hw/ssi/xilinx_spips.c

   1 /*
   2  * QEMU model of the Xilinx Zynq SPI controller
   3  *
   4  * Copyright (c) 2012 Peter A. G. Crosthwaite
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26 #include "hw/sysbus.h"
  27 #include "sysemu/sysemu.h"
  28 #include "hw/ptimer.h"
  29 #include "qemu/log.h"
  30 #include "qemu/fifo8.h"
  31 #include "hw/ssi/ssi.h"
  32 #include "qemu/bitops.h"
  33 #include "hw/ssi/xilinx_spips.h"
  34 #include "qapi/error.h"
  35 #include "migration/blocker.h"
  36
  37 #ifndef XILINX_SPIPS_ERR_DEBUG
  38 #define XILINX_SPIPS_ERR_DEBUG 0
  39 #endif
  40
  41 #define DB_PRINT_L(level, ...) do { \
  42     if (XILINX_SPIPS_ERR_DEBUG > (level)) { \
  43         fprintf(stderr,  ": %s: ", __func__); \
  44         fprintf(stderr, ## __VA_ARGS__); \
  45     } \
  46 } while (0);
  47
  48 /* config register */
  49 #define R_CONFIG            (0x00 / 4)
  50 #define IFMODE              (1U << 31)
  51 #define ENDIAN              (1 << 26)
  52 #define MODEFAIL_GEN_EN     (1 << 17)
  53 #define MAN_START_COM       (1 << 16)
  54 #define MAN_START_EN        (1 << 15)
  55 #define MANUAL_CS           (1 << 14)
  56 #define CS                  (0xF << 10)
  57 #define CS_SHIFT            (10)
  58 #define PERI_SEL            (1 << 9)
  59 #define REF_CLK             (1 << 8)
  60 #define FIFO_WIDTH          (3 << 6)
  61 #define BAUD_RATE_DIV       (7 << 3)
  62 #define CLK_PH              (1 << 2)
  63 #define CLK_POL             (1 << 1)
  64 #define MODE_SEL            (1 << 0)
  65 #define R_CONFIG_RSVD       (0x7bf40000)
  66
  67 /* interrupt mechanism */
  68 #define R_INTR_STATUS       (0x04 / 4)
  69 #define R_INTR_EN           (0x08 / 4)
  70 #define R_INTR_DIS          (0x0C / 4)
  71 #define R_INTR_MASK         (0x10 / 4)
  72 #define IXR_TX_FIFO_UNDERFLOW   (1 << 6)
  73 #define IXR_RX_FIFO_FULL        (1 << 5)
  74 #define IXR_RX_FIFO_NOT_EMPTY   (1 << 4)
  75 #define IXR_TX_FIFO_FULL        (1 << 3)
  76 #define IXR_TX_FIFO_NOT_FULL    (1 << 2)
  77 #define IXR_TX_FIFO_MODE_FAIL   (1 << 1)
  78 #define IXR_RX_FIFO_OVERFLOW    (1 << 0)
  79 #define IXR_ALL                 ((IXR_TX_FIFO_UNDERFLOW<<1)-1)
  80
  81 #define R_EN                (0x14 / 4)
  82 #define R_DELAY             (0x18 / 4)
  83 #define R_TX_DATA           (0x1C / 4)
  84 #define R_RX_DATA           (0x20 / 4)
  85 #define R_SLAVE_IDLE_COUNT  (0x24 / 4)
  86 #define R_TX_THRES          (0x28 / 4)
  87 #define R_RX_THRES          (0x2C / 4)
  88 #define R_TXD1              (0x80 / 4)
  89 #define R_TXD2              (0x84 / 4)
  90 #define R_TXD3              (0x88 / 4)
  91
  92 #define R_LQSPI_CFG         (0xa0 / 4)
  93 #define R_LQSPI_CFG_RESET       0x03A002EB
  94 #define LQSPI_CFG_LQ_MODE       (1U << 31)
  95 #define LQSPI_CFG_TWO_MEM       (1 << 30)
  96 #define LQSPI_CFG_SEP_BUS       (1 << 30)
  97 #define LQSPI_CFG_U_PAGE        (1 << 28)
  98 #define LQSPI_CFG_MODE_EN       (1 << 25)
  99 #define LQSPI_CFG_MODE_WIDTH    8
 100 #define LQSPI_CFG_MODE_SHIFT    16
 101 #define LQSPI_CFG_DUMMY_WIDTH   3
 102 #define LQSPI_CFG_DUMMY_SHIFT   8
 103 #define LQSPI_CFG_INST_CODE     0xFF
 104
 105 #define R_LQSPI_STS         (0xA4 / 4)
 106 #define LQSPI_STS_WR_RECVD      (1 << 1)
 107
 108 #define R_MOD_ID            (0xFC / 4)
 109
 110 /* size of TXRX FIFOs */
 111 #define RXFF_A          32
 112 #define TXFF_A          32
 113
 114 #define RXFF_A_Q          (64 * 4)
 115 #define TXFF_A_Q          (64 * 4)
 116
 117 /* 16MB per linear region */
 118 #define LQSPI_ADDRESS_BITS 24
 119 /* Bite off 4k chunks at a time */
 120 #define LQSPI_CACHE_SIZE 1024
 121
 122 #define SNOOP_CHECKING 0xFF
 123 #define SNOOP_NONE 0xFE
 124 #define SNOOP_STRIPING 0
 125
 126 typedef enum {
 127     READ = 0x3,
 128     FAST_READ = 0xb,
 129     DOR = 0x3b,
 130     QOR = 0x6b,
 131     DIOR = 0xbb,
 132     QIOR = 0xeb,
 133
 134     PP = 0x2,
 135     DPP = 0xa2,
 136     QPP = 0x32,
 137 } FlashCMD;
 138
 139 typedef struct {
 140     XilinxSPIPS parent_obj;
 141
 142     uint8_t lqspi_buf[LQSPI_CACHE_SIZE];
 143     hwaddr lqspi_cached_addr;
 144     Error *migration_blocker;
 145     bool mmio_execution_enabled;
 146 } XilinxQSPIPS;
 147
 148 typedef struct XilinxSPIPSClass {
 149     SysBusDeviceClass parent_class;
 150
 151     const MemoryRegionOps *reg_ops;
 152
 153     uint32_t rx_fifo_size;
 154     uint32_t tx_fifo_size;
 155 } XilinxSPIPSClass;
 156
 157 static inline int num_effective_busses(XilinxSPIPS *s)
 158 {
 159     return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
 160             s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM) ? s->num_busses : 1;
 161 }
 162
 163 static inline bool xilinx_spips_cs_is_set(XilinxSPIPS *s, int i, int field)
 164 {
 165     return ~field & (1 << i) && (s->regs[R_CONFIG] & MANUAL_CS
 166                     || !fifo8_is_empty(&s->tx_fifo));
 167 }
 168
 169 static void xilinx_spips_update_cs_lines(XilinxSPIPS *s)
 170 {
 171     int i, j;
 172     bool found = false;
 173     int field = s->regs[R_CONFIG] >> CS_SHIFT;
 174
 175     for (i = 0; i < s->num_cs; i++) {
 176         for (j = 0; j < num_effective_busses(s); j++) {
 177             int upage = !!(s->regs[R_LQSPI_STS] & LQSPI_CFG_U_PAGE);
 178             int cs_to_set = (j * s->num_cs + i + upage) %
 179                                 (s->num_cs * s->num_busses);
 180
 181             if (xilinx_spips_cs_is_set(s, i, field) && !found) {
 182                 DB_PRINT_L(0, "selecting slave %d\n", i);
 183                 qemu_set_irq(s->cs_lines[cs_to_set], 0);
 184             } else {
 185                 DB_PRINT_L(0, "deselecting slave %d\n", i);
 186                 qemu_set_irq(s->cs_lines[cs_to_set], 1);
 187             }
 188         }
 189         if (xilinx_spips_cs_is_set(s, i, field)) {
 190             found = true;
 191         }
 192     }
 193     if (!found) {
 194         s->snoop_state = SNOOP_CHECKING;
 195         DB_PRINT_L(1, "moving to snoop check state\n");
 196     }
 197 }
 198
 199 static void xilinx_spips_update_ixr(XilinxSPIPS *s)
 200 {
 201     if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_LQ_MODE) {
 202         return;
 203     }
 204     /* These are set/cleared as they occur */
 205     s->regs[R_INTR_STATUS] &= (IXR_TX_FIFO_UNDERFLOW | IXR_RX_FIFO_OVERFLOW |
 206                                 IXR_TX_FIFO_MODE_FAIL);
 207     /* these are pure functions of fifo state, set them here */
 208     s->regs[R_INTR_STATUS] |=
 209         (fifo8_is_full(&s->rx_fifo) ? IXR_RX_FIFO_FULL : 0) |
 210         (s->rx_fifo.num >= s->regs[R_RX_THRES] ? IXR_RX_FIFO_NOT_EMPTY : 0) |
 211         (fifo8_is_full(&s->tx_fifo) ? IXR_TX_FIFO_FULL : 0) |
 212         (s->tx_fifo.num < s->regs[R_TX_THRES] ? IXR_TX_FIFO_NOT_FULL : 0);
 213     /* drive external interrupt pin */
 214     int new_irqline = !!(s->regs[R_INTR_MASK] & s->regs[R_INTR_STATUS] &
 215                                                                 IXR_ALL);
 216     if (new_irqline != s->irqline) {
 217         s->irqline = new_irqline;
 218         qemu_set_irq(s->irq, s->irqline);
 219     }
 220 }
 221
 222 static void xilinx_spips_reset(DeviceState *d)
 223 {
 224     XilinxSPIPS *s = XILINX_SPIPS(d);
 225
 226     int i;
 227     for (i = 0; i < XLNX_SPIPS_R_MAX; i++) {
 228         s->regs[i] = 0;
 229     }
 230
 231     fifo8_reset(&s->rx_fifo);
 232     fifo8_reset(&s->rx_fifo);
 233     /* non zero resets */
 234     s->regs[R_CONFIG] |= MODEFAIL_GEN_EN;
 235     s->regs[R_SLAVE_IDLE_COUNT] = 0xFF;
 236     s->regs[R_TX_THRES] = 1;
 237     s->regs[R_RX_THRES] = 1;
 238     /* FIXME: move magic number definition somewhere sensible */
 239     s->regs[R_MOD_ID] = 0x01090106;
 240     s->regs[R_LQSPI_CFG] = R_LQSPI_CFG_RESET;
 241     s->snoop_state = SNOOP_CHECKING;
 242     xilinx_spips_update_ixr(s);
 243     xilinx_spips_update_cs_lines(s);
 244 }
 245
 246 /* N way (num) in place bit striper. Lay out row wise bits (LSB to MSB)
 247  * column wise (from element 0 to N-1). num is the length of x, and dir
 248  * reverses the direction of the transform. Best illustrated by example:
 249  * Each digit in the below array is a single bit (num == 3):
 250  *
 251  * {{ 76543210, }  ----- stripe (dir == false) -----> {{ FCheb630, }
 252  *  { hgfedcba, }                                      { GDAfc741, }
 253  *  { HGFEDCBA, }} <---- upstripe (dir == true) -----  { HEBgda52, }}
 254  */
 255
 256 static inline void stripe8(uint8_t *x, int num, bool dir)
 257 {
 258     uint8_t r[num];
 259     memset(r, 0, sizeof(uint8_t) * num);
 260     int idx[2] = {0, 0};
 261     int bit[2] = {0, 0};
 262     int d = dir;
 263
 264     for (idx[0] = 0; idx[0] < num; ++idx[0]) {
 265         for (bit[0] = 0; bit[0] < 8; ++bit[0]) {
 266             r[idx[d]] |= x[idx[!d]] & 1 << bit[!d] ? 1 << bit[d] : 0;
 267             idx[1] = (idx[1] + 1) % num;
 268             if (!idx[1]) {
 269                 bit[1]++;
 270             }
 271         }
 272     }
 273     memcpy(x, r, sizeof(uint8_t) * num);
 274 }
 275
 276 static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
 277 {
 278     int debug_level = 0;
 279
 280     for (;;) {
 281         int i;
 282         uint8_t tx = 0;
 283         uint8_t tx_rx[num_effective_busses(s)];
 284
 285         if (fifo8_is_empty(&s->tx_fifo)) {
 286             if (!(s->regs[R_LQSPI_CFG] & LQSPI_CFG_LQ_MODE)) {
 287                 s->regs[R_INTR_STATUS] |= IXR_TX_FIFO_UNDERFLOW;
 288             }
 289             xilinx_spips_update_ixr(s);
 290             return;
 291         } else if (s->snoop_state == SNOOP_STRIPING) {
 292             for (i = 0; i < num_effective_busses(s); ++i) {
 293                 tx_rx[i] = fifo8_pop(&s->tx_fifo);
 294             }
 295             stripe8(tx_rx, num_effective_busses(s), false);
 296         } else {
 297             tx = fifo8_pop(&s->tx_fifo);
 298             for (i = 0; i < num_effective_busses(s); ++i) {
 299                 tx_rx[i] = tx;
 300             }
 301         }
 302
 303         for (i = 0; i < num_effective_busses(s); ++i) {
 304             DB_PRINT_L(debug_level, "tx = %02x\n", tx_rx[i]);
 305             tx_rx[i] = ssi_transfer(s->spi[i], (uint32_t)tx_rx[i]);
 306             DB_PRINT_L(debug_level, "rx = %02x\n", tx_rx[i]);
 307         }
 308
 309         if (fifo8_is_full(&s->rx_fifo)) {
 310             s->regs[R_INTR_STATUS] |= IXR_RX_FIFO_OVERFLOW;
 311             DB_PRINT_L(0, "rx FIFO overflow");
 312         } else if (s->snoop_state == SNOOP_STRIPING) {
 313             stripe8(tx_rx, num_effective_busses(s), true);
 314             for (i = 0; i < num_effective_busses(s); ++i) {
 315                 fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[i]);
 316             }
 317         } else {
 318            fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[0]);
 319         }
 320
 321         DB_PRINT_L(debug_level, "initial snoop state: %x\n",
 322                    (unsigned)s->snoop_state);
 323         switch (s->snoop_state) {
 324         case (SNOOP_CHECKING):
 325             switch (tx) { /* new instruction code */
 326             case READ: /* 3 address bytes, no dummy bytes/cycles */
 327             case PP:
 328             case DPP:
 329             case QPP:
 330                 s->snoop_state = 3;
 331                 break;
 332             case FAST_READ: /* 3 address bytes, 1 dummy byte */
 333             case DOR:
 334             case QOR:
 335             case DIOR: /* FIXME: these vary between vendor - set to spansion */
 336                 s->snoop_state = 4;
 337                 break;
 338             case QIOR: /* 3 address bytes, 2 dummy bytes */
 339                 s->snoop_state = 6;
 340                 break;
 341             default:
 342                 s->snoop_state = SNOOP_NONE;
 343             }
 344             break;
 345         case (SNOOP_STRIPING):
 346         case (SNOOP_NONE):
 347             /* Once we hit the boring stuff - squelch debug noise */
 348             if (!debug_level) {
 349                 DB_PRINT_L(0, "squelching debug info ....\n");
 350                 debug_level = 1;
 351             }
 352             break;
 353         default:
 354             s->snoop_state--;
 355         }
 356         DB_PRINT_L(debug_level, "final snoop state: %x\n",
 357                    (unsigned)s->snoop_state);
 358     }
 359 }
 360
 361 static inline void rx_data_bytes(XilinxSPIPS *s, uint8_t *value, int max)
 362 {
 363     int i;
 364
 365     for (i = 0; i < max && !fifo8_is_empty(&s->rx_fifo); ++i) {
 366         value[i] = fifo8_pop(&s->rx_fifo);
 367     }
 368 }
 369
 370 static uint64_t xilinx_spips_read(void *opaque, hwaddr addr,
 371                                                         unsigned size)
 372 {
 373     XilinxSPIPS *s = opaque;
 374     uint32_t mask = ~0;
 375     uint32_t ret;
 376     uint8_t rx_buf[4];
 377
 378     addr >>= 2;
 379     switch (addr) {
 380     case R_CONFIG:
 381         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
 382         break;
 383     case R_INTR_STATUS:
 384         ret = s->regs[addr] & IXR_ALL;
 385         s->regs[addr] = 0;
 386         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
 387         return ret;
 388     case R_INTR_MASK:
 389         mask = IXR_ALL;
 390         break;
 391     case  R_EN:
 392         mask = 0x1;
 393         break;
 394     case R_SLAVE_IDLE_COUNT:
 395         mask = 0xFF;
 396         break;
 397     case R_MOD_ID:
 398         mask = 0x01FFFFFF;
 399         break;
 400     case R_INTR_EN:
 401     case R_INTR_DIS:
 402     case R_TX_DATA:
 403         mask = 0;
 404         break;
 405     case R_RX_DATA:
 406         memset(rx_buf, 0, sizeof(rx_buf));
 407         rx_data_bytes(s, rx_buf, s->num_txrx_bytes);
 408         ret = s->regs[R_CONFIG] & ENDIAN ? cpu_to_be32(*(uint32_t *)rx_buf)
 409                         : cpu_to_le32(*(uint32_t *)rx_buf);
 410         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
 411         xilinx_spips_update_ixr(s);
 412         return ret;
 413     }
 414     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4,
 415                s->regs[addr] & mask);
 416     return s->regs[addr] & mask;
 417
 418 }
 419
 420 static inline void tx_data_bytes(XilinxSPIPS *s, uint32_t value, int num)
 421 {
 422     int i;
 423     for (i = 0; i < num && !fifo8_is_full(&s->tx_fifo); ++i) {
 424         if (s->regs[R_CONFIG] & ENDIAN) {
 425             fifo8_push(&s->tx_fifo, (uint8_t)(value >> 24));
 426             value <<= 8;
 427         } else {
 428             fifo8_push(&s->tx_fifo, (uint8_t)value);
 429             value >>= 8;
 430         }
 431     }
 432 }
 433
 434 static void xilinx_spips_write(void *opaque, hwaddr addr,
 435                                         uint64_t value, unsigned size)
 436 {
 437     int mask = ~0;
 438     int man_start_com = 0;
 439     XilinxSPIPS *s = opaque;
 440
 441     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr, (unsigned)value);
 442     addr >>= 2;
 443     switch (addr) {
 444     case R_CONFIG:
 445         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
 446         if (value & MAN_START_COM) {
 447             man_start_com = 1;
 448         }
 449         break;
 450     case R_INTR_STATUS:
 451         mask = IXR_ALL;
 452         s->regs[R_INTR_STATUS] &= ~(mask & value);
 453         goto no_reg_update;
 454     case R_INTR_DIS:
 455         mask = IXR_ALL;
 456         s->regs[R_INTR_MASK] &= ~(mask & value);
 457         goto no_reg_update;
 458     case R_INTR_EN:
 459         mask = IXR_ALL;
 460         s->regs[R_INTR_MASK] |= mask & value;
 461         goto no_reg_update;
 462     case R_EN:
 463         mask = 0x1;
 464         break;
 465     case R_SLAVE_IDLE_COUNT:
 466         mask = 0xFF;
 467         break;
 468     case R_RX_DATA:
 469     case R_INTR_MASK:
 470     case R_MOD_ID:
 471         mask = 0;
 472         break;
 473     case R_TX_DATA:
 474         tx_data_bytes(s, (uint32_t)value, s->num_txrx_bytes);
 475         goto no_reg_update;
 476     case R_TXD1:
 477         tx_data_bytes(s, (uint32_t)value, 1);
 478         goto no_reg_update;
 479     case R_TXD2:
 480         tx_data_bytes(s, (uint32_t)value, 2);
 481         goto no_reg_update;
 482     case R_TXD3:
 483         tx_data_bytes(s, (uint32_t)value, 3);
 484         goto no_reg_update;
 485     }
 486     s->regs[addr] = (s->regs[addr] & ~mask) | (value & mask);
 487 no_reg_update:
 488     xilinx_spips_update_cs_lines(s);
 489     if ((man_start_com && s->regs[R_CONFIG] & MAN_START_EN) ||
 490             (fifo8_is_empty(&s->tx_fifo) && s->regs[R_CONFIG] & MAN_START_EN)) {
 491         xilinx_spips_flush_txfifo(s);
 492     }
 493     xilinx_spips_update_cs_lines(s);
 494     xilinx_spips_update_ixr(s);
 495 }
 496
 497 static const MemoryRegionOps spips_ops = {
 498     .read = xilinx_spips_read,
 499     .write = xilinx_spips_write,
 500     .endianness = DEVICE_LITTLE_ENDIAN,
 501 };
 502
 503 static void xilinx_qspips_invalidate_mmio_ptr(XilinxQSPIPS *q)
 504 {
 505     XilinxSPIPS *s = &q->parent_obj;
 506
 507     if ((q->mmio_execution_enabled) && (q->lqspi_cached_addr != ~0ULL)) {
 508         /* Invalidate the current mapped mmio */
 509         memory_region_invalidate_mmio_ptr(&s->mmlqspi, q->lqspi_cached_addr,
 510                                           LQSPI_CACHE_SIZE);
 511     }
 512
 513     q->lqspi_cached_addr = ~0ULL;
 514 }
 515
 516 static void xilinx_qspips_write(void *opaque, hwaddr addr,
 517                                 uint64_t value, unsigned size)
 518 {
 519     XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
 520
 521     xilinx_spips_write(opaque, addr, value, size);
 522     addr >>= 2;
 523
 524     if (addr == R_LQSPI_CFG) {
 525         xilinx_qspips_invalidate_mmio_ptr(q);
 526     }
 527 }
 528
 529 static const MemoryRegionOps qspips_ops = {
 530     .read = xilinx_spips_read,
 531     .write = xilinx_qspips_write,
 532     .endianness = DEVICE_LITTLE_ENDIAN,
 533 };
 534
 535 #define LQSPI_CACHE_SIZE 1024
 536
 537 static void lqspi_load_cache(void *opaque, hwaddr addr)
 538 {
 539     XilinxQSPIPS *q = opaque;
 540     XilinxSPIPS *s = opaque;
 541     int i;
 542     int flash_addr = ((addr & ~(LQSPI_CACHE_SIZE - 1))
 543                    / num_effective_busses(s));
 544     int slave = flash_addr >> LQSPI_ADDRESS_BITS;
 545     int cache_entry = 0;
 546     uint32_t u_page_save = s->regs[R_LQSPI_STS] & ~LQSPI_CFG_U_PAGE;
 547
 548     if (addr < q->lqspi_cached_addr ||
 549             addr > q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
 550         xilinx_qspips_invalidate_mmio_ptr(q);
 551         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
 552         s->regs[R_LQSPI_STS] |= slave ? LQSPI_CFG_U_PAGE : 0;
 553
 554         DB_PRINT_L(0, "config reg status: %08x\n", s->regs[R_LQSPI_CFG]);
 555
 556         fifo8_reset(&s->tx_fifo);
 557         fifo8_reset(&s->rx_fifo);
 558
 559         /* instruction */
 560         DB_PRINT_L(0, "pushing read instruction: %02x\n",
 561                    (unsigned)(uint8_t)(s->regs[R_LQSPI_CFG] &
 562                                        LQSPI_CFG_INST_CODE));
 563         fifo8_push(&s->tx_fifo, s->regs[R_LQSPI_CFG] & LQSPI_CFG_INST_CODE);
 564         /* read address */
 565         DB_PRINT_L(0, "pushing read address %06x\n", flash_addr);
 566         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 16));
 567         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 8));
 568         fifo8_push(&s->tx_fifo, (uint8_t)flash_addr);
 569         /* mode bits */
 570         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_MODE_EN) {
 571             fifo8_push(&s->tx_fifo, extract32(s->regs[R_LQSPI_CFG],
 572                                               LQSPI_CFG_MODE_SHIFT,
 573                                               LQSPI_CFG_MODE_WIDTH));
 574         }
 575         /* dummy bytes */
 576         for (i = 0; i < (extract32(s->regs[R_LQSPI_CFG], LQSPI_CFG_DUMMY_SHIFT,
 577                                    LQSPI_CFG_DUMMY_WIDTH)); ++i) {
 578             DB_PRINT_L(0, "pushing dummy byte\n");
 579             fifo8_push(&s->tx_fifo, 0);
 580         }
 581         xilinx_spips_update_cs_lines(s);
 582         xilinx_spips_flush_txfifo(s);
 583         fifo8_reset(&s->rx_fifo);
 584
 585         DB_PRINT_L(0, "starting QSPI data read\n");
 586
 587         while (cache_entry < LQSPI_CACHE_SIZE) {
 588             for (i = 0; i < 64; ++i) {
 589                 tx_data_bytes(s, 0, 1);
 590             }
 591             xilinx_spips_flush_txfifo(s);
 592             for (i = 0; i < 64; ++i) {
 593                 rx_data_bytes(s, &q->lqspi_buf[cache_entry++], 1);
 594             }
 595         }
 596
 597         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
 598         s->regs[R_LQSPI_STS] |= u_page_save;
 599         xilinx_spips_update_cs_lines(s);
 600
 601         q->lqspi_cached_addr = flash_addr * num_effective_busses(s);
 602     }
 603 }
 604
 605 static void *lqspi_request_mmio_ptr(void *opaque, hwaddr addr, unsigned *size,
 606                                     unsigned *offset)
 607 {
 608     XilinxQSPIPS *q = opaque;
 609     hwaddr offset_within_the_region;
 610
 611     if (!q->mmio_execution_enabled) {
 612         return NULL;
 613     }
 614
 615     offset_within_the_region = addr & ~(LQSPI_CACHE_SIZE - 1);
 616     lqspi_load_cache(opaque, offset_within_the_region);
 617     *size = LQSPI_CACHE_SIZE;
 618     *offset = offset_within_the_region;
 619     return q->lqspi_buf;
 620 }
 621
 622 static uint64_t
 623 lqspi_read(void *opaque, hwaddr addr, unsigned int size)
 624 {
 625     XilinxQSPIPS *q = opaque;
 626     uint32_t ret;
 627
 628     if (addr >= q->lqspi_cached_addr &&
 629             addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
 630         uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
 631         ret = cpu_to_le32(*(uint32_t *)retp);
 632         DB_PRINT_L(1, "addr: %08x, data: %08x\n", (unsigned)addr,
 633                    (unsigned)ret);
 634         return ret;
 635     } else {
 636         lqspi_load_cache(opaque, addr);
 637         return lqspi_read(opaque, addr, size);
 638     }
 639 }
 640
 641 static const MemoryRegionOps lqspi_ops = {
 642     .read = lqspi_read,
 643     .request_ptr = lqspi_request_mmio_ptr,
 644     .endianness = DEVICE_NATIVE_ENDIAN,
 645     .valid = {
 646         .min_access_size = 1,
 647         .max_access_size = 4
 648     }
 649 };
 650
 651 static void xilinx_spips_realize(DeviceState *dev, Error **errp)
 652 {
 653     XilinxSPIPS *s = XILINX_SPIPS(dev);
 654     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 655     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
 656     qemu_irq *cs;
 657     int i;
 658
 659     DB_PRINT_L(0, "realized spips\n");
 660
 661     s->spi = g_new(SSIBus *, s->num_busses);
 662     for (i = 0; i < s->num_busses; ++i) {
 663         char bus_name[16];
 664         snprintf(bus_name, 16, "spi%d", i);
 665         s->spi[i] = ssi_create_bus(dev, bus_name);
 666     }
 667
 668     s->cs_lines = g_new0(qemu_irq, s->num_cs * s->num_busses);
 669     for (i = 0, cs = s->cs_lines; i < s->num_busses; ++i, cs += s->num_cs) {
 670         ssi_auto_connect_slaves(DEVICE(s), cs, s->spi[i]);
 671     }
 672
 673     sysbus_init_irq(sbd, &s->irq);
 674     for (i = 0; i < s->num_cs * s->num_busses; ++i) {
 675         sysbus_init_irq(sbd, &s->cs_lines[i]);
 676     }
 677
 678     memory_region_init_io(&s->iomem, OBJECT(s), xsc->reg_ops, s,
 679                           "spi", XLNX_SPIPS_R_MAX * 4);
 680     sysbus_init_mmio(sbd, &s->iomem);
 681
 682     s->irqline = -1;
 683
 684     fifo8_create(&s->rx_fifo, xsc->rx_fifo_size);
 685     fifo8_create(&s->tx_fifo, xsc->tx_fifo_size);
 686 }
 687
 688 static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
 689 {
 690     XilinxSPIPS *s = XILINX_SPIPS(dev);
 691     XilinxQSPIPS *q = XILINX_QSPIPS(dev);
 692     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 693
 694     DB_PRINT_L(0, "realized qspips\n");
 695
 696     s->num_busses = 2;
 697     s->num_cs = 2;
 698     s->num_txrx_bytes = 4;
 699
 700     xilinx_spips_realize(dev, errp);
 701     memory_region_init_io(&s->mmlqspi, OBJECT(s), &lqspi_ops, s, "lqspi",
 702                           (1 << LQSPI_ADDRESS_BITS) * 2);
 703     sysbus_init_mmio(sbd, &s->mmlqspi);
 704
 705     q->lqspi_cached_addr = ~0ULL;
 706
 707     /* mmio_execution breaks migration better aborting than having strange
 708      * bugs.
 709      */
 710     if (q->mmio_execution_enabled) {
 711         error_setg(&q->migration_blocker,
 712                    "enabling mmio_execution breaks migration");
 713         migrate_add_blocker(q->migration_blocker, &error_fatal);
 714     }
 715 }
 716
 717 static int xilinx_spips_post_load(void *opaque, int version_id)
 718 {
 719     xilinx_spips_update_ixr((XilinxSPIPS *)opaque);
 720     xilinx_spips_update_cs_lines((XilinxSPIPS *)opaque);
 721     return 0;
 722 }
 723
 724 static const VMStateDescription vmstate_xilinx_spips = {
 725     .name = "xilinx_spips",
 726     .version_id = 2,
 727     .minimum_version_id = 2,
 728     .post_load = xilinx_spips_post_load,
 729     .fields = (VMStateField[]) {
 730         VMSTATE_FIFO8(tx_fifo, XilinxSPIPS),
 731         VMSTATE_FIFO8(rx_fifo, XilinxSPIPS),
 732         VMSTATE_UINT32_ARRAY(regs, XilinxSPIPS, XLNX_SPIPS_R_MAX),
 733         VMSTATE_UINT8(snoop_state, XilinxSPIPS),
 734         VMSTATE_END_OF_LIST()
 735     }
 736 };
 737
 738 static Property xilinx_qspips_properties[] = {
 739     /* We had to turn this off for 2.10 as it is not compatible with migration.
 740      * It can be enabled but will prevent the device to be migrated.
 741      * This will go aways when a fix will be released.
 742      */
 743     DEFINE_PROP_BOOL("x-mmio-exec", XilinxQSPIPS, mmio_execution_enabled,
 744                      false),
 745     DEFINE_PROP_END_OF_LIST(),
 746 };
 747
 748 static Property xilinx_spips_properties[] = {
 749     DEFINE_PROP_UINT8("num-busses", XilinxSPIPS, num_busses, 1),
 750     DEFINE_PROP_UINT8("num-ss-bits", XilinxSPIPS, num_cs, 4),
 751     DEFINE_PROP_UINT8("num-txrx-bytes", XilinxSPIPS, num_txrx_bytes, 1),
 752     DEFINE_PROP_END_OF_LIST(),
 753 };
 754
 755 static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
 756 {
 757     DeviceClass *dc = DEVICE_CLASS(klass);
 758     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
 759
 760     dc->realize = xilinx_qspips_realize;
 761     dc->props = xilinx_qspips_properties;
 762     xsc->reg_ops = &qspips_ops;
 763     xsc->rx_fifo_size = RXFF_A_Q;
 764     xsc->tx_fifo_size = TXFF_A_Q;
 765 }
 766
 767 static void xilinx_spips_class_init(ObjectClass *klass, void *data)
 768 {
 769     DeviceClass *dc = DEVICE_CLASS(klass);
 770     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
 771
 772     dc->realize = xilinx_spips_realize;
 773     dc->reset = xilinx_spips_reset;
 774     dc->props = xilinx_spips_properties;
 775     dc->vmsd = &vmstate_xilinx_spips;
 776
 777     xsc->reg_ops = &spips_ops;
 778     xsc->rx_fifo_size = RXFF_A;
 779     xsc->tx_fifo_size = TXFF_A;
 780 }
 781
 782 static const TypeInfo xilinx_spips_info = {
 783     .name  = TYPE_XILINX_SPIPS,
 784     .parent = TYPE_SYS_BUS_DEVICE,
 785     .instance_size  = sizeof(XilinxSPIPS),
 786     .class_init = xilinx_spips_class_init,
 787     .class_size = sizeof(XilinxSPIPSClass),
 788 };
 789
 790 static const TypeInfo xilinx_qspips_info = {
 791     .name  = TYPE_XILINX_QSPIPS,
 792     .parent = TYPE_XILINX_SPIPS,
 793     .instance_size  = sizeof(XilinxQSPIPS),
 794     .class_init = xilinx_qspips_class_init,
 795 };
 796
 797 static void xilinx_spips_register_types(void)
 798 {
 799     type_register_static(&xilinx_spips_info);
 800     type_register_static(&xilinx_qspips_info);
 801 }
 802
 803 type_init(xilinx_spips_register_types)