xref: /openbmc/qemu/hw/block/pflash_cfi01.c (revision 6683d7bc)
1 /*
2  *  CFI parallel flash with Intel command set emulation
3  *
4  *  Copyright (c) 2006 Thorsten Zitterell
5  *  Copyright (c) 2005 Jocelyn Mayer
6  *
7  * This library is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU Lesser General Public
9  * License as published by the Free Software Foundation; either
10  * version 2 of the License, or (at your option) any later version.
11  *
12  * This library is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * Lesser General Public License for more details.
16  *
17  * You should have received a copy of the GNU Lesser General Public
18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 /*
22  * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
23  * Supported commands/modes are:
24  * - flash read
25  * - flash write
26  * - flash ID read
27  * - sector erase
28  * - CFI queries
29  *
30  * It does not support timings
31  * It does not support flash interleaving
32  * It does not implement software data protection as found in many real chips
33  * It does not implement erase suspend/resume commands
34  * It does not implement multiple sectors erase
35  *
36  * It does not implement much more ...
37  */
38 
39 #include "hw/hw.h"
40 #include "hw/block/flash.h"
41 #include "block/block.h"
42 #include "qemu/timer.h"
43 #include "exec/address-spaces.h"
44 #include "qemu/host-utils.h"
45 #include "hw/sysbus.h"
46 
47 #define PFLASH_BUG(fmt, ...) \
48 do { \
49     fprintf(stderr, "PFLASH: Possible BUG - " fmt, ## __VA_ARGS__); \
50     exit(1); \
51 } while(0)
52 
53 /* #define PFLASH_DEBUG */
54 #ifdef PFLASH_DEBUG
55 #define DPRINTF(fmt, ...)                                   \
56 do {                                                        \
57     fprintf(stderr, "PFLASH: " fmt , ## __VA_ARGS__);       \
58 } while (0)
59 #else
60 #define DPRINTF(fmt, ...) do { } while (0)
61 #endif
62 
63 struct pflash_t {
64     SysBusDevice busdev;
65     BlockDriverState *bs;
66     uint32_t nb_blocs;
67     uint64_t sector_len;
68     uint8_t width;
69     uint8_t be;
70     uint8_t wcycle; /* if 0, the flash is read normally */
71     int ro;
72     uint8_t cmd;
73     uint8_t status;
74     uint16_t ident0;
75     uint16_t ident1;
76     uint16_t ident2;
77     uint16_t ident3;
78     uint8_t cfi_len;
79     uint8_t cfi_table[0x52];
80     uint64_t counter;
81     unsigned int writeblock_size;
82     QEMUTimer *timer;
83     MemoryRegion mem;
84     char *name;
85     void *storage;
86 };
87 
88 static const VMStateDescription vmstate_pflash = {
89     .name = "pflash_cfi01",
90     .version_id = 1,
91     .minimum_version_id = 1,
92     .fields = (VMStateField[]) {
93         VMSTATE_UINT8(wcycle, pflash_t),
94         VMSTATE_UINT8(cmd, pflash_t),
95         VMSTATE_UINT8(status, pflash_t),
96         VMSTATE_UINT64(counter, pflash_t),
97         VMSTATE_END_OF_LIST()
98     }
99 };
100 
101 static void pflash_timer (void *opaque)
102 {
103     pflash_t *pfl = opaque;
104 
105     DPRINTF("%s: command %02x done\n", __func__, pfl->cmd);
106     /* Reset flash */
107     pfl->status ^= 0x80;
108     memory_region_rom_device_set_romd(&pfl->mem, true);
109     pfl->wcycle = 0;
110     pfl->cmd = 0;
111 }
112 
113 static uint32_t pflash_read (pflash_t *pfl, hwaddr offset,
114                              int width, int be)
115 {
116     hwaddr boff;
117     uint32_t ret;
118     uint8_t *p;
119 
120     ret = -1;
121     boff = offset & 0xFF; /* why this here ?? */
122 
123     if (pfl->width == 2)
124         boff = boff >> 1;
125     else if (pfl->width == 4)
126         boff = boff >> 2;
127 
128 #if 0
129     DPRINTF("%s: reading offset " TARGET_FMT_plx " under cmd %02x width %d\n",
130             __func__, offset, pfl->cmd, width);
131 #endif
132     switch (pfl->cmd) {
133     default:
134         /* This should never happen : reset state & treat it as a read */
135         DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);
136         pfl->wcycle = 0;
137         pfl->cmd = 0;
138         /* fall through to read code */
139     case 0x00:
140         /* Flash area read */
141         p = pfl->storage;
142         switch (width) {
143         case 1:
144             ret = p[offset];
145             DPRINTF("%s: data offset " TARGET_FMT_plx " %02x\n",
146                     __func__, offset, ret);
147             break;
148         case 2:
149             if (be) {
150                 ret = p[offset] << 8;
151                 ret |= p[offset + 1];
152             } else {
153                 ret = p[offset];
154                 ret |= p[offset + 1] << 8;
155             }
156             DPRINTF("%s: data offset " TARGET_FMT_plx " %04x\n",
157                     __func__, offset, ret);
158             break;
159         case 4:
160             if (be) {
161                 ret = p[offset] << 24;
162                 ret |= p[offset + 1] << 16;
163                 ret |= p[offset + 2] << 8;
164                 ret |= p[offset + 3];
165             } else {
166                 ret = p[offset];
167                 ret |= p[offset + 1] << 8;
168                 ret |= p[offset + 2] << 16;
169                 ret |= p[offset + 3] << 24;
170             }
171             DPRINTF("%s: data offset " TARGET_FMT_plx " %08x\n",
172                     __func__, offset, ret);
173             break;
174         default:
175             DPRINTF("BUG in %s\n", __func__);
176         }
177 
178         break;
179     case 0x10: /* Single byte program */
180     case 0x20: /* Block erase */
181     case 0x28: /* Block erase */
182     case 0x40: /* single byte program */
183     case 0x50: /* Clear status register */
184     case 0x60: /* Block /un)lock */
185     case 0x70: /* Status Register */
186     case 0xe8: /* Write block */
187         /* Status register read */
188         ret = pfl->status;
189         DPRINTF("%s: status %x\n", __func__, ret);
190         break;
191     case 0x90:
192         switch (boff) {
193         case 0:
194             ret = pfl->ident0 << 8 | pfl->ident1;
195             DPRINTF("%s: Manufacturer Code %04x\n", __func__, ret);
196             break;
197         case 1:
198             ret = pfl->ident2 << 8 | pfl->ident3;
199             DPRINTF("%s: Device ID Code %04x\n", __func__, ret);
200             break;
201         default:
202             DPRINTF("%s: Read Device Information boff=%x\n", __func__,
203                     (unsigned)boff);
204             ret = 0;
205             break;
206         }
207         break;
208     case 0x98: /* Query mode */
209         if (boff > pfl->cfi_len)
210             ret = 0;
211         else
212             ret = pfl->cfi_table[boff];
213         break;
214     }
215     return ret;
216 }
217 
218 /* update flash content on disk */
219 static void pflash_update(pflash_t *pfl, int offset,
220                           int size)
221 {
222     int offset_end;
223     if (pfl->bs) {
224         offset_end = offset + size;
225         /* round to sectors */
226         offset = offset >> 9;
227         offset_end = (offset_end + 511) >> 9;
228         bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),
229                    offset_end - offset);
230     }
231 }
232 
233 static inline void pflash_data_write(pflash_t *pfl, hwaddr offset,
234                                      uint32_t value, int width, int be)
235 {
236     uint8_t *p = pfl->storage;
237 
238     DPRINTF("%s: block write offset " TARGET_FMT_plx
239             " value %x counter %016" PRIx64 "\n",
240             __func__, offset, value, pfl->counter);
241     switch (width) {
242     case 1:
243         p[offset] = value;
244         break;
245     case 2:
246         if (be) {
247             p[offset] = value >> 8;
248             p[offset + 1] = value;
249         } else {
250             p[offset] = value;
251             p[offset + 1] = value >> 8;
252         }
253         break;
254     case 4:
255         if (be) {
256             p[offset] = value >> 24;
257             p[offset + 1] = value >> 16;
258             p[offset + 2] = value >> 8;
259             p[offset + 3] = value;
260         } else {
261             p[offset] = value;
262             p[offset + 1] = value >> 8;
263             p[offset + 2] = value >> 16;
264             p[offset + 3] = value >> 24;
265         }
266         break;
267     }
268 
269 }
270 
271 static void pflash_write(pflash_t *pfl, hwaddr offset,
272                          uint32_t value, int width, int be)
273 {
274     uint8_t *p;
275     uint8_t cmd;
276 
277     cmd = value;
278 
279     DPRINTF("%s: writing offset " TARGET_FMT_plx " value %08x width %d wcycle 0x%x\n",
280             __func__, offset, value, width, pfl->wcycle);
281 
282     if (!pfl->wcycle) {
283         /* Set the device in I/O access mode */
284         memory_region_rom_device_set_romd(&pfl->mem, false);
285     }
286 
287     switch (pfl->wcycle) {
288     case 0:
289         /* read mode */
290         switch (cmd) {
291         case 0x00: /* ??? */
292             goto reset_flash;
293         case 0x10: /* Single Byte Program */
294         case 0x40: /* Single Byte Program */
295             DPRINTF("%s: Single Byte Program\n", __func__);
296             break;
297         case 0x20: /* Block erase */
298             p = pfl->storage;
299             offset &= ~(pfl->sector_len - 1);
300 
301             DPRINTF("%s: block erase at " TARGET_FMT_plx " bytes %x\n",
302                     __func__, offset, (unsigned)pfl->sector_len);
303 
304             if (!pfl->ro) {
305                 memset(p + offset, 0xff, pfl->sector_len);
306                 pflash_update(pfl, offset, pfl->sector_len);
307             } else {
308                 pfl->status |= 0x20; /* Block erase error */
309             }
310             pfl->status |= 0x80; /* Ready! */
311             break;
312         case 0x50: /* Clear status bits */
313             DPRINTF("%s: Clear status bits\n", __func__);
314             pfl->status = 0x0;
315             goto reset_flash;
316         case 0x60: /* Block (un)lock */
317             DPRINTF("%s: Block unlock\n", __func__);
318             break;
319         case 0x70: /* Status Register */
320             DPRINTF("%s: Read status register\n", __func__);
321             pfl->cmd = cmd;
322             return;
323         case 0x90: /* Read Device ID */
324             DPRINTF("%s: Read Device information\n", __func__);
325             pfl->cmd = cmd;
326             return;
327         case 0x98: /* CFI query */
328             DPRINTF("%s: CFI query\n", __func__);
329             break;
330         case 0xe8: /* Write to buffer */
331             DPRINTF("%s: Write to buffer\n", __func__);
332             pfl->status |= 0x80; /* Ready! */
333             break;
334         case 0xf0: /* Probe for AMD flash */
335             DPRINTF("%s: Probe for AMD flash\n", __func__);
336             goto reset_flash;
337         case 0xff: /* Read array mode */
338             DPRINTF("%s: Read array mode\n", __func__);
339             goto reset_flash;
340         default:
341             goto error_flash;
342         }
343         pfl->wcycle++;
344         pfl->cmd = cmd;
345         break;
346     case 1:
347         switch (pfl->cmd) {
348         case 0x10: /* Single Byte Program */
349         case 0x40: /* Single Byte Program */
350             DPRINTF("%s: Single Byte Program\n", __func__);
351             if (!pfl->ro) {
352                 pflash_data_write(pfl, offset, value, width, be);
353                 pflash_update(pfl, offset, width);
354             } else {
355                 pfl->status |= 0x10; /* Programming error */
356             }
357             pfl->status |= 0x80; /* Ready! */
358             pfl->wcycle = 0;
359         break;
360         case 0x20: /* Block erase */
361         case 0x28:
362             if (cmd == 0xd0) { /* confirm */
363                 pfl->wcycle = 0;
364                 pfl->status |= 0x80;
365             } else if (cmd == 0xff) { /* read array mode */
366                 goto reset_flash;
367             } else
368                 goto error_flash;
369 
370             break;
371         case 0xe8:
372             DPRINTF("%s: block write of %x bytes\n", __func__, value);
373             pfl->counter = value;
374             pfl->wcycle++;
375             break;
376         case 0x60:
377             if (cmd == 0xd0) {
378                 pfl->wcycle = 0;
379                 pfl->status |= 0x80;
380             } else if (cmd == 0x01) {
381                 pfl->wcycle = 0;
382                 pfl->status |= 0x80;
383             } else if (cmd == 0xff) {
384                 goto reset_flash;
385             } else {
386                 DPRINTF("%s: Unknown (un)locking command\n", __func__);
387                 goto reset_flash;
388             }
389             break;
390         case 0x98:
391             if (cmd == 0xff) {
392                 goto reset_flash;
393             } else {
394                 DPRINTF("%s: leaving query mode\n", __func__);
395             }
396             break;
397         default:
398             goto error_flash;
399         }
400         break;
401     case 2:
402         switch (pfl->cmd) {
403         case 0xe8: /* Block write */
404             if (!pfl->ro) {
405                 pflash_data_write(pfl, offset, value, width, be);
406             } else {
407                 pfl->status |= 0x10; /* Programming error */
408             }
409 
410             pfl->status |= 0x80;
411 
412             if (!pfl->counter) {
413                 hwaddr mask = pfl->writeblock_size - 1;
414                 mask = ~mask;
415 
416                 DPRINTF("%s: block write finished\n", __func__);
417                 pfl->wcycle++;
418                 if (!pfl->ro) {
419                     /* Flush the entire write buffer onto backing storage.  */
420                     pflash_update(pfl, offset & mask, pfl->writeblock_size);
421                 } else {
422                     pfl->status |= 0x10; /* Programming error */
423                 }
424             }
425 
426             pfl->counter--;
427             break;
428         default:
429             goto error_flash;
430         }
431         break;
432     case 3: /* Confirm mode */
433         switch (pfl->cmd) {
434         case 0xe8: /* Block write */
435             if (cmd == 0xd0) {
436                 pfl->wcycle = 0;
437                 pfl->status |= 0x80;
438             } else {
439                 DPRINTF("%s: unknown command for \"write block\"\n", __func__);
440                 PFLASH_BUG("Write block confirm");
441                 goto reset_flash;
442             }
443             break;
444         default:
445             goto error_flash;
446         }
447         break;
448     default:
449         /* Should never happen */
450         DPRINTF("%s: invalid write state\n",  __func__);
451         goto reset_flash;
452     }
453     return;
454 
455  error_flash:
456     qemu_log_mask(LOG_UNIMP, "%s: Unimplemented flash cmd sequence "
457                   "(offset " TARGET_FMT_plx ", wcycle 0x%x cmd 0x%x value 0x%x)"
458                   "\n", __func__, offset, pfl->wcycle, pfl->cmd, value);
459 
460  reset_flash:
461     memory_region_rom_device_set_romd(&pfl->mem, true);
462 
463     pfl->wcycle = 0;
464     pfl->cmd = 0;
465 }
466 
467 
468 static uint32_t pflash_readb_be(void *opaque, hwaddr addr)
469 {
470     return pflash_read(opaque, addr, 1, 1);
471 }
472 
473 static uint32_t pflash_readb_le(void *opaque, hwaddr addr)
474 {
475     return pflash_read(opaque, addr, 1, 0);
476 }
477 
478 static uint32_t pflash_readw_be(void *opaque, hwaddr addr)
479 {
480     pflash_t *pfl = opaque;
481 
482     return pflash_read(pfl, addr, 2, 1);
483 }
484 
485 static uint32_t pflash_readw_le(void *opaque, hwaddr addr)
486 {
487     pflash_t *pfl = opaque;
488 
489     return pflash_read(pfl, addr, 2, 0);
490 }
491 
492 static uint32_t pflash_readl_be(void *opaque, hwaddr addr)
493 {
494     pflash_t *pfl = opaque;
495 
496     return pflash_read(pfl, addr, 4, 1);
497 }
498 
499 static uint32_t pflash_readl_le(void *opaque, hwaddr addr)
500 {
501     pflash_t *pfl = opaque;
502 
503     return pflash_read(pfl, addr, 4, 0);
504 }
505 
506 static void pflash_writeb_be(void *opaque, hwaddr addr,
507                              uint32_t value)
508 {
509     pflash_write(opaque, addr, value, 1, 1);
510 }
511 
512 static void pflash_writeb_le(void *opaque, hwaddr addr,
513                              uint32_t value)
514 {
515     pflash_write(opaque, addr, value, 1, 0);
516 }
517 
518 static void pflash_writew_be(void *opaque, hwaddr addr,
519                              uint32_t value)
520 {
521     pflash_t *pfl = opaque;
522 
523     pflash_write(pfl, addr, value, 2, 1);
524 }
525 
526 static void pflash_writew_le(void *opaque, hwaddr addr,
527                              uint32_t value)
528 {
529     pflash_t *pfl = opaque;
530 
531     pflash_write(pfl, addr, value, 2, 0);
532 }
533 
534 static void pflash_writel_be(void *opaque, hwaddr addr,
535                              uint32_t value)
536 {
537     pflash_t *pfl = opaque;
538 
539     pflash_write(pfl, addr, value, 4, 1);
540 }
541 
542 static void pflash_writel_le(void *opaque, hwaddr addr,
543                              uint32_t value)
544 {
545     pflash_t *pfl = opaque;
546 
547     pflash_write(pfl, addr, value, 4, 0);
548 }
549 
550 static const MemoryRegionOps pflash_cfi01_ops_be = {
551     .old_mmio = {
552         .read = { pflash_readb_be, pflash_readw_be, pflash_readl_be, },
553         .write = { pflash_writeb_be, pflash_writew_be, pflash_writel_be, },
554     },
555     .endianness = DEVICE_NATIVE_ENDIAN,
556 };
557 
558 static const MemoryRegionOps pflash_cfi01_ops_le = {
559     .old_mmio = {
560         .read = { pflash_readb_le, pflash_readw_le, pflash_readl_le, },
561         .write = { pflash_writeb_le, pflash_writew_le, pflash_writel_le, },
562     },
563     .endianness = DEVICE_NATIVE_ENDIAN,
564 };
565 
566 static int pflash_cfi01_init(SysBusDevice *dev)
567 {
568     pflash_t *pfl = FROM_SYSBUS(typeof(*pfl), dev);
569     uint64_t total_len;
570     int ret;
571 
572     total_len = pfl->sector_len * pfl->nb_blocs;
573 
574     /* XXX: to be fixed */
575 #if 0
576     if (total_len != (8 * 1024 * 1024) && total_len != (16 * 1024 * 1024) &&
577         total_len != (32 * 1024 * 1024) && total_len != (64 * 1024 * 1024))
578         return NULL;
579 #endif
580 
581     memory_region_init_rom_device(
582         &pfl->mem, pfl->be ? &pflash_cfi01_ops_be : &pflash_cfi01_ops_le, pfl,
583         pfl->name, total_len);
584     vmstate_register_ram(&pfl->mem, DEVICE(pfl));
585     pfl->storage = memory_region_get_ram_ptr(&pfl->mem);
586     sysbus_init_mmio(dev, &pfl->mem);
587 
588     if (pfl->bs) {
589         /* read the initial flash content */
590         ret = bdrv_read(pfl->bs, 0, pfl->storage, total_len >> 9);
591 
592         if (ret < 0) {
593             vmstate_unregister_ram(&pfl->mem, DEVICE(pfl));
594             memory_region_destroy(&pfl->mem);
595             return 1;
596         }
597     }
598 
599     if (pfl->bs) {
600         pfl->ro = bdrv_is_read_only(pfl->bs);
601     } else {
602         pfl->ro = 0;
603     }
604 
605     pfl->timer = qemu_new_timer_ns(vm_clock, pflash_timer, pfl);
606     pfl->wcycle = 0;
607     pfl->cmd = 0;
608     pfl->status = 0;
609     /* Hardcoded CFI table */
610     pfl->cfi_len = 0x52;
611     /* Standard "QRY" string */
612     pfl->cfi_table[0x10] = 'Q';
613     pfl->cfi_table[0x11] = 'R';
614     pfl->cfi_table[0x12] = 'Y';
615     /* Command set (Intel) */
616     pfl->cfi_table[0x13] = 0x01;
617     pfl->cfi_table[0x14] = 0x00;
618     /* Primary extended table address (none) */
619     pfl->cfi_table[0x15] = 0x31;
620     pfl->cfi_table[0x16] = 0x00;
621     /* Alternate command set (none) */
622     pfl->cfi_table[0x17] = 0x00;
623     pfl->cfi_table[0x18] = 0x00;
624     /* Alternate extended table (none) */
625     pfl->cfi_table[0x19] = 0x00;
626     pfl->cfi_table[0x1A] = 0x00;
627     /* Vcc min */
628     pfl->cfi_table[0x1B] = 0x45;
629     /* Vcc max */
630     pfl->cfi_table[0x1C] = 0x55;
631     /* Vpp min (no Vpp pin) */
632     pfl->cfi_table[0x1D] = 0x00;
633     /* Vpp max (no Vpp pin) */
634     pfl->cfi_table[0x1E] = 0x00;
635     /* Reserved */
636     pfl->cfi_table[0x1F] = 0x07;
637     /* Timeout for min size buffer write */
638     pfl->cfi_table[0x20] = 0x07;
639     /* Typical timeout for block erase */
640     pfl->cfi_table[0x21] = 0x0a;
641     /* Typical timeout for full chip erase (4096 ms) */
642     pfl->cfi_table[0x22] = 0x00;
643     /* Reserved */
644     pfl->cfi_table[0x23] = 0x04;
645     /* Max timeout for buffer write */
646     pfl->cfi_table[0x24] = 0x04;
647     /* Max timeout for block erase */
648     pfl->cfi_table[0x25] = 0x04;
649     /* Max timeout for chip erase */
650     pfl->cfi_table[0x26] = 0x00;
651     /* Device size */
652     pfl->cfi_table[0x27] = ctz32(total_len); // + 1;
653     /* Flash device interface (8 & 16 bits) */
654     pfl->cfi_table[0x28] = 0x02;
655     pfl->cfi_table[0x29] = 0x00;
656     /* Max number of bytes in multi-bytes write */
657     if (pfl->width == 1) {
658         pfl->cfi_table[0x2A] = 0x08;
659     } else {
660         pfl->cfi_table[0x2A] = 0x0B;
661     }
662     pfl->writeblock_size = 1 << pfl->cfi_table[0x2A];
663 
664     pfl->cfi_table[0x2B] = 0x00;
665     /* Number of erase block regions (uniform) */
666     pfl->cfi_table[0x2C] = 0x01;
667     /* Erase block region 1 */
668     pfl->cfi_table[0x2D] = pfl->nb_blocs - 1;
669     pfl->cfi_table[0x2E] = (pfl->nb_blocs - 1) >> 8;
670     pfl->cfi_table[0x2F] = pfl->sector_len >> 8;
671     pfl->cfi_table[0x30] = pfl->sector_len >> 16;
672 
673     /* Extended */
674     pfl->cfi_table[0x31] = 'P';
675     pfl->cfi_table[0x32] = 'R';
676     pfl->cfi_table[0x33] = 'I';
677 
678     pfl->cfi_table[0x34] = '1';
679     pfl->cfi_table[0x35] = '0';
680 
681     pfl->cfi_table[0x36] = 0x00;
682     pfl->cfi_table[0x37] = 0x00;
683     pfl->cfi_table[0x38] = 0x00;
684     pfl->cfi_table[0x39] = 0x00;
685 
686     pfl->cfi_table[0x3a] = 0x00;
687 
688     pfl->cfi_table[0x3b] = 0x00;
689     pfl->cfi_table[0x3c] = 0x00;
690 
691     pfl->cfi_table[0x3f] = 0x01; /* Number of protection fields */
692 
693     return 0;
694 }
695 
696 static Property pflash_cfi01_properties[] = {
697     DEFINE_PROP_DRIVE("drive", struct pflash_t, bs),
698     DEFINE_PROP_UINT32("num-blocks", struct pflash_t, nb_blocs, 0),
699     DEFINE_PROP_UINT64("sector-length", struct pflash_t, sector_len, 0),
700     DEFINE_PROP_UINT8("width", struct pflash_t, width, 0),
701     DEFINE_PROP_UINT8("big-endian", struct pflash_t, be, 0),
702     DEFINE_PROP_UINT16("id0", struct pflash_t, ident0, 0),
703     DEFINE_PROP_UINT16("id1", struct pflash_t, ident1, 0),
704     DEFINE_PROP_UINT16("id2", struct pflash_t, ident2, 0),
705     DEFINE_PROP_UINT16("id3", struct pflash_t, ident3, 0),
706     DEFINE_PROP_STRING("name", struct pflash_t, name),
707     DEFINE_PROP_END_OF_LIST(),
708 };
709 
710 static void pflash_cfi01_class_init(ObjectClass *klass, void *data)
711 {
712     DeviceClass *dc = DEVICE_CLASS(klass);
713     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
714 
715     k->init = pflash_cfi01_init;
716     dc->props = pflash_cfi01_properties;
717     dc->vmsd = &vmstate_pflash;
718 }
719 
720 
721 static const TypeInfo pflash_cfi01_info = {
722     .name           = "cfi.pflash01",
723     .parent         = TYPE_SYS_BUS_DEVICE,
724     .instance_size  = sizeof(struct pflash_t),
725     .class_init     = pflash_cfi01_class_init,
726 };
727 
728 static void pflash_cfi01_register_types(void)
729 {
730     type_register_static(&pflash_cfi01_info);
731 }
732 
733 type_init(pflash_cfi01_register_types)
734 
735 pflash_t *pflash_cfi01_register(hwaddr base,
736                                 DeviceState *qdev, const char *name,
737                                 hwaddr size,
738                                 BlockDriverState *bs,
739                                 uint32_t sector_len, int nb_blocs, int width,
740                                 uint16_t id0, uint16_t id1,
741                                 uint16_t id2, uint16_t id3, int be)
742 {
743     DeviceState *dev = qdev_create(NULL, "cfi.pflash01");
744     SysBusDevice *busdev = SYS_BUS_DEVICE(dev);
745     pflash_t *pfl = (pflash_t *)object_dynamic_cast(OBJECT(dev),
746                                                     "cfi.pflash01");
747 
748     if (bs && qdev_prop_set_drive(dev, "drive", bs)) {
749         abort();
750     }
751     qdev_prop_set_uint32(dev, "num-blocks", nb_blocs);
752     qdev_prop_set_uint64(dev, "sector-length", sector_len);
753     qdev_prop_set_uint8(dev, "width", width);
754     qdev_prop_set_uint8(dev, "big-endian", !!be);
755     qdev_prop_set_uint16(dev, "id0", id0);
756     qdev_prop_set_uint16(dev, "id1", id1);
757     qdev_prop_set_uint16(dev, "id2", id2);
758     qdev_prop_set_uint16(dev, "id3", id3);
759     qdev_prop_set_string(dev, "name", name);
760     qdev_init_nofail(dev);
761 
762     sysbus_mmio_map(busdev, 0, base);
763     return pfl;
764 }
765 
766 MemoryRegion *pflash_cfi01_get_memory(pflash_t *fl)
767 {
768     return &fl->mem;
769 }
770