 
845     /*
846      * Typical values of a palmetto-bmc machine.
847      */
848     switch (aspeed_smc_hclk_divisor(hclk_mask)) {
849     case 4 ... 16:
850         return false;
851     case 3: /* at least one HCLK cycle delay */
852         return (delay & 0x7) < 1;
853     case 2: /* at least two HCLK cycle delay */
854         return (delay & 0x7) < 2;
855     case 1: /* (> 100MHz) is above the max freq of the controller */
856         return true;
857     default:
858         g_assert_not_reached();
859     }
860 }
861 
862 static uint64_t aspeed_smc_dma_dram_addr(AspeedSMCState *s)
863 {
864     return s->regs[R_DMA_DRAM_ADDR] |
865         ((uint64_t) s->regs[R_DMA_DRAM_ADDR_HIGH] << 32);
866 }
867 
868 static uint32_t aspeed_smc_dma_len(AspeedSMCState *s)
869 {
870     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
871 
872     return QEMU_ALIGN_UP(s->regs[R_DMA_LEN] + asc->dma_start_length, 4);
873 }
874 
875 /*
876  * Accumulate the result of the reads to provide a checksum that will
877  * be used to validate the read timing settings.
878  */
879 static void aspeed_smc_dma_checksum(AspeedSMCState *s)
880 {
881     MemTxResult result;
882     uint32_t dma_len;
883     uint32_t data;
884 
885     if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
886         aspeed_smc_error("invalid direction for DMA checksum");
887         return;
888     }
889 
890     if (s->regs[R_DMA_CTRL] & DMA_CTRL_CALIB) {
891         aspeed_smc_dma_calibration(s);
892     }
893 
894     dma_len = aspeed_smc_dma_len(s);
895 
896     while (dma_len) {
897         data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
898                                     MEMTXATTRS_UNSPECIFIED, &result);
899         if (result != MEMTX_OK) {
900             aspeed_smc_error("Flash read failed @%08x",
901                              s->regs[R_DMA_FLASH_ADDR]);
902             return;
903         }
904         trace_aspeed_smc_dma_checksum(s->regs[R_DMA_FLASH_ADDR], data);
905 
906         /*
907          * When the DMA is on-going, the DMA registers are updated
908          * with the current working addresses and length.
909          */
910         s->regs[R_DMA_CHECKSUM] += data;
911         s->regs[R_DMA_FLASH_ADDR] += 4;
912         dma_len -= 4;
913         s->regs[R_DMA_LEN] = dma_len;
914     }
915 
916     if (s->inject_failure && aspeed_smc_inject_read_failure(s)) {
917         s->regs[R_DMA_CHECKSUM] = 0xbadc0de;
918     }
919 
920 }
921 
922 static void aspeed_smc_dma_rw(AspeedSMCState *s)
923 {
924     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
925     uint64_t dma_dram_offset;
926     uint64_t dma_dram_addr;
927     MemTxResult result;
928     uint32_t dma_len;
929     uint32_t data;
930 
931     dma_len = aspeed_smc_dma_len(s);
932     dma_dram_addr = aspeed_smc_dma_dram_addr(s);
933 
934     if (aspeed_smc_has_dma64(asc)) {
935         dma_dram_offset = dma_dram_addr - s->dram_base;
936     } else {
937         dma_dram_offset = dma_dram_addr;
938     }
939 
940     trace_aspeed_smc_dma_rw(s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE ?
941                             "write" : "read",
942                             s->regs[R_DMA_FLASH_ADDR],
943                             dma_dram_offset,
944                             dma_len);
945     while (dma_len) {
946         if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
947             data = address_space_ldl_le(&s->dram_as, dma_dram_offset,
948                                         MEMTXATTRS_UNSPECIFIED, &result);
949             if (result != MEMTX_OK) {
950                 aspeed_smc_error("DRAM read failed @%" PRIx64,
951                                  dma_dram_offset);
952                 return;
953             }
954 
955             address_space_stl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
956                                  data, MEMTXATTRS_UNSPECIFIED, &result);
957             if (result != MEMTX_OK) {
958                 aspeed_smc_error("Flash write failed @%08x",
959                                  s->regs[R_DMA_FLASH_ADDR]);
960                 return;
961             }
962         } else {
963             data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
964                                         MEMTXATTRS_UNSPECIFIED, &result);
965             if (result != MEMTX_OK) {
966                 aspeed_smc_error("Flash read failed @%08x",
967                                  s->regs[R_DMA_FLASH_ADDR]);
968                 return;
969             }
970 
971             address_space_stl_le(&s->dram_as, dma_dram_offset,
972                                  data, MEMTXATTRS_UNSPECIFIED, &result);
973             if (result != MEMTX_OK) {
974                 aspeed_smc_error("DRAM write failed @%" PRIx64,
975                                  dma_dram_offset);
976                 return;
977             }
978         }
979 
980         /*
981          * When the DMA is on-going, the DMA registers are updated
982          * with the current working addresses and length.
983          */
984         dma_dram_offset += 4;
985         dma_dram_addr += 4;
986 
987         s->regs[R_DMA_DRAM_ADDR_HIGH] = dma_dram_addr >> 32;
988         s->regs[R_DMA_DRAM_ADDR] = dma_dram_addr & 0xffffffff;
989         s->regs[R_DMA_FLASH_ADDR] += 4;
990         dma_len -= 4;
991         s->regs[R_DMA_LEN] = dma_len;
992         s->regs[R_DMA_CHECKSUM] += data;
993     }
994 }
995 
996 static void aspeed_smc_dma_stop(AspeedSMCState *s)
997 {
998     /*
999      * When the DMA is disabled, INTR_CTRL_DMA_STATUS=0 means the
1000      * engine is idle
1001      */
1002     s->regs[R_INTR_CTRL] &= ~INTR_CTRL_DMA_STATUS;
1003     s->regs[R_DMA_CHECKSUM] = 0;
1004 
1005     /*
1006      * Lower the DMA irq in any case. The IRQ control register could
1007      * have been cleared before disabling the DMA.
1008      */
1009     qemu_irq_lower(s->irq);
1010 }
1011 
1012 /*
1013  * When INTR_CTRL_DMA_STATUS=1, the DMA has completed and a new DMA
1014  * can start even if the result of the previous was not collected.
1015  */
1016 static bool aspeed_smc_dma_in_progress(AspeedSMCState *s)
1017 {
1018     return s->regs[R_DMA_CTRL] & DMA_CTRL_ENABLE &&
1019         !(s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_STATUS);
1020 }
1021 
1022 static void aspeed_smc_dma_done(AspeedSMCState *s)
1023 {
1024     s->regs[R_INTR_CTRL] |= INTR_CTRL_DMA_STATUS;
1025     if (s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_EN) {
1026         qemu_irq_raise(s->irq);
1027     }
1028 }
1029 
1030 static void aspeed_smc_dma_ctrl(AspeedSMCState *s, uint32_t dma_ctrl)
1031 {
1032     if (!(dma_ctrl & DMA_CTRL_ENABLE)) {
1033         s->regs[R_DMA_CTRL] = dma_ctrl;
1034 
1035         aspeed_smc_dma_stop(s);
1036         return;
1037     }
1038 
1039     if (aspeed_smc_dma_in_progress(s)) {
1040         aspeed_smc_error("DMA in progress !");
1041         return;
1042     }
1043 
1044     s->regs[R_DMA_CTRL] = dma_ctrl;
1045 
1046     if (s->regs[R_DMA_CTRL] & DMA_CTRL_CKSUM) {
1047         aspeed_smc_dma_checksum(s);
1048     } else {
1049         aspeed_smc_dma_rw(s);
1050     }
1051 
1052     aspeed_smc_dma_done(s);
1053 }
1054 
1055 static inline bool aspeed_smc_dma_granted(AspeedSMCState *s)
1056 {
1057     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1058 
1059     if (!(asc->features & ASPEED_SMC_FEATURE_DMA_GRANT)) {
1060         return true;
1061     }
1062 
1063     if (!(s->regs[R_DMA_CTRL] & DMA_CTRL_GRANT)) {
1064         aspeed_smc_error("DMA not granted");
1065         return false;
1066     }
1067 
1068     return true;
1069 }
1070 
1071 static void aspeed_2600_smc_dma_ctrl(AspeedSMCState *s, uint32_t dma_ctrl)
1072 {
1073     /* Preserve DMA bits  */
1074     dma_ctrl |= s->regs[R_DMA_CTRL] & (DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1075 
1076     if (dma_ctrl == 0xAEED0000) {
1077         /* automatically grant request */
1078         s->regs[R_DMA_CTRL] |= (DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1079         return;
1080     }
1081 
1082     /* clear request */
1083     if (dma_ctrl == 0xDEEA0000) {
1084         s->regs[R_DMA_CTRL] &= ~(DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1085         return;
1086     }
1087 
1088     if (!aspeed_smc_dma_granted(s)) {
1089         aspeed_smc_error("DMA not granted");
1090         return;
1091     }
1092 
1093     aspeed_smc_dma_ctrl(s, dma_ctrl);
1094     s->regs[R_DMA_CTRL] &= ~(DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
1095 }
1096 
1097 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
1098                              unsigned int size)
1099 {
1100     AspeedSMCState *s = ASPEED_SMC(opaque);
1101     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1102     uint32_t value = data;
1103 
1104     trace_aspeed_smc_write(addr, size, data);
1105 
1106     addr >>= 2;
1107 
1108     if (addr == s->r_conf ||
1109         (addr >= s->r_timings &&
1110          addr < s->r_timings + asc->nregs_timings) ||
1111         addr == s->r_ce_ctrl) {
1112         s->regs[addr] = value;
1113     } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + asc->cs_num_max) {
1114         int cs = addr - s->r_ctrl0;
1115         aspeed_smc_flash_update_ctrl(&s->flashes[cs], value);
1116     } else if (addr >= R_SEG_ADDR0 &&
1117                addr < R_SEG_ADDR0 + asc->cs_num_max) {
1118         int cs = addr - R_SEG_ADDR0;
1119 
1120         if (value != s->regs[R_SEG_ADDR0 + cs]) {
1121             aspeed_smc_flash_set_segment(s, cs, value);
1122         }
1123     } else if (addr == R_CE_CMD_CTRL) {
1124         s->regs[addr] = value & 0xff;
1125     } else if (addr == R_DUMMY_DATA) {
1126         s->regs[addr] = value & 0xff;
1127     } else if (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_CTRL) {
1128         s->regs[addr] = value & FMC_WDT2_CTRL_EN;
1129     } else if (addr == R_INTR_CTRL) {
1130         s->regs[addr] = value;
1131     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_CTRL) {
1132         asc->dma_ctrl(s, value);
1133     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_DRAM_ADDR &&
1134                aspeed_smc_dma_granted(s)) {
1135         s->regs[addr] = DMA_DRAM_ADDR(asc, value);
1136     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_FLASH_ADDR &&
1137                aspeed_smc_dma_granted(s)) {
1138         s->regs[addr] = DMA_FLASH_ADDR(asc, value);
1139     } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_LEN &&
1140                aspeed_smc_dma_granted(s)) {
1141         s->regs[addr] = DMA_LENGTH(value);
1142     } else if (aspeed_smc_has_dma(asc) && aspeed_smc_has_dma64(asc) &&
1143                addr == R_DMA_DRAM_ADDR_HIGH) {
1144         s->regs[addr] = DMA_DRAM_ADDR_HIGH(value);
1145     } else {
1146         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
1147                       __func__, addr);
1148         return;
1149     }
1150 }
1151 
1152 static const MemoryRegionOps aspeed_smc_ops = {
1153     .read = aspeed_smc_read,
1154     .write = aspeed_smc_write,
1155     .endianness = DEVICE_LITTLE_ENDIAN,
1156 };
1157 
1158 static void aspeed_smc_instance_init(Object *obj)
1159 {
1160     AspeedSMCState *s = ASPEED_SMC(obj);
1161     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1162     int i;
1163 
1164     for (i = 0; i < asc->cs_num_max; i++) {
1165         object_initialize_child(obj, "flash[*]", &s->flashes[i],
1166                                 TYPE_ASPEED_SMC_FLASH);
1167     }
1168 }
1169 
1170 /*
1171  * Initialize the custom address spaces for DMAs
1172  */
1173 static void aspeed_smc_dma_setup(AspeedSMCState *s, Error **errp)
1174 {
1175     if (!s->dram_mr) {
1176         error_setg(errp, TYPE_ASPEED_SMC ": 'dram' link not set");
1177         return;
1178     }
1179 
1180     address_space_init(&s->flash_as, &s->mmio_flash,
1181                        TYPE_ASPEED_SMC ".dma-flash");
1182     address_space_init(&s->dram_as, s->dram_mr,
1183                        TYPE_ASPEED_SMC ".dma-dram");
1184 }
1185 
1186 static void aspeed_smc_realize(DeviceState *dev, Error **errp)
1187 {
1188     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1189     AspeedSMCState *s = ASPEED_SMC(dev);
1190     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1191     int i;
1192     hwaddr offset = 0;
1193 
1194     /* keep a copy under AspeedSMCState to speed up accesses */
1195     s->r_conf = asc->r_conf;
1196     s->r_ce_ctrl = asc->r_ce_ctrl;
1197     s->r_ctrl0 = asc->r_ctrl0;
1198     s->r_timings = asc->r_timings;
1199     s->conf_enable_w0 = asc->conf_enable_w0;
1200 
1201     /* DMA irq. Keep it first for the initialization in the SoC */
1202     sysbus_init_irq(sbd, &s->irq);
1203 
1204     s->spi = ssi_create_bus(dev, NULL);
1205 
1206     /* Setup cs_lines for peripherals */
1207     s->cs_lines = g_new0(qemu_irq, asc->cs_num_max);
1208     qdev_init_gpio_out_named(DEVICE(s), s->cs_lines, "cs", asc->cs_num_max);
1209 
1210     /* The memory region for the controller registers */
1211     memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s,
1212                           TYPE_ASPEED_SMC, asc->nregs * 4);
1213     sysbus_init_mmio(sbd, &s->mmio);
1214 
1215     /*
1216      * The container memory region representing the address space
1217      * window in which the flash modules are mapped. The size and
1218      * address depends on the SoC model and controller type.
1219      */
1220     memory_region_init(&s->mmio_flash_container, OBJECT(s),
1221                        TYPE_ASPEED_SMC ".container",
1222                        asc->flash_window_size);
1223     sysbus_init_mmio(sbd, &s->mmio_flash_container);
1224 
1225     memory_region_init_io(&s->mmio_flash, OBJECT(s),
1226                           &aspeed_smc_flash_default_ops, s,
1227                           TYPE_ASPEED_SMC ".flash",
1228                           asc->flash_window_size);
1229     memory_region_add_subregion(&s->mmio_flash_container, 0x0,
1230                                 &s->mmio_flash);
1231 
1232     /*
1233      * Let's create a sub memory region for each possible peripheral. All
1234      * have a configurable memory segment in the overall flash mapping
1235      * window of the controller but, there is not necessarily a flash
1236      * module behind to handle the memory accesses. This depends on
1237      * the board configuration.
1238      */
1239     for (i = 0; i < asc->cs_num_max; ++i) {
1240         AspeedSMCFlash *fl = &s->flashes[i];
1241 
1242         if (!object_property_set_link(OBJECT(fl), "controller", OBJECT(s),
1243                                       errp)) {
1244             return;
1245         }
1246         if (!object_property_set_uint(OBJECT(fl), "cs", i, errp)) {
1247             return;
1248         }
1249         if (!sysbus_realize(SYS_BUS_DEVICE(fl), errp)) {
1250             return;
1251         }
1252 
1253         memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio);
1254         offset += asc->segments[i].size;
1255     }
1256 
1257     /* DMA support */
1258     if (aspeed_smc_has_dma(asc)) {
1259         aspeed_smc_dma_setup(s, errp);
1260     }
1261 }
1262 
1263 static const VMStateDescription vmstate_aspeed_smc = {
1264     .name = "aspeed.smc",
1265     .version_id = 2,
1266     .minimum_version_id = 2,
1267     .fields = (const VMStateField[]) {
1268         VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX),
1269         VMSTATE_UINT8(snoop_index, AspeedSMCState),
1270         VMSTATE_UINT8(snoop_dummies, AspeedSMCState),
1271         VMSTATE_END_OF_LIST()
1272     }
1273 };
1274 
1275 static Property aspeed_smc_properties[] = {
1276     DEFINE_PROP_BOOL("inject-failure", AspeedSMCState, inject_failure, false),
1277     DEFINE_PROP_UINT64("dram-base", AspeedSMCState, dram_base, 0),
1278     DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
1279                      TYPE_MEMORY_REGION, MemoryRegion *),
1280     DEFINE_PROP_END_OF_LIST(),
1281 };
1282 
1283 static void aspeed_smc_class_init(ObjectClass *klass, void *data)
1284 {
1285     DeviceClass *dc = DEVICE_CLASS(klass);
1286 
1287     dc->realize = aspeed_smc_realize;
1288     dc->reset = aspeed_smc_reset;
1289     device_class_set_props(dc, aspeed_smc_properties);
1290     dc->vmsd = &vmstate_aspeed_smc;
1291 }
1292 
1293 static const TypeInfo aspeed_smc_info = {
1294     .name           = TYPE_ASPEED_SMC,
1295     .parent         = TYPE_SYS_BUS_DEVICE,
1296     .instance_init  = aspeed_smc_instance_init,
1297     .instance_size  = sizeof(AspeedSMCState),
1298     .class_size     = sizeof(AspeedSMCClass),
1299     .class_init     = aspeed_smc_class_init,
1300     .abstract       = true,
1301 };
1302 
1303 static void aspeed_smc_flash_realize(DeviceState *dev, Error **errp)
1304 {
1305     AspeedSMCFlash *s = ASPEED_SMC_FLASH(dev);
1306     g_autofree char *name = g_strdup_printf(TYPE_ASPEED_SMC_FLASH ".%d", s->cs);
1307 
1308     if (!s->controller) {
1309         error_setg(errp, TYPE_ASPEED_SMC_FLASH ": 'controller' link not set");
1310         return;
1311     }
1312 
1313     s->asc = ASPEED_SMC_GET_CLASS(s->controller);
1314 
1315     /*
1316      * Use the default segment value to size the memory region. This
1317      * can be changed by FW at runtime.
1318      */
1319     memory_region_init_io(&s->mmio, OBJECT(s), s->asc->reg_ops,
1320                           s, name, s->asc->segments[s->cs].size);
1321     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
1322 }
1323 
1324 static Property aspeed_smc_flash_properties[] = {
1325     DEFINE_PROP_UINT8("cs", AspeedSMCFlash, cs, 0),
1326     DEFINE_PROP_LINK("controller", AspeedSMCFlash, controller, TYPE_ASPEED_SMC,
1327                      AspeedSMCState *),
1328     DEFINE_PROP_END_OF_LIST(),
1329 };
1330 
1331 static void aspeed_smc_flash_class_init(ObjectClass *klass, void *data)
1332 {
1333     DeviceClass *dc = DEVICE_CLASS(klass);
1334 
1335     dc->desc = "Aspeed SMC Flash device region";
1336     dc->realize = aspeed_smc_flash_realize;
1337     device_class_set_props(dc, aspeed_smc_flash_properties);
1338 }
1339 
1340 static const TypeInfo aspeed_smc_flash_info = {
1341     .name           = TYPE_ASPEED_SMC_FLASH,
1342     .parent         = TYPE_SYS_BUS_DEVICE,
1343     .instance_size  = sizeof(AspeedSMCFlash),
1344     .class_init     = aspeed_smc_flash_class_init,
1345 };
1346 
1347 /*
1348  * The Segment Registers of the AST2400 and AST2500 have a 8MB
1349  * unit. The address range of a flash SPI peripheral is encoded with
1350  * absolute addresses which should be part of the overall controller
1351  * window.
1352  */
1353 static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s,
1354                                           const AspeedSegments *seg)
1355 {
1356     uint32_t reg = 0;
1357     reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT;
1358     reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT;
1359     return reg;
1360 }
1361 
1362 static void aspeed_smc_reg_to_segment(const AspeedSMCState *s,
1363                                       uint32_t reg, AspeedSegments *seg)
1364 {
1365     seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23;
1366     seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr;
1367 }
1368 
1369 static const AspeedSegments aspeed_2400_smc_segments[] = {
1370     { 0x10000000, 32 * MiB },
1371 };
1372 
1373 static void aspeed_2400_smc_class_init(ObjectClass *klass, void *data)
1374 {
1375     DeviceClass *dc = DEVICE_CLASS(klass);
1376     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1377 
1378     dc->desc               = "Aspeed 2400 SMC Controller";
1379     asc->r_conf            = R_CONF;
1380     asc->r_ce_ctrl         = R_CE_CTRL;
1381     asc->r_ctrl0           = R_CTRL0;
1382     asc->r_timings         = R_TIMINGS;
1383     asc->nregs_timings     = 1;
1384     asc->conf_enable_w0    = CONF_ENABLE_W0;
1385     asc->cs_num_max        = 1;
1386     asc->segments          = aspeed_2400_smc_segments;
1387     asc->flash_window_base = 0x10000000;
1388     asc->flash_window_size = 0x6000000;
1389     asc->features          = 0x0;
1390     asc->nregs             = ASPEED_SMC_R_SMC_MAX;
1391     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1392     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1393     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1394     asc->reg_ops           = &aspeed_smc_flash_ops;
1395 }
1396 
1397 static const TypeInfo aspeed_2400_smc_info = {
1398     .name =  "aspeed.smc-ast2400",
1399     .parent = TYPE_ASPEED_SMC,
1400     .class_init = aspeed_2400_smc_class_init,
1401 };
1402 
1403 static const uint32_t aspeed_2400_fmc_resets[ASPEED_SMC_R_MAX] = {
1404     /*
1405      * CE0 and CE1 types are HW strapped in SCU70. Do it here to
1406      * simplify the model.
1407      */
1408     [R_CONF] = CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0,
1409 };
1410 
1411 static const AspeedSegments aspeed_2400_fmc_segments[] = {
1412     { 0x20000000, 64 * MiB }, /* start address is readonly */
1413     { 0x24000000, 32 * MiB },
1414     { 0x26000000, 32 * MiB },
1415     { 0x28000000, 32 * MiB },
1416     { 0x2A000000, 32 * MiB }
1417 };
1418 
1419 static void aspeed_2400_fmc_class_init(ObjectClass *klass, void *data)
1420 {
1421     DeviceClass *dc = DEVICE_CLASS(klass);
1422     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1423 
1424     dc->desc               = "Aspeed 2400 FMC Controller";
1425     asc->r_conf            = R_CONF;
1426     asc->r_ce_ctrl         = R_CE_CTRL;
1427     asc->r_ctrl0           = R_CTRL0;
1428     asc->r_timings         = R_TIMINGS;
1429     asc->nregs_timings     = 1;
1430     asc->conf_enable_w0    = CONF_ENABLE_W0;
1431     asc->cs_num_max        = 5;
1432     asc->segments          = aspeed_2400_fmc_segments;
1433     asc->segment_addr_mask = 0xffff0000;
1434     asc->resets            = aspeed_2400_fmc_resets;
1435     asc->flash_window_base = 0x20000000;
1436     asc->flash_window_size = 0x10000000;
1437     asc->features          = ASPEED_SMC_FEATURE_DMA;
1438     asc->dma_flash_mask    = 0x0FFFFFFC;
1439     asc->dma_dram_mask     = 0x1FFFFFFC;
1440     asc->dma_start_length  = 4;
1441     asc->nregs             = ASPEED_SMC_R_MAX;
1442     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1443     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1444     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1445     asc->reg_ops           = &aspeed_smc_flash_ops;
1446 }
1447 
1448 static const TypeInfo aspeed_2400_fmc_info = {
1449     .name =  "aspeed.fmc-ast2400",
1450     .parent = TYPE_ASPEED_SMC,
1451     .class_init = aspeed_2400_fmc_class_init,
1452 };
1453 
1454 static const AspeedSegments aspeed_2400_spi1_segments[] = {
1455     { 0x30000000, 64 * MiB },
1456 };
1457 
1458 static int aspeed_2400_spi1_addr_width(const AspeedSMCState *s)
1459 {
1460     return s->regs[R_SPI_CTRL0] & CTRL_AST2400_SPI_4BYTE ? 4 : 3;
1461 }
1462 
1463 static void aspeed_2400_spi1_class_init(ObjectClass *klass, void *data)
1464 {
1465     DeviceClass *dc = DEVICE_CLASS(klass);
1466     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1467 
1468     dc->desc               = "Aspeed 2400 SPI1 Controller";
1469     asc->r_conf            = R_SPI_CONF;
1470     asc->r_ce_ctrl         = 0xff;
1471     asc->r_ctrl0           = R_SPI_CTRL0;
1472     asc->r_timings         = R_SPI_TIMINGS;
1473     asc->nregs_timings     = 1;
1474     asc->conf_enable_w0    = SPI_CONF_ENABLE_W0;
1475     asc->cs_num_max        = 1;
1476     asc->segments          = aspeed_2400_spi1_segments;
1477     asc->flash_window_base = 0x30000000;
1478     asc->flash_window_size = 0x10000000;
1479     asc->features          = 0x0;
1480     asc->nregs             = ASPEED_SMC_R_SPI_MAX;
1481     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1482     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1483     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1484     asc->addr_width        = aspeed_2400_spi1_addr_width;
1485     asc->reg_ops           = &aspeed_smc_flash_ops;
1486 }
1487 
1488 static const TypeInfo aspeed_2400_spi1_info = {
1489     .name =  "aspeed.spi1-ast2400",
1490     .parent = TYPE_ASPEED_SMC,
1491     .class_init = aspeed_2400_spi1_class_init,
1492 };
1493 
1494 static const uint32_t aspeed_2500_fmc_resets[ASPEED_SMC_R_MAX] = {
1495     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1496                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
1497 };
1498 
1499 static const AspeedSegments aspeed_2500_fmc_segments[] = {
1500     { 0x20000000, 128 * MiB }, /* start address is readonly */
1501     { 0x28000000,  32 * MiB },
1502     { 0x2A000000,  32 * MiB },
1503 };
1504 
1505 static void aspeed_2500_fmc_class_init(ObjectClass *klass, void *data)
1506 {
1507     DeviceClass *dc = DEVICE_CLASS(klass);
1508     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1509 
1510     dc->desc               = "Aspeed 2500 FMC Controller";
1511     asc->r_conf            = R_CONF;
1512     asc->r_ce_ctrl         = R_CE_CTRL;
1513     asc->r_ctrl0           = R_CTRL0;
1514     asc->r_timings         = R_TIMINGS;
1515     asc->nregs_timings     = 1;
1516     asc->conf_enable_w0    = CONF_ENABLE_W0;
1517     asc->cs_num_max        = 3;
1518     asc->segments          = aspeed_2500_fmc_segments;
1519     asc->segment_addr_mask = 0xffff0000;
1520     asc->resets            = aspeed_2500_fmc_resets;
1521     asc->flash_window_base = 0x20000000;
1522     asc->flash_window_size = 0x10000000;
1523     asc->features          = ASPEED_SMC_FEATURE_DMA;
1524     asc->dma_flash_mask    = 0x0FFFFFFC;
1525     asc->dma_dram_mask     = 0x3FFFFFFC;
1526     asc->dma_start_length  = 4;
1527     asc->nregs             = ASPEED_SMC_R_MAX;
1528     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1529     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1530     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1531     asc->reg_ops           = &aspeed_smc_flash_ops;
1532 }
1533 
1534 static const TypeInfo aspeed_2500_fmc_info = {
1535     .name =  "aspeed.fmc-ast2500",
1536     .parent = TYPE_ASPEED_SMC,
1537     .class_init = aspeed_2500_fmc_class_init,
1538 };
1539 
1540 static const AspeedSegments aspeed_2500_spi1_segments[] = {
1541     { 0x30000000, 32 * MiB }, /* start address is readonly */
1542     { 0x32000000, 96 * MiB }, /* end address is readonly */
1543 };
1544 
1545 static void aspeed_2500_spi1_class_init(ObjectClass *klass, void *data)
1546 {
1547     DeviceClass *dc = DEVICE_CLASS(klass);
1548     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1549 
1550     dc->desc               = "Aspeed 2500 SPI1 Controller";
1551     asc->r_conf            = R_CONF;
1552     asc->r_ce_ctrl         = R_CE_CTRL;
1553     asc->r_ctrl0           = R_CTRL0;
1554     asc->r_timings         = R_TIMINGS;
1555     asc->nregs_timings     = 1;
1556     asc->conf_enable_w0    = CONF_ENABLE_W0;
1557     asc->cs_num_max        = 2;
1558     asc->segments          = aspeed_2500_spi1_segments;
1559     asc->segment_addr_mask = 0xffff0000;
1560     asc->flash_window_base = 0x30000000;
1561     asc->flash_window_size = 0x8000000;
1562     asc->features          = 0x0;
1563     asc->nregs             = ASPEED_SMC_R_MAX;
1564     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1565     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1566     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1567     asc->reg_ops           = &aspeed_smc_flash_ops;
1568 }
1569 
1570 static const TypeInfo aspeed_2500_spi1_info = {
1571     .name =  "aspeed.spi1-ast2500",
1572     .parent = TYPE_ASPEED_SMC,
1573     .class_init = aspeed_2500_spi1_class_init,
1574 };
1575 
1576 static const AspeedSegments aspeed_2500_spi2_segments[] = {
1577     { 0x38000000, 32 * MiB }, /* start address is readonly */
1578     { 0x3A000000, 96 * MiB }, /* end address is readonly */
1579 };
1580 
1581 static void aspeed_2500_spi2_class_init(ObjectClass *klass, void *data)
1582 {
1583     DeviceClass *dc = DEVICE_CLASS(klass);
1584     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1585 
1586     dc->desc               = "Aspeed 2500 SPI2 Controller";
1587     asc->r_conf            = R_CONF;
1588     asc->r_ce_ctrl         = R_CE_CTRL;
1589     asc->r_ctrl0           = R_CTRL0;
1590     asc->r_timings         = R_TIMINGS;
1591     asc->nregs_timings     = 1;
1592     asc->conf_enable_w0    = CONF_ENABLE_W0;
1593     asc->cs_num_max        = 2;
1594     asc->segments          = aspeed_2500_spi2_segments;
1595     asc->segment_addr_mask = 0xffff0000;
1596     asc->flash_window_base = 0x38000000;
1597     asc->flash_window_size = 0x8000000;
1598     asc->features          = 0x0;
1599     asc->nregs             = ASPEED_SMC_R_MAX;
1600     asc->segment_to_reg    = aspeed_smc_segment_to_reg;
1601     asc->reg_to_segment    = aspeed_smc_reg_to_segment;
1602     asc->dma_ctrl          = aspeed_smc_dma_ctrl;
1603     asc->reg_ops           = &aspeed_smc_flash_ops;
1604 }
1605 
1606 static const TypeInfo aspeed_2500_spi2_info = {
1607     .name =  "aspeed.spi2-ast2500",
1608     .parent = TYPE_ASPEED_SMC,
1609     .class_init = aspeed_2500_spi2_class_init,
1610 };
1611 
1612 /*
1613  * The Segment Registers of the AST2600 have a 1MB unit. The address
1614  * range of a flash SPI peripheral is encoded with offsets in the overall
1615  * controller window. The previous SoC AST2400 and AST2500 used
1616  * absolute addresses. Only bits [27:20] are relevant and the end
1617  * address is an upper bound limit.
1618  */
1619 #define AST2600_SEG_ADDR_MASK 0x0ff00000
1620 
1621 static uint32_t aspeed_2600_smc_segment_to_reg(const AspeedSMCState *s,
1622                                                const AspeedSegments *seg)
1623 {
1624     uint32_t reg = 0;
1625 
1626     /* Disabled segments have a nil register */
1627     if (!seg->size) {
1628         return 0;
1629     }
1630 
1631     reg |= (seg->addr & AST2600_SEG_ADDR_MASK) >> 16; /* start offset */
1632     reg |= (seg->addr + seg->size - 1) & AST2600_SEG_ADDR_MASK; /* end offset */
1633     return reg;
1634 }
1635 
1636 static void aspeed_2600_smc_reg_to_segment(const AspeedSMCState *s,
1637                                            uint32_t reg, AspeedSegments *seg)
1638 {
1639     uint32_t start_offset = (reg << 16) & AST2600_SEG_ADDR_MASK;
1640     uint32_t end_offset = reg & AST2600_SEG_ADDR_MASK;
1641     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1642 
1643     if (reg) {
1644         seg->addr = asc->flash_window_base + start_offset;
1645         seg->size = end_offset + MiB - start_offset;
1646     } else {
1647         seg->addr = asc->flash_window_base;
1648         seg->size = 0;
1649     }
1650 }
1651 
1652 static const uint32_t aspeed_2600_fmc_resets[ASPEED_SMC_R_MAX] = {
1653     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1654                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1 |
1655                 CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE2),
1656 };
1657 
1658 static const AspeedSegments aspeed_2600_fmc_segments[] = {
1659     { 0x0, 128 * MiB }, /* start address is readonly */
1660     { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
1661     { 0x0, 0 }, /* disabled */
1662 };
1663 
1664 static void aspeed_2600_fmc_class_init(ObjectClass *klass, void *data)
1665 {
1666     DeviceClass *dc = DEVICE_CLASS(klass);
1667     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1668 
1669     dc->desc               = "Aspeed 2600 FMC Controller";
1670     asc->r_conf            = R_CONF;
1671     asc->r_ce_ctrl         = R_CE_CTRL;
1672     asc->r_ctrl0           = R_CTRL0;
1673     asc->r_timings         = R_TIMINGS;
1674     asc->nregs_timings     = 1;
1675     asc->conf_enable_w0    = CONF_ENABLE_W0;
1676     asc->cs_num_max        = 3;
1677     asc->segments          = aspeed_2600_fmc_segments;
1678     asc->segment_addr_mask = 0x0ff00ff0;
1679     asc->resets            = aspeed_2600_fmc_resets;
1680     asc->flash_window_base = 0x20000000;
1681     asc->flash_window_size = 0x10000000;
1682     asc->features          = ASPEED_SMC_FEATURE_DMA |
1683                              ASPEED_SMC_FEATURE_WDT_CONTROL;
1684     asc->dma_flash_mask    = 0x0FFFFFFC;
1685     asc->dma_dram_mask     = 0x3FFFFFFC;
1686     asc->dma_start_length  = 1;
1687     asc->nregs             = ASPEED_SMC_R_MAX;
1688     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1689     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1690     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1691     asc->reg_ops           = &aspeed_smc_flash_ops;
1692 }
1693 
1694 static const TypeInfo aspeed_2600_fmc_info = {
1695     .name =  "aspeed.fmc-ast2600",
1696     .parent = TYPE_ASPEED_SMC,
1697     .class_init = aspeed_2600_fmc_class_init,
1698 };
1699 
1700 static const AspeedSegments aspeed_2600_spi1_segments[] = {
1701     { 0x0, 128 * MiB }, /* start address is readonly */
1702     { 0x0, 0 }, /* disabled */
1703 };
1704 
1705 static void aspeed_2600_spi1_class_init(ObjectClass *klass, void *data)
1706 {
1707     DeviceClass *dc = DEVICE_CLASS(klass);
1708     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1709 
1710     dc->desc               = "Aspeed 2600 SPI1 Controller";
1711     asc->r_conf            = R_CONF;
1712     asc->r_ce_ctrl         = R_CE_CTRL;
1713     asc->r_ctrl0           = R_CTRL0;
1714     asc->r_timings         = R_TIMINGS;
1715     asc->nregs_timings     = 2;
1716     asc->conf_enable_w0    = CONF_ENABLE_W0;
1717     asc->cs_num_max        = 2;
1718     asc->segments          = aspeed_2600_spi1_segments;
1719     asc->segment_addr_mask = 0x0ff00ff0;
1720     asc->flash_window_base = 0x30000000;
1721     asc->flash_window_size = 0x10000000;
1722     asc->features          = ASPEED_SMC_FEATURE_DMA |
1723                              ASPEED_SMC_FEATURE_DMA_GRANT;
1724     asc->dma_flash_mask    = 0x0FFFFFFC;
1725     asc->dma_dram_mask     = 0x3FFFFFFC;
1726     asc->dma_start_length  = 1;
1727     asc->nregs             = ASPEED_SMC_R_MAX;
1728     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1729     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1730     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1731     asc->reg_ops           = &aspeed_smc_flash_ops;
1732 }
1733 
1734 static const TypeInfo aspeed_2600_spi1_info = {
1735     .name =  "aspeed.spi1-ast2600",
1736     .parent = TYPE_ASPEED_SMC,
1737     .class_init = aspeed_2600_spi1_class_init,
1738 };
1739 
1740 static const AspeedSegments aspeed_2600_spi2_segments[] = {
1741     { 0x0, 128 * MiB }, /* start address is readonly */
1742     { 0x0, 0 }, /* disabled */
1743     { 0x0, 0 }, /* disabled */
1744 };
1745 
1746 static void aspeed_2600_spi2_class_init(ObjectClass *klass, void *data)
1747 {
1748     DeviceClass *dc = DEVICE_CLASS(klass);
1749     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1750 
1751     dc->desc               = "Aspeed 2600 SPI2 Controller";
1752     asc->r_conf            = R_CONF;
1753     asc->r_ce_ctrl         = R_CE_CTRL;
1754     asc->r_ctrl0           = R_CTRL0;
1755     asc->r_timings         = R_TIMINGS;
1756     asc->nregs_timings     = 3;
1757     asc->conf_enable_w0    = CONF_ENABLE_W0;
1758     asc->cs_num_max        = 3;
1759     asc->segments          = aspeed_2600_spi2_segments;
1760     asc->segment_addr_mask = 0x0ff00ff0;
1761     asc->flash_window_base = 0x50000000;
1762     asc->flash_window_size = 0x10000000;
1763     asc->features          = ASPEED_SMC_FEATURE_DMA |
1764                              ASPEED_SMC_FEATURE_DMA_GRANT;
1765     asc->dma_flash_mask    = 0x0FFFFFFC;
1766     asc->dma_dram_mask     = 0x3FFFFFFC;
1767     asc->dma_start_length  = 1;
1768     asc->nregs             = ASPEED_SMC_R_MAX;
1769     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1770     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1771     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1772     asc->reg_ops           = &aspeed_smc_flash_ops;
1773 }
1774 
1775 static const TypeInfo aspeed_2600_spi2_info = {
1776     .name =  "aspeed.spi2-ast2600",
1777     .parent = TYPE_ASPEED_SMC,
1778     .class_init = aspeed_2600_spi2_class_init,
1779 };
1780 
1781 /*
1782  * The FMC Segment Registers of the AST1030 have a 512KB unit.
1783  * Only bits [27:19] are used for decoding.
1784  */
1785 #define AST1030_SEG_ADDR_MASK 0x0ff80000
1786 
1787 static uint32_t aspeed_1030_smc_segment_to_reg(const AspeedSMCState *s,
1788         const AspeedSegments *seg)
1789 {
1790     uint32_t reg = 0;
1791 
1792     /* Disabled segments have a nil register */
1793     if (!seg->size) {
1794         return 0;
1795     }
1796 
1797     reg |= (seg->addr & AST1030_SEG_ADDR_MASK) >> 16; /* start offset */
1798     reg |= (seg->addr + seg->size - 1) & AST1030_SEG_ADDR_MASK; /* end offset */
1799     return reg;
1800 }
1801 
1802 static void aspeed_1030_smc_reg_to_segment(const AspeedSMCState *s,
1803         uint32_t reg, AspeedSegments *seg)
1804 {
1805     uint32_t start_offset = (reg << 16) & AST1030_SEG_ADDR_MASK;
1806     uint32_t end_offset = reg & AST1030_SEG_ADDR_MASK;
1807     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1808 
1809     if (reg) {
1810         seg->addr = asc->flash_window_base + start_offset;
1811         seg->size = end_offset + (512 * KiB) - start_offset;
1812     } else {
1813         seg->addr = asc->flash_window_base;
1814         seg->size = 0;
1815     }
1816 }
1817 
1818 static const uint32_t aspeed_1030_fmc_resets[ASPEED_SMC_R_MAX] = {
1819     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1820                             CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
1821 };
1822 
1823 static const AspeedSegments aspeed_1030_fmc_segments[] = {
1824     { 0x0, 128 * MiB }, /* start address is readonly */
1825     { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
1826     { 0x0, 0 }, /* disabled */
1827 };
1828 
1829 static void aspeed_1030_fmc_class_init(ObjectClass *klass, void *data)
1830 {
1831     DeviceClass *dc = DEVICE_CLASS(klass);
1832     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1833 
1834     dc->desc               = "Aspeed 1030 FMC Controller";
1835     asc->r_conf            = R_CONF;
1836     asc->r_ce_ctrl         = R_CE_CTRL;
1837     asc->r_ctrl0           = R_CTRL0;
1838     asc->r_timings         = R_TIMINGS;
1839     asc->nregs_timings     = 2;
1840     asc->conf_enable_w0    = CONF_ENABLE_W0;
1841     asc->cs_num_max        = 2;
1842     asc->segments          = aspeed_1030_fmc_segments;
1843     asc->segment_addr_mask = 0x0ff80ff8;
1844     asc->resets            = aspeed_1030_fmc_resets;
1845     asc->flash_window_base = 0x80000000;
1846     asc->flash_window_size = 0x10000000;
1847     asc->features          = ASPEED_SMC_FEATURE_DMA;
1848     asc->dma_flash_mask    = 0x0FFFFFFC;
1849     asc->dma_dram_mask     = 0x000BFFFC;
1850     asc->dma_start_length  = 1;
1851     asc->nregs             = ASPEED_SMC_R_MAX;
1852     asc->segment_to_reg    = aspeed_1030_smc_segment_to_reg;
1853     asc->reg_to_segment    = aspeed_1030_smc_reg_to_segment;
1854     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1855     asc->reg_ops           = &aspeed_smc_flash_ops;
1856 }
1857 
1858 static const TypeInfo aspeed_1030_fmc_info = {
1859     .name =  "aspeed.fmc-ast1030",
1860     .parent = TYPE_ASPEED_SMC,
1861     .class_init = aspeed_1030_fmc_class_init,
1862 };
1863 
1864 static const AspeedSegments aspeed_1030_spi1_segments[] = {
1865     { 0x0, 128 * MiB }, /* start address is readonly */
1866     { 0x0, 0 }, /* disabled */
1867 };
1868 
1869 static void aspeed_1030_spi1_class_init(ObjectClass *klass, void *data)
1870 {
1871     DeviceClass *dc = DEVICE_CLASS(klass);
1872     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1873 
1874     dc->desc               = "Aspeed 1030 SPI1 Controller";
1875     asc->r_conf            = R_CONF;
1876     asc->r_ce_ctrl         = R_CE_CTRL;
1877     asc->r_ctrl0           = R_CTRL0;
1878     asc->r_timings         = R_TIMINGS;
1879     asc->nregs_timings     = 2;
1880     asc->conf_enable_w0    = CONF_ENABLE_W0;
1881     asc->cs_num_max        = 2;
1882     asc->segments          = aspeed_1030_spi1_segments;
1883     asc->segment_addr_mask = 0x0ff00ff0;
1884     asc->flash_window_base = 0x90000000;
1885     asc->flash_window_size = 0x10000000;
1886     asc->features          = ASPEED_SMC_FEATURE_DMA;
1887     asc->dma_flash_mask    = 0x0FFFFFFC;
1888     asc->dma_dram_mask     = 0x000BFFFC;
1889     asc->dma_start_length  = 1;
1890     asc->nregs             = ASPEED_SMC_R_MAX;
1891     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1892     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1893     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1894     asc->reg_ops           = &aspeed_smc_flash_ops;
1895 }
1896 
1897 static const TypeInfo aspeed_1030_spi1_info = {
1898     .name =  "aspeed.spi1-ast1030",
1899     .parent = TYPE_ASPEED_SMC,
1900     .class_init = aspeed_1030_spi1_class_init,
1901 };
1902 static const AspeedSegments aspeed_1030_spi2_segments[] = {
1903     { 0x0, 128 * MiB }, /* start address is readonly */
1904     { 0x0, 0 }, /* disabled */
1905 };
1906 
1907 static void aspeed_1030_spi2_class_init(ObjectClass *klass, void *data)
1908 {
1909     DeviceClass *dc = DEVICE_CLASS(klass);
1910     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
1911 
1912     dc->desc               = "Aspeed 1030 SPI2 Controller";
1913     asc->r_conf            = R_CONF;
1914     asc->r_ce_ctrl         = R_CE_CTRL;
1915     asc->r_ctrl0           = R_CTRL0;
1916     asc->r_timings         = R_TIMINGS;
1917     asc->nregs_timings     = 2;
1918     asc->conf_enable_w0    = CONF_ENABLE_W0;
1919     asc->cs_num_max        = 2;
1920     asc->segments          = aspeed_1030_spi2_segments;
1921     asc->segment_addr_mask = 0x0ff00ff0;
1922     asc->flash_window_base = 0xb0000000;
1923     asc->flash_window_size = 0x10000000;
1924     asc->features          = ASPEED_SMC_FEATURE_DMA;
1925     asc->dma_flash_mask    = 0x0FFFFFFC;
1926     asc->dma_dram_mask     = 0x000BFFFC;
1927     asc->dma_start_length  = 1;
1928     asc->nregs             = ASPEED_SMC_R_MAX;
1929     asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
1930     asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
1931     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
1932     asc->reg_ops           = &aspeed_smc_flash_ops;
1933 }
1934 
1935 static const TypeInfo aspeed_1030_spi2_info = {
1936     .name =  "aspeed.spi2-ast1030",
1937     .parent = TYPE_ASPEED_SMC,
1938     .class_init = aspeed_1030_spi2_class_init,
1939 };
1940 
1941 /*
1942  * The FMC Segment Registers of the AST2700 have a 64KB unit.
1943  * Only bits [31:16] are used for decoding.
1944  */
1945 #define AST2700_SEG_ADDR_MASK 0xffff0000
1946 
1947 static uint32_t aspeed_2700_smc_segment_to_reg(const AspeedSMCState *s,
1948                                                const AspeedSegments *seg)
1949 {
1950     uint32_t reg = 0;
1951 
1952     /* Disabled segments have a nil register */
1953     if (!seg->size) {
1954         return 0;
1955     }
1956 
1957     reg |= (seg->addr & AST2700_SEG_ADDR_MASK) >> 16; /* start offset */
1958     reg |= (seg->addr + seg->size - 1) & AST2700_SEG_ADDR_MASK; /* end offset */
1959     return reg;
1960 }
1961 
1962 static void aspeed_2700_smc_reg_to_segment(const AspeedSMCState *s,
1963                                            uint32_t reg, AspeedSegments *seg)
1964 {
1965     uint32_t start_offset = (reg << 16) & AST2700_SEG_ADDR_MASK;
1966     uint32_t end_offset = reg & AST2700_SEG_ADDR_MASK;
1967     AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
1968 
1969     if (reg) {
1970         seg->addr = asc->flash_window_base + start_offset;
1971         seg->size = end_offset + (64 * KiB) - start_offset;
1972     } else {
1973         seg->addr = asc->flash_window_base;
1974         seg->size = 0;
1975     }
1976 }
1977 
1978 static const uint32_t aspeed_2700_fmc_resets[ASPEED_SMC_R_MAX] = {
1979     [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
1980             CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
1981     [R_CE_CTRL] = 0x0000aa00,
1982     [R_CTRL0] = 0x406b0641,
1983     [R_CTRL1] = 0x00000400,
1984     [R_CTRL2] = 0x00000400,
1985     [R_CTRL3] = 0x00000400,
1986     [R_SEG_ADDR0] = 0x08000000,
1987     [R_SEG_ADDR1] = 0x10000800,
1988     [R_SEG_ADDR2] = 0x00000000,
1989     [R_SEG_ADDR3] = 0x00000000,
1990     [R_DUMMY_DATA] = 0x00010000,
1991     [R_DMA_DRAM_ADDR_HIGH] = 0x00000000,
1992     [R_TIMINGS] = 0x007b0000,
1993 };
1994 
1995 static const MemoryRegionOps aspeed_2700_smc_flash_ops = {
1996     .read = aspeed_smc_flash_read,
1997     .write = aspeed_smc_flash_write,
1998     .endianness = DEVICE_LITTLE_ENDIAN,
1999     .valid = {
2000         .min_access_size = 1,
2001         .max_access_size = 8,
2002     },
2003 };
2004 
2005 static const AspeedSegments aspeed_2700_fmc_segments[] = {
2006     { 0x0, 128 * MiB }, /* start address is readonly */
2007     { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
2008     { 256 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
2009     { 0x0, 0 }, /* disabled */
2010 };
2011 
2012 static void aspeed_2700_fmc_class_init(ObjectClass *klass, void *data)
2013 {
2014     DeviceClass *dc = DEVICE_CLASS(klass);
2015     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2016 
2017     dc->desc               = "Aspeed 2700 FMC Controller";
2018     asc->r_conf            = R_CONF;
2019     asc->r_ce_ctrl         = R_CE_CTRL;
2020     asc->r_ctrl0           = R_CTRL0;
2021     asc->r_timings         = R_TIMINGS;
2022     asc->nregs_timings     = 3;
2023     asc->conf_enable_w0    = CONF_ENABLE_W0;
2024     asc->cs_num_max        = 3;
2025     asc->segments          = aspeed_2700_fmc_segments;
2026     asc->segment_addr_mask = 0xffffffff;
2027     asc->resets            = aspeed_2700_fmc_resets;
2028     asc->flash_window_base = 0x100000000;
2029     asc->flash_window_size = 1 * GiB;
2030     asc->features          = ASPEED_SMC_FEATURE_DMA |
2031                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2032     asc->dma_flash_mask    = 0x2FFFFFFC;
2033     asc->dma_dram_mask     = 0xFFFFFFFC;
2034     asc->dma_start_length  = 1;
2035     asc->nregs             = ASPEED_SMC_R_MAX;
2036     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2037     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2038     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2039     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2040 }
2041 
2042 static const TypeInfo aspeed_2700_fmc_info = {
2043     .name =  "aspeed.fmc-ast2700",
2044     .parent = TYPE_ASPEED_SMC,
2045     .class_init = aspeed_2700_fmc_class_init,
2046 };
2047 
2048 static const AspeedSegments aspeed_2700_spi0_segments[] = {
2049     { 0x0, 128 * MiB }, /* start address is readonly */
2050     { 128 * MiB, 128 * MiB }, /* start address is readonly */
2051     { 0x0, 0 }, /* disabled */
2052 };
2053 
2054 static void aspeed_2700_spi0_class_init(ObjectClass *klass, void *data)
2055 {
2056     DeviceClass *dc = DEVICE_CLASS(klass);
2057     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2058 
2059     dc->desc               = "Aspeed 2700 SPI0 Controller";
2060     asc->r_conf            = R_CONF;
2061     asc->r_ce_ctrl         = R_CE_CTRL;
2062     asc->r_ctrl0           = R_CTRL0;
2063     asc->r_timings         = R_TIMINGS;
2064     asc->nregs_timings     = 2;
2065     asc->conf_enable_w0    = CONF_ENABLE_W0;
2066     asc->cs_num_max        = 2;
2067     asc->segments          = aspeed_2700_spi0_segments;
2068     asc->segment_addr_mask = 0xffffffff;
2069     asc->flash_window_base = 0x180000000;
2070     asc->flash_window_size = 1 * GiB;
2071     asc->features          = ASPEED_SMC_FEATURE_DMA |
2072                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2073     asc->dma_flash_mask    = 0x2FFFFFFC;
2074     asc->dma_dram_mask     = 0xFFFFFFFC;
2075     asc->dma_start_length  = 1;
2076     asc->nregs             = ASPEED_SMC_R_MAX;
2077     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2078     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2079     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2080     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2081 }
2082 
2083 static const TypeInfo aspeed_2700_spi0_info = {
2084     .name =  "aspeed.spi0-ast2700",
2085     .parent = TYPE_ASPEED_SMC,
2086     .class_init = aspeed_2700_spi0_class_init,
2087 };
2088 
2089 static const AspeedSegments aspeed_2700_spi1_segments[] = {
2090     { 0x0, 128 * MiB }, /* start address is readonly */
2091     { 0x0, 0 }, /* disabled */
2092 };
2093 
2094 static void aspeed_2700_spi1_class_init(ObjectClass *klass, void *data)
2095 {
2096     DeviceClass *dc = DEVICE_CLASS(klass);
2097     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2098 
2099     dc->desc               = "Aspeed 2700 SPI1 Controller";
2100     asc->r_conf            = R_CONF;
2101     asc->r_ce_ctrl         = R_CE_CTRL;
2102     asc->r_ctrl0           = R_CTRL0;
2103     asc->r_timings         = R_TIMINGS;
2104     asc->nregs_timings     = 2;
2105     asc->conf_enable_w0    = CONF_ENABLE_W0;
2106     asc->cs_num_max        = 2;
2107     asc->segments          = aspeed_2700_spi1_segments;
2108     asc->segment_addr_mask = 0xffffffff;
2109     asc->flash_window_base = 0x200000000;
2110     asc->flash_window_size = 1 * GiB;
2111     asc->features          = ASPEED_SMC_FEATURE_DMA |
2112                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2113     asc->dma_flash_mask    = 0x2FFFFFFC;
2114     asc->dma_dram_mask     = 0xFFFFFFFC;
2115     asc->dma_start_length  = 1;
2116     asc->nregs             = ASPEED_SMC_R_MAX;
2117     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2118     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2119     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2120     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2121 }
2122 
2123 static const TypeInfo aspeed_2700_spi1_info = {
2124         .name =  "aspeed.spi1-ast2700",
2125         .parent = TYPE_ASPEED_SMC,
2126         .class_init = aspeed_2700_spi1_class_init,
2127 };
2128 
2129 static const AspeedSegments aspeed_2700_spi2_segments[] = {
2130     { 0x0, 128 * MiB }, /* start address is readonly */
2131     { 0x0, 0 }, /* disabled */
2132 };
2133 
2134 static void aspeed_2700_spi2_class_init(ObjectClass *klass, void *data)
2135 {
2136     DeviceClass *dc = DEVICE_CLASS(klass);
2137     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
2138 
2139     dc->desc               = "Aspeed 2700 SPI2 Controller";
2140     asc->r_conf            = R_CONF;
2141     asc->r_ce_ctrl         = R_CE_CTRL;
2142     asc->r_ctrl0           = R_CTRL0;
2143     asc->r_timings         = R_TIMINGS;
2144     asc->nregs_timings     = 2;
2145     asc->conf_enable_w0    = CONF_ENABLE_W0;
2146     asc->cs_num_max        = 2;
2147     asc->segments          = aspeed_2700_spi2_segments;
2148     asc->segment_addr_mask = 0xffffffff;
2149     asc->flash_window_base = 0x280000000;
2150     asc->flash_window_size = 1 * GiB;
2151     asc->features          = ASPEED_SMC_FEATURE_DMA |
2152                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
2153     asc->dma_flash_mask    = 0x0FFFFFFC;
2154     asc->dma_dram_mask     = 0xFFFFFFFC;
2155     asc->dma_start_length  = 1;
2156     asc->nregs             = ASPEED_SMC_R_MAX;
2157     asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
2158     asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
2159     asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
2160     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
2161 }
2162 
2163 static const TypeInfo aspeed_2700_spi2_info = {
2164         .name =  "aspeed.spi2-ast2700",
2165         .parent = TYPE_ASPEED_SMC,
2166         .class_init = aspeed_2700_spi2_class_init,
2167 };
2168 
2169 static void aspeed_smc_register_types(void)
2170 {
2171     type_register_static(&aspeed_smc_flash_info);
2172     type_register_static(&aspeed_smc_info);
2173     type_register_static(&aspeed_2400_smc_info);
2174     type_register_static(&aspeed_2400_fmc_info);
2175     type_register_static(&aspeed_2400_spi1_info);
2176     type_register_static(&aspeed_2500_fmc_info);
2177     type_register_static(&aspeed_2500_spi1_info);
2178     type_register_static(&aspeed_2500_spi2_info);
2179     type_register_static(&aspeed_2600_fmc_info);
2180     type_register_static(&aspeed_2600_spi1_info);
2181     type_register_static(&aspeed_2600_spi2_info);
2182     type_register_static(&aspeed_1030_fmc_info);
2183     type_register_static(&aspeed_1030_spi1_info);
2184     type_register_static(&aspeed_1030_spi2_info);
2185     type_register_static(&aspeed_2700_fmc_info);
2186     type_register_static(&aspeed_2700_spi0_info);
2187     type_register_static(&aspeed_2700_spi1_info);
2188     type_register_static(&aspeed_2700_spi2_info);
2189 }
2190 
2191 type_init(aspeed_smc_register_types)
2192