xref: /qemu/hw/ssi/xilinx_spips.c (revision bdf9613b)
1 /*
2  * QEMU model of the Xilinx Zynq SPI controller
3  *
4  * Copyright (c) 2012 Peter A. G. Crosthwaite
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "hw/sysbus.h"
27 #include "sysemu/sysemu.h"
28 #include "hw/ptimer.h"
29 #include "qemu/log.h"
30 #include "qemu/module.h"
31 #include "qemu/bitops.h"
32 #include "hw/ssi/xilinx_spips.h"
33 #include "qapi/error.h"
34 #include "hw/register.h"
35 #include "sysemu/dma.h"
36 #include "migration/blocker.h"
37 
38 #ifndef XILINX_SPIPS_ERR_DEBUG
39 #define XILINX_SPIPS_ERR_DEBUG 0
40 #endif
41 
42 #define DB_PRINT_L(level, ...) do { \
43     if (XILINX_SPIPS_ERR_DEBUG > (level)) { \
44         fprintf(stderr,  ": %s: ", __func__); \
45         fprintf(stderr, ## __VA_ARGS__); \
46     } \
47 } while (0)
48 
49 /* config register */
50 #define R_CONFIG            (0x00 / 4)
51 #define IFMODE              (1U << 31)
52 #define R_CONFIG_ENDIAN     (1 << 26)
53 #define MODEFAIL_GEN_EN     (1 << 17)
54 #define MAN_START_COM       (1 << 16)
55 #define MAN_START_EN        (1 << 15)
56 #define MANUAL_CS           (1 << 14)
57 #define CS                  (0xF << 10)
58 #define CS_SHIFT            (10)
59 #define PERI_SEL            (1 << 9)
60 #define REF_CLK             (1 << 8)
61 #define FIFO_WIDTH          (3 << 6)
62 #define BAUD_RATE_DIV       (7 << 3)
63 #define CLK_PH              (1 << 2)
64 #define CLK_POL             (1 << 1)
65 #define MODE_SEL            (1 << 0)
66 #define R_CONFIG_RSVD       (0x7bf40000)
67 
68 /* interrupt mechanism */
69 #define R_INTR_STATUS       (0x04 / 4)
70 #define R_INTR_STATUS_RESET (0x104)
71 #define R_INTR_EN           (0x08 / 4)
72 #define R_INTR_DIS          (0x0C / 4)
73 #define R_INTR_MASK         (0x10 / 4)
74 #define IXR_TX_FIFO_UNDERFLOW   (1 << 6)
75 /* Poll timeout not implemented */
76 #define IXR_RX_FIFO_EMPTY       (1 << 11)
77 #define IXR_GENERIC_FIFO_FULL   (1 << 10)
78 #define IXR_GENERIC_FIFO_NOT_FULL (1 << 9)
79 #define IXR_TX_FIFO_EMPTY       (1 << 8)
80 #define IXR_GENERIC_FIFO_EMPTY  (1 << 7)
81 #define IXR_RX_FIFO_FULL        (1 << 5)
82 #define IXR_RX_FIFO_NOT_EMPTY   (1 << 4)
83 #define IXR_TX_FIFO_FULL        (1 << 3)
84 #define IXR_TX_FIFO_NOT_FULL    (1 << 2)
85 #define IXR_TX_FIFO_MODE_FAIL   (1 << 1)
86 #define IXR_RX_FIFO_OVERFLOW    (1 << 0)
87 #define IXR_ALL                 ((1 << 13) - 1)
88 #define GQSPI_IXR_MASK          0xFBE
89 #define IXR_SELF_CLEAR \
90 (IXR_GENERIC_FIFO_EMPTY \
91 | IXR_GENERIC_FIFO_FULL  \
92 | IXR_GENERIC_FIFO_NOT_FULL \
93 | IXR_TX_FIFO_EMPTY \
94 | IXR_TX_FIFO_FULL  \
95 | IXR_TX_FIFO_NOT_FULL \
96 | IXR_RX_FIFO_EMPTY \
97 | IXR_RX_FIFO_FULL  \
98 | IXR_RX_FIFO_NOT_EMPTY)
99 
100 #define R_EN                (0x14 / 4)
101 #define R_DELAY             (0x18 / 4)
102 #define R_TX_DATA           (0x1C / 4)
103 #define R_RX_DATA           (0x20 / 4)
104 #define R_SLAVE_IDLE_COUNT  (0x24 / 4)
105 #define R_TX_THRES          (0x28 / 4)
106 #define R_RX_THRES          (0x2C / 4)
107 #define R_GPIO              (0x30 / 4)
108 #define R_LPBK_DLY_ADJ      (0x38 / 4)
109 #define R_LPBK_DLY_ADJ_RESET (0x33)
110 #define R_TXD1              (0x80 / 4)
111 #define R_TXD2              (0x84 / 4)
112 #define R_TXD3              (0x88 / 4)
113 
114 #define R_LQSPI_CFG         (0xa0 / 4)
115 #define R_LQSPI_CFG_RESET       0x03A002EB
116 #define LQSPI_CFG_LQ_MODE       (1U << 31)
117 #define LQSPI_CFG_TWO_MEM       (1 << 30)
118 #define LQSPI_CFG_SEP_BUS       (1 << 29)
119 #define LQSPI_CFG_U_PAGE        (1 << 28)
120 #define LQSPI_CFG_ADDR4         (1 << 27)
121 #define LQSPI_CFG_MODE_EN       (1 << 25)
122 #define LQSPI_CFG_MODE_WIDTH    8
123 #define LQSPI_CFG_MODE_SHIFT    16
124 #define LQSPI_CFG_DUMMY_WIDTH   3
125 #define LQSPI_CFG_DUMMY_SHIFT   8
126 #define LQSPI_CFG_INST_CODE     0xFF
127 
128 #define R_CMND        (0xc0 / 4)
129     #define R_CMND_RXFIFO_DRAIN   (1 << 19)
130     FIELD(CMND, PARTIAL_BYTE_LEN, 16, 3)
131 #define R_CMND_EXT_ADD        (1 << 15)
132     FIELD(CMND, RX_DISCARD, 8, 7)
133     FIELD(CMND, DUMMY_CYCLES, 2, 6)
134 #define R_CMND_DMA_EN         (1 << 1)
135 #define R_CMND_PUSH_WAIT      (1 << 0)
136 #define R_TRANSFER_SIZE     (0xc4 / 4)
137 #define R_LQSPI_STS         (0xA4 / 4)
138 #define LQSPI_STS_WR_RECVD      (1 << 1)
139 
140 #define R_MOD_ID            (0xFC / 4)
141 
142 #define R_GQSPI_SELECT          (0x144 / 4)
143     FIELD(GQSPI_SELECT, GENERIC_QSPI_EN, 0, 1)
144 #define R_GQSPI_ISR         (0x104 / 4)
145 #define R_GQSPI_IER         (0x108 / 4)
146 #define R_GQSPI_IDR         (0x10c / 4)
147 #define R_GQSPI_IMR         (0x110 / 4)
148 #define R_GQSPI_IMR_RESET   (0xfbe)
149 #define R_GQSPI_TX_THRESH   (0x128 / 4)
150 #define R_GQSPI_RX_THRESH   (0x12c / 4)
151 #define R_GQSPI_GPIO (0x130 / 4)
152 #define R_GQSPI_LPBK_DLY_ADJ (0x138 / 4)
153 #define R_GQSPI_LPBK_DLY_ADJ_RESET (0x33)
154 #define R_GQSPI_CNFG        (0x100 / 4)
155     FIELD(GQSPI_CNFG, MODE_EN, 30, 2)
156     FIELD(GQSPI_CNFG, GEN_FIFO_START_MODE, 29, 1)
157     FIELD(GQSPI_CNFG, GEN_FIFO_START, 28, 1)
158     FIELD(GQSPI_CNFG, ENDIAN, 26, 1)
159     /* Poll timeout not implemented */
160     FIELD(GQSPI_CNFG, EN_POLL_TIMEOUT, 20, 1)
161     /* QEMU doesnt care about any of these last three */
162     FIELD(GQSPI_CNFG, BR, 3, 3)
163     FIELD(GQSPI_CNFG, CPH, 2, 1)
164     FIELD(GQSPI_CNFG, CPL, 1, 1)
165 #define R_GQSPI_GEN_FIFO        (0x140 / 4)
166 #define R_GQSPI_TXD             (0x11c / 4)
167 #define R_GQSPI_RXD             (0x120 / 4)
168 #define R_GQSPI_FIFO_CTRL       (0x14c / 4)
169     FIELD(GQSPI_FIFO_CTRL, RX_FIFO_RESET, 2, 1)
170     FIELD(GQSPI_FIFO_CTRL, TX_FIFO_RESET, 1, 1)
171     FIELD(GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET, 0, 1)
172 #define R_GQSPI_GFIFO_THRESH    (0x150 / 4)
173 #define R_GQSPI_DATA_STS (0x15c / 4)
174 /* We use the snapshot register to hold the core state for the currently
175  * or most recently executed command. So the generic fifo format is defined
176  * for the snapshot register
177  */
178 #define R_GQSPI_GF_SNAPSHOT (0x160 / 4)
179     FIELD(GQSPI_GF_SNAPSHOT, POLL, 19, 1)
180     FIELD(GQSPI_GF_SNAPSHOT, STRIPE, 18, 1)
181     FIELD(GQSPI_GF_SNAPSHOT, RECIEVE, 17, 1)
182     FIELD(GQSPI_GF_SNAPSHOT, TRANSMIT, 16, 1)
183     FIELD(GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT, 14, 2)
184     FIELD(GQSPI_GF_SNAPSHOT, CHIP_SELECT, 12, 2)
185     FIELD(GQSPI_GF_SNAPSHOT, SPI_MODE, 10, 2)
186     FIELD(GQSPI_GF_SNAPSHOT, EXPONENT, 9, 1)
187     FIELD(GQSPI_GF_SNAPSHOT, DATA_XFER, 8, 1)
188     FIELD(GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA, 0, 8)
189 #define R_GQSPI_MOD_ID        (0x1fc / 4)
190 #define R_GQSPI_MOD_ID_RESET  (0x10a0000)
191 
192 #define R_QSPIDMA_DST_CTRL         (0x80c / 4)
193 #define R_QSPIDMA_DST_CTRL_RESET   (0x803ffa00)
194 #define R_QSPIDMA_DST_I_MASK       (0x820 / 4)
195 #define R_QSPIDMA_DST_I_MASK_RESET (0xfe)
196 #define R_QSPIDMA_DST_CTRL2        (0x824 / 4)
197 #define R_QSPIDMA_DST_CTRL2_RESET  (0x081bfff8)
198 
199 /* size of TXRX FIFOs */
200 #define RXFF_A          (128)
201 #define TXFF_A          (128)
202 
203 #define RXFF_A_Q          (64 * 4)
204 #define TXFF_A_Q          (64 * 4)
205 
206 /* 16MB per linear region */
207 #define LQSPI_ADDRESS_BITS 24
208 
209 #define SNOOP_CHECKING 0xFF
210 #define SNOOP_ADDR 0xF0
211 #define SNOOP_NONE 0xEE
212 #define SNOOP_STRIPING 0
213 
214 #define MIN_NUM_BUSSES 1
215 #define MAX_NUM_BUSSES 2
216 
217 static inline int num_effective_busses(XilinxSPIPS *s)
218 {
219     return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
220             s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM) ? s->num_busses : 1;
221 }
222 
223 static void xilinx_spips_update_cs(XilinxSPIPS *s, int field)
224 {
225     int i;
226 
227     for (i = 0; i < s->num_cs * s->num_busses; i++) {
228         bool old_state = s->cs_lines_state[i];
229         bool new_state = field & (1 << i);
230 
231         if (old_state != new_state) {
232             s->cs_lines_state[i] = new_state;
233             s->rx_discard = ARRAY_FIELD_EX32(s->regs, CMND, RX_DISCARD);
234             DB_PRINT_L(1, "%sselecting slave %d\n", new_state ? "" : "de", i);
235         }
236         qemu_set_irq(s->cs_lines[i], !new_state);
237     }
238     if (!(field & ((1 << (s->num_cs * s->num_busses)) - 1))) {
239         s->snoop_state = SNOOP_CHECKING;
240         s->cmd_dummies = 0;
241         s->link_state = 1;
242         s->link_state_next = 1;
243         s->link_state_next_when = 0;
244         DB_PRINT_L(1, "moving to snoop check state\n");
245     }
246 }
247 
248 static void xlnx_zynqmp_qspips_update_cs_lines(XlnxZynqMPQSPIPS *s)
249 {
250     if (s->regs[R_GQSPI_GF_SNAPSHOT]) {
251         int field = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, CHIP_SELECT);
252         bool upper_cs_sel = field & (1 << 1);
253         bool lower_cs_sel = field & 1;
254         bool bus0_enabled;
255         bool bus1_enabled;
256         uint8_t buses;
257         int cs = 0;
258 
259         buses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
260         bus0_enabled = buses & 1;
261         bus1_enabled = buses & (1 << 1);
262 
263         if (bus0_enabled && bus1_enabled) {
264             if (lower_cs_sel) {
265                 cs |= 1;
266             }
267             if (upper_cs_sel) {
268                 cs |= 1 << 3;
269             }
270         } else if (bus0_enabled) {
271             if (lower_cs_sel) {
272                 cs |= 1;
273             }
274             if (upper_cs_sel) {
275                 cs |= 1 << 1;
276             }
277         } else if (bus1_enabled) {
278             if (lower_cs_sel) {
279                 cs |= 1 << 2;
280             }
281             if (upper_cs_sel) {
282                 cs |= 1 << 3;
283             }
284         }
285         xilinx_spips_update_cs(XILINX_SPIPS(s), cs);
286     }
287 }
288 
289 static void xilinx_spips_update_cs_lines(XilinxSPIPS *s)
290 {
291     int field = ~((s->regs[R_CONFIG] & CS) >> CS_SHIFT);
292 
293     /* In dual parallel, mirror low CS to both */
294     if (num_effective_busses(s) == 2) {
295         /* Single bit chip-select for qspi */
296         field &= 0x1;
297         field |= field << 3;
298     /* Dual stack U-Page */
299     } else if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM &&
300                s->regs[R_LQSPI_STS] & LQSPI_CFG_U_PAGE) {
301         /* Single bit chip-select for qspi */
302         field &= 0x1;
303         /* change from CS0 to CS1 */
304         field <<= 1;
305     }
306     /* Auto CS */
307     if (!(s->regs[R_CONFIG] & MANUAL_CS) &&
308         fifo8_is_empty(&s->tx_fifo)) {
309         field = 0;
310     }
311     xilinx_spips_update_cs(s, field);
312 }
313 
314 static void xilinx_spips_update_ixr(XilinxSPIPS *s)
315 {
316     if (!(s->regs[R_LQSPI_CFG] & LQSPI_CFG_LQ_MODE)) {
317         s->regs[R_INTR_STATUS] &= ~IXR_SELF_CLEAR;
318         s->regs[R_INTR_STATUS] |=
319             (fifo8_is_full(&s->rx_fifo) ? IXR_RX_FIFO_FULL : 0) |
320             (s->rx_fifo.num >= s->regs[R_RX_THRES] ?
321                                     IXR_RX_FIFO_NOT_EMPTY : 0) |
322             (fifo8_is_full(&s->tx_fifo) ? IXR_TX_FIFO_FULL : 0) |
323             (fifo8_is_empty(&s->tx_fifo) ? IXR_TX_FIFO_EMPTY : 0) |
324             (s->tx_fifo.num < s->regs[R_TX_THRES] ? IXR_TX_FIFO_NOT_FULL : 0);
325     }
326     int new_irqline = !!(s->regs[R_INTR_MASK] & s->regs[R_INTR_STATUS] &
327                                                                 IXR_ALL);
328     if (new_irqline != s->irqline) {
329         s->irqline = new_irqline;
330         qemu_set_irq(s->irq, s->irqline);
331     }
332 }
333 
334 static void xlnx_zynqmp_qspips_update_ixr(XlnxZynqMPQSPIPS *s)
335 {
336     uint32_t gqspi_int;
337     int new_irqline;
338 
339     s->regs[R_GQSPI_ISR] &= ~IXR_SELF_CLEAR;
340     s->regs[R_GQSPI_ISR] |=
341         (fifo32_is_empty(&s->fifo_g) ? IXR_GENERIC_FIFO_EMPTY : 0) |
342         (fifo32_is_full(&s->fifo_g) ? IXR_GENERIC_FIFO_FULL : 0) |
343         (s->fifo_g.fifo.num < s->regs[R_GQSPI_GFIFO_THRESH] ?
344                                     IXR_GENERIC_FIFO_NOT_FULL : 0) |
345         (fifo8_is_empty(&s->rx_fifo_g) ? IXR_RX_FIFO_EMPTY : 0) |
346         (fifo8_is_full(&s->rx_fifo_g) ? IXR_RX_FIFO_FULL : 0) |
347         (s->rx_fifo_g.num >= s->regs[R_GQSPI_RX_THRESH] ?
348                                     IXR_RX_FIFO_NOT_EMPTY : 0) |
349         (fifo8_is_empty(&s->tx_fifo_g) ? IXR_TX_FIFO_EMPTY : 0) |
350         (fifo8_is_full(&s->tx_fifo_g) ? IXR_TX_FIFO_FULL : 0) |
351         (s->tx_fifo_g.num < s->regs[R_GQSPI_TX_THRESH] ?
352                                     IXR_TX_FIFO_NOT_FULL : 0);
353 
354     /* GQSPI Interrupt Trigger Status */
355     gqspi_int = (~s->regs[R_GQSPI_IMR]) & s->regs[R_GQSPI_ISR] & GQSPI_IXR_MASK;
356     new_irqline = !!(gqspi_int & IXR_ALL);
357 
358     /* drive external interrupt pin */
359     if (new_irqline != s->gqspi_irqline) {
360         s->gqspi_irqline = new_irqline;
361         qemu_set_irq(XILINX_SPIPS(s)->irq, s->gqspi_irqline);
362     }
363 }
364 
365 static void xilinx_spips_reset(DeviceState *d)
366 {
367     XilinxSPIPS *s = XILINX_SPIPS(d);
368 
369     memset(s->regs, 0, sizeof(s->regs));
370 
371     fifo8_reset(&s->rx_fifo);
372     fifo8_reset(&s->rx_fifo);
373     /* non zero resets */
374     s->regs[R_CONFIG] |= MODEFAIL_GEN_EN;
375     s->regs[R_SLAVE_IDLE_COUNT] = 0xFF;
376     s->regs[R_TX_THRES] = 1;
377     s->regs[R_RX_THRES] = 1;
378     /* FIXME: move magic number definition somewhere sensible */
379     s->regs[R_MOD_ID] = 0x01090106;
380     s->regs[R_LQSPI_CFG] = R_LQSPI_CFG_RESET;
381     s->link_state = 1;
382     s->link_state_next = 1;
383     s->link_state_next_when = 0;
384     s->snoop_state = SNOOP_CHECKING;
385     s->cmd_dummies = 0;
386     s->man_start_com = false;
387     xilinx_spips_update_ixr(s);
388     xilinx_spips_update_cs_lines(s);
389 }
390 
391 static void xlnx_zynqmp_qspips_reset(DeviceState *d)
392 {
393     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(d);
394 
395     xilinx_spips_reset(d);
396 
397     memset(s->regs, 0, sizeof(s->regs));
398 
399     fifo8_reset(&s->rx_fifo_g);
400     fifo8_reset(&s->rx_fifo_g);
401     fifo32_reset(&s->fifo_g);
402     s->regs[R_INTR_STATUS] = R_INTR_STATUS_RESET;
403     s->regs[R_GPIO] = 1;
404     s->regs[R_LPBK_DLY_ADJ] = R_LPBK_DLY_ADJ_RESET;
405     s->regs[R_GQSPI_GFIFO_THRESH] = 0x10;
406     s->regs[R_MOD_ID] = 0x01090101;
407     s->regs[R_GQSPI_IMR] = R_GQSPI_IMR_RESET;
408     s->regs[R_GQSPI_TX_THRESH] = 1;
409     s->regs[R_GQSPI_RX_THRESH] = 1;
410     s->regs[R_GQSPI_GPIO] = 1;
411     s->regs[R_GQSPI_LPBK_DLY_ADJ] = R_GQSPI_LPBK_DLY_ADJ_RESET;
412     s->regs[R_GQSPI_MOD_ID] = R_GQSPI_MOD_ID_RESET;
413     s->regs[R_QSPIDMA_DST_CTRL] = R_QSPIDMA_DST_CTRL_RESET;
414     s->regs[R_QSPIDMA_DST_I_MASK] = R_QSPIDMA_DST_I_MASK_RESET;
415     s->regs[R_QSPIDMA_DST_CTRL2] = R_QSPIDMA_DST_CTRL2_RESET;
416     s->man_start_com_g = false;
417     s->gqspi_irqline = 0;
418     xlnx_zynqmp_qspips_update_ixr(s);
419 }
420 
421 /* N way (num) in place bit striper. Lay out row wise bits (MSB to LSB)
422  * column wise (from element 0 to N-1). num is the length of x, and dir
423  * reverses the direction of the transform. Best illustrated by example:
424  * Each digit in the below array is a single bit (num == 3):
425  *
426  * {{ 76543210, }  ----- stripe (dir == false) -----> {{ 741gdaFC, }
427  *  { hgfedcba, }                                      { 630fcHEB, }
428  *  { HGFEDCBA, }} <---- upstripe (dir == true) -----  { 52hebGDA, }}
429  */
430 
431 static inline void stripe8(uint8_t *x, int num, bool dir)
432 {
433     uint8_t r[MAX_NUM_BUSSES];
434     int idx[2] = {0, 0};
435     int bit[2] = {0, 7};
436     int d = dir;
437 
438     assert(num <= MAX_NUM_BUSSES);
439     memset(r, 0, sizeof(uint8_t) * num);
440 
441     for (idx[0] = 0; idx[0] < num; ++idx[0]) {
442         for (bit[0] = 7; bit[0] >= 0; bit[0]--) {
443             r[idx[!d]] |= x[idx[d]] & 1 << bit[d] ? 1 << bit[!d] : 0;
444             idx[1] = (idx[1] + 1) % num;
445             if (!idx[1]) {
446                 bit[1]--;
447             }
448         }
449     }
450     memcpy(x, r, sizeof(uint8_t) * num);
451 }
452 
453 static void xlnx_zynqmp_qspips_flush_fifo_g(XlnxZynqMPQSPIPS *s)
454 {
455     while (s->regs[R_GQSPI_DATA_STS] || !fifo32_is_empty(&s->fifo_g)) {
456         uint8_t tx_rx[2] = { 0 };
457         int num_stripes = 1;
458         uint8_t busses;
459         int i;
460 
461         if (!s->regs[R_GQSPI_DATA_STS]) {
462             uint8_t imm;
463 
464             s->regs[R_GQSPI_GF_SNAPSHOT] = fifo32_pop(&s->fifo_g);
465             DB_PRINT_L(0, "GQSPI command: %x\n", s->regs[R_GQSPI_GF_SNAPSHOT]);
466             if (!s->regs[R_GQSPI_GF_SNAPSHOT]) {
467                 DB_PRINT_L(0, "Dummy GQSPI Delay Command Entry, Do nothing");
468                 continue;
469             }
470             xlnx_zynqmp_qspips_update_cs_lines(s);
471 
472             imm = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
473             if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
474                 /* immedate transfer */
475                 if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
476                     ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
477                     s->regs[R_GQSPI_DATA_STS] = 1;
478                 /* CS setup/hold - do nothing */
479                 } else {
480                     s->regs[R_GQSPI_DATA_STS] = 0;
481                 }
482             } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, EXPONENT)) {
483                 if (imm > 31) {
484                     qemu_log_mask(LOG_UNIMP, "QSPI exponential transfer too"
485                                   " long - 2 ^ %" PRId8 " requested\n", imm);
486                 }
487                 s->regs[R_GQSPI_DATA_STS] = 1ul << imm;
488             } else {
489                 s->regs[R_GQSPI_DATA_STS] = imm;
490             }
491         }
492         /* Zero length transfer check */
493         if (!s->regs[R_GQSPI_DATA_STS]) {
494             continue;
495         }
496         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE) &&
497             fifo8_is_full(&s->rx_fifo_g)) {
498             /* No space in RX fifo for transfer - try again later */
499             return;
500         }
501         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, STRIPE) &&
502             (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
503              ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE))) {
504             num_stripes = 2;
505         }
506         if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
507             tx_rx[0] = ARRAY_FIELD_EX32(s->regs,
508                                         GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
509         } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT)) {
510             for (i = 0; i < num_stripes; ++i) {
511                 if (!fifo8_is_empty(&s->tx_fifo_g)) {
512                     tx_rx[i] = fifo8_pop(&s->tx_fifo_g);
513                     s->tx_fifo_g_align++;
514                 } else {
515                     return;
516                 }
517             }
518         }
519         if (num_stripes == 1) {
520             /* mirror */
521             tx_rx[1] = tx_rx[0];
522         }
523         busses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
524         for (i = 0; i < 2; ++i) {
525             DB_PRINT_L(1, "bus %d tx = %02x\n", i, tx_rx[i]);
526             tx_rx[i] = ssi_transfer(XILINX_SPIPS(s)->spi[i], tx_rx[i]);
527             DB_PRINT_L(1, "bus %d rx = %02x\n", i, tx_rx[i]);
528         }
529         if (s->regs[R_GQSPI_DATA_STS] > 1 &&
530             busses == 0x3 && num_stripes == 2) {
531             s->regs[R_GQSPI_DATA_STS] -= 2;
532         } else if (s->regs[R_GQSPI_DATA_STS] > 0) {
533             s->regs[R_GQSPI_DATA_STS]--;
534         }
535         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
536             for (i = 0; i < 2; ++i) {
537                 if (busses & (1 << i)) {
538                     DB_PRINT_L(1, "bus %d push_byte = %02x\n", i, tx_rx[i]);
539                     fifo8_push(&s->rx_fifo_g, tx_rx[i]);
540                     s->rx_fifo_g_align++;
541                 }
542             }
543         }
544         if (!s->regs[R_GQSPI_DATA_STS]) {
545             for (; s->tx_fifo_g_align % 4; s->tx_fifo_g_align++) {
546                 fifo8_pop(&s->tx_fifo_g);
547             }
548             for (; s->rx_fifo_g_align % 4; s->rx_fifo_g_align++) {
549                 fifo8_push(&s->rx_fifo_g, 0);
550             }
551         }
552     }
553 }
554 
555 static int xilinx_spips_num_dummies(XilinxQSPIPS *qs, uint8_t command)
556 {
557     if (!qs) {
558         /* The SPI device is not a QSPI device */
559         return -1;
560     }
561 
562     switch (command) { /* check for dummies */
563     case READ: /* no dummy bytes/cycles */
564     case PP:
565     case DPP:
566     case QPP:
567     case READ_4:
568     case PP_4:
569     case QPP_4:
570         return 0;
571     case FAST_READ:
572     case DOR:
573     case QOR:
574     case DOR_4:
575     case QOR_4:
576         return 1;
577     case DIOR:
578     case FAST_READ_4:
579     case DIOR_4:
580         return 2;
581     case QIOR:
582     case QIOR_4:
583         return 4;
584     default:
585         return -1;
586     }
587 }
588 
589 static inline uint8_t get_addr_length(XilinxSPIPS *s, uint8_t cmd)
590 {
591    switch (cmd) {
592    case PP_4:
593    case QPP_4:
594    case READ_4:
595    case QIOR_4:
596    case FAST_READ_4:
597    case DOR_4:
598    case QOR_4:
599    case DIOR_4:
600        return 4;
601    default:
602        return (s->regs[R_CMND] & R_CMND_EXT_ADD) ? 4 : 3;
603    }
604 }
605 
606 static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
607 {
608     int debug_level = 0;
609     XilinxQSPIPS *q = (XilinxQSPIPS *) object_dynamic_cast(OBJECT(s),
610                                                            TYPE_XILINX_QSPIPS);
611 
612     for (;;) {
613         int i;
614         uint8_t tx = 0;
615         uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
616         uint8_t dummy_cycles = 0;
617         uint8_t addr_length;
618 
619         if (fifo8_is_empty(&s->tx_fifo)) {
620             xilinx_spips_update_ixr(s);
621             return;
622         } else if (s->snoop_state == SNOOP_STRIPING ||
623                    s->snoop_state == SNOOP_NONE) {
624             for (i = 0; i < num_effective_busses(s); ++i) {
625                 tx_rx[i] = fifo8_pop(&s->tx_fifo);
626             }
627             stripe8(tx_rx, num_effective_busses(s), false);
628         } else if (s->snoop_state >= SNOOP_ADDR) {
629             tx = fifo8_pop(&s->tx_fifo);
630             for (i = 0; i < num_effective_busses(s); ++i) {
631                 tx_rx[i] = tx;
632             }
633         } else {
634             /* Extract a dummy byte and generate dummy cycles according to the
635              * link state */
636             tx = fifo8_pop(&s->tx_fifo);
637             dummy_cycles = 8 / s->link_state;
638         }
639 
640         for (i = 0; i < num_effective_busses(s); ++i) {
641             int bus = num_effective_busses(s) - 1 - i;
642             if (dummy_cycles) {
643                 int d;
644                 for (d = 0; d < dummy_cycles; ++d) {
645                     tx_rx[0] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[0]);
646                 }
647             } else {
648                 DB_PRINT_L(debug_level, "tx = %02x\n", tx_rx[i]);
649                 tx_rx[i] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[i]);
650                 DB_PRINT_L(debug_level, "rx = %02x\n", tx_rx[i]);
651             }
652         }
653 
654         if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
655             DB_PRINT_L(debug_level, "dircarding drained rx byte\n");
656             /* Do nothing */
657         } else if (s->rx_discard) {
658             DB_PRINT_L(debug_level, "dircarding discarded rx byte\n");
659             s->rx_discard -= 8 / s->link_state;
660         } else if (fifo8_is_full(&s->rx_fifo)) {
661             s->regs[R_INTR_STATUS] |= IXR_RX_FIFO_OVERFLOW;
662             DB_PRINT_L(0, "rx FIFO overflow");
663         } else if (s->snoop_state == SNOOP_STRIPING) {
664             stripe8(tx_rx, num_effective_busses(s), true);
665             for (i = 0; i < num_effective_busses(s); ++i) {
666                 fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[i]);
667                 DB_PRINT_L(debug_level, "pushing striped rx byte\n");
668             }
669         } else {
670            DB_PRINT_L(debug_level, "pushing unstriped rx byte\n");
671            fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[0]);
672         }
673 
674         if (s->link_state_next_when) {
675             s->link_state_next_when--;
676             if (!s->link_state_next_when) {
677                 s->link_state = s->link_state_next;
678             }
679         }
680 
681         DB_PRINT_L(debug_level, "initial snoop state: %x\n",
682                    (unsigned)s->snoop_state);
683         switch (s->snoop_state) {
684         case (SNOOP_CHECKING):
685             /* Store the count of dummy bytes in the txfifo */
686             s->cmd_dummies = xilinx_spips_num_dummies(q, tx);
687             addr_length = get_addr_length(s, tx);
688             if (s->cmd_dummies < 0) {
689                 s->snoop_state = SNOOP_NONE;
690             } else {
691                 s->snoop_state = SNOOP_ADDR + addr_length - 1;
692             }
693             switch (tx) {
694             case DPP:
695             case DOR:
696             case DOR_4:
697                 s->link_state_next = 2;
698                 s->link_state_next_when = addr_length + s->cmd_dummies;
699                 break;
700             case QPP:
701             case QPP_4:
702             case QOR:
703             case QOR_4:
704                 s->link_state_next = 4;
705                 s->link_state_next_when = addr_length + s->cmd_dummies;
706                 break;
707             case DIOR:
708             case DIOR_4:
709                 s->link_state = 2;
710                 break;
711             case QIOR:
712             case QIOR_4:
713                 s->link_state = 4;
714                 break;
715             }
716             break;
717         case (SNOOP_ADDR):
718             /* Address has been transmitted, transmit dummy cycles now if
719              * needed */
720             if (s->cmd_dummies < 0) {
721                 s->snoop_state = SNOOP_NONE;
722             } else {
723                 s->snoop_state = s->cmd_dummies;
724             }
725             break;
726         case (SNOOP_STRIPING):
727         case (SNOOP_NONE):
728             /* Once we hit the boring stuff - squelch debug noise */
729             if (!debug_level) {
730                 DB_PRINT_L(0, "squelching debug info ....\n");
731                 debug_level = 1;
732             }
733             break;
734         default:
735             s->snoop_state--;
736         }
737         DB_PRINT_L(debug_level, "final snoop state: %x\n",
738                    (unsigned)s->snoop_state);
739     }
740 }
741 
742 static inline void tx_data_bytes(Fifo8 *fifo, uint32_t value, int num, bool be)
743 {
744     int i;
745     for (i = 0; i < num && !fifo8_is_full(fifo); ++i) {
746         if (be) {
747             fifo8_push(fifo, (uint8_t)(value >> 24));
748             value <<= 8;
749         } else {
750             fifo8_push(fifo, (uint8_t)value);
751             value >>= 8;
752         }
753     }
754 }
755 
756 static void xilinx_spips_check_zero_pump(XilinxSPIPS *s)
757 {
758     if (!s->regs[R_TRANSFER_SIZE]) {
759         return;
760     }
761     if (!fifo8_is_empty(&s->tx_fifo) && s->regs[R_CMND] & R_CMND_PUSH_WAIT) {
762         return;
763     }
764     /*
765      * The zero pump must never fill tx fifo such that rx overflow is
766      * possible
767      */
768     while (s->regs[R_TRANSFER_SIZE] &&
769            s->rx_fifo.num + s->tx_fifo.num < RXFF_A_Q - 3) {
770         /* endianess just doesn't matter when zero pumping */
771         tx_data_bytes(&s->tx_fifo, 0, 4, false);
772         s->regs[R_TRANSFER_SIZE] &= ~0x03ull;
773         s->regs[R_TRANSFER_SIZE] -= 4;
774     }
775 }
776 
777 static void xilinx_spips_check_flush(XilinxSPIPS *s)
778 {
779     if (s->man_start_com ||
780         (!fifo8_is_empty(&s->tx_fifo) &&
781          !(s->regs[R_CONFIG] & MAN_START_EN))) {
782         xilinx_spips_check_zero_pump(s);
783         xilinx_spips_flush_txfifo(s);
784     }
785     if (fifo8_is_empty(&s->tx_fifo) && !s->regs[R_TRANSFER_SIZE]) {
786         s->man_start_com = false;
787     }
788     xilinx_spips_update_ixr(s);
789 }
790 
791 static void xlnx_zynqmp_qspips_check_flush(XlnxZynqMPQSPIPS *s)
792 {
793     bool gqspi_has_work = s->regs[R_GQSPI_DATA_STS] ||
794                           !fifo32_is_empty(&s->fifo_g);
795 
796     if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
797         if (s->man_start_com_g || (gqspi_has_work &&
798              !ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE))) {
799             xlnx_zynqmp_qspips_flush_fifo_g(s);
800         }
801     } else {
802         xilinx_spips_check_flush(XILINX_SPIPS(s));
803     }
804     if (!gqspi_has_work) {
805         s->man_start_com_g = false;
806     }
807     xlnx_zynqmp_qspips_update_ixr(s);
808 }
809 
810 static inline int rx_data_bytes(Fifo8 *fifo, uint8_t *value, int max)
811 {
812     int i;
813 
814     for (i = 0; i < max && !fifo8_is_empty(fifo); ++i) {
815         value[i] = fifo8_pop(fifo);
816     }
817     return max - i;
818 }
819 
820 static const void *pop_buf(Fifo8 *fifo, uint32_t max, uint32_t *num)
821 {
822     void *ret;
823 
824     if (max == 0 || max > fifo->num) {
825         abort();
826     }
827     *num = MIN(fifo->capacity - fifo->head, max);
828     ret = &fifo->data[fifo->head];
829     fifo->head += *num;
830     fifo->head %= fifo->capacity;
831     fifo->num -= *num;
832     return ret;
833 }
834 
835 static void xlnx_zynqmp_qspips_notify(void *opaque)
836 {
837     XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(opaque);
838     XilinxSPIPS *s = XILINX_SPIPS(rq);
839     Fifo8 *recv_fifo;
840 
841     if (ARRAY_FIELD_EX32(rq->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
842         if (!(ARRAY_FIELD_EX32(rq->regs, GQSPI_CNFG, MODE_EN) == 2)) {
843             return;
844         }
845         recv_fifo = &rq->rx_fifo_g;
846     } else {
847         if (!(s->regs[R_CMND] & R_CMND_DMA_EN)) {
848             return;
849         }
850         recv_fifo = &s->rx_fifo;
851     }
852     while (recv_fifo->num >= 4
853            && stream_can_push(rq->dma, xlnx_zynqmp_qspips_notify, rq))
854     {
855         size_t ret;
856         uint32_t num;
857         const void *rxd;
858         int len;
859 
860         len = recv_fifo->num >= rq->dma_burst_size ? rq->dma_burst_size :
861                                                    recv_fifo->num;
862         rxd = pop_buf(recv_fifo, len, &num);
863 
864         memcpy(rq->dma_buf, rxd, num);
865 
866         ret = stream_push(rq->dma, rq->dma_buf, num);
867         assert(ret == num);
868         xlnx_zynqmp_qspips_check_flush(rq);
869     }
870 }
871 
872 static uint64_t xilinx_spips_read(void *opaque, hwaddr addr,
873                                                         unsigned size)
874 {
875     XilinxSPIPS *s = opaque;
876     uint32_t mask = ~0;
877     uint32_t ret;
878     uint8_t rx_buf[4];
879     int shortfall;
880 
881     addr >>= 2;
882     switch (addr) {
883     case R_CONFIG:
884         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
885         break;
886     case R_INTR_STATUS:
887         ret = s->regs[addr] & IXR_ALL;
888         s->regs[addr] = 0;
889         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
890         xilinx_spips_update_ixr(s);
891         return ret;
892     case R_INTR_MASK:
893         mask = IXR_ALL;
894         break;
895     case  R_EN:
896         mask = 0x1;
897         break;
898     case R_SLAVE_IDLE_COUNT:
899         mask = 0xFF;
900         break;
901     case R_MOD_ID:
902         mask = 0x01FFFFFF;
903         break;
904     case R_INTR_EN:
905     case R_INTR_DIS:
906     case R_TX_DATA:
907         mask = 0;
908         break;
909     case R_RX_DATA:
910         memset(rx_buf, 0, sizeof(rx_buf));
911         shortfall = rx_data_bytes(&s->rx_fifo, rx_buf, s->num_txrx_bytes);
912         ret = s->regs[R_CONFIG] & R_CONFIG_ENDIAN ?
913                         cpu_to_be32(*(uint32_t *)rx_buf) :
914                         cpu_to_le32(*(uint32_t *)rx_buf);
915         if (!(s->regs[R_CONFIG] & R_CONFIG_ENDIAN)) {
916             ret <<= 8 * shortfall;
917         }
918         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
919         xilinx_spips_check_flush(s);
920         xilinx_spips_update_ixr(s);
921         return ret;
922     }
923     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4,
924                s->regs[addr] & mask);
925     return s->regs[addr] & mask;
926 
927 }
928 
929 static uint64_t xlnx_zynqmp_qspips_read(void *opaque,
930                                         hwaddr addr, unsigned size)
931 {
932     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
933     uint32_t reg = addr / 4;
934     uint32_t ret;
935     uint8_t rx_buf[4];
936     int shortfall;
937 
938     if (reg <= R_MOD_ID) {
939         return xilinx_spips_read(opaque, addr, size);
940     } else {
941         switch (reg) {
942         case R_GQSPI_RXD:
943             if (fifo8_is_empty(&s->rx_fifo_g)) {
944                 qemu_log_mask(LOG_GUEST_ERROR,
945                               "Read from empty GQSPI RX FIFO\n");
946                 return 0;
947             }
948             memset(rx_buf, 0, sizeof(rx_buf));
949             shortfall = rx_data_bytes(&s->rx_fifo_g, rx_buf,
950                                       XILINX_SPIPS(s)->num_txrx_bytes);
951             ret = ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN) ?
952                   cpu_to_be32(*(uint32_t *)rx_buf) :
953                   cpu_to_le32(*(uint32_t *)rx_buf);
954             if (!ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN)) {
955                 ret <<= 8 * shortfall;
956             }
957             xlnx_zynqmp_qspips_check_flush(s);
958             xlnx_zynqmp_qspips_update_ixr(s);
959             return ret;
960         default:
961             return s->regs[reg];
962         }
963     }
964 }
965 
966 static void xilinx_spips_write(void *opaque, hwaddr addr,
967                                         uint64_t value, unsigned size)
968 {
969     int mask = ~0;
970     XilinxSPIPS *s = opaque;
971 
972     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr, (unsigned)value);
973     addr >>= 2;
974     switch (addr) {
975     case R_CONFIG:
976         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
977         if ((value & MAN_START_COM) && (s->regs[R_CONFIG] & MAN_START_EN)) {
978             s->man_start_com = true;
979         }
980         break;
981     case R_INTR_STATUS:
982         mask = IXR_ALL;
983         s->regs[R_INTR_STATUS] &= ~(mask & value);
984         goto no_reg_update;
985     case R_INTR_DIS:
986         mask = IXR_ALL;
987         s->regs[R_INTR_MASK] &= ~(mask & value);
988         goto no_reg_update;
989     case R_INTR_EN:
990         mask = IXR_ALL;
991         s->regs[R_INTR_MASK] |= mask & value;
992         goto no_reg_update;
993     case R_EN:
994         mask = 0x1;
995         break;
996     case R_SLAVE_IDLE_COUNT:
997         mask = 0xFF;
998         break;
999     case R_RX_DATA:
1000     case R_INTR_MASK:
1001     case R_MOD_ID:
1002         mask = 0;
1003         break;
1004     case R_TX_DATA:
1005         tx_data_bytes(&s->tx_fifo, (uint32_t)value, s->num_txrx_bytes,
1006                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1007         goto no_reg_update;
1008     case R_TXD1:
1009         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 1,
1010                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1011         goto no_reg_update;
1012     case R_TXD2:
1013         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 2,
1014                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1015         goto no_reg_update;
1016     case R_TXD3:
1017         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 3,
1018                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1019         goto no_reg_update;
1020     }
1021     s->regs[addr] = (s->regs[addr] & ~mask) | (value & mask);
1022 no_reg_update:
1023     xilinx_spips_update_cs_lines(s);
1024     xilinx_spips_check_flush(s);
1025     xilinx_spips_update_cs_lines(s);
1026     xilinx_spips_update_ixr(s);
1027 }
1028 
1029 static const MemoryRegionOps spips_ops = {
1030     .read = xilinx_spips_read,
1031     .write = xilinx_spips_write,
1032     .endianness = DEVICE_LITTLE_ENDIAN,
1033 };
1034 
1035 static void xilinx_qspips_invalidate_mmio_ptr(XilinxQSPIPS *q)
1036 {
1037     q->lqspi_cached_addr = ~0ULL;
1038 }
1039 
1040 static void xilinx_qspips_write(void *opaque, hwaddr addr,
1041                                 uint64_t value, unsigned size)
1042 {
1043     XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
1044     XilinxSPIPS *s = XILINX_SPIPS(opaque);
1045 
1046     xilinx_spips_write(opaque, addr, value, size);
1047     addr >>= 2;
1048 
1049     if (addr == R_LQSPI_CFG) {
1050         xilinx_qspips_invalidate_mmio_ptr(q);
1051     }
1052     if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
1053         fifo8_reset(&s->rx_fifo);
1054     }
1055 }
1056 
1057 static void xlnx_zynqmp_qspips_write(void *opaque, hwaddr addr,
1058                                         uint64_t value, unsigned size)
1059 {
1060     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
1061     uint32_t reg = addr / 4;
1062 
1063     if (reg <= R_MOD_ID) {
1064         xilinx_qspips_write(opaque, addr, value, size);
1065     } else {
1066         switch (reg) {
1067         case R_GQSPI_CNFG:
1068             if (FIELD_EX32(value, GQSPI_CNFG, GEN_FIFO_START) &&
1069                 ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE)) {
1070                 s->man_start_com_g = true;
1071             }
1072             s->regs[reg] = value & ~(R_GQSPI_CNFG_GEN_FIFO_START_MASK);
1073             break;
1074         case R_GQSPI_GEN_FIFO:
1075             if (!fifo32_is_full(&s->fifo_g)) {
1076                 fifo32_push(&s->fifo_g, value);
1077             }
1078             break;
1079         case R_GQSPI_TXD:
1080             tx_data_bytes(&s->tx_fifo_g, (uint32_t)value, 4,
1081                           ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN));
1082             break;
1083         case R_GQSPI_FIFO_CTRL:
1084             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET)) {
1085                 fifo32_reset(&s->fifo_g);
1086             }
1087             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, TX_FIFO_RESET)) {
1088                 fifo8_reset(&s->tx_fifo_g);
1089             }
1090             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, RX_FIFO_RESET)) {
1091                 fifo8_reset(&s->rx_fifo_g);
1092             }
1093             break;
1094         case R_GQSPI_IDR:
1095             s->regs[R_GQSPI_IMR] |= value;
1096             break;
1097         case R_GQSPI_IER:
1098             s->regs[R_GQSPI_IMR] &= ~value;
1099             break;
1100         case R_GQSPI_ISR:
1101             s->regs[R_GQSPI_ISR] &= ~value;
1102             break;
1103         case R_GQSPI_IMR:
1104         case R_GQSPI_RXD:
1105         case R_GQSPI_GF_SNAPSHOT:
1106         case R_GQSPI_MOD_ID:
1107             break;
1108         default:
1109             s->regs[reg] = value;
1110             break;
1111         }
1112         xlnx_zynqmp_qspips_update_cs_lines(s);
1113         xlnx_zynqmp_qspips_check_flush(s);
1114         xlnx_zynqmp_qspips_update_cs_lines(s);
1115         xlnx_zynqmp_qspips_update_ixr(s);
1116     }
1117     xlnx_zynqmp_qspips_notify(s);
1118 }
1119 
1120 static const MemoryRegionOps qspips_ops = {
1121     .read = xilinx_spips_read,
1122     .write = xilinx_qspips_write,
1123     .endianness = DEVICE_LITTLE_ENDIAN,
1124 };
1125 
1126 static const MemoryRegionOps xlnx_zynqmp_qspips_ops = {
1127     .read = xlnx_zynqmp_qspips_read,
1128     .write = xlnx_zynqmp_qspips_write,
1129     .endianness = DEVICE_LITTLE_ENDIAN,
1130 };
1131 
1132 #define LQSPI_CACHE_SIZE 1024
1133 
1134 static void lqspi_load_cache(void *opaque, hwaddr addr)
1135 {
1136     XilinxQSPIPS *q = opaque;
1137     XilinxSPIPS *s = opaque;
1138     int i;
1139     int flash_addr = ((addr & ~(LQSPI_CACHE_SIZE - 1))
1140                    / num_effective_busses(s));
1141     int slave = flash_addr >> LQSPI_ADDRESS_BITS;
1142     int cache_entry = 0;
1143     uint32_t u_page_save = s->regs[R_LQSPI_STS] & ~LQSPI_CFG_U_PAGE;
1144 
1145     if (addr < q->lqspi_cached_addr ||
1146             addr > q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1147         xilinx_qspips_invalidate_mmio_ptr(q);
1148         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1149         s->regs[R_LQSPI_STS] |= slave ? LQSPI_CFG_U_PAGE : 0;
1150 
1151         DB_PRINT_L(0, "config reg status: %08x\n", s->regs[R_LQSPI_CFG]);
1152 
1153         fifo8_reset(&s->tx_fifo);
1154         fifo8_reset(&s->rx_fifo);
1155 
1156         /* instruction */
1157         DB_PRINT_L(0, "pushing read instruction: %02x\n",
1158                    (unsigned)(uint8_t)(s->regs[R_LQSPI_CFG] &
1159                                        LQSPI_CFG_INST_CODE));
1160         fifo8_push(&s->tx_fifo, s->regs[R_LQSPI_CFG] & LQSPI_CFG_INST_CODE);
1161         /* read address */
1162         DB_PRINT_L(0, "pushing read address %06x\n", flash_addr);
1163         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_ADDR4) {
1164             fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 24));
1165         }
1166         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 16));
1167         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 8));
1168         fifo8_push(&s->tx_fifo, (uint8_t)flash_addr);
1169         /* mode bits */
1170         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_MODE_EN) {
1171             fifo8_push(&s->tx_fifo, extract32(s->regs[R_LQSPI_CFG],
1172                                               LQSPI_CFG_MODE_SHIFT,
1173                                               LQSPI_CFG_MODE_WIDTH));
1174         }
1175         /* dummy bytes */
1176         for (i = 0; i < (extract32(s->regs[R_LQSPI_CFG], LQSPI_CFG_DUMMY_SHIFT,
1177                                    LQSPI_CFG_DUMMY_WIDTH)); ++i) {
1178             DB_PRINT_L(0, "pushing dummy byte\n");
1179             fifo8_push(&s->tx_fifo, 0);
1180         }
1181         xilinx_spips_update_cs_lines(s);
1182         xilinx_spips_flush_txfifo(s);
1183         fifo8_reset(&s->rx_fifo);
1184 
1185         DB_PRINT_L(0, "starting QSPI data read\n");
1186 
1187         while (cache_entry < LQSPI_CACHE_SIZE) {
1188             for (i = 0; i < 64; ++i) {
1189                 tx_data_bytes(&s->tx_fifo, 0, 1, false);
1190             }
1191             xilinx_spips_flush_txfifo(s);
1192             for (i = 0; i < 64; ++i) {
1193                 rx_data_bytes(&s->rx_fifo, &q->lqspi_buf[cache_entry++], 1);
1194             }
1195         }
1196 
1197         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1198         s->regs[R_LQSPI_STS] |= u_page_save;
1199         xilinx_spips_update_cs_lines(s);
1200 
1201         q->lqspi_cached_addr = flash_addr * num_effective_busses(s);
1202     }
1203 }
1204 
1205 static uint64_t
1206 lqspi_read(void *opaque, hwaddr addr, unsigned int size)
1207 {
1208     XilinxQSPIPS *q = opaque;
1209     uint32_t ret;
1210 
1211     if (addr >= q->lqspi_cached_addr &&
1212             addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1213         uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
1214         ret = cpu_to_le32(*(uint32_t *)retp);
1215         DB_PRINT_L(1, "addr: %08x, data: %08x\n", (unsigned)addr,
1216                    (unsigned)ret);
1217         return ret;
1218     } else {
1219         lqspi_load_cache(opaque, addr);
1220         return lqspi_read(opaque, addr, size);
1221     }
1222 }
1223 
1224 static const MemoryRegionOps lqspi_ops = {
1225     .read = lqspi_read,
1226     .endianness = DEVICE_NATIVE_ENDIAN,
1227     .valid = {
1228         .min_access_size = 1,
1229         .max_access_size = 4
1230     }
1231 };
1232 
1233 static void xilinx_spips_realize(DeviceState *dev, Error **errp)
1234 {
1235     XilinxSPIPS *s = XILINX_SPIPS(dev);
1236     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1237     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1238     qemu_irq *cs;
1239     int i;
1240 
1241     DB_PRINT_L(0, "realized spips\n");
1242 
1243     if (s->num_busses > MAX_NUM_BUSSES) {
1244         error_setg(errp,
1245                    "requested number of SPI busses %u exceeds maximum %d",
1246                    s->num_busses, MAX_NUM_BUSSES);
1247         return;
1248     }
1249     if (s->num_busses < MIN_NUM_BUSSES) {
1250         error_setg(errp,
1251                    "requested number of SPI busses %u is below minimum %d",
1252                    s->num_busses, MIN_NUM_BUSSES);
1253         return;
1254     }
1255 
1256     s->spi = g_new(SSIBus *, s->num_busses);
1257     for (i = 0; i < s->num_busses; ++i) {
1258         char bus_name[16];
1259         snprintf(bus_name, 16, "spi%d", i);
1260         s->spi[i] = ssi_create_bus(dev, bus_name);
1261     }
1262 
1263     s->cs_lines = g_new0(qemu_irq, s->num_cs * s->num_busses);
1264     s->cs_lines_state = g_new0(bool, s->num_cs * s->num_busses);
1265     for (i = 0, cs = s->cs_lines; i < s->num_busses; ++i, cs += s->num_cs) {
1266         ssi_auto_connect_slaves(DEVICE(s), cs, s->spi[i]);
1267     }
1268 
1269     sysbus_init_irq(sbd, &s->irq);
1270     for (i = 0; i < s->num_cs * s->num_busses; ++i) {
1271         sysbus_init_irq(sbd, &s->cs_lines[i]);
1272     }
1273 
1274     memory_region_init_io(&s->iomem, OBJECT(s), xsc->reg_ops, s,
1275                           "spi", XLNX_ZYNQMP_SPIPS_R_MAX * 4);
1276     sysbus_init_mmio(sbd, &s->iomem);
1277 
1278     s->irqline = -1;
1279 
1280     fifo8_create(&s->rx_fifo, xsc->rx_fifo_size);
1281     fifo8_create(&s->tx_fifo, xsc->tx_fifo_size);
1282 }
1283 
1284 static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
1285 {
1286     XilinxSPIPS *s = XILINX_SPIPS(dev);
1287     XilinxQSPIPS *q = XILINX_QSPIPS(dev);
1288     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1289 
1290     DB_PRINT_L(0, "realized qspips\n");
1291 
1292     s->num_busses = 2;
1293     s->num_cs = 2;
1294     s->num_txrx_bytes = 4;
1295 
1296     xilinx_spips_realize(dev, errp);
1297     memory_region_init_io(&s->mmlqspi, OBJECT(s), &lqspi_ops, s, "lqspi",
1298                           (1 << LQSPI_ADDRESS_BITS) * 2);
1299     sysbus_init_mmio(sbd, &s->mmlqspi);
1300 
1301     q->lqspi_cached_addr = ~0ULL;
1302 }
1303 
1304 static void xlnx_zynqmp_qspips_realize(DeviceState *dev, Error **errp)
1305 {
1306     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(dev);
1307     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1308 
1309     if (s->dma_burst_size > QSPI_DMA_MAX_BURST_SIZE) {
1310         error_setg(errp,
1311                    "qspi dma burst size %u exceeds maximum limit %d",
1312                    s->dma_burst_size, QSPI_DMA_MAX_BURST_SIZE);
1313         return;
1314     }
1315     xilinx_qspips_realize(dev, errp);
1316     fifo8_create(&s->rx_fifo_g, xsc->rx_fifo_size);
1317     fifo8_create(&s->tx_fifo_g, xsc->tx_fifo_size);
1318     fifo32_create(&s->fifo_g, 32);
1319 }
1320 
1321 static void xlnx_zynqmp_qspips_init(Object *obj)
1322 {
1323     XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(obj);
1324 
1325     object_property_add_link(obj, "stream-connected-dma", TYPE_STREAM_SLAVE,
1326                              (Object **)&rq->dma,
1327                              object_property_allow_set_link,
1328                              OBJ_PROP_LINK_STRONG,
1329                              NULL);
1330 }
1331 
1332 static int xilinx_spips_post_load(void *opaque, int version_id)
1333 {
1334     xilinx_spips_update_ixr((XilinxSPIPS *)opaque);
1335     xilinx_spips_update_cs_lines((XilinxSPIPS *)opaque);
1336     return 0;
1337 }
1338 
1339 static const VMStateDescription vmstate_xilinx_spips = {
1340     .name = "xilinx_spips",
1341     .version_id = 2,
1342     .minimum_version_id = 2,
1343     .post_load = xilinx_spips_post_load,
1344     .fields = (VMStateField[]) {
1345         VMSTATE_FIFO8(tx_fifo, XilinxSPIPS),
1346         VMSTATE_FIFO8(rx_fifo, XilinxSPIPS),
1347         VMSTATE_UINT32_ARRAY(regs, XilinxSPIPS, XLNX_SPIPS_R_MAX),
1348         VMSTATE_UINT8(snoop_state, XilinxSPIPS),
1349         VMSTATE_END_OF_LIST()
1350     }
1351 };
1352 
1353 static int xlnx_zynqmp_qspips_post_load(void *opaque, int version_id)
1354 {
1355     XlnxZynqMPQSPIPS *s = (XlnxZynqMPQSPIPS *)opaque;
1356     XilinxSPIPS *qs = XILINX_SPIPS(s);
1357 
1358     if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN) &&
1359         fifo8_is_empty(&qs->rx_fifo) && fifo8_is_empty(&qs->tx_fifo)) {
1360         xlnx_zynqmp_qspips_update_ixr(s);
1361         xlnx_zynqmp_qspips_update_cs_lines(s);
1362     }
1363     return 0;
1364 }
1365 
1366 static const VMStateDescription vmstate_xilinx_qspips = {
1367     .name = "xilinx_qspips",
1368     .version_id = 1,
1369     .minimum_version_id = 1,
1370     .fields = (VMStateField[]) {
1371         VMSTATE_STRUCT(parent_obj, XilinxQSPIPS, 0,
1372                        vmstate_xilinx_spips, XilinxSPIPS),
1373         VMSTATE_END_OF_LIST()
1374     }
1375 };
1376 
1377 static const VMStateDescription vmstate_xlnx_zynqmp_qspips = {
1378     .name = "xlnx_zynqmp_qspips",
1379     .version_id = 1,
1380     .minimum_version_id = 1,
1381     .post_load = xlnx_zynqmp_qspips_post_load,
1382     .fields = (VMStateField[]) {
1383         VMSTATE_STRUCT(parent_obj, XlnxZynqMPQSPIPS, 0,
1384                        vmstate_xilinx_qspips, XilinxQSPIPS),
1385         VMSTATE_FIFO8(tx_fifo_g, XlnxZynqMPQSPIPS),
1386         VMSTATE_FIFO8(rx_fifo_g, XlnxZynqMPQSPIPS),
1387         VMSTATE_FIFO32(fifo_g, XlnxZynqMPQSPIPS),
1388         VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPQSPIPS, XLNX_ZYNQMP_SPIPS_R_MAX),
1389         VMSTATE_END_OF_LIST()
1390     }
1391 };
1392 
1393 static Property xilinx_zynqmp_qspips_properties[] = {
1394     DEFINE_PROP_UINT32("dma-burst-size", XlnxZynqMPQSPIPS, dma_burst_size, 64),
1395     DEFINE_PROP_END_OF_LIST(),
1396 };
1397 
1398 static Property xilinx_spips_properties[] = {
1399     DEFINE_PROP_UINT8("num-busses", XilinxSPIPS, num_busses, 1),
1400     DEFINE_PROP_UINT8("num-ss-bits", XilinxSPIPS, num_cs, 4),
1401     DEFINE_PROP_UINT8("num-txrx-bytes", XilinxSPIPS, num_txrx_bytes, 1),
1402     DEFINE_PROP_END_OF_LIST(),
1403 };
1404 
1405 static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
1406 {
1407     DeviceClass *dc = DEVICE_CLASS(klass);
1408     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1409 
1410     dc->realize = xilinx_qspips_realize;
1411     xsc->reg_ops = &qspips_ops;
1412     xsc->rx_fifo_size = RXFF_A_Q;
1413     xsc->tx_fifo_size = TXFF_A_Q;
1414 }
1415 
1416 static void xilinx_spips_class_init(ObjectClass *klass, void *data)
1417 {
1418     DeviceClass *dc = DEVICE_CLASS(klass);
1419     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1420 
1421     dc->realize = xilinx_spips_realize;
1422     dc->reset = xilinx_spips_reset;
1423     dc->props = xilinx_spips_properties;
1424     dc->vmsd = &vmstate_xilinx_spips;
1425 
1426     xsc->reg_ops = &spips_ops;
1427     xsc->rx_fifo_size = RXFF_A;
1428     xsc->tx_fifo_size = TXFF_A;
1429 }
1430 
1431 static void xlnx_zynqmp_qspips_class_init(ObjectClass *klass, void * data)
1432 {
1433     DeviceClass *dc = DEVICE_CLASS(klass);
1434     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1435 
1436     dc->realize = xlnx_zynqmp_qspips_realize;
1437     dc->reset = xlnx_zynqmp_qspips_reset;
1438     dc->vmsd = &vmstate_xlnx_zynqmp_qspips;
1439     dc->props = xilinx_zynqmp_qspips_properties;
1440     xsc->reg_ops = &xlnx_zynqmp_qspips_ops;
1441     xsc->rx_fifo_size = RXFF_A_Q;
1442     xsc->tx_fifo_size = TXFF_A_Q;
1443 }
1444 
1445 static const TypeInfo xilinx_spips_info = {
1446     .name  = TYPE_XILINX_SPIPS,
1447     .parent = TYPE_SYS_BUS_DEVICE,
1448     .instance_size  = sizeof(XilinxSPIPS),
1449     .class_init = xilinx_spips_class_init,
1450     .class_size = sizeof(XilinxSPIPSClass),
1451 };
1452 
1453 static const TypeInfo xilinx_qspips_info = {
1454     .name  = TYPE_XILINX_QSPIPS,
1455     .parent = TYPE_XILINX_SPIPS,
1456     .instance_size  = sizeof(XilinxQSPIPS),
1457     .class_init = xilinx_qspips_class_init,
1458 };
1459 
1460 static const TypeInfo xlnx_zynqmp_qspips_info = {
1461     .name  = TYPE_XLNX_ZYNQMP_QSPIPS,
1462     .parent = TYPE_XILINX_QSPIPS,
1463     .instance_size  = sizeof(XlnxZynqMPQSPIPS),
1464     .instance_init  = xlnx_zynqmp_qspips_init,
1465     .class_init = xlnx_zynqmp_qspips_class_init,
1466 };
1467 
1468 static void xilinx_spips_register_types(void)
1469 {
1470     type_register_static(&xilinx_spips_info);
1471     type_register_static(&xilinx_qspips_info);
1472     type_register_static(&xlnx_zynqmp_qspips_info);
1473 }
1474 
1475 type_init(xilinx_spips_register_types)
1476