+ DPRINTF("data rx:0x%08x\n", rx);
+
+ /* Remove 32 bits from the actual burst */
+ s->burst_length -= 32;
+
+ if (fifo32_is_full(&s->rx_fifo)) {
+ s->regs[ECSPI_STATREG] |= ECSPI_STATREG_RO;
+ } else {
+ fifo32_push(&s->rx_fifo, (uint8_t)rx);
+ }
+
+ if (s->burst_length <= 0) {
+ uint8_t current_channel = imx_spi_selected_channel(s);
+
+ /*
+ * We need to unset the CS signal for the selected
device
+ * as the burst is over
+ */
+ qemu_set_irq(s->cs_lines[current_channel], 0);
+
+ s->regs[ECSPI_CONREG] &= ~ECSPI_CONREG_XCH;
+
+ if (!imx_spi_is_multiple_master_burst(s)) {
+ s->regs[ECSPI_STATREG] |= ECSPI_STATREG_TC;
+ break;
+ }
+ }
+ }
+
+ if (fifo32_is_empty(&s->tx_fifo)) {
+ s->regs[ECSPI_STATREG] |= ECSPI_STATREG_TC;
+ }
+
+ /* TODO: We should also use TDR and RDR bits */
+
+ DPRINTF("End: TX Fifo Size = %d, RX Fifo Size = %d\n",
+ fifo32_num_used(&s->tx_fifo),
fifo32_num_used(&s->rx_fifo));
+}
+
+static void imx_spi_reset(DeviceState *dev)
+{
+ IMXSPIState *s = IMX_SPI(dev);
+ int i;
+
+ DPRINTF("\n");
+
+ memset(s->regs, 0, ECSPI_MAX * sizeof(uint32_t));
+
+ s->regs[ECSPI_STATREG] = 0x00000003;
+
+ imx_spi_rxfifo_reset(s);
+ imx_spi_txfifo_reset(s);
+
+ imx_spi_update_irq(s);
+
+ s->burst_length = 0;
+
+ for (i=0; i<4; i++) {
+ qemu_set_irq(s->cs_lines[i], 0);
+ }
+}
+
+static uint64_t imx_spi_read(void *opaque, hwaddr offset,
unsigned size)
+{
+ uint32 value = 0;
+ IMXSPIState *s = (IMXSPIState *)opaque;
+ uint32_t index = offset >> 2;
+
+ if (index >= ECSPI_MAX) {
+ qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad register at
offset 0x%"
+ HWADDR_PRIx "\n", TYPE_IMX_SPI, __func__,
offset);
+ return 0;
+ }
+
+ switch (index) {
+ case ECSPI_RXDATA:
+ if (!imx_spi_is_enabled(s)) {
+ value = 0;
+ } else if (fifo32_is_empty(&s->rx_fifo)) {
+ value = 0xdeadbeef;
+ } else {
+ /* read from the RX FIFO */
+ value = fifo32_pop(&s->rx_fifo);
+ }
+
+ break;
+ case ECSPI_TXDATA:
+ qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Trying to read
from TX FIFO\n",
+ TYPE_IMX_SPI, __func__);
+
+ /* Reading from TXDATA gives 0 */
+
+ break;
+ case ECSPI_MSGDATA:
+ qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Trying to read
from MSG FIFO\n",
+ TYPE_IMX_SPI, __func__);
+
+ /* Reading from MSGDATA gives 0 */
+
+ break;
+ default:
+ value = s->regs[index];
+ break;
+ }
+
+ DPRINTF("reg[%s] => 0x%" PRIx32 "\n",
imx_spi_reg_name(index), value);
+
+ imx_spi_update_irq(s);
+
+ return (uint64_t)value;
+}
+
+static void imx_spi_write(void *opaque, hwaddr offset, uint64_t
value,
+ unsigned size)
+{
+ IMXSPIState *s = (IMXSPIState *)opaque;
+ uint32_t index = offset >> 2;
+ uint32_t change_mask;
+
+ if (index >= ECSPI_MAX) {
+ qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad register at
offset 0x%"
+ HWADDR_PRIx "\n", TYPE_IMX_SPI, __func__,
offset);
+ return;
+ }
+
+ DPRINTF("reg[%s] <= 0x%" PRIx32 "\n", imx_spi_reg_name(index),
+ (uint32_t)value);
+
+ change_mask = s->regs[index] ^ value;
+
+ switch (index) {
+ case ECSPI_RXDATA:
+ qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Trying to write
to RX FIFO\n",
+ TYPE_IMX_SPI, __func__);
+ break;
+ case ECSPI_TXDATA:
+ case ECSPI_MSGDATA:
+ /* Is there any difference between TXDATA and MSGDATA ? */
+ /* I'll have to look in the linux driver */
+ if (!imx_spi_is_enabled(s)) {
+ /* Ignore writes if device is disabled */
+ break;
+ } else if (fifo32_is_full(&s->tx_fifo)) {
+ /* Ignore writes if queue is full */
+ break;
+ }
+
+ fifo32_push(&s->tx_fifo, (uint32_t)value);
+
+ if (imx_spi_channel_is_master(s) &&
+ (s->regs[ECSPI_CONREG] & ECSPI_CONREG_SMC)) {
+ /*
+ * Start emiting if current channel is master and
SMC bit is
+ * set.
+ */
+ imx_spi_flush_txfifo(s);
+ }
+
+ break;
+ case ECSPI_STATREG:
+ /* Clear RO and TC bits on write */
+ value &= ECSPI_STATREG_RO | ECSPI_STATREG_TC;
+ s->regs[ECSPI_STATREG] &= ~value;
+
+ break;
+ case ECSPI_CONREG:
+ s->regs[ECSPI_CONREG] = value;
+
+ if (!imx_spi_is_enabled(s)) {
+ /* device is diabled, so this is a reset */
+ imx_spi_reset(DEVICE(s));
+ return;
+ }
+
+ if (imx_spi_channel_is_master(s)) {
+ /* We are in master mode */
+
+ if ((value & change_mask & ECSPI_CONREG_SMC) &&
+ !fifo32_is_empty(&s->tx_fifo)) {
+ /* SMC bit is set and TX FIFO has some slots
filled in */
+ imx_spi_flush_txfifo(s);
+ } else if ((value & change_mask & ECSPI_CONREG_XCH) &&
+ !(value & ECSPI_CONREG_SMC)) {
+ /* This is a request to start emiting */
+ imx_spi_flush_txfifo(s);
+ }
+ }
+
+ break;
+ default:
+ s->regs[index] = value;
+
+ break;
+ }
+
+ imx_spi_update_irq(s);
+}
+
+static const struct MemoryRegionOps imx_spi_ops = {
+ .read = imx_spi_read,
+ .write = imx_spi_write,
+ .endianness = DEVICE_NATIVE_ENDIAN,
+ .valid = {
+ /*
+ * Our device would not work correctly if the guest was
doing
+ * unaligned access. This might not be a limitation on
the real
+ * device but in practice there is no reason for a guest
to access
+ * this device unaligned.
+ */
+ .min_access_size = 4,
+ .max_access_size = 4,
+ .unaligned = false,
+ },
+};
+
+static void imx_spi_realize(DeviceState *dev, Error **errp)
+{
+ IMXSPIState *s = IMX_SPI(dev);
+ int i;
+
+ s->bus = ssi_create_bus(dev, "spi");
+
+ memory_region_init_io(&s->iomem, OBJECT(dev), &imx_spi_ops, s,
+ TYPE_IMX_SPI, 0x1000);
+ sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
+ sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
+
+ ssi_auto_connect_slaves(dev, s->cs_lines, s->bus);
+
+ for (i = 0; i < 4; ++i) {
+ sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->cs_lines[i]);
+ }
+
+ s->previous_level = -1;
+ s->burst_length = 0;
+
+ fifo32_create(&s->tx_fifo, ECSPI_FIFO_SIZE);
+ fifo32_create(&s->rx_fifo, ECSPI_FIFO_SIZE);
+}
+
+static void imx_spi_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ dc->realize = imx_spi_realize;
+ dc->vmsd = &vmstate_imx_spi;
+ dc->reset = imx_spi_reset;
+ dc->desc = "i.MX SPI Controller";
+}
+
+static const TypeInfo imx_spi_info = {
+ .name = TYPE_IMX_SPI,
+ .parent = TYPE_SYS_BUS_DEVICE,
+ .instance_size = sizeof(IMXSPIState),
+ .class_init = imx_spi_class_init,
+};
+
+static void imx_spi_register_types(void)
+{
+ type_register_static(&imx_spi_info);
+}
+
+type_init(imx_spi_register_types)
diff --git a/include/hw/ssi/imx_spi.h b/include/hw/ssi/imx_spi.h
new file mode 100644
index 0000000..1e38cb1
--- /dev/null
+++ b/include/hw/ssi/imx_spi.h
@@ -0,0 +1,104 @@
+/*
+ * IMX SPI Controller
+ *
+ * Copyright 2016 Jean-Christophe Dubois <j...@tribudubois.net>
+ *
+ * This work is licensed under the terms of the GNU GPL, version
2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef IMX_SPI_H
+#define IMX_SPI_H
+
+#include "hw/sysbus.h"
+#include "hw/ssi/ssi.h"
+#include "qemu/bitops.h"
+#include "qemu/fifo32.h"
+
+#define ECSPI_FIFO_SIZE 64
+
+#define ECSPI_RXDATA 0
+#define ECSPI_TXDATA 1
+#define ECSPI_CONREG 2
+#define ECSPI_CONFIGREG 3
+#define ECSPI_INTREG 4
+#define ECSPI_DMAREG 5
+#define ECSPI_STATREG 6
+#define ECSPI_PERIODREG 7
+#define ECSPI_TESTREG 8
+#define ECSPI_MSGDATA 16
+#define ECSPI_MAX 17
+
+/* ECSPI_CONREG */
+#define ECSPI_CONREG_EN (1 << 0)
+#define ECSPI_CONREG_HT (1 << 1)
+#define ECSPI_CONREG_XCH (1 << 2)
+#define ECSPI_CONREG_SMC (1 << 3)
+#define ECSPI_CONREG_CHANNEL_MODE_SHIFT 4
+#define ECSPI_CONREG_CHANNEL_MODE_LENGTH 4
+#define ECSPI_CONREG_DRCTL_SHIFT 16
+#define ECSPI_CONREG_DRCTL_LENGTH 2
+#define ECSPI_CONREG_CHANNEL_SELECT_SHIFT 18
+#define ECSPI_CONREG_CHANNEL_SELECT_LENGTH 2
+#define ECSPI_CONREG_BURST_LENGTH_SHIFT 20
+#define ECSPI_CONREG_BURST_LENGTH_LENGTH 12
+
+/* ECSPI_CONFIGREG */
+#define ECSPI_CONFIGREG_SS_CTL_SHIFT 8
+#define ECSPI_CONFIGREG_SS_CTL_LENGTH 4
+
+/* ECSPI_INTREG */
+#define ECSPI_INTREG_TEEN (1 << 0)
+#define ECSPI_INTREG_TDREN (1 << 1)
+#define ECSPI_INTREG_TFEN (1 << 2)
+#define ECSPI_INTREG_RREN (1 << 3)
+#define ECSPI_INTREG_RDREN (1 << 4)
+#define ECSPI_INTREG_RFEN (1 << 5)
+#define ECSPI_INTREG_ROEN (1 << 6)
+#define ECSPI_INTREG_TCEN (1 << 7)
+
+/* ECSPI_DMAREG */
+#define ECSPI_DMAREG_RXTDEN (1 << 31)
+#define ECSPI_DMAREG_RXDEN (1 << 23)
+#define ECSPI_DMAREG_TEDEN (1 << 7)
+#define ECSPI_DMAREG_RX_THRESHOLD_SHIFT 16
+#define ECSPI_DMAREG_RX_THRESHOLD_LENGTH 6
+
+/* ECSPI_STATREG */
+#define ECSPI_STATREG_TE (1 << 0)
+#define ECSPI_STATREG_TDR (1 << 1)
+#define ECSPI_STATREG_TF (1 << 2)
+#define ECSPI_STATREG_RR (1 << 3)
+#define ECSPI_STATREG_RDR (1 << 4)
+#define ECSPI_STATREG_RF (1 << 5)
+#define ECSPI_STATREG_RO (1 << 6)
+#define ECSPI_STATREG_TC (1 << 7)
+
+#define EXTRACT(value, name) extract32(value, name##_SHIFT,
name##_LENGTH)
+
+#define TYPE_IMX_SPI "imx.spi"
+#define IMX_SPI(obj) OBJECT_CHECK(IMXSPIState, (obj), TYPE_IMX_SPI)
+
+typedef struct IMXSPIState {
+ /* <private> */
+ SysBusDevice parent_obj;
+
+ /* <public> */
+ MemoryRegion iomem;
+
+ qemu_irq irq;
+ int previous_level;
+
+ qemu_irq cs_lines[4];
+
+ SSIBus *bus;
+
+ uint32_t regs[ECSPI_MAX];
+
+ Fifo32 rx_fifo;
+ Fifo32 tx_fifo;
+
+ int16_t burst_length;
+} IMXSPIState;
+
+#endif /* IMX_SPI_H */
