xref: /openbmc/qemu/hw/block/m25p80.c (revision afb81fe8)
1 /*
2  * ST M25P80 emulator. Emulate all SPI flash devices based on the m25p80 command
3  * set. Known devices table current as of Jun/2012 and taken from linux.
4  * See drivers/mtd/devices/m25p80.c.
5  *
6  * Copyright (C) 2011 Edgar E. Iglesias <edgar.iglesias@gmail.com>
7  * Copyright (C) 2012 Peter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>
8  * Copyright (C) 2012 PetaLogix
9  *
10  * This program is free software; you can redistribute it and/or
11  * modify it under the terms of the GNU General Public License as
12  * published by the Free Software Foundation; either version 2 or
13  * (at your option) a later version of the License.
14  *
15  * This program is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18  * GNU General Public License for more details.
19  *
20  * You should have received a copy of the GNU General Public License along
21  * with this program; if not, see <http://www.gnu.org/licenses/>.
22  */
23 
24 #include "qemu/osdep.h"
25 #include "qemu/units.h"
26 #include "sysemu/block-backend.h"
27 #include "hw/block/block.h"
28 #include "hw/block/flash.h"
29 #include "hw/qdev-properties.h"
30 #include "hw/qdev-properties-system.h"
31 #include "hw/ssi/ssi.h"
32 #include "migration/vmstate.h"
33 #include "qemu/bitops.h"
34 #include "qemu/log.h"
35 #include "qemu/module.h"
36 #include "qemu/error-report.h"
37 #include "qapi/error.h"
38 #include "trace.h"
39 #include "qom/object.h"
40 #include "m25p80_sfdp.h"
41 
42 /* 16 MiB max in 3 byte address mode */
43 #define MAX_3BYTES_SIZE 0x1000000
44 #define SPI_NOR_MAX_ID_LEN 6
45 
46 /* Fields for FlashPartInfo->flags */
47 enum spi_flash_option_flags {
48     ER_4K                  = BIT(0),
49     ER_32K                 = BIT(1),
50     EEPROM                 = BIT(2),
51     HAS_SR_TB              = BIT(3),
52     HAS_SR_BP3_BIT6        = BIT(4),
53 };
54 
55 typedef struct FlashPartInfo {
56     const char *part_name;
57     /*
58      * This array stores the ID bytes.
59      * The first three bytes are the JEDIC ID.
60      * JEDEC ID zero means "no ID" (mostly older chips).
61      */
62     uint8_t id[SPI_NOR_MAX_ID_LEN];
63     uint8_t id_len;
64     /* there is confusion between manufacturers as to what a sector is. In this
65      * device model, a "sector" is the size that is erased by the ERASE_SECTOR
66      * command (opcode 0xd8).
67      */
68     uint32_t sector_size;
69     uint32_t n_sectors;
70     uint32_t page_size;
71     uint16_t flags;
72     /*
73      * Big sized spi nor are often stacked devices, thus sometime
74      * replace chip erase with die erase.
75      * This field inform how many die is in the chip.
76      */
77     uint8_t die_cnt;
78     uint8_t (*sfdp_read)(uint32_t sfdp_addr);
79 } FlashPartInfo;
80 
81 /* adapted from linux */
82 /* Used when the "_ext_id" is two bytes at most */
83 #define INFO(_part_name, _jedec_id, _ext_id, _sector_size, _n_sectors, _flags)\
84     .part_name = _part_name,\
85     .id = {\
86         ((_jedec_id) >> 16) & 0xff,\
87         ((_jedec_id) >> 8) & 0xff,\
88         (_jedec_id) & 0xff,\
89         ((_ext_id) >> 8) & 0xff,\
90         (_ext_id) & 0xff,\
91           },\
92     .id_len = (!(_jedec_id) ? 0 : (3 + ((_ext_id) ? 2 : 0))),\
93     .sector_size = (_sector_size),\
94     .n_sectors = (_n_sectors),\
95     .page_size = 256,\
96     .flags = (_flags),\
97     .die_cnt = 0
98 
99 #define INFO6(_part_name, _jedec_id, _ext_id, _sector_size, _n_sectors, _flags)\
100     .part_name = _part_name,\
101     .id = {\
102         ((_jedec_id) >> 16) & 0xff,\
103         ((_jedec_id) >> 8) & 0xff,\
104         (_jedec_id) & 0xff,\
105         ((_ext_id) >> 16) & 0xff,\
106         ((_ext_id) >> 8) & 0xff,\
107         (_ext_id) & 0xff,\
108           },\
109     .id_len = 6,\
110     .sector_size = (_sector_size),\
111     .n_sectors = (_n_sectors),\
112     .page_size = 256,\
113     .flags = (_flags),\
114     .die_cnt = 0
115 
116 #define INFO_STACKED(_part_name, _jedec_id, _ext_id, _sector_size, _n_sectors,\
117                     _flags, _die_cnt)\
118     .part_name = _part_name,\
119     .id = {\
120         ((_jedec_id) >> 16) & 0xff,\
121         ((_jedec_id) >> 8) & 0xff,\
122         (_jedec_id) & 0xff,\
123         ((_ext_id) >> 8) & 0xff,\
124         (_ext_id) & 0xff,\
125           },\
126     .id_len = (!(_jedec_id) ? 0 : (3 + ((_ext_id) ? 2 : 0))),\
127     .sector_size = (_sector_size),\
128     .n_sectors = (_n_sectors),\
129     .page_size = 256,\
130     .flags = (_flags),\
131     .die_cnt = _die_cnt
132 
133 #define JEDEC_NUMONYX 0x20
134 #define JEDEC_WINBOND 0xEF
135 #define JEDEC_SPANSION 0x01
136 
137 /* Numonyx (Micron) Configuration register macros */
138 #define VCFG_DUMMY 0x1
139 #define VCFG_WRAP_SEQUENTIAL 0x2
140 #define NVCFG_XIP_MODE_DISABLED (7 << 9)
141 #define NVCFG_XIP_MODE_MASK (7 << 9)
142 #define VCFG_XIP_MODE_DISABLED (1 << 3)
143 #define CFG_DUMMY_CLK_LEN 4
144 #define NVCFG_DUMMY_CLK_POS 12
145 #define VCFG_DUMMY_CLK_POS 4
146 #define EVCFG_OUT_DRIVER_STRENGTH_DEF 7
147 #define EVCFG_VPP_ACCELERATOR (1 << 3)
148 #define EVCFG_RESET_HOLD_ENABLED (1 << 4)
149 #define NVCFG_DUAL_IO_MASK (1 << 2)
150 #define EVCFG_DUAL_IO_DISABLED (1 << 6)
151 #define NVCFG_QUAD_IO_MASK (1 << 3)
152 #define EVCFG_QUAD_IO_DISABLED (1 << 7)
153 #define NVCFG_4BYTE_ADDR_MASK (1 << 0)
154 #define NVCFG_LOWER_SEGMENT_MASK (1 << 1)
155 
156 /* Numonyx (Micron) Flag Status Register macros */
157 #define FSR_4BYTE_ADDR_MODE_ENABLED 0x1
158 #define FSR_FLASH_READY (1 << 7)
159 
160 /* Spansion configuration registers macros. */
161 #define SPANSION_QUAD_CFG_POS 0
162 #define SPANSION_QUAD_CFG_LEN 1
163 #define SPANSION_DUMMY_CLK_POS 0
164 #define SPANSION_DUMMY_CLK_LEN 4
165 #define SPANSION_ADDR_LEN_POS 7
166 #define SPANSION_ADDR_LEN_LEN 1
167 
168 /*
169  * Spansion read mode command length in bytes,
170  * the mode is currently not supported.
171 */
172 
173 #define SPANSION_CONTINUOUS_READ_MODE_CMD_LEN 1
174 #define WINBOND_CONTINUOUS_READ_MODE_CMD_LEN 1
175 
176 static const FlashPartInfo known_devices[] = {
177     /* Atmel -- some are (confusingly) marketed as "DataFlash" */
178     { INFO("at25fs010",   0x1f6601,      0,  32 << 10,   4, ER_4K) },
179     { INFO("at25fs040",   0x1f6604,      0,  64 << 10,   8, ER_4K) },
180 
181     { INFO("at25df041a",  0x1f4401,      0,  64 << 10,   8, ER_4K) },
182     { INFO("at25df321a",  0x1f4701,      0,  64 << 10,  64, ER_4K) },
183     { INFO("at25df641",   0x1f4800,      0,  64 << 10, 128, ER_4K) },
184 
185     { INFO("at26f004",    0x1f0400,      0,  64 << 10,   8, ER_4K) },
186     { INFO("at26df081a",  0x1f4501,      0,  64 << 10,  16, ER_4K) },
187     { INFO("at26df161a",  0x1f4601,      0,  64 << 10,  32, ER_4K) },
188     { INFO("at26df321",   0x1f4700,      0,  64 << 10,  64, ER_4K) },
189 
190     { INFO("at45db081d",  0x1f2500,      0,  64 << 10,  16, ER_4K) },
191 
192     /* Atmel EEPROMS - it is assumed, that don't care bit in command
193      * is set to 0. Block protection is not supported.
194      */
195     { INFO("at25128a-nonjedec", 0x0,     0,         1, 131072, EEPROM) },
196     { INFO("at25256a-nonjedec", 0x0,     0,         1, 262144, EEPROM) },
197 
198     /* EON -- en25xxx */
199     { INFO("en25f32",     0x1c3116,      0,  64 << 10,  64, ER_4K) },
200     { INFO("en25p32",     0x1c2016,      0,  64 << 10,  64, 0) },
201     { INFO("en25q32b",    0x1c3016,      0,  64 << 10,  64, 0) },
202     { INFO("en25p64",     0x1c2017,      0,  64 << 10, 128, 0) },
203     { INFO("en25q64",     0x1c3017,      0,  64 << 10, 128, ER_4K) },
204 
205     /* GigaDevice */
206     { INFO("gd25q32",     0xc84016,      0,  64 << 10,  64, ER_4K) },
207     { INFO("gd25q64",     0xc84017,      0,  64 << 10, 128, ER_4K) },
208 
209     /* Intel/Numonyx -- xxxs33b */
210     { INFO("160s33b",     0x898911,      0,  64 << 10,  32, 0) },
211     { INFO("320s33b",     0x898912,      0,  64 << 10,  64, 0) },
212     { INFO("640s33b",     0x898913,      0,  64 << 10, 128, 0) },
213     { INFO("n25q064",     0x20ba17,      0,  64 << 10, 128, 0) },
214 
215     /* ISSI */
216     { INFO("is25lq040b",  0x9d4013,      0,  64 << 10,   8, ER_4K) },
217     { INFO("is25lp080d",  0x9d6014,      0,  64 << 10,  16, ER_4K) },
218     { INFO("is25lp016d",  0x9d6015,      0,  64 << 10,  32, ER_4K) },
219     { INFO("is25lp032",   0x9d6016,      0,  64 << 10,  64, ER_4K) },
220     { INFO("is25lp064",   0x9d6017,      0,  64 << 10, 128, ER_4K) },
221     { INFO("is25lp128",   0x9d6018,      0,  64 << 10, 256, ER_4K) },
222     { INFO("is25lp256",   0x9d6019,      0,  64 << 10, 512, ER_4K) },
223     { INFO("is25wp032",   0x9d7016,      0,  64 << 10,  64, ER_4K) },
224     { INFO("is25wp064",   0x9d7017,      0,  64 << 10, 128, ER_4K) },
225     { INFO("is25wp128",   0x9d7018,      0,  64 << 10, 256, ER_4K) },
226     { INFO("is25wp256",   0x9d7019,      0,  64 << 10, 512, ER_4K),
227       .sfdp_read = m25p80_sfdp_is25wp256 },
228 
229     /* Macronix */
230     { INFO("mx25l2005a",  0xc22012,      0,  64 << 10,   4, ER_4K) },
231     { INFO("mx25l4005a",  0xc22013,      0,  64 << 10,   8, ER_4K) },
232     { INFO("mx25l8005",   0xc22014,      0,  64 << 10,  16, 0) },
233     { INFO("mx25l1606e",  0xc22015,      0,  64 << 10,  32, ER_4K) },
234     { INFO("mx25l3205d",  0xc22016,      0,  64 << 10,  64, 0) },
235     { INFO("mx25l6405d",  0xc22017,      0,  64 << 10, 128, 0) },
236     { INFO("mx25l12805d", 0xc22018,      0,  64 << 10, 256, 0) },
237     { INFO("mx25l12855e", 0xc22618,      0,  64 << 10, 256, 0) },
238     { INFO6("mx25l25635e", 0xc22019,     0xc22019,  64 << 10, 512,
239             ER_4K | ER_32K), .sfdp_read = m25p80_sfdp_mx25l25635e },
240     { INFO6("mx25l25635f", 0xc22019,     0xc22019,  64 << 10, 512,
241             ER_4K | ER_32K), .sfdp_read = m25p80_sfdp_mx25l25635f },
242     { INFO("mx25l25655e", 0xc22619,      0,  64 << 10, 512, 0) },
243     { INFO("mx66l51235f", 0xc2201a,      0,  64 << 10, 1024, ER_4K | ER_32K) },
244     { INFO("mx66u51235f", 0xc2253a,      0,  64 << 10, 1024, ER_4K | ER_32K) },
245     { INFO("mx66u1g45g",  0xc2253b,      0,  64 << 10, 2048, ER_4K | ER_32K) },
246     { INFO("mx66l1g45g",  0xc2201b,      0,  64 << 10, 2048, ER_4K | ER_32K),
247       .sfdp_read = m25p80_sfdp_mx66l1g45g },
248 
249     /* Micron */
250     { INFO("n25q032a11",  0x20bb16,      0,  64 << 10,  64, ER_4K) },
251     { INFO("n25q032a13",  0x20ba16,      0,  64 << 10,  64, ER_4K) },
252     { INFO("n25q064a11",  0x20bb17,      0,  64 << 10, 128, ER_4K) },
253     { INFO("n25q064a13",  0x20ba17,      0,  64 << 10, 128, ER_4K) },
254     { INFO("n25q128a11",  0x20bb18,      0,  64 << 10, 256, ER_4K) },
255     { INFO("n25q128a13",  0x20ba18,      0,  64 << 10, 256, ER_4K) },
256     { INFO("n25q256a11",  0x20bb19,      0,  64 << 10, 512, ER_4K) },
257     { INFO("n25q256a13",  0x20ba19,      0,  64 << 10, 512, ER_4K),
258       .sfdp_read = m25p80_sfdp_n25q256a },
259     { INFO("n25q512a11",  0x20bb20,      0,  64 << 10, 1024, ER_4K) },
260     { INFO("n25q512a13",  0x20ba20,      0,  64 << 10, 1024, ER_4K) },
261     { INFO("n25q128",     0x20ba18,      0,  64 << 10, 256, 0) },
262     { INFO("n25q256a",    0x20ba19,      0,  64 << 10, 512,
263            ER_4K | HAS_SR_BP3_BIT6 | HAS_SR_TB),
264       .sfdp_read = m25p80_sfdp_n25q256a },
265    { INFO("n25q512a",    0x20ba20,      0,  64 << 10, 1024, ER_4K) },
266     { INFO("n25q512ax3",  0x20ba20,  0x1000,  64 << 10, 1024, ER_4K) },
267     { INFO("mt25ql512ab", 0x20ba20, 0x1044, 64 << 10, 1024, ER_4K | ER_32K) },
268     { INFO_STACKED("mt35xu01g", 0x2c5b1b, 0x104100, 128 << 10, 1024,
269                    ER_4K | ER_32K, 2) },
270     { INFO_STACKED("n25q00",    0x20ba21, 0x1000, 64 << 10, 2048, ER_4K, 4) },
271     { INFO_STACKED("n25q00a",   0x20bb21, 0x1000, 64 << 10, 2048, ER_4K, 4) },
272     { INFO_STACKED("mt25ql01g", 0x20ba21, 0x1040, 64 << 10, 2048, ER_4K, 2) },
273     { INFO_STACKED("mt25qu01g", 0x20bb21, 0x1040, 64 << 10, 2048, ER_4K, 2) },
274     { INFO_STACKED("mt25ql02g", 0x20ba22, 0x1040, 64 << 10, 4096, ER_4K | ER_32K, 2) },
275     { INFO_STACKED("mt25qu02g", 0x20bb22, 0x1040, 64 << 10, 4096, ER_4K | ER_32K, 2) },
276 
277     /* Spansion -- single (large) sector size only, at least
278      * for the chips listed here (without boot sectors).
279      */
280     { INFO("s25sl032p",   0x010215, 0x4d00,  64 << 10,  64, ER_4K) },
281     { INFO("s25sl064p",   0x010216, 0x4d00,  64 << 10, 128, ER_4K) },
282     { INFO("s25fl256s0",  0x010219, 0x4d00, 256 << 10, 128, 0) },
283     { INFO("s25fl256s1",  0x010219, 0x4d01,  64 << 10, 512, 0) },
284     { INFO6("s25fl512s",  0x010220, 0x4d0080, 256 << 10, 256, 0) },
285     { INFO6("s70fl01gs",  0x010221, 0x4d0080, 256 << 10, 512, 0) },
286     { INFO("s25sl12800",  0x012018, 0x0300, 256 << 10,  64, 0) },
287     { INFO("s25sl12801",  0x012018, 0x0301,  64 << 10, 256, 0) },
288     { INFO("s25fl129p0",  0x012018, 0x4d00, 256 << 10,  64, 0) },
289     { INFO("s25fl129p1",  0x012018, 0x4d01,  64 << 10, 256, 0) },
290     { INFO("s25sl004a",   0x010212,      0,  64 << 10,   8, 0) },
291     { INFO("s25sl008a",   0x010213,      0,  64 << 10,  16, 0) },
292     { INFO("s25sl016a",   0x010214,      0,  64 << 10,  32, 0) },
293     { INFO("s25sl032a",   0x010215,      0,  64 << 10,  64, 0) },
294     { INFO("s25sl064a",   0x010216,      0,  64 << 10, 128, 0) },
295     { INFO("s25fl016k",   0xef4015,      0,  64 << 10,  32, ER_4K | ER_32K) },
296     { INFO("s25fl064k",   0xef4017,      0,  64 << 10, 128, ER_4K | ER_32K) },
297 
298     /* Spansion --  boot sectors support  */
299     { INFO6("s25fs512s",    0x010220, 0x4d0081, 256 << 10, 256, 0) },
300     { INFO6("s70fs01gs",    0x010221, 0x4d0081, 256 << 10, 512, 0) },
301 
302     /* SST -- large erase sizes are "overlays", "sectors" are 4<< 10 */
303     { INFO("sst25vf040b", 0xbf258d,      0,  64 << 10,   8, ER_4K) },
304     { INFO("sst25vf080b", 0xbf258e,      0,  64 << 10,  16, ER_4K) },
305     { INFO("sst25vf016b", 0xbf2541,      0,  64 << 10,  32, ER_4K) },
306     { INFO("sst25vf032b", 0xbf254a,      0,  64 << 10,  64, ER_4K) },
307     { INFO("sst25wf512",  0xbf2501,      0,  64 << 10,   1, ER_4K) },
308     { INFO("sst25wf010",  0xbf2502,      0,  64 << 10,   2, ER_4K) },
309     { INFO("sst25wf020",  0xbf2503,      0,  64 << 10,   4, ER_4K) },
310     { INFO("sst25wf040",  0xbf2504,      0,  64 << 10,   8, ER_4K) },
311     { INFO("sst25wf080",  0xbf2505,      0,  64 << 10,  16, ER_4K) },
312 
313     /* ST Microelectronics -- newer production may have feature updates */
314     { INFO("m25p05",      0x202010,      0,  32 << 10,   2, 0) },
315     { INFO("m25p10",      0x202011,      0,  32 << 10,   4, 0) },
316     { INFO("m25p20",      0x202012,      0,  64 << 10,   4, 0) },
317     { INFO("m25p40",      0x202013,      0,  64 << 10,   8, 0) },
318     { INFO("m25p80",      0x202014,      0,  64 << 10,  16, 0) },
319     { INFO("m25p16",      0x202015,      0,  64 << 10,  32, 0) },
320     { INFO("m25p32",      0x202016,      0,  64 << 10,  64, 0) },
321     { INFO("m25p64",      0x202017,      0,  64 << 10, 128, 0) },
322     { INFO("m25p128",     0x202018,      0, 256 << 10,  64, 0) },
323     { INFO("n25q032",     0x20ba16,      0,  64 << 10,  64, 0) },
324 
325     { INFO("m45pe10",     0x204011,      0,  64 << 10,   2, 0) },
326     { INFO("m45pe80",     0x204014,      0,  64 << 10,  16, 0) },
327     { INFO("m45pe16",     0x204015,      0,  64 << 10,  32, 0) },
328 
329     { INFO("m25pe20",     0x208012,      0,  64 << 10,   4, 0) },
330     { INFO("m25pe80",     0x208014,      0,  64 << 10,  16, 0) },
331     { INFO("m25pe16",     0x208015,      0,  64 << 10,  32, ER_4K) },
332 
333     { INFO("m25px32",     0x207116,      0,  64 << 10,  64, ER_4K) },
334     { INFO("m25px32-s0",  0x207316,      0,  64 << 10,  64, ER_4K) },
335     { INFO("m25px32-s1",  0x206316,      0,  64 << 10,  64, ER_4K) },
336     { INFO("m25px64",     0x207117,      0,  64 << 10, 128, 0) },
337 
338     /* Winbond -- w25x "blocks" are 64k, "sectors" are 4KiB */
339     { INFO("w25x10",      0xef3011,      0,  64 << 10,   2, ER_4K) },
340     { INFO("w25x20",      0xef3012,      0,  64 << 10,   4, ER_4K) },
341     { INFO("w25x40",      0xef3013,      0,  64 << 10,   8, ER_4K) },
342     { INFO("w25x80",      0xef3014,      0,  64 << 10,  16, ER_4K) },
343     { INFO("w25x16",      0xef3015,      0,  64 << 10,  32, ER_4K) },
344     { INFO("w25x32",      0xef3016,      0,  64 << 10,  64, ER_4K) },
345     { INFO("w25q32",      0xef4016,      0,  64 << 10,  64, ER_4K) },
346     { INFO("w25q32dw",    0xef6016,      0,  64 << 10,  64, ER_4K) },
347     { INFO("w25x64",      0xef3017,      0,  64 << 10, 128, ER_4K) },
348     { INFO("w25q64",      0xef4017,      0,  64 << 10, 128, ER_4K) },
349     { INFO("w25q80",      0xef5014,      0,  64 << 10,  16, ER_4K) },
350     { INFO("w25q80bl",    0xef4014,      0,  64 << 10,  16, ER_4K) },
351     { INFO("w25q256",     0xef4019,      0,  64 << 10, 512, ER_4K),
352       .sfdp_read = m25p80_sfdp_w25q256 },
353     { INFO("w25q512jv",   0xef4020,      0,  64 << 10, 1024, ER_4K),
354       .sfdp_read = m25p80_sfdp_w25q512jv },
355     { INFO("w25q01jvq",   0xef4021,      0,  64 << 10, 2048, ER_4K),
356       .sfdp_read = m25p80_sfdp_w25q01jvq },
357 };
358 
359 typedef enum {
360     NOP = 0,
361     WRSR = 0x1,
362     WRDI = 0x4,
363     RDSR = 0x5,
364     WREN = 0x6,
365     BRRD = 0x16,
366     BRWR = 0x17,
367     JEDEC_READ = 0x9f,
368     BULK_ERASE_60 = 0x60,
369     BULK_ERASE = 0xc7,
370     READ_FSR = 0x70,
371     RDCR = 0x15,
372     RDSFDP = 0x5a,
373 
374     READ = 0x03,
375     READ4 = 0x13,
376     FAST_READ = 0x0b,
377     FAST_READ4 = 0x0c,
378     DOR = 0x3b,
379     DOR4 = 0x3c,
380     QOR = 0x6b,
381     QOR4 = 0x6c,
382     DIOR = 0xbb,
383     DIOR4 = 0xbc,
384     QIOR = 0xeb,
385     QIOR4 = 0xec,
386 
387     PP = 0x02,
388     PP4 = 0x12,
389     PP4_4 = 0x3e,
390     DPP = 0xa2,
391     QPP = 0x32,
392     QPP_4 = 0x34,
393     RDID_90 = 0x90,
394     RDID_AB = 0xab,
395     AAI_WP = 0xad,
396 
397     ERASE_4K = 0x20,
398     ERASE4_4K = 0x21,
399     ERASE_32K = 0x52,
400     ERASE4_32K = 0x5c,
401     ERASE_SECTOR = 0xd8,
402     ERASE4_SECTOR = 0xdc,
403 
404     EN_4BYTE_ADDR = 0xB7,
405     EX_4BYTE_ADDR = 0xE9,
406 
407     EXTEND_ADDR_READ = 0xC8,
408     EXTEND_ADDR_WRITE = 0xC5,
409 
410     RESET_ENABLE = 0x66,
411     RESET_MEMORY = 0x99,
412 
413     /*
414      * Micron: 0x35 - enable QPI
415      * Spansion: 0x35 - read control register
416      */
417     RDCR_EQIO = 0x35,
418     RSTQIO = 0xf5,
419 
420     RNVCR = 0xB5,
421     WNVCR = 0xB1,
422 
423     RVCR = 0x85,
424     WVCR = 0x81,
425 
426     REVCR = 0x65,
427     WEVCR = 0x61,
428 
429     DIE_ERASE = 0xC4,
430 } FlashCMD;
431 
432 typedef enum {
433     STATE_IDLE,
434     STATE_PAGE_PROGRAM,
435     STATE_READ,
436     STATE_COLLECTING_DATA,
437     STATE_COLLECTING_VAR_LEN_DATA,
438     STATE_READING_DATA,
439     STATE_READING_SFDP,
440 } CMDState;
441 
442 typedef enum {
443     MAN_SPANSION,
444     MAN_MACRONIX,
445     MAN_NUMONYX,
446     MAN_WINBOND,
447     MAN_SST,
448     MAN_ISSI,
449     MAN_GENERIC,
450 } Manufacturer;
451 
452 typedef enum {
453     MODE_STD = 0,
454     MODE_DIO = 1,
455     MODE_QIO = 2
456 } SPIMode;
457 
458 #define M25P80_INTERNAL_DATA_BUFFER_SZ 16
459 
460 struct Flash {
461     SSIPeripheral parent_obj;
462 
463     BlockBackend *blk;
464 
465     uint8_t *storage;
466     uint32_t size;
467     int page_size;
468 
469     uint8_t state;
470     uint8_t data[M25P80_INTERNAL_DATA_BUFFER_SZ];
471     uint32_t len;
472     uint32_t pos;
473     bool data_read_loop;
474     uint8_t needed_bytes;
475     uint8_t cmd_in_progress;
476     uint32_t cur_addr;
477     uint32_t nonvolatile_cfg;
478     /* Configuration register for Macronix */
479     uint32_t volatile_cfg;
480     uint32_t enh_volatile_cfg;
481     /* Spansion cfg registers. */
482     uint8_t spansion_cr1nv;
483     uint8_t spansion_cr2nv;
484     uint8_t spansion_cr3nv;
485     uint8_t spansion_cr4nv;
486     uint8_t spansion_cr1v;
487     uint8_t spansion_cr2v;
488     uint8_t spansion_cr3v;
489     uint8_t spansion_cr4v;
490     bool wp_level;
491     bool write_enable;
492     bool four_bytes_address_mode;
493     bool reset_enable;
494     bool quad_enable;
495     bool aai_enable;
496     bool block_protect0;
497     bool block_protect1;
498     bool block_protect2;
499     bool block_protect3;
500     bool top_bottom_bit;
501     bool status_register_write_disabled;
502     uint8_t ear;
503 
504     int64_t dirty_page;
505 
506     const FlashPartInfo *pi;
507 
508 };
509 
510 struct M25P80Class {
511     SSIPeripheralClass parent_class;
512     FlashPartInfo *pi;
513 };
514 
515 #define TYPE_M25P80 "m25p80-generic"
516 OBJECT_DECLARE_TYPE(Flash, M25P80Class, M25P80)
517 
518 static inline Manufacturer get_man(Flash *s)
519 {
520     switch (s->pi->id[0]) {
521     case 0x20:
522         return MAN_NUMONYX;
523     case 0xEF:
524         return MAN_WINBOND;
525     case 0x01:
526         return MAN_SPANSION;
527     case 0xC2:
528         return MAN_MACRONIX;
529     case 0xBF:
530         return MAN_SST;
531     case 0x9D:
532         return MAN_ISSI;
533     default:
534         return MAN_GENERIC;
535     }
536 }
537 
538 static void blk_sync_complete(void *opaque, int ret)
539 {
540     QEMUIOVector *iov = opaque;
541 
542     qemu_iovec_destroy(iov);
543     g_free(iov);
544 
545     /* do nothing. Masters do not directly interact with the backing store,
546      * only the working copy so no mutexing required.
547      */
548 }
549 
550 static void flash_sync_page(Flash *s, int page)
551 {
552     QEMUIOVector *iov;
553 
554     if (!s->blk || !blk_is_writable(s->blk)) {
555         return;
556     }
557 
558     iov = g_new(QEMUIOVector, 1);
559     qemu_iovec_init(iov, 1);
560     qemu_iovec_add(iov, s->storage + page * s->pi->page_size,
561                    s->pi->page_size);
562     blk_aio_pwritev(s->blk, page * s->pi->page_size, iov, 0,
563                     blk_sync_complete, iov);
564 }
565 
566 static inline void flash_sync_area(Flash *s, int64_t off, int64_t len)
567 {
568     QEMUIOVector *iov;
569 
570     if (!s->blk || !blk_is_writable(s->blk)) {
571         return;
572     }
573 
574     assert(!(len % BDRV_SECTOR_SIZE));
575     iov = g_new(QEMUIOVector, 1);
576     qemu_iovec_init(iov, 1);
577     qemu_iovec_add(iov, s->storage + off, len);
578     blk_aio_pwritev(s->blk, off, iov, 0, blk_sync_complete, iov);
579 }
580 
581 static void flash_erase(Flash *s, int offset, FlashCMD cmd)
582 {
583     uint32_t len;
584     uint8_t capa_to_assert = 0;
585 
586     switch (cmd) {
587     case ERASE_4K:
588     case ERASE4_4K:
589         len = 4 * KiB;
590         capa_to_assert = ER_4K;
591         break;
592     case ERASE_32K:
593     case ERASE4_32K:
594         len = 32 * KiB;
595         capa_to_assert = ER_32K;
596         break;
597     case ERASE_SECTOR:
598     case ERASE4_SECTOR:
599         len = s->pi->sector_size;
600         break;
601     case BULK_ERASE:
602         len = s->size;
603         break;
604     case DIE_ERASE:
605         if (s->pi->die_cnt) {
606             len = s->size / s->pi->die_cnt;
607             offset = offset & (~(len - 1));
608         } else {
609             qemu_log_mask(LOG_GUEST_ERROR, "M25P80: die erase is not supported"
610                           " by device\n");
611             return;
612         }
613         break;
614     default:
615         abort();
616     }
617 
618     trace_m25p80_flash_erase(s, offset, len);
619 
620     if ((s->pi->flags & capa_to_assert) != capa_to_assert) {
621         qemu_log_mask(LOG_GUEST_ERROR, "M25P80: %d erase size not supported by"
622                       " device\n", len);
623     }
624 
625     if (!s->write_enable) {
626         qemu_log_mask(LOG_GUEST_ERROR, "M25P80: erase with write protect!\n");
627         return;
628     }
629     memset(s->storage + offset, 0xff, len);
630     flash_sync_area(s, offset, len);
631 }
632 
633 static inline void flash_sync_dirty(Flash *s, int64_t newpage)
634 {
635     if (s->dirty_page >= 0 && s->dirty_page != newpage) {
636         flash_sync_page(s, s->dirty_page);
637         s->dirty_page = newpage;
638     }
639 }
640 
641 static inline
642 void flash_write8(Flash *s, uint32_t addr, uint8_t data)
643 {
644     uint32_t page = addr / s->pi->page_size;
645     uint8_t prev = s->storage[s->cur_addr];
646     uint32_t block_protect_value = (s->block_protect3 << 3) |
647                                    (s->block_protect2 << 2) |
648                                    (s->block_protect1 << 1) |
649                                    (s->block_protect0 << 0);
650 
651     if (!s->write_enable) {
652         qemu_log_mask(LOG_GUEST_ERROR, "M25P80: write with write protect!\n");
653         return;
654     }
655 
656     if (block_protect_value > 0) {
657         uint32_t num_protected_sectors = 1 << (block_protect_value - 1);
658         uint32_t sector = addr / s->pi->sector_size;
659 
660         /* top_bottom_bit == 0 means TOP */
661         if (!s->top_bottom_bit) {
662             if (s->pi->n_sectors <= sector + num_protected_sectors) {
663                 qemu_log_mask(LOG_GUEST_ERROR,
664                               "M25P80: write with write protect!\n");
665                 return;
666             }
667         } else {
668             if (sector < num_protected_sectors) {
669                 qemu_log_mask(LOG_GUEST_ERROR,
670                               "M25P80: write with write protect!\n");
671                 return;
672             }
673         }
674     }
675 
676     if ((prev ^ data) & data) {
677         trace_m25p80_programming_zero_to_one(s, addr, prev, data);
678     }
679 
680     if (s->pi->flags & EEPROM) {
681         s->storage[s->cur_addr] = data;
682     } else {
683         s->storage[s->cur_addr] &= data;
684     }
685 
686     flash_sync_dirty(s, page);
687     s->dirty_page = page;
688 }
689 
690 static inline int get_addr_length(Flash *s)
691 {
692    /* check if eeprom is in use */
693     if (s->pi->flags == EEPROM) {
694         return 2;
695     }
696 
697    switch (s->cmd_in_progress) {
698    case RDSFDP:
699        return 3;
700    case PP4:
701    case PP4_4:
702    case QPP_4:
703    case READ4:
704    case QIOR4:
705    case ERASE4_4K:
706    case ERASE4_32K:
707    case ERASE4_SECTOR:
708    case FAST_READ4:
709    case DOR4:
710    case QOR4:
711    case DIOR4:
712        return 4;
713    default:
714        return s->four_bytes_address_mode ? 4 : 3;
715    }
716 }
717 
718 static void complete_collecting_data(Flash *s)
719 {
720     int i, n;
721 
722     n = get_addr_length(s);
723     s->cur_addr = (n == 3 ? s->ear : 0);
724     for (i = 0; i < n; ++i) {
725         s->cur_addr <<= 8;
726         s->cur_addr |= s->data[i];
727     }
728 
729     s->cur_addr &= s->size - 1;
730 
731     s->state = STATE_IDLE;
732 
733     trace_m25p80_complete_collecting(s, s->cmd_in_progress, n, s->ear,
734                                      s->cur_addr);
735 
736     switch (s->cmd_in_progress) {
737     case DPP:
738     case QPP:
739     case QPP_4:
740     case PP:
741     case PP4:
742     case PP4_4:
743         s->state = STATE_PAGE_PROGRAM;
744         break;
745     case AAI_WP:
746         /* AAI programming starts from the even address */
747         s->cur_addr &= ~BIT(0);
748         s->state = STATE_PAGE_PROGRAM;
749         break;
750     case READ:
751     case READ4:
752     case FAST_READ:
753     case FAST_READ4:
754     case DOR:
755     case DOR4:
756     case QOR:
757     case QOR4:
758     case DIOR:
759     case DIOR4:
760     case QIOR:
761     case QIOR4:
762         s->state = STATE_READ;
763         break;
764     case ERASE_4K:
765     case ERASE4_4K:
766     case ERASE_32K:
767     case ERASE4_32K:
768     case ERASE_SECTOR:
769     case ERASE4_SECTOR:
770     case DIE_ERASE:
771         flash_erase(s, s->cur_addr, s->cmd_in_progress);
772         break;
773     case WRSR:
774         s->status_register_write_disabled = extract32(s->data[0], 7, 1);
775         s->block_protect0 = extract32(s->data[0], 2, 1);
776         s->block_protect1 = extract32(s->data[0], 3, 1);
777         s->block_protect2 = extract32(s->data[0], 4, 1);
778         if (s->pi->flags & HAS_SR_TB) {
779             s->top_bottom_bit = extract32(s->data[0], 5, 1);
780         }
781         if (s->pi->flags & HAS_SR_BP3_BIT6) {
782             s->block_protect3 = extract32(s->data[0], 6, 1);
783         }
784 
785         switch (get_man(s)) {
786         case MAN_SPANSION:
787             s->quad_enable = !!(s->data[1] & 0x02);
788             break;
789         case MAN_ISSI:
790             s->quad_enable = extract32(s->data[0], 6, 1);
791             break;
792         case MAN_MACRONIX:
793             s->quad_enable = extract32(s->data[0], 6, 1);
794             if (s->len > 1) {
795                 s->volatile_cfg = s->data[1];
796                 s->four_bytes_address_mode = extract32(s->data[1], 5, 1);
797             }
798             break;
799         default:
800             break;
801         }
802         if (s->write_enable) {
803             s->write_enable = false;
804         }
805         break;
806     case BRWR:
807     case EXTEND_ADDR_WRITE:
808         s->ear = s->data[0];
809         break;
810     case WNVCR:
811         s->nonvolatile_cfg = s->data[0] | (s->data[1] << 8);
812         break;
813     case WVCR:
814         s->volatile_cfg = s->data[0];
815         break;
816     case WEVCR:
817         s->enh_volatile_cfg = s->data[0];
818         break;
819     case RDID_90:
820     case RDID_AB:
821         if (get_man(s) == MAN_SST) {
822             if (s->cur_addr <= 1) {
823                 if (s->cur_addr) {
824                     s->data[0] = s->pi->id[2];
825                     s->data[1] = s->pi->id[0];
826                 } else {
827                     s->data[0] = s->pi->id[0];
828                     s->data[1] = s->pi->id[2];
829                 }
830                 s->pos = 0;
831                 s->len = 2;
832                 s->data_read_loop = true;
833                 s->state = STATE_READING_DATA;
834             } else {
835                 qemu_log_mask(LOG_GUEST_ERROR,
836                               "M25P80: Invalid read id address\n");
837             }
838         } else {
839             qemu_log_mask(LOG_GUEST_ERROR,
840                           "M25P80: Read id (command 0x90/0xAB) is not supported"
841                           " by device\n");
842         }
843         break;
844 
845     case RDSFDP:
846         s->state = STATE_READING_SFDP;
847         break;
848 
849     default:
850         break;
851     }
852 }
853 
854 static void reset_memory(Flash *s)
855 {
856     s->cmd_in_progress = NOP;
857     s->cur_addr = 0;
858     s->ear = 0;
859     s->four_bytes_address_mode = false;
860     s->len = 0;
861     s->needed_bytes = 0;
862     s->pos = 0;
863     s->state = STATE_IDLE;
864     s->write_enable = false;
865     s->reset_enable = false;
866     s->quad_enable = false;
867     s->aai_enable = false;
868 
869     switch (get_man(s)) {
870     case MAN_NUMONYX:
871         s->volatile_cfg = 0;
872         s->volatile_cfg |= VCFG_DUMMY;
873         s->volatile_cfg |= VCFG_WRAP_SEQUENTIAL;
874         if ((s->nonvolatile_cfg & NVCFG_XIP_MODE_MASK)
875                                 == NVCFG_XIP_MODE_DISABLED) {
876             s->volatile_cfg |= VCFG_XIP_MODE_DISABLED;
877         }
878         s->volatile_cfg |= deposit32(s->volatile_cfg,
879                             VCFG_DUMMY_CLK_POS,
880                             CFG_DUMMY_CLK_LEN,
881                             extract32(s->nonvolatile_cfg,
882                                         NVCFG_DUMMY_CLK_POS,
883                                         CFG_DUMMY_CLK_LEN)
884                             );
885 
886         s->enh_volatile_cfg = 0;
887         s->enh_volatile_cfg |= EVCFG_OUT_DRIVER_STRENGTH_DEF;
888         s->enh_volatile_cfg |= EVCFG_VPP_ACCELERATOR;
889         s->enh_volatile_cfg |= EVCFG_RESET_HOLD_ENABLED;
890         if (s->nonvolatile_cfg & NVCFG_DUAL_IO_MASK) {
891             s->enh_volatile_cfg |= EVCFG_DUAL_IO_DISABLED;
892         }
893         if (s->nonvolatile_cfg & NVCFG_QUAD_IO_MASK) {
894             s->enh_volatile_cfg |= EVCFG_QUAD_IO_DISABLED;
895         }
896         if (!(s->nonvolatile_cfg & NVCFG_4BYTE_ADDR_MASK)) {
897             s->four_bytes_address_mode = true;
898         }
899         if (!(s->nonvolatile_cfg & NVCFG_LOWER_SEGMENT_MASK)) {
900             s->ear = s->size / MAX_3BYTES_SIZE - 1;
901         }
902         break;
903     case MAN_MACRONIX:
904         s->volatile_cfg = 0x7;
905         break;
906     case MAN_SPANSION:
907         s->spansion_cr1v = s->spansion_cr1nv;
908         s->spansion_cr2v = s->spansion_cr2nv;
909         s->spansion_cr3v = s->spansion_cr3nv;
910         s->spansion_cr4v = s->spansion_cr4nv;
911         s->quad_enable = extract32(s->spansion_cr1v,
912                                    SPANSION_QUAD_CFG_POS,
913                                    SPANSION_QUAD_CFG_LEN
914                                    );
915         s->four_bytes_address_mode = extract32(s->spansion_cr2v,
916                 SPANSION_ADDR_LEN_POS,
917                 SPANSION_ADDR_LEN_LEN
918                 );
919         break;
920     default:
921         break;
922     }
923 
924     trace_m25p80_reset_done(s);
925 }
926 
927 static uint8_t numonyx_mode(Flash *s)
928 {
929     if (!(s->enh_volatile_cfg & EVCFG_QUAD_IO_DISABLED)) {
930         return MODE_QIO;
931     } else if (!(s->enh_volatile_cfg & EVCFG_DUAL_IO_DISABLED)) {
932         return MODE_DIO;
933     } else {
934         return MODE_STD;
935     }
936 }
937 
938 static uint8_t numonyx_extract_cfg_num_dummies(Flash *s)
939 {
940     uint8_t num_dummies;
941     uint8_t mode;
942     assert(get_man(s) == MAN_NUMONYX);
943 
944     mode = numonyx_mode(s);
945     num_dummies = extract32(s->volatile_cfg, 4, 4);
946 
947     if (num_dummies == 0x0 || num_dummies == 0xf) {
948         switch (s->cmd_in_progress) {
949         case QIOR:
950         case QIOR4:
951             num_dummies = 10;
952             break;
953         default:
954             num_dummies = (mode == MODE_QIO) ? 10 : 8;
955             break;
956         }
957     }
958 
959     return num_dummies;
960 }
961 
962 static void decode_fast_read_cmd(Flash *s)
963 {
964     s->needed_bytes = get_addr_length(s);
965     switch (get_man(s)) {
966     /* Dummy cycles - modeled with bytes writes instead of bits */
967     case MAN_SST:
968         s->needed_bytes += 1;
969         break;
970     case MAN_WINBOND:
971         s->needed_bytes += 8;
972         break;
973     case MAN_NUMONYX:
974         s->needed_bytes += numonyx_extract_cfg_num_dummies(s);
975         break;
976     case MAN_MACRONIX:
977         if (extract32(s->volatile_cfg, 6, 2) == 1) {
978             s->needed_bytes += 6;
979         } else {
980             s->needed_bytes += 8;
981         }
982         break;
983     case MAN_SPANSION:
984         s->needed_bytes += extract32(s->spansion_cr2v,
985                                     SPANSION_DUMMY_CLK_POS,
986                                     SPANSION_DUMMY_CLK_LEN
987                                     );
988         break;
989     case MAN_ISSI:
990         /*
991          * The Fast Read instruction code is followed by address bytes and
992          * dummy cycles, transmitted via the SI line.
993          *
994          * The number of dummy cycles is configurable but this is currently
995          * unmodeled, hence the default value 8 is used.
996          *
997          * QPI (Quad Peripheral Interface) mode has different default value
998          * of dummy cycles, but this is unsupported at the time being.
999          */
1000         s->needed_bytes += 1;
1001         break;
1002     default:
1003         break;
1004     }
1005     s->pos = 0;
1006     s->len = 0;
1007     s->state = STATE_COLLECTING_DATA;
1008 }
1009 
1010 static void decode_dio_read_cmd(Flash *s)
1011 {
1012     s->needed_bytes = get_addr_length(s);
1013     /* Dummy cycles modeled with bytes writes instead of bits */
1014     switch (get_man(s)) {
1015     case MAN_WINBOND:
1016         s->needed_bytes += WINBOND_CONTINUOUS_READ_MODE_CMD_LEN;
1017         break;
1018     case MAN_SPANSION:
1019         s->needed_bytes += SPANSION_CONTINUOUS_READ_MODE_CMD_LEN;
1020         s->needed_bytes += extract32(s->spansion_cr2v,
1021                                     SPANSION_DUMMY_CLK_POS,
1022                                     SPANSION_DUMMY_CLK_LEN
1023                                     );
1024         break;
1025     case MAN_NUMONYX:
1026         s->needed_bytes += numonyx_extract_cfg_num_dummies(s);
1027         break;
1028     case MAN_MACRONIX:
1029         switch (extract32(s->volatile_cfg, 6, 2)) {
1030         case 1:
1031             s->needed_bytes += 6;
1032             break;
1033         case 2:
1034             s->needed_bytes += 8;
1035             break;
1036         default:
1037             s->needed_bytes += 4;
1038             break;
1039         }
1040         break;
1041     case MAN_ISSI:
1042         /*
1043          * The Fast Read Dual I/O instruction code is followed by address bytes
1044          * and dummy cycles, transmitted via the IO1 and IO0 line.
1045          *
1046          * The number of dummy cycles is configurable but this is currently
1047          * unmodeled, hence the default value 4 is used.
1048          */
1049         s->needed_bytes += 1;
1050         break;
1051     default:
1052         break;
1053     }
1054     s->pos = 0;
1055     s->len = 0;
1056     s->state = STATE_COLLECTING_DATA;
1057 }
1058 
1059 static void decode_qio_read_cmd(Flash *s)
1060 {
1061     s->needed_bytes = get_addr_length(s);
1062     /* Dummy cycles modeled with bytes writes instead of bits */
1063     switch (get_man(s)) {
1064     case MAN_WINBOND:
1065         s->needed_bytes += WINBOND_CONTINUOUS_READ_MODE_CMD_LEN;
1066         s->needed_bytes += 4;
1067         break;
1068     case MAN_SPANSION:
1069         s->needed_bytes += SPANSION_CONTINUOUS_READ_MODE_CMD_LEN;
1070         s->needed_bytes += extract32(s->spansion_cr2v,
1071                                     SPANSION_DUMMY_CLK_POS,
1072                                     SPANSION_DUMMY_CLK_LEN
1073                                     );
1074         break;
1075     case MAN_NUMONYX:
1076         s->needed_bytes += numonyx_extract_cfg_num_dummies(s);
1077         break;
1078     case MAN_MACRONIX:
1079         switch (extract32(s->volatile_cfg, 6, 2)) {
1080         case 1:
1081             s->needed_bytes += 4;
1082             break;
1083         case 2:
1084             s->needed_bytes += 8;
1085             break;
1086         default:
1087             s->needed_bytes += 6;
1088             break;
1089         }
1090         break;
1091     case MAN_ISSI:
1092         /*
1093          * The Fast Read Quad I/O instruction code is followed by address bytes
1094          * and dummy cycles, transmitted via the IO3, IO2, IO1 and IO0 line.
1095          *
1096          * The number of dummy cycles is configurable but this is currently
1097          * unmodeled, hence the default value 6 is used.
1098          *
1099          * QPI (Quad Peripheral Interface) mode has different default value
1100          * of dummy cycles, but this is unsupported at the time being.
1101          */
1102         s->needed_bytes += 3;
1103         break;
1104     default:
1105         break;
1106     }
1107     s->pos = 0;
1108     s->len = 0;
1109     s->state = STATE_COLLECTING_DATA;
1110 }
1111 
1112 static bool is_valid_aai_cmd(uint32_t cmd)
1113 {
1114     return cmd == AAI_WP || cmd == WRDI || cmd == RDSR;
1115 }
1116 
1117 static void decode_new_cmd(Flash *s, uint32_t value)
1118 {
1119     int i;
1120 
1121     s->cmd_in_progress = value;
1122     trace_m25p80_command_decoded(s, value);
1123 
1124     if (value != RESET_MEMORY) {
1125         s->reset_enable = false;
1126     }
1127 
1128     if (get_man(s) == MAN_SST && s->aai_enable && !is_valid_aai_cmd(value)) {
1129         qemu_log_mask(LOG_GUEST_ERROR,
1130                       "M25P80: Invalid cmd within AAI programming sequence");
1131     }
1132 
1133     switch (value) {
1134 
1135     case ERASE_4K:
1136     case ERASE4_4K:
1137     case ERASE_32K:
1138     case ERASE4_32K:
1139     case ERASE_SECTOR:
1140     case ERASE4_SECTOR:
1141     case PP:
1142     case PP4:
1143     case DIE_ERASE:
1144     case RDID_90:
1145     case RDID_AB:
1146         s->needed_bytes = get_addr_length(s);
1147         s->pos = 0;
1148         s->len = 0;
1149         s->state = STATE_COLLECTING_DATA;
1150         break;
1151     case READ:
1152     case READ4:
1153         if (get_man(s) != MAN_NUMONYX || numonyx_mode(s) == MODE_STD) {
1154             s->needed_bytes = get_addr_length(s);
1155             s->pos = 0;
1156             s->len = 0;
1157             s->state = STATE_COLLECTING_DATA;
1158         } else {
1159             qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Cannot execute cmd %x in "
1160                           "DIO or QIO mode\n", s->cmd_in_progress);
1161         }
1162         break;
1163     case DPP:
1164         if (get_man(s) != MAN_NUMONYX || numonyx_mode(s) != MODE_QIO) {
1165             s->needed_bytes = get_addr_length(s);
1166             s->pos = 0;
1167             s->len = 0;
1168             s->state = STATE_COLLECTING_DATA;
1169         } else {
1170             qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Cannot execute cmd %x in "
1171                           "QIO mode\n", s->cmd_in_progress);
1172         }
1173         break;
1174     case QPP:
1175     case QPP_4:
1176     case PP4_4:
1177         if (get_man(s) != MAN_NUMONYX || numonyx_mode(s) != MODE_DIO) {
1178             s->needed_bytes = get_addr_length(s);
1179             s->pos = 0;
1180             s->len = 0;
1181             s->state = STATE_COLLECTING_DATA;
1182         } else {
1183             qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Cannot execute cmd %x in "
1184                           "DIO mode\n", s->cmd_in_progress);
1185         }
1186         break;
1187 
1188     case FAST_READ:
1189     case FAST_READ4:
1190         decode_fast_read_cmd(s);
1191         break;
1192     case DOR:
1193     case DOR4:
1194         if (get_man(s) != MAN_NUMONYX || numonyx_mode(s) != MODE_QIO) {
1195             decode_fast_read_cmd(s);
1196         } else {
1197             qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Cannot execute cmd %x in "
1198                           "QIO mode\n", s->cmd_in_progress);
1199         }
1200         break;
1201     case QOR:
1202     case QOR4:
1203         if (get_man(s) != MAN_NUMONYX || numonyx_mode(s) != MODE_DIO) {
1204             decode_fast_read_cmd(s);
1205         } else {
1206             qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Cannot execute cmd %x in "
1207                           "DIO mode\n", s->cmd_in_progress);
1208         }
1209         break;
1210 
1211     case DIOR:
1212     case DIOR4:
1213         if (get_man(s) != MAN_NUMONYX || numonyx_mode(s) != MODE_QIO) {
1214             decode_dio_read_cmd(s);
1215         } else {
1216             qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Cannot execute cmd %x in "
1217                           "QIO mode\n", s->cmd_in_progress);
1218         }
1219         break;
1220 
1221     case QIOR:
1222     case QIOR4:
1223         if (get_man(s) != MAN_NUMONYX || numonyx_mode(s) != MODE_DIO) {
1224             decode_qio_read_cmd(s);
1225         } else {
1226             qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Cannot execute cmd %x in "
1227                           "DIO mode\n", s->cmd_in_progress);
1228         }
1229         break;
1230 
1231     case WRSR:
1232         /*
1233          * If WP# is low and status_register_write_disabled is high,
1234          * status register writes are disabled.
1235          * This is also called "hardware protected mode" (HPM). All other
1236          * combinations of the two states are called "software protected mode"
1237          * (SPM), and status register writes are permitted.
1238          */
1239         if ((s->wp_level == 0 && s->status_register_write_disabled)
1240             || !s->write_enable) {
1241             qemu_log_mask(LOG_GUEST_ERROR,
1242                           "M25P80: Status register write is disabled!\n");
1243             break;
1244         }
1245 
1246         switch (get_man(s)) {
1247         case MAN_SPANSION:
1248             s->needed_bytes = 2;
1249             s->state = STATE_COLLECTING_DATA;
1250             break;
1251         case MAN_MACRONIX:
1252             s->needed_bytes = 2;
1253             s->state = STATE_COLLECTING_VAR_LEN_DATA;
1254             break;
1255         default:
1256             s->needed_bytes = 1;
1257             s->state = STATE_COLLECTING_DATA;
1258         }
1259         s->pos = 0;
1260         break;
1261 
1262     case WRDI:
1263         s->write_enable = false;
1264         if (get_man(s) == MAN_SST) {
1265             s->aai_enable = false;
1266         }
1267         break;
1268     case WREN:
1269         s->write_enable = true;
1270         break;
1271 
1272     case RDSR:
1273         s->data[0] = (!!s->write_enable) << 1;
1274         s->data[0] |= (!!s->status_register_write_disabled) << 7;
1275         s->data[0] |= (!!s->block_protect0) << 2;
1276         s->data[0] |= (!!s->block_protect1) << 3;
1277         s->data[0] |= (!!s->block_protect2) << 4;
1278         if (s->pi->flags & HAS_SR_TB) {
1279             s->data[0] |= (!!s->top_bottom_bit) << 5;
1280         }
1281         if (s->pi->flags & HAS_SR_BP3_BIT6) {
1282             s->data[0] |= (!!s->block_protect3) << 6;
1283         }
1284 
1285         if (get_man(s) == MAN_MACRONIX || get_man(s) == MAN_ISSI) {
1286             s->data[0] |= (!!s->quad_enable) << 6;
1287         }
1288         if (get_man(s) == MAN_SST) {
1289             s->data[0] |= (!!s->aai_enable) << 6;
1290         }
1291 
1292         s->pos = 0;
1293         s->len = 1;
1294         s->data_read_loop = true;
1295         s->state = STATE_READING_DATA;
1296         break;
1297 
1298     case READ_FSR:
1299         s->data[0] = FSR_FLASH_READY;
1300         if (s->four_bytes_address_mode) {
1301             s->data[0] |= FSR_4BYTE_ADDR_MODE_ENABLED;
1302         }
1303         s->pos = 0;
1304         s->len = 1;
1305         s->data_read_loop = true;
1306         s->state = STATE_READING_DATA;
1307         break;
1308 
1309     case JEDEC_READ:
1310         if (get_man(s) != MAN_NUMONYX || numonyx_mode(s) == MODE_STD) {
1311             trace_m25p80_populated_jedec(s);
1312             for (i = 0; i < s->pi->id_len; i++) {
1313                 s->data[i] = s->pi->id[i];
1314             }
1315             for (; i < SPI_NOR_MAX_ID_LEN; i++) {
1316                 s->data[i] = 0;
1317             }
1318 
1319             s->len = SPI_NOR_MAX_ID_LEN;
1320             s->pos = 0;
1321             s->state = STATE_READING_DATA;
1322         } else {
1323             qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Cannot execute JEDEC read "
1324                           "in DIO or QIO mode\n");
1325         }
1326         break;
1327 
1328     case RDCR:
1329         s->data[0] = s->volatile_cfg & 0xFF;
1330         s->data[0] |= (!!s->four_bytes_address_mode) << 5;
1331         s->pos = 0;
1332         s->len = 1;
1333         s->state = STATE_READING_DATA;
1334         break;
1335 
1336     case BULK_ERASE_60:
1337     case BULK_ERASE:
1338         if (s->write_enable) {
1339             trace_m25p80_chip_erase(s);
1340             flash_erase(s, 0, BULK_ERASE);
1341         } else {
1342             qemu_log_mask(LOG_GUEST_ERROR, "M25P80: chip erase with write "
1343                           "protect!\n");
1344         }
1345         break;
1346     case NOP:
1347         break;
1348     case EN_4BYTE_ADDR:
1349         s->four_bytes_address_mode = true;
1350         break;
1351     case EX_4BYTE_ADDR:
1352         s->four_bytes_address_mode = false;
1353         break;
1354     case BRRD:
1355     case EXTEND_ADDR_READ:
1356         s->data[0] = s->ear;
1357         s->pos = 0;
1358         s->len = 1;
1359         s->state = STATE_READING_DATA;
1360         break;
1361     case BRWR:
1362     case EXTEND_ADDR_WRITE:
1363         if (s->write_enable) {
1364             s->needed_bytes = 1;
1365             s->pos = 0;
1366             s->len = 0;
1367             s->state = STATE_COLLECTING_DATA;
1368         }
1369         break;
1370     case RNVCR:
1371         s->data[0] = s->nonvolatile_cfg & 0xFF;
1372         s->data[1] = (s->nonvolatile_cfg >> 8) & 0xFF;
1373         s->pos = 0;
1374         s->len = 2;
1375         s->state = STATE_READING_DATA;
1376         break;
1377     case WNVCR:
1378         if (s->write_enable && get_man(s) == MAN_NUMONYX) {
1379             s->needed_bytes = 2;
1380             s->pos = 0;
1381             s->len = 0;
1382             s->state = STATE_COLLECTING_DATA;
1383         }
1384         break;
1385     case RVCR:
1386         s->data[0] = s->volatile_cfg & 0xFF;
1387         s->pos = 0;
1388         s->len = 1;
1389         s->state = STATE_READING_DATA;
1390         break;
1391     case WVCR:
1392         if (s->write_enable) {
1393             s->needed_bytes = 1;
1394             s->pos = 0;
1395             s->len = 0;
1396             s->state = STATE_COLLECTING_DATA;
1397         }
1398         break;
1399     case REVCR:
1400         s->data[0] = s->enh_volatile_cfg & 0xFF;
1401         s->pos = 0;
1402         s->len = 1;
1403         s->state = STATE_READING_DATA;
1404         break;
1405     case WEVCR:
1406         if (s->write_enable) {
1407             s->needed_bytes = 1;
1408             s->pos = 0;
1409             s->len = 0;
1410             s->state = STATE_COLLECTING_DATA;
1411         }
1412         break;
1413     case RESET_ENABLE:
1414         s->reset_enable = true;
1415         break;
1416     case RESET_MEMORY:
1417         if (s->reset_enable) {
1418             reset_memory(s);
1419         }
1420         break;
1421     case RDCR_EQIO:
1422         switch (get_man(s)) {
1423         case MAN_SPANSION:
1424             s->data[0] = (!!s->quad_enable) << 1;
1425             s->pos = 0;
1426             s->len = 1;
1427             s->state = STATE_READING_DATA;
1428             break;
1429         case MAN_MACRONIX:
1430             s->quad_enable = true;
1431             break;
1432         default:
1433             break;
1434         }
1435         break;
1436     case RSTQIO:
1437         s->quad_enable = false;
1438         break;
1439     case AAI_WP:
1440         if (get_man(s) == MAN_SST) {
1441             if (s->write_enable) {
1442                 if (s->aai_enable) {
1443                     s->state = STATE_PAGE_PROGRAM;
1444                 } else {
1445                     s->aai_enable = true;
1446                     s->needed_bytes = get_addr_length(s);
1447                     s->state = STATE_COLLECTING_DATA;
1448                 }
1449             } else {
1450                 qemu_log_mask(LOG_GUEST_ERROR,
1451                               "M25P80: AAI_WP with write protect\n");
1452             }
1453         } else {
1454             qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Unknown cmd %x\n", value);
1455         }
1456         break;
1457     case RDSFDP:
1458         if (s->pi->sfdp_read) {
1459             s->needed_bytes = get_addr_length(s) + 1; /* SFDP addr + dummy */
1460             s->pos = 0;
1461             s->len = 0;
1462             s->state = STATE_COLLECTING_DATA;
1463             break;
1464         }
1465         /* Fallthrough */
1466 
1467     default:
1468         s->pos = 0;
1469         s->len = 1;
1470         s->state = STATE_READING_DATA;
1471         s->data_read_loop = true;
1472         s->data[0] = 0;
1473         qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Unknown cmd %x\n", value);
1474         break;
1475     }
1476 }
1477 
1478 static int m25p80_cs(SSIPeripheral *ss, bool select)
1479 {
1480     Flash *s = M25P80(ss);
1481 
1482     if (select) {
1483         if (s->state == STATE_COLLECTING_VAR_LEN_DATA) {
1484             complete_collecting_data(s);
1485         }
1486         s->len = 0;
1487         s->pos = 0;
1488         s->state = STATE_IDLE;
1489         flash_sync_dirty(s, -1);
1490         s->data_read_loop = false;
1491     }
1492 
1493     trace_m25p80_select(s, select ? "de" : "");
1494 
1495     return 0;
1496 }
1497 
1498 static uint32_t m25p80_transfer8(SSIPeripheral *ss, uint32_t tx)
1499 {
1500     Flash *s = M25P80(ss);
1501     uint32_t r = 0;
1502 
1503     trace_m25p80_transfer(s, s->state, s->len, s->needed_bytes, s->pos,
1504                           s->cur_addr, (uint8_t)tx);
1505 
1506     switch (s->state) {
1507 
1508     case STATE_PAGE_PROGRAM:
1509         trace_m25p80_page_program(s, s->cur_addr, (uint8_t)tx);
1510         flash_write8(s, s->cur_addr, (uint8_t)tx);
1511         s->cur_addr = (s->cur_addr + 1) & (s->size - 1);
1512 
1513         if (get_man(s) == MAN_SST && s->aai_enable && s->cur_addr == 0) {
1514             /*
1515              * There is no wrap mode during AAI programming once the highest
1516              * unprotected memory address is reached. The Write-Enable-Latch
1517              * bit is automatically reset, and AAI programming mode aborts.
1518              */
1519             s->write_enable = false;
1520             s->aai_enable = false;
1521         }
1522 
1523         break;
1524 
1525     case STATE_READ:
1526         r = s->storage[s->cur_addr];
1527         trace_m25p80_read_byte(s, s->cur_addr, (uint8_t)r);
1528         s->cur_addr = (s->cur_addr + 1) & (s->size - 1);
1529         break;
1530 
1531     case STATE_COLLECTING_DATA:
1532     case STATE_COLLECTING_VAR_LEN_DATA:
1533 
1534         if (s->len >= M25P80_INTERNAL_DATA_BUFFER_SZ) {
1535             qemu_log_mask(LOG_GUEST_ERROR,
1536                           "M25P80: Write overrun internal data buffer. "
1537                           "SPI controller (QEMU emulator or guest driver) "
1538                           "is misbehaving\n");
1539             s->len = s->pos = 0;
1540             s->state = STATE_IDLE;
1541             break;
1542         }
1543 
1544         s->data[s->len] = (uint8_t)tx;
1545         s->len++;
1546 
1547         if (s->len == s->needed_bytes) {
1548             complete_collecting_data(s);
1549         }
1550         break;
1551 
1552     case STATE_READING_DATA:
1553 
1554         if (s->pos >= M25P80_INTERNAL_DATA_BUFFER_SZ) {
1555             qemu_log_mask(LOG_GUEST_ERROR,
1556                           "M25P80: Read overrun internal data buffer. "
1557                           "SPI controller (QEMU emulator or guest driver) "
1558                           "is misbehaving\n");
1559             s->len = s->pos = 0;
1560             s->state = STATE_IDLE;
1561             break;
1562         }
1563 
1564         r = s->data[s->pos];
1565         trace_m25p80_read_data(s, s->pos, (uint8_t)r);
1566         s->pos++;
1567         if (s->pos == s->len) {
1568             s->pos = 0;
1569             if (!s->data_read_loop) {
1570                 s->state = STATE_IDLE;
1571             }
1572         }
1573         break;
1574     case STATE_READING_SFDP:
1575         assert(s->pi->sfdp_read);
1576         r = s->pi->sfdp_read(s->cur_addr);
1577         trace_m25p80_read_sfdp(s, s->cur_addr, (uint8_t)r);
1578         s->cur_addr = (s->cur_addr + 1) & (M25P80_SFDP_MAX_SIZE - 1);
1579         break;
1580 
1581     default:
1582     case STATE_IDLE:
1583         decode_new_cmd(s, (uint8_t)tx);
1584         break;
1585     }
1586 
1587     return r;
1588 }
1589 
1590 static void m25p80_write_protect_pin_irq_handler(void *opaque, int n, int level)
1591 {
1592     Flash *s = M25P80(opaque);
1593     /* WP# is just a single pin. */
1594     assert(n == 0);
1595     s->wp_level = !!level;
1596 }
1597 
1598 static void m25p80_realize(SSIPeripheral *ss, Error **errp)
1599 {
1600     Flash *s = M25P80(ss);
1601     M25P80Class *mc = M25P80_GET_CLASS(s);
1602     int ret;
1603 
1604     s->pi = mc->pi;
1605 
1606     s->size = s->pi->sector_size * s->pi->n_sectors;
1607     s->dirty_page = -1;
1608 
1609     if (s->blk) {
1610         uint64_t perm = BLK_PERM_CONSISTENT_READ |
1611                         (blk_supports_write_perm(s->blk) ? BLK_PERM_WRITE : 0);
1612         ret = blk_set_perm(s->blk, perm, BLK_PERM_ALL, errp);
1613         if (ret < 0) {
1614             return;
1615         }
1616 
1617         trace_m25p80_binding(s);
1618         s->storage = blk_blockalign(s->blk, s->size);
1619 
1620         if (!blk_check_size_and_read_all(s->blk, s->storage, s->size, errp)) {
1621             return;
1622         }
1623     } else {
1624         trace_m25p80_binding_no_bdrv(s);
1625         s->storage = blk_blockalign(NULL, s->size);
1626         memset(s->storage, 0xFF, s->size);
1627     }
1628 
1629     qdev_init_gpio_in_named(DEVICE(s),
1630                             m25p80_write_protect_pin_irq_handler, "WP#", 1);
1631 }
1632 
1633 static void m25p80_reset(DeviceState *d)
1634 {
1635     Flash *s = M25P80(d);
1636 
1637     s->wp_level = true;
1638     s->status_register_write_disabled = false;
1639     s->block_protect0 = false;
1640     s->block_protect1 = false;
1641     s->block_protect2 = false;
1642     s->block_protect3 = false;
1643     s->top_bottom_bit = false;
1644 
1645     reset_memory(s);
1646 }
1647 
1648 static int m25p80_pre_save(void *opaque)
1649 {
1650     flash_sync_dirty((Flash *)opaque, -1);
1651 
1652     return 0;
1653 }
1654 
1655 static Property m25p80_properties[] = {
1656     /* This is default value for Micron flash */
1657     DEFINE_PROP_BOOL("write-enable", Flash, write_enable, false),
1658     DEFINE_PROP_UINT32("nonvolatile-cfg", Flash, nonvolatile_cfg, 0x8FFF),
1659     DEFINE_PROP_UINT8("spansion-cr1nv", Flash, spansion_cr1nv, 0x0),
1660     DEFINE_PROP_UINT8("spansion-cr2nv", Flash, spansion_cr2nv, 0x8),
1661     DEFINE_PROP_UINT8("spansion-cr3nv", Flash, spansion_cr3nv, 0x2),
1662     DEFINE_PROP_UINT8("spansion-cr4nv", Flash, spansion_cr4nv, 0x10),
1663     DEFINE_PROP_DRIVE("drive", Flash, blk),
1664     DEFINE_PROP_END_OF_LIST(),
1665 };
1666 
1667 static int m25p80_pre_load(void *opaque)
1668 {
1669     Flash *s = (Flash *)opaque;
1670 
1671     s->data_read_loop = false;
1672     return 0;
1673 }
1674 
1675 static bool m25p80_data_read_loop_needed(void *opaque)
1676 {
1677     Flash *s = (Flash *)opaque;
1678 
1679     return s->data_read_loop;
1680 }
1681 
1682 static const VMStateDescription vmstate_m25p80_data_read_loop = {
1683     .name = "m25p80/data_read_loop",
1684     .version_id = 1,
1685     .minimum_version_id = 1,
1686     .needed = m25p80_data_read_loop_needed,
1687     .fields = (VMStateField[]) {
1688         VMSTATE_BOOL(data_read_loop, Flash),
1689         VMSTATE_END_OF_LIST()
1690     }
1691 };
1692 
1693 static bool m25p80_aai_enable_needed(void *opaque)
1694 {
1695     Flash *s = (Flash *)opaque;
1696 
1697     return s->aai_enable;
1698 }
1699 
1700 static const VMStateDescription vmstate_m25p80_aai_enable = {
1701     .name = "m25p80/aai_enable",
1702     .version_id = 1,
1703     .minimum_version_id = 1,
1704     .needed = m25p80_aai_enable_needed,
1705     .fields = (VMStateField[]) {
1706         VMSTATE_BOOL(aai_enable, Flash),
1707         VMSTATE_END_OF_LIST()
1708     }
1709 };
1710 
1711 static bool m25p80_wp_level_srwd_needed(void *opaque)
1712 {
1713     Flash *s = (Flash *)opaque;
1714 
1715     return !s->wp_level || s->status_register_write_disabled;
1716 }
1717 
1718 static const VMStateDescription vmstate_m25p80_write_protect = {
1719     .name = "m25p80/write_protect",
1720     .version_id = 1,
1721     .minimum_version_id = 1,
1722     .needed = m25p80_wp_level_srwd_needed,
1723     .fields = (VMStateField[]) {
1724         VMSTATE_BOOL(wp_level, Flash),
1725         VMSTATE_BOOL(status_register_write_disabled, Flash),
1726         VMSTATE_END_OF_LIST()
1727     }
1728 };
1729 
1730 static bool m25p80_block_protect_needed(void *opaque)
1731 {
1732     Flash *s = (Flash *)opaque;
1733 
1734     return s->block_protect0 ||
1735            s->block_protect1 ||
1736            s->block_protect2 ||
1737            s->block_protect3 ||
1738            s->top_bottom_bit;
1739 }
1740 
1741 static const VMStateDescription vmstate_m25p80_block_protect = {
1742     .name = "m25p80/block_protect",
1743     .version_id = 1,
1744     .minimum_version_id = 1,
1745     .needed = m25p80_block_protect_needed,
1746     .fields = (VMStateField[]) {
1747         VMSTATE_BOOL(block_protect0, Flash),
1748         VMSTATE_BOOL(block_protect1, Flash),
1749         VMSTATE_BOOL(block_protect2, Flash),
1750         VMSTATE_BOOL(block_protect3, Flash),
1751         VMSTATE_BOOL(top_bottom_bit, Flash),
1752         VMSTATE_END_OF_LIST()
1753     }
1754 };
1755 
1756 static const VMStateDescription vmstate_m25p80 = {
1757     .name = "m25p80",
1758     .version_id = 0,
1759     .minimum_version_id = 0,
1760     .pre_save = m25p80_pre_save,
1761     .pre_load = m25p80_pre_load,
1762     .fields = (VMStateField[]) {
1763         VMSTATE_UINT8(state, Flash),
1764         VMSTATE_UINT8_ARRAY(data, Flash, M25P80_INTERNAL_DATA_BUFFER_SZ),
1765         VMSTATE_UINT32(len, Flash),
1766         VMSTATE_UINT32(pos, Flash),
1767         VMSTATE_UINT8(needed_bytes, Flash),
1768         VMSTATE_UINT8(cmd_in_progress, Flash),
1769         VMSTATE_UINT32(cur_addr, Flash),
1770         VMSTATE_BOOL(write_enable, Flash),
1771         VMSTATE_BOOL(reset_enable, Flash),
1772         VMSTATE_UINT8(ear, Flash),
1773         VMSTATE_BOOL(four_bytes_address_mode, Flash),
1774         VMSTATE_UINT32(nonvolatile_cfg, Flash),
1775         VMSTATE_UINT32(volatile_cfg, Flash),
1776         VMSTATE_UINT32(enh_volatile_cfg, Flash),
1777         VMSTATE_BOOL(quad_enable, Flash),
1778         VMSTATE_UINT8(spansion_cr1nv, Flash),
1779         VMSTATE_UINT8(spansion_cr2nv, Flash),
1780         VMSTATE_UINT8(spansion_cr3nv, Flash),
1781         VMSTATE_UINT8(spansion_cr4nv, Flash),
1782         VMSTATE_END_OF_LIST()
1783     },
1784     .subsections = (const VMStateDescription * []) {
1785         &vmstate_m25p80_data_read_loop,
1786         &vmstate_m25p80_aai_enable,
1787         &vmstate_m25p80_write_protect,
1788         &vmstate_m25p80_block_protect,
1789         NULL
1790     }
1791 };
1792 
1793 static void m25p80_class_init(ObjectClass *klass, void *data)
1794 {
1795     DeviceClass *dc = DEVICE_CLASS(klass);
1796     SSIPeripheralClass *k = SSI_PERIPHERAL_CLASS(klass);
1797     M25P80Class *mc = M25P80_CLASS(klass);
1798 
1799     k->realize = m25p80_realize;
1800     k->transfer = m25p80_transfer8;
1801     k->set_cs = m25p80_cs;
1802     k->cs_polarity = SSI_CS_LOW;
1803     dc->vmsd = &vmstate_m25p80;
1804     device_class_set_props(dc, m25p80_properties);
1805     dc->reset = m25p80_reset;
1806     mc->pi = data;
1807 }
1808 
1809 static const TypeInfo m25p80_info = {
1810     .name           = TYPE_M25P80,
1811     .parent         = TYPE_SSI_PERIPHERAL,
1812     .instance_size  = sizeof(Flash),
1813     .class_size     = sizeof(M25P80Class),
1814     .abstract       = true,
1815 };
1816 
1817 static void m25p80_register_types(void)
1818 {
1819     int i;
1820 
1821     type_register_static(&m25p80_info);
1822     for (i = 0; i < ARRAY_SIZE(known_devices); ++i) {
1823         TypeInfo ti = {
1824             .name       = known_devices[i].part_name,
1825             .parent     = TYPE_M25P80,
1826             .class_init = m25p80_class_init,
1827             .class_data = (void *)&known_devices[i],
1828         };
1829         type_register(&ti);
1830     }
1831 }
1832 
1833 type_init(m25p80_register_types)
1834 
1835 BlockBackend *m25p80_get_blk(DeviceState *dev)
1836 {
1837     return M25P80(dev)->blk;
1838 }
1839