2 * CFI parallel flash with AMD command set emulation
4 * Copyright (c) 2005 Jocelyn Mayer
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
22 * Supported commands/modes are:
28 * - unlock bypass command
31 * It does not support flash interleaving.
32 * It does not implement software data protection as found in many real chips
35 #include "qemu/osdep.h"
36 #include "hw/block/block.h"
37 #include "hw/block/flash.h"
38 #include "hw/qdev-properties.h"
39 #include "hw/qdev-properties-system.h"
40 #include "qapi/error.h"
41 #include "qemu/error-report.h"
42 #include "qemu/bitmap.h"
43 #include "qemu/timer.h"
44 #include "sysemu/block-backend.h"
45 #include "qemu/host-utils.h"
46 #include "qemu/module.h"
47 #include "hw/sysbus.h"
48 #include "migration/vmstate.h"
51 #define PFLASH_DEBUG false
52 #define DPRINTF(fmt, ...) \
55 fprintf(stderr, "PFLASH: " fmt, ## __VA_ARGS__); \
59 #define PFLASH_LAZY_ROMD_THRESHOLD 42
62 * The size of the cfi_table indirectly depends on this and the start of the
63 * PRI table directly depends on it. 4 is the maximum size (and also what
64 * seems common) without changing the PRT table address.
66 #define PFLASH_MAX_ERASE_REGIONS 4
68 /* Special write cycles for CFI queries. */
71 WCYCLE_AUTOSELECT_CFI
= 8,
76 SysBusDevice parent_obj
;
80 uint32_t uniform_nb_blocs
;
81 uint32_t uniform_sector_len
;
82 uint32_t total_sectors
;
83 uint32_t nb_blocs
[PFLASH_MAX_ERASE_REGIONS
];
84 uint32_t sector_len
[PFLASH_MAX_ERASE_REGIONS
];
89 int wcycle
; /* if 0, the flash is read normally */
94 /* FIXME: implement array device properties */
99 uint16_t unlock_addr0
;
100 uint16_t unlock_addr1
;
101 uint8_t cfi_table
[0x4d];
104 * The device replicates the flash memory across its memory space. Emulate
105 * that by having a container (.mem) filled with an array of aliases
106 * (.mem_mappings) pointing to the flash memory (.orig_mem).
109 MemoryRegion
*mem_mappings
; /* array; one per mapping */
110 MemoryRegion orig_mem
;
112 int read_counter
; /* used for lazy switch-back to rom mode */
113 int sectors_to_erase
;
114 uint64_t erase_time_remaining
;
115 unsigned long *sector_erase_map
;
121 * Toggle status bit DQ7.
123 static inline void toggle_dq7(PFlashCFI02
*pfl
)
129 * Set status bit DQ7 to bit 7 of value.
131 static inline void set_dq7(PFlashCFI02
*pfl
, uint8_t value
)
134 pfl
->status
|= value
& 0x80;
138 * Toggle status bit DQ6.
140 static inline void toggle_dq6(PFlashCFI02
*pfl
)
148 static inline void assert_dq3(PFlashCFI02
*pfl
)
156 static inline void reset_dq3(PFlashCFI02
*pfl
)
158 pfl
->status
&= ~0x08;
162 * Toggle status bit DQ2.
164 static inline void toggle_dq2(PFlashCFI02
*pfl
)
170 * Set up replicated mappings of the same region.
172 static void pflash_setup_mappings(PFlashCFI02
*pfl
)
175 hwaddr size
= memory_region_size(&pfl
->orig_mem
);
177 memory_region_init(&pfl
->mem
, OBJECT(pfl
), "pflash", pfl
->mappings
* size
);
178 pfl
->mem_mappings
= g_new(MemoryRegion
, pfl
->mappings
);
179 for (i
= 0; i
< pfl
->mappings
; ++i
) {
180 memory_region_init_alias(&pfl
->mem_mappings
[i
], OBJECT(pfl
),
181 "pflash-alias", &pfl
->orig_mem
, 0, size
);
182 memory_region_add_subregion(&pfl
->mem
, i
* size
, &pfl
->mem_mappings
[i
]);
184 pfl
->rom_mode
= true;
187 static void pflash_mode_read_array(PFlashCFI02
*pfl
)
189 trace_pflash_mode_read_array();
192 pfl
->rom_mode
= true;
193 memory_region_rom_device_set_romd(&pfl
->orig_mem
, true);
196 static size_t pflash_regions_count(PFlashCFI02
*pfl
)
198 return pfl
->cfi_table
[0x2c];
202 * Returns the time it takes to erase the number of sectors scheduled for
203 * erasure based on CFI address 0x21 which is "Typical timeout per individual
204 * block erase 2^N ms."
206 static uint64_t pflash_erase_time(PFlashCFI02
*pfl
)
209 * If there are no sectors to erase (which can happen if all of the sectors
210 * to be erased are protected), then erase takes 100 us. Protected sectors
211 * aren't supported so this should never happen.
213 return ((1ULL << pfl
->cfi_table
[0x21]) * pfl
->sectors_to_erase
) * SCALE_US
;
217 * Returns true if the device is currently in erase suspend mode.
219 static inline bool pflash_erase_suspend_mode(PFlashCFI02
*pfl
)
221 return pfl
->erase_time_remaining
> 0;
224 static void pflash_timer(void *opaque
)
226 PFlashCFI02
*pfl
= opaque
;
228 trace_pflash_timer_expired(pfl
->cmd
);
229 if (pfl
->cmd
== 0x30) {
231 * Sector erase. If DQ3 is 0 when the timer expires, then the 50
232 * us erase timeout has expired so we need to start the timer for the
233 * sector erase algorithm. Otherwise, the erase completed and we should
234 * go back to read array mode.
236 if ((pfl
->status
& 0x08) == 0) {
238 uint64_t timeout
= pflash_erase_time(pfl
);
239 timer_mod(&pfl
->timer
,
240 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
) + timeout
);
241 DPRINTF("%s: erase timeout fired; erasing %d sectors\n",
242 __func__
, pfl
->sectors_to_erase
);
245 DPRINTF("%s: sector erase complete\n", __func__
);
246 bitmap_zero(pfl
->sector_erase_map
, pfl
->total_sectors
);
247 pfl
->sectors_to_erase
= 0;
257 pflash_mode_read_array(pfl
);
262 * Read data from flash.
264 static uint64_t pflash_data_read(PFlashCFI02
*pfl
, hwaddr offset
,
267 uint8_t *p
= (uint8_t *)pfl
->storage
+ offset
;
268 uint64_t ret
= pfl
->be
? ldn_be_p(p
, width
) : ldn_le_p(p
, width
);
269 trace_pflash_data_read(offset
, width
, ret
);
279 * offset should be a byte offset of the QEMU device and _not_ a device
282 static SectorInfo
pflash_sector_info(PFlashCFI02
*pfl
, hwaddr offset
)
284 assert(offset
< pfl
->chip_len
);
286 uint32_t sector_num
= 0;
287 for (int i
= 0; i
< pflash_regions_count(pfl
); ++i
) {
288 uint64_t region_size
= (uint64_t)pfl
->nb_blocs
[i
] * pfl
->sector_len
[i
];
289 if (addr
<= offset
&& offset
< addr
+ region_size
) {
290 return (SectorInfo
) {
291 .len
= pfl
->sector_len
[i
],
292 .num
= sector_num
+ (offset
- addr
) / pfl
->sector_len
[i
],
295 sector_num
+= pfl
->nb_blocs
[i
];
302 * Returns true if the offset refers to a flash sector that is currently being
305 static bool pflash_sector_is_erasing(PFlashCFI02
*pfl
, hwaddr offset
)
307 long sector_num
= pflash_sector_info(pfl
, offset
).num
;
308 return test_bit(sector_num
, pfl
->sector_erase_map
);
311 static uint64_t pflash_read(void *opaque
, hwaddr offset
, unsigned int width
)
313 PFlashCFI02
*pfl
= opaque
;
317 /* Lazy reset to ROMD mode after a certain amount of read accesses */
318 if (!pfl
->rom_mode
&& pfl
->wcycle
== 0 &&
319 ++pfl
->read_counter
> PFLASH_LAZY_ROMD_THRESHOLD
) {
320 pflash_mode_read_array(pfl
);
322 offset
&= pfl
->chip_len
- 1;
323 boff
= offset
& 0xFF;
324 if (pfl
->width
== 2) {
326 } else if (pfl
->width
== 4) {
331 /* This should never happen : reset state & treat it as a read*/
332 DPRINTF("%s: unknown command state: %x\n", __func__
, pfl
->cmd
);
335 /* fall through to the read code */
336 case 0x80: /* Erase (unlock) */
337 /* We accept reads during second unlock sequence... */
339 if (pflash_erase_suspend_mode(pfl
) &&
340 pflash_sector_is_erasing(pfl
, offset
)) {
341 /* Toggle bit 2, but not 6. */
343 /* Status register read */
345 DPRINTF("%s: status %" PRIx64
"\n", __func__
, ret
);
348 /* Flash area read */
349 ret
= pflash_data_read(pfl
, offset
, width
);
351 case 0x90: /* flash ID read */
355 ret
= boff
& 0x01 ? pfl
->ident1
: pfl
->ident0
;
358 ret
= 0x00; /* Pretend all sectors are unprotected */
362 ret
= boff
& 0x01 ? pfl
->ident3
: pfl
->ident2
;
363 if (ret
!= (uint8_t)-1) {
366 /* Fall through to data read. */
368 ret
= pflash_data_read(pfl
, offset
, width
);
370 DPRINTF("%s: ID " TARGET_FMT_plx
" %" PRIx64
"\n", __func__
, boff
, ret
);
372 case 0x10: /* Chip Erase */
373 case 0x30: /* Sector Erase */
374 /* Toggle bit 2 during erase, but not program. */
377 case 0xA0: /* Program */
380 /* Status register read */
382 DPRINTF("%s: status %" PRIx64
"\n", __func__
, ret
);
386 if (boff
< sizeof(pfl
->cfi_table
)) {
387 ret
= pfl
->cfi_table
[boff
];
393 trace_pflash_io_read(offset
, width
, ret
, pfl
->cmd
, pfl
->wcycle
);
398 /* update flash content on disk */
399 static void pflash_update(PFlashCFI02
*pfl
, int offset
, int size
)
404 offset_end
= offset
+ size
;
405 /* widen to sector boundaries */
406 offset
= QEMU_ALIGN_DOWN(offset
, BDRV_SECTOR_SIZE
);
407 offset_end
= QEMU_ALIGN_UP(offset_end
, BDRV_SECTOR_SIZE
);
408 ret
= blk_pwrite(pfl
->blk
, offset
, pfl
->storage
+ offset
,
409 offset_end
- offset
, 0);
411 /* TODO set error bit in status */
412 error_report("Could not update PFLASH: %s", strerror(-ret
));
417 static void pflash_sector_erase(PFlashCFI02
*pfl
, hwaddr offset
)
419 SectorInfo sector_info
= pflash_sector_info(pfl
, offset
);
420 uint64_t sector_len
= sector_info
.len
;
421 offset
&= ~(sector_len
- 1);
422 DPRINTF("%s: start sector erase at %0*" PRIx64
"-%0*" PRIx64
"\n",
423 __func__
, pfl
->width
* 2, offset
,
424 pfl
->width
* 2, offset
+ sector_len
- 1);
426 uint8_t *p
= pfl
->storage
;
427 memset(p
+ offset
, 0xff, sector_len
);
428 pflash_update(pfl
, offset
, sector_len
);
431 ++pfl
->sectors_to_erase
;
432 set_bit(sector_info
.num
, pfl
->sector_erase_map
);
433 /* Set (or reset) the 50 us timer for additional erase commands. */
434 timer_mod(&pfl
->timer
, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
) + 50000);
437 static void pflash_write(void *opaque
, hwaddr offset
, uint64_t value
,
440 PFlashCFI02
*pfl
= opaque
;
445 trace_pflash_io_write(offset
, width
, value
, pfl
->wcycle
);
447 if (pfl
->cmd
!= 0xA0) {
448 /* Reset does nothing during chip erase and sector erase. */
449 if (cmd
== 0xF0 && pfl
->cmd
!= 0x10 && pfl
->cmd
!= 0x30) {
450 if (pfl
->wcycle
== WCYCLE_AUTOSELECT_CFI
) {
451 /* Return to autoselect mode. */
459 offset
&= pfl
->chip_len
- 1;
462 if (pfl
->width
== 2) {
464 } else if (pfl
->width
== 4) {
467 /* Only the least-significant 11 bits are used in most cases. */
469 switch (pfl
->wcycle
) {
471 /* Set the device in I/O access mode if required */
473 pfl
->rom_mode
= false;
474 memory_region_rom_device_set_romd(&pfl
->orig_mem
, false);
476 pfl
->read_counter
= 0;
477 /* We're in read mode */
479 if (boff
== 0x55 && cmd
== 0x98) {
480 /* Enter CFI query mode */
481 pfl
->wcycle
= WCYCLE_CFI
;
485 /* Handle erase resume in erase suspend mode, otherwise reset. */
486 if (cmd
== 0x30) { /* Erase Resume */
487 if (pflash_erase_suspend_mode(pfl
)) {
488 /* Resume the erase. */
489 timer_mod(&pfl
->timer
, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
) +
490 pfl
->erase_time_remaining
);
491 pfl
->erase_time_remaining
= 0;
500 /* Ignore erase suspend. */
501 if (cmd
== 0xB0) { /* Erase Suspend */
504 if (boff
!= pfl
->unlock_addr0
|| cmd
!= 0xAA) {
505 DPRINTF("%s: unlock0 failed " TARGET_FMT_plx
" %02x %04x\n",
506 __func__
, boff
, cmd
, pfl
->unlock_addr0
);
509 DPRINTF("%s: unlock sequence started\n", __func__
);
512 /* We started an unlock sequence */
514 if (boff
!= pfl
->unlock_addr1
|| cmd
!= 0x55) {
515 DPRINTF("%s: unlock1 failed " TARGET_FMT_plx
" %02x\n", __func__
,
519 DPRINTF("%s: unlock sequence done\n", __func__
);
522 /* We finished an unlock sequence */
523 if (!pfl
->bypass
&& boff
!= pfl
->unlock_addr0
) {
524 DPRINTF("%s: command failed " TARGET_FMT_plx
" %02x\n", __func__
,
532 case 0x80: /* Erase */
533 case 0x90: /* Autoselect */
534 case 0xA0: /* Program */
536 DPRINTF("%s: starting command %02x\n", __func__
, cmd
);
539 DPRINTF("%s: unknown command %02x\n", __func__
, cmd
);
545 case 0x80: /* Erase */
546 /* We need another unlock sequence */
548 case 0xA0: /* Program */
549 if (pflash_erase_suspend_mode(pfl
) &&
550 pflash_sector_is_erasing(pfl
, offset
)) {
551 /* Ignore writes to erasing sectors. */
557 trace_pflash_data_write(offset
, width
, value
, 0);
559 p
= (uint8_t *)pfl
->storage
+ offset
;
561 uint64_t current
= ldn_be_p(p
, width
);
562 stn_be_p(p
, width
, current
& value
);
564 uint64_t current
= ldn_le_p(p
, width
);
565 stn_le_p(p
, width
, current
& value
);
567 pflash_update(pfl
, offset
, width
);
570 * While programming, status bit DQ7 should hold the opposite
571 * value from how it was programmed.
573 set_dq7(pfl
, ~value
);
574 /* Let's pretend write is immediate */
578 case 0x90: /* Autoselect */
579 if (pfl
->bypass
&& cmd
== 0x00) {
580 /* Unlock bypass reset */
584 * We can enter CFI query mode from autoselect mode, but we must
585 * return to autoselect mode after a reset.
587 if (boff
== 0x55 && cmd
== 0x98) {
588 /* Enter autoselect CFI query mode */
589 pfl
->wcycle
= WCYCLE_AUTOSELECT_CFI
;
595 DPRINTF("%s: invalid write for command %02x\n",
601 case 0xA0: /* Program */
602 /* Ignore writes while flash data write is occurring */
603 /* As we suppose write is immediate, this should never happen */
605 case 0x80: /* Erase */
608 /* Should never happen */
609 DPRINTF("%s: invalid command state %02x (wc 4)\n",
615 if (pflash_erase_suspend_mode(pfl
)) {
616 /* Erasing is not supported in erase suspend mode. */
620 case 0x10: /* Chip Erase */
621 if (boff
!= pfl
->unlock_addr0
) {
622 DPRINTF("%s: chip erase: invalid address " TARGET_FMT_plx
"\n",
627 DPRINTF("%s: start chip erase\n", __func__
);
629 memset(pfl
->storage
, 0xff, pfl
->chip_len
);
630 pflash_update(pfl
, 0, pfl
->chip_len
);
633 /* Wait the time specified at CFI address 0x22. */
634 timer_mod(&pfl
->timer
, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
) +
635 (1ULL << pfl
->cfi_table
[0x22]) * SCALE_MS
);
637 case 0x30: /* Sector erase */
638 pflash_sector_erase(pfl
, offset
);
641 DPRINTF("%s: invalid command %02x (wc 5)\n", __func__
, cmd
);
648 case 0x10: /* Chip Erase */
649 /* Ignore writes during chip erase */
651 case 0x30: /* Sector erase */
654 * If erase suspend happens during the erase timeout (so DQ3 is
655 * 0), then the device suspends erasing immediately. Set the
656 * remaining time to be the total time to erase. Otherwise,
657 * there is a maximum amount of time it can take to enter
658 * suspend mode. Let's ignore that and suspend immediately and
659 * set the remaining time to the actual time remaining on the
662 if ((pfl
->status
& 0x08) == 0) {
663 pfl
->erase_time_remaining
= pflash_erase_time(pfl
);
665 int64_t delta
= timer_expire_time_ns(&pfl
->timer
) -
666 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
);
667 /* Make sure we have a positive time remaining. */
668 pfl
->erase_time_remaining
= delta
<= 0 ? 1 : delta
;
671 timer_del(&pfl
->timer
);
677 * If DQ3 is 0, additional sector erase commands can be
678 * written and anything else (other than an erase suspend) resets
681 if ((pfl
->status
& 0x08) == 0) {
683 pflash_sector_erase(pfl
, offset
);
688 /* Ignore writes during the actual erase. */
691 /* Should never happen */
692 DPRINTF("%s: invalid command state %02x (wc 6)\n",
697 /* Special values for CFI queries */
699 case WCYCLE_AUTOSELECT_CFI
:
700 DPRINTF("%s: invalid write in CFI query mode\n", __func__
);
703 /* Should never happen */
704 DPRINTF("%s: invalid write state (wc 7)\n", __func__
);
713 trace_pflash_reset();
724 static const MemoryRegionOps pflash_cfi02_ops
= {
726 .write
= pflash_write
,
727 .valid
.min_access_size
= 1,
728 .valid
.max_access_size
= 4,
729 .endianness
= DEVICE_NATIVE_ENDIAN
,
732 static void pflash_cfi02_fill_cfi_table(PFlashCFI02
*pfl
, int nb_regions
)
734 /* Hardcoded CFI table (mostly from SG29 Spansion flash) */
735 const uint16_t pri_ofs
= 0x40;
736 /* Standard "QRY" string */
737 pfl
->cfi_table
[0x10] = 'Q';
738 pfl
->cfi_table
[0x11] = 'R';
739 pfl
->cfi_table
[0x12] = 'Y';
740 /* Command set (AMD/Fujitsu) */
741 pfl
->cfi_table
[0x13] = 0x02;
742 pfl
->cfi_table
[0x14] = 0x00;
743 /* Primary extended table address */
744 pfl
->cfi_table
[0x15] = pri_ofs
;
745 pfl
->cfi_table
[0x16] = pri_ofs
>> 8;
746 /* Alternate command set (none) */
747 pfl
->cfi_table
[0x17] = 0x00;
748 pfl
->cfi_table
[0x18] = 0x00;
749 /* Alternate extended table (none) */
750 pfl
->cfi_table
[0x19] = 0x00;
751 pfl
->cfi_table
[0x1A] = 0x00;
753 pfl
->cfi_table
[0x1B] = 0x27;
755 pfl
->cfi_table
[0x1C] = 0x36;
756 /* Vpp min (no Vpp pin) */
757 pfl
->cfi_table
[0x1D] = 0x00;
758 /* Vpp max (no Vpp pin) */
759 pfl
->cfi_table
[0x1E] = 0x00;
760 /* Timeout per single byte/word write (128 ms) */
761 pfl
->cfi_table
[0x1F] = 0x07;
762 /* Timeout for min size buffer write (NA) */
763 pfl
->cfi_table
[0x20] = 0x00;
764 /* Typical timeout for block erase (512 ms) */
765 pfl
->cfi_table
[0x21] = 0x09;
766 /* Typical timeout for full chip erase (4096 ms) */
767 pfl
->cfi_table
[0x22] = 0x0C;
769 pfl
->cfi_table
[0x23] = 0x01;
770 /* Max timeout for buffer write (NA) */
771 pfl
->cfi_table
[0x24] = 0x00;
772 /* Max timeout for block erase */
773 pfl
->cfi_table
[0x25] = 0x0A;
774 /* Max timeout for chip erase */
775 pfl
->cfi_table
[0x26] = 0x0D;
777 pfl
->cfi_table
[0x27] = ctz32(pfl
->chip_len
);
778 /* Flash device interface (8 & 16 bits) */
779 pfl
->cfi_table
[0x28] = 0x02;
780 pfl
->cfi_table
[0x29] = 0x00;
781 /* Max number of bytes in multi-bytes write */
783 * XXX: disable buffered write as it's not supported
784 * pfl->cfi_table[0x2A] = 0x05;
786 pfl
->cfi_table
[0x2A] = 0x00;
787 pfl
->cfi_table
[0x2B] = 0x00;
788 /* Number of erase block regions */
789 pfl
->cfi_table
[0x2c] = nb_regions
;
790 /* Erase block regions */
791 for (int i
= 0; i
< nb_regions
; ++i
) {
792 uint32_t sector_len_per_device
= pfl
->sector_len
[i
];
793 pfl
->cfi_table
[0x2d + 4 * i
] = pfl
->nb_blocs
[i
] - 1;
794 pfl
->cfi_table
[0x2e + 4 * i
] = (pfl
->nb_blocs
[i
] - 1) >> 8;
795 pfl
->cfi_table
[0x2f + 4 * i
] = sector_len_per_device
>> 8;
796 pfl
->cfi_table
[0x30 + 4 * i
] = sector_len_per_device
>> 16;
798 assert(0x2c + 4 * nb_regions
< pri_ofs
);
801 pfl
->cfi_table
[0x00 + pri_ofs
] = 'P';
802 pfl
->cfi_table
[0x01 + pri_ofs
] = 'R';
803 pfl
->cfi_table
[0x02 + pri_ofs
] = 'I';
805 /* Extended version 1.0 */
806 pfl
->cfi_table
[0x03 + pri_ofs
] = '1';
807 pfl
->cfi_table
[0x04 + pri_ofs
] = '0';
809 /* Address sensitive unlock required. */
810 pfl
->cfi_table
[0x05 + pri_ofs
] = 0x00;
811 /* Erase suspend to read/write. */
812 pfl
->cfi_table
[0x06 + pri_ofs
] = 0x02;
813 /* Sector protect not supported. */
814 pfl
->cfi_table
[0x07 + pri_ofs
] = 0x00;
815 /* Temporary sector unprotect not supported. */
816 pfl
->cfi_table
[0x08 + pri_ofs
] = 0x00;
818 /* Sector protect/unprotect scheme. */
819 pfl
->cfi_table
[0x09 + pri_ofs
] = 0x00;
821 /* Simultaneous operation not supported. */
822 pfl
->cfi_table
[0x0a + pri_ofs
] = 0x00;
823 /* Burst mode not supported. */
824 pfl
->cfi_table
[0x0b + pri_ofs
] = 0x00;
825 /* Page mode not supported. */
826 pfl
->cfi_table
[0x0c + pri_ofs
] = 0x00;
827 assert(0x0c + pri_ofs
< ARRAY_SIZE(pfl
->cfi_table
));
830 static void pflash_cfi02_realize(DeviceState
*dev
, Error
**errp
)
833 PFlashCFI02
*pfl
= PFLASH_CFI02(dev
);
836 if (pfl
->uniform_sector_len
== 0 && pfl
->sector_len
[0] == 0) {
837 error_setg(errp
, "attribute \"sector-length\" not specified or zero.");
840 if (pfl
->uniform_nb_blocs
== 0 && pfl
->nb_blocs
[0] == 0) {
841 error_setg(errp
, "attribute \"num-blocks\" not specified or zero.");
844 if (pfl
->name
== NULL
) {
845 error_setg(errp
, "attribute \"name\" not specified.");
851 pfl
->total_sectors
= 0;
852 for (nb_regions
= 0; nb_regions
< PFLASH_MAX_ERASE_REGIONS
; ++nb_regions
) {
853 if (pfl
->nb_blocs
[nb_regions
] == 0) {
856 pfl
->total_sectors
+= pfl
->nb_blocs
[nb_regions
];
857 uint64_t sector_len_per_device
= pfl
->sector_len
[nb_regions
];
860 * The size of each flash sector must be a power of 2 and it must be
861 * aligned at the same power of 2.
863 if (sector_len_per_device
& 0xff ||
864 sector_len_per_device
>= (1 << 24) ||
865 !is_power_of_2(sector_len_per_device
))
867 error_setg(errp
, "unsupported configuration: "
868 "sector length[%d] per device = %" PRIx64
".",
869 nb_regions
, sector_len_per_device
);
872 if (pfl
->chip_len
& (sector_len_per_device
- 1)) {
873 error_setg(errp
, "unsupported configuration: "
874 "flash region %d not correctly aligned.",
879 pfl
->chip_len
+= (uint64_t)pfl
->sector_len
[nb_regions
] *
880 pfl
->nb_blocs
[nb_regions
];
883 uint64_t uniform_len
= (uint64_t)pfl
->uniform_nb_blocs
*
884 pfl
->uniform_sector_len
;
885 if (nb_regions
== 0) {
887 pfl
->nb_blocs
[0] = pfl
->uniform_nb_blocs
;
888 pfl
->sector_len
[0] = pfl
->uniform_sector_len
;
889 pfl
->chip_len
= uniform_len
;
890 pfl
->total_sectors
= pfl
->uniform_nb_blocs
;
891 } else if (uniform_len
!= 0 && uniform_len
!= pfl
->chip_len
) {
892 error_setg(errp
, "\"num-blocks\"*\"sector-length\" "
893 "different from \"num-blocks0\"*\'sector-length0\" + ... + "
894 "\"num-blocks3\"*\"sector-length3\"");
898 memory_region_init_rom_device(&pfl
->orig_mem
, OBJECT(pfl
),
899 &pflash_cfi02_ops
, pfl
, pfl
->name
,
900 pfl
->chip_len
, errp
);
905 pfl
->storage
= memory_region_get_ram_ptr(&pfl
->orig_mem
);
909 pfl
->ro
= !blk_supports_write_perm(pfl
->blk
);
910 perm
= BLK_PERM_CONSISTENT_READ
| (pfl
->ro
? 0 : BLK_PERM_WRITE
);
911 ret
= blk_set_perm(pfl
->blk
, perm
, BLK_PERM_ALL
, errp
);
920 if (!blk_check_size_and_read_all(pfl
->blk
, pfl
->storage
,
921 pfl
->chip_len
, errp
)) {
922 vmstate_unregister_ram(&pfl
->orig_mem
, DEVICE(pfl
));
927 /* Only 11 bits are used in the comparison. */
928 pfl
->unlock_addr0
&= 0x7FF;
929 pfl
->unlock_addr1
&= 0x7FF;
931 /* Allocate memory for a bitmap for sectors being erased. */
932 pfl
->sector_erase_map
= bitmap_new(pfl
->total_sectors
);
934 pflash_setup_mappings(pfl
);
935 sysbus_init_mmio(SYS_BUS_DEVICE(dev
), &pfl
->mem
);
937 timer_init_ns(&pfl
->timer
, QEMU_CLOCK_VIRTUAL
, pflash_timer
, pfl
);
940 pflash_cfi02_fill_cfi_table(pfl
, nb_regions
);
943 static Property pflash_cfi02_properties
[] = {
944 DEFINE_PROP_DRIVE("drive", PFlashCFI02
, blk
),
945 DEFINE_PROP_UINT32("num-blocks", PFlashCFI02
, uniform_nb_blocs
, 0),
946 DEFINE_PROP_UINT32("sector-length", PFlashCFI02
, uniform_sector_len
, 0),
947 DEFINE_PROP_UINT32("num-blocks0", PFlashCFI02
, nb_blocs
[0], 0),
948 DEFINE_PROP_UINT32("sector-length0", PFlashCFI02
, sector_len
[0], 0),
949 DEFINE_PROP_UINT32("num-blocks1", PFlashCFI02
, nb_blocs
[1], 0),
950 DEFINE_PROP_UINT32("sector-length1", PFlashCFI02
, sector_len
[1], 0),
951 DEFINE_PROP_UINT32("num-blocks2", PFlashCFI02
, nb_blocs
[2], 0),
952 DEFINE_PROP_UINT32("sector-length2", PFlashCFI02
, sector_len
[2], 0),
953 DEFINE_PROP_UINT32("num-blocks3", PFlashCFI02
, nb_blocs
[3], 0),
954 DEFINE_PROP_UINT32("sector-length3", PFlashCFI02
, sector_len
[3], 0),
955 DEFINE_PROP_UINT8("width", PFlashCFI02
, width
, 0),
956 DEFINE_PROP_UINT8("mappings", PFlashCFI02
, mappings
, 0),
957 DEFINE_PROP_UINT8("big-endian", PFlashCFI02
, be
, 0),
958 DEFINE_PROP_UINT16("id0", PFlashCFI02
, ident0
, 0),
959 DEFINE_PROP_UINT16("id1", PFlashCFI02
, ident1
, 0),
960 DEFINE_PROP_UINT16("id2", PFlashCFI02
, ident2
, 0),
961 DEFINE_PROP_UINT16("id3", PFlashCFI02
, ident3
, 0),
962 DEFINE_PROP_UINT16("unlock-addr0", PFlashCFI02
, unlock_addr0
, 0),
963 DEFINE_PROP_UINT16("unlock-addr1", PFlashCFI02
, unlock_addr1
, 0),
964 DEFINE_PROP_STRING("name", PFlashCFI02
, name
),
965 DEFINE_PROP_END_OF_LIST(),
968 static void pflash_cfi02_unrealize(DeviceState
*dev
)
970 PFlashCFI02
*pfl
= PFLASH_CFI02(dev
);
971 timer_del(&pfl
->timer
);
972 g_free(pfl
->sector_erase_map
);
975 static void pflash_cfi02_class_init(ObjectClass
*klass
, void *data
)
977 DeviceClass
*dc
= DEVICE_CLASS(klass
);
979 dc
->realize
= pflash_cfi02_realize
;
980 dc
->unrealize
= pflash_cfi02_unrealize
;
981 device_class_set_props(dc
, pflash_cfi02_properties
);
982 set_bit(DEVICE_CATEGORY_STORAGE
, dc
->categories
);
985 static const TypeInfo pflash_cfi02_info
= {
986 .name
= TYPE_PFLASH_CFI02
,
987 .parent
= TYPE_SYS_BUS_DEVICE
,
988 .instance_size
= sizeof(PFlashCFI02
),
989 .class_init
= pflash_cfi02_class_init
,
992 static void pflash_cfi02_register_types(void)
994 type_register_static(&pflash_cfi02_info
);
997 type_init(pflash_cfi02_register_types
)
999 PFlashCFI02
*pflash_cfi02_register(hwaddr base
,
1003 uint32_t sector_len
,
1004 int nb_mappings
, int width
,
1005 uint16_t id0
, uint16_t id1
,
1006 uint16_t id2
, uint16_t id3
,
1007 uint16_t unlock_addr0
,
1008 uint16_t unlock_addr1
,
1011 DeviceState
*dev
= qdev_new(TYPE_PFLASH_CFI02
);
1014 qdev_prop_set_drive(dev
, "drive", blk
);
1016 assert(QEMU_IS_ALIGNED(size
, sector_len
));
1017 qdev_prop_set_uint32(dev
, "num-blocks", size
/ sector_len
);
1018 qdev_prop_set_uint32(dev
, "sector-length", sector_len
);
1019 qdev_prop_set_uint8(dev
, "width", width
);
1020 qdev_prop_set_uint8(dev
, "mappings", nb_mappings
);
1021 qdev_prop_set_uint8(dev
, "big-endian", !!be
);
1022 qdev_prop_set_uint16(dev
, "id0", id0
);
1023 qdev_prop_set_uint16(dev
, "id1", id1
);
1024 qdev_prop_set_uint16(dev
, "id2", id2
);
1025 qdev_prop_set_uint16(dev
, "id3", id3
);
1026 qdev_prop_set_uint16(dev
, "unlock-addr0", unlock_addr0
);
1027 qdev_prop_set_uint16(dev
, "unlock-addr1", unlock_addr1
);
1028 qdev_prop_set_string(dev
, "name", name
);
1029 sysbus_realize_and_unref(SYS_BUS_DEVICE(dev
), &error_fatal
);
1031 sysbus_mmio_map(SYS_BUS_DEVICE(dev
), 0, base
);
1032 return PFLASH_CFI02(dev
);