hw/ssi/xilinx_spips.c

   1 /*
   2  * QEMU model of the Xilinx Zynq SPI controller
   3  *
   4  * Copyright (c) 2012 Peter A. G. Crosthwaite
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26 #include "hw/sysbus.h"
  27 #include "hw/irq.h"
  28 #include "hw/ptimer.h"
  29 #include "hw/qdev-properties.h"
  30 #include "qemu/log.h"
  31 #include "qemu/module.h"
  32 #include "qemu/bitops.h"
  33 #include "hw/ssi/xilinx_spips.h"
  34 #include "qapi/error.h"
  35 #include "hw/register.h"
  36 #include "sysemu/dma.h"
  37 #include "migration/blocker.h"
  38 #include "migration/vmstate.h"
  39
  40 #ifndef XILINX_SPIPS_ERR_DEBUG
  41 #define XILINX_SPIPS_ERR_DEBUG 0
  42 #endif
  43
  44 #define DB_PRINT_L(level, ...) do { \
  45     if (XILINX_SPIPS_ERR_DEBUG > (level)) { \
  46         fprintf(stderr,  ": %s: ", __func__); \
  47         fprintf(stderr, ## __VA_ARGS__); \
  48     } \
  49 } while (0)
  50
  51 /* config register */
  52 #define R_CONFIG            (0x00 / 4)
  53 #define IFMODE              (1U << 31)
  54 #define R_CONFIG_ENDIAN     (1 << 26)
  55 #define MODEFAIL_GEN_EN     (1 << 17)
  56 #define MAN_START_COM       (1 << 16)
  57 #define MAN_START_EN        (1 << 15)
  58 #define MANUAL_CS           (1 << 14)
  59 #define CS                  (0xF << 10)
  60 #define CS_SHIFT            (10)
  61 #define PERI_SEL            (1 << 9)
  62 #define REF_CLK             (1 << 8)
  63 #define FIFO_WIDTH          (3 << 6)
  64 #define BAUD_RATE_DIV       (7 << 3)
  65 #define CLK_PH              (1 << 2)
  66 #define CLK_POL             (1 << 1)
  67 #define MODE_SEL            (1 << 0)
  68 #define R_CONFIG_RSVD       (0x7bf40000)
  69
  70 /* interrupt mechanism */
  71 #define R_INTR_STATUS       (0x04 / 4)
  72 #define R_INTR_STATUS_RESET (0x104)
  73 #define R_INTR_EN           (0x08 / 4)
  74 #define R_INTR_DIS          (0x0C / 4)
  75 #define R_INTR_MASK         (0x10 / 4)
  76 #define IXR_TX_FIFO_UNDERFLOW   (1 << 6)
  77 /* Poll timeout not implemented */
  78 #define IXR_RX_FIFO_EMPTY       (1 << 11)
  79 #define IXR_GENERIC_FIFO_FULL   (1 << 10)
  80 #define IXR_GENERIC_FIFO_NOT_FULL (1 << 9)
  81 #define IXR_TX_FIFO_EMPTY       (1 << 8)
  82 #define IXR_GENERIC_FIFO_EMPTY  (1 << 7)
  83 #define IXR_RX_FIFO_FULL        (1 << 5)
  84 #define IXR_RX_FIFO_NOT_EMPTY   (1 << 4)
  85 #define IXR_TX_FIFO_FULL        (1 << 3)
  86 #define IXR_TX_FIFO_NOT_FULL    (1 << 2)
  87 #define IXR_TX_FIFO_MODE_FAIL   (1 << 1)
  88 #define IXR_RX_FIFO_OVERFLOW    (1 << 0)
  89 #define IXR_ALL                 ((1 << 13) - 1)
  90 #define GQSPI_IXR_MASK          0xFBE
  91 #define IXR_SELF_CLEAR \
  92 (IXR_GENERIC_FIFO_EMPTY \
  93 | IXR_GENERIC_FIFO_FULL  \
  94 | IXR_GENERIC_FIFO_NOT_FULL \
  95 | IXR_TX_FIFO_EMPTY \
  96 | IXR_TX_FIFO_FULL  \
  97 | IXR_TX_FIFO_NOT_FULL \
  98 | IXR_RX_FIFO_EMPTY \
  99 | IXR_RX_FIFO_FULL  \
 100 | IXR_RX_FIFO_NOT_EMPTY)
 101
 102 #define R_EN                (0x14 / 4)
 103 #define R_DELAY             (0x18 / 4)
 104 #define R_TX_DATA           (0x1C / 4)
 105 #define R_RX_DATA           (0x20 / 4)
 106 #define R_SLAVE_IDLE_COUNT  (0x24 / 4)
 107 #define R_TX_THRES          (0x28 / 4)
 108 #define R_RX_THRES          (0x2C / 4)
 109 #define R_GPIO              (0x30 / 4)
 110 #define R_LPBK_DLY_ADJ      (0x38 / 4)
 111 #define R_LPBK_DLY_ADJ_RESET (0x33)
 112 #define R_IOU_TAPDLY_BYPASS (0x3C / 4)
 113 #define R_TXD1              (0x80 / 4)
 114 #define R_TXD2              (0x84 / 4)
 115 #define R_TXD3              (0x88 / 4)
 116
 117 #define R_LQSPI_CFG         (0xa0 / 4)
 118 #define R_LQSPI_CFG_RESET       0x03A002EB
 119 #define LQSPI_CFG_LQ_MODE       (1U << 31)
 120 #define LQSPI_CFG_TWO_MEM       (1 << 30)
 121 #define LQSPI_CFG_SEP_BUS       (1 << 29)
 122 #define LQSPI_CFG_U_PAGE        (1 << 28)
 123 #define LQSPI_CFG_ADDR4         (1 << 27)
 124 #define LQSPI_CFG_MODE_EN       (1 << 25)
 125 #define LQSPI_CFG_MODE_WIDTH    8
 126 #define LQSPI_CFG_MODE_SHIFT    16
 127 #define LQSPI_CFG_DUMMY_WIDTH   3
 128 #define LQSPI_CFG_DUMMY_SHIFT   8
 129 #define LQSPI_CFG_INST_CODE     0xFF
 130
 131 #define R_CMND        (0xc0 / 4)
 132     #define R_CMND_RXFIFO_DRAIN   (1 << 19)
 133     FIELD(CMND, PARTIAL_BYTE_LEN, 16, 3)
 134 #define R_CMND_EXT_ADD        (1 << 15)
 135     FIELD(CMND, RX_DISCARD, 8, 7)
 136     FIELD(CMND, DUMMY_CYCLES, 2, 6)
 137 #define R_CMND_DMA_EN         (1 << 1)
 138 #define R_CMND_PUSH_WAIT      (1 << 0)
 139 #define R_TRANSFER_SIZE     (0xc4 / 4)
 140 #define R_LQSPI_STS         (0xA4 / 4)
 141 #define LQSPI_STS_WR_RECVD      (1 << 1)
 142
 143 #define R_DUMMY_CYCLE_EN    (0xC8 / 4)
 144 #define R_ECO               (0xF8 / 4)
 145 #define R_MOD_ID            (0xFC / 4)
 146
 147 #define R_GQSPI_SELECT          (0x144 / 4)
 148     FIELD(GQSPI_SELECT, GENERIC_QSPI_EN, 0, 1)
 149 #define R_GQSPI_ISR         (0x104 / 4)
 150 #define R_GQSPI_IER         (0x108 / 4)
 151 #define R_GQSPI_IDR         (0x10c / 4)
 152 #define R_GQSPI_IMR         (0x110 / 4)
 153 #define R_GQSPI_IMR_RESET   (0xfbe)
 154 #define R_GQSPI_TX_THRESH   (0x128 / 4)
 155 #define R_GQSPI_RX_THRESH   (0x12c / 4)
 156 #define R_GQSPI_GPIO (0x130 / 4)
 157 #define R_GQSPI_LPBK_DLY_ADJ (0x138 / 4)
 158 #define R_GQSPI_LPBK_DLY_ADJ_RESET (0x33)
 159 #define R_GQSPI_CNFG        (0x100 / 4)
 160     FIELD(GQSPI_CNFG, MODE_EN, 30, 2)
 161     FIELD(GQSPI_CNFG, GEN_FIFO_START_MODE, 29, 1)
 162     FIELD(GQSPI_CNFG, GEN_FIFO_START, 28, 1)
 163     FIELD(GQSPI_CNFG, ENDIAN, 26, 1)
 164     /* Poll timeout not implemented */
 165     FIELD(GQSPI_CNFG, EN_POLL_TIMEOUT, 20, 1)
 166     /* QEMU doesnt care about any of these last three */
 167     FIELD(GQSPI_CNFG, BR, 3, 3)
 168     FIELD(GQSPI_CNFG, CPH, 2, 1)
 169     FIELD(GQSPI_CNFG, CPL, 1, 1)
 170 #define R_GQSPI_GEN_FIFO        (0x140 / 4)
 171 #define R_GQSPI_TXD             (0x11c / 4)
 172 #define R_GQSPI_RXD             (0x120 / 4)
 173 #define R_GQSPI_FIFO_CTRL       (0x14c / 4)
 174     FIELD(GQSPI_FIFO_CTRL, RX_FIFO_RESET, 2, 1)
 175     FIELD(GQSPI_FIFO_CTRL, TX_FIFO_RESET, 1, 1)
 176     FIELD(GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET, 0, 1)
 177 #define R_GQSPI_GFIFO_THRESH    (0x150 / 4)
 178 #define R_GQSPI_DATA_STS (0x15c / 4)
 179 /* We use the snapshot register to hold the core state for the currently
 180  * or most recently executed command. So the generic fifo format is defined
 181  * for the snapshot register
 182  */
 183 #define R_GQSPI_GF_SNAPSHOT (0x160 / 4)
 184     FIELD(GQSPI_GF_SNAPSHOT, POLL, 19, 1)
 185     FIELD(GQSPI_GF_SNAPSHOT, STRIPE, 18, 1)
 186     FIELD(GQSPI_GF_SNAPSHOT, RECIEVE, 17, 1)
 187     FIELD(GQSPI_GF_SNAPSHOT, TRANSMIT, 16, 1)
 188     FIELD(GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT, 14, 2)
 189     FIELD(GQSPI_GF_SNAPSHOT, CHIP_SELECT, 12, 2)
 190     FIELD(GQSPI_GF_SNAPSHOT, SPI_MODE, 10, 2)
 191     FIELD(GQSPI_GF_SNAPSHOT, EXPONENT, 9, 1)
 192     FIELD(GQSPI_GF_SNAPSHOT, DATA_XFER, 8, 1)
 193     FIELD(GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA, 0, 8)
 194 #define R_GQSPI_MOD_ID        (0x1fc / 4)
 195 #define R_GQSPI_MOD_ID_RESET  (0x10a0000)
 196
 197 #define R_QSPIDMA_DST_CTRL         (0x80c / 4)
 198 #define R_QSPIDMA_DST_CTRL_RESET   (0x803ffa00)
 199 #define R_QSPIDMA_DST_I_MASK       (0x820 / 4)
 200 #define R_QSPIDMA_DST_I_MASK_RESET (0xfe)
 201 #define R_QSPIDMA_DST_CTRL2        (0x824 / 4)
 202 #define R_QSPIDMA_DST_CTRL2_RESET  (0x081bfff8)
 203
 204 /* size of TXRX FIFOs */
 205 #define RXFF_A          (128)
 206 #define TXFF_A          (128)
 207
 208 #define RXFF_A_Q          (64 * 4)
 209 #define TXFF_A_Q          (64 * 4)
 210
 211 /* 16MB per linear region */
 212 #define LQSPI_ADDRESS_BITS 24
 213
 214 #define SNOOP_CHECKING 0xFF
 215 #define SNOOP_ADDR 0xF0
 216 #define SNOOP_NONE 0xEE
 217 #define SNOOP_STRIPING 0
 218
 219 #define MIN_NUM_BUSSES 1
 220 #define MAX_NUM_BUSSES 2
 221
 222 static inline int num_effective_busses(XilinxSPIPS *s)
 223 {
 224     return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
 225             s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM) ? s->num_busses : 1;
 226 }
 227
 228 static void xilinx_spips_update_cs(XilinxSPIPS *s, int field)
 229 {
 230     int i;
 231
 232     for (i = 0; i < s->num_cs * s->num_busses; i++) {
 233         bool old_state = s->cs_lines_state[i];
 234         bool new_state = field & (1 << i);
 235
 236         if (old_state != new_state) {
 237             s->cs_lines_state[i] = new_state;
 238             s->rx_discard = ARRAY_FIELD_EX32(s->regs, CMND, RX_DISCARD);
 239             DB_PRINT_L(1, "%sselecting peripheral %d\n",
 240                        new_state ? "" : "de", i);
 241         }
 242         qemu_set_irq(s->cs_lines[i], !new_state);
 243     }
 244     if (!(field & ((1 << (s->num_cs * s->num_busses)) - 1))) {
 245         s->snoop_state = SNOOP_CHECKING;
 246         s->cmd_dummies = 0;
 247         s->link_state = 1;
 248         s->link_state_next = 1;
 249         s->link_state_next_when = 0;
 250         DB_PRINT_L(1, "moving to snoop check state\n");
 251     }
 252 }
 253
 254 static void xlnx_zynqmp_qspips_update_cs_lines(XlnxZynqMPQSPIPS *s)
 255 {
 256     if (s->regs[R_GQSPI_GF_SNAPSHOT]) {
 257         int field = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, CHIP_SELECT);
 258         bool upper_cs_sel = field & (1 << 1);
 259         bool lower_cs_sel = field & 1;
 260         bool bus0_enabled;
 261         bool bus1_enabled;
 262         uint8_t buses;
 263         int cs = 0;
 264
 265         buses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
 266         bus0_enabled = buses & 1;
 267         bus1_enabled = buses & (1 << 1);
 268
 269         if (bus0_enabled && bus1_enabled) {
 270             if (lower_cs_sel) {
 271                 cs |= 1;
 272             }
 273             if (upper_cs_sel) {
 274                 cs |= 1 << 3;
 275             }
 276         } else if (bus0_enabled) {
 277             if (lower_cs_sel) {
 278                 cs |= 1;
 279             }
 280             if (upper_cs_sel) {
 281                 cs |= 1 << 1;
 282             }
 283         } else if (bus1_enabled) {
 284             if (lower_cs_sel) {
 285                 cs |= 1 << 2;
 286             }
 287             if (upper_cs_sel) {
 288                 cs |= 1 << 3;
 289             }
 290         }
 291         xilinx_spips_update_cs(XILINX_SPIPS(s), cs);
 292     }
 293 }
 294
 295 static void xilinx_spips_update_cs_lines(XilinxSPIPS *s)
 296 {
 297     int field = ~((s->regs[R_CONFIG] & CS) >> CS_SHIFT);
 298
 299     /* In dual parallel, mirror low CS to both */
 300     if (num_effective_busses(s) == 2) {
 301         /* Single bit chip-select for qspi */
 302         field &= 0x1;
 303         field |= field << 3;
 304     /* Dual stack U-Page */
 305     } else if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_TWO_MEM &&
 306                s->regs[R_LQSPI_STS] & LQSPI_CFG_U_PAGE) {
 307         /* Single bit chip-select for qspi */
 308         field &= 0x1;
 309         /* change from CS0 to CS1 */
 310         field <<= 1;
 311     }
 312     /* Auto CS */
 313     if (!(s->regs[R_CONFIG] & MANUAL_CS) &&
 314         fifo8_is_empty(&s->tx_fifo)) {
 315         field = 0;
 316     }
 317     xilinx_spips_update_cs(s, field);
 318 }
 319
 320 static void xilinx_spips_update_ixr(XilinxSPIPS *s)
 321 {
 322     if (!(s->regs[R_LQSPI_CFG] & LQSPI_CFG_LQ_MODE)) {
 323         s->regs[R_INTR_STATUS] &= ~IXR_SELF_CLEAR;
 324         s->regs[R_INTR_STATUS] |=
 325             (fifo8_is_full(&s->rx_fifo) ? IXR_RX_FIFO_FULL : 0) |
 326             (s->rx_fifo.num >= s->regs[R_RX_THRES] ?
 327                                     IXR_RX_FIFO_NOT_EMPTY : 0) |
 328             (fifo8_is_full(&s->tx_fifo) ? IXR_TX_FIFO_FULL : 0) |
 329             (fifo8_is_empty(&s->tx_fifo) ? IXR_TX_FIFO_EMPTY : 0) |
 330             (s->tx_fifo.num < s->regs[R_TX_THRES] ? IXR_TX_FIFO_NOT_FULL : 0);
 331     }
 332     int new_irqline = !!(s->regs[R_INTR_MASK] & s->regs[R_INTR_STATUS] &
 333                                                                 IXR_ALL);
 334     if (new_irqline != s->irqline) {
 335         s->irqline = new_irqline;
 336         qemu_set_irq(s->irq, s->irqline);
 337     }
 338 }
 339
 340 static void xlnx_zynqmp_qspips_update_ixr(XlnxZynqMPQSPIPS *s)
 341 {
 342     uint32_t gqspi_int;
 343     int new_irqline;
 344
 345     s->regs[R_GQSPI_ISR] &= ~IXR_SELF_CLEAR;
 346     s->regs[R_GQSPI_ISR] |=
 347         (fifo32_is_empty(&s->fifo_g) ? IXR_GENERIC_FIFO_EMPTY : 0) |
 348         (fifo32_is_full(&s->fifo_g) ? IXR_GENERIC_FIFO_FULL : 0) |
 349         (s->fifo_g.fifo.num < s->regs[R_GQSPI_GFIFO_THRESH] ?
 350                                     IXR_GENERIC_FIFO_NOT_FULL : 0) |
 351         (fifo8_is_empty(&s->rx_fifo_g) ? IXR_RX_FIFO_EMPTY : 0) |
 352         (fifo8_is_full(&s->rx_fifo_g) ? IXR_RX_FIFO_FULL : 0) |
 353         (s->rx_fifo_g.num >= s->regs[R_GQSPI_RX_THRESH] ?
 354                                     IXR_RX_FIFO_NOT_EMPTY : 0) |
 355         (fifo8_is_empty(&s->tx_fifo_g) ? IXR_TX_FIFO_EMPTY : 0) |
 356         (fifo8_is_full(&s->tx_fifo_g) ? IXR_TX_FIFO_FULL : 0) |
 357         (s->tx_fifo_g.num < s->regs[R_GQSPI_TX_THRESH] ?
 358                                     IXR_TX_FIFO_NOT_FULL : 0);
 359
 360     /* GQSPI Interrupt Trigger Status */
 361     gqspi_int = (~s->regs[R_GQSPI_IMR]) & s->regs[R_GQSPI_ISR] & GQSPI_IXR_MASK;
 362     new_irqline = !!(gqspi_int & IXR_ALL);
 363
 364     /* drive external interrupt pin */
 365     if (new_irqline != s->gqspi_irqline) {
 366         s->gqspi_irqline = new_irqline;
 367         qemu_set_irq(XILINX_SPIPS(s)->irq, s->gqspi_irqline);
 368     }
 369 }
 370
 371 static void xilinx_spips_reset(DeviceState *d)
 372 {
 373     XilinxSPIPS *s = XILINX_SPIPS(d);
 374
 375     memset(s->regs, 0, sizeof(s->regs));
 376
 377     fifo8_reset(&s->rx_fifo);
 378     fifo8_reset(&s->rx_fifo);
 379     /* non zero resets */
 380     s->regs[R_CONFIG] |= MODEFAIL_GEN_EN;
 381     s->regs[R_SLAVE_IDLE_COUNT] = 0xFF;
 382     s->regs[R_TX_THRES] = 1;
 383     s->regs[R_RX_THRES] = 1;
 384     /* FIXME: move magic number definition somewhere sensible */
 385     s->regs[R_MOD_ID] = 0x01090106;
 386     s->regs[R_LQSPI_CFG] = R_LQSPI_CFG_RESET;
 387     s->link_state = 1;
 388     s->link_state_next = 1;
 389     s->link_state_next_when = 0;
 390     s->snoop_state = SNOOP_CHECKING;
 391     s->cmd_dummies = 0;
 392     s->man_start_com = false;
 393     xilinx_spips_update_ixr(s);
 394     xilinx_spips_update_cs_lines(s);
 395 }
 396
 397 static void xlnx_zynqmp_qspips_reset(DeviceState *d)
 398 {
 399     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(d);
 400
 401     xilinx_spips_reset(d);
 402
 403     memset(s->regs, 0, sizeof(s->regs));
 404
 405     fifo8_reset(&s->rx_fifo_g);
 406     fifo8_reset(&s->rx_fifo_g);
 407     fifo32_reset(&s->fifo_g);
 408     s->regs[R_INTR_STATUS] = R_INTR_STATUS_RESET;
 409     s->regs[R_GPIO] = 1;
 410     s->regs[R_LPBK_DLY_ADJ] = R_LPBK_DLY_ADJ_RESET;
 411     s->regs[R_GQSPI_GFIFO_THRESH] = 0x10;
 412     s->regs[R_MOD_ID] = 0x01090101;
 413     s->regs[R_GQSPI_IMR] = R_GQSPI_IMR_RESET;
 414     s->regs[R_GQSPI_TX_THRESH] = 1;
 415     s->regs[R_GQSPI_RX_THRESH] = 1;
 416     s->regs[R_GQSPI_GPIO] = 1;
 417     s->regs[R_GQSPI_LPBK_DLY_ADJ] = R_GQSPI_LPBK_DLY_ADJ_RESET;
 418     s->regs[R_GQSPI_MOD_ID] = R_GQSPI_MOD_ID_RESET;
 419     s->regs[R_QSPIDMA_DST_CTRL] = R_QSPIDMA_DST_CTRL_RESET;
 420     s->regs[R_QSPIDMA_DST_I_MASK] = R_QSPIDMA_DST_I_MASK_RESET;
 421     s->regs[R_QSPIDMA_DST_CTRL2] = R_QSPIDMA_DST_CTRL2_RESET;
 422     s->man_start_com_g = false;
 423     s->gqspi_irqline = 0;
 424     xlnx_zynqmp_qspips_update_ixr(s);
 425 }
 426
 427 /* N way (num) in place bit striper. Lay out row wise bits (MSB to LSB)
 428  * column wise (from element 0 to N-1). num is the length of x, and dir
 429  * reverses the direction of the transform. Best illustrated by example:
 430  * Each digit in the below array is a single bit (num == 3):
 431  *
 432  * {{ 76543210, }  ----- stripe (dir == false) -----> {{ 741gdaFC, }
 433  *  { hgfedcba, }                                      { 630fcHEB, }
 434  *  { HGFEDCBA, }} <---- upstripe (dir == true) -----  { 52hebGDA, }}
 435  */
 436
 437 static inline void stripe8(uint8_t *x, int num, bool dir)
 438 {
 439     uint8_t r[MAX_NUM_BUSSES];
 440     int idx[2] = {0, 0};
 441     int bit[2] = {0, 7};
 442     int d = dir;
 443
 444     assert(num <= MAX_NUM_BUSSES);
 445     memset(r, 0, sizeof(uint8_t) * num);
 446
 447     for (idx[0] = 0; idx[0] < num; ++idx[0]) {
 448         for (bit[0] = 7; bit[0] >= 0; bit[0]--) {
 449             r[idx[!d]] |= x[idx[d]] & 1 << bit[d] ? 1 << bit[!d] : 0;
 450             idx[1] = (idx[1] + 1) % num;
 451             if (!idx[1]) {
 452                 bit[1]--;
 453             }
 454         }
 455     }
 456     memcpy(x, r, sizeof(uint8_t) * num);
 457 }
 458
 459 static void xlnx_zynqmp_qspips_flush_fifo_g(XlnxZynqMPQSPIPS *s)
 460 {
 461     while (s->regs[R_GQSPI_DATA_STS] || !fifo32_is_empty(&s->fifo_g)) {
 462         uint8_t tx_rx[2] = { 0 };
 463         int num_stripes = 1;
 464         uint8_t busses;
 465         int i;
 466
 467         if (!s->regs[R_GQSPI_DATA_STS]) {
 468             uint8_t imm;
 469
 470             s->regs[R_GQSPI_GF_SNAPSHOT] = fifo32_pop(&s->fifo_g);
 471             DB_PRINT_L(0, "GQSPI command: %x\n", s->regs[R_GQSPI_GF_SNAPSHOT]);
 472             if (!s->regs[R_GQSPI_GF_SNAPSHOT]) {
 473                 DB_PRINT_L(0, "Dummy GQSPI Delay Command Entry, Do nothing");
 474                 continue;
 475             }
 476             xlnx_zynqmp_qspips_update_cs_lines(s);
 477
 478             imm = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
 479             if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
 480                 /* immedate transfer */
 481                 if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
 482                     ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
 483                     s->regs[R_GQSPI_DATA_STS] = 1;
 484                 /* CS setup/hold - do nothing */
 485                 } else {
 486                     s->regs[R_GQSPI_DATA_STS] = 0;
 487                 }
 488             } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, EXPONENT)) {
 489                 if (imm > 31) {
 490                     qemu_log_mask(LOG_UNIMP, "QSPI exponential transfer too"
 491                                   " long - 2 ^ %" PRId8 " requested\n", imm);
 492                 }
 493                 s->regs[R_GQSPI_DATA_STS] = 1ul << imm;
 494             } else {
 495                 s->regs[R_GQSPI_DATA_STS] = imm;
 496             }
 497         }
 498         /* Zero length transfer check */
 499         if (!s->regs[R_GQSPI_DATA_STS]) {
 500             continue;
 501         }
 502         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE) &&
 503             fifo8_is_full(&s->rx_fifo_g)) {
 504             /* No space in RX fifo for transfer - try again later */
 505             return;
 506         }
 507         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, STRIPE) &&
 508             (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT) ||
 509              ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE))) {
 510             num_stripes = 2;
 511         }
 512         if (!ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_XFER)) {
 513             tx_rx[0] = ARRAY_FIELD_EX32(s->regs,
 514                                         GQSPI_GF_SNAPSHOT, IMMEDIATE_DATA);
 515         } else if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, TRANSMIT)) {
 516             for (i = 0; i < num_stripes; ++i) {
 517                 if (!fifo8_is_empty(&s->tx_fifo_g)) {
 518                     tx_rx[i] = fifo8_pop(&s->tx_fifo_g);
 519                     s->tx_fifo_g_align++;
 520                 } else {
 521                     return;
 522                 }
 523             }
 524         }
 525         if (num_stripes == 1) {
 526             /* mirror */
 527             tx_rx[1] = tx_rx[0];
 528         }
 529         busses = ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, DATA_BUS_SELECT);
 530         for (i = 0; i < 2; ++i) {
 531             DB_PRINT_L(1, "bus %d tx = %02x\n", i, tx_rx[i]);
 532             tx_rx[i] = ssi_transfer(XILINX_SPIPS(s)->spi[i], tx_rx[i]);
 533             DB_PRINT_L(1, "bus %d rx = %02x\n", i, tx_rx[i]);
 534         }
 535         if (s->regs[R_GQSPI_DATA_STS] > 1 &&
 536             busses == 0x3 && num_stripes == 2) {
 537             s->regs[R_GQSPI_DATA_STS] -= 2;
 538         } else if (s->regs[R_GQSPI_DATA_STS] > 0) {
 539             s->regs[R_GQSPI_DATA_STS]--;
 540         }
 541         if (ARRAY_FIELD_EX32(s->regs, GQSPI_GF_SNAPSHOT, RECIEVE)) {
 542             for (i = 0; i < 2; ++i) {
 543                 if (busses & (1 << i)) {
 544                     DB_PRINT_L(1, "bus %d push_byte = %02x\n", i, tx_rx[i]);
 545                     fifo8_push(&s->rx_fifo_g, tx_rx[i]);
 546                     s->rx_fifo_g_align++;
 547                 }
 548             }
 549         }
 550         if (!s->regs[R_GQSPI_DATA_STS]) {
 551             for (; s->tx_fifo_g_align % 4; s->tx_fifo_g_align++) {
 552                 fifo8_pop(&s->tx_fifo_g);
 553             }
 554             for (; s->rx_fifo_g_align % 4; s->rx_fifo_g_align++) {
 555                 fifo8_push(&s->rx_fifo_g, 0);
 556             }
 557         }
 558     }
 559 }
 560
 561 static int xilinx_spips_num_dummies(XilinxQSPIPS *qs, uint8_t command)
 562 {
 563     if (!qs) {
 564         /* The SPI device is not a QSPI device */
 565         return -1;
 566     }
 567
 568     switch (command) { /* check for dummies */
 569     case READ: /* no dummy bytes/cycles */
 570     case PP:
 571     case DPP:
 572     case QPP:
 573     case READ_4:
 574     case PP_4:
 575     case QPP_4:
 576         return 0;
 577     case FAST_READ:
 578     case DOR:
 579     case QOR:
 580     case FAST_READ_4:
 581     case DOR_4:
 582     case QOR_4:
 583         return 1;
 584     case DIOR:
 585     case DIOR_4:
 586         return 2;
 587     case QIOR:
 588     case QIOR_4:
 589         return 4;
 590     default:
 591         return -1;
 592     }
 593 }
 594
 595 static inline uint8_t get_addr_length(XilinxSPIPS *s, uint8_t cmd)
 596 {
 597    switch (cmd) {
 598    case PP_4:
 599    case QPP_4:
 600    case READ_4:
 601    case QIOR_4:
 602    case FAST_READ_4:
 603    case DOR_4:
 604    case QOR_4:
 605    case DIOR_4:
 606        return 4;
 607    default:
 608        return (s->regs[R_CMND] & R_CMND_EXT_ADD) ? 4 : 3;
 609    }
 610 }
 611
 612 static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
 613 {
 614     int debug_level = 0;
 615     XilinxQSPIPS *q = (XilinxQSPIPS *) object_dynamic_cast(OBJECT(s),
 616                                                            TYPE_XILINX_QSPIPS);
 617
 618     for (;;) {
 619         int i;
 620         uint8_t tx = 0;
 621         uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
 622         uint8_t dummy_cycles = 0;
 623         uint8_t addr_length;
 624
 625         if (fifo8_is_empty(&s->tx_fifo)) {
 626             xilinx_spips_update_ixr(s);
 627             return;
 628         } else if (s->snoop_state == SNOOP_STRIPING ||
 629                    s->snoop_state == SNOOP_NONE) {
 630             for (i = 0; i < num_effective_busses(s); ++i) {
 631                 tx_rx[i] = fifo8_pop(&s->tx_fifo);
 632             }
 633             stripe8(tx_rx, num_effective_busses(s), false);
 634         } else if (s->snoop_state >= SNOOP_ADDR) {
 635             tx = fifo8_pop(&s->tx_fifo);
 636             for (i = 0; i < num_effective_busses(s); ++i) {
 637                 tx_rx[i] = tx;
 638             }
 639         } else {
 640             /* Extract a dummy byte and generate dummy cycles according to the
 641              * link state */
 642             tx = fifo8_pop(&s->tx_fifo);
 643             dummy_cycles = 8 / s->link_state;
 644         }
 645
 646         for (i = 0; i < num_effective_busses(s); ++i) {
 647             int bus = num_effective_busses(s) - 1 - i;
 648             if (dummy_cycles) {
 649                 int d;
 650                 for (d = 0; d < dummy_cycles; ++d) {
 651                     tx_rx[0] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[0]);
 652                 }
 653             } else {
 654                 DB_PRINT_L(debug_level, "tx = %02x\n", tx_rx[i]);
 655                 tx_rx[i] = ssi_transfer(s->spi[bus], (uint32_t)tx_rx[i]);
 656                 DB_PRINT_L(debug_level, "rx = %02x\n", tx_rx[i]);
 657             }
 658         }
 659
 660         if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
 661             DB_PRINT_L(debug_level, "dircarding drained rx byte\n");
 662             /* Do nothing */
 663         } else if (s->rx_discard) {
 664             DB_PRINT_L(debug_level, "dircarding discarded rx byte\n");
 665             s->rx_discard -= 8 / s->link_state;
 666         } else if (fifo8_is_full(&s->rx_fifo)) {
 667             s->regs[R_INTR_STATUS] |= IXR_RX_FIFO_OVERFLOW;
 668             DB_PRINT_L(0, "rx FIFO overflow");
 669         } else if (s->snoop_state == SNOOP_STRIPING) {
 670             stripe8(tx_rx, num_effective_busses(s), true);
 671             for (i = 0; i < num_effective_busses(s); ++i) {
 672                 fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[i]);
 673                 DB_PRINT_L(debug_level, "pushing striped rx byte\n");
 674             }
 675         } else {
 676            DB_PRINT_L(debug_level, "pushing unstriped rx byte\n");
 677            fifo8_push(&s->rx_fifo, (uint8_t)tx_rx[0]);
 678         }
 679
 680         if (s->link_state_next_when) {
 681             s->link_state_next_when--;
 682             if (!s->link_state_next_when) {
 683                 s->link_state = s->link_state_next;
 684             }
 685         }
 686
 687         DB_PRINT_L(debug_level, "initial snoop state: %x\n",
 688                    (unsigned)s->snoop_state);
 689         switch (s->snoop_state) {
 690         case (SNOOP_CHECKING):
 691             /* Store the count of dummy bytes in the txfifo */
 692             s->cmd_dummies = xilinx_spips_num_dummies(q, tx);
 693             addr_length = get_addr_length(s, tx);
 694             if (s->cmd_dummies < 0) {
 695                 s->snoop_state = SNOOP_NONE;
 696             } else {
 697                 s->snoop_state = SNOOP_ADDR + addr_length - 1;
 698             }
 699             switch (tx) {
 700             case DPP:
 701             case DOR:
 702             case DOR_4:
 703                 s->link_state_next = 2;
 704                 s->link_state_next_when = addr_length + s->cmd_dummies;
 705                 break;
 706             case QPP:
 707             case QPP_4:
 708             case QOR:
 709             case QOR_4:
 710                 s->link_state_next = 4;
 711                 s->link_state_next_when = addr_length + s->cmd_dummies;
 712                 break;
 713             case DIOR:
 714             case DIOR_4:
 715                 s->link_state = 2;
 716                 break;
 717             case QIOR:
 718             case QIOR_4:
 719                 s->link_state = 4;
 720                 break;
 721             }
 722             break;
 723         case (SNOOP_ADDR):
 724             /* Address has been transmitted, transmit dummy cycles now if
 725              * needed */
 726             if (s->cmd_dummies < 0) {
 727                 s->snoop_state = SNOOP_NONE;
 728             } else {
 729                 s->snoop_state = s->cmd_dummies;
 730             }
 731             break;
 732         case (SNOOP_STRIPING):
 733         case (SNOOP_NONE):
 734             /* Once we hit the boring stuff - squelch debug noise */
 735             if (!debug_level) {
 736                 DB_PRINT_L(0, "squelching debug info ....\n");
 737                 debug_level = 1;
 738             }
 739             break;
 740         default:
 741             s->snoop_state--;
 742         }
 743         DB_PRINT_L(debug_level, "final snoop state: %x\n",
 744                    (unsigned)s->snoop_state);
 745     }
 746 }
 747
 748 static inline void tx_data_bytes(Fifo8 *fifo, uint32_t value, int num, bool be)
 749 {
 750     int i;
 751     for (i = 0; i < num && !fifo8_is_full(fifo); ++i) {
 752         if (be) {
 753             fifo8_push(fifo, (uint8_t)(value >> 24));
 754             value <<= 8;
 755         } else {
 756             fifo8_push(fifo, (uint8_t)value);
 757             value >>= 8;
 758         }
 759     }
 760 }
 761
 762 static void xilinx_spips_check_zero_pump(XilinxSPIPS *s)
 763 {
 764     if (!s->regs[R_TRANSFER_SIZE]) {
 765         return;
 766     }
 767     if (!fifo8_is_empty(&s->tx_fifo) && s->regs[R_CMND] & R_CMND_PUSH_WAIT) {
 768         return;
 769     }
 770     /*
 771      * The zero pump must never fill tx fifo such that rx overflow is
 772      * possible
 773      */
 774     while (s->regs[R_TRANSFER_SIZE] &&
 775            s->rx_fifo.num + s->tx_fifo.num < RXFF_A_Q - 3) {
 776         /* endianess just doesn't matter when zero pumping */
 777         tx_data_bytes(&s->tx_fifo, 0, 4, false);
 778         s->regs[R_TRANSFER_SIZE] &= ~0x03ull;
 779         s->regs[R_TRANSFER_SIZE] -= 4;
 780     }
 781 }
 782
 783 static void xilinx_spips_check_flush(XilinxSPIPS *s)
 784 {
 785     if (s->man_start_com ||
 786         (!fifo8_is_empty(&s->tx_fifo) &&
 787          !(s->regs[R_CONFIG] & MAN_START_EN))) {
 788         xilinx_spips_check_zero_pump(s);
 789         xilinx_spips_flush_txfifo(s);
 790     }
 791     if (fifo8_is_empty(&s->tx_fifo) && !s->regs[R_TRANSFER_SIZE]) {
 792         s->man_start_com = false;
 793     }
 794     xilinx_spips_update_ixr(s);
 795 }
 796
 797 static void xlnx_zynqmp_qspips_check_flush(XlnxZynqMPQSPIPS *s)
 798 {
 799     bool gqspi_has_work = s->regs[R_GQSPI_DATA_STS] ||
 800                           !fifo32_is_empty(&s->fifo_g);
 801
 802     if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
 803         if (s->man_start_com_g || (gqspi_has_work &&
 804              !ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE))) {
 805             xlnx_zynqmp_qspips_flush_fifo_g(s);
 806         }
 807     } else {
 808         xilinx_spips_check_flush(XILINX_SPIPS(s));
 809     }
 810     if (!gqspi_has_work) {
 811         s->man_start_com_g = false;
 812     }
 813     xlnx_zynqmp_qspips_update_ixr(s);
 814 }
 815
 816 static inline int rx_data_bytes(Fifo8 *fifo, uint8_t *value, int max)
 817 {
 818     int i;
 819
 820     for (i = 0; i < max && !fifo8_is_empty(fifo); ++i) {
 821         value[i] = fifo8_pop(fifo);
 822     }
 823     return max - i;
 824 }
 825
 826 static const void *pop_buf(Fifo8 *fifo, uint32_t max, uint32_t *num)
 827 {
 828     void *ret;
 829
 830     if (max == 0 || max > fifo->num) {
 831         abort();
 832     }
 833     *num = MIN(fifo->capacity - fifo->head, max);
 834     ret = &fifo->data[fifo->head];
 835     fifo->head += *num;
 836     fifo->head %= fifo->capacity;
 837     fifo->num -= *num;
 838     return ret;
 839 }
 840
 841 static void xlnx_zynqmp_qspips_notify(void *opaque)
 842 {
 843     XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(opaque);
 844     XilinxSPIPS *s = XILINX_SPIPS(rq);
 845     Fifo8 *recv_fifo;
 846
 847     if (ARRAY_FIELD_EX32(rq->regs, GQSPI_SELECT, GENERIC_QSPI_EN)) {
 848         if (!(ARRAY_FIELD_EX32(rq->regs, GQSPI_CNFG, MODE_EN) == 2)) {
 849             return;
 850         }
 851         recv_fifo = &rq->rx_fifo_g;
 852     } else {
 853         if (!(s->regs[R_CMND] & R_CMND_DMA_EN)) {
 854             return;
 855         }
 856         recv_fifo = &s->rx_fifo;
 857     }
 858     while (recv_fifo->num >= 4
 859            && stream_can_push(rq->dma, xlnx_zynqmp_qspips_notify, rq))
 860     {
 861         size_t ret;
 862         uint32_t num;
 863         const void *rxd;
 864         int len;
 865
 866         len = recv_fifo->num >= rq->dma_burst_size ? rq->dma_burst_size :
 867                                                    recv_fifo->num;
 868         rxd = pop_buf(recv_fifo, len, &num);
 869
 870         memcpy(rq->dma_buf, rxd, num);
 871
 872         ret = stream_push(rq->dma, rq->dma_buf, num, false);
 873         assert(ret == num);
 874         xlnx_zynqmp_qspips_check_flush(rq);
 875     }
 876 }
 877
 878 static uint64_t xilinx_spips_read(void *opaque, hwaddr addr,
 879                                                         unsigned size)
 880 {
 881     XilinxSPIPS *s = opaque;
 882     uint32_t mask = ~0;
 883     uint32_t ret;
 884     uint8_t rx_buf[4];
 885     int shortfall;
 886
 887     addr >>= 2;
 888     switch (addr) {
 889     case R_CONFIG:
 890         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
 891         break;
 892     case R_INTR_STATUS:
 893         ret = s->regs[addr] & IXR_ALL;
 894         s->regs[addr] = 0;
 895         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
 896         xilinx_spips_update_ixr(s);
 897         return ret;
 898     case R_INTR_MASK:
 899         mask = IXR_ALL;
 900         break;
 901     case  R_EN:
 902         mask = 0x1;
 903         break;
 904     case R_SLAVE_IDLE_COUNT:
 905         mask = 0xFF;
 906         break;
 907     case R_MOD_ID:
 908         mask = 0x01FFFFFF;
 909         break;
 910     case R_INTR_EN:
 911     case R_INTR_DIS:
 912     case R_TX_DATA:
 913         mask = 0;
 914         break;
 915     case R_RX_DATA:
 916         memset(rx_buf, 0, sizeof(rx_buf));
 917         shortfall = rx_data_bytes(&s->rx_fifo, rx_buf, s->num_txrx_bytes);
 918         ret = s->regs[R_CONFIG] & R_CONFIG_ENDIAN ?
 919                         cpu_to_be32(*(uint32_t *)rx_buf) :
 920                         cpu_to_le32(*(uint32_t *)rx_buf);
 921         if (!(s->regs[R_CONFIG] & R_CONFIG_ENDIAN)) {
 922             ret <<= 8 * shortfall;
 923         }
 924         DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4, ret);
 925         xilinx_spips_check_flush(s);
 926         xilinx_spips_update_ixr(s);
 927         return ret;
 928     }
 929     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr * 4,
 930                s->regs[addr] & mask);
 931     return s->regs[addr] & mask;
 932
 933 }
 934
 935 static uint64_t xlnx_zynqmp_qspips_read(void *opaque,
 936                                         hwaddr addr, unsigned size)
 937 {
 938     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
 939     uint32_t reg = addr / 4;
 940     uint32_t ret;
 941     uint8_t rx_buf[4];
 942     int shortfall;
 943
 944     if (reg <= R_MOD_ID) {
 945         return xilinx_spips_read(opaque, addr, size);
 946     } else {
 947         switch (reg) {
 948         case R_GQSPI_RXD:
 949             if (fifo8_is_empty(&s->rx_fifo_g)) {
 950                 qemu_log_mask(LOG_GUEST_ERROR,
 951                               "Read from empty GQSPI RX FIFO\n");
 952                 return 0;
 953             }
 954             memset(rx_buf, 0, sizeof(rx_buf));
 955             shortfall = rx_data_bytes(&s->rx_fifo_g, rx_buf,
 956                                       XILINX_SPIPS(s)->num_txrx_bytes);
 957             ret = ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN) ?
 958                   cpu_to_be32(*(uint32_t *)rx_buf) :
 959                   cpu_to_le32(*(uint32_t *)rx_buf);
 960             if (!ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN)) {
 961                 ret <<= 8 * shortfall;
 962             }
 963             xlnx_zynqmp_qspips_check_flush(s);
 964             xlnx_zynqmp_qspips_update_ixr(s);
 965             return ret;
 966         default:
 967             return s->regs[reg];
 968         }
 969     }
 970 }
 971
 972 static void xilinx_spips_write(void *opaque, hwaddr addr,
 973                                         uint64_t value, unsigned size)
 974 {
 975     int mask = ~0;
 976     XilinxSPIPS *s = opaque;
 977     bool try_flush = true;
 978
 979     DB_PRINT_L(0, "addr=" TARGET_FMT_plx " = %x\n", addr, (unsigned)value);
 980     addr >>= 2;
 981     switch (addr) {
 982     case R_CONFIG:
 983         mask = ~(R_CONFIG_RSVD | MAN_START_COM);
 984         if ((value & MAN_START_COM) && (s->regs[R_CONFIG] & MAN_START_EN)) {
 985             s->man_start_com = true;
 986         }
 987         break;
 988     case R_INTR_STATUS:
 989         mask = IXR_ALL;
 990         s->regs[R_INTR_STATUS] &= ~(mask & value);
 991         goto no_reg_update;
 992     case R_INTR_DIS:
 993         mask = IXR_ALL;
 994         s->regs[R_INTR_MASK] &= ~(mask & value);
 995         goto no_reg_update;
 996     case R_INTR_EN:
 997         mask = IXR_ALL;
 998         s->regs[R_INTR_MASK] |= mask & value;
 999         goto no_reg_update;
1000     case R_EN:
1001         mask = 0x1;
1002         break;
1003     case R_SLAVE_IDLE_COUNT:
1004         mask = 0xFF;
1005         break;
1006     case R_RX_DATA:
1007     case R_INTR_MASK:
1008     case R_MOD_ID:
1009         mask = 0;
1010         break;
1011     case R_TX_DATA:
1012         tx_data_bytes(&s->tx_fifo, (uint32_t)value, s->num_txrx_bytes,
1013                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1014         goto no_reg_update;
1015     case R_TXD1:
1016         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 1,
1017                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1018         goto no_reg_update;
1019     case R_TXD2:
1020         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 2,
1021                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1022         goto no_reg_update;
1023     case R_TXD3:
1024         tx_data_bytes(&s->tx_fifo, (uint32_t)value, 3,
1025                       s->regs[R_CONFIG] & R_CONFIG_ENDIAN);
1026         goto no_reg_update;
1027     /* Skip SPI bus update for below registers writes */
1028     case R_GPIO:
1029     case R_LPBK_DLY_ADJ:
1030     case R_IOU_TAPDLY_BYPASS:
1031     case R_DUMMY_CYCLE_EN:
1032     case R_ECO:
1033         try_flush = false;
1034         break;
1035     }
1036     s->regs[addr] = (s->regs[addr] & ~mask) | (value & mask);
1037 no_reg_update:
1038     if (try_flush) {
1039         xilinx_spips_update_cs_lines(s);
1040         xilinx_spips_check_flush(s);
1041         xilinx_spips_update_cs_lines(s);
1042         xilinx_spips_update_ixr(s);
1043     }
1044 }
1045
1046 static const MemoryRegionOps spips_ops = {
1047     .read = xilinx_spips_read,
1048     .write = xilinx_spips_write,
1049     .endianness = DEVICE_LITTLE_ENDIAN,
1050 };
1051
1052 static void xilinx_qspips_invalidate_mmio_ptr(XilinxQSPIPS *q)
1053 {
1054     q->lqspi_cached_addr = ~0ULL;
1055 }
1056
1057 static void xilinx_qspips_write(void *opaque, hwaddr addr,
1058                                 uint64_t value, unsigned size)
1059 {
1060     XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
1061     XilinxSPIPS *s = XILINX_SPIPS(opaque);
1062
1063     xilinx_spips_write(opaque, addr, value, size);
1064     addr >>= 2;
1065
1066     if (addr == R_LQSPI_CFG) {
1067         xilinx_qspips_invalidate_mmio_ptr(q);
1068     }
1069     if (s->regs[R_CMND] & R_CMND_RXFIFO_DRAIN) {
1070         fifo8_reset(&s->rx_fifo);
1071     }
1072 }
1073
1074 static void xlnx_zynqmp_qspips_write(void *opaque, hwaddr addr,
1075                                         uint64_t value, unsigned size)
1076 {
1077     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque);
1078     uint32_t reg = addr / 4;
1079
1080     if (reg <= R_MOD_ID) {
1081         xilinx_qspips_write(opaque, addr, value, size);
1082     } else {
1083         switch (reg) {
1084         case R_GQSPI_CNFG:
1085             if (FIELD_EX32(value, GQSPI_CNFG, GEN_FIFO_START) &&
1086                 ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, GEN_FIFO_START_MODE)) {
1087                 s->man_start_com_g = true;
1088             }
1089             s->regs[reg] = value & ~(R_GQSPI_CNFG_GEN_FIFO_START_MASK);
1090             break;
1091         case R_GQSPI_GEN_FIFO:
1092             if (!fifo32_is_full(&s->fifo_g)) {
1093                 fifo32_push(&s->fifo_g, value);
1094             }
1095             break;
1096         case R_GQSPI_TXD:
1097             tx_data_bytes(&s->tx_fifo_g, (uint32_t)value, 4,
1098                           ARRAY_FIELD_EX32(s->regs, GQSPI_CNFG, ENDIAN));
1099             break;
1100         case R_GQSPI_FIFO_CTRL:
1101             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET)) {
1102                 fifo32_reset(&s->fifo_g);
1103             }
1104             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, TX_FIFO_RESET)) {
1105                 fifo8_reset(&s->tx_fifo_g);
1106             }
1107             if (FIELD_EX32(value, GQSPI_FIFO_CTRL, RX_FIFO_RESET)) {
1108                 fifo8_reset(&s->rx_fifo_g);
1109             }
1110             break;
1111         case R_GQSPI_IDR:
1112             s->regs[R_GQSPI_IMR] |= value;
1113             break;
1114         case R_GQSPI_IER:
1115             s->regs[R_GQSPI_IMR] &= ~value;
1116             break;
1117         case R_GQSPI_ISR:
1118             s->regs[R_GQSPI_ISR] &= ~value;
1119             break;
1120         case R_GQSPI_IMR:
1121         case R_GQSPI_RXD:
1122         case R_GQSPI_GF_SNAPSHOT:
1123         case R_GQSPI_MOD_ID:
1124             break;
1125         default:
1126             s->regs[reg] = value;
1127             break;
1128         }
1129         xlnx_zynqmp_qspips_update_cs_lines(s);
1130         xlnx_zynqmp_qspips_check_flush(s);
1131         xlnx_zynqmp_qspips_update_cs_lines(s);
1132         xlnx_zynqmp_qspips_update_ixr(s);
1133     }
1134     xlnx_zynqmp_qspips_notify(s);
1135 }
1136
1137 static const MemoryRegionOps qspips_ops = {
1138     .read = xilinx_spips_read,
1139     .write = xilinx_qspips_write,
1140     .endianness = DEVICE_LITTLE_ENDIAN,
1141 };
1142
1143 static const MemoryRegionOps xlnx_zynqmp_qspips_ops = {
1144     .read = xlnx_zynqmp_qspips_read,
1145     .write = xlnx_zynqmp_qspips_write,
1146     .endianness = DEVICE_LITTLE_ENDIAN,
1147 };
1148
1149 #define LQSPI_CACHE_SIZE 1024
1150
1151 static void lqspi_load_cache(void *opaque, hwaddr addr)
1152 {
1153     XilinxQSPIPS *q = opaque;
1154     XilinxSPIPS *s = opaque;
1155     int i;
1156     int flash_addr = ((addr & ~(LQSPI_CACHE_SIZE - 1))
1157                    / num_effective_busses(s));
1158     int peripheral = flash_addr >> LQSPI_ADDRESS_BITS;
1159     int cache_entry = 0;
1160     uint32_t u_page_save = s->regs[R_LQSPI_STS] & ~LQSPI_CFG_U_PAGE;
1161
1162     if (addr < q->lqspi_cached_addr ||
1163             addr > q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1164         xilinx_qspips_invalidate_mmio_ptr(q);
1165         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1166         s->regs[R_LQSPI_STS] |= peripheral ? LQSPI_CFG_U_PAGE : 0;
1167
1168         DB_PRINT_L(0, "config reg status: %08x\n", s->regs[R_LQSPI_CFG]);
1169
1170         fifo8_reset(&s->tx_fifo);
1171         fifo8_reset(&s->rx_fifo);
1172
1173         /* instruction */
1174         DB_PRINT_L(0, "pushing read instruction: %02x\n",
1175                    (unsigned)(uint8_t)(s->regs[R_LQSPI_CFG] &
1176                                        LQSPI_CFG_INST_CODE));
1177         fifo8_push(&s->tx_fifo, s->regs[R_LQSPI_CFG] & LQSPI_CFG_INST_CODE);
1178         /* read address */
1179         DB_PRINT_L(0, "pushing read address %06x\n", flash_addr);
1180         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_ADDR4) {
1181             fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 24));
1182         }
1183         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 16));
1184         fifo8_push(&s->tx_fifo, (uint8_t)(flash_addr >> 8));
1185         fifo8_push(&s->tx_fifo, (uint8_t)flash_addr);
1186         /* mode bits */
1187         if (s->regs[R_LQSPI_CFG] & LQSPI_CFG_MODE_EN) {
1188             fifo8_push(&s->tx_fifo, extract32(s->regs[R_LQSPI_CFG],
1189                                               LQSPI_CFG_MODE_SHIFT,
1190                                               LQSPI_CFG_MODE_WIDTH));
1191         }
1192         /* dummy bytes */
1193         for (i = 0; i < (extract32(s->regs[R_LQSPI_CFG], LQSPI_CFG_DUMMY_SHIFT,
1194                                    LQSPI_CFG_DUMMY_WIDTH)); ++i) {
1195             DB_PRINT_L(0, "pushing dummy byte\n");
1196             fifo8_push(&s->tx_fifo, 0);
1197         }
1198         xilinx_spips_update_cs_lines(s);
1199         xilinx_spips_flush_txfifo(s);
1200         fifo8_reset(&s->rx_fifo);
1201
1202         DB_PRINT_L(0, "starting QSPI data read\n");
1203
1204         while (cache_entry < LQSPI_CACHE_SIZE) {
1205             for (i = 0; i < 64; ++i) {
1206                 tx_data_bytes(&s->tx_fifo, 0, 1, false);
1207             }
1208             xilinx_spips_flush_txfifo(s);
1209             for (i = 0; i < 64; ++i) {
1210                 rx_data_bytes(&s->rx_fifo, &q->lqspi_buf[cache_entry++], 1);
1211             }
1212         }
1213
1214         s->regs[R_LQSPI_STS] &= ~LQSPI_CFG_U_PAGE;
1215         s->regs[R_LQSPI_STS] |= u_page_save;
1216         xilinx_spips_update_cs_lines(s);
1217
1218         q->lqspi_cached_addr = flash_addr * num_effective_busses(s);
1219     }
1220 }
1221
1222 static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
1223                               unsigned size, MemTxAttrs attrs)
1224 {
1225     XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
1226
1227     if (addr >= q->lqspi_cached_addr &&
1228             addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
1229         uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
1230         *value = cpu_to_le32(*(uint32_t *)retp);
1231         DB_PRINT_L(1, "addr: %08" HWADDR_PRIx ", data: %08" PRIx64 "\n",
1232                    addr, *value);
1233         return MEMTX_OK;
1234     }
1235
1236     lqspi_load_cache(opaque, addr);
1237     return lqspi_read(opaque, addr, value, size, attrs);
1238 }
1239
1240 static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,
1241                                unsigned size, MemTxAttrs attrs)
1242 {
1243     /*
1244      * From UG1085, Chapter 24 (Quad-SPI controllers):
1245      * - Writes are ignored
1246      * - AXI writes generate an external AXI slave error (SLVERR)
1247      */
1248     qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64
1249                                    " (value: 0x%" PRIx64 "\n",
1250                   __func__, size << 3, offset, value);
1251
1252     return MEMTX_ERROR;
1253 }
1254
1255 static const MemoryRegionOps lqspi_ops = {
1256     .read_with_attrs = lqspi_read,
1257     .write_with_attrs = lqspi_write,
1258     .endianness = DEVICE_NATIVE_ENDIAN,
1259     .impl = {
1260         .min_access_size = 4,
1261         .max_access_size = 4,
1262     },
1263     .valid = {
1264         .min_access_size = 1,
1265         .max_access_size = 4
1266     }
1267 };
1268
1269 static void xilinx_spips_realize(DeviceState *dev, Error **errp)
1270 {
1271     XilinxSPIPS *s = XILINX_SPIPS(dev);
1272     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1273     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1274     int i;
1275
1276     DB_PRINT_L(0, "realized spips\n");
1277
1278     if (s->num_busses > MAX_NUM_BUSSES) {
1279         error_setg(errp,
1280                    "requested number of SPI busses %u exceeds maximum %d",
1281                    s->num_busses, MAX_NUM_BUSSES);
1282         return;
1283     }
1284     if (s->num_busses < MIN_NUM_BUSSES) {
1285         error_setg(errp,
1286                    "requested number of SPI busses %u is below minimum %d",
1287                    s->num_busses, MIN_NUM_BUSSES);
1288         return;
1289     }
1290
1291     s->spi = g_new(SSIBus *, s->num_busses);
1292     for (i = 0; i < s->num_busses; ++i) {
1293         char bus_name[16];
1294         snprintf(bus_name, 16, "spi%d", i);
1295         s->spi[i] = ssi_create_bus(dev, bus_name);
1296     }
1297
1298     s->cs_lines = g_new0(qemu_irq, s->num_cs * s->num_busses);
1299     s->cs_lines_state = g_new0(bool, s->num_cs * s->num_busses);
1300
1301     sysbus_init_irq(sbd, &s->irq);
1302     for (i = 0; i < s->num_cs * s->num_busses; ++i) {
1303         sysbus_init_irq(sbd, &s->cs_lines[i]);
1304     }
1305
1306     memory_region_init_io(&s->iomem, OBJECT(s), xsc->reg_ops, s,
1307                           "spi", XLNX_ZYNQMP_SPIPS_R_MAX * 4);
1308     sysbus_init_mmio(sbd, &s->iomem);
1309
1310     s->irqline = -1;
1311
1312     fifo8_create(&s->rx_fifo, xsc->rx_fifo_size);
1313     fifo8_create(&s->tx_fifo, xsc->tx_fifo_size);
1314 }
1315
1316 static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
1317 {
1318     XilinxSPIPS *s = XILINX_SPIPS(dev);
1319     XilinxQSPIPS *q = XILINX_QSPIPS(dev);
1320     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1321
1322     DB_PRINT_L(0, "realized qspips\n");
1323
1324     s->num_busses = 2;
1325     s->num_cs = 2;
1326     s->num_txrx_bytes = 4;
1327
1328     xilinx_spips_realize(dev, errp);
1329     memory_region_init_io(&s->mmlqspi, OBJECT(s), &lqspi_ops, s, "lqspi",
1330                           (1 << LQSPI_ADDRESS_BITS) * 2);
1331     sysbus_init_mmio(sbd, &s->mmlqspi);
1332
1333     q->lqspi_cached_addr = ~0ULL;
1334 }
1335
1336 static void xlnx_zynqmp_qspips_realize(DeviceState *dev, Error **errp)
1337 {
1338     XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(dev);
1339     XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);
1340
1341     if (s->dma_burst_size > QSPI_DMA_MAX_BURST_SIZE) {
1342         error_setg(errp,
1343                    "qspi dma burst size %u exceeds maximum limit %d",
1344                    s->dma_burst_size, QSPI_DMA_MAX_BURST_SIZE);
1345         return;
1346     }
1347     xilinx_qspips_realize(dev, errp);
1348     fifo8_create(&s->rx_fifo_g, xsc->rx_fifo_size);
1349     fifo8_create(&s->tx_fifo_g, xsc->tx_fifo_size);
1350     fifo32_create(&s->fifo_g, 32);
1351 }
1352
1353 static void xlnx_zynqmp_qspips_init(Object *obj)
1354 {
1355     XlnxZynqMPQSPIPS *rq = XLNX_ZYNQMP_QSPIPS(obj);
1356
1357     object_property_add_link(obj, "stream-connected-dma", TYPE_STREAM_SINK,
1358                              (Object **)&rq->dma,
1359                              object_property_allow_set_link,
1360                              OBJ_PROP_LINK_STRONG);
1361 }
1362
1363 static int xilinx_spips_post_load(void *opaque, int version_id)
1364 {
1365     xilinx_spips_update_ixr((XilinxSPIPS *)opaque);
1366     xilinx_spips_update_cs_lines((XilinxSPIPS *)opaque);
1367     return 0;
1368 }
1369
1370 static const VMStateDescription vmstate_xilinx_spips = {
1371     .name = "xilinx_spips",
1372     .version_id = 2,
1373     .minimum_version_id = 2,
1374     .post_load = xilinx_spips_post_load,
1375     .fields = (VMStateField[]) {
1376         VMSTATE_FIFO8(tx_fifo, XilinxSPIPS),
1377         VMSTATE_FIFO8(rx_fifo, XilinxSPIPS),
1378         VMSTATE_UINT32_ARRAY(regs, XilinxSPIPS, XLNX_SPIPS_R_MAX),
1379         VMSTATE_UINT8(snoop_state, XilinxSPIPS),
1380         VMSTATE_END_OF_LIST()
1381     }
1382 };
1383
1384 static int xlnx_zynqmp_qspips_post_load(void *opaque, int version_id)
1385 {
1386     XlnxZynqMPQSPIPS *s = (XlnxZynqMPQSPIPS *)opaque;
1387     XilinxSPIPS *qs = XILINX_SPIPS(s);
1388
1389     if (ARRAY_FIELD_EX32(s->regs, GQSPI_SELECT, GENERIC_QSPI_EN) &&
1390         fifo8_is_empty(&qs->rx_fifo) && fifo8_is_empty(&qs->tx_fifo)) {
1391         xlnx_zynqmp_qspips_update_ixr(s);
1392         xlnx_zynqmp_qspips_update_cs_lines(s);
1393     }
1394     return 0;
1395 }
1396
1397 static const VMStateDescription vmstate_xilinx_qspips = {
1398     .name = "xilinx_qspips",
1399     .version_id = 1,
1400     .minimum_version_id = 1,
1401     .fields = (VMStateField[]) {
1402         VMSTATE_STRUCT(parent_obj, XilinxQSPIPS, 0,
1403                        vmstate_xilinx_spips, XilinxSPIPS),
1404         VMSTATE_END_OF_LIST()
1405     }
1406 };
1407
1408 static const VMStateDescription vmstate_xlnx_zynqmp_qspips = {
1409     .name = "xlnx_zynqmp_qspips",
1410     .version_id = 1,
1411     .minimum_version_id = 1,
1412     .post_load = xlnx_zynqmp_qspips_post_load,
1413     .fields = (VMStateField[]) {
1414         VMSTATE_STRUCT(parent_obj, XlnxZynqMPQSPIPS, 0,
1415                        vmstate_xilinx_qspips, XilinxQSPIPS),
1416         VMSTATE_FIFO8(tx_fifo_g, XlnxZynqMPQSPIPS),
1417         VMSTATE_FIFO8(rx_fifo_g, XlnxZynqMPQSPIPS),
1418         VMSTATE_FIFO32(fifo_g, XlnxZynqMPQSPIPS),
1419         VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPQSPIPS, XLNX_ZYNQMP_SPIPS_R_MAX),
1420         VMSTATE_END_OF_LIST()
1421     }
1422 };
1423
1424 static Property xilinx_zynqmp_qspips_properties[] = {
1425     DEFINE_PROP_UINT32("dma-burst-size", XlnxZynqMPQSPIPS, dma_burst_size, 64),
1426     DEFINE_PROP_END_OF_LIST(),
1427 };
1428
1429 static Property xilinx_spips_properties[] = {
1430     DEFINE_PROP_UINT8("num-busses", XilinxSPIPS, num_busses, 1),
1431     DEFINE_PROP_UINT8("num-ss-bits", XilinxSPIPS, num_cs, 4),
1432     DEFINE_PROP_UINT8("num-txrx-bytes", XilinxSPIPS, num_txrx_bytes, 1),
1433     DEFINE_PROP_END_OF_LIST(),
1434 };
1435
1436 static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
1437 {
1438     DeviceClass *dc = DEVICE_CLASS(klass);
1439     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1440
1441     dc->realize = xilinx_qspips_realize;
1442     xsc->reg_ops = &qspips_ops;
1443     xsc->rx_fifo_size = RXFF_A_Q;
1444     xsc->tx_fifo_size = TXFF_A_Q;
1445 }
1446
1447 static void xilinx_spips_class_init(ObjectClass *klass, void *data)
1448 {
1449     DeviceClass *dc = DEVICE_CLASS(klass);
1450     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1451
1452     dc->realize = xilinx_spips_realize;
1453     dc->reset = xilinx_spips_reset;
1454     device_class_set_props(dc, xilinx_spips_properties);
1455     dc->vmsd = &vmstate_xilinx_spips;
1456
1457     xsc->reg_ops = &spips_ops;
1458     xsc->rx_fifo_size = RXFF_A;
1459     xsc->tx_fifo_size = TXFF_A;
1460 }
1461
1462 static void xlnx_zynqmp_qspips_class_init(ObjectClass *klass, void * data)
1463 {
1464     DeviceClass *dc = DEVICE_CLASS(klass);
1465     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
1466
1467     dc->realize = xlnx_zynqmp_qspips_realize;
1468     dc->reset = xlnx_zynqmp_qspips_reset;
1469     dc->vmsd = &vmstate_xlnx_zynqmp_qspips;
1470     device_class_set_props(dc, xilinx_zynqmp_qspips_properties);
1471     xsc->reg_ops = &xlnx_zynqmp_qspips_ops;
1472     xsc->rx_fifo_size = RXFF_A_Q;
1473     xsc->tx_fifo_size = TXFF_A_Q;
1474 }
1475
1476 static const TypeInfo xilinx_spips_info = {
1477     .name  = TYPE_XILINX_SPIPS,
1478     .parent = TYPE_SYS_BUS_DEVICE,
1479     .instance_size  = sizeof(XilinxSPIPS),
1480     .class_init = xilinx_spips_class_init,
1481     .class_size = sizeof(XilinxSPIPSClass),
1482 };
1483
1484 static const TypeInfo xilinx_qspips_info = {
1485     .name  = TYPE_XILINX_QSPIPS,
1486     .parent = TYPE_XILINX_SPIPS,
1487     .instance_size  = sizeof(XilinxQSPIPS),
1488     .class_init = xilinx_qspips_class_init,
1489 };
1490
1491 static const TypeInfo xlnx_zynqmp_qspips_info = {
1492     .name  = TYPE_XLNX_ZYNQMP_QSPIPS,
1493     .parent = TYPE_XILINX_QSPIPS,
1494     .instance_size  = sizeof(XlnxZynqMPQSPIPS),
1495     .instance_init  = xlnx_zynqmp_qspips_init,
1496     .class_init = xlnx_zynqmp_qspips_class_init,
1497 };
1498
1499 static void xilinx_spips_register_types(void)
1500 {
1501     type_register_static(&xilinx_spips_info);
1502     type_register_static(&xilinx_qspips_info);
1503     type_register_static(&xlnx_zynqmp_qspips_info);
1504 }
1505
1506 type_init(xilinx_spips_register_types)