cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

xilinx_spips.c (49239B)


      1/*
      2 * QEMU model of the Xilinx Zynq SPI controller
      3 *
      4 * Copyright (c) 2012 Peter A. G. Crosthwaite
      5 *
      6 * Permission is hereby granted, free of charge, to any person obtaining a copy
      7 * of this software and associated documentation files (the "Software"), to deal
      8 * in the Software without restriction, including without limitation the rights
      9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     10 * copies of the Software, and to permit persons to whom the Software is
     11 * furnished to do so, subject to the following conditions:
     12 *
     13 * The above copyright notice and this permission notice shall be included in
     14 * all copies or substantial portions of the Software.
     15 *
     16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     22 * THE SOFTWARE.
     23 */
     24
     25#include "qemu/osdep.h"
     26#include "hw/sysbus.h"
     27#include "hw/irq.h"
     28#include "hw/ptimer.h"
     29#include "hw/qdev-properties.h"
     30#include "qemu/log.h"
     31#include "qemu/module.h"
     32#include "qemu/bitops.h"
     33#include "hw/ssi/xilinx_spips.h"
     34#include "qapi/error.h"
     35#include "hw/register.h"
     36#include "sysemu/dma.h"
     37#include "migration/blocker.h"
     38#include "migration/vmstate.h"
     39
     40#ifndef XILINX_SPIPS_ERR_DEBUG
     41#define XILINX_SPIPS_ERR_DEBUG 0
     42#endif
     43
     44#define DB_PRINT_L(level, ...) do { \
     45    if (XILINX_SPIPS_ERR_DEBUG > (level)) { \
     46        fprintf(stderr,  ": %s: ", __func__); \
     47        fprintf(stderr, ## __VA_ARGS__); \
     48    } \
     49} while (0)
     50
     51/* config register */
     52#define R_CONFIG            (0x00 / 4)
     53#define IFMODE              (1U << 31)
     54#define R_CONFIG_ENDIAN     (1 << 26)
     55#define MODEFAIL_GEN_EN     (1 << 17)
     56#define MAN_START_COM       (1 << 16)
     57#define MAN_START_EN        (1 << 15)
     58#define MANUAL_CS           (1 << 14)
     59#define CS                  (0xF << 10)
     60#define CS_SHIFT            (10)
     61#define PERI_SEL            (1 << 9)
     62#define REF_CLK             (1 << 8)
     63#define FIFO_WIDTH          (3 << 6)
     64#define BAUD_RATE_DIV       (7 << 3)
     65#define CLK_PH              (1 << 2)
     66#define CLK_POL             (1 << 1)
     67#define MODE_SEL            (1 << 0)
     68#define R_CONFIG_RSVD       (0x7bf40000)
     69
     70/* interrupt mechanism */
     71#define R_INTR_STATUS       (0x04 / 4)
     72#define R_INTR_STATUS_RESET (0x104)
     73#define R_INTR_EN           (0x08 / 4)
     74#define R_INTR_DIS          (0x0C / 4)
     75#define R_INTR_MASK         (0x10 / 4)
     76#define IXR_TX_FIFO_UNDERFLOW   (1 << 6)
     77/* Poll timeout not implemented */
     78#define IXR_RX_FIFO_EMPTY       (1 << 11)
     79#define IXR_GENERIC_FIFO_FULL   (1 << 10)
     80#define IXR_GENERIC_FIFO_NOT_FULL (1 << 9)
     81#define IXR_TX_FIFO_EMPTY       (1 << 8)
     82#define IXR_GENERIC_FIFO_EMPTY  (1 << 7)
     83#define IXR_RX_FIFO_FULL        (1 << 5)
     84#define IXR_RX_FIFO_NOT_EMPTY   (1 << 4)
     85#define IXR_TX_FIFO_FULL        (1 << 3)
     86#define IXR_TX_FIFO_NOT_FULL    (1 << 2)
     87#define IXR_TX_FIFO_MODE_FAIL   (1 << 1)
     88#define IXR_RX_FIFO_OVERFLOW    (1 << 0)
     89#define IXR_ALL                 ((1 << 13) - 1)
     90#define GQSPI_IXR_MASK          0xFBE
     91#define IXR_SELF_CLEAR \
     92(IXR_GENERIC_FIFO_EMPTY \
     93| IXR_GENERIC_FIFO_FULL  \
     94| IXR_GENERIC_FIFO_NOT_FULL \
     95| IXR_TX_FIFO_EMPTY \
     96| IXR_TX_FIFO_FULL  \
     97| IXR_TX_FIFO_NOT_FULL \
     98| IXR_RX_FIFO_EMPTY \
     99| IXR_RX_FIFO_FULL  \
    100| IXR_RX_FIFO_NOT_EMPTY)
    101
    102#define R_EN                (0x14 / 4)
    103#define R_DELAY             (0x18 / 4)
    104#define R_TX_DATA           (0x1C / 4)
    105#define R_RX_DATA           (0x20 / 4)
    106#define R_SLAVE_IDLE_COUNT  (0x24 / 4)
    107#define R_TX_THRES          (0x28 / 4)
    108#define R_RX_THRES          (0x2C / 4)
    109#define R_GPIO              (0x30 / 4)
    110#define R_LPBK_DLY_ADJ      (0x38 / 4)
    111#define R_LPBK_DLY_ADJ_RESET (0x33)
    112#define R_IOU_TAPDLY_BYPASS (0x3C / 4)
    113#define R_TXD1              (0x80 / 4)
    114#define R_TXD2              (0x84 / 4)
    115#define R_TXD3              (0x88 / 4)
    116
    117#define R_LQSPI_CFG         (0xa0 / 4)
    118#define R_LQSPI_CFG_RESET       0x03A002EB
    119#define LQSPI_CFG_LQ_MODE       (1U << 31)
    120#define LQSPI_CFG_TWO_MEM       (1 << 30)
    121#define LQSPI_CFG_SEP_BUS       (1 << 29)
    122#define LQSPI_CFG_U_PAGE        (1 << 28)
    123#define LQSPI_CFG_ADDR4         (1 << 27)
    124#define LQSPI_CFG_MODE_EN       (1 << 25)
    125#define LQSPI_CFG_MODE_WIDTH    8
    126#define LQSPI_CFG_MODE_SHIFT    16
    127#define LQSPI_CFG_DUMMY_WIDTH   3
    128#define LQSPI_CFG_DUMMY_SHIFT   8
    129#define LQSPI_CFG_INST_CODE     0xFF
    130
    131#define R_CMND        (0xc0 / 4)
    132    #define R_CMND_RXFIFO_DRAIN   (1 << 19)
    133    FIELD(CMND, PARTIAL_BYTE_LEN, 16, 3)
    134#define R_CMND_EXT_ADD        (1 << 15)
    135    FIELD(CMND, RX_DISCARD, 8, 7)
    136    FIELD(CMND, DUMMY_CYCLES, 2, 6)
    137#define R_CMND_DMA_EN         (1 << 1)
    138#define R_CMND_PUSH_WAIT      (1 << 0)
    139#define R_TRANSFER_SIZE     (0xc4 / 4)
    140#define R_LQSPI_STS         (0xA4 / 4)
    141#define LQSPI_STS_WR_RECVD      (1 << 1)
    142
    143#define R_DUMMY_CYCLE_EN    (0xC8 / 4)
    144#define R_ECO               (0xF8 / 4)
    145#define R_MOD_ID            (0xFC / 4)
    146
    147#define R_GQSPI_SELECT          (0x144 / 4)
    148    FIELD(GQSPI_SELECT, GENERIC_QSPI_EN, 0, 1)
    149#define R_GQSPI_ISR         (0x104 / 4)
    150#define R_GQSPI_IER         (0x108 / 4)
    151#define R_GQSPI_IDR         (0x10c / 4)
    152#define R_GQSPI_IMR         (0x110 / 4)
    153#define R_GQSPI_IMR_RESET   (0xfbe)
    154#define R_GQSPI_TX_THRESH   (0x128 / 4)
    155#define R_GQSPI_RX_THRESH   (0x12c / 4)
    156#define R_GQSPI_GPIO (0x130 / 4)
    157#define R_GQSPI_LPBK_DLY_ADJ (0x138 / 4)
    158#define R_GQSPI_LPBK_DLY_ADJ_RESET (0x33)
    159#define R_GQSPI_CNFG        (0x100 / 4)
    160    FIELD(GQSPI_CNFG, MODE_EN, 30, 2)
    161    FIELD(GQSPI_CNFG, GEN_FIFO_START_MODE, 29, 1)
    162    FIELD(GQSPI_CNFG, GEN_FIFO_START, 28, 1)
    163    FIELD(GQSPI_CNFG, ENDIAN, 26, 1)
    164    /* Poll timeout not implemented */
    165    FIELD(GQSPI_CNFG, EN_POLL_TIMEOUT, 20, 1)
    166    /* QEMU doesnt care about any of these last three */
    167    FIELD(GQSPI_CNFG, BR, 3, 3)
    168    FIELD(GQSPI_CNFG, CPH, 2, 1)
    169    FIELD(GQSPI_CNFG, CPL, 1, 1)
    170#define R_GQSPI_GEN_FIFO        (0x140 / 4)
    171#define R_GQSPI_TXD             (0x11c / 4)
    172#define R_GQSPI_RXD             (0x120 / 4)
    173#define R_GQSPI_FIFO_CTRL       (0x14c / 4)
    174    FIELD(GQSPI_FIFO_CTRL, RX_FIFO_RESET, 2, 1)
    175    FIELD(GQSPI_FIFO_CTRL, TX_FIFO_RESET, 1, 1)
    176    FIELD(GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET, 0, 1)
    177#define R_GQSPI_GFIFO_THRESH    (0x150 / 4)
    178#define R_GQSPI_DATA_STS (0x15c / 4)
    179/*
    180 * We use the snapshot register to hold the core state for the currently
    181 * or most recently executed command. So the generic fifo format is defined
    182 * for the snapshot register
    183 */
    184#define R_GQSPI_GF_SNAPSHOT (0x160 / 4)
    185    FIELD(GQSPI_GF_SNAPSHOT, POLL, 19, 1)
    186    FIELD(GQSPI_GF_SNAPSHOT, STRIPE, 18, 1)
    187    FIELD(GQSPI_GF_SNAPSHOT, RECIEVE, 17, 1)
    188    FIELD(GQSPI_GF_SNAPSHOT, TRANSMIT, 16, 1)
    189    FIELD(GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT, 14, 2)
    190    FIELD(GQSPI_GF_SNAPSHOT, CHIP_SELECT, 12, 2)
    191    FIELD(GQSPI_GF_SNAPSHOT, SPI_MODE, 10, 2)
    192    FIELD(GQSPI_GF_SNAPSHOT, EXPONENT, 9, 1)
    193    FIELD(GQSPI_GF_SNAPSHOT, DATA_XFER, 8, 1)
    194    FIELD(GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA, 0, 8)
    195#define R_GQSPI_MOD_ID        (0x1fc / 4)
    196#define R_GQSPI_MOD_ID_RESET  (0x10a0000)
    197
    198/* size of TXRX FIFOs */
    199#define RXFF_A          (128)
    200#define TXFF_A          (128)
    201
    202#define RXFF_A_Q          (64 * 4)
    203#define TXFF_A_Q          (64 * 4)
    204
    205/* 16MB per linear region */
    206#define LQSPI_ADDRESS_BITS 24
    207
    208#define SNOOP_CHECKING 0xFF
    209#define SNOOP_ADDR 0xF0
    210#define SNOOP_NONE 0xEE
    211#define SNOOP_STRIPING 0
    212
    213#define MIN_NUM_BUSSES 1
    214#define MAX_NUM_BUSSES 2
    215
    216static inline int num_effective_busses(XilinxSPIPS *s)
    217{
    218    return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
    219            s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM) ? s->num_busses : 1;
    220}
    221
    222static void xilinx_spips_update_cs(XilinxSPIPS *s, int field)
    223{
    224    int i;
    225
    226    for (i = 0; i < s->num_cs * s->num_busses; i++) {
    227        bool old_state = s->cs_lines_state[i];
    228        bool new_state = field & (1 << i);
    229
    230        if (old_state != new_state) {
    231            s->cs_lines_state[i] = new_state;
    232            s->rx_discard = ARRAY_FIELD_EX32(s->regs, CMND, RX_DISCARD);
    233            DB_PRINT_L(1, "%sselecting peripheral %d\n",
    234                       new_state ? "" : "de", i);
    235        }
    236        qemu_set_irq(s->cs_lines[i], !new_state);
    237    }
    238    if (!(field & ((1 << (s->num_cs * s->num_busses)) - 1))) {
    239        s->snoop_state = SNOOP_CHECKING;
    240        s->cmd_dummies = 0;
    241        s->link_state = 1;
    242        s->link_state_next = 1;
    243        s->link_state_next_when = 0;
    244        DB_PRINT_L(1, "moving to snoop check state\n");
    245    }
    246}
    247
    248static void xlnx_zynqmp_qspips_update_cs_lines(XlnxZynqMPQSPIPS *s)
    249{
    250    if (s->regs[R_GQSPI_GF_SNAPSHOT]) {
    251        int field = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, CHIP_SELECT);
    252        bool upper_cs_sel = field & (1 << 1);
    253        bool lower_cs_sel = field & 1;
    254        bool bus0_enabled;
    255        bool bus1_enabled;
    256        uint8_t buses;
    257        int cs = 0;
    258
    259        buses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
    260        bus0_enabled = buses & 1;
    261        bus1_enabled = buses & (1 << 1);
    262
    263        if (bus0_enabled && bus1_enabled) {
    264            if (lower_cs_sel) {
    265                cs |= 1;
    266            }
    267            if (upper_cs_sel) {
    268                cs |= 1 << 3;
    269            }
    270        } else if (bus0_enabled) {
    271            if (lower_cs_sel) {
    272                cs |= 1;
    273            }
    274            if (upper_cs_sel) {
    275                cs |= 1 << 1;
    276            }
    277        } else if (bus1_enabled) {
    278            if (lower_cs_sel) {
    279                cs |= 1 << 2;
    280            }
    281            if (upper_cs_sel) {
    282                cs |= 1 << 3;
    283            }
    284        }
    285        xilinx_spips_update_cs(XILINX_SPIPS(s), cs);
    286    }
    287}
    288
    289static void xilinx_spips_update_cs_lines(XilinxSPIPS *s)
    290{
    291    int field = ~((s->regs[R_CONFIG] & CS) >> CS_SHIFT);
    292
    293    /* In dual parallel, mirror low CS to both */
    294    if (num_effective_busses(s) == 2) {
    295        /* Single bit chip-select for qspi */
    296        field &= 0x1;
    297        field |= field << 3;
    298    /* Dual stack U-Page */
    299    } else if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM &&
    300               s->regs[R_LQSPI_STS] & LQSPI_CFG_U_PAGE) {
    301        /* Single bit chip-select for qspi */
    302        field &= 0x1;
    303        /* change from CS0 to CS1 */
    304        field <<= 1;
    305    }
    306    /* Auto CS */
    307    if (!(s->regs[R_CONFIG] & MANUAL_CS) &&
    308        fifo8_is_empty(&s->tx_fifo)) {
    309        field = 0;
    310    }
    311    xilinx_spips_update_cs(s, field);
    312}
    313
    314static void xilinx_spips_update_ixr(XilinxSPIPS *s)
    315{
    316    if (!(s->regs[R_LQSPI_CFG] & LQSPI_CFG_LQ_MODE)) {
    317        s->regs[R_INTR_STATUS] &= ~IXR_SELF_CLEAR;
    318        s->regs[R_INTR_STATUS] |=
    319            (fifo8_is_full(&s->rx_fifo) ? IXR_RX_FIFO_FULL : 0) |
    320            (s->rx_fifo.num >= s->regs[R_RX_THRES] ?
    321                                    IXR_RX_FIFO_NOT_EMPTY : 0) |
    322            (fifo8_is_full(&s->tx_fifo) ? IXR_TX_FIFO_FULL : 0) |
    323            (fifo8_is_empty(&s->tx_fifo) ? IXR_TX_FIFO_EMPTY : 0) |
    324            (s->tx_fifo.num < s->regs[R_TX_THRES] ? IXR_TX_FIFO_NOT_FULL : 0);
    325    }
    326    int new_irqline = !!(s->regs[R_INTR_MASK] & s->regs[R_INTR_STATUS] &
    327                                                                IXR_ALL);
    328    if (new_irqline != s->irqline) {
    329        s->irqline = new_irqline;
    330        qemu_set_irq(s->irq, s->irqline);
    331    }
    332}
    333
    334static void xlnx_zynqmp_qspips_update_ixr(XlnxZynqMPQSPIPS *s)
    335{
    336    uint32_t gqspi_int;
    337    int new_irqline;
    338
    339    s->regs[R_GQSPI_ISR] &= ~IXR_SELF_CLEAR;
    340    s->regs[R_GQSPI_ISR] |=
    341        (fifo32_is_empty(&s->fifo_g) ? IXR_GENERIC_FIFO_EMPTY : 0) |
    342        (fifo32_is_full(&s->fifo_g) ? IXR_GENERIC_FIFO_FULL : 0) |
    343        (s->fifo_g.fifo.num < s->regs[R_GQSPI_GFIFO_THRESH] ?
    344                                    IXR_GENERIC_FIFO_NOT_FULL : 0) |
    345        (fifo8_is_empty(&s->rx_fifo_g) ? IXR_RX_FIFO_EMPTY : 0) |
    346        (fifo8_is_full(&s->rx_fifo_g) ? IXR_RX_FIFO_FULL : 0) |
    347        (s->rx_fifo_g.num >= s->regs[R_GQSPI_RX_THRESH] ?
    348                                    IXR_RX_FIFO_NOT_EMPTY : 0) |
    349        (fifo8_is_empty(&s->tx_fifo_g) ? IXR_TX_FIFO_EMPTY : 0) |
    350        (fifo8_is_full(&s->tx_fifo_g) ? IXR_TX_FIFO_FULL : 0) |
    351        (s->tx_fifo_g.num < s->regs[R_GQSPI_TX_THRESH] ?
    352                                    IXR_TX_FIFO_NOT_FULL : 0);
    353
    354    /* GQSPI Interrupt Trigger Status */
    355    gqspi_int = (~s->regs[R_GQSPI_IMR]) & s->regs[R_GQSPI_ISR] & GQSPI_IXR_MASK;
    356    new_irqline = !!(gqspi_int & IXR_ALL);
    357
    358    /* drive external interrupt pin */
    359    if (new_irqline != s->gqspi_irqline) {
    360        s->gqspi_irqline = new_irqline;
    361        qemu_set_irq(XILINX_SPIPS(s)->irq, s->gqspi_irqline);
    362    }
    363}
    364
    365static void xilinx_spips_reset(DeviceState *d)
    366{
    367    XilinxSPIPS *s = XILINX_SPIPS(d);
    368
    369    memset(s->regs, 0, sizeof(s->regs));
    370
    371    fifo8_reset(&s->rx_fifo);
    372    fifo8_reset(&s->rx_fifo);
    373    /* non zero resets */
    374    s->regs[R_CONFIG] |= MODEFAIL_GEN_EN;
    375    s->regs[R_SLAVE_IDLE_COUNT] = 0xFF;
    376    s->regs[R_TX_THRES] = 1;
    377    s->regs[R_RX_THRES] = 1;
    378    /* FIXME: move magic number definition somewhere sensible */
    379    s->regs[R_MOD_ID] = 0x01090106;
    380    s->regs[R_LQSPI_CFG] = R_LQSPI_CFG_RESET;
    381    s->link_state = 1;
    382    s->link_state_next = 1;
    383    s->link_state_next_when = 0;
    384    s->snoop_state = SNOOP_CHECKING;
    385    s->cmd_dummies = 0;
    386    s->man_start_com = false;
    387    xilinx_spips_update_ixr(s);
    388    xilinx_spips_update_cs_lines(s);
    389}
    390
    391static void xlnx_zynqmp_qspips_reset(DeviceState *d)
    392{
    393    XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(d);
    394
    395    xilinx_spips_reset(d);
    396
    397    memset(s->regs, 0, sizeof(s->regs));
    398
    399    fifo8_reset(&s->rx_fifo_g);
    400    fifo8_reset(&s->rx_fifo_g);
    401    fifo32_reset(&s->fifo_g);
    402    s->regs[R_INTR_STATUS] = R_INTR_STATUS_RESET;
    403    s->regs[R_GPIO] = 1;
    404    s->regs[R_LPBK_DLY_ADJ] = R_LPBK_DLY_ADJ_RESET;
    405    s->regs[R_GQSPI_GFIFO_THRESH] = 0x10;
    406    s->regs[R_MOD_ID] = 0x01090101;
    407    s->regs[R_GQSPI_IMR] = R_GQSPI_IMR_RESET;
    408    s->regs[R_GQSPI_TX_THRESH] = 1;
    409    s->regs[R_GQSPI_RX_THRESH] = 1;
    410    s->regs[R_GQSPI_GPIO] = 1;
    411    s->regs[R_GQSPI_LPBK_DLY_ADJ] = R_GQSPI_LPBK_DLY_ADJ_RESET;
    412    s->regs[R_GQSPI_MOD_ID] = R_GQSPI_MOD_ID_RESET;
    413    s->man_start_com_g = false;
    414    s->gqspi_irqline = 0;
    415    xlnx_zynqmp_qspips_update_ixr(s);
    416}
    417
    418/*
    419 * N way (num) in place bit striper. Lay out row wise bits (MSB to LSB)
    420 * column wise (from element 0 to N-1). num is the length of x, and dir
    421 * reverses the direction of the transform. Best illustrated by example:
    422 * Each digit in the below array is a single bit (num == 3):
    423 *
    424 * {{ 76543210, }  ----- stripe (dir == false) -----> {{ 741gdaFC, }
    425 *  { hgfedcba, }                                      { 630fcHEB, }
    426 *  { HGFEDCBA, }} <---- upstripe (dir == true) -----  { 52hebGDA, }}
    427 */
    428
    429static inline void stripe8(uint8_t *x, int num, bool dir)
    430{
    431    uint8_t r[MAX_NUM_BUSSES];
    432    int idx[2] = {0, 0};
    433    int bit[2] = {0, 7};
    434    int d = dir;
    435
    436    assert(num <= MAX_NUM_BUSSES);
    437    memset(r, 0, sizeof(uint8_t) * num);
    438
    439    for (idx[0] = 0; idx[0] < num; ++idx[0]) {
    440        for (bit[0] = 7; bit[0] >= 0; bit[0]--) {
    441            r[idx[!d]] |= x[idx[d]] & 1 << bit[d] ? 1 << bit[!d] : 0;
    442            idx[1] = (idx[1] + 1) % num;
    443            if (!idx[1]) {
    444                bit[1]--;
    445            }
    446        }
    447    }
    448    memcpy(x, r, sizeof(uint8_t) * num);
    449}
    450
    451static void xlnx_zynqmp_qspips_flush_fifo_g(XlnxZynqMPQSPIPS *s)
    452{
    453    while (s->regs[R_GQSPI_DATA_STS] || !fifo32_is_empty(&s->fifo_g)) {
    454        uint8_t tx_rx[2] = { 0 };
    455        int num_stripes = 1;
    456        uint8_t busses;
    457        int i;
    458
    459        if (!s->regs[R_GQSPI_DATA_STS]) {
    460            uint8_t imm;
    461
    462            s->regs[R_GQSPI_GF_SNAPSHOT] = fifo32_pop(&s->fifo_g);
    463            DB_PRINT_L(0, "GQSPI command: %x\n", s->regs[R_GQSPI_GF_SNAPSHOT]);
    464            if (!s->regs[R_GQSPI_GF_SNAPSHOT]) {
    465                DB_PRINT_L(0, "Dummy GQSPI Delay Command Entry, Do nothing");
    466                continue;
    467            }
    468            xlnx_zynqmp_qspips_update_cs_lines(s);
    469
    470            imm = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
    471            if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
    472                /* immedate transfer */
    473                if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
    474                    ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
    475                    s->regs[R_GQSPI_DATA_STS] = 1;
    476                /* CS setup/hold - do nothing */
    477                } else {
    478                    s->regs[R_GQSPI_DATA_STS] = 0;
    479                }
    480            } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, EXPONENT)) {
    481                if (imm > 31) {
    482                    qemu_log_mask(LOG_UNIMP, "QSPI exponential transfer too"
    483                                  " long - 2 ^ %" PRId8 " requested\n", imm);
    484                }
    485                s->regs[R_GQSPI_DATA_STS] = 1ul << imm;
    486            } else {
    487                s->regs[R_GQSPI_DATA_STS] = imm;
    488            }
    489        }
    490        /* Zero length transfer check */
    491        if (!s->regs[R_GQSPI_DATA_STS]) {
    492            continue;
    493        }
    494        if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE) &&
    495            fifo8_is_full(&s->rx_fifo_g)) {
    496            /* No space in RX fifo for transfer - try again later */
    497            return;
    498        }
    499        if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, STRIPE) &&
    500            (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
    501             ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE))) {
    502            num_stripes = 2;
    503        }
    504        if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
    505            tx_rx[0] = ARRAY_FIELD_EX32(s->regs,
    506                                        GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
    507        } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT)) {
    508            for (i = 0; i < num_stripes; ++i) {
    509                if (!fifo8_is_empty(&s->tx_fifo_g)) {
    510                    tx_rx[i] = fifo8_pop(&s->tx_fifo_g);
    511                    s->tx_fifo_g_align++;
    512                } else {
    513                    return;
    514                }
    515            }
    516        }
    517        if (num_stripes == 1) {
    518            /* mirror */
    519            tx_rx[1] = tx_rx[0];
    520        }
    521        busses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
    522        for (i = 0; i < 2; ++i) {
    523            DB_PRINT_L(1, "bus %d tx = %02x\n", i, tx_rx[i]);
    524            tx_rx[i] = ssi_transfer(XILINX_SPIPS(s)->spi[i], tx_rx[i]);
    525            DB_PRINT_L(1, "bus %d rx = %02x\n", i, tx_rx[i]);
    526        }
    527        if (s->regs[R_GQSPI_DATA_STS] > 1 &&
    528            busses == 0x3 && num_stripes == 2) {
    529            s->regs[R_GQSPI_DATA_STS] -= 2;
    530        } else if (s->regs[R_GQSPI_DATA_STS] > 0) {
    531            s->regs[R_GQSPI_DATA_STS]--;
    532        }
    533        if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
    534            for (i = 0; i < 2; ++i) {
    535                if (busses & (1 << i)) {
    536                    DB_PRINT_L(1, "bus %d push_byte = %02x\n", i, tx_rx[i]);
    537                    fifo8_push(&s->rx_fifo_g, tx_rx[i]);
    538                    s->rx_fifo_g_align++;
    539                }
    540            }
    541        }
    542        if (!s->regs[R_GQSPI_DATA_STS]) {
    543            for (; s->tx_fifo_g_align % 4; s->tx_fifo_g_align++) {
    544                fifo8_pop(&s->tx_fifo_g);
    545            }
    546            for (; s->rx_fifo_g_align % 4; s->rx_fifo_g_align++) {
    547                fifo8_push(&s->rx_fifo_g, 0);
    548            }
    549        }
    550    }
    551}
    552
    553static int xilinx_spips_num_dummies(XilinxQSPIPS *qs, uint8_t command)
    554{
    555    if (!qs) {
    556        /* The SPI device is not a QSPI device */
    557        return -1;
    558    }
    559
    560    switch (command) { /* check for dummies */
    561    case READ: /* no dummy bytes/cycles */
    562    case PP:
    563    case DPP:
    564    case QPP:
    565    case READ_4:
    566    case PP_4:
    567    case QPP_4:
    568        return 0;
    569    case FAST_READ:
    570    case DOR:
    571    case QOR:
    572    case FAST_READ_4:
    573    case DOR_4:
    574    case QOR_4:
    575        return 1;
    576    case DIOR:
    577    case DIOR_4:
    578        return 2;
    579    case QIOR:
    580    case QIOR_4:
    581        return 4;
    582    default:
    583        return -1;
    584    }
    585}
    586
    587static inline uint8_t get_addr_length(XilinxSPIPS *s, uint8_t cmd)
    588{
    589   switch (cmd) {
    590   case PP_4:
    591   case QPP_4:
    592   case READ_4:
    593   case QIOR_4:
    594   case FAST_READ_4:
    595   case DOR_4:
    596   case QOR_4:
    597   case DIOR_4:
    598       return 4;
    599   default:
    600       return (s->regs[R_CMND] & R_CMND_EXT_ADD) ? 4 : 3;
    601   }
    602}
    603
    604static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
    605{
    606    int debug_level = 0;
    607    XilinxQSPIPS *q = (XilinxQSPIPS *) object_dynamic_cast(OBJECT(s),
    608                                                           TYPE_XILINX_QSPIPS);
    609
    610    for (;;) {
    611        int i;
    612        uint8_t tx = 0;
    613        uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
    614        uint8_t dummy_cycles = 0;
    615        uint8_t addr_length;
    616
    617        if (fifo8_is_empty(&s->tx_fifo)) {
    618            xilinx_spips_update_ixr(s);
    619            return;
    620        } else if (s->snoop_state == SNOOP_STRIPING ||
    621                   s->snoop_state == SNOOP_NONE) {
    622            for (i = 0; i < num_effective_busses(s); ++i) {
    623                tx_rx[i] = fifo8_pop(&s->tx_fifo);
    624            }
    625            stripe8(tx_rx, num_effective_busses(s), false);
    626        } else if (s->snoop_state >= SNOOP_ADDR) {
    627            tx = fifo8_pop(&s->tx_fifo);
    628            for (i = 0; i < num_effective_busses(s); ++i) {
    629                tx_rx[i] = tx;
    630            }
    631        } else {
    632            /*
    633             * Extract a dummy byte and generate dummy cycles according to the
    634             * link state
    635             */
    636            tx = fifo8_pop(&s->tx_fifo);
    637            dummy_cycles = 8 / s->link_state;
    638        }
    639
    640        for (i = 0; i < num_effective_busses(s); ++i) {
    641            int bus = num_effective_busses(s) - 1 - i;
    642            if (dummy_cycles) {
    643                int d;
    644                for (d = 0; d < dummy_cycles; ++d) {
    645                    tx_rx[0] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[0]);
    646                }
    647            } else {
    648                DB_PRINT_L(debug_level, "tx = %02x\n", tx_rx[i]);
    649                tx_rx[i] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[i]);
    650                DB_PRINT_L(debug_level, "rx = %02x\n", tx_rx[i]);
    651            }
    652        }
    653
    654        if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
    655            DB_PRINT_L(debug_level, "dircarding drained rx byte\n");
    656            /* Do nothing */
    657        } else if (s->rx_discard) {
    658            DB_PRINT_L(debug_level, "dircarding discarded rx byte\n");
    659            s->rx_discard -= 8 / s->link_state;
    660        } else if (fifo8_is_full(&s->rx_fifo)) {
    661            s->regs[R_INTR_STATUS] |= IXR_RX_FIFO_OVERFLOW;
    662            DB_PRINT_L(0, "rx FIFO overflow");
    663        } else if (s->snoop_state == SNOOP_STRIPING) {
    664            stripe8(tx_rx, num_effective_busses(s), true);
    665            for (i = 0; i < num_effective_busses(s); ++i) {
    666                fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[i]);
    667                DB_PRINT_L(debug_level, "pushing striped rx byte\n");
    668            }
    669        } else {
    670           DB_PRINT_L(debug_level, "pushing unstriped rx byte\n");
    671           fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[0]);
    672        }
    673
    674        if (s->link_state_next_when) {
    675            s->link_state_next_when--;
    676            if (!s->link_state_next_when) {
    677                s->link_state = s->link_state_next;
    678            }
    679        }
    680
    681        DB_PRINT_L(debug_level, "initial snoop state: %x\n",
    682                   (unsigned)s->snoop_state);
    683        switch (s->snoop_state) {
    684        case (SNOOP_CHECKING):
    685            /* Store the count of dummy bytes in the txfifo */
    686            s->cmd_dummies = xilinx_spips_num_dummies(q, tx);
    687            addr_length = get_addr_length(s, tx);
    688            if (s->cmd_dummies < 0) {
    689                s->snoop_state = SNOOP_NONE;
    690            } else {
    691                s->snoop_state = SNOOP_ADDR + addr_length - 1;
    692            }
    693            switch (tx) {
    694            case DPP:
    695            case DOR:
    696            case DOR_4:
    697                s->link_state_next = 2;
    698                s->link_state_next_when = addr_length + s->cmd_dummies;
    699                break;
    700            case QPP:
    701            case QPP_4:
    702            case QOR:
    703            case QOR_4:
    704                s->link_state_next = 4;
    705                s->link_state_next_when = addr_length + s->cmd_dummies;
    706                break;
    707            case DIOR:
    708            case DIOR_4:
    709                s->link_state = 2;
    710                break;
    711            case QIOR:
    712            case QIOR_4:
    713                s->link_state = 4;
    714                break;
    715            }
    716            break;
    717        case (SNOOP_ADDR):
    718            /*
    719             * Address has been transmitted, transmit dummy cycles now if needed
    720             */
    721            if (s->cmd_dummies < 0) {
    722                s->snoop_state = SNOOP_NONE;
    723            } else {
    724                s->snoop_state = s->cmd_dummies;
    725            }
    726            break;
    727        case (SNOOP_STRIPING):
    728        case (SNOOP_NONE):
    729            /* Once we hit the boring stuff - squelch debug noise */
    730            if (!debug_level) {
    731                DB_PRINT_L(0, "squelching debug info ....\n");
    732                debug_level = 1;
    733            }
    734            break;
    735        default:
    736            s->snoop_state--;
    737        }
    738        DB_PRINT_L(debug_level, "final snoop state: %x\n",
    739                   (unsigned)s->snoop_state);
    740    }
    741}
    742
    743static inline void tx_data_bytes(Fifo8 *fifo, uint32_t value, int num, bool be)
    744{
    745    int i;
    746    for (i = 0; i < num && !fifo8_is_full(fifo); ++i) {
    747        if (be) {
    748            fifo8_push(fifo, (uint8_t)(value >> 24));
    749            value <<= 8;
    750        } else {
    751            fifo8_push(fifo, (uint8_t)value);
    752            value >>= 8;
    753        }
    754    }
    755}
    756
    757static void xilinx_spips_check_zero_pump(XilinxSPIPS *s)
    758{
    759    if (!s->regs[R_TRANSFER_SIZE]) {
    760        return;
    761    }
    762    if (!fifo8_is_empty(&s->tx_fifo) && s->regs[R_CMND] & R_CMND_PUSH_WAIT) {
    763        return;
    764    }
    765    /*
    766     * The zero pump must never fill tx fifo such that rx overflow is
    767     * possible
    768     */
    769    while (s->regs[R_TRANSFER_SIZE] &&
    770           s->rx_fifo.num + s->tx_fifo.num < RXFF_A_Q - 3) {
    771        /* endianess just doesn't matter when zero pumping */
    772        tx_data_bytes(&s->tx_fifo, 0, 4, false);
    773        s->regs[R_TRANSFER_SIZE] &= ~0x03ull;
    774        s->regs[R_TRANSFER_SIZE] -= 4;
    775    }
    776}
    777
    778static void xilinx_spips_check_flush(XilinxSPIPS *s)
    779{
    780    if (s->man_start_com ||
    781        (!fifo8_is_empty(&s->tx_fifo) &&
    782         !(s->regs[R_CONFIG] & MAN_START_EN))) {
    783        xilinx_spips_check_zero_pump(s);
    784        xilinx_spips_flush_txfifo(s);
    785    }
    786    if (fifo8_is_empty(&s->tx_fifo) && !s->regs[R_TRANSFER_SIZE]) {
    787        s->man_start_com = false;
    788    }
    789    xilinx_spips_update_ixr(s);
    790}
    791
    792static void xlnx_zynqmp_qspips_check_flush(XlnxZynqMPQSPIPS *s)
    793{
    794    bool gqspi_has_work = s->regs[R_GQSPI_DATA_STS] ||
    795                          !fifo32_is_empty(&s->fifo_g);
    796
    797    if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
    798        if (s->man_start_com_g || (gqspi_has_work &&
    799             !ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE))) {
    800            xlnx_zynqmp_qspips_flush_fifo_g(s);
    801        }
    802    } else {
    803        xilinx_spips_check_flush(XILINX_SPIPS(s));
    804    }
    805    if (!gqspi_has_work) {
    806        s->man_start_com_g = false;
    807    }
    808    xlnx_zynqmp_qspips_update_ixr(s);
    809}
    810
    811static inline int rx_data_bytes(Fifo8 *fifo, uint8_t *value, int max)
    812{
    813    int i;
    814
    815    for (i = 0; i < max && !fifo8_is_empty(fifo); ++i) {
    816        value[i] = fifo8_pop(fifo);
    817    }
    818    return max - i;
    819}
    820
    821static const void *pop_buf(Fifo8 *fifo, uint32_t max, uint32_t *num)
    822{
    823    void *ret;
    824
    825    if (max == 0 || max > fifo->num) {
    826        abort();
    827    }
    828    *num = MIN(fifo->capacity - fifo->head, max);
    829    ret = &fifo->data[fifo->head];
    830    fifo->head += *num;
    831    fifo->head %= fifo->capacity;
    832    fifo->num -= *num;
    833    return ret;
    834}
    835
    836static void xlnx_zynqmp_qspips_notify(void *opaque)
    837{
    838    XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(opaque);
    839    XilinxSPIPS *s = XILINX_SPIPS(rq);
    840    Fifo8 *recv_fifo;
    841
    842    if (ARRAY_FIELD_EX32(rq->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
    843        if (!(ARRAY_FIELD_EX32(rq->regs, GQSPI_CNFG, MODE_EN) == 2)) {
    844            return;
    845        }
    846        recv_fifo = &rq->rx_fifo_g;
    847    } else {
    848        if (!(s->regs[R_CMND] & R_CMND_DMA_EN)) {
    849            return;
    850        }
    851        recv_fifo = &s->rx_fifo;
    852    }
    853    while (recv_fifo->num >= 4
    854           && stream_can_push(rq->dma, xlnx_zynqmp_qspips_notify, rq))
    855    {
    856        size_t ret;
    857        uint32_t num;
    858        const void *rxd;
    859        int len;
    860
    861        len = recv_fifo->num >= rq->dma_burst_size ? rq->dma_burst_size :
    862                                                   recv_fifo->num;
    863        rxd = pop_buf(recv_fifo, len, &num);
    864
    865        memcpy(rq->dma_buf, rxd, num);
    866
    867        ret = stream_push(rq->dma, rq->dma_buf, num, false);
    868        assert(ret == num);
    869        xlnx_zynqmp_qspips_check_flush(rq);
    870    }
    871}
    872
    873static uint64_t xilinx_spips_read(void *opaque, hwaddr addr,
    874                                  unsigned size)
    875{
    876    XilinxSPIPS *s = opaque;
    877    uint32_t mask = ~0;
    878    uint32_t ret;
    879    uint8_t rx_buf[4];
    880    int shortfall;
    881
    882    addr >>= 2;
    883    switch (addr) {
    884    case R_CONFIG:
    885        mask = ~(R_CONFIG_RSVD | MAN_START_COM);
    886        break;
    887    case R_INTR_STATUS:
    888        ret = s->regs[addr] & IXR_ALL;
    889        s->regs[addr] = 0;
    890        DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
    891        xilinx_spips_update_ixr(s);
    892        return ret;
    893    case R_INTR_MASK:
    894        mask = IXR_ALL;
    895        break;
    896    case  R_EN:
    897        mask = 0x1;
    898        break;
    899    case R_SLAVE_IDLE_COUNT:
    900        mask = 0xFF;
    901        break;
    902    case R_MOD_ID:
    903        mask = 0x01FFFFFF;
    904        break;
    905    case R_INTR_EN:
    906    case R_INTR_DIS:
    907    case R_TX_DATA:
    908        mask = 0;
    909        break;
    910    case R_RX_DATA:
    911        memset(rx_buf, 0, sizeof(rx_buf));
    912        shortfall = rx_data_bytes(&s->rx_fifo, rx_buf, s->num_txrx_bytes);
    913        ret = s->regs[R_CONFIG] & R_CONFIG_ENDIAN ?
    914                        cpu_to_be32(*(uint32_t *)rx_buf) :
    915                        cpu_to_le32(*(uint32_t *)rx_buf);
    916        if (!(s->regs[R_CONFIG] & R_CONFIG_ENDIAN)) {
    917            ret <<= 8 * shortfall;
    918        }
    919        DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
    920        xilinx_spips_check_flush(s);
    921        xilinx_spips_update_ixr(s);
    922        return ret;
    923    }
    924    DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4,
    925               s->regs[addr] & mask);
    926    return s->regs[addr] & mask;
    927
    928}
    929
    930static uint64_t xlnx_zynqmp_qspips_read(void *opaque,
    931                                        hwaddr addr, unsigned size)
    932{
    933    XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
    934    uint32_t reg = addr / 4;
    935    uint32_t ret;
    936    uint8_t rx_buf[4];
    937    int shortfall;
    938
    939    if (reg <= R_MOD_ID) {
    940        return xilinx_spips_read(opaque, addr, size);
    941    } else {
    942        switch (reg) {
    943        case R_GQSPI_RXD:
    944            if (fifo8_is_empty(&s->rx_fifo_g)) {
    945                qemu_log_mask(LOG_GUEST_ERROR,
    946                              "Read from empty GQSPI RX FIFO\n");
    947                return 0;
    948            }
    949            memset(rx_buf, 0, sizeof(rx_buf));
    950            shortfall = rx_data_bytes(&s->rx_fifo_g, rx_buf,
    951                                      XILINX_SPIPS(s)->num_txrx_bytes);
    952            ret = ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN) ?
    953                  cpu_to_be32(*(uint32_t *)rx_buf) :
    954                  cpu_to_le32(*(uint32_t *)rx_buf);
    955            if (!ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN)) {
    956                ret <<= 8 * shortfall;
    957            }
    958            xlnx_zynqmp_qspips_check_flush(s);
    959            xlnx_zynqmp_qspips_update_ixr(s);
    960            return ret;
    961        default:
    962            return s->regs[reg];
    963        }
    964    }
    965}
    966
    967static void xilinx_spips_write(void *opaque, hwaddr addr,
    968                               uint64_t value, unsigned size)
    969{
    970    int mask = ~0;
    971    XilinxSPIPS *s = opaque;
    972    bool try_flush = true;
    973
    974    DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr, (unsigned)value);
    975    addr >>= 2;
    976    switch (addr) {
    977    case R_CONFIG:
    978        mask = ~(R_CONFIG_RSVD | MAN_START_COM);
    979        if ((value & MAN_START_COM) && (s->regs[R_CONFIG] & MAN_START_EN)) {
    980            s->man_start_com = true;
    981        }
    982        break;
    983    case R_INTR_STATUS:
    984        mask = IXR_ALL;
    985        s->regs[R_INTR_STATUS] &= ~(mask & value);
    986        goto no_reg_update;
    987    case R_INTR_DIS:
    988        mask = IXR_ALL;
    989        s->regs[R_INTR_MASK] &= ~(mask & value);
    990        goto no_reg_update;
    991    case R_INTR_EN:
    992        mask = IXR_ALL;
    993        s->regs[R_INTR_MASK] |= mask & value;
    994        goto no_reg_update;
    995    case R_EN:
    996        mask = 0x1;
    997        break;
    998    case R_SLAVE_IDLE_COUNT:
    999        mask = 0xFF;
   1000        break;
   1001    case R_RX_DATA:
   1002    case R_INTR_MASK:
   1003    case R_MOD_ID:
   1004        mask = 0;
   1005        break;
   1006    case R_TX_DATA:
   1007        tx_data_bytes(&s->tx_fifo, (uint32_t)value, s->num_txrx_bytes,
   1008                      s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
   1009        goto no_reg_update;
   1010    case R_TXD1:
   1011        tx_data_bytes(&s->tx_fifo, (uint32_t)value, 1,
   1012                      s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
   1013        goto no_reg_update;
   1014    case R_TXD2:
   1015        tx_data_bytes(&s->tx_fifo, (uint32_t)value, 2,
   1016                      s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
   1017        goto no_reg_update;
   1018    case R_TXD3:
   1019        tx_data_bytes(&s->tx_fifo, (uint32_t)value, 3,
   1020                      s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
   1021        goto no_reg_update;
   1022    /* Skip SPI bus update for below registers writes */
   1023    case R_GPIO:
   1024    case R_LPBK_DLY_ADJ:
   1025    case R_IOU_TAPDLY_BYPASS:
   1026    case R_DUMMY_CYCLE_EN:
   1027    case R_ECO:
   1028        try_flush = false;
   1029        break;
   1030    }
   1031    s->regs[addr] = (s->regs[addr] & ~mask) | (value & mask);
   1032no_reg_update:
   1033    if (try_flush) {
   1034        xilinx_spips_update_cs_lines(s);
   1035        xilinx_spips_check_flush(s);
   1036        xilinx_spips_update_cs_lines(s);
   1037        xilinx_spips_update_ixr(s);
   1038    }
   1039}
   1040
   1041static const MemoryRegionOps spips_ops = {
   1042    .read = xilinx_spips_read,
   1043    .write = xilinx_spips_write,
   1044    .endianness = DEVICE_LITTLE_ENDIAN,
   1045};
   1046
   1047static void xilinx_qspips_invalidate_mmio_ptr(XilinxQSPIPS *q)
   1048{
   1049    q->lqspi_cached_addr = ~0ULL;
   1050}
   1051
   1052static void xilinx_qspips_write(void *opaque, hwaddr addr,
   1053                                uint64_t value, unsigned size)
   1054{
   1055    XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
   1056    XilinxSPIPS *s = XILINX_SPIPS(opaque);
   1057
   1058    xilinx_spips_write(opaque, addr, value, size);
   1059    addr >>= 2;
   1060
   1061    if (addr == R_LQSPI_CFG) {
   1062        xilinx_qspips_invalidate_mmio_ptr(q);
   1063    }
   1064    if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
   1065        fifo8_reset(&s->rx_fifo);
   1066    }
   1067}
   1068
   1069static void xlnx_zynqmp_qspips_write(void *opaque, hwaddr addr,
   1070                                     uint64_t value, unsigned size)
   1071{
   1072    XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
   1073    uint32_t reg = addr / 4;
   1074
   1075    if (reg <= R_MOD_ID) {
   1076        xilinx_qspips_write(opaque, addr, value, size);
   1077    } else {
   1078        switch (reg) {
   1079        case R_GQSPI_CNFG:
   1080            if (FIELD_EX32(value, GQSPI_CNFG, GEN_FIFO_START) &&
   1081                ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE)) {
   1082                s->man_start_com_g = true;
   1083            }
   1084            s->regs[reg] = value & ~(R_GQSPI_CNFG_GEN_FIFO_START_MASK);
   1085            break;
   1086        case R_GQSPI_GEN_FIFO:
   1087            if (!fifo32_is_full(&s->fifo_g)) {
   1088                fifo32_push(&s->fifo_g, value);
   1089            }
   1090            break;
   1091        case R_GQSPI_TXD:
   1092            tx_data_bytes(&s->tx_fifo_g, (uint32_t)value, 4,
   1093                          ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN));
   1094            break;
   1095        case R_GQSPI_FIFO_CTRL:
   1096            if (FIELD_EX32(value, GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET)) {
   1097                fifo32_reset(&s->fifo_g);
   1098            }
   1099            if (FIELD_EX32(value, GQSPI_FIFO_CTRL, TX_FIFO_RESET)) {
   1100                fifo8_reset(&s->tx_fifo_g);
   1101            }
   1102            if (FIELD_EX32(value, GQSPI_FIFO_CTRL, RX_FIFO_RESET)) {
   1103                fifo8_reset(&s->rx_fifo_g);
   1104            }
   1105            break;
   1106        case R_GQSPI_IDR:
   1107            s->regs[R_GQSPI_IMR] |= value;
   1108            break;
   1109        case R_GQSPI_IER:
   1110            s->regs[R_GQSPI_IMR] &= ~value;
   1111            break;
   1112        case R_GQSPI_ISR:
   1113            s->regs[R_GQSPI_ISR] &= ~value;
   1114            break;
   1115        case R_GQSPI_IMR:
   1116        case R_GQSPI_RXD:
   1117        case R_GQSPI_GF_SNAPSHOT:
   1118        case R_GQSPI_MOD_ID:
   1119            break;
   1120        default:
   1121            s->regs[reg] = value;
   1122            break;
   1123        }
   1124        xlnx_zynqmp_qspips_update_cs_lines(s);
   1125        xlnx_zynqmp_qspips_check_flush(s);
   1126        xlnx_zynqmp_qspips_update_cs_lines(s);
   1127        xlnx_zynqmp_qspips_update_ixr(s);
   1128    }
   1129    xlnx_zynqmp_qspips_notify(s);
   1130}
   1131
   1132static const MemoryRegionOps qspips_ops = {
   1133    .read = xilinx_spips_read,
   1134    .write = xilinx_qspips_write,
   1135    .endianness = DEVICE_LITTLE_ENDIAN,
   1136};
   1137
   1138static const MemoryRegionOps xlnx_zynqmp_qspips_ops = {
   1139    .read = xlnx_zynqmp_qspips_read,
   1140    .write = xlnx_zynqmp_qspips_write,
   1141    .endianness = DEVICE_LITTLE_ENDIAN,
   1142};
   1143
   1144#define LQSPI_CACHE_SIZE 1024
   1145
   1146static void lqspi_load_cache(void *opaque, hwaddr addr)
   1147{
   1148    XilinxQSPIPS *q = opaque;
   1149    XilinxSPIPS *s = opaque;
   1150    int i;
   1151    int flash_addr = ((addr & ~(LQSPI_CACHE_SIZE - 1))
   1152                   / num_effective_busses(s));
   1153    int peripheral = flash_addr >> LQSPI_ADDRESS_BITS;
   1154    int cache_entry = 0;
   1155    uint32_t u_page_save = s->regs[R_LQSPI_STS] & ~LQSPI_CFG_U_PAGE;
   1156
   1157    if (addr < q->lqspi_cached_addr ||
   1158            addr > q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
   1159        xilinx_qspips_invalidate_mmio_ptr(q);
   1160        s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
   1161        s->regs[R_LQSPI_STS] |= peripheral ? LQSPI_CFG_U_PAGE : 0;
   1162
   1163        DB_PRINT_L(0, "config reg status: %08x\n", s->regs[R_LQSPI_CFG]);
   1164
   1165        fifo8_reset(&s->tx_fifo);
   1166        fifo8_reset(&s->rx_fifo);
   1167
   1168        /* instruction */
   1169        DB_PRINT_L(0, "pushing read instruction: %02x\n",
   1170                   (unsigned)(uint8_t)(s->regs[R_LQSPI_CFG] &
   1171                                       LQSPI_CFG_INST_CODE));
   1172        fifo8_push(&s->tx_fifo, s->regs[R_LQSPI_CFG] & LQSPI_CFG_INST_CODE);
   1173        /* read address */
   1174        DB_PRINT_L(0, "pushing read address %06x\n", flash_addr);
   1175        if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_ADDR4) {
   1176            fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 24));
   1177        }
   1178        fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 16));
   1179        fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 8));
   1180        fifo8_push(&s->tx_fifo, (uint8_t)flash_addr);
   1181        /* mode bits */
   1182        if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_MODE_EN) {
   1183            fifo8_push(&s->tx_fifo, extract32(s->regs[R_LQSPI_CFG],
   1184                                              LQSPI_CFG_MODE_SHIFT,
   1185                                              LQSPI_CFG_MODE_WIDTH));
   1186        }
   1187        /* dummy bytes */
   1188        for (i = 0; i < (extract32(s->regs[R_LQSPI_CFG], LQSPI_CFG_DUMMY_SHIFT,
   1189                                   LQSPI_CFG_DUMMY_WIDTH)); ++i) {
   1190            DB_PRINT_L(0, "pushing dummy byte\n");
   1191            fifo8_push(&s->tx_fifo, 0);
   1192        }
   1193        xilinx_spips_update_cs_lines(s);
   1194        xilinx_spips_flush_txfifo(s);
   1195        fifo8_reset(&s->rx_fifo);
   1196
   1197        DB_PRINT_L(0, "starting QSPI data read\n");
   1198
   1199        while (cache_entry < LQSPI_CACHE_SIZE) {
   1200            for (i = 0; i < 64; ++i) {
   1201                tx_data_bytes(&s->tx_fifo, 0, 1, false);
   1202            }
   1203            xilinx_spips_flush_txfifo(s);
   1204            for (i = 0; i < 64; ++i) {
   1205                rx_data_bytes(&s->rx_fifo, &q->lqspi_buf[cache_entry++], 1);
   1206            }
   1207        }
   1208
   1209        s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
   1210        s->regs[R_LQSPI_STS] |= u_page_save;
   1211        xilinx_spips_update_cs_lines(s);
   1212
   1213        q->lqspi_cached_addr = flash_addr * num_effective_busses(s);
   1214    }
   1215}
   1216
   1217static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
   1218                              unsigned size, MemTxAttrs attrs)
   1219{
   1220    XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
   1221
   1222    if (addr >= q->lqspi_cached_addr &&
   1223            addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
   1224        uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
   1225        *value = cpu_to_le32(*(uint32_t *)retp);
   1226        DB_PRINT_L(1, "addr: %08" HWADDR_PRIx ", data: %08" PRIx64 "\n",
   1227                   addr, *value);
   1228        return MEMTX_OK;
   1229    }
   1230
   1231    lqspi_load_cache(opaque, addr);
   1232    return lqspi_read(opaque, addr, value, size, attrs);
   1233}
   1234
   1235static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,
   1236                               unsigned size, MemTxAttrs attrs)
   1237{
   1238    /*
   1239     * From UG1085, Chapter 24 (Quad-SPI controllers):
   1240     * - Writes are ignored
   1241     * - AXI writes generate an external AXI slave error (SLVERR)
   1242     */
   1243    qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64
   1244                                   " (value: 0x%" PRIx64 "\n",
   1245                  __func__, size << 3, offset, value);
   1246
   1247    return MEMTX_ERROR;
   1248}
   1249
   1250static const MemoryRegionOps lqspi_ops = {
   1251    .read_with_attrs = lqspi_read,
   1252    .write_with_attrs = lqspi_write,
   1253    .endianness = DEVICE_NATIVE_ENDIAN,
   1254    .impl = {
   1255        .min_access_size = 4,
   1256        .max_access_size = 4,
   1257    },
   1258    .valid = {
   1259        .min_access_size = 1,
   1260        .max_access_size = 4
   1261    }
   1262};
   1263
   1264static void xilinx_spips_realize(DeviceState *dev, Error **errp)
   1265{
   1266    XilinxSPIPS *s = XILINX_SPIPS(dev);
   1267    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
   1268    XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
   1269    int i;
   1270
   1271    DB_PRINT_L(0, "realized spips\n");
   1272
   1273    if (s->num_busses > MAX_NUM_BUSSES) {
   1274        error_setg(errp,
   1275                   "requested number of SPI busses %u exceeds maximum %d",
   1276                   s->num_busses, MAX_NUM_BUSSES);
   1277        return;
   1278    }
   1279    if (s->num_busses < MIN_NUM_BUSSES) {
   1280        error_setg(errp,
   1281                   "requested number of SPI busses %u is below minimum %d",
   1282                   s->num_busses, MIN_NUM_BUSSES);
   1283        return;
   1284    }
   1285
   1286    s->spi = g_new(SSIBus *, s->num_busses);
   1287    for (i = 0; i < s->num_busses; ++i) {
   1288        char bus_name[16];
   1289        snprintf(bus_name, 16, "spi%d", i);
   1290        s->spi[i] = ssi_create_bus(dev, bus_name);
   1291    }
   1292
   1293    s->cs_lines = g_new0(qemu_irq, s->num_cs * s->num_busses);
   1294    s->cs_lines_state = g_new0(bool, s->num_cs * s->num_busses);
   1295
   1296    sysbus_init_irq(sbd, &s->irq);
   1297    for (i = 0; i < s->num_cs * s->num_busses; ++i) {
   1298        sysbus_init_irq(sbd, &s->cs_lines[i]);
   1299    }
   1300
   1301    memory_region_init_io(&s->iomem, OBJECT(s), xsc->reg_ops, s,
   1302                          "spi", XLNX_ZYNQMP_SPIPS_R_MAX * 4);
   1303    sysbus_init_mmio(sbd, &s->iomem);
   1304
   1305    s->irqline = -1;
   1306
   1307    fifo8_create(&s->rx_fifo, xsc->rx_fifo_size);
   1308    fifo8_create(&s->tx_fifo, xsc->tx_fifo_size);
   1309}
   1310
   1311static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
   1312{
   1313    XilinxSPIPS *s = XILINX_SPIPS(dev);
   1314    XilinxQSPIPS *q = XILINX_QSPIPS(dev);
   1315    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
   1316
   1317    DB_PRINT_L(0, "realized qspips\n");
   1318
   1319    s->num_busses = 2;
   1320    s->num_cs = 2;
   1321    s->num_txrx_bytes = 4;
   1322
   1323    xilinx_spips_realize(dev, errp);
   1324    memory_region_init_io(&s->mmlqspi, OBJECT(s), &lqspi_ops, s, "lqspi",
   1325                          (1 << LQSPI_ADDRESS_BITS) * 2);
   1326    sysbus_init_mmio(sbd, &s->mmlqspi);
   1327
   1328    q->lqspi_cached_addr = ~0ULL;
   1329}
   1330
   1331static void xlnx_zynqmp_qspips_realize(DeviceState *dev, Error **errp)
   1332{
   1333    XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(dev);
   1334    XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
   1335
   1336    if (s->dma_burst_size > QSPI_DMA_MAX_BURST_SIZE) {
   1337        error_setg(errp,
   1338                   "qspi dma burst size %u exceeds maximum limit %d",
   1339                   s->dma_burst_size, QSPI_DMA_MAX_BURST_SIZE);
   1340        return;
   1341    }
   1342    xilinx_qspips_realize(dev, errp);
   1343    fifo8_create(&s->rx_fifo_g, xsc->rx_fifo_size);
   1344    fifo8_create(&s->tx_fifo_g, xsc->tx_fifo_size);
   1345    fifo32_create(&s->fifo_g, 32);
   1346}
   1347
   1348static void xlnx_zynqmp_qspips_init(Object *obj)
   1349{
   1350    XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(obj);
   1351
   1352    object_property_add_link(obj, "stream-connected-dma", TYPE_STREAM_SINK,
   1353                             (Object **)&rq->dma,
   1354                             object_property_allow_set_link,
   1355                             OBJ_PROP_LINK_STRONG);
   1356}
   1357
   1358static int xilinx_spips_post_load(void *opaque, int version_id)
   1359{
   1360    xilinx_spips_update_ixr((XilinxSPIPS *)opaque);
   1361    xilinx_spips_update_cs_lines((XilinxSPIPS *)opaque);
   1362    return 0;
   1363}
   1364
   1365static const VMStateDescription vmstate_xilinx_spips = {
   1366    .name = "xilinx_spips",
   1367    .version_id = 2,
   1368    .minimum_version_id = 2,
   1369    .post_load = xilinx_spips_post_load,
   1370    .fields = (VMStateField[]) {
   1371        VMSTATE_FIFO8(tx_fifo, XilinxSPIPS),
   1372        VMSTATE_FIFO8(rx_fifo, XilinxSPIPS),
   1373        VMSTATE_UINT32_ARRAY(regs, XilinxSPIPS, XLNX_SPIPS_R_MAX),
   1374        VMSTATE_UINT8(snoop_state, XilinxSPIPS),
   1375        VMSTATE_END_OF_LIST()
   1376    }
   1377};
   1378
   1379static int xlnx_zynqmp_qspips_post_load(void *opaque, int version_id)
   1380{
   1381    XlnxZynqMPQSPIPS *s = (XlnxZynqMPQSPIPS *)opaque;
   1382    XilinxSPIPS *qs = XILINX_SPIPS(s);
   1383
   1384    if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN) &&
   1385        fifo8_is_empty(&qs->rx_fifo) && fifo8_is_empty(&qs->tx_fifo)) {
   1386        xlnx_zynqmp_qspips_update_ixr(s);
   1387        xlnx_zynqmp_qspips_update_cs_lines(s);
   1388    }
   1389    return 0;
   1390}
   1391
   1392static const VMStateDescription vmstate_xilinx_qspips = {
   1393    .name = "xilinx_qspips",
   1394    .version_id = 1,
   1395    .minimum_version_id = 1,
   1396    .fields = (VMStateField[]) {
   1397        VMSTATE_STRUCT(parent_obj, XilinxQSPIPS, 0,
   1398                       vmstate_xilinx_spips, XilinxSPIPS),
   1399        VMSTATE_END_OF_LIST()
   1400    }
   1401};
   1402
   1403static const VMStateDescription vmstate_xlnx_zynqmp_qspips = {
   1404    .name = "xlnx_zynqmp_qspips",
   1405    .version_id = 1,
   1406    .minimum_version_id = 1,
   1407    .post_load = xlnx_zynqmp_qspips_post_load,
   1408    .fields = (VMStateField[]) {
   1409        VMSTATE_STRUCT(parent_obj, XlnxZynqMPQSPIPS, 0,
   1410                       vmstate_xilinx_qspips, XilinxQSPIPS),
   1411        VMSTATE_FIFO8(tx_fifo_g, XlnxZynqMPQSPIPS),
   1412        VMSTATE_FIFO8(rx_fifo_g, XlnxZynqMPQSPIPS),
   1413        VMSTATE_FIFO32(fifo_g, XlnxZynqMPQSPIPS),
   1414        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPQSPIPS, XLNX_ZYNQMP_SPIPS_R_MAX),
   1415        VMSTATE_END_OF_LIST()
   1416    }
   1417};
   1418
   1419static Property xilinx_zynqmp_qspips_properties[] = {
   1420    DEFINE_PROP_UINT32("dma-burst-size", XlnxZynqMPQSPIPS, dma_burst_size, 64),
   1421    DEFINE_PROP_END_OF_LIST(),
   1422};
   1423
   1424static Property xilinx_spips_properties[] = {
   1425    DEFINE_PROP_UINT8("num-busses", XilinxSPIPS, num_busses, 1),
   1426    DEFINE_PROP_UINT8("num-ss-bits", XilinxSPIPS, num_cs, 4),
   1427    DEFINE_PROP_UINT8("num-txrx-bytes", XilinxSPIPS, num_txrx_bytes, 1),
   1428    DEFINE_PROP_END_OF_LIST(),
   1429};
   1430
   1431static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
   1432{
   1433    DeviceClass *dc = DEVICE_CLASS(klass);
   1434    XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
   1435
   1436    dc->realize = xilinx_qspips_realize;
   1437    xsc->reg_ops = &qspips_ops;
   1438    xsc->rx_fifo_size = RXFF_A_Q;
   1439    xsc->tx_fifo_size = TXFF_A_Q;
   1440}
   1441
   1442static void xilinx_spips_class_init(ObjectClass *klass, void *data)
   1443{
   1444    DeviceClass *dc = DEVICE_CLASS(klass);
   1445    XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
   1446
   1447    dc->realize = xilinx_spips_realize;
   1448    dc->reset = xilinx_spips_reset;
   1449    device_class_set_props(dc, xilinx_spips_properties);
   1450    dc->vmsd = &vmstate_xilinx_spips;
   1451
   1452    xsc->reg_ops = &spips_ops;
   1453    xsc->rx_fifo_size = RXFF_A;
   1454    xsc->tx_fifo_size = TXFF_A;
   1455}
   1456
   1457static void xlnx_zynqmp_qspips_class_init(ObjectClass *klass, void * data)
   1458{
   1459    DeviceClass *dc = DEVICE_CLASS(klass);
   1460    XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
   1461
   1462    dc->realize = xlnx_zynqmp_qspips_realize;
   1463    dc->reset = xlnx_zynqmp_qspips_reset;
   1464    dc->vmsd = &vmstate_xlnx_zynqmp_qspips;
   1465    device_class_set_props(dc, xilinx_zynqmp_qspips_properties);
   1466    xsc->reg_ops = &xlnx_zynqmp_qspips_ops;
   1467    xsc->rx_fifo_size = RXFF_A_Q;
   1468    xsc->tx_fifo_size = TXFF_A_Q;
   1469}
   1470
   1471static const TypeInfo xilinx_spips_info = {
   1472    .name  = TYPE_XILINX_SPIPS,
   1473    .parent = TYPE_SYS_BUS_DEVICE,
   1474    .instance_size  = sizeof(XilinxSPIPS),
   1475    .class_init = xilinx_spips_class_init,
   1476    .class_size = sizeof(XilinxSPIPSClass),
   1477};
   1478
   1479static const TypeInfo xilinx_qspips_info = {
   1480    .name  = TYPE_XILINX_QSPIPS,
   1481    .parent = TYPE_XILINX_SPIPS,
   1482    .instance_size  = sizeof(XilinxQSPIPS),
   1483    .class_init = xilinx_qspips_class_init,
   1484};
   1485
   1486static const TypeInfo xlnx_zynqmp_qspips_info = {
   1487    .name  = TYPE_XLNX_ZYNQMP_QSPIPS,
   1488    .parent = TYPE_XILINX_QSPIPS,
   1489    .instance_size  = sizeof(XlnxZynqMPQSPIPS),
   1490    .instance_init  = xlnx_zynqmp_qspips_init,
   1491    .class_init = xlnx_zynqmp_qspips_class_init,
   1492};
   1493
   1494static void xilinx_spips_register_types(void)
   1495{
   1496    type_register_static(&xilinx_spips_info);
   1497    type_register_static(&xilinx_qspips_info);
   1498    type_register_static(&xlnx_zynqmp_qspips_info);
   1499}
   1500
   1501type_init(xilinx_spips_register_types)