1 /* 2 * ASPEED AST2400 SMC Controller (SPI Flash Only) 3 * 4 * Copyright (C) 2016 IBM Corp. 5 * 6 * Permission is hereby granted, free of charge, to any person obtaining a copy 7 * of this software and associated documentation files (the "Software"), to deal 8 * in the Software without restriction, including without limitation the rights 9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 * copies of the Software, and to permit persons to whom the Software is 11 * furnished to do so, subject to the following conditions: 12 * 13 * The above copyright notice and this permission notice shall be included in 14 * all copies or substantial portions of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 * THE SOFTWARE. 23 */ 24 25 #include "qemu/osdep.h" 26 #include "hw/sysbus.h" 27 #include "sysemu/sysemu.h" 28 #include "qemu/log.h" 29 #include "qemu/module.h" 30 #include "qemu/error-report.h" 31 32 #include "hw/irq.h" 33 #include "hw/ssi/aspeed_smc.h" 34 35 /* CE Type Setting Register */ 36 #define R_CONF (0x00 / 4) 37 #define CONF_LEGACY_DISABLE (1 << 31) 38 #define CONF_ENABLE_W4 20 39 #define CONF_ENABLE_W3 19 40 #define CONF_ENABLE_W2 18 41 #define CONF_ENABLE_W1 17 42 #define CONF_ENABLE_W0 16 43 #define CONF_FLASH_TYPE4 8 44 #define CONF_FLASH_TYPE3 6 45 #define CONF_FLASH_TYPE2 4 46 #define CONF_FLASH_TYPE1 2 47 #define CONF_FLASH_TYPE0 0 48 #define CONF_FLASH_TYPE_NOR 0x0 49 #define CONF_FLASH_TYPE_NAND 0x1 50 #define CONF_FLASH_TYPE_SPI 0x2 51 52 /* CE Control Register */ 53 #define R_CE_CTRL (0x04 / 4) 54 #define CTRL_EXTENDED4 4 /* 32 bit addressing for SPI */ 55 #define CTRL_EXTENDED3 3 /* 32 bit addressing for SPI */ 56 #define CTRL_EXTENDED2 2 /* 32 bit addressing for SPI */ 57 #define CTRL_EXTENDED1 1 /* 32 bit addressing for SPI */ 58 #define CTRL_EXTENDED0 0 /* 32 bit addressing for SPI */ 59 60 /* Interrupt Control and Status Register */ 61 #define R_INTR_CTRL (0x08 / 4) 62 #define INTR_CTRL_DMA_STATUS (1 << 11) 63 #define INTR_CTRL_CMD_ABORT_STATUS (1 << 10) 64 #define INTR_CTRL_WRITE_PROTECT_STATUS (1 << 9) 65 #define INTR_CTRL_DMA_EN (1 << 3) 66 #define INTR_CTRL_CMD_ABORT_EN (1 << 2) 67 #define INTR_CTRL_WRITE_PROTECT_EN (1 << 1) 68 69 /* CEx Control Register */ 70 #define R_CTRL0 (0x10 / 4) 71 #define CTRL_IO_DUAL_DATA (1 << 29) 72 #define CTRL_IO_DUAL_ADDR_DATA (1 << 28) /* Includes dummies */ 73 #define CTRL_CMD_SHIFT 16 74 #define CTRL_CMD_MASK 0xff 75 #define CTRL_DUMMY_HIGH_SHIFT 14 76 #define CTRL_AST2400_SPI_4BYTE (1 << 13) 77 #define CTRL_DUMMY_LOW_SHIFT 6 /* 2 bits [7:6] */ 78 #define CTRL_CE_STOP_ACTIVE (1 << 2) 79 #define CTRL_CMD_MODE_MASK 0x3 80 #define CTRL_READMODE 0x0 81 #define CTRL_FREADMODE 0x1 82 #define CTRL_WRITEMODE 0x2 83 #define CTRL_USERMODE 0x3 84 #define R_CTRL1 (0x14 / 4) 85 #define R_CTRL2 (0x18 / 4) 86 #define R_CTRL3 (0x1C / 4) 87 #define R_CTRL4 (0x20 / 4) 88 89 /* CEx Segment Address Register */ 90 #define R_SEG_ADDR0 (0x30 / 4) 91 #define SEG_END_SHIFT 24 /* 8MB units */ 92 #define SEG_END_MASK 0xff 93 #define SEG_START_SHIFT 16 /* address bit [A29-A23] */ 94 #define SEG_START_MASK 0xff 95 #define R_SEG_ADDR1 (0x34 / 4) 96 #define R_SEG_ADDR2 (0x38 / 4) 97 #define R_SEG_ADDR3 (0x3C / 4) 98 #define R_SEG_ADDR4 (0x40 / 4) 99 100 /* Misc Control Register #1 */ 101 #define R_MISC_CTRL1 (0x50 / 4) 102 103 /* SPI dummy cycle data */ 104 #define R_DUMMY_DATA (0x54 / 4) 105 106 /* DMA Control/Status Register */ 107 #define R_DMA_CTRL (0x80 / 4) 108 #define DMA_CTRL_DELAY_MASK 0xf 109 #define DMA_CTRL_DELAY_SHIFT 8 110 #define DMA_CTRL_FREQ_MASK 0xf 111 #define DMA_CTRL_FREQ_SHIFT 4 112 #define DMA_CTRL_MODE (1 << 3) 113 #define DMA_CTRL_CKSUM (1 << 2) 114 #define DMA_CTRL_DIR (1 << 1) 115 #define DMA_CTRL_EN (1 << 0) 116 117 /* DMA Flash Side Address */ 118 #define R_DMA_FLASH_ADDR (0x84 / 4) 119 120 /* DMA DRAM Side Address */ 121 #define R_DMA_DRAM_ADDR (0x88 / 4) 122 123 /* DMA Length Register */ 124 #define R_DMA_LEN (0x8C / 4) 125 126 /* Checksum Calculation Result */ 127 #define R_DMA_CHECKSUM (0x90 / 4) 128 129 /* Misc Control Register #2 */ 130 #define R_TIMINGS (0x94 / 4) 131 132 /* SPI controller registers and bits */ 133 #define R_SPI_CONF (0x00 / 4) 134 #define SPI_CONF_ENABLE_W0 0 135 #define R_SPI_CTRL0 (0x4 / 4) 136 #define R_SPI_MISC_CTRL (0x10 / 4) 137 #define R_SPI_TIMINGS (0x14 / 4) 138 139 #define ASPEED_SMC_R_SPI_MAX (0x20 / 4) 140 #define ASPEED_SMC_R_SMC_MAX (0x20 / 4) 141 142 #define ASPEED_SOC_SMC_FLASH_BASE 0x10000000 143 #define ASPEED_SOC_FMC_FLASH_BASE 0x20000000 144 #define ASPEED_SOC_SPI_FLASH_BASE 0x30000000 145 #define ASPEED_SOC_SPI2_FLASH_BASE 0x38000000 146 147 /* Flash opcodes. */ 148 #define SPI_OP_READ 0x03 /* Read data bytes (low frequency) */ 149 150 #define SNOOP_OFF 0xFF 151 #define SNOOP_START 0x0 152 153 /* 154 * Default segments mapping addresses and size for each slave per 155 * controller. These can be changed when board is initialized with the 156 * Segment Address Registers. 157 */ 158 static const AspeedSegments aspeed_segments_legacy[] = { 159 { 0x10000000, 32 * 1024 * 1024 }, 160 }; 161 162 static const AspeedSegments aspeed_segments_fmc[] = { 163 { 0x20000000, 64 * 1024 * 1024 }, /* start address is readonly */ 164 { 0x24000000, 32 * 1024 * 1024 }, 165 { 0x26000000, 32 * 1024 * 1024 }, 166 { 0x28000000, 32 * 1024 * 1024 }, 167 { 0x2A000000, 32 * 1024 * 1024 } 168 }; 169 170 static const AspeedSegments aspeed_segments_spi[] = { 171 { 0x30000000, 64 * 1024 * 1024 }, 172 }; 173 174 static const AspeedSegments aspeed_segments_ast2500_fmc[] = { 175 { 0x20000000, 128 * 1024 * 1024 }, /* start address is readonly */ 176 { 0x28000000, 32 * 1024 * 1024 }, 177 { 0x2A000000, 32 * 1024 * 1024 }, 178 }; 179 180 static const AspeedSegments aspeed_segments_ast2500_spi1[] = { 181 { 0x30000000, 32 * 1024 * 1024 }, /* start address is readonly */ 182 { 0x32000000, 96 * 1024 * 1024 }, /* end address is readonly */ 183 }; 184 185 static const AspeedSegments aspeed_segments_ast2500_spi2[] = { 186 { 0x38000000, 32 * 1024 * 1024 }, /* start address is readonly */ 187 { 0x3A000000, 96 * 1024 * 1024 }, /* end address is readonly */ 188 }; 189 190 static const AspeedSMCController controllers[] = { 191 { 192 .name = "aspeed.smc.smc", 193 .r_conf = R_CONF, 194 .r_ce_ctrl = R_CE_CTRL, 195 .r_ctrl0 = R_CTRL0, 196 .r_timings = R_TIMINGS, 197 .conf_enable_w0 = CONF_ENABLE_W0, 198 .max_slaves = 5, 199 .segments = aspeed_segments_legacy, 200 .flash_window_base = ASPEED_SOC_SMC_FLASH_BASE, 201 .flash_window_size = 0x6000000, 202 .has_dma = false, 203 .nregs = ASPEED_SMC_R_SMC_MAX, 204 }, { 205 .name = "aspeed.smc.fmc", 206 .r_conf = R_CONF, 207 .r_ce_ctrl = R_CE_CTRL, 208 .r_ctrl0 = R_CTRL0, 209 .r_timings = R_TIMINGS, 210 .conf_enable_w0 = CONF_ENABLE_W0, 211 .max_slaves = 5, 212 .segments = aspeed_segments_fmc, 213 .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE, 214 .flash_window_size = 0x10000000, 215 .has_dma = true, 216 .nregs = ASPEED_SMC_R_MAX, 217 }, { 218 .name = "aspeed.smc.spi", 219 .r_conf = R_SPI_CONF, 220 .r_ce_ctrl = 0xff, 221 .r_ctrl0 = R_SPI_CTRL0, 222 .r_timings = R_SPI_TIMINGS, 223 .conf_enable_w0 = SPI_CONF_ENABLE_W0, 224 .max_slaves = 1, 225 .segments = aspeed_segments_spi, 226 .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE, 227 .flash_window_size = 0x10000000, 228 .has_dma = false, 229 .nregs = ASPEED_SMC_R_SPI_MAX, 230 }, { 231 .name = "aspeed.smc.ast2500-fmc", 232 .r_conf = R_CONF, 233 .r_ce_ctrl = R_CE_CTRL, 234 .r_ctrl0 = R_CTRL0, 235 .r_timings = R_TIMINGS, 236 .conf_enable_w0 = CONF_ENABLE_W0, 237 .max_slaves = 3, 238 .segments = aspeed_segments_ast2500_fmc, 239 .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE, 240 .flash_window_size = 0x10000000, 241 .has_dma = true, 242 .nregs = ASPEED_SMC_R_MAX, 243 }, { 244 .name = "aspeed.smc.ast2500-spi1", 245 .r_conf = R_CONF, 246 .r_ce_ctrl = R_CE_CTRL, 247 .r_ctrl0 = R_CTRL0, 248 .r_timings = R_TIMINGS, 249 .conf_enable_w0 = CONF_ENABLE_W0, 250 .max_slaves = 2, 251 .segments = aspeed_segments_ast2500_spi1, 252 .flash_window_base = ASPEED_SOC_SPI_FLASH_BASE, 253 .flash_window_size = 0x8000000, 254 .has_dma = false, 255 .nregs = ASPEED_SMC_R_MAX, 256 }, { 257 .name = "aspeed.smc.ast2500-spi2", 258 .r_conf = R_CONF, 259 .r_ce_ctrl = R_CE_CTRL, 260 .r_ctrl0 = R_CTRL0, 261 .r_timings = R_TIMINGS, 262 .conf_enable_w0 = CONF_ENABLE_W0, 263 .max_slaves = 2, 264 .segments = aspeed_segments_ast2500_spi2, 265 .flash_window_base = ASPEED_SOC_SPI2_FLASH_BASE, 266 .flash_window_size = 0x8000000, 267 .has_dma = false, 268 .nregs = ASPEED_SMC_R_MAX, 269 }, 270 }; 271 272 /* 273 * The Segment Register uses a 8MB unit to encode the start address 274 * and the end address of the mapping window of a flash SPI slave : 275 * 276 * | byte 1 | byte 2 | byte 3 | byte 4 | 277 * +--------+--------+--------+--------+ 278 * | end | start | 0 | 0 | 279 * 280 */ 281 static inline uint32_t aspeed_smc_segment_to_reg(const AspeedSegments *seg) 282 { 283 uint32_t reg = 0; 284 reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT; 285 reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT; 286 return reg; 287 } 288 289 static inline void aspeed_smc_reg_to_segment(uint32_t reg, AspeedSegments *seg) 290 { 291 seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23; 292 seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr; 293 } 294 295 static bool aspeed_smc_flash_overlap(const AspeedSMCState *s, 296 const AspeedSegments *new, 297 int cs) 298 { 299 AspeedSegments seg; 300 int i; 301 302 for (i = 0; i < s->ctrl->max_slaves; i++) { 303 if (i == cs) { 304 continue; 305 } 306 307 aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + i], &seg); 308 309 if (new->addr + new->size > seg.addr && 310 new->addr < seg.addr + seg.size) { 311 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment CS%d [ 0x%" 312 HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with " 313 "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 314 s->ctrl->name, cs, new->addr, new->addr + new->size, 315 i, seg.addr, seg.addr + seg.size); 316 return true; 317 } 318 } 319 return false; 320 } 321 322 static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs, 323 uint64_t new) 324 { 325 AspeedSMCFlash *fl = &s->flashes[cs]; 326 AspeedSegments seg; 327 328 aspeed_smc_reg_to_segment(new, &seg); 329 330 /* The start address of CS0 is read-only */ 331 if (cs == 0 && seg.addr != s->ctrl->flash_window_base) { 332 qemu_log_mask(LOG_GUEST_ERROR, 333 "%s: Tried to change CS0 start address to 0x%" 334 HWADDR_PRIx "\n", s->ctrl->name, seg.addr); 335 seg.addr = s->ctrl->flash_window_base; 336 new = aspeed_smc_segment_to_reg(&seg); 337 } 338 339 /* 340 * The end address of the AST2500 spi controllers is also 341 * read-only. 342 */ 343 if ((s->ctrl->segments == aspeed_segments_ast2500_spi1 || 344 s->ctrl->segments == aspeed_segments_ast2500_spi2) && 345 cs == s->ctrl->max_slaves && 346 seg.addr + seg.size != s->ctrl->segments[cs].addr + 347 s->ctrl->segments[cs].size) { 348 qemu_log_mask(LOG_GUEST_ERROR, 349 "%s: Tried to change CS%d end address to 0x%" 350 HWADDR_PRIx "\n", s->ctrl->name, cs, seg.addr + seg.size); 351 seg.size = s->ctrl->segments[cs].addr + s->ctrl->segments[cs].size - 352 seg.addr; 353 new = aspeed_smc_segment_to_reg(&seg); 354 } 355 356 /* Keep the segment in the overall flash window */ 357 if (seg.addr + seg.size <= s->ctrl->flash_window_base || 358 seg.addr > s->ctrl->flash_window_base + s->ctrl->flash_window_size) { 359 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is invalid : " 360 "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 361 s->ctrl->name, cs, seg.addr, seg.addr + seg.size); 362 return; 363 } 364 365 /* Check start address vs. alignment */ 366 if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) { 367 qemu_log_mask(LOG_GUEST_ERROR, "%s: new segment for CS%d is not " 368 "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 369 s->ctrl->name, cs, seg.addr, seg.addr + seg.size); 370 } 371 372 /* And segments should not overlap (in the specs) */ 373 aspeed_smc_flash_overlap(s, &seg, cs); 374 375 /* All should be fine now to move the region */ 376 memory_region_transaction_begin(); 377 memory_region_set_size(&fl->mmio, seg.size); 378 memory_region_set_address(&fl->mmio, seg.addr - s->ctrl->flash_window_base); 379 memory_region_set_enabled(&fl->mmio, true); 380 memory_region_transaction_commit(); 381 382 s->regs[R_SEG_ADDR0 + cs] = new; 383 } 384 385 static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr, 386 unsigned size) 387 { 388 qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u" 389 PRIx64 "\n", __func__, addr, size); 390 return 0; 391 } 392 393 static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr, 394 uint64_t data, unsigned size) 395 { 396 qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u: 0x%" 397 PRIx64 "\n", __func__, addr, size, data); 398 } 399 400 static const MemoryRegionOps aspeed_smc_flash_default_ops = { 401 .read = aspeed_smc_flash_default_read, 402 .write = aspeed_smc_flash_default_write, 403 .endianness = DEVICE_LITTLE_ENDIAN, 404 .valid = { 405 .min_access_size = 1, 406 .max_access_size = 4, 407 }, 408 }; 409 410 static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl) 411 { 412 const AspeedSMCState *s = fl->controller; 413 414 return s->regs[s->r_ctrl0 + fl->id] & CTRL_CMD_MODE_MASK; 415 } 416 417 static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl) 418 { 419 const AspeedSMCState *s = fl->controller; 420 421 return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->id)); 422 } 423 424 static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl) 425 { 426 const AspeedSMCState *s = fl->controller; 427 int cmd = (s->regs[s->r_ctrl0 + fl->id] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK; 428 429 /* In read mode, the default SPI command is READ (0x3). In other 430 * modes, the command should necessarily be defined */ 431 if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) { 432 cmd = SPI_OP_READ; 433 } 434 435 if (!cmd) { 436 qemu_log_mask(LOG_GUEST_ERROR, "%s: no command defined for mode %d\n", 437 __func__, aspeed_smc_flash_mode(fl)); 438 } 439 440 return cmd; 441 } 442 443 static inline int aspeed_smc_flash_is_4byte(const AspeedSMCFlash *fl) 444 { 445 const AspeedSMCState *s = fl->controller; 446 447 if (s->ctrl->segments == aspeed_segments_spi) { 448 return s->regs[s->r_ctrl0] & CTRL_AST2400_SPI_4BYTE; 449 } else { 450 return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->id)); 451 } 452 } 453 454 static inline bool aspeed_smc_is_ce_stop_active(const AspeedSMCFlash *fl) 455 { 456 const AspeedSMCState *s = fl->controller; 457 458 return s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE; 459 } 460 461 static void aspeed_smc_flash_select(AspeedSMCFlash *fl) 462 { 463 AspeedSMCState *s = fl->controller; 464 465 s->regs[s->r_ctrl0 + fl->id] &= ~CTRL_CE_STOP_ACTIVE; 466 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 467 } 468 469 static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl) 470 { 471 AspeedSMCState *s = fl->controller; 472 473 s->regs[s->r_ctrl0 + fl->id] |= CTRL_CE_STOP_ACTIVE; 474 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 475 } 476 477 static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl, 478 uint32_t addr) 479 { 480 const AspeedSMCState *s = fl->controller; 481 AspeedSegments seg; 482 483 aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + fl->id], &seg); 484 if ((addr % seg.size) != addr) { 485 qemu_log_mask(LOG_GUEST_ERROR, 486 "%s: invalid address 0x%08x for CS%d segment : " 487 "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n", 488 s->ctrl->name, addr, fl->id, seg.addr, 489 seg.addr + seg.size); 490 addr %= seg.size; 491 } 492 493 return addr; 494 } 495 496 static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl) 497 { 498 const AspeedSMCState *s = fl->controller; 499 uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->id]; 500 uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1; 501 uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3; 502 uint32_t dummies = ((dummy_high << 2) | dummy_low) * 8; 503 504 if (r_ctrl0 & CTRL_IO_DUAL_ADDR_DATA) { 505 dummies /= 2; 506 } 507 508 return dummies; 509 } 510 511 static void aspeed_smc_flash_setup(AspeedSMCFlash *fl, uint32_t addr) 512 { 513 const AspeedSMCState *s = fl->controller; 514 uint8_t cmd = aspeed_smc_flash_cmd(fl); 515 int i; 516 517 /* Flash access can not exceed CS segment */ 518 addr = aspeed_smc_check_segment_addr(fl, addr); 519 520 ssi_transfer(s->spi, cmd); 521 522 if (aspeed_smc_flash_is_4byte(fl)) { 523 ssi_transfer(s->spi, (addr >> 24) & 0xff); 524 } 525 ssi_transfer(s->spi, (addr >> 16) & 0xff); 526 ssi_transfer(s->spi, (addr >> 8) & 0xff); 527 ssi_transfer(s->spi, (addr & 0xff)); 528 529 /* 530 * Use fake transfers to model dummy bytes. The value should 531 * be configured to some non-zero value in fast read mode and 532 * zero in read mode. But, as the HW allows inconsistent 533 * settings, let's check for fast read mode. 534 */ 535 if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) { 536 for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) { 537 ssi_transfer(fl->controller->spi, s->regs[R_DUMMY_DATA] & 0xff); 538 } 539 } 540 } 541 542 static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size) 543 { 544 AspeedSMCFlash *fl = opaque; 545 AspeedSMCState *s = fl->controller; 546 uint64_t ret = 0; 547 int i; 548 549 switch (aspeed_smc_flash_mode(fl)) { 550 case CTRL_USERMODE: 551 for (i = 0; i < size; i++) { 552 ret |= ssi_transfer(s->spi, 0x0) << (8 * i); 553 } 554 break; 555 case CTRL_READMODE: 556 case CTRL_FREADMODE: 557 aspeed_smc_flash_select(fl); 558 aspeed_smc_flash_setup(fl, addr); 559 560 for (i = 0; i < size; i++) { 561 ret |= ssi_transfer(s->spi, 0x0) << (8 * i); 562 } 563 564 aspeed_smc_flash_unselect(fl); 565 break; 566 default: 567 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n", 568 __func__, aspeed_smc_flash_mode(fl)); 569 } 570 571 return ret; 572 } 573 574 /* 575 * TODO (clg@kaod.org): stolen from xilinx_spips.c. Should move to a 576 * common include header. 577 */ 578 typedef enum { 579 READ = 0x3, READ_4 = 0x13, 580 FAST_READ = 0xb, FAST_READ_4 = 0x0c, 581 DOR = 0x3b, DOR_4 = 0x3c, 582 QOR = 0x6b, QOR_4 = 0x6c, 583 DIOR = 0xbb, DIOR_4 = 0xbc, 584 QIOR = 0xeb, QIOR_4 = 0xec, 585 586 PP = 0x2, PP_4 = 0x12, 587 DPP = 0xa2, 588 QPP = 0x32, QPP_4 = 0x34, 589 } FlashCMD; 590 591 static int aspeed_smc_num_dummies(uint8_t command) 592 { 593 switch (command) { /* check for dummies */ 594 case READ: /* no dummy bytes/cycles */ 595 case PP: 596 case DPP: 597 case QPP: 598 case READ_4: 599 case PP_4: 600 case QPP_4: 601 return 0; 602 case FAST_READ: 603 case DOR: 604 case QOR: 605 case DOR_4: 606 case QOR_4: 607 return 1; 608 case DIOR: 609 case FAST_READ_4: 610 case DIOR_4: 611 return 2; 612 case QIOR: 613 case QIOR_4: 614 return 4; 615 default: 616 return -1; 617 } 618 } 619 620 static bool aspeed_smc_do_snoop(AspeedSMCFlash *fl, uint64_t data, 621 unsigned size) 622 { 623 AspeedSMCState *s = fl->controller; 624 uint8_t addr_width = aspeed_smc_flash_is_4byte(fl) ? 4 : 3; 625 626 if (s->snoop_index == SNOOP_OFF) { 627 return false; /* Do nothing */ 628 629 } else if (s->snoop_index == SNOOP_START) { 630 uint8_t cmd = data & 0xff; 631 int ndummies = aspeed_smc_num_dummies(cmd); 632 633 /* 634 * No dummy cycles are expected with the current command. Turn 635 * off snooping and let the transfer proceed normally. 636 */ 637 if (ndummies <= 0) { 638 s->snoop_index = SNOOP_OFF; 639 return false; 640 } 641 642 s->snoop_dummies = ndummies * 8; 643 644 } else if (s->snoop_index >= addr_width + 1) { 645 646 /* The SPI transfer has reached the dummy cycles sequence */ 647 for (; s->snoop_dummies; s->snoop_dummies--) { 648 ssi_transfer(s->spi, s->regs[R_DUMMY_DATA] & 0xff); 649 } 650 651 /* If no more dummy cycles are expected, turn off snooping */ 652 if (!s->snoop_dummies) { 653 s->snoop_index = SNOOP_OFF; 654 } else { 655 s->snoop_index += size; 656 } 657 658 /* 659 * Dummy cycles have been faked already. Ignore the current 660 * SPI transfer 661 */ 662 return true; 663 } 664 665 s->snoop_index += size; 666 return false; 667 } 668 669 static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data, 670 unsigned size) 671 { 672 AspeedSMCFlash *fl = opaque; 673 AspeedSMCState *s = fl->controller; 674 int i; 675 676 if (!aspeed_smc_is_writable(fl)) { 677 qemu_log_mask(LOG_GUEST_ERROR, "%s: flash is not writable at 0x%" 678 HWADDR_PRIx "\n", __func__, addr); 679 return; 680 } 681 682 switch (aspeed_smc_flash_mode(fl)) { 683 case CTRL_USERMODE: 684 if (aspeed_smc_do_snoop(fl, data, size)) { 685 break; 686 } 687 688 for (i = 0; i < size; i++) { 689 ssi_transfer(s->spi, (data >> (8 * i)) & 0xff); 690 } 691 break; 692 case CTRL_WRITEMODE: 693 aspeed_smc_flash_select(fl); 694 aspeed_smc_flash_setup(fl, addr); 695 696 for (i = 0; i < size; i++) { 697 ssi_transfer(s->spi, (data >> (8 * i)) & 0xff); 698 } 699 700 aspeed_smc_flash_unselect(fl); 701 break; 702 default: 703 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid flash mode %d\n", 704 __func__, aspeed_smc_flash_mode(fl)); 705 } 706 } 707 708 static const MemoryRegionOps aspeed_smc_flash_ops = { 709 .read = aspeed_smc_flash_read, 710 .write = aspeed_smc_flash_write, 711 .endianness = DEVICE_LITTLE_ENDIAN, 712 .valid = { 713 .min_access_size = 1, 714 .max_access_size = 4, 715 }, 716 }; 717 718 static void aspeed_smc_flash_update_cs(AspeedSMCFlash *fl) 719 { 720 AspeedSMCState *s = fl->controller; 721 722 s->snoop_index = aspeed_smc_is_ce_stop_active(fl) ? SNOOP_OFF : SNOOP_START; 723 724 qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl)); 725 } 726 727 static void aspeed_smc_reset(DeviceState *d) 728 { 729 AspeedSMCState *s = ASPEED_SMC(d); 730 int i; 731 732 memset(s->regs, 0, sizeof s->regs); 733 734 /* Pretend DMA is done (u-boot initialization) */ 735 s->regs[R_INTR_CTRL] = INTR_CTRL_DMA_STATUS; 736 737 /* Unselect all slaves */ 738 for (i = 0; i < s->num_cs; ++i) { 739 s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE; 740 qemu_set_irq(s->cs_lines[i], true); 741 } 742 743 /* setup default segment register values for all */ 744 for (i = 0; i < s->ctrl->max_slaves; ++i) { 745 s->regs[R_SEG_ADDR0 + i] = 746 aspeed_smc_segment_to_reg(&s->ctrl->segments[i]); 747 } 748 749 /* HW strapping flash type for FMC controllers */ 750 if (s->ctrl->segments == aspeed_segments_ast2500_fmc) { 751 /* flash type is fixed to SPI for CE0 and CE1 */ 752 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0); 753 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1); 754 } 755 756 /* HW strapping for AST2400 FMC controllers (SCU70). Let's use the 757 * configuration of the palmetto-bmc machine */ 758 if (s->ctrl->segments == aspeed_segments_fmc) { 759 s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0); 760 } 761 762 s->snoop_index = SNOOP_OFF; 763 s->snoop_dummies = 0; 764 } 765 766 static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size) 767 { 768 AspeedSMCState *s = ASPEED_SMC(opaque); 769 770 addr >>= 2; 771 772 if (addr == s->r_conf || 773 addr == s->r_timings || 774 addr == s->r_ce_ctrl || 775 addr == R_INTR_CTRL || 776 addr == R_DUMMY_DATA || 777 (addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) || 778 (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->ctrl->max_slaves)) { 779 return s->regs[addr]; 780 } else { 781 qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n", 782 __func__, addr); 783 return -1; 784 } 785 } 786 787 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data, 788 unsigned int size) 789 { 790 AspeedSMCState *s = ASPEED_SMC(opaque); 791 uint32_t value = data; 792 793 addr >>= 2; 794 795 if (addr == s->r_conf || 796 addr == s->r_timings || 797 addr == s->r_ce_ctrl) { 798 s->regs[addr] = value; 799 } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) { 800 int cs = addr - s->r_ctrl0; 801 s->regs[addr] = value; 802 aspeed_smc_flash_update_cs(&s->flashes[cs]); 803 } else if (addr >= R_SEG_ADDR0 && 804 addr < R_SEG_ADDR0 + s->ctrl->max_slaves) { 805 int cs = addr - R_SEG_ADDR0; 806 807 if (value != s->regs[R_SEG_ADDR0 + cs]) { 808 aspeed_smc_flash_set_segment(s, cs, value); 809 } 810 } else if (addr == R_DUMMY_DATA) { 811 s->regs[addr] = value & 0xff; 812 } else { 813 qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n", 814 __func__, addr); 815 return; 816 } 817 } 818 819 static const MemoryRegionOps aspeed_smc_ops = { 820 .read = aspeed_smc_read, 821 .write = aspeed_smc_write, 822 .endianness = DEVICE_LITTLE_ENDIAN, 823 .valid.unaligned = true, 824 }; 825 826 static void aspeed_smc_realize(DeviceState *dev, Error **errp) 827 { 828 SysBusDevice *sbd = SYS_BUS_DEVICE(dev); 829 AspeedSMCState *s = ASPEED_SMC(dev); 830 AspeedSMCClass *mc = ASPEED_SMC_GET_CLASS(s); 831 int i; 832 char name[32]; 833 hwaddr offset = 0; 834 835 s->ctrl = mc->ctrl; 836 837 /* keep a copy under AspeedSMCState to speed up accesses */ 838 s->r_conf = s->ctrl->r_conf; 839 s->r_ce_ctrl = s->ctrl->r_ce_ctrl; 840 s->r_ctrl0 = s->ctrl->r_ctrl0; 841 s->r_timings = s->ctrl->r_timings; 842 s->conf_enable_w0 = s->ctrl->conf_enable_w0; 843 844 /* Enforce some real HW limits */ 845 if (s->num_cs > s->ctrl->max_slaves) { 846 qemu_log_mask(LOG_GUEST_ERROR, "%s: num_cs cannot exceed: %d\n", 847 __func__, s->ctrl->max_slaves); 848 s->num_cs = s->ctrl->max_slaves; 849 } 850 851 s->spi = ssi_create_bus(dev, "spi"); 852 853 /* Setup cs_lines for slaves */ 854 sysbus_init_irq(sbd, &s->irq); 855 s->cs_lines = g_new0(qemu_irq, s->num_cs); 856 ssi_auto_connect_slaves(dev, s->cs_lines, s->spi); 857 858 for (i = 0; i < s->num_cs; ++i) { 859 sysbus_init_irq(sbd, &s->cs_lines[i]); 860 } 861 862 /* The memory region for the controller registers */ 863 memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s, 864 s->ctrl->name, s->ctrl->nregs * 4); 865 sysbus_init_mmio(sbd, &s->mmio); 866 867 /* 868 * The container memory region representing the address space 869 * window in which the flash modules are mapped. The size and 870 * address depends on the SoC model and controller type. 871 */ 872 snprintf(name, sizeof(name), "%s.flash", s->ctrl->name); 873 874 memory_region_init_io(&s->mmio_flash, OBJECT(s), 875 &aspeed_smc_flash_default_ops, s, name, 876 s->ctrl->flash_window_size); 877 sysbus_init_mmio(sbd, &s->mmio_flash); 878 879 s->flashes = g_new0(AspeedSMCFlash, s->ctrl->max_slaves); 880 881 /* 882 * Let's create a sub memory region for each possible slave. All 883 * have a configurable memory segment in the overall flash mapping 884 * window of the controller but, there is not necessarily a flash 885 * module behind to handle the memory accesses. This depends on 886 * the board configuration. 887 */ 888 for (i = 0; i < s->ctrl->max_slaves; ++i) { 889 AspeedSMCFlash *fl = &s->flashes[i]; 890 891 snprintf(name, sizeof(name), "%s.%d", s->ctrl->name, i); 892 893 fl->id = i; 894 fl->controller = s; 895 fl->size = s->ctrl->segments[i].size; 896 memory_region_init_io(&fl->mmio, OBJECT(s), &aspeed_smc_flash_ops, 897 fl, name, fl->size); 898 memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio); 899 offset += fl->size; 900 } 901 } 902 903 static const VMStateDescription vmstate_aspeed_smc = { 904 .name = "aspeed.smc", 905 .version_id = 2, 906 .minimum_version_id = 2, 907 .fields = (VMStateField[]) { 908 VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX), 909 VMSTATE_UINT8(snoop_index, AspeedSMCState), 910 VMSTATE_UINT8(snoop_dummies, AspeedSMCState), 911 VMSTATE_END_OF_LIST() 912 } 913 }; 914 915 static Property aspeed_smc_properties[] = { 916 DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1), 917 DEFINE_PROP_UINT64("sdram-base", AspeedSMCState, sdram_base, 0), 918 DEFINE_PROP_END_OF_LIST(), 919 }; 920 921 static void aspeed_smc_class_init(ObjectClass *klass, void *data) 922 { 923 DeviceClass *dc = DEVICE_CLASS(klass); 924 AspeedSMCClass *mc = ASPEED_SMC_CLASS(klass); 925 926 dc->realize = aspeed_smc_realize; 927 dc->reset = aspeed_smc_reset; 928 dc->props = aspeed_smc_properties; 929 dc->vmsd = &vmstate_aspeed_smc; 930 mc->ctrl = data; 931 } 932 933 static const TypeInfo aspeed_smc_info = { 934 .name = TYPE_ASPEED_SMC, 935 .parent = TYPE_SYS_BUS_DEVICE, 936 .instance_size = sizeof(AspeedSMCState), 937 .class_size = sizeof(AspeedSMCClass), 938 .abstract = true, 939 }; 940 941 static void aspeed_smc_register_types(void) 942 { 943 int i; 944 945 type_register_static(&aspeed_smc_info); 946 for (i = 0; i < ARRAY_SIZE(controllers); ++i) { 947 TypeInfo ti = { 948 .name = controllers[i].name, 949 .parent = TYPE_ASPEED_SMC, 950 .class_init = aspeed_smc_class_init, 951 .class_data = (void *)&controllers[i], 952 }; 953 type_register(&ti); 954 } 955 } 956 957 type_init(aspeed_smc_register_types) 958