1 /*
2 * CFI parallel flash with Intel command set emulation
3 *
4 * Copyright (c) 2006 Thorsten Zitterell
5 * Copyright (c) 2005 Jocelyn Mayer
6 *
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21 /*
22 * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
23 * Supported commands/modes are:
24 * - flash read
25 * - flash write
26 * - flash ID read
27 * - sector erase
28 * - CFI queries
29 *
30 * It does not support timings
31 * It does not support flash interleaving
32 * It does not implement software data protection as found in many real chips
33 * It does not implement erase suspend/resume commands
34 * It does not implement multiple sectors erase
35 *
36 * It does not implement much more ...
37 */
38
39 #include "qemu/osdep.h"
40 #include "hw/block/block.h"
41 #include "hw/block/flash.h"
42 #include "hw/qdev-properties.h"
43 #include "hw/qdev-properties-system.h"
44 #include "sysemu/block-backend.h"
45 #include "qapi/error.h"
46 #include "qemu/error-report.h"
47 #include "qemu/bitops.h"
48 #include "qemu/host-utils.h"
49 #include "qemu/log.h"
50 #include "qemu/module.h"
51 #include "qemu/option.h"
52 #include "hw/sysbus.h"
53 #include "migration/vmstate.h"
54 #include "sysemu/blockdev.h"
55 #include "sysemu/runstate.h"
56 #include "trace.h"
57
58 #define PFLASH_BE 0
59 #define PFLASH_SECURE 1
60
61 struct PFlashCFI01 {
62 /*< private >*/
63 SysBusDevice parent_obj;
64 /*< public >*/
65
66 BlockBackend *blk;
67 uint32_t nb_blocs;
68 uint64_t sector_len;
69 uint8_t bank_width;
70 uint8_t device_width; /* If 0, device width not specified. */
71 uint8_t max_device_width; /* max device width in bytes */
72 uint32_t features;
73 uint8_t wcycle; /* if 0, the flash is read normally */
74 bool ro;
75 uint8_t cmd;
76 uint8_t status;
77 uint16_t ident0;
78 uint16_t ident1;
79 uint16_t ident2;
80 uint16_t ident3;
81 uint8_t cfi_table[0x52];
82 uint64_t counter;
83 uint32_t writeblock_size;
84 MemoryRegion mem;
85 char *name;
86 void *storage;
87 VMChangeStateEntry *vmstate;
88 bool old_multiple_chip_handling;
89
90 /* block update buffer */
91 unsigned char *blk_bytes;
92 uint32_t blk_offset;
93 };
94
95 static int pflash_post_load(void *opaque, int version_id);
96
pflash_blk_write_state_needed(void * opaque)97 static bool pflash_blk_write_state_needed(void *opaque)
98 {
99 PFlashCFI01 *pfl = opaque;
100
101 return (pfl->blk_offset != -1);
102 }
103
104 static const VMStateDescription vmstate_pflash_blk_write = {
105 .name = "pflash_cfi01_blk_write",
106 .version_id = 1,
107 .minimum_version_id = 1,
108 .needed = pflash_blk_write_state_needed,
109 .fields = (const VMStateField[]) {
110 VMSTATE_VBUFFER_UINT32(blk_bytes, PFlashCFI01, 0, NULL, writeblock_size),
111 VMSTATE_UINT32(blk_offset, PFlashCFI01),
112 VMSTATE_END_OF_LIST()
113 }
114 };
115
116 static const VMStateDescription vmstate_pflash = {
117 .name = "pflash_cfi01",
118 .version_id = 1,
119 .minimum_version_id = 1,
120 .post_load = pflash_post_load,
121 .fields = (const VMStateField[]) {
122 VMSTATE_UINT8(wcycle, PFlashCFI01),
123 VMSTATE_UINT8(cmd, PFlashCFI01),
124 VMSTATE_UINT8(status, PFlashCFI01),
125 VMSTATE_UINT64(counter, PFlashCFI01),
126 VMSTATE_END_OF_LIST()
127 },
128 .subsections = (const VMStateDescription * const []) {
129 &vmstate_pflash_blk_write,
130 NULL
131 }
132 };
133
134 /*
135 * Perform a CFI query based on the bank width of the flash.
136 * If this code is called we know we have a device_width set for
137 * this flash.
138 */
pflash_cfi_query(PFlashCFI01 * pfl,hwaddr offset)139 static uint32_t pflash_cfi_query(PFlashCFI01 *pfl, hwaddr offset)
140 {
141 int i;
142 uint32_t resp = 0;
143 hwaddr boff;
144
145 /*
146 * Adjust incoming offset to match expected device-width
147 * addressing. CFI query addresses are always specified in terms of
148 * the maximum supported width of the device. This means that x8
149 * devices and x8/x16 devices in x8 mode behave differently. For
150 * devices that are not used at their max width, we will be
151 * provided with addresses that use higher address bits than
152 * expected (based on the max width), so we will shift them lower
153 * so that they will match the addresses used when
154 * device_width==max_device_width.
155 */
156 boff = offset >> (ctz32(pfl->bank_width) +
157 ctz32(pfl->max_device_width) - ctz32(pfl->device_width));
158
159 if (boff >= sizeof(pfl->cfi_table)) {
160 return 0;
161 }
162 /*
163 * Now we will construct the CFI response generated by a single
164 * device, then replicate that for all devices that make up the
165 * bus. For wide parts used in x8 mode, CFI query responses
166 * are different than native byte-wide parts.
167 */
168 resp = pfl->cfi_table[boff];
169 if (pfl->device_width != pfl->max_device_width) {
170 /* The only case currently supported is x8 mode for a
171 * wider part.
172 */
173 if (pfl->device_width != 1 || pfl->bank_width > 4) {
174 trace_pflash_unsupported_device_configuration(pfl->name,
175 pfl->device_width, pfl->max_device_width);
176 return 0;
177 }
178 /* CFI query data is repeated, rather than zero padded for
179 * wide devices used in x8 mode.
180 */
181 for (i = 1; i < pfl->max_device_width; i++) {
182 resp = deposit32(resp, 8 * i, 8, pfl->cfi_table[boff]);
183 }
184 }
185 /* Replicate responses for each device in bank. */
186 if (pfl->device_width < pfl->bank_width) {
187 for (i = pfl->device_width;
188 i < pfl->bank_width; i += pfl->device_width) {
189 resp = deposit32(resp, 8 * i, 8 * pfl->device_width, resp);
190 }
191 }
192
193 return resp;
194 }
195
196
197
198 /* Perform a device id query based on the bank width of the flash. */
pflash_devid_query(PFlashCFI01 * pfl,hwaddr offset)199 static uint32_t pflash_devid_query(PFlashCFI01 *pfl, hwaddr offset)
200 {
201 int i;
202 uint32_t resp;
203 hwaddr boff;
204
205 /*
206 * Adjust incoming offset to match expected device-width
207 * addressing. Device ID read addresses are always specified in
208 * terms of the maximum supported width of the device. This means
209 * that x8 devices and x8/x16 devices in x8 mode behave
210 * differently. For devices that are not used at their max width,
211 * we will be provided with addresses that use higher address bits
212 * than expected (based on the max width), so we will shift them
213 * lower so that they will match the addresses used when
214 * device_width==max_device_width.
215 */
216 boff = offset >> (ctz32(pfl->bank_width) +
217 ctz32(pfl->max_device_width) - ctz32(pfl->device_width));
218
219 /*
220 * Mask off upper bits which may be used in to query block
221 * or sector lock status at other addresses.
222 * Offsets 2/3 are block lock status, is not emulated.
223 */
224 switch (boff & 0xFF) {
225 case 0:
226 resp = pfl->ident0;
227 trace_pflash_manufacturer_id(pfl->name, resp);
228 break;
229 case 1:
230 resp = pfl->ident1;
231 trace_pflash_device_id(pfl->name, resp);
232 break;
233 default:
234 trace_pflash_device_info(pfl->name, offset);
235 return 0;
236 }
237 /* Replicate responses for each device in bank. */
238 if (pfl->device_width < pfl->bank_width) {
239 for (i = pfl->device_width;
240 i < pfl->bank_width; i += pfl->device_width) {
241 resp = deposit32(resp, 8 * i, 8 * pfl->device_width, resp);
242 }
243 }
244
245 return resp;
246 }
247
pflash_data_read(PFlashCFI01 * pfl,hwaddr offset,int width,int be)248 static uint32_t pflash_data_read(PFlashCFI01 *pfl, hwaddr offset,
249 int width, int be)
250 {
251 uint8_t *p;
252 uint32_t ret;
253
254 p = pfl->storage;
255 if (be) {
256 ret = ldn_be_p(p + offset, width);
257 } else {
258 ret = ldn_le_p(p + offset, width);
259 }
260 trace_pflash_data_read(pfl->name, offset, width, ret);
261 return ret;
262 }
263
pflash_read(PFlashCFI01 * pfl,hwaddr offset,int width,int be)264 static uint32_t pflash_read(PFlashCFI01 *pfl, hwaddr offset,
265 int width, int be)
266 {
267 hwaddr boff;
268 uint32_t ret;
269
270 ret = -1;
271 switch (pfl->cmd) {
272 default:
273 /* This should never happen : reset state & treat it as a read */
274 trace_pflash_read_unknown_state(pfl->name, pfl->cmd);
275 pfl->wcycle = 0;
276 /*
277 * The command 0x00 is not assigned by the CFI open standard,
278 * but QEMU historically uses it for the READ_ARRAY command (0xff).
279 */
280 pfl->cmd = 0x00;
281 /* fall through to read code */
282 case 0x00: /* This model reset value for READ_ARRAY (not CFI compliant) */
283 /* Flash area read */
284 ret = pflash_data_read(pfl, offset, width, be);
285 break;
286 case 0x10: /* Single byte program */
287 case 0x20: /* Block erase */
288 case 0x28: /* Block erase */
289 case 0x40: /* single byte program */
290 case 0x50: /* Clear status register */
291 case 0x60: /* Block /un)lock */
292 case 0x70: /* Status Register */
293 case 0xe8: /* Write block */
294 /*
295 * Status register read. Return status from each device in
296 * bank.
297 */
298 ret = pfl->status;
299 if (pfl->device_width && width > pfl->device_width) {
300 int shift = pfl->device_width * 8;
301 while (shift + pfl->device_width * 8 <= width * 8) {
302 ret |= pfl->status << shift;
303 shift += pfl->device_width * 8;
304 }
305 } else if (!pfl->device_width && width > 2) {
306 /*
307 * Handle 32 bit flash cases where device width is not
308 * set. (Existing behavior before device width added.)
309 */
310 ret |= pfl->status << 16;
311 }
312 trace_pflash_read_status(pfl->name, ret);
313 break;
314 case 0x90:
315 if (!pfl->device_width) {
316 /* Preserve old behavior if device width not specified */
317 boff = offset & 0xFF;
318 if (pfl->bank_width == 2) {
319 boff = boff >> 1;
320 } else if (pfl->bank_width == 4) {
321 boff = boff >> 2;
322 }
323
324 switch (boff) {
325 case 0:
326 ret = pfl->ident0 << 8 | pfl->ident1;
327 trace_pflash_manufacturer_id(pfl->name, ret);
328 break;
329 case 1:
330 ret = pfl->ident2 << 8 | pfl->ident3;
331 trace_pflash_device_id(pfl->name, ret);
332 break;
333 default:
334 trace_pflash_device_info(pfl->name, boff);
335 ret = 0;
336 break;
337 }
338 } else {
339 /*
340 * If we have a read larger than the bank_width, combine multiple
341 * manufacturer/device ID queries into a single response.
342 */
343 int i;
344 for (i = 0; i < width; i += pfl->bank_width) {
345 ret = deposit32(ret, i * 8, pfl->bank_width * 8,
346 pflash_devid_query(pfl,
347 offset + i * pfl->bank_width));
348 }
349 }
350 break;
351 case 0x98: /* Query mode */
352 if (!pfl->device_width) {
353 /* Preserve old behavior if device width not specified */
354 boff = offset & 0xFF;
355 if (pfl->bank_width == 2) {
356 boff = boff >> 1;
357 } else if (pfl->bank_width == 4) {
358 boff = boff >> 2;
359 }
360
361 if (boff < sizeof(pfl->cfi_table)) {
362 ret = pfl->cfi_table[boff];
363 } else {
364 ret = 0;
365 }
366 } else {
367 /*
368 * If we have a read larger than the bank_width, combine multiple
369 * CFI queries into a single response.
370 */
371 int i;
372 for (i = 0; i < width; i += pfl->bank_width) {
373 ret = deposit32(ret, i * 8, pfl->bank_width * 8,
374 pflash_cfi_query(pfl,
375 offset + i * pfl->bank_width));
376 }
377 }
378
379 break;
380 }
381 trace_pflash_io_read(pfl->name, offset, width, ret, pfl->cmd, pfl->wcycle);
382
383 return ret;
384 }
385
386 /* update flash content on disk */
pflash_update(PFlashCFI01 * pfl,int offset,int size)387 static void pflash_update(PFlashCFI01 *pfl, int offset,
388 int size)
389 {
390 int offset_end;
391 int ret;
392 if (pfl->blk) {
393 offset_end = offset + size;
394 /* widen to sector boundaries */
395 offset = QEMU_ALIGN_DOWN(offset, BDRV_SECTOR_SIZE);
396 offset_end = QEMU_ALIGN_UP(offset_end, BDRV_SECTOR_SIZE);
397 ret = blk_pwrite(pfl->blk, offset, offset_end - offset,
398 pfl->storage + offset, 0);
399 if (ret < 0) {
400 /* TODO set error bit in status */
401 error_report("Could not update PFLASH: %s", strerror(-ret));
402 }
403 }
404 }
405
406 /* copy current flash content to block update buffer */
pflash_blk_write_start(PFlashCFI01 * pfl,hwaddr offset)407 static void pflash_blk_write_start(PFlashCFI01 *pfl, hwaddr offset)
408 {
409 hwaddr mask = ~(pfl->writeblock_size - 1);
410
411 trace_pflash_write_block_start(pfl->name, pfl->counter);
412 pfl->blk_offset = offset & mask;
413 memcpy(pfl->blk_bytes, pfl->storage + pfl->blk_offset,
414 pfl->writeblock_size);
415 }
416
417 /* commit block update buffer changes */
pflash_blk_write_flush(PFlashCFI01 * pfl)418 static void pflash_blk_write_flush(PFlashCFI01 *pfl)
419 {
420 g_assert(pfl->blk_offset != -1);
421 trace_pflash_write_block_flush(pfl->name);
422 memcpy(pfl->storage + pfl->blk_offset, pfl->blk_bytes,
423 pfl->writeblock_size);
424 pflash_update(pfl, pfl->blk_offset, pfl->writeblock_size);
425 pfl->blk_offset = -1;
426 }
427
428 /* discard block update buffer changes */
pflash_blk_write_abort(PFlashCFI01 * pfl)429 static void pflash_blk_write_abort(PFlashCFI01 *pfl)
430 {
431 trace_pflash_write_block_abort(pfl->name);
432 pfl->blk_offset = -1;
433 }
434
pflash_data_write(PFlashCFI01 * pfl,hwaddr offset,uint32_t value,int width,int be)435 static inline void pflash_data_write(PFlashCFI01 *pfl, hwaddr offset,
436 uint32_t value, int width, int be)
437 {
438 uint8_t *p;
439
440 if (pfl->blk_offset != -1) {
441 /* block write: redirect writes to block update buffer */
442 if ((offset < pfl->blk_offset) ||
443 (offset + width > pfl->blk_offset + pfl->writeblock_size)) {
444 pfl->status |= 0x10; /* Programming error */
445 return;
446 }
447 trace_pflash_data_write_block(pfl->name, offset, width, value,
448 pfl->counter);
449 p = pfl->blk_bytes + (offset - pfl->blk_offset);
450 } else {
451 /* write directly to storage */
452 trace_pflash_data_write(pfl->name, offset, width, value);
453 p = pfl->storage + offset;
454 }
455
456 if (be) {
457 stn_be_p(p, width, value);
458 } else {
459 stn_le_p(p, width, value);
460 }
461 }
462
pflash_write(PFlashCFI01 * pfl,hwaddr offset,uint32_t value,int width,int be)463 static void pflash_write(PFlashCFI01 *pfl, hwaddr offset,
464 uint32_t value, int width, int be)
465 {
466 uint8_t *p;
467 uint8_t cmd;
468
469 cmd = value;
470
471 trace_pflash_io_write(pfl->name, offset, width, value, pfl->wcycle);
472 if (!pfl->wcycle) {
473 /* Set the device in I/O access mode */
474 memory_region_rom_device_set_romd(&pfl->mem, false);
475 }
476
477 switch (pfl->wcycle) {
478 case 0:
479 /* read mode */
480 switch (cmd) {
481 case 0x00: /* This model reset value for READ_ARRAY (not CFI) */
482 goto mode_read_array;
483 case 0x10: /* Single Byte Program */
484 case 0x40: /* Single Byte Program */
485 trace_pflash_write(pfl->name, "single byte program (0)");
486 break;
487 case 0x20: /* Block erase */
488 p = pfl->storage;
489 offset &= ~(pfl->sector_len - 1);
490
491 trace_pflash_write_block_erase(pfl->name, offset, pfl->sector_len);
492
493 if (!pfl->ro) {
494 memset(p + offset, 0xff, pfl->sector_len);
495 pflash_update(pfl, offset, pfl->sector_len);
496 } else {
497 pfl->status |= 0x20; /* Block erase error */
498 }
499 pfl->status |= 0x80; /* Ready! */
500 break;
501 case 0x50: /* Clear status bits */
502 trace_pflash_write(pfl->name, "clear status bits");
503 pfl->status = 0x0;
504 goto mode_read_array;
505 case 0x60: /* Block (un)lock */
506 trace_pflash_write(pfl->name, "block unlock");
507 break;
508 case 0x70: /* Status Register */
509 trace_pflash_write(pfl->name, "read status register");
510 pfl->cmd = cmd;
511 return;
512 case 0x90: /* Read Device ID */
513 trace_pflash_write(pfl->name, "read device information");
514 pfl->cmd = cmd;
515 return;
516 case 0x98: /* CFI query */
517 trace_pflash_write(pfl->name, "CFI query");
518 break;
519 case 0xe8: /* Write to buffer */
520 trace_pflash_write(pfl->name, "write to buffer");
521 pfl->status |= 0x80; /* Ready! */
522 break;
523 case 0xf0: /* Probe for AMD flash */
524 trace_pflash_write(pfl->name, "probe for AMD flash");
525 goto mode_read_array;
526 case 0xff: /* Read Array */
527 trace_pflash_write(pfl->name, "read array mode");
528 goto mode_read_array;
529 default:
530 goto error_flash;
531 }
532 pfl->wcycle++;
533 pfl->cmd = cmd;
534 break;
535 case 1:
536 switch (pfl->cmd) {
537 case 0x10: /* Single Byte Program */
538 case 0x40: /* Single Byte Program */
539 trace_pflash_write(pfl->name, "single byte program (1)");
540 if (!pfl->ro) {
541 pflash_data_write(pfl, offset, value, width, be);
542 pflash_update(pfl, offset, width);
543 } else {
544 pfl->status |= 0x10; /* Programming error */
545 }
546 pfl->status |= 0x80; /* Ready! */
547 pfl->wcycle = 0;
548 break;
549 case 0x20: /* Block erase */
550 case 0x28:
551 if (cmd == 0xd0) { /* confirm */
552 pfl->wcycle = 0;
553 pfl->status |= 0x80;
554 } else if (cmd == 0xff) { /* Read Array */
555 goto mode_read_array;
556 } else
557 goto error_flash;
558
559 break;
560 case 0xe8:
561 /*
562 * Mask writeblock size based on device width, or bank width if
563 * device width not specified.
564 */
565 /* FIXME check @offset, @width */
566 if (pfl->device_width) {
567 value = extract32(value, 0, pfl->device_width * 8);
568 } else {
569 value = extract32(value, 0, pfl->bank_width * 8);
570 }
571 pfl->counter = value;
572 pfl->wcycle++;
573 break;
574 case 0x60:
575 if (cmd == 0xd0) {
576 pfl->wcycle = 0;
577 pfl->status |= 0x80;
578 } else if (cmd == 0x01) {
579 pfl->wcycle = 0;
580 pfl->status |= 0x80;
581 } else if (cmd == 0xff) { /* Read Array */
582 goto mode_read_array;
583 } else {
584 trace_pflash_write(pfl->name, "unknown (un)locking command");
585 goto mode_read_array;
586 }
587 break;
588 case 0x98:
589 if (cmd == 0xff) { /* Read Array */
590 goto mode_read_array;
591 } else {
592 trace_pflash_write(pfl->name, "leaving query mode");
593 }
594 break;
595 default:
596 goto error_flash;
597 }
598 break;
599 case 2:
600 switch (pfl->cmd) {
601 case 0xe8: /* Block write */
602 /* FIXME check @offset, @width */
603 if (pfl->blk_offset == -1 && pfl->counter) {
604 pflash_blk_write_start(pfl, offset);
605 }
606 if (!pfl->ro && (pfl->blk_offset != -1)) {
607 pflash_data_write(pfl, offset, value, width, be);
608 } else {
609 pfl->status |= 0x10; /* Programming error */
610 }
611
612 pfl->status |= 0x80;
613
614 if (!pfl->counter) {
615 trace_pflash_write(pfl->name, "block write finished");
616 pfl->wcycle++;
617 break;
618 }
619
620 pfl->counter--;
621 break;
622 default:
623 goto error_flash;
624 }
625 break;
626 case 3: /* Confirm mode */
627 switch (pfl->cmd) {
628 case 0xe8: /* Block write */
629 if ((cmd == 0xd0) && !(pfl->status & 0x10)) {
630 pflash_blk_write_flush(pfl);
631 pfl->wcycle = 0;
632 pfl->status |= 0x80;
633 } else {
634 pflash_blk_write_abort(pfl);
635 goto mode_read_array;
636 }
637 break;
638 default:
639 pflash_blk_write_abort(pfl);
640 goto error_flash;
641 }
642 break;
643 default:
644 /* Should never happen */
645 trace_pflash_write(pfl->name, "invalid write state");
646 goto mode_read_array;
647 }
648 return;
649
650 error_flash:
651 qemu_log_mask(LOG_UNIMP, "%s: Unimplemented flash cmd sequence "
652 "(offset " HWADDR_FMT_plx ", wcycle 0x%x cmd 0x%x value 0x%x)"
653 "\n", __func__, offset, pfl->wcycle, pfl->cmd, value);
654
655 mode_read_array:
656 trace_pflash_mode_read_array(pfl->name);
657 memory_region_rom_device_set_romd(&pfl->mem, true);
658 pfl->wcycle = 0;
659 pfl->cmd = 0x00; /* This model reset value for READ_ARRAY (not CFI) */
660 }
661
662
pflash_mem_read_with_attrs(void * opaque,hwaddr addr,uint64_t * value,unsigned len,MemTxAttrs attrs)663 static MemTxResult pflash_mem_read_with_attrs(void *opaque, hwaddr addr, uint64_t *value,
664 unsigned len, MemTxAttrs attrs)
665 {
666 PFlashCFI01 *pfl = opaque;
667 bool be = !!(pfl->features & (1 << PFLASH_BE));
668
669 if ((pfl->features & (1 << PFLASH_SECURE)) && !attrs.secure) {
670 *value = pflash_data_read(opaque, addr, len, be);
671 } else {
672 *value = pflash_read(opaque, addr, len, be);
673 }
674 return MEMTX_OK;
675 }
676
pflash_mem_write_with_attrs(void * opaque,hwaddr addr,uint64_t value,unsigned len,MemTxAttrs attrs)677 static MemTxResult pflash_mem_write_with_attrs(void *opaque, hwaddr addr, uint64_t value,
678 unsigned len, MemTxAttrs attrs)
679 {
680 PFlashCFI01 *pfl = opaque;
681 bool be = !!(pfl->features & (1 << PFLASH_BE));
682
683 if ((pfl->features & (1 << PFLASH_SECURE)) && !attrs.secure) {
684 return MEMTX_ERROR;
685 } else {
686 pflash_write(opaque, addr, value, len, be);
687 return MEMTX_OK;
688 }
689 }
690
691 static const MemoryRegionOps pflash_cfi01_ops = {
692 .read_with_attrs = pflash_mem_read_with_attrs,
693 .write_with_attrs = pflash_mem_write_with_attrs,
694 .endianness = DEVICE_NATIVE_ENDIAN,
695 };
696
pflash_cfi01_fill_cfi_table(PFlashCFI01 * pfl)697 static void pflash_cfi01_fill_cfi_table(PFlashCFI01 *pfl)
698 {
699 uint64_t blocks_per_device, sector_len_per_device, device_len;
700 int num_devices;
701
702 /*
703 * These are only used to expose the parameters of each device
704 * in the cfi_table[].
705 */
706 num_devices = pfl->device_width ? (pfl->bank_width / pfl->device_width) : 1;
707 if (pfl->old_multiple_chip_handling) {
708 blocks_per_device = pfl->nb_blocs / num_devices;
709 sector_len_per_device = pfl->sector_len;
710 } else {
711 blocks_per_device = pfl->nb_blocs;
712 sector_len_per_device = pfl->sector_len / num_devices;
713 }
714 device_len = sector_len_per_device * blocks_per_device;
715
716 /* Hardcoded CFI table */
717 /* Standard "QRY" string */
718 pfl->cfi_table[0x10] = 'Q';
719 pfl->cfi_table[0x11] = 'R';
720 pfl->cfi_table[0x12] = 'Y';
721 /* Command set (Intel) */
722 pfl->cfi_table[0x13] = 0x01;
723 pfl->cfi_table[0x14] = 0x00;
724 /* Primary extended table address (none) */
725 pfl->cfi_table[0x15] = 0x31;
726 pfl->cfi_table[0x16] = 0x00;
727 /* Alternate command set (none) */
728 pfl->cfi_table[0x17] = 0x00;
729 pfl->cfi_table[0x18] = 0x00;
730 /* Alternate extended table (none) */
731 pfl->cfi_table[0x19] = 0x00;
732 pfl->cfi_table[0x1A] = 0x00;
733 /* Vcc min */
734 pfl->cfi_table[0x1B] = 0x45;
735 /* Vcc max */
736 pfl->cfi_table[0x1C] = 0x55;
737 /* Vpp min (no Vpp pin) */
738 pfl->cfi_table[0x1D] = 0x00;
739 /* Vpp max (no Vpp pin) */
740 pfl->cfi_table[0x1E] = 0x00;
741 /* Reserved */
742 pfl->cfi_table[0x1F] = 0x07;
743 /* Timeout for min size buffer write */
744 pfl->cfi_table[0x20] = 0x07;
745 /* Typical timeout for block erase */
746 pfl->cfi_table[0x21] = 0x0a;
747 /* Typical timeout for full chip erase (4096 ms) */
748 pfl->cfi_table[0x22] = 0x00;
749 /* Reserved */
750 pfl->cfi_table[0x23] = 0x04;
751 /* Max timeout for buffer write */
752 pfl->cfi_table[0x24] = 0x04;
753 /* Max timeout for block erase */
754 pfl->cfi_table[0x25] = 0x04;
755 /* Max timeout for chip erase */
756 pfl->cfi_table[0x26] = 0x00;
757 /* Device size */
758 pfl->cfi_table[0x27] = ctz32(device_len); /* + 1; */
759 /* Flash device interface (8 & 16 bits) */
760 pfl->cfi_table[0x28] = 0x02;
761 pfl->cfi_table[0x29] = 0x00;
762 /* Max number of bytes in multi-bytes write */
763 if (pfl->bank_width == 1) {
764 pfl->cfi_table[0x2A] = 0x08;
765 } else {
766 pfl->cfi_table[0x2A] = 0x0B;
767 }
768 pfl->writeblock_size = 1 << pfl->cfi_table[0x2A];
769 if (!pfl->old_multiple_chip_handling && num_devices > 1) {
770 pfl->writeblock_size *= num_devices;
771 }
772
773 pfl->cfi_table[0x2B] = 0x00;
774 /* Number of erase block regions (uniform) */
775 pfl->cfi_table[0x2C] = 0x01;
776 /* Erase block region 1 */
777 pfl->cfi_table[0x2D] = blocks_per_device - 1;
778 pfl->cfi_table[0x2E] = (blocks_per_device - 1) >> 8;
779 pfl->cfi_table[0x2F] = sector_len_per_device >> 8;
780 pfl->cfi_table[0x30] = sector_len_per_device >> 16;
781
782 /* Extended */
783 pfl->cfi_table[0x31] = 'P';
784 pfl->cfi_table[0x32] = 'R';
785 pfl->cfi_table[0x33] = 'I';
786
787 pfl->cfi_table[0x34] = '1';
788 pfl->cfi_table[0x35] = '0';
789
790 pfl->cfi_table[0x36] = 0x00;
791 pfl->cfi_table[0x37] = 0x00;
792 pfl->cfi_table[0x38] = 0x00;
793 pfl->cfi_table[0x39] = 0x00;
794
795 pfl->cfi_table[0x3a] = 0x00;
796
797 pfl->cfi_table[0x3b] = 0x00;
798 pfl->cfi_table[0x3c] = 0x00;
799
800 pfl->cfi_table[0x3f] = 0x01; /* Number of protection fields */
801 }
802
pflash_cfi01_realize(DeviceState * dev,Error ** errp)803 static void pflash_cfi01_realize(DeviceState *dev, Error **errp)
804 {
805 ERRP_GUARD();
806 PFlashCFI01 *pfl = PFLASH_CFI01(dev);
807 uint64_t total_len;
808 int ret;
809
810 if (pfl->sector_len == 0) {
811 error_setg(errp, "attribute \"sector-length\" not specified or zero.");
812 return;
813 }
814 if (pfl->nb_blocs == 0) {
815 error_setg(errp, "attribute \"num-blocks\" not specified or zero.");
816 return;
817 }
818 if (pfl->name == NULL) {
819 error_setg(errp, "attribute \"name\" not specified.");
820 return;
821 }
822
823 total_len = pfl->sector_len * pfl->nb_blocs;
824
825 memory_region_init_rom_device(
826 &pfl->mem, OBJECT(dev),
827 &pflash_cfi01_ops,
828 pfl,
829 pfl->name, total_len, errp);
830 if (*errp) {
831 return;
832 }
833
834 pfl->storage = memory_region_get_ram_ptr(&pfl->mem);
835 sysbus_init_mmio(SYS_BUS_DEVICE(dev), &pfl->mem);
836
837 if (pfl->blk) {
838 uint64_t perm;
839 pfl->ro = !blk_supports_write_perm(pfl->blk);
840 perm = BLK_PERM_CONSISTENT_READ | (pfl->ro ? 0 : BLK_PERM_WRITE);
841 ret = blk_set_perm(pfl->blk, perm, BLK_PERM_ALL, errp);
842 if (ret < 0) {
843 return;
844 }
845 } else {
846 pfl->ro = false;
847 }
848
849 if (pfl->blk) {
850 if (!blk_check_size_and_read_all(pfl->blk, dev, pfl->storage,
851 total_len, errp)) {
852 vmstate_unregister_ram(&pfl->mem, DEVICE(pfl));
853 return;
854 }
855 }
856
857 /*
858 * Default to devices being used at their maximum device width. This was
859 * assumed before the device_width support was added.
860 */
861 if (!pfl->max_device_width) {
862 pfl->max_device_width = pfl->device_width;
863 }
864
865 pfl->wcycle = 0;
866 /*
867 * The command 0x00 is not assigned by the CFI open standard,
868 * but QEMU historically uses it for the READ_ARRAY command (0xff).
869 */
870 pfl->cmd = 0x00;
871 pfl->status = 0x80; /* WSM ready */
872 pflash_cfi01_fill_cfi_table(pfl);
873
874 pfl->blk_bytes = g_malloc(pfl->writeblock_size);
875 pfl->blk_offset = -1;
876 }
877
pflash_cfi01_system_reset(DeviceState * dev)878 static void pflash_cfi01_system_reset(DeviceState *dev)
879 {
880 PFlashCFI01 *pfl = PFLASH_CFI01(dev);
881
882 trace_pflash_reset(pfl->name);
883 /*
884 * The command 0x00 is not assigned by the CFI open standard,
885 * but QEMU historically uses it for the READ_ARRAY command (0xff).
886 */
887 pfl->cmd = 0x00;
888 pfl->wcycle = 0;
889 memory_region_rom_device_set_romd(&pfl->mem, true);
890 /*
891 * The WSM ready timer occurs at most 150ns after system reset.
892 * This model deliberately ignores this delay.
893 */
894 pfl->status = 0x80;
895
896 pfl->blk_offset = -1;
897 }
898
899 static Property pflash_cfi01_properties[] = {
900 DEFINE_PROP_DRIVE("drive", PFlashCFI01, blk),
901 /* num-blocks is the number of blocks actually visible to the guest,
902 * ie the total size of the device divided by the sector length.
903 * If we're emulating flash devices wired in parallel the actual
904 * number of blocks per individual device will differ.
905 */
906 DEFINE_PROP_UINT32("num-blocks", PFlashCFI01, nb_blocs, 0),
907 DEFINE_PROP_UINT64("sector-length", PFlashCFI01, sector_len, 0),
908 /* width here is the overall width of this QEMU device in bytes.
909 * The QEMU device may be emulating a number of flash devices
910 * wired up in parallel; the width of each individual flash
911 * device should be specified via device-width. If the individual
912 * devices have a maximum width which is greater than the width
913 * they are being used for, this maximum width should be set via
914 * max-device-width (which otherwise defaults to device-width).
915 * So for instance a 32-bit wide QEMU flash device made from four
916 * 16-bit flash devices used in 8-bit wide mode would be configured
917 * with width = 4, device-width = 1, max-device-width = 2.
918 *
919 * If device-width is not specified we default to backwards
920 * compatible behaviour which is a bad emulation of two
921 * 16 bit devices making up a 32 bit wide QEMU device. This
922 * is deprecated for new uses of this device.
923 */
924 DEFINE_PROP_UINT8("width", PFlashCFI01, bank_width, 0),
925 DEFINE_PROP_UINT8("device-width", PFlashCFI01, device_width, 0),
926 DEFINE_PROP_UINT8("max-device-width", PFlashCFI01, max_device_width, 0),
927 DEFINE_PROP_BIT("big-endian", PFlashCFI01, features, PFLASH_BE, 0),
928 DEFINE_PROP_BIT("secure", PFlashCFI01, features, PFLASH_SECURE, 0),
929 DEFINE_PROP_UINT16("id0", PFlashCFI01, ident0, 0),
930 DEFINE_PROP_UINT16("id1", PFlashCFI01, ident1, 0),
931 DEFINE_PROP_UINT16("id2", PFlashCFI01, ident2, 0),
932 DEFINE_PROP_UINT16("id3", PFlashCFI01, ident3, 0),
933 DEFINE_PROP_STRING("name", PFlashCFI01, name),
934 DEFINE_PROP_BOOL("old-multiple-chip-handling", PFlashCFI01,
935 old_multiple_chip_handling, false),
936 DEFINE_PROP_END_OF_LIST(),
937 };
938
pflash_cfi01_class_init(ObjectClass * klass,void * data)939 static void pflash_cfi01_class_init(ObjectClass *klass, void *data)
940 {
941 DeviceClass *dc = DEVICE_CLASS(klass);
942
943 dc->reset = pflash_cfi01_system_reset;
944 dc->realize = pflash_cfi01_realize;
945 device_class_set_props(dc, pflash_cfi01_properties);
946 dc->vmsd = &vmstate_pflash;
947 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
948 }
949
950
951 static const TypeInfo pflash_cfi01_info = {
952 .name = TYPE_PFLASH_CFI01,
953 .parent = TYPE_SYS_BUS_DEVICE,
954 .instance_size = sizeof(PFlashCFI01),
955 .class_init = pflash_cfi01_class_init,
956 };
957
pflash_cfi01_register_types(void)958 static void pflash_cfi01_register_types(void)
959 {
960 type_register_static(&pflash_cfi01_info);
961 }
962
type_init(pflash_cfi01_register_types)963 type_init(pflash_cfi01_register_types)
964
965 PFlashCFI01 *pflash_cfi01_register(hwaddr base,
966 const char *name,
967 hwaddr size,
968 BlockBackend *blk,
969 uint32_t sector_len,
970 int bank_width,
971 uint16_t id0, uint16_t id1,
972 uint16_t id2, uint16_t id3,
973 int be)
974 {
975 DeviceState *dev = qdev_new(TYPE_PFLASH_CFI01);
976
977 if (blk) {
978 qdev_prop_set_drive(dev, "drive", blk);
979 }
980 assert(QEMU_IS_ALIGNED(size, sector_len));
981 qdev_prop_set_uint32(dev, "num-blocks", size / sector_len);
982 qdev_prop_set_uint64(dev, "sector-length", sector_len);
983 qdev_prop_set_uint8(dev, "width", bank_width);
984 qdev_prop_set_bit(dev, "big-endian", !!be);
985 qdev_prop_set_uint16(dev, "id0", id0);
986 qdev_prop_set_uint16(dev, "id1", id1);
987 qdev_prop_set_uint16(dev, "id2", id2);
988 qdev_prop_set_uint16(dev, "id3", id3);
989 qdev_prop_set_string(dev, "name", name);
990 sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
991
992 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
993 return PFLASH_CFI01(dev);
994 }
995
pflash_cfi01_get_blk(PFlashCFI01 * fl)996 BlockBackend *pflash_cfi01_get_blk(PFlashCFI01 *fl)
997 {
998 return fl->blk;
999 }
1000
pflash_cfi01_get_memory(PFlashCFI01 * fl)1001 MemoryRegion *pflash_cfi01_get_memory(PFlashCFI01 *fl)
1002 {
1003 return &fl->mem;
1004 }
1005
1006 /*
1007 * Handle -drive if=pflash for machines that use properties.
1008 * If @dinfo is null, do nothing.
1009 * Else if @fl's property "drive" is already set, fatal error.
1010 * Else set it to the BlockBackend with @dinfo.
1011 */
pflash_cfi01_legacy_drive(PFlashCFI01 * fl,DriveInfo * dinfo)1012 void pflash_cfi01_legacy_drive(PFlashCFI01 *fl, DriveInfo *dinfo)
1013 {
1014 Location loc;
1015
1016 if (!dinfo) {
1017 return;
1018 }
1019
1020 loc_push_none(&loc);
1021 qemu_opts_loc_restore(dinfo->opts);
1022 if (fl->blk) {
1023 error_report("clashes with -machine");
1024 exit(1);
1025 }
1026 qdev_prop_set_drive_err(DEVICE(fl), "drive", blk_by_legacy_dinfo(dinfo),
1027 &error_fatal);
1028 loc_pop(&loc);
1029 }
1030
postload_update_cb(void * opaque,bool running,RunState state)1031 static void postload_update_cb(void *opaque, bool running, RunState state)
1032 {
1033 PFlashCFI01 *pfl = opaque;
1034
1035 /* This is called after bdrv_activate_all. */
1036 qemu_del_vm_change_state_handler(pfl->vmstate);
1037 pfl->vmstate = NULL;
1038
1039 trace_pflash_postload_cb(pfl->name);
1040 pflash_update(pfl, 0, pfl->sector_len * pfl->nb_blocs);
1041 }
1042
pflash_post_load(void * opaque,int version_id)1043 static int pflash_post_load(void *opaque, int version_id)
1044 {
1045 PFlashCFI01 *pfl = opaque;
1046
1047 if (!pfl->ro) {
1048 pfl->vmstate = qemu_add_vm_change_state_handler(postload_update_cb,
1049 pfl);
1050 }
1051 return 0;
1052 }
1053