cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

aspeed_smc.c (56415B)


      1/*
      2 * ASPEED AST2400 SMC Controller (SPI Flash Only)
      3 *
      4 * Copyright (C) 2016 IBM Corp.
      5 *
      6 * Permission is hereby granted, free of charge, to any person obtaining a copy
      7 * of this software and associated documentation files (the "Software"), to deal
      8 * in the Software without restriction, including without limitation the rights
      9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     10 * copies of the Software, and to permit persons to whom the Software is
     11 * furnished to do so, subject to the following conditions:
     12 *
     13 * The above copyright notice and this permission notice shall be included in
     14 * all copies or substantial portions of the Software.
     15 *
     16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     22 * THE SOFTWARE.
     23 */
     24
     25#include "qemu/osdep.h"
     26#include "hw/sysbus.h"
     27#include "migration/vmstate.h"
     28#include "qemu/log.h"
     29#include "qemu/module.h"
     30#include "qemu/error-report.h"
     31#include "qapi/error.h"
     32#include "qemu/units.h"
     33#include "trace.h"
     34
     35#include "hw/irq.h"
     36#include "hw/qdev-properties.h"
     37#include "hw/ssi/aspeed_smc.h"
     38
     39/* CE Type Setting Register */
     40#define R_CONF            (0x00 / 4)
     41#define   CONF_LEGACY_DISABLE  (1 << 31)
     42#define   CONF_ENABLE_W4       20
     43#define   CONF_ENABLE_W3       19
     44#define   CONF_ENABLE_W2       18
     45#define   CONF_ENABLE_W1       17
     46#define   CONF_ENABLE_W0       16
     47#define   CONF_FLASH_TYPE4     8
     48#define   CONF_FLASH_TYPE3     6
     49#define   CONF_FLASH_TYPE2     4
     50#define   CONF_FLASH_TYPE1     2
     51#define   CONF_FLASH_TYPE0     0
     52#define      CONF_FLASH_TYPE_NOR   0x0
     53#define      CONF_FLASH_TYPE_NAND  0x1
     54#define      CONF_FLASH_TYPE_SPI   0x2 /* AST2600 is SPI only */
     55
     56/* CE Control Register */
     57#define R_CE_CTRL            (0x04 / 4)
     58#define   CTRL_EXTENDED4       4  /* 32 bit addressing for SPI */
     59#define   CTRL_EXTENDED3       3  /* 32 bit addressing for SPI */
     60#define   CTRL_EXTENDED2       2  /* 32 bit addressing for SPI */
     61#define   CTRL_EXTENDED1       1  /* 32 bit addressing for SPI */
     62#define   CTRL_EXTENDED0       0  /* 32 bit addressing for SPI */
     63
     64/* Interrupt Control and Status Register */
     65#define R_INTR_CTRL       (0x08 / 4)
     66#define   INTR_CTRL_DMA_STATUS            (1 << 11)
     67#define   INTR_CTRL_CMD_ABORT_STATUS      (1 << 10)
     68#define   INTR_CTRL_WRITE_PROTECT_STATUS  (1 << 9)
     69#define   INTR_CTRL_DMA_EN                (1 << 3)
     70#define   INTR_CTRL_CMD_ABORT_EN          (1 << 2)
     71#define   INTR_CTRL_WRITE_PROTECT_EN      (1 << 1)
     72
     73/* Command Control Register */
     74#define R_CE_CMD_CTRL      (0x0C / 4)
     75#define   CTRL_ADDR_BYTE0_DISABLE_SHIFT       4
     76#define   CTRL_DATA_BYTE0_DISABLE_SHIFT       0
     77
     78#define aspeed_smc_addr_byte_enabled(s, i)                               \
     79    (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_ADDR_BYTE0_DISABLE_SHIFT + (i)))))
     80#define aspeed_smc_data_byte_enabled(s, i)                               \
     81    (!((s)->regs[R_CE_CMD_CTRL] & (1 << (CTRL_DATA_BYTE0_DISABLE_SHIFT + (i)))))
     82
     83/* CEx Control Register */
     84#define R_CTRL0           (0x10 / 4)
     85#define   CTRL_IO_QPI              (1 << 31)
     86#define   CTRL_IO_QUAD_DATA        (1 << 30)
     87#define   CTRL_IO_DUAL_DATA        (1 << 29)
     88#define   CTRL_IO_DUAL_ADDR_DATA   (1 << 28) /* Includes dummies */
     89#define   CTRL_IO_QUAD_ADDR_DATA   (1 << 28) /* Includes dummies */
     90#define   CTRL_CMD_SHIFT           16
     91#define   CTRL_CMD_MASK            0xff
     92#define   CTRL_DUMMY_HIGH_SHIFT    14
     93#define   CTRL_AST2400_SPI_4BYTE   (1 << 13)
     94#define CE_CTRL_CLOCK_FREQ_SHIFT   8
     95#define CE_CTRL_CLOCK_FREQ_MASK    0xf
     96#define CE_CTRL_CLOCK_FREQ(div)                                         \
     97    (((div) & CE_CTRL_CLOCK_FREQ_MASK) << CE_CTRL_CLOCK_FREQ_SHIFT)
     98#define   CTRL_DUMMY_LOW_SHIFT     6 /* 2 bits [7:6] */
     99#define   CTRL_CE_STOP_ACTIVE      (1 << 2)
    100#define   CTRL_CMD_MODE_MASK       0x3
    101#define     CTRL_READMODE          0x0
    102#define     CTRL_FREADMODE         0x1
    103#define     CTRL_WRITEMODE         0x2
    104#define     CTRL_USERMODE          0x3
    105#define R_CTRL1           (0x14 / 4)
    106#define R_CTRL2           (0x18 / 4)
    107#define R_CTRL3           (0x1C / 4)
    108#define R_CTRL4           (0x20 / 4)
    109
    110/* CEx Segment Address Register */
    111#define R_SEG_ADDR0       (0x30 / 4)
    112#define   SEG_END_SHIFT        24   /* 8MB units */
    113#define   SEG_END_MASK         0xff
    114#define   SEG_START_SHIFT      16   /* address bit [A29-A23] */
    115#define   SEG_START_MASK       0xff
    116#define R_SEG_ADDR1       (0x34 / 4)
    117#define R_SEG_ADDR2       (0x38 / 4)
    118#define R_SEG_ADDR3       (0x3C / 4)
    119#define R_SEG_ADDR4       (0x40 / 4)
    120
    121/* Misc Control Register #1 */
    122#define R_MISC_CTRL1      (0x50 / 4)
    123
    124/* SPI dummy cycle data */
    125#define R_DUMMY_DATA      (0x54 / 4)
    126
    127/* FMC_WDT2 Control/Status Register for Alternate Boot (AST2600) */
    128#define R_FMC_WDT2_CTRL   (0x64 / 4)
    129#define   FMC_WDT2_CTRL_ALT_BOOT_MODE    BIT(6) /* O: 2 chips 1: 1 chip */
    130#define   FMC_WDT2_CTRL_SINGLE_BOOT_MODE BIT(5)
    131#define   FMC_WDT2_CTRL_BOOT_SOURCE      BIT(4) /* O: primary 1: alternate */
    132#define   FMC_WDT2_CTRL_EN               BIT(0)
    133
    134/* DMA Control/Status Register */
    135#define R_DMA_CTRL        (0x80 / 4)
    136#define   DMA_CTRL_REQUEST      (1 << 31)
    137#define   DMA_CTRL_GRANT        (1 << 30)
    138#define   DMA_CTRL_DELAY_MASK   0xf
    139#define   DMA_CTRL_DELAY_SHIFT  8
    140#define   DMA_CTRL_FREQ_MASK    0xf
    141#define   DMA_CTRL_FREQ_SHIFT   4
    142#define   DMA_CTRL_CALIB        (1 << 3)
    143#define   DMA_CTRL_CKSUM        (1 << 2)
    144#define   DMA_CTRL_WRITE        (1 << 1)
    145#define   DMA_CTRL_ENABLE       (1 << 0)
    146
    147/* DMA Flash Side Address */
    148#define R_DMA_FLASH_ADDR  (0x84 / 4)
    149
    150/* DMA DRAM Side Address */
    151#define R_DMA_DRAM_ADDR   (0x88 / 4)
    152
    153/* DMA Length Register */
    154#define R_DMA_LEN         (0x8C / 4)
    155
    156/* Checksum Calculation Result */
    157#define R_DMA_CHECKSUM    (0x90 / 4)
    158
    159/* Read Timing Compensation Register */
    160#define R_TIMINGS         (0x94 / 4)
    161
    162/* SPI controller registers and bits (AST2400) */
    163#define R_SPI_CONF        (0x00 / 4)
    164#define   SPI_CONF_ENABLE_W0   0
    165#define R_SPI_CTRL0       (0x4 / 4)
    166#define R_SPI_MISC_CTRL   (0x10 / 4)
    167#define R_SPI_TIMINGS     (0x14 / 4)
    168
    169#define ASPEED_SMC_R_SPI_MAX (0x20 / 4)
    170#define ASPEED_SMC_R_SMC_MAX (0x20 / 4)
    171
    172/*
    173 * DMA DRAM addresses should be 4 bytes aligned and the valid address
    174 * range is 0x40000000 - 0x5FFFFFFF (AST2400)
    175 *          0x80000000 - 0xBFFFFFFF (AST2500)
    176 *
    177 * DMA flash addresses should be 4 bytes aligned and the valid address
    178 * range is 0x20000000 - 0x2FFFFFFF.
    179 *
    180 * DMA length is from 4 bytes to 32MB
    181 *   0: 4 bytes
    182 *   0x7FFFFF: 32M bytes
    183 */
    184#define DMA_DRAM_ADDR(asc, val)   ((val) & (asc)->dma_dram_mask)
    185#define DMA_FLASH_ADDR(asc, val)  ((val) & (asc)->dma_flash_mask)
    186#define DMA_LENGTH(val)         ((val) & 0x01FFFFFC)
    187
    188/* Flash opcodes. */
    189#define SPI_OP_READ       0x03    /* Read data bytes (low frequency) */
    190
    191#define SNOOP_OFF         0xFF
    192#define SNOOP_START       0x0
    193
    194/*
    195 * Default segments mapping addresses and size for each peripheral per
    196 * controller. These can be changed when board is initialized with the
    197 * Segment Address Registers.
    198 */
    199static const AspeedSegments aspeed_2500_spi1_segments[];
    200static const AspeedSegments aspeed_2500_spi2_segments[];
    201
    202#define ASPEED_SMC_FEATURE_DMA       0x1
    203#define ASPEED_SMC_FEATURE_DMA_GRANT 0x2
    204#define ASPEED_SMC_FEATURE_WDT_CONTROL 0x4
    205
    206static inline bool aspeed_smc_has_dma(const AspeedSMCClass *asc)
    207{
    208    return !!(asc->features & ASPEED_SMC_FEATURE_DMA);
    209}
    210
    211static inline bool aspeed_smc_has_wdt_control(const AspeedSMCClass *asc)
    212{
    213    return !!(asc->features & ASPEED_SMC_FEATURE_WDT_CONTROL);
    214}
    215
    216#define aspeed_smc_error(fmt, ...)                                      \
    217    qemu_log_mask(LOG_GUEST_ERROR, "%s: " fmt "\n", __func__, ## __VA_ARGS__)
    218
    219static bool aspeed_smc_flash_overlap(const AspeedSMCState *s,
    220                                     const AspeedSegments *new,
    221                                     int cs)
    222{
    223    AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
    224    AspeedSegments seg;
    225    int i;
    226
    227    for (i = 0; i < asc->max_peripherals; i++) {
    228        if (i == cs) {
    229            continue;
    230        }
    231
    232        asc->reg_to_segment(s, s->regs[R_SEG_ADDR0 + i], &seg);
    233
    234        if (new->addr + new->size > seg.addr &&
    235            new->addr < seg.addr + seg.size) {
    236            aspeed_smc_error("new segment CS%d [ 0x%"
    237                             HWADDR_PRIx" - 0x%"HWADDR_PRIx" ] overlaps with "
    238                             "CS%d [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
    239                             cs, new->addr, new->addr + new->size,
    240                             i, seg.addr, seg.addr + seg.size);
    241            return true;
    242        }
    243    }
    244    return false;
    245}
    246
    247static void aspeed_smc_flash_set_segment_region(AspeedSMCState *s, int cs,
    248                                                uint64_t regval)
    249{
    250    AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
    251    AspeedSMCFlash *fl = &s->flashes[cs];
    252    AspeedSegments seg;
    253
    254    asc->reg_to_segment(s, regval, &seg);
    255
    256    memory_region_transaction_begin();
    257    memory_region_set_size(&fl->mmio, seg.size);
    258    memory_region_set_address(&fl->mmio, seg.addr - asc->flash_window_base);
    259    memory_region_set_enabled(&fl->mmio, !!seg.size);
    260    memory_region_transaction_commit();
    261
    262    s->regs[R_SEG_ADDR0 + cs] = regval;
    263}
    264
    265static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
    266                                         uint64_t new)
    267{
    268    AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
    269    AspeedSegments seg;
    270
    271    asc->reg_to_segment(s, new, &seg);
    272
    273    trace_aspeed_smc_flash_set_segment(cs, new, seg.addr, seg.addr + seg.size);
    274
    275    /* The start address of CS0 is read-only */
    276    if (cs == 0 && seg.addr != asc->flash_window_base) {
    277        aspeed_smc_error("Tried to change CS0 start address to 0x%"
    278                         HWADDR_PRIx, seg.addr);
    279        seg.addr = asc->flash_window_base;
    280        new = asc->segment_to_reg(s, &seg);
    281    }
    282
    283    /*
    284     * The end address of the AST2500 spi controllers is also
    285     * read-only.
    286     */
    287    if ((asc->segments == aspeed_2500_spi1_segments ||
    288         asc->segments == aspeed_2500_spi2_segments) &&
    289        cs == asc->max_peripherals &&
    290        seg.addr + seg.size != asc->segments[cs].addr +
    291        asc->segments[cs].size) {
    292        aspeed_smc_error("Tried to change CS%d end address to 0x%"
    293                         HWADDR_PRIx, cs, seg.addr + seg.size);
    294        seg.size = asc->segments[cs].addr + asc->segments[cs].size -
    295            seg.addr;
    296        new = asc->segment_to_reg(s, &seg);
    297    }
    298
    299    /* Keep the segment in the overall flash window */
    300    if (seg.size &&
    301        (seg.addr + seg.size <= asc->flash_window_base ||
    302         seg.addr > asc->flash_window_base + asc->flash_window_size)) {
    303        aspeed_smc_error("new segment for CS%d is invalid : "
    304                         "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
    305                         cs, seg.addr, seg.addr + seg.size);
    306        return;
    307    }
    308
    309    /* Check start address vs. alignment */
    310    if (seg.size && !QEMU_IS_ALIGNED(seg.addr, seg.size)) {
    311        aspeed_smc_error("new segment for CS%d is not "
    312                         "aligned : [ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
    313                         cs, seg.addr, seg.addr + seg.size);
    314    }
    315
    316    /* And segments should not overlap (in the specs) */
    317    aspeed_smc_flash_overlap(s, &seg, cs);
    318
    319    /* All should be fine now to move the region */
    320    aspeed_smc_flash_set_segment_region(s, cs, new);
    321}
    322
    323static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr,
    324                                              unsigned size)
    325{
    326    aspeed_smc_error("To 0x%" HWADDR_PRIx " of size %u" PRIx64, addr, size);
    327    return 0;
    328}
    329
    330static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr,
    331                                           uint64_t data, unsigned size)
    332{
    333    aspeed_smc_error("To 0x%" HWADDR_PRIx " of size %u: 0x%" PRIx64,
    334                     addr, size, data);
    335}
    336
    337static const MemoryRegionOps aspeed_smc_flash_default_ops = {
    338    .read = aspeed_smc_flash_default_read,
    339    .write = aspeed_smc_flash_default_write,
    340    .endianness = DEVICE_LITTLE_ENDIAN,
    341    .valid = {
    342        .min_access_size = 1,
    343        .max_access_size = 4,
    344    },
    345};
    346
    347static inline int aspeed_smc_flash_mode(const AspeedSMCFlash *fl)
    348{
    349    const AspeedSMCState *s = fl->controller;
    350
    351    return s->regs[s->r_ctrl0 + fl->cs] & CTRL_CMD_MODE_MASK;
    352}
    353
    354static inline bool aspeed_smc_is_writable(const AspeedSMCFlash *fl)
    355{
    356    const AspeedSMCState *s = fl->controller;
    357
    358    return s->regs[s->r_conf] & (1 << (s->conf_enable_w0 + fl->cs));
    359}
    360
    361static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl)
    362{
    363    const AspeedSMCState *s = fl->controller;
    364    int cmd = (s->regs[s->r_ctrl0 + fl->cs] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK;
    365
    366    /*
    367     * In read mode, the default SPI command is READ (0x3). In other
    368     * modes, the command should necessarily be defined
    369     *
    370     * TODO: add support for READ4 (0x13) on AST2600
    371     */
    372    if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) {
    373        cmd = SPI_OP_READ;
    374    }
    375
    376    if (!cmd) {
    377        aspeed_smc_error("no command defined for mode %d",
    378                         aspeed_smc_flash_mode(fl));
    379    }
    380
    381    return cmd;
    382}
    383
    384static inline int aspeed_smc_flash_addr_width(const AspeedSMCFlash *fl)
    385{
    386    const AspeedSMCState *s = fl->controller;
    387    AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
    388
    389    if (asc->addr_width) {
    390        return asc->addr_width(s);
    391    } else {
    392        return s->regs[s->r_ce_ctrl] & (1 << (CTRL_EXTENDED0 + fl->cs)) ? 4 : 3;
    393    }
    394}
    395
    396static void aspeed_smc_flash_do_select(AspeedSMCFlash *fl, bool unselect)
    397{
    398    AspeedSMCState *s = fl->controller;
    399
    400    trace_aspeed_smc_flash_select(fl->cs, unselect ? "un" : "");
    401
    402    qemu_set_irq(s->cs_lines[fl->cs], unselect);
    403}
    404
    405static void aspeed_smc_flash_select(AspeedSMCFlash *fl)
    406{
    407    aspeed_smc_flash_do_select(fl, false);
    408}
    409
    410static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl)
    411{
    412    aspeed_smc_flash_do_select(fl, true);
    413}
    414
    415static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
    416                                              uint32_t addr)
    417{
    418    const AspeedSMCState *s = fl->controller;
    419    AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
    420    AspeedSegments seg;
    421
    422    asc->reg_to_segment(s, s->regs[R_SEG_ADDR0 + fl->cs], &seg);
    423    if ((addr % seg.size) != addr) {
    424        aspeed_smc_error("invalid address 0x%08x for CS%d segment : "
    425                         "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]",
    426                         addr, fl->cs, seg.addr, seg.addr + seg.size);
    427        addr %= seg.size;
    428    }
    429
    430    return addr;
    431}
    432
    433static int aspeed_smc_flash_dummies(const AspeedSMCFlash *fl)
    434{
    435    const AspeedSMCState *s = fl->controller;
    436    uint32_t r_ctrl0 = s->regs[s->r_ctrl0 + fl->cs];
    437    uint32_t dummy_high = (r_ctrl0 >> CTRL_DUMMY_HIGH_SHIFT) & 0x1;
    438    uint32_t dummy_low = (r_ctrl0 >> CTRL_DUMMY_LOW_SHIFT) & 0x3;
    439    uint32_t dummies = ((dummy_high << 2) | dummy_low) * 8;
    440
    441    if (r_ctrl0 & CTRL_IO_DUAL_ADDR_DATA) {
    442        dummies /= 2;
    443    }
    444
    445    return dummies;
    446}
    447
    448static void aspeed_smc_flash_setup(AspeedSMCFlash *fl, uint32_t addr)
    449{
    450    const AspeedSMCState *s = fl->controller;
    451    uint8_t cmd = aspeed_smc_flash_cmd(fl);
    452    int i = aspeed_smc_flash_addr_width(fl);
    453
    454    /* Flash access can not exceed CS segment */
    455    addr = aspeed_smc_check_segment_addr(fl, addr);
    456
    457    ssi_transfer(s->spi, cmd);
    458    while (i--) {
    459        if (aspeed_smc_addr_byte_enabled(s, i)) {
    460            ssi_transfer(s->spi, (addr >> (i * 8)) & 0xff);
    461        }
    462    }
    463
    464    /*
    465     * Use fake transfers to model dummy bytes. The value should
    466     * be configured to some non-zero value in fast read mode and
    467     * zero in read mode. But, as the HW allows inconsistent
    468     * settings, let's check for fast read mode.
    469     */
    470    if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) {
    471        for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) {
    472            ssi_transfer(fl->controller->spi, s->regs[R_DUMMY_DATA] & 0xff);
    473        }
    474    }
    475}
    476
    477static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
    478{
    479    AspeedSMCFlash *fl = opaque;
    480    AspeedSMCState *s = fl->controller;
    481    uint64_t ret = 0;
    482    int i;
    483
    484    switch (aspeed_smc_flash_mode(fl)) {
    485    case CTRL_USERMODE:
    486        for (i = 0; i < size; i++) {
    487            ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
    488        }
    489        break;
    490    case CTRL_READMODE:
    491    case CTRL_FREADMODE:
    492        aspeed_smc_flash_select(fl);
    493        aspeed_smc_flash_setup(fl, addr);
    494
    495        for (i = 0; i < size; i++) {
    496            ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
    497        }
    498
    499        aspeed_smc_flash_unselect(fl);
    500        break;
    501    default:
    502        aspeed_smc_error("invalid flash mode %d", aspeed_smc_flash_mode(fl));
    503    }
    504
    505    trace_aspeed_smc_flash_read(fl->cs, addr, size, ret,
    506                                aspeed_smc_flash_mode(fl));
    507    return ret;
    508}
    509
    510/*
    511 * TODO (clg@kaod.org): stolen from xilinx_spips.c. Should move to a
    512 * common include header.
    513 */
    514typedef enum {
    515    READ = 0x3,         READ_4 = 0x13,
    516    FAST_READ = 0xb,    FAST_READ_4 = 0x0c,
    517    DOR = 0x3b,         DOR_4 = 0x3c,
    518    QOR = 0x6b,         QOR_4 = 0x6c,
    519    DIOR = 0xbb,        DIOR_4 = 0xbc,
    520    QIOR = 0xeb,        QIOR_4 = 0xec,
    521
    522    PP = 0x2,           PP_4 = 0x12,
    523    DPP = 0xa2,
    524    QPP = 0x32,         QPP_4 = 0x34,
    525} FlashCMD;
    526
    527static int aspeed_smc_num_dummies(uint8_t command)
    528{
    529    switch (command) { /* check for dummies */
    530    case READ: /* no dummy bytes/cycles */
    531    case PP:
    532    case DPP:
    533    case QPP:
    534    case READ_4:
    535    case PP_4:
    536    case QPP_4:
    537        return 0;
    538    case FAST_READ:
    539    case DOR:
    540    case QOR:
    541    case FAST_READ_4:
    542    case DOR_4:
    543    case QOR_4:
    544        return 1;
    545    case DIOR:
    546    case DIOR_4:
    547        return 2;
    548    case QIOR:
    549    case QIOR_4:
    550        return 4;
    551    default:
    552        return -1;
    553    }
    554}
    555
    556static bool aspeed_smc_do_snoop(AspeedSMCFlash *fl,  uint64_t data,
    557                                unsigned size)
    558{
    559    AspeedSMCState *s = fl->controller;
    560    uint8_t addr_width = aspeed_smc_flash_addr_width(fl);
    561
    562    trace_aspeed_smc_do_snoop(fl->cs, s->snoop_index, s->snoop_dummies,
    563                              (uint8_t) data & 0xff);
    564
    565    if (s->snoop_index == SNOOP_OFF) {
    566        return false; /* Do nothing */
    567
    568    } else if (s->snoop_index == SNOOP_START) {
    569        uint8_t cmd = data & 0xff;
    570        int ndummies = aspeed_smc_num_dummies(cmd);
    571
    572        /*
    573         * No dummy cycles are expected with the current command. Turn
    574         * off snooping and let the transfer proceed normally.
    575         */
    576        if (ndummies <= 0) {
    577            s->snoop_index = SNOOP_OFF;
    578            return false;
    579        }
    580
    581        s->snoop_dummies = ndummies * 8;
    582
    583    } else if (s->snoop_index >= addr_width + 1) {
    584
    585        /* The SPI transfer has reached the dummy cycles sequence */
    586        for (; s->snoop_dummies; s->snoop_dummies--) {
    587            ssi_transfer(s->spi, s->regs[R_DUMMY_DATA] & 0xff);
    588        }
    589
    590        /* If no more dummy cycles are expected, turn off snooping */
    591        if (!s->snoop_dummies) {
    592            s->snoop_index = SNOOP_OFF;
    593        } else {
    594            s->snoop_index += size;
    595        }
    596
    597        /*
    598         * Dummy cycles have been faked already. Ignore the current
    599         * SPI transfer
    600         */
    601        return true;
    602    }
    603
    604    s->snoop_index += size;
    605    return false;
    606}
    607
    608static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,
    609                                   unsigned size)
    610{
    611    AspeedSMCFlash *fl = opaque;
    612    AspeedSMCState *s = fl->controller;
    613    int i;
    614
    615    trace_aspeed_smc_flash_write(fl->cs, addr, size, data,
    616                                 aspeed_smc_flash_mode(fl));
    617
    618    if (!aspeed_smc_is_writable(fl)) {
    619        aspeed_smc_error("flash is not writable at 0x%" HWADDR_PRIx, addr);
    620        return;
    621    }
    622
    623    switch (aspeed_smc_flash_mode(fl)) {
    624    case CTRL_USERMODE:
    625        if (aspeed_smc_do_snoop(fl, data, size)) {
    626            break;
    627        }
    628
    629        for (i = 0; i < size; i++) {
    630            ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
    631        }
    632        break;
    633    case CTRL_WRITEMODE:
    634        aspeed_smc_flash_select(fl);
    635        aspeed_smc_flash_setup(fl, addr);
    636
    637        for (i = 0; i < size; i++) {
    638            ssi_transfer(s->spi, (data >> (8 * i)) & 0xff);
    639        }
    640
    641        aspeed_smc_flash_unselect(fl);
    642        break;
    643    default:
    644        aspeed_smc_error("invalid flash mode %d", aspeed_smc_flash_mode(fl));
    645    }
    646}
    647
    648static const MemoryRegionOps aspeed_smc_flash_ops = {
    649    .read = aspeed_smc_flash_read,
    650    .write = aspeed_smc_flash_write,
    651    .endianness = DEVICE_LITTLE_ENDIAN,
    652    .valid = {
    653        .min_access_size = 1,
    654        .max_access_size = 4,
    655    },
    656};
    657
    658static void aspeed_smc_flash_update_ctrl(AspeedSMCFlash *fl, uint32_t value)
    659{
    660    AspeedSMCState *s = fl->controller;
    661    bool unselect;
    662
    663    /* User mode selects the CS, other modes unselect */
    664    unselect = (value & CTRL_CMD_MODE_MASK) != CTRL_USERMODE;
    665
    666    /* A change of CTRL_CE_STOP_ACTIVE from 0 to 1, unselects the CS */
    667    if (!(s->regs[s->r_ctrl0 + fl->cs] & CTRL_CE_STOP_ACTIVE) &&
    668        value & CTRL_CE_STOP_ACTIVE) {
    669        unselect = true;
    670    }
    671
    672    s->regs[s->r_ctrl0 + fl->cs] = value;
    673
    674    s->snoop_index = unselect ? SNOOP_OFF : SNOOP_START;
    675
    676    aspeed_smc_flash_do_select(fl, unselect);
    677}
    678
    679static void aspeed_smc_reset(DeviceState *d)
    680{
    681    AspeedSMCState *s = ASPEED_SMC(d);
    682    AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
    683    int i;
    684
    685    if (asc->resets) {
    686        memcpy(s->regs, asc->resets, sizeof s->regs);
    687    } else {
    688        memset(s->regs, 0, sizeof s->regs);
    689    }
    690
    691    /* Unselect all peripherals */
    692    for (i = 0; i < s->num_cs; ++i) {
    693        s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE;
    694        qemu_set_irq(s->cs_lines[i], true);
    695    }
    696
    697    /* setup the default segment register values and regions for all */
    698    for (i = 0; i < asc->max_peripherals; ++i) {
    699        aspeed_smc_flash_set_segment_region(s, i,
    700                    asc->segment_to_reg(s, &asc->segments[i]));
    701    }
    702
    703    s->snoop_index = SNOOP_OFF;
    704    s->snoop_dummies = 0;
    705}
    706
    707static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
    708{
    709    AspeedSMCState *s = ASPEED_SMC(opaque);
    710    AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(opaque);
    711
    712    addr >>= 2;
    713
    714    if (addr == s->r_conf ||
    715        (addr >= s->r_timings &&
    716         addr < s->r_timings + asc->nregs_timings) ||
    717        addr == s->r_ce_ctrl ||
    718        addr == R_CE_CMD_CTRL ||
    719        addr == R_INTR_CTRL ||
    720        addr == R_DUMMY_DATA ||
    721        (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_CTRL) ||
    722        (aspeed_smc_has_dma(asc) && addr == R_DMA_CTRL) ||
    723        (aspeed_smc_has_dma(asc) && addr == R_DMA_FLASH_ADDR) ||
    724        (aspeed_smc_has_dma(asc) && addr == R_DMA_DRAM_ADDR) ||
    725        (aspeed_smc_has_dma(asc) && addr == R_DMA_LEN) ||
    726        (aspeed_smc_has_dma(asc) && addr == R_DMA_CHECKSUM) ||
    727        (addr >= R_SEG_ADDR0 &&
    728         addr < R_SEG_ADDR0 + asc->max_peripherals) ||
    729        (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + asc->max_peripherals)) {
    730
    731        trace_aspeed_smc_read(addr << 2, size, s->regs[addr]);
    732
    733        return s->regs[addr];
    734    } else {
    735        qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
    736                      __func__, addr);
    737        return -1;
    738    }
    739}
    740
    741static uint8_t aspeed_smc_hclk_divisor(uint8_t hclk_mask)
    742{
    743    /* HCLK/1 .. HCLK/16 */
    744    const uint8_t hclk_divisors[] = {
    745        15, 7, 14, 6, 13, 5, 12, 4, 11, 3, 10, 2, 9, 1, 8, 0
    746    };
    747    int i;
    748
    749    for (i = 0; i < ARRAY_SIZE(hclk_divisors); i++) {
    750        if (hclk_mask == hclk_divisors[i]) {
    751            return i + 1;
    752        }
    753    }
    754
    755    aspeed_smc_error("invalid HCLK mask %x", hclk_mask);
    756    return 0;
    757}
    758
    759/*
    760 * When doing calibration, the SPI clock rate in the CE0 Control
    761 * Register and the read delay cycles in the Read Timing Compensation
    762 * Register are set using bit[11:4] of the DMA Control Register.
    763 */
    764static void aspeed_smc_dma_calibration(AspeedSMCState *s)
    765{
    766    uint8_t delay =
    767        (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
    768    uint8_t hclk_mask =
    769        (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
    770    uint8_t hclk_div = aspeed_smc_hclk_divisor(hclk_mask);
    771    uint32_t hclk_shift = (hclk_div - 1) << 2;
    772    uint8_t cs;
    773
    774    /*
    775     * The Read Timing Compensation Register values apply to all CS on
    776     * the SPI bus and only HCLK/1 - HCLK/5 can have tunable delays
    777     */
    778    if (hclk_div && hclk_div < 6) {
    779        s->regs[s->r_timings] &= ~(0xf << hclk_shift);
    780        s->regs[s->r_timings] |= delay << hclk_shift;
    781    }
    782
    783    /*
    784     * TODO: compute the CS from the DMA address and the segment
    785     * registers. This is not really a problem for now because the
    786     * Timing Register values apply to all CS and software uses CS0 to
    787     * do calibration.
    788     */
    789    cs = 0;
    790    s->regs[s->r_ctrl0 + cs] &=
    791        ~(CE_CTRL_CLOCK_FREQ_MASK << CE_CTRL_CLOCK_FREQ_SHIFT);
    792    s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
    793}
    794
    795/*
    796 * Emulate read errors in the DMA Checksum Register for high
    797 * frequencies and optimistic settings of the Read Timing Compensation
    798 * Register. This will help in tuning the SPI timing calibration
    799 * algorithm.
    800 */
    801static bool aspeed_smc_inject_read_failure(AspeedSMCState *s)
    802{
    803    uint8_t delay =
    804        (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
    805    uint8_t hclk_mask =
    806        (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
    807
    808    /*
    809     * Typical values of a palmetto-bmc machine.
    810     */
    811    switch (aspeed_smc_hclk_divisor(hclk_mask)) {
    812    case 4 ... 16:
    813        return false;
    814    case 3: /* at least one HCLK cycle delay */
    815        return (delay & 0x7) < 1;
    816    case 2: /* at least two HCLK cycle delay */
    817        return (delay & 0x7) < 2;
    818    case 1: /* (> 100MHz) is above the max freq of the controller */
    819        return true;
    820    default:
    821        g_assert_not_reached();
    822    }
    823}
    824
    825/*
    826 * Accumulate the result of the reads to provide a checksum that will
    827 * be used to validate the read timing settings.
    828 */
    829static void aspeed_smc_dma_checksum(AspeedSMCState *s)
    830{
    831    MemTxResult result;
    832    uint32_t data;
    833
    834    if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
    835        aspeed_smc_error("invalid direction for DMA checksum");
    836        return;
    837    }
    838
    839    if (s->regs[R_DMA_CTRL] & DMA_CTRL_CALIB) {
    840        aspeed_smc_dma_calibration(s);
    841    }
    842
    843    while (s->regs[R_DMA_LEN]) {
    844        data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
    845                                    MEMTXATTRS_UNSPECIFIED, &result);
    846        if (result != MEMTX_OK) {
    847            aspeed_smc_error("Flash read failed @%08x",
    848                             s->regs[R_DMA_FLASH_ADDR]);
    849            return;
    850        }
    851        trace_aspeed_smc_dma_checksum(s->regs[R_DMA_FLASH_ADDR], data);
    852
    853        /*
    854         * When the DMA is on-going, the DMA registers are updated
    855         * with the current working addresses and length.
    856         */
    857        s->regs[R_DMA_CHECKSUM] += data;
    858        s->regs[R_DMA_FLASH_ADDR] += 4;
    859        s->regs[R_DMA_LEN] -= 4;
    860    }
    861
    862    if (s->inject_failure && aspeed_smc_inject_read_failure(s)) {
    863        s->regs[R_DMA_CHECKSUM] = 0xbadc0de;
    864    }
    865
    866}
    867
    868static void aspeed_smc_dma_rw(AspeedSMCState *s)
    869{
    870    MemTxResult result;
    871    uint32_t data;
    872
    873    trace_aspeed_smc_dma_rw(s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE ?
    874                            "write" : "read",
    875                            s->regs[R_DMA_FLASH_ADDR],
    876                            s->regs[R_DMA_DRAM_ADDR],
    877                            s->regs[R_DMA_LEN]);
    878    while (s->regs[R_DMA_LEN]) {
    879        if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
    880            data = address_space_ldl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
    881                                        MEMTXATTRS_UNSPECIFIED, &result);
    882            if (result != MEMTX_OK) {
    883                aspeed_smc_error("DRAM read failed @%08x",
    884                                 s->regs[R_DMA_DRAM_ADDR]);
    885                return;
    886            }
    887
    888            address_space_stl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
    889                                 data, MEMTXATTRS_UNSPECIFIED, &result);
    890            if (result != MEMTX_OK) {
    891                aspeed_smc_error("Flash write failed @%08x",
    892                                 s->regs[R_DMA_FLASH_ADDR]);
    893                return;
    894            }
    895        } else {
    896            data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
    897                                        MEMTXATTRS_UNSPECIFIED, &result);
    898            if (result != MEMTX_OK) {
    899                aspeed_smc_error("Flash read failed @%08x",
    900                                 s->regs[R_DMA_FLASH_ADDR]);
    901                return;
    902            }
    903
    904            address_space_stl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
    905                                 data, MEMTXATTRS_UNSPECIFIED, &result);
    906            if (result != MEMTX_OK) {
    907                aspeed_smc_error("DRAM write failed @%08x",
    908                                 s->regs[R_DMA_DRAM_ADDR]);
    909                return;
    910            }
    911        }
    912
    913        /*
    914         * When the DMA is on-going, the DMA registers are updated
    915         * with the current working addresses and length.
    916         */
    917        s->regs[R_DMA_FLASH_ADDR] += 4;
    918        s->regs[R_DMA_DRAM_ADDR] += 4;
    919        s->regs[R_DMA_LEN] -= 4;
    920        s->regs[R_DMA_CHECKSUM] += data;
    921    }
    922}
    923
    924static void aspeed_smc_dma_stop(AspeedSMCState *s)
    925{
    926    /*
    927     * When the DMA is disabled, INTR_CTRL_DMA_STATUS=0 means the
    928     * engine is idle
    929     */
    930    s->regs[R_INTR_CTRL] &= ~INTR_CTRL_DMA_STATUS;
    931    s->regs[R_DMA_CHECKSUM] = 0;
    932
    933    /*
    934     * Lower the DMA irq in any case. The IRQ control register could
    935     * have been cleared before disabling the DMA.
    936     */
    937    qemu_irq_lower(s->irq);
    938}
    939
    940/*
    941 * When INTR_CTRL_DMA_STATUS=1, the DMA has completed and a new DMA
    942 * can start even if the result of the previous was not collected.
    943 */
    944static bool aspeed_smc_dma_in_progress(AspeedSMCState *s)
    945{
    946    return s->regs[R_DMA_CTRL] & DMA_CTRL_ENABLE &&
    947        !(s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_STATUS);
    948}
    949
    950static void aspeed_smc_dma_done(AspeedSMCState *s)
    951{
    952    s->regs[R_INTR_CTRL] |= INTR_CTRL_DMA_STATUS;
    953    if (s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_EN) {
    954        qemu_irq_raise(s->irq);
    955    }
    956}
    957
    958static void aspeed_smc_dma_ctrl(AspeedSMCState *s, uint32_t dma_ctrl)
    959{
    960    if (!(dma_ctrl & DMA_CTRL_ENABLE)) {
    961        s->regs[R_DMA_CTRL] = dma_ctrl;
    962
    963        aspeed_smc_dma_stop(s);
    964        return;
    965    }
    966
    967    if (aspeed_smc_dma_in_progress(s)) {
    968        aspeed_smc_error("DMA in progress !");
    969        return;
    970    }
    971
    972    s->regs[R_DMA_CTRL] = dma_ctrl;
    973
    974    if (s->regs[R_DMA_CTRL] & DMA_CTRL_CKSUM) {
    975        aspeed_smc_dma_checksum(s);
    976    } else {
    977        aspeed_smc_dma_rw(s);
    978    }
    979
    980    aspeed_smc_dma_done(s);
    981}
    982
    983static inline bool aspeed_smc_dma_granted(AspeedSMCState *s)
    984{
    985    AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
    986
    987    if (!(asc->features & ASPEED_SMC_FEATURE_DMA_GRANT)) {
    988        return true;
    989    }
    990
    991    if (!(s->regs[R_DMA_CTRL] & DMA_CTRL_GRANT)) {
    992        aspeed_smc_error("DMA not granted");
    993        return false;
    994    }
    995
    996    return true;
    997}
    998
    999static void aspeed_2600_smc_dma_ctrl(AspeedSMCState *s, uint32_t dma_ctrl)
   1000{
   1001    /* Preserve DMA bits  */
   1002    dma_ctrl |= s->regs[R_DMA_CTRL] & (DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
   1003
   1004    if (dma_ctrl == 0xAEED0000) {
   1005        /* automatically grant request */
   1006        s->regs[R_DMA_CTRL] |= (DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
   1007        return;
   1008    }
   1009
   1010    /* clear request */
   1011    if (dma_ctrl == 0xDEEA0000) {
   1012        s->regs[R_DMA_CTRL] &= ~(DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
   1013        return;
   1014    }
   1015
   1016    if (!aspeed_smc_dma_granted(s)) {
   1017        aspeed_smc_error("DMA not granted");
   1018        return;
   1019    }
   1020
   1021    aspeed_smc_dma_ctrl(s, dma_ctrl);
   1022    s->regs[R_DMA_CTRL] &= ~(DMA_CTRL_REQUEST | DMA_CTRL_GRANT);
   1023}
   1024
   1025static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
   1026                             unsigned int size)
   1027{
   1028    AspeedSMCState *s = ASPEED_SMC(opaque);
   1029    AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
   1030    uint32_t value = data;
   1031
   1032    trace_aspeed_smc_write(addr, size, data);
   1033
   1034    addr >>= 2;
   1035
   1036    if (addr == s->r_conf ||
   1037        (addr >= s->r_timings &&
   1038         addr < s->r_timings + asc->nregs_timings) ||
   1039        addr == s->r_ce_ctrl) {
   1040        s->regs[addr] = value;
   1041    } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) {
   1042        int cs = addr - s->r_ctrl0;
   1043        aspeed_smc_flash_update_ctrl(&s->flashes[cs], value);
   1044    } else if (addr >= R_SEG_ADDR0 &&
   1045               addr < R_SEG_ADDR0 + asc->max_peripherals) {
   1046        int cs = addr - R_SEG_ADDR0;
   1047
   1048        if (value != s->regs[R_SEG_ADDR0 + cs]) {
   1049            aspeed_smc_flash_set_segment(s, cs, value);
   1050        }
   1051    } else if (addr == R_CE_CMD_CTRL) {
   1052        s->regs[addr] = value & 0xff;
   1053    } else if (addr == R_DUMMY_DATA) {
   1054        s->regs[addr] = value & 0xff;
   1055    } else if (aspeed_smc_has_wdt_control(asc) && addr == R_FMC_WDT2_CTRL) {
   1056        s->regs[addr] = value & FMC_WDT2_CTRL_EN;
   1057    } else if (addr == R_INTR_CTRL) {
   1058        s->regs[addr] = value;
   1059    } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_CTRL) {
   1060        asc->dma_ctrl(s, value);
   1061    } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_DRAM_ADDR &&
   1062               aspeed_smc_dma_granted(s)) {
   1063        s->regs[addr] = DMA_DRAM_ADDR(asc, value);
   1064    } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_FLASH_ADDR &&
   1065               aspeed_smc_dma_granted(s)) {
   1066        s->regs[addr] = DMA_FLASH_ADDR(asc, value);
   1067    } else if (aspeed_smc_has_dma(asc) && addr == R_DMA_LEN &&
   1068               aspeed_smc_dma_granted(s)) {
   1069        s->regs[addr] = DMA_LENGTH(value);
   1070    } else {
   1071        qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
   1072                      __func__, addr);
   1073        return;
   1074    }
   1075}
   1076
   1077static const MemoryRegionOps aspeed_smc_ops = {
   1078    .read = aspeed_smc_read,
   1079    .write = aspeed_smc_write,
   1080    .endianness = DEVICE_LITTLE_ENDIAN,
   1081};
   1082
   1083static void aspeed_smc_instance_init(Object *obj)
   1084{
   1085    AspeedSMCState *s = ASPEED_SMC(obj);
   1086    AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
   1087    int i;
   1088
   1089    for (i = 0; i < asc->max_peripherals; i++) {
   1090        object_initialize_child(obj, "flash[*]", &s->flashes[i],
   1091                                TYPE_ASPEED_SMC_FLASH);
   1092    }
   1093}
   1094
   1095/*
   1096 * Initialize the custom address spaces for DMAs
   1097 */
   1098static void aspeed_smc_dma_setup(AspeedSMCState *s, Error **errp)
   1099{
   1100    if (!s->dram_mr) {
   1101        error_setg(errp, TYPE_ASPEED_SMC ": 'dram' link not set");
   1102        return;
   1103    }
   1104
   1105    address_space_init(&s->flash_as, &s->mmio_flash,
   1106                       TYPE_ASPEED_SMC ".dma-flash");
   1107    address_space_init(&s->dram_as, s->dram_mr,
   1108                       TYPE_ASPEED_SMC ".dma-dram");
   1109}
   1110
   1111static void aspeed_smc_realize(DeviceState *dev, Error **errp)
   1112{
   1113    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
   1114    AspeedSMCState *s = ASPEED_SMC(dev);
   1115    AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
   1116    int i;
   1117    hwaddr offset = 0;
   1118
   1119    /* keep a copy under AspeedSMCState to speed up accesses */
   1120    s->r_conf = asc->r_conf;
   1121    s->r_ce_ctrl = asc->r_ce_ctrl;
   1122    s->r_ctrl0 = asc->r_ctrl0;
   1123    s->r_timings = asc->r_timings;
   1124    s->conf_enable_w0 = asc->conf_enable_w0;
   1125
   1126    /* Enforce some real HW limits */
   1127    if (s->num_cs > asc->max_peripherals) {
   1128        aspeed_smc_error("num_cs cannot exceed: %d", asc->max_peripherals);
   1129        s->num_cs = asc->max_peripherals;
   1130    }
   1131
   1132    /* DMA irq. Keep it first for the initialization in the SoC */
   1133    sysbus_init_irq(sbd, &s->irq);
   1134
   1135    s->spi = ssi_create_bus(dev, "spi");
   1136
   1137    /* Setup cs_lines for peripherals */
   1138    s->cs_lines = g_new0(qemu_irq, s->num_cs);
   1139
   1140    for (i = 0; i < s->num_cs; ++i) {
   1141        sysbus_init_irq(sbd, &s->cs_lines[i]);
   1142    }
   1143
   1144    /* The memory region for the controller registers */
   1145    memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s,
   1146                          TYPE_ASPEED_SMC, asc->nregs * 4);
   1147    sysbus_init_mmio(sbd, &s->mmio);
   1148
   1149    /*
   1150     * The container memory region representing the address space
   1151     * window in which the flash modules are mapped. The size and
   1152     * address depends on the SoC model and controller type.
   1153     */
   1154    memory_region_init_io(&s->mmio_flash, OBJECT(s),
   1155                          &aspeed_smc_flash_default_ops, s,
   1156                          TYPE_ASPEED_SMC ".flash",
   1157                          asc->flash_window_size);
   1158    memory_region_init_alias(&s->mmio_flash_alias, OBJECT(s),
   1159                             TYPE_ASPEED_SMC ".flash",
   1160                             &s->mmio_flash, 0, asc->flash_window_size);
   1161    sysbus_init_mmio(sbd, &s->mmio_flash_alias);
   1162
   1163    /*
   1164     * Let's create a sub memory region for each possible peripheral. All
   1165     * have a configurable memory segment in the overall flash mapping
   1166     * window of the controller but, there is not necessarily a flash
   1167     * module behind to handle the memory accesses. This depends on
   1168     * the board configuration.
   1169     */
   1170    for (i = 0; i < asc->max_peripherals; ++i) {
   1171        AspeedSMCFlash *fl = &s->flashes[i];
   1172
   1173        if (!object_property_set_link(OBJECT(fl), "controller", OBJECT(s),
   1174                                      errp)) {
   1175            return;
   1176        }
   1177        if (!object_property_set_uint(OBJECT(fl), "cs", i, errp)) {
   1178            return;
   1179        }
   1180        if (!sysbus_realize(SYS_BUS_DEVICE(fl), errp)) {
   1181            return;
   1182        }
   1183
   1184        memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio);
   1185        offset += asc->segments[i].size;
   1186    }
   1187
   1188    /* DMA support */
   1189    if (aspeed_smc_has_dma(asc)) {
   1190        aspeed_smc_dma_setup(s, errp);
   1191    }
   1192}
   1193
   1194static const VMStateDescription vmstate_aspeed_smc = {
   1195    .name = "aspeed.smc",
   1196    .version_id = 2,
   1197    .minimum_version_id = 2,
   1198    .fields = (VMStateField[]) {
   1199        VMSTATE_UINT32_ARRAY(regs, AspeedSMCState, ASPEED_SMC_R_MAX),
   1200        VMSTATE_UINT8(snoop_index, AspeedSMCState),
   1201        VMSTATE_UINT8(snoop_dummies, AspeedSMCState),
   1202        VMSTATE_END_OF_LIST()
   1203    }
   1204};
   1205
   1206static Property aspeed_smc_properties[] = {
   1207    DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1),
   1208    DEFINE_PROP_BOOL("inject-failure", AspeedSMCState, inject_failure, false),
   1209    DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
   1210                     TYPE_MEMORY_REGION, MemoryRegion *),
   1211    DEFINE_PROP_END_OF_LIST(),
   1212};
   1213
   1214static void aspeed_smc_class_init(ObjectClass *klass, void *data)
   1215{
   1216    DeviceClass *dc = DEVICE_CLASS(klass);
   1217
   1218    dc->realize = aspeed_smc_realize;
   1219    dc->reset = aspeed_smc_reset;
   1220    device_class_set_props(dc, aspeed_smc_properties);
   1221    dc->vmsd = &vmstate_aspeed_smc;
   1222}
   1223
   1224static const TypeInfo aspeed_smc_info = {
   1225    .name           = TYPE_ASPEED_SMC,
   1226    .parent         = TYPE_SYS_BUS_DEVICE,
   1227    .instance_init  = aspeed_smc_instance_init,
   1228    .instance_size  = sizeof(AspeedSMCState),
   1229    .class_size     = sizeof(AspeedSMCClass),
   1230    .class_init     = aspeed_smc_class_init,
   1231    .abstract       = true,
   1232};
   1233
   1234static void aspeed_smc_flash_realize(DeviceState *dev, Error **errp)
   1235{
   1236    AspeedSMCFlash *s = ASPEED_SMC_FLASH(dev);
   1237    AspeedSMCClass *asc;
   1238    g_autofree char *name = g_strdup_printf(TYPE_ASPEED_SMC_FLASH ".%d", s->cs);
   1239
   1240    if (!s->controller) {
   1241        error_setg(errp, TYPE_ASPEED_SMC_FLASH ": 'controller' link not set");
   1242        return;
   1243    }
   1244
   1245    asc = ASPEED_SMC_GET_CLASS(s->controller);
   1246
   1247    /*
   1248     * Use the default segment value to size the memory region. This
   1249     * can be changed by FW at runtime.
   1250     */
   1251    memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_flash_ops,
   1252                          s, name, asc->segments[s->cs].size);
   1253    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
   1254}
   1255
   1256static Property aspeed_smc_flash_properties[] = {
   1257    DEFINE_PROP_UINT8("cs", AspeedSMCFlash, cs, 0),
   1258    DEFINE_PROP_LINK("controller", AspeedSMCFlash, controller, TYPE_ASPEED_SMC,
   1259                     AspeedSMCState *),
   1260    DEFINE_PROP_END_OF_LIST(),
   1261};
   1262
   1263static void aspeed_smc_flash_class_init(ObjectClass *klass, void *data)
   1264{
   1265    DeviceClass *dc = DEVICE_CLASS(klass);
   1266
   1267    dc->desc = "Aspeed SMC Flash device region";
   1268    dc->realize = aspeed_smc_flash_realize;
   1269    device_class_set_props(dc, aspeed_smc_flash_properties);
   1270}
   1271
   1272static const TypeInfo aspeed_smc_flash_info = {
   1273    .name           = TYPE_ASPEED_SMC_FLASH,
   1274    .parent         = TYPE_SYS_BUS_DEVICE,
   1275    .instance_size  = sizeof(AspeedSMCFlash),
   1276    .class_init     = aspeed_smc_flash_class_init,
   1277};
   1278
   1279/*
   1280 * The Segment Registers of the AST2400 and AST2500 have a 8MB
   1281 * unit. The address range of a flash SPI peripheral is encoded with
   1282 * absolute addresses which should be part of the overall controller
   1283 * window.
   1284 */
   1285static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s,
   1286                                          const AspeedSegments *seg)
   1287{
   1288    uint32_t reg = 0;
   1289    reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT;
   1290    reg |= (((seg->addr + seg->size) >> 23) & SEG_END_MASK) << SEG_END_SHIFT;
   1291    return reg;
   1292}
   1293
   1294static void aspeed_smc_reg_to_segment(const AspeedSMCState *s,
   1295                                      uint32_t reg, AspeedSegments *seg)
   1296{
   1297    seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23;
   1298    seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr;
   1299}
   1300
   1301static const AspeedSegments aspeed_2400_smc_segments[] = {
   1302    { 0x10000000, 32 * MiB },
   1303};
   1304
   1305static void aspeed_2400_smc_class_init(ObjectClass *klass, void *data)
   1306{
   1307    DeviceClass *dc = DEVICE_CLASS(klass);
   1308    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
   1309
   1310    dc->desc               = "Aspeed 2400 SMC Controller";
   1311    asc->r_conf            = R_CONF;
   1312    asc->r_ce_ctrl         = R_CE_CTRL;
   1313    asc->r_ctrl0           = R_CTRL0;
   1314    asc->r_timings         = R_TIMINGS;
   1315    asc->nregs_timings     = 1;
   1316    asc->conf_enable_w0    = CONF_ENABLE_W0;
   1317    asc->max_peripherals   = 1;
   1318    asc->segments          = aspeed_2400_smc_segments;
   1319    asc->flash_window_base = 0x10000000;
   1320    asc->flash_window_size = 0x6000000;
   1321    asc->features          = 0x0;
   1322    asc->nregs             = ASPEED_SMC_R_SMC_MAX;
   1323    asc->segment_to_reg    = aspeed_smc_segment_to_reg;
   1324    asc->reg_to_segment    = aspeed_smc_reg_to_segment;
   1325    asc->dma_ctrl          = aspeed_smc_dma_ctrl;
   1326}
   1327
   1328static const TypeInfo aspeed_2400_smc_info = {
   1329    .name =  "aspeed.smc-ast2400",
   1330    .parent = TYPE_ASPEED_SMC,
   1331    .class_init = aspeed_2400_smc_class_init,
   1332};
   1333
   1334static const uint32_t aspeed_2400_fmc_resets[ASPEED_SMC_R_MAX] = {
   1335    /*
   1336     * CE0 and CE1 types are HW strapped in SCU70. Do it here to
   1337     * simplify the model.
   1338     */
   1339    [R_CONF] = CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0,
   1340};
   1341
   1342static const AspeedSegments aspeed_2400_fmc_segments[] = {
   1343    { 0x20000000, 64 * MiB }, /* start address is readonly */
   1344    { 0x24000000, 32 * MiB },
   1345    { 0x26000000, 32 * MiB },
   1346    { 0x28000000, 32 * MiB },
   1347    { 0x2A000000, 32 * MiB }
   1348};
   1349
   1350static void aspeed_2400_fmc_class_init(ObjectClass *klass, void *data)
   1351{
   1352    DeviceClass *dc = DEVICE_CLASS(klass);
   1353    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
   1354
   1355    dc->desc               = "Aspeed 2400 FMC Controller";
   1356    asc->r_conf            = R_CONF;
   1357    asc->r_ce_ctrl         = R_CE_CTRL;
   1358    asc->r_ctrl0           = R_CTRL0;
   1359    asc->r_timings         = R_TIMINGS;
   1360    asc->nregs_timings     = 1;
   1361    asc->conf_enable_w0    = CONF_ENABLE_W0;
   1362    asc->max_peripherals   = 5;
   1363    asc->segments          = aspeed_2400_fmc_segments;
   1364    asc->resets            = aspeed_2400_fmc_resets;
   1365    asc->flash_window_base = 0x20000000;
   1366    asc->flash_window_size = 0x10000000;
   1367    asc->features          = ASPEED_SMC_FEATURE_DMA;
   1368    asc->dma_flash_mask    = 0x0FFFFFFC;
   1369    asc->dma_dram_mask     = 0x1FFFFFFC;
   1370    asc->nregs             = ASPEED_SMC_R_MAX;
   1371    asc->segment_to_reg    = aspeed_smc_segment_to_reg;
   1372    asc->reg_to_segment    = aspeed_smc_reg_to_segment;
   1373    asc->dma_ctrl          = aspeed_smc_dma_ctrl;
   1374}
   1375
   1376static const TypeInfo aspeed_2400_fmc_info = {
   1377    .name =  "aspeed.fmc-ast2400",
   1378    .parent = TYPE_ASPEED_SMC,
   1379    .class_init = aspeed_2400_fmc_class_init,
   1380};
   1381
   1382static const AspeedSegments aspeed_2400_spi1_segments[] = {
   1383    { 0x30000000, 64 * MiB },
   1384};
   1385
   1386static int aspeed_2400_spi1_addr_width(const AspeedSMCState *s)
   1387{
   1388    return s->regs[R_SPI_CTRL0] & CTRL_AST2400_SPI_4BYTE ? 4 : 3;
   1389}
   1390
   1391static void aspeed_2400_spi1_class_init(ObjectClass *klass, void *data)
   1392{
   1393    DeviceClass *dc = DEVICE_CLASS(klass);
   1394    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
   1395
   1396    dc->desc               = "Aspeed 2400 SPI1 Controller";
   1397    asc->r_conf            = R_SPI_CONF;
   1398    asc->r_ce_ctrl         = 0xff;
   1399    asc->r_ctrl0           = R_SPI_CTRL0;
   1400    asc->r_timings         = R_SPI_TIMINGS;
   1401    asc->nregs_timings     = 1;
   1402    asc->conf_enable_w0    = SPI_CONF_ENABLE_W0;
   1403    asc->max_peripherals   = 1;
   1404    asc->segments          = aspeed_2400_spi1_segments;
   1405    asc->flash_window_base = 0x30000000;
   1406    asc->flash_window_size = 0x10000000;
   1407    asc->features          = 0x0;
   1408    asc->nregs             = ASPEED_SMC_R_SPI_MAX;
   1409    asc->segment_to_reg    = aspeed_smc_segment_to_reg;
   1410    asc->reg_to_segment    = aspeed_smc_reg_to_segment;
   1411    asc->dma_ctrl          = aspeed_smc_dma_ctrl;
   1412    asc->addr_width        = aspeed_2400_spi1_addr_width;
   1413}
   1414
   1415static const TypeInfo aspeed_2400_spi1_info = {
   1416    .name =  "aspeed.spi1-ast2400",
   1417    .parent = TYPE_ASPEED_SMC,
   1418    .class_init = aspeed_2400_spi1_class_init,
   1419};
   1420
   1421static const uint32_t aspeed_2500_fmc_resets[ASPEED_SMC_R_MAX] = {
   1422    [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
   1423                CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
   1424};
   1425
   1426static const AspeedSegments aspeed_2500_fmc_segments[] = {
   1427    { 0x20000000, 128 * MiB }, /* start address is readonly */
   1428    { 0x28000000,  32 * MiB },
   1429    { 0x2A000000,  32 * MiB },
   1430};
   1431
   1432static void aspeed_2500_fmc_class_init(ObjectClass *klass, void *data)
   1433{
   1434    DeviceClass *dc = DEVICE_CLASS(klass);
   1435    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
   1436
   1437    dc->desc               = "Aspeed 2600 FMC Controller";
   1438    asc->r_conf            = R_CONF;
   1439    asc->r_ce_ctrl         = R_CE_CTRL;
   1440    asc->r_ctrl0           = R_CTRL0;
   1441    asc->r_timings         = R_TIMINGS;
   1442    asc->nregs_timings     = 1;
   1443    asc->conf_enable_w0    = CONF_ENABLE_W0;
   1444    asc->max_peripherals   = 3;
   1445    asc->segments          = aspeed_2500_fmc_segments;
   1446    asc->resets            = aspeed_2500_fmc_resets;
   1447    asc->flash_window_base = 0x20000000;
   1448    asc->flash_window_size = 0x10000000;
   1449    asc->features          = ASPEED_SMC_FEATURE_DMA;
   1450    asc->dma_flash_mask    = 0x0FFFFFFC;
   1451    asc->dma_dram_mask     = 0x3FFFFFFC;
   1452    asc->nregs             = ASPEED_SMC_R_MAX;
   1453    asc->segment_to_reg    = aspeed_smc_segment_to_reg;
   1454    asc->reg_to_segment    = aspeed_smc_reg_to_segment;
   1455    asc->dma_ctrl          = aspeed_smc_dma_ctrl;
   1456}
   1457
   1458static const TypeInfo aspeed_2500_fmc_info = {
   1459    .name =  "aspeed.fmc-ast2500",
   1460    .parent = TYPE_ASPEED_SMC,
   1461    .class_init = aspeed_2500_fmc_class_init,
   1462};
   1463
   1464static const AspeedSegments aspeed_2500_spi1_segments[] = {
   1465    { 0x30000000, 32 * MiB }, /* start address is readonly */
   1466    { 0x32000000, 96 * MiB }, /* end address is readonly */
   1467};
   1468
   1469static void aspeed_2500_spi1_class_init(ObjectClass *klass, void *data)
   1470{
   1471    DeviceClass *dc = DEVICE_CLASS(klass);
   1472    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
   1473
   1474    dc->desc               = "Aspeed 2600 SPI1 Controller";
   1475    asc->r_conf            = R_CONF;
   1476    asc->r_ce_ctrl         = R_CE_CTRL;
   1477    asc->r_ctrl0           = R_CTRL0;
   1478    asc->r_timings         = R_TIMINGS;
   1479    asc->nregs_timings     = 1;
   1480    asc->conf_enable_w0    = CONF_ENABLE_W0;
   1481    asc->max_peripherals   = 2;
   1482    asc->segments          = aspeed_2500_spi1_segments;
   1483    asc->flash_window_base = 0x30000000;
   1484    asc->flash_window_size = 0x8000000;
   1485    asc->features          = 0x0;
   1486    asc->nregs             = ASPEED_SMC_R_MAX;
   1487    asc->segment_to_reg    = aspeed_smc_segment_to_reg;
   1488    asc->reg_to_segment    = aspeed_smc_reg_to_segment;
   1489    asc->dma_ctrl          = aspeed_smc_dma_ctrl;
   1490}
   1491
   1492static const TypeInfo aspeed_2500_spi1_info = {
   1493    .name =  "aspeed.spi1-ast2500",
   1494    .parent = TYPE_ASPEED_SMC,
   1495    .class_init = aspeed_2500_spi1_class_init,
   1496};
   1497
   1498static const AspeedSegments aspeed_2500_spi2_segments[] = {
   1499    { 0x38000000, 32 * MiB }, /* start address is readonly */
   1500    { 0x3A000000, 96 * MiB }, /* end address is readonly */
   1501};
   1502
   1503static void aspeed_2500_spi2_class_init(ObjectClass *klass, void *data)
   1504{
   1505    DeviceClass *dc = DEVICE_CLASS(klass);
   1506    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
   1507
   1508    dc->desc               = "Aspeed 2600 SPI2 Controller";
   1509    asc->r_conf            = R_CONF;
   1510    asc->r_ce_ctrl         = R_CE_CTRL;
   1511    asc->r_ctrl0           = R_CTRL0;
   1512    asc->r_timings         = R_TIMINGS;
   1513    asc->nregs_timings     = 1;
   1514    asc->conf_enable_w0    = CONF_ENABLE_W0;
   1515    asc->max_peripherals   = 2;
   1516    asc->segments          = aspeed_2500_spi2_segments;
   1517    asc->flash_window_base = 0x38000000;
   1518    asc->flash_window_size = 0x8000000;
   1519    asc->features          = 0x0;
   1520    asc->nregs             = ASPEED_SMC_R_MAX;
   1521    asc->segment_to_reg    = aspeed_smc_segment_to_reg;
   1522    asc->reg_to_segment    = aspeed_smc_reg_to_segment;
   1523    asc->dma_ctrl          = aspeed_smc_dma_ctrl;
   1524}
   1525
   1526static const TypeInfo aspeed_2500_spi2_info = {
   1527    .name =  "aspeed.spi2-ast2500",
   1528    .parent = TYPE_ASPEED_SMC,
   1529    .class_init = aspeed_2500_spi2_class_init,
   1530};
   1531
   1532/*
   1533 * The Segment Registers of the AST2600 have a 1MB unit. The address
   1534 * range of a flash SPI peripheral is encoded with offsets in the overall
   1535 * controller window. The previous SoC AST2400 and AST2500 used
   1536 * absolute addresses. Only bits [27:20] are relevant and the end
   1537 * address is an upper bound limit.
   1538 */
   1539#define AST2600_SEG_ADDR_MASK 0x0ff00000
   1540
   1541static uint32_t aspeed_2600_smc_segment_to_reg(const AspeedSMCState *s,
   1542                                               const AspeedSegments *seg)
   1543{
   1544    uint32_t reg = 0;
   1545
   1546    /* Disabled segments have a nil register */
   1547    if (!seg->size) {
   1548        return 0;
   1549    }
   1550
   1551    reg |= (seg->addr & AST2600_SEG_ADDR_MASK) >> 16; /* start offset */
   1552    reg |= (seg->addr + seg->size - 1) & AST2600_SEG_ADDR_MASK; /* end offset */
   1553    return reg;
   1554}
   1555
   1556static void aspeed_2600_smc_reg_to_segment(const AspeedSMCState *s,
   1557                                           uint32_t reg, AspeedSegments *seg)
   1558{
   1559    uint32_t start_offset = (reg << 16) & AST2600_SEG_ADDR_MASK;
   1560    uint32_t end_offset = reg & AST2600_SEG_ADDR_MASK;
   1561    AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
   1562
   1563    if (reg) {
   1564        seg->addr = asc->flash_window_base + start_offset;
   1565        seg->size = end_offset + MiB - start_offset;
   1566    } else {
   1567        seg->addr = asc->flash_window_base;
   1568        seg->size = 0;
   1569    }
   1570}
   1571
   1572static const uint32_t aspeed_2600_fmc_resets[ASPEED_SMC_R_MAX] = {
   1573    [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
   1574                CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1 |
   1575                CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE2),
   1576};
   1577
   1578static const AspeedSegments aspeed_2600_fmc_segments[] = {
   1579    { 0x0, 128 * MiB }, /* start address is readonly */
   1580    { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
   1581    { 0x0, 0 }, /* disabled */
   1582};
   1583
   1584static void aspeed_2600_fmc_class_init(ObjectClass *klass, void *data)
   1585{
   1586    DeviceClass *dc = DEVICE_CLASS(klass);
   1587    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
   1588
   1589    dc->desc               = "Aspeed 2600 FMC Controller";
   1590    asc->r_conf            = R_CONF;
   1591    asc->r_ce_ctrl         = R_CE_CTRL;
   1592    asc->r_ctrl0           = R_CTRL0;
   1593    asc->r_timings         = R_TIMINGS;
   1594    asc->nregs_timings     = 1;
   1595    asc->conf_enable_w0    = CONF_ENABLE_W0;
   1596    asc->max_peripherals   = 3;
   1597    asc->segments          = aspeed_2600_fmc_segments;
   1598    asc->resets            = aspeed_2600_fmc_resets;
   1599    asc->flash_window_base = 0x20000000;
   1600    asc->flash_window_size = 0x10000000;
   1601    asc->features          = ASPEED_SMC_FEATURE_DMA |
   1602                             ASPEED_SMC_FEATURE_WDT_CONTROL;
   1603    asc->dma_flash_mask    = 0x0FFFFFFC;
   1604    asc->dma_dram_mask     = 0x3FFFFFFC;
   1605    asc->nregs             = ASPEED_SMC_R_MAX;
   1606    asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
   1607    asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
   1608    asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
   1609}
   1610
   1611static const TypeInfo aspeed_2600_fmc_info = {
   1612    .name =  "aspeed.fmc-ast2600",
   1613    .parent = TYPE_ASPEED_SMC,
   1614    .class_init = aspeed_2600_fmc_class_init,
   1615};
   1616
   1617static const AspeedSegments aspeed_2600_spi1_segments[] = {
   1618    { 0x0, 128 * MiB }, /* start address is readonly */
   1619    { 0x0, 0 }, /* disabled */
   1620};
   1621
   1622static void aspeed_2600_spi1_class_init(ObjectClass *klass, void *data)
   1623{
   1624    DeviceClass *dc = DEVICE_CLASS(klass);
   1625    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
   1626
   1627    dc->desc               = "Aspeed 2600 SPI1 Controller";
   1628    asc->r_conf            = R_CONF;
   1629    asc->r_ce_ctrl         = R_CE_CTRL;
   1630    asc->r_ctrl0           = R_CTRL0;
   1631    asc->r_timings         = R_TIMINGS;
   1632    asc->nregs_timings     = 2;
   1633    asc->conf_enable_w0    = CONF_ENABLE_W0;
   1634    asc->max_peripherals   = 2;
   1635    asc->segments          = aspeed_2600_spi1_segments;
   1636    asc->flash_window_base = 0x30000000;
   1637    asc->flash_window_size = 0x10000000;
   1638    asc->features          = ASPEED_SMC_FEATURE_DMA |
   1639                             ASPEED_SMC_FEATURE_DMA_GRANT;
   1640    asc->dma_flash_mask    = 0x0FFFFFFC;
   1641    asc->dma_dram_mask     = 0x3FFFFFFC;
   1642    asc->nregs             = ASPEED_SMC_R_MAX;
   1643    asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
   1644    asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
   1645    asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
   1646}
   1647
   1648static const TypeInfo aspeed_2600_spi1_info = {
   1649    .name =  "aspeed.spi1-ast2600",
   1650    .parent = TYPE_ASPEED_SMC,
   1651    .class_init = aspeed_2600_spi1_class_init,
   1652};
   1653
   1654static const AspeedSegments aspeed_2600_spi2_segments[] = {
   1655    { 0x0, 128 * MiB }, /* start address is readonly */
   1656    { 0x0, 0 }, /* disabled */
   1657    { 0x0, 0 }, /* disabled */
   1658};
   1659
   1660static void aspeed_2600_spi2_class_init(ObjectClass *klass, void *data)
   1661{
   1662    DeviceClass *dc = DEVICE_CLASS(klass);
   1663    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
   1664
   1665    dc->desc               = "Aspeed 2600 SPI2 Controller";
   1666    asc->r_conf            = R_CONF;
   1667    asc->r_ce_ctrl         = R_CE_CTRL;
   1668    asc->r_ctrl0           = R_CTRL0;
   1669    asc->r_timings         = R_TIMINGS;
   1670    asc->nregs_timings     = 3;
   1671    asc->conf_enable_w0    = CONF_ENABLE_W0;
   1672    asc->max_peripherals   = 3;
   1673    asc->segments          = aspeed_2600_spi2_segments;
   1674    asc->flash_window_base = 0x50000000;
   1675    asc->flash_window_size = 0x10000000;
   1676    asc->features          = ASPEED_SMC_FEATURE_DMA |
   1677                             ASPEED_SMC_FEATURE_DMA_GRANT;
   1678    asc->dma_flash_mask    = 0x0FFFFFFC;
   1679    asc->dma_dram_mask     = 0x3FFFFFFC;
   1680    asc->nregs             = ASPEED_SMC_R_MAX;
   1681    asc->segment_to_reg    = aspeed_2600_smc_segment_to_reg;
   1682    asc->reg_to_segment    = aspeed_2600_smc_reg_to_segment;
   1683    asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
   1684}
   1685
   1686static const TypeInfo aspeed_2600_spi2_info = {
   1687    .name =  "aspeed.spi2-ast2600",
   1688    .parent = TYPE_ASPEED_SMC,
   1689    .class_init = aspeed_2600_spi2_class_init,
   1690};
   1691
   1692static void aspeed_smc_register_types(void)
   1693{
   1694    type_register_static(&aspeed_smc_flash_info);
   1695    type_register_static(&aspeed_smc_info);
   1696    type_register_static(&aspeed_2400_smc_info);
   1697    type_register_static(&aspeed_2400_fmc_info);
   1698    type_register_static(&aspeed_2400_spi1_info);
   1699    type_register_static(&aspeed_2500_fmc_info);
   1700    type_register_static(&aspeed_2500_spi1_info);
   1701    type_register_static(&aspeed_2500_spi2_info);
   1702    type_register_static(&aspeed_2600_fmc_info);
   1703    type_register_static(&aspeed_2600_spi1_info);
   1704    type_register_static(&aspeed_2600_spi2_info);
   1705}
   1706
   1707type_init(aspeed_smc_register_types)