2 * CFI parallel flash with AMD command set emulation
4 * Copyright (c) 2005 Jocelyn Mayer
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
22 * Supported commands/modes are:
28 * - unlock bypass command
31 * It does not support flash interleaving.
32 * It does not implement software data protection as found in many real chips
35 #include "qemu/osdep.h"
36 #include "hw/block/block.h"
37 #include "hw/block/flash.h"
38 #include "hw/qdev-properties.h"
39 #include "hw/qdev-properties-system.h"
40 #include "qapi/error.h"
41 #include "qemu/error-report.h"
42 #include "qemu/bitmap.h"
43 #include "qemu/timer.h"
44 #include "sysemu/block-backend.h"
45 #include "qemu/host-utils.h"
46 #include "qemu/module.h"
47 #include "hw/sysbus.h"
48 #include "migration/vmstate.h"
51 #define PFLASH_DEBUG false
52 #define DPRINTF(fmt, ...) \
55 fprintf(stderr, "PFLASH: " fmt, ## __VA_ARGS__); \
59 #define PFLASH_LAZY_ROMD_THRESHOLD 42
62 * The size of the cfi_table indirectly depends on this and the start of the
63 * PRI table directly depends on it. 4 is the maximum size (and also what
64 * seems common) without changing the PRT table address.
66 #define PFLASH_MAX_ERASE_REGIONS 4
68 /* Special write cycles for CFI queries. */
71 WCYCLE_AUTOSELECT_CFI
= 8,
76 SysBusDevice parent_obj
;
80 uint32_t uniform_nb_blocs
;
81 uint32_t uniform_sector_len
;
82 uint32_t total_sectors
;
83 uint32_t nb_blocs
[PFLASH_MAX_ERASE_REGIONS
];
84 uint32_t sector_len
[PFLASH_MAX_ERASE_REGIONS
];
89 int wcycle
; /* if 0, the flash is read normally */
94 /* FIXME: implement array device properties */
99 uint16_t unlock_addr0
;
100 uint16_t unlock_addr1
;
101 uint8_t cfi_table
[0x4d];
104 * The device replicates the flash memory across its memory space. Emulate
105 * that by having a container (.mem) filled with an array of aliases
106 * (.mem_mappings) pointing to the flash memory (.orig_mem).
109 MemoryRegion
*mem_mappings
; /* array; one per mapping */
110 MemoryRegion orig_mem
;
112 int read_counter
; /* used for lazy switch-back to rom mode */
113 int sectors_to_erase
;
114 uint64_t erase_time_remaining
;
115 unsigned long *sector_erase_map
;
121 * Toggle status bit DQ7.
123 static inline void toggle_dq7(PFlashCFI02
*pfl
)
129 * Set status bit DQ7 to bit 7 of value.
131 static inline void set_dq7(PFlashCFI02
*pfl
, uint8_t value
)
134 pfl
->status
|= value
& 0x80;
138 * Toggle status bit DQ6.
140 static inline void toggle_dq6(PFlashCFI02
*pfl
)
148 static inline void assert_dq3(PFlashCFI02
*pfl
)
156 static inline void reset_dq3(PFlashCFI02
*pfl
)
158 pfl
->status
&= ~0x08;
162 * Toggle status bit DQ2.
164 static inline void toggle_dq2(PFlashCFI02
*pfl
)
170 * Set up replicated mappings of the same region.
172 static void pflash_setup_mappings(PFlashCFI02
*pfl
)
175 hwaddr size
= memory_region_size(&pfl
->orig_mem
);
177 memory_region_init(&pfl
->mem
, OBJECT(pfl
), "pflash", pfl
->mappings
* size
);
178 pfl
->mem_mappings
= g_new(MemoryRegion
, pfl
->mappings
);
179 for (i
= 0; i
< pfl
->mappings
; ++i
) {
180 memory_region_init_alias(&pfl
->mem_mappings
[i
], OBJECT(pfl
),
181 "pflash-alias", &pfl
->orig_mem
, 0, size
);
182 memory_region_add_subregion(&pfl
->mem
, i
* size
, &pfl
->mem_mappings
[i
]);
184 pfl
->rom_mode
= true;
187 static void pflash_reset_state_machine(PFlashCFI02
*pfl
)
189 trace_pflash_reset();
194 static void pflash_mode_read_array(PFlashCFI02
*pfl
)
196 trace_pflash_mode_read_array();
197 pflash_reset_state_machine(pfl
);
198 pfl
->rom_mode
= true;
199 memory_region_rom_device_set_romd(&pfl
->orig_mem
, true);
202 static size_t pflash_regions_count(PFlashCFI02
*pfl
)
204 return pfl
->cfi_table
[0x2c];
208 * Returns the time it takes to erase the number of sectors scheduled for
209 * erasure based on CFI address 0x21 which is "Typical timeout per individual
210 * block erase 2^N ms."
212 static uint64_t pflash_erase_time(PFlashCFI02
*pfl
)
215 * If there are no sectors to erase (which can happen if all of the sectors
216 * to be erased are protected), then erase takes 100 us. Protected sectors
217 * aren't supported so this should never happen.
219 return ((1ULL << pfl
->cfi_table
[0x21]) * pfl
->sectors_to_erase
) * SCALE_US
;
223 * Returns true if the device is currently in erase suspend mode.
225 static inline bool pflash_erase_suspend_mode(PFlashCFI02
*pfl
)
227 return pfl
->erase_time_remaining
> 0;
230 static void pflash_timer(void *opaque
)
232 PFlashCFI02
*pfl
= opaque
;
234 trace_pflash_timer_expired(pfl
->cmd
);
235 if (pfl
->cmd
== 0x30) {
237 * Sector erase. If DQ3 is 0 when the timer expires, then the 50
238 * us erase timeout has expired so we need to start the timer for the
239 * sector erase algorithm. Otherwise, the erase completed and we should
240 * go back to read array mode.
242 if ((pfl
->status
& 0x08) == 0) {
244 uint64_t timeout
= pflash_erase_time(pfl
);
245 timer_mod(&pfl
->timer
,
246 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
) + timeout
);
247 DPRINTF("%s: erase timeout fired; erasing %d sectors\n",
248 __func__
, pfl
->sectors_to_erase
);
251 DPRINTF("%s: sector erase complete\n", __func__
);
252 bitmap_zero(pfl
->sector_erase_map
, pfl
->total_sectors
);
253 pfl
->sectors_to_erase
= 0;
263 pflash_mode_read_array(pfl
);
268 * Read data from flash.
270 static uint64_t pflash_data_read(PFlashCFI02
*pfl
, hwaddr offset
,
273 uint8_t *p
= (uint8_t *)pfl
->storage
+ offset
;
274 uint64_t ret
= pfl
->be
? ldn_be_p(p
, width
) : ldn_le_p(p
, width
);
275 trace_pflash_data_read(offset
, width
, ret
);
285 * offset should be a byte offset of the QEMU device and _not_ a device
288 static SectorInfo
pflash_sector_info(PFlashCFI02
*pfl
, hwaddr offset
)
290 assert(offset
< pfl
->chip_len
);
292 uint32_t sector_num
= 0;
293 for (int i
= 0; i
< pflash_regions_count(pfl
); ++i
) {
294 uint64_t region_size
= (uint64_t)pfl
->nb_blocs
[i
] * pfl
->sector_len
[i
];
295 if (addr
<= offset
&& offset
< addr
+ region_size
) {
296 return (SectorInfo
) {
297 .len
= pfl
->sector_len
[i
],
298 .num
= sector_num
+ (offset
- addr
) / pfl
->sector_len
[i
],
301 sector_num
+= pfl
->nb_blocs
[i
];
308 * Returns true if the offset refers to a flash sector that is currently being
311 static bool pflash_sector_is_erasing(PFlashCFI02
*pfl
, hwaddr offset
)
313 long sector_num
= pflash_sector_info(pfl
, offset
).num
;
314 return test_bit(sector_num
, pfl
->sector_erase_map
);
317 static uint64_t pflash_read(void *opaque
, hwaddr offset
, unsigned int width
)
319 PFlashCFI02
*pfl
= opaque
;
323 /* Lazy reset to ROMD mode after a certain amount of read accesses */
324 if (!pfl
->rom_mode
&& pfl
->wcycle
== 0 &&
325 ++pfl
->read_counter
> PFLASH_LAZY_ROMD_THRESHOLD
) {
326 pflash_mode_read_array(pfl
);
328 offset
&= pfl
->chip_len
- 1;
329 boff
= offset
& 0xFF;
330 if (pfl
->width
== 2) {
332 } else if (pfl
->width
== 4) {
337 /* This should never happen : reset state & treat it as a read*/
338 DPRINTF("%s: unknown command state: %x\n", __func__
, pfl
->cmd
);
339 pflash_reset_state_machine(pfl
);
340 /* fall through to the read code */
341 case 0x80: /* Erase (unlock) */
342 /* We accept reads during second unlock sequence... */
344 if (pflash_erase_suspend_mode(pfl
) &&
345 pflash_sector_is_erasing(pfl
, offset
)) {
346 /* Toggle bit 2, but not 6. */
348 /* Status register read */
350 DPRINTF("%s: status %" PRIx64
"\n", __func__
, ret
);
353 /* Flash area read */
354 ret
= pflash_data_read(pfl
, offset
, width
);
356 case 0x90: /* flash ID read */
360 ret
= boff
& 0x01 ? pfl
->ident1
: pfl
->ident0
;
363 ret
= 0x00; /* Pretend all sectors are unprotected */
367 ret
= boff
& 0x01 ? pfl
->ident3
: pfl
->ident2
;
368 if (ret
!= (uint8_t)-1) {
371 /* Fall through to data read. */
373 ret
= pflash_data_read(pfl
, offset
, width
);
375 DPRINTF("%s: ID " TARGET_FMT_plx
" %" PRIx64
"\n", __func__
, boff
, ret
);
377 case 0x10: /* Chip Erase */
378 case 0x30: /* Sector Erase */
379 /* Toggle bit 2 during erase, but not program. */
382 case 0xA0: /* Program */
385 /* Status register read */
387 DPRINTF("%s: status %" PRIx64
"\n", __func__
, ret
);
391 if (boff
< sizeof(pfl
->cfi_table
)) {
392 ret
= pfl
->cfi_table
[boff
];
398 trace_pflash_io_read(offset
, width
, ret
, pfl
->cmd
, pfl
->wcycle
);
403 /* update flash content on disk */
404 static void pflash_update(PFlashCFI02
*pfl
, int offset
, int size
)
409 offset_end
= offset
+ size
;
410 /* widen to sector boundaries */
411 offset
= QEMU_ALIGN_DOWN(offset
, BDRV_SECTOR_SIZE
);
412 offset_end
= QEMU_ALIGN_UP(offset_end
, BDRV_SECTOR_SIZE
);
413 ret
= blk_pwrite(pfl
->blk
, offset
, pfl
->storage
+ offset
,
414 offset_end
- offset
, 0);
416 /* TODO set error bit in status */
417 error_report("Could not update PFLASH: %s", strerror(-ret
));
422 static void pflash_sector_erase(PFlashCFI02
*pfl
, hwaddr offset
)
424 SectorInfo sector_info
= pflash_sector_info(pfl
, offset
);
425 uint64_t sector_len
= sector_info
.len
;
426 offset
&= ~(sector_len
- 1);
427 DPRINTF("%s: start sector erase at %0*" PRIx64
"-%0*" PRIx64
"\n",
428 __func__
, pfl
->width
* 2, offset
,
429 pfl
->width
* 2, offset
+ sector_len
- 1);
431 uint8_t *p
= pfl
->storage
;
432 memset(p
+ offset
, 0xff, sector_len
);
433 pflash_update(pfl
, offset
, sector_len
);
436 ++pfl
->sectors_to_erase
;
437 set_bit(sector_info
.num
, pfl
->sector_erase_map
);
438 /* Set (or reset) the 50 us timer for additional erase commands. */
439 timer_mod(&pfl
->timer
, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
) + 50000);
442 static void pflash_write(void *opaque
, hwaddr offset
, uint64_t value
,
445 PFlashCFI02
*pfl
= opaque
;
450 trace_pflash_io_write(offset
, width
, value
, pfl
->wcycle
);
452 if (pfl
->cmd
!= 0xA0) {
453 /* Reset does nothing during chip erase and sector erase. */
454 if (cmd
== 0xF0 && pfl
->cmd
!= 0x10 && pfl
->cmd
!= 0x30) {
455 if (pfl
->wcycle
== WCYCLE_AUTOSELECT_CFI
) {
456 /* Return to autoselect mode. */
464 offset
&= pfl
->chip_len
- 1;
467 if (pfl
->width
== 2) {
469 } else if (pfl
->width
== 4) {
472 /* Only the least-significant 11 bits are used in most cases. */
474 switch (pfl
->wcycle
) {
476 /* Set the device in I/O access mode if required */
478 pfl
->rom_mode
= false;
479 memory_region_rom_device_set_romd(&pfl
->orig_mem
, false);
481 pfl
->read_counter
= 0;
482 /* We're in read mode */
484 if (boff
== 0x55 && cmd
== 0x98) {
485 /* Enter CFI query mode */
486 pfl
->wcycle
= WCYCLE_CFI
;
490 /* Handle erase resume in erase suspend mode, otherwise reset. */
491 if (cmd
== 0x30) { /* Erase Resume */
492 if (pflash_erase_suspend_mode(pfl
)) {
493 /* Resume the erase. */
494 timer_mod(&pfl
->timer
, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
) +
495 pfl
->erase_time_remaining
);
496 pfl
->erase_time_remaining
= 0;
505 /* Ignore erase suspend. */
506 if (cmd
== 0xB0) { /* Erase Suspend */
509 if (boff
!= pfl
->unlock_addr0
|| cmd
!= 0xAA) {
510 DPRINTF("%s: unlock0 failed " TARGET_FMT_plx
" %02x %04x\n",
511 __func__
, boff
, cmd
, pfl
->unlock_addr0
);
514 DPRINTF("%s: unlock sequence started\n", __func__
);
517 /* We started an unlock sequence */
519 if (boff
!= pfl
->unlock_addr1
|| cmd
!= 0x55) {
520 DPRINTF("%s: unlock1 failed " TARGET_FMT_plx
" %02x\n", __func__
,
524 DPRINTF("%s: unlock sequence done\n", __func__
);
527 /* We finished an unlock sequence */
528 if (!pfl
->bypass
&& boff
!= pfl
->unlock_addr0
) {
529 DPRINTF("%s: command failed " TARGET_FMT_plx
" %02x\n", __func__
,
537 case 0x80: /* Erase */
538 case 0x90: /* Autoselect */
539 case 0xA0: /* Program */
541 DPRINTF("%s: starting command %02x\n", __func__
, cmd
);
544 DPRINTF("%s: unknown command %02x\n", __func__
, cmd
);
550 case 0x80: /* Erase */
551 /* We need another unlock sequence */
553 case 0xA0: /* Program */
554 if (pflash_erase_suspend_mode(pfl
) &&
555 pflash_sector_is_erasing(pfl
, offset
)) {
556 /* Ignore writes to erasing sectors. */
562 trace_pflash_data_write(offset
, width
, value
, 0);
564 p
= (uint8_t *)pfl
->storage
+ offset
;
566 uint64_t current
= ldn_be_p(p
, width
);
567 stn_be_p(p
, width
, current
& value
);
569 uint64_t current
= ldn_le_p(p
, width
);
570 stn_le_p(p
, width
, current
& value
);
572 pflash_update(pfl
, offset
, width
);
575 * While programming, status bit DQ7 should hold the opposite
576 * value from how it was programmed.
578 set_dq7(pfl
, ~value
);
579 /* Let's pretend write is immediate */
583 case 0x90: /* Autoselect */
584 if (pfl
->bypass
&& cmd
== 0x00) {
585 /* Unlock bypass reset */
589 * We can enter CFI query mode from autoselect mode, but we must
590 * return to autoselect mode after a reset.
592 if (boff
== 0x55 && cmd
== 0x98) {
593 /* Enter autoselect CFI query mode */
594 pfl
->wcycle
= WCYCLE_AUTOSELECT_CFI
;
600 DPRINTF("%s: invalid write for command %02x\n",
606 case 0xA0: /* Program */
607 /* Ignore writes while flash data write is occurring */
608 /* As we suppose write is immediate, this should never happen */
610 case 0x80: /* Erase */
613 /* Should never happen */
614 DPRINTF("%s: invalid command state %02x (wc 4)\n",
620 if (pflash_erase_suspend_mode(pfl
)) {
621 /* Erasing is not supported in erase suspend mode. */
625 case 0x10: /* Chip Erase */
626 if (boff
!= pfl
->unlock_addr0
) {
627 DPRINTF("%s: chip erase: invalid address " TARGET_FMT_plx
"\n",
632 DPRINTF("%s: start chip erase\n", __func__
);
634 memset(pfl
->storage
, 0xff, pfl
->chip_len
);
635 pflash_update(pfl
, 0, pfl
->chip_len
);
638 /* Wait the time specified at CFI address 0x22. */
639 timer_mod(&pfl
->timer
, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
) +
640 (1ULL << pfl
->cfi_table
[0x22]) * SCALE_MS
);
642 case 0x30: /* Sector erase */
643 pflash_sector_erase(pfl
, offset
);
646 DPRINTF("%s: invalid command %02x (wc 5)\n", __func__
, cmd
);
653 case 0x10: /* Chip Erase */
654 /* Ignore writes during chip erase */
656 case 0x30: /* Sector erase */
659 * If erase suspend happens during the erase timeout (so DQ3 is
660 * 0), then the device suspends erasing immediately. Set the
661 * remaining time to be the total time to erase. Otherwise,
662 * there is a maximum amount of time it can take to enter
663 * suspend mode. Let's ignore that and suspend immediately and
664 * set the remaining time to the actual time remaining on the
667 if ((pfl
->status
& 0x08) == 0) {
668 pfl
->erase_time_remaining
= pflash_erase_time(pfl
);
670 int64_t delta
= timer_expire_time_ns(&pfl
->timer
) -
671 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
);
672 /* Make sure we have a positive time remaining. */
673 pfl
->erase_time_remaining
= delta
<= 0 ? 1 : delta
;
676 timer_del(&pfl
->timer
);
677 pflash_reset_state_machine(pfl
);
681 * If DQ3 is 0, additional sector erase commands can be
682 * written and anything else (other than an erase suspend) resets
685 if ((pfl
->status
& 0x08) == 0) {
687 pflash_sector_erase(pfl
, offset
);
692 /* Ignore writes during the actual erase. */
695 /* Should never happen */
696 DPRINTF("%s: invalid command state %02x (wc 6)\n",
701 /* Special values for CFI queries */
703 case WCYCLE_AUTOSELECT_CFI
:
704 DPRINTF("%s: invalid write in CFI query mode\n", __func__
);
707 /* Should never happen */
708 DPRINTF("%s: invalid write state (wc 7)\n", __func__
);
718 pflash_reset_state_machine(pfl
);
726 static const MemoryRegionOps pflash_cfi02_ops
= {
728 .write
= pflash_write
,
729 .valid
.min_access_size
= 1,
730 .valid
.max_access_size
= 4,
731 .endianness
= DEVICE_NATIVE_ENDIAN
,
734 static void pflash_cfi02_fill_cfi_table(PFlashCFI02
*pfl
, int nb_regions
)
736 /* Hardcoded CFI table (mostly from SG29 Spansion flash) */
737 const uint16_t pri_ofs
= 0x40;
738 /* Standard "QRY" string */
739 pfl
->cfi_table
[0x10] = 'Q';
740 pfl
->cfi_table
[0x11] = 'R';
741 pfl
->cfi_table
[0x12] = 'Y';
742 /* Command set (AMD/Fujitsu) */
743 pfl
->cfi_table
[0x13] = 0x02;
744 pfl
->cfi_table
[0x14] = 0x00;
745 /* Primary extended table address */
746 pfl
->cfi_table
[0x15] = pri_ofs
;
747 pfl
->cfi_table
[0x16] = pri_ofs
>> 8;
748 /* Alternate command set (none) */
749 pfl
->cfi_table
[0x17] = 0x00;
750 pfl
->cfi_table
[0x18] = 0x00;
751 /* Alternate extended table (none) */
752 pfl
->cfi_table
[0x19] = 0x00;
753 pfl
->cfi_table
[0x1A] = 0x00;
755 pfl
->cfi_table
[0x1B] = 0x27;
757 pfl
->cfi_table
[0x1C] = 0x36;
758 /* Vpp min (no Vpp pin) */
759 pfl
->cfi_table
[0x1D] = 0x00;
760 /* Vpp max (no Vpp pin) */
761 pfl
->cfi_table
[0x1E] = 0x00;
762 /* Timeout per single byte/word write (128 ms) */
763 pfl
->cfi_table
[0x1F] = 0x07;
764 /* Timeout for min size buffer write (NA) */
765 pfl
->cfi_table
[0x20] = 0x00;
766 /* Typical timeout for block erase (512 ms) */
767 pfl
->cfi_table
[0x21] = 0x09;
768 /* Typical timeout for full chip erase (4096 ms) */
769 pfl
->cfi_table
[0x22] = 0x0C;
771 pfl
->cfi_table
[0x23] = 0x01;
772 /* Max timeout for buffer write (NA) */
773 pfl
->cfi_table
[0x24] = 0x00;
774 /* Max timeout for block erase */
775 pfl
->cfi_table
[0x25] = 0x0A;
776 /* Max timeout for chip erase */
777 pfl
->cfi_table
[0x26] = 0x0D;
779 pfl
->cfi_table
[0x27] = ctz32(pfl
->chip_len
);
780 /* Flash device interface (8 & 16 bits) */
781 pfl
->cfi_table
[0x28] = 0x02;
782 pfl
->cfi_table
[0x29] = 0x00;
783 /* Max number of bytes in multi-bytes write */
785 * XXX: disable buffered write as it's not supported
786 * pfl->cfi_table[0x2A] = 0x05;
788 pfl
->cfi_table
[0x2A] = 0x00;
789 pfl
->cfi_table
[0x2B] = 0x00;
790 /* Number of erase block regions */
791 pfl
->cfi_table
[0x2c] = nb_regions
;
792 /* Erase block regions */
793 for (int i
= 0; i
< nb_regions
; ++i
) {
794 uint32_t sector_len_per_device
= pfl
->sector_len
[i
];
795 pfl
->cfi_table
[0x2d + 4 * i
] = pfl
->nb_blocs
[i
] - 1;
796 pfl
->cfi_table
[0x2e + 4 * i
] = (pfl
->nb_blocs
[i
] - 1) >> 8;
797 pfl
->cfi_table
[0x2f + 4 * i
] = sector_len_per_device
>> 8;
798 pfl
->cfi_table
[0x30 + 4 * i
] = sector_len_per_device
>> 16;
800 assert(0x2c + 4 * nb_regions
< pri_ofs
);
803 pfl
->cfi_table
[0x00 + pri_ofs
] = 'P';
804 pfl
->cfi_table
[0x01 + pri_ofs
] = 'R';
805 pfl
->cfi_table
[0x02 + pri_ofs
] = 'I';
807 /* Extended version 1.0 */
808 pfl
->cfi_table
[0x03 + pri_ofs
] = '1';
809 pfl
->cfi_table
[0x04 + pri_ofs
] = '0';
811 /* Address sensitive unlock required. */
812 pfl
->cfi_table
[0x05 + pri_ofs
] = 0x00;
813 /* Erase suspend to read/write. */
814 pfl
->cfi_table
[0x06 + pri_ofs
] = 0x02;
815 /* Sector protect not supported. */
816 pfl
->cfi_table
[0x07 + pri_ofs
] = 0x00;
817 /* Temporary sector unprotect not supported. */
818 pfl
->cfi_table
[0x08 + pri_ofs
] = 0x00;
820 /* Sector protect/unprotect scheme. */
821 pfl
->cfi_table
[0x09 + pri_ofs
] = 0x00;
823 /* Simultaneous operation not supported. */
824 pfl
->cfi_table
[0x0a + pri_ofs
] = 0x00;
825 /* Burst mode not supported. */
826 pfl
->cfi_table
[0x0b + pri_ofs
] = 0x00;
827 /* Page mode not supported. */
828 pfl
->cfi_table
[0x0c + pri_ofs
] = 0x00;
829 assert(0x0c + pri_ofs
< ARRAY_SIZE(pfl
->cfi_table
));
832 static void pflash_cfi02_realize(DeviceState
*dev
, Error
**errp
)
835 PFlashCFI02
*pfl
= PFLASH_CFI02(dev
);
838 if (pfl
->uniform_sector_len
== 0 && pfl
->sector_len
[0] == 0) {
839 error_setg(errp
, "attribute \"sector-length\" not specified or zero.");
842 if (pfl
->uniform_nb_blocs
== 0 && pfl
->nb_blocs
[0] == 0) {
843 error_setg(errp
, "attribute \"num-blocks\" not specified or zero.");
846 if (pfl
->name
== NULL
) {
847 error_setg(errp
, "attribute \"name\" not specified.");
853 pfl
->total_sectors
= 0;
854 for (nb_regions
= 0; nb_regions
< PFLASH_MAX_ERASE_REGIONS
; ++nb_regions
) {
855 if (pfl
->nb_blocs
[nb_regions
] == 0) {
858 pfl
->total_sectors
+= pfl
->nb_blocs
[nb_regions
];
859 uint64_t sector_len_per_device
= pfl
->sector_len
[nb_regions
];
862 * The size of each flash sector must be a power of 2 and it must be
863 * aligned at the same power of 2.
865 if (sector_len_per_device
& 0xff ||
866 sector_len_per_device
>= (1 << 24) ||
867 !is_power_of_2(sector_len_per_device
))
869 error_setg(errp
, "unsupported configuration: "
870 "sector length[%d] per device = %" PRIx64
".",
871 nb_regions
, sector_len_per_device
);
874 if (pfl
->chip_len
& (sector_len_per_device
- 1)) {
875 error_setg(errp
, "unsupported configuration: "
876 "flash region %d not correctly aligned.",
881 pfl
->chip_len
+= (uint64_t)pfl
->sector_len
[nb_regions
] *
882 pfl
->nb_blocs
[nb_regions
];
885 uint64_t uniform_len
= (uint64_t)pfl
->uniform_nb_blocs
*
886 pfl
->uniform_sector_len
;
887 if (nb_regions
== 0) {
889 pfl
->nb_blocs
[0] = pfl
->uniform_nb_blocs
;
890 pfl
->sector_len
[0] = pfl
->uniform_sector_len
;
891 pfl
->chip_len
= uniform_len
;
892 pfl
->total_sectors
= pfl
->uniform_nb_blocs
;
893 } else if (uniform_len
!= 0 && uniform_len
!= pfl
->chip_len
) {
894 error_setg(errp
, "\"num-blocks\"*\"sector-length\" "
895 "different from \"num-blocks0\"*\'sector-length0\" + ... + "
896 "\"num-blocks3\"*\"sector-length3\"");
900 memory_region_init_rom_device(&pfl
->orig_mem
, OBJECT(pfl
),
901 &pflash_cfi02_ops
, pfl
, pfl
->name
,
902 pfl
->chip_len
, errp
);
907 pfl
->storage
= memory_region_get_ram_ptr(&pfl
->orig_mem
);
911 pfl
->ro
= !blk_supports_write_perm(pfl
->blk
);
912 perm
= BLK_PERM_CONSISTENT_READ
| (pfl
->ro
? 0 : BLK_PERM_WRITE
);
913 ret
= blk_set_perm(pfl
->blk
, perm
, BLK_PERM_ALL
, errp
);
922 if (!blk_check_size_and_read_all(pfl
->blk
, pfl
->storage
,
923 pfl
->chip_len
, errp
)) {
924 vmstate_unregister_ram(&pfl
->orig_mem
, DEVICE(pfl
));
929 /* Only 11 bits are used in the comparison. */
930 pfl
->unlock_addr0
&= 0x7FF;
931 pfl
->unlock_addr1
&= 0x7FF;
933 /* Allocate memory for a bitmap for sectors being erased. */
934 pfl
->sector_erase_map
= bitmap_new(pfl
->total_sectors
);
936 pflash_setup_mappings(pfl
);
937 sysbus_init_mmio(SYS_BUS_DEVICE(dev
), &pfl
->mem
);
939 timer_init_ns(&pfl
->timer
, QEMU_CLOCK_VIRTUAL
, pflash_timer
, pfl
);
942 pflash_cfi02_fill_cfi_table(pfl
, nb_regions
);
945 static Property pflash_cfi02_properties
[] = {
946 DEFINE_PROP_DRIVE("drive", PFlashCFI02
, blk
),
947 DEFINE_PROP_UINT32("num-blocks", PFlashCFI02
, uniform_nb_blocs
, 0),
948 DEFINE_PROP_UINT32("sector-length", PFlashCFI02
, uniform_sector_len
, 0),
949 DEFINE_PROP_UINT32("num-blocks0", PFlashCFI02
, nb_blocs
[0], 0),
950 DEFINE_PROP_UINT32("sector-length0", PFlashCFI02
, sector_len
[0], 0),
951 DEFINE_PROP_UINT32("num-blocks1", PFlashCFI02
, nb_blocs
[1], 0),
952 DEFINE_PROP_UINT32("sector-length1", PFlashCFI02
, sector_len
[1], 0),
953 DEFINE_PROP_UINT32("num-blocks2", PFlashCFI02
, nb_blocs
[2], 0),
954 DEFINE_PROP_UINT32("sector-length2", PFlashCFI02
, sector_len
[2], 0),
955 DEFINE_PROP_UINT32("num-blocks3", PFlashCFI02
, nb_blocs
[3], 0),
956 DEFINE_PROP_UINT32("sector-length3", PFlashCFI02
, sector_len
[3], 0),
957 DEFINE_PROP_UINT8("width", PFlashCFI02
, width
, 0),
958 DEFINE_PROP_UINT8("mappings", PFlashCFI02
, mappings
, 0),
959 DEFINE_PROP_UINT8("big-endian", PFlashCFI02
, be
, 0),
960 DEFINE_PROP_UINT16("id0", PFlashCFI02
, ident0
, 0),
961 DEFINE_PROP_UINT16("id1", PFlashCFI02
, ident1
, 0),
962 DEFINE_PROP_UINT16("id2", PFlashCFI02
, ident2
, 0),
963 DEFINE_PROP_UINT16("id3", PFlashCFI02
, ident3
, 0),
964 DEFINE_PROP_UINT16("unlock-addr0", PFlashCFI02
, unlock_addr0
, 0),
965 DEFINE_PROP_UINT16("unlock-addr1", PFlashCFI02
, unlock_addr1
, 0),
966 DEFINE_PROP_STRING("name", PFlashCFI02
, name
),
967 DEFINE_PROP_END_OF_LIST(),
970 static void pflash_cfi02_unrealize(DeviceState
*dev
)
972 PFlashCFI02
*pfl
= PFLASH_CFI02(dev
);
973 timer_del(&pfl
->timer
);
974 g_free(pfl
->sector_erase_map
);
977 static void pflash_cfi02_class_init(ObjectClass
*klass
, void *data
)
979 DeviceClass
*dc
= DEVICE_CLASS(klass
);
981 dc
->realize
= pflash_cfi02_realize
;
982 dc
->unrealize
= pflash_cfi02_unrealize
;
983 device_class_set_props(dc
, pflash_cfi02_properties
);
984 set_bit(DEVICE_CATEGORY_STORAGE
, dc
->categories
);
987 static const TypeInfo pflash_cfi02_info
= {
988 .name
= TYPE_PFLASH_CFI02
,
989 .parent
= TYPE_SYS_BUS_DEVICE
,
990 .instance_size
= sizeof(PFlashCFI02
),
991 .class_init
= pflash_cfi02_class_init
,
994 static void pflash_cfi02_register_types(void)
996 type_register_static(&pflash_cfi02_info
);
999 type_init(pflash_cfi02_register_types
)
1001 PFlashCFI02
*pflash_cfi02_register(hwaddr base
,
1005 uint32_t sector_len
,
1006 int nb_mappings
, int width
,
1007 uint16_t id0
, uint16_t id1
,
1008 uint16_t id2
, uint16_t id3
,
1009 uint16_t unlock_addr0
,
1010 uint16_t unlock_addr1
,
1013 DeviceState
*dev
= qdev_new(TYPE_PFLASH_CFI02
);
1016 qdev_prop_set_drive(dev
, "drive", blk
);
1018 assert(QEMU_IS_ALIGNED(size
, sector_len
));
1019 qdev_prop_set_uint32(dev
, "num-blocks", size
/ sector_len
);
1020 qdev_prop_set_uint32(dev
, "sector-length", sector_len
);
1021 qdev_prop_set_uint8(dev
, "width", width
);
1022 qdev_prop_set_uint8(dev
, "mappings", nb_mappings
);
1023 qdev_prop_set_uint8(dev
, "big-endian", !!be
);
1024 qdev_prop_set_uint16(dev
, "id0", id0
);
1025 qdev_prop_set_uint16(dev
, "id1", id1
);
1026 qdev_prop_set_uint16(dev
, "id2", id2
);
1027 qdev_prop_set_uint16(dev
, "id3", id3
);
1028 qdev_prop_set_uint16(dev
, "unlock-addr0", unlock_addr0
);
1029 qdev_prop_set_uint16(dev
, "unlock-addr1", unlock_addr1
);
1030 qdev_prop_set_string(dev
, "name", name
);
1031 sysbus_realize_and_unref(SYS_BUS_DEVICE(dev
), &error_fatal
);
1033 sysbus_mmio_map(SYS_BUS_DEVICE(dev
), 0, base
);
1034 return PFLASH_CFI02(dev
);