1 /* 2 * CFI parallel flash with Intel command set emulation 3 * 4 * Copyright (c) 2006 Thorsten Zitterell 5 * Copyright (c) 2005 Jocelyn Mayer 6 * 7 * This library is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU Lesser General Public 9 * License as published by the Free Software Foundation; either 10 * version 2 of the License, or (at your option) any later version. 11 * 12 * This library is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 15 * Lesser General Public License for more details. 16 * 17 * You should have received a copy of the GNU Lesser General Public 18 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 19 */ 20 21 /* 22 * For now, this code can emulate flashes of 1, 2 or 4 bytes width. 23 * Supported commands/modes are: 24 * - flash read 25 * - flash write 26 * - flash ID read 27 * - sector erase 28 * - CFI queries 29 * 30 * It does not support timings 31 * It does not support flash interleaving 32 * It does not implement software data protection as found in many real chips 33 * It does not implement erase suspend/resume commands 34 * It does not implement multiple sectors erase 35 * 36 * It does not implement much more ... 37 */ 38 39 #include "qemu/osdep.h" 40 #include "hw/hw.h" 41 #include "hw/block/flash.h" 42 #include "sysemu/block-backend.h" 43 #include "qapi/error.h" 44 #include "qemu/timer.h" 45 #include "qemu/bitops.h" 46 #include "qemu/host-utils.h" 47 #include "qemu/log.h" 48 #include "hw/sysbus.h" 49 #include "sysemu/sysemu.h" 50 51 #define PFLASH_BUG(fmt, ...) \ 52 do { \ 53 fprintf(stderr, "PFLASH: Possible BUG - " fmt, ## __VA_ARGS__); \ 54 exit(1); \ 55 } while(0) 56 57 /* #define PFLASH_DEBUG */ 58 #ifdef PFLASH_DEBUG 59 #define DPRINTF(fmt, ...) \ 60 do { \ 61 fprintf(stderr, "PFLASH: " fmt , ## __VA_ARGS__); \ 62 } while (0) 63 #else 64 #define DPRINTF(fmt, ...) do { } while (0) 65 #endif 66 67 #define CFI_PFLASH01(obj) OBJECT_CHECK(pflash_t, (obj), TYPE_CFI_PFLASH01) 68 69 #define PFLASH_BE 0 70 #define PFLASH_SECURE 1 71 72 struct pflash_t { 73 /*< private >*/ 74 SysBusDevice parent_obj; 75 /*< public >*/ 76 77 BlockBackend *blk; 78 uint32_t nb_blocs; 79 uint64_t sector_len; 80 uint8_t bank_width; 81 uint8_t device_width; /* If 0, device width not specified. */ 82 uint8_t max_device_width; /* max device width in bytes */ 83 uint32_t features; 84 uint8_t wcycle; /* if 0, the flash is read normally */ 85 int ro; 86 uint8_t cmd; 87 uint8_t status; 88 uint16_t ident0; 89 uint16_t ident1; 90 uint16_t ident2; 91 uint16_t ident3; 92 uint8_t cfi_table[0x52]; 93 uint64_t counter; 94 unsigned int writeblock_size; 95 QEMUTimer *timer; 96 MemoryRegion mem; 97 char *name; 98 void *storage; 99 VMChangeStateEntry *vmstate; 100 bool old_multiple_chip_handling; 101 }; 102 103 static int pflash_post_load(void *opaque, int version_id); 104 105 static const VMStateDescription vmstate_pflash = { 106 .name = "pflash_cfi01", 107 .version_id = 1, 108 .minimum_version_id = 1, 109 .post_load = pflash_post_load, 110 .fields = (VMStateField[]) { 111 VMSTATE_UINT8(wcycle, pflash_t), 112 VMSTATE_UINT8(cmd, pflash_t), 113 VMSTATE_UINT8(status, pflash_t), 114 VMSTATE_UINT64(counter, pflash_t), 115 VMSTATE_END_OF_LIST() 116 } 117 }; 118 119 static void pflash_timer (void *opaque) 120 { 121 pflash_t *pfl = opaque; 122 123 DPRINTF("%s: command %02x done\n", __func__, pfl->cmd); 124 /* Reset flash */ 125 pfl->status ^= 0x80; 126 memory_region_rom_device_set_romd(&pfl->mem, true); 127 pfl->wcycle = 0; 128 pfl->cmd = 0; 129 } 130 131 /* Perform a CFI query based on the bank width of the flash. 132 * If this code is called we know we have a device_width set for 133 * this flash. 134 */ 135 static uint32_t pflash_cfi_query(pflash_t *pfl, hwaddr offset) 136 { 137 int i; 138 uint32_t resp = 0; 139 hwaddr boff; 140 141 /* Adjust incoming offset to match expected device-width 142 * addressing. CFI query addresses are always specified in terms of 143 * the maximum supported width of the device. This means that x8 144 * devices and x8/x16 devices in x8 mode behave differently. For 145 * devices that are not used at their max width, we will be 146 * provided with addresses that use higher address bits than 147 * expected (based on the max width), so we will shift them lower 148 * so that they will match the addresses used when 149 * device_width==max_device_width. 150 */ 151 boff = offset >> (ctz32(pfl->bank_width) + 152 ctz32(pfl->max_device_width) - ctz32(pfl->device_width)); 153 154 if (boff >= sizeof(pfl->cfi_table)) { 155 return 0; 156 } 157 /* Now we will construct the CFI response generated by a single 158 * device, then replicate that for all devices that make up the 159 * bus. For wide parts used in x8 mode, CFI query responses 160 * are different than native byte-wide parts. 161 */ 162 resp = pfl->cfi_table[boff]; 163 if (pfl->device_width != pfl->max_device_width) { 164 /* The only case currently supported is x8 mode for a 165 * wider part. 166 */ 167 if (pfl->device_width != 1 || pfl->bank_width > 4) { 168 DPRINTF("%s: Unsupported device configuration: " 169 "device_width=%d, max_device_width=%d\n", 170 __func__, pfl->device_width, 171 pfl->max_device_width); 172 return 0; 173 } 174 /* CFI query data is repeated, rather than zero padded for 175 * wide devices used in x8 mode. 176 */ 177 for (i = 1; i < pfl->max_device_width; i++) { 178 resp = deposit32(resp, 8 * i, 8, pfl->cfi_table[boff]); 179 } 180 } 181 /* Replicate responses for each device in bank. */ 182 if (pfl->device_width < pfl->bank_width) { 183 for (i = pfl->device_width; 184 i < pfl->bank_width; i += pfl->device_width) { 185 resp = deposit32(resp, 8 * i, 8 * pfl->device_width, resp); 186 } 187 } 188 189 return resp; 190 } 191 192 193 194 /* Perform a device id query based on the bank width of the flash. */ 195 static uint32_t pflash_devid_query(pflash_t *pfl, hwaddr offset) 196 { 197 int i; 198 uint32_t resp; 199 hwaddr boff; 200 201 /* Adjust incoming offset to match expected device-width 202 * addressing. Device ID read addresses are always specified in 203 * terms of the maximum supported width of the device. This means 204 * that x8 devices and x8/x16 devices in x8 mode behave 205 * differently. For devices that are not used at their max width, 206 * we will be provided with addresses that use higher address bits 207 * than expected (based on the max width), so we will shift them 208 * lower so that they will match the addresses used when 209 * device_width==max_device_width. 210 */ 211 boff = offset >> (ctz32(pfl->bank_width) + 212 ctz32(pfl->max_device_width) - ctz32(pfl->device_width)); 213 214 /* Mask off upper bits which may be used in to query block 215 * or sector lock status at other addresses. 216 * Offsets 2/3 are block lock status, is not emulated. 217 */ 218 switch (boff & 0xFF) { 219 case 0: 220 resp = pfl->ident0; 221 DPRINTF("%s: Manufacturer Code %04x\n", __func__, resp); 222 break; 223 case 1: 224 resp = pfl->ident1; 225 DPRINTF("%s: Device ID Code %04x\n", __func__, resp); 226 break; 227 default: 228 DPRINTF("%s: Read Device Information offset=%x\n", __func__, 229 (unsigned)offset); 230 return 0; 231 break; 232 } 233 /* Replicate responses for each device in bank. */ 234 if (pfl->device_width < pfl->bank_width) { 235 for (i = pfl->device_width; 236 i < pfl->bank_width; i += pfl->device_width) { 237 resp = deposit32(resp, 8 * i, 8 * pfl->device_width, resp); 238 } 239 } 240 241 return resp; 242 } 243 244 static uint32_t pflash_data_read(pflash_t *pfl, hwaddr offset, 245 int width, int be) 246 { 247 uint8_t *p; 248 uint32_t ret; 249 250 p = pfl->storage; 251 switch (width) { 252 case 1: 253 ret = p[offset]; 254 DPRINTF("%s: data offset " TARGET_FMT_plx " %02x\n", 255 __func__, offset, ret); 256 break; 257 case 2: 258 if (be) { 259 ret = p[offset] << 8; 260 ret |= p[offset + 1]; 261 } else { 262 ret = p[offset]; 263 ret |= p[offset + 1] << 8; 264 } 265 DPRINTF("%s: data offset " TARGET_FMT_plx " %04x\n", 266 __func__, offset, ret); 267 break; 268 case 4: 269 if (be) { 270 ret = p[offset] << 24; 271 ret |= p[offset + 1] << 16; 272 ret |= p[offset + 2] << 8; 273 ret |= p[offset + 3]; 274 } else { 275 ret = p[offset]; 276 ret |= p[offset + 1] << 8; 277 ret |= p[offset + 2] << 16; 278 ret |= p[offset + 3] << 24; 279 } 280 DPRINTF("%s: data offset " TARGET_FMT_plx " %08x\n", 281 __func__, offset, ret); 282 break; 283 default: 284 DPRINTF("BUG in %s\n", __func__); 285 abort(); 286 } 287 return ret; 288 } 289 290 static uint32_t pflash_read (pflash_t *pfl, hwaddr offset, 291 int width, int be) 292 { 293 hwaddr boff; 294 uint32_t ret; 295 296 ret = -1; 297 298 #if 0 299 DPRINTF("%s: reading offset " TARGET_FMT_plx " under cmd %02x width %d\n", 300 __func__, offset, pfl->cmd, width); 301 #endif 302 switch (pfl->cmd) { 303 default: 304 /* This should never happen : reset state & treat it as a read */ 305 DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd); 306 pfl->wcycle = 0; 307 pfl->cmd = 0; 308 /* fall through to read code */ 309 case 0x00: 310 /* Flash area read */ 311 ret = pflash_data_read(pfl, offset, width, be); 312 break; 313 case 0x10: /* Single byte program */ 314 case 0x20: /* Block erase */ 315 case 0x28: /* Block erase */ 316 case 0x40: /* single byte program */ 317 case 0x50: /* Clear status register */ 318 case 0x60: /* Block /un)lock */ 319 case 0x70: /* Status Register */ 320 case 0xe8: /* Write block */ 321 /* Status register read. Return status from each device in 322 * bank. 323 */ 324 ret = pfl->status; 325 if (pfl->device_width && width > pfl->device_width) { 326 int shift = pfl->device_width * 8; 327 while (shift + pfl->device_width * 8 <= width * 8) { 328 ret |= pfl->status << shift; 329 shift += pfl->device_width * 8; 330 } 331 } else if (!pfl->device_width && width > 2) { 332 /* Handle 32 bit flash cases where device width is not 333 * set. (Existing behavior before device width added.) 334 */ 335 ret |= pfl->status << 16; 336 } 337 DPRINTF("%s: status %x\n", __func__, ret); 338 break; 339 case 0x90: 340 if (!pfl->device_width) { 341 /* Preserve old behavior if device width not specified */ 342 boff = offset & 0xFF; 343 if (pfl->bank_width == 2) { 344 boff = boff >> 1; 345 } else if (pfl->bank_width == 4) { 346 boff = boff >> 2; 347 } 348 349 switch (boff) { 350 case 0: 351 ret = pfl->ident0 << 8 | pfl->ident1; 352 DPRINTF("%s: Manufacturer Code %04x\n", __func__, ret); 353 break; 354 case 1: 355 ret = pfl->ident2 << 8 | pfl->ident3; 356 DPRINTF("%s: Device ID Code %04x\n", __func__, ret); 357 break; 358 default: 359 DPRINTF("%s: Read Device Information boff=%x\n", __func__, 360 (unsigned)boff); 361 ret = 0; 362 break; 363 } 364 } else { 365 /* If we have a read larger than the bank_width, combine multiple 366 * manufacturer/device ID queries into a single response. 367 */ 368 int i; 369 for (i = 0; i < width; i += pfl->bank_width) { 370 ret = deposit32(ret, i * 8, pfl->bank_width * 8, 371 pflash_devid_query(pfl, 372 offset + i * pfl->bank_width)); 373 } 374 } 375 break; 376 case 0x98: /* Query mode */ 377 if (!pfl->device_width) { 378 /* Preserve old behavior if device width not specified */ 379 boff = offset & 0xFF; 380 if (pfl->bank_width == 2) { 381 boff = boff >> 1; 382 } else if (pfl->bank_width == 4) { 383 boff = boff >> 2; 384 } 385 386 if (boff < sizeof(pfl->cfi_table)) { 387 ret = pfl->cfi_table[boff]; 388 } else { 389 ret = 0; 390 } 391 } else { 392 /* If we have a read larger than the bank_width, combine multiple 393 * CFI queries into a single response. 394 */ 395 int i; 396 for (i = 0; i < width; i += pfl->bank_width) { 397 ret = deposit32(ret, i * 8, pfl->bank_width * 8, 398 pflash_cfi_query(pfl, 399 offset + i * pfl->bank_width)); 400 } 401 } 402 403 break; 404 } 405 return ret; 406 } 407 408 /* update flash content on disk */ 409 static void pflash_update(pflash_t *pfl, int offset, 410 int size) 411 { 412 int offset_end; 413 if (pfl->blk) { 414 offset_end = offset + size; 415 /* widen to sector boundaries */ 416 offset = QEMU_ALIGN_DOWN(offset, BDRV_SECTOR_SIZE); 417 offset_end = QEMU_ALIGN_UP(offset_end, BDRV_SECTOR_SIZE); 418 blk_pwrite(pfl->blk, offset, pfl->storage + offset, 419 offset_end - offset, 0); 420 } 421 } 422 423 static inline void pflash_data_write(pflash_t *pfl, hwaddr offset, 424 uint32_t value, int width, int be) 425 { 426 uint8_t *p = pfl->storage; 427 428 DPRINTF("%s: block write offset " TARGET_FMT_plx 429 " value %x counter %016" PRIx64 "\n", 430 __func__, offset, value, pfl->counter); 431 switch (width) { 432 case 1: 433 p[offset] = value; 434 break; 435 case 2: 436 if (be) { 437 p[offset] = value >> 8; 438 p[offset + 1] = value; 439 } else { 440 p[offset] = value; 441 p[offset + 1] = value >> 8; 442 } 443 break; 444 case 4: 445 if (be) { 446 p[offset] = value >> 24; 447 p[offset + 1] = value >> 16; 448 p[offset + 2] = value >> 8; 449 p[offset + 3] = value; 450 } else { 451 p[offset] = value; 452 p[offset + 1] = value >> 8; 453 p[offset + 2] = value >> 16; 454 p[offset + 3] = value >> 24; 455 } 456 break; 457 } 458 459 } 460 461 static void pflash_write(pflash_t *pfl, hwaddr offset, 462 uint32_t value, int width, int be) 463 { 464 uint8_t *p; 465 uint8_t cmd; 466 467 cmd = value; 468 469 DPRINTF("%s: writing offset " TARGET_FMT_plx " value %08x width %d wcycle 0x%x\n", 470 __func__, offset, value, width, pfl->wcycle); 471 472 if (!pfl->wcycle) { 473 /* Set the device in I/O access mode */ 474 memory_region_rom_device_set_romd(&pfl->mem, false); 475 } 476 477 switch (pfl->wcycle) { 478 case 0: 479 /* read mode */ 480 switch (cmd) { 481 case 0x00: /* ??? */ 482 goto reset_flash; 483 case 0x10: /* Single Byte Program */ 484 case 0x40: /* Single Byte Program */ 485 DPRINTF("%s: Single Byte Program\n", __func__); 486 break; 487 case 0x20: /* Block erase */ 488 p = pfl->storage; 489 offset &= ~(pfl->sector_len - 1); 490 491 DPRINTF("%s: block erase at " TARGET_FMT_plx " bytes %x\n", 492 __func__, offset, (unsigned)pfl->sector_len); 493 494 if (!pfl->ro) { 495 memset(p + offset, 0xff, pfl->sector_len); 496 pflash_update(pfl, offset, pfl->sector_len); 497 } else { 498 pfl->status |= 0x20; /* Block erase error */ 499 } 500 pfl->status |= 0x80; /* Ready! */ 501 break; 502 case 0x50: /* Clear status bits */ 503 DPRINTF("%s: Clear status bits\n", __func__); 504 pfl->status = 0x0; 505 goto reset_flash; 506 case 0x60: /* Block (un)lock */ 507 DPRINTF("%s: Block unlock\n", __func__); 508 break; 509 case 0x70: /* Status Register */ 510 DPRINTF("%s: Read status register\n", __func__); 511 pfl->cmd = cmd; 512 return; 513 case 0x90: /* Read Device ID */ 514 DPRINTF("%s: Read Device information\n", __func__); 515 pfl->cmd = cmd; 516 return; 517 case 0x98: /* CFI query */ 518 DPRINTF("%s: CFI query\n", __func__); 519 break; 520 case 0xe8: /* Write to buffer */ 521 DPRINTF("%s: Write to buffer\n", __func__); 522 pfl->status |= 0x80; /* Ready! */ 523 break; 524 case 0xf0: /* Probe for AMD flash */ 525 DPRINTF("%s: Probe for AMD flash\n", __func__); 526 goto reset_flash; 527 case 0xff: /* Read array mode */ 528 DPRINTF("%s: Read array mode\n", __func__); 529 goto reset_flash; 530 default: 531 goto error_flash; 532 } 533 pfl->wcycle++; 534 pfl->cmd = cmd; 535 break; 536 case 1: 537 switch (pfl->cmd) { 538 case 0x10: /* Single Byte Program */ 539 case 0x40: /* Single Byte Program */ 540 DPRINTF("%s: Single Byte Program\n", __func__); 541 if (!pfl->ro) { 542 pflash_data_write(pfl, offset, value, width, be); 543 pflash_update(pfl, offset, width); 544 } else { 545 pfl->status |= 0x10; /* Programming error */ 546 } 547 pfl->status |= 0x80; /* Ready! */ 548 pfl->wcycle = 0; 549 break; 550 case 0x20: /* Block erase */ 551 case 0x28: 552 if (cmd == 0xd0) { /* confirm */ 553 pfl->wcycle = 0; 554 pfl->status |= 0x80; 555 } else if (cmd == 0xff) { /* read array mode */ 556 goto reset_flash; 557 } else 558 goto error_flash; 559 560 break; 561 case 0xe8: 562 /* Mask writeblock size based on device width, or bank width if 563 * device width not specified. 564 */ 565 if (pfl->device_width) { 566 value = extract32(value, 0, pfl->device_width * 8); 567 } else { 568 value = extract32(value, 0, pfl->bank_width * 8); 569 } 570 DPRINTF("%s: block write of %x bytes\n", __func__, value); 571 pfl->counter = value; 572 pfl->wcycle++; 573 break; 574 case 0x60: 575 if (cmd == 0xd0) { 576 pfl->wcycle = 0; 577 pfl->status |= 0x80; 578 } else if (cmd == 0x01) { 579 pfl->wcycle = 0; 580 pfl->status |= 0x80; 581 } else if (cmd == 0xff) { 582 goto reset_flash; 583 } else { 584 DPRINTF("%s: Unknown (un)locking command\n", __func__); 585 goto reset_flash; 586 } 587 break; 588 case 0x98: 589 if (cmd == 0xff) { 590 goto reset_flash; 591 } else { 592 DPRINTF("%s: leaving query mode\n", __func__); 593 } 594 break; 595 default: 596 goto error_flash; 597 } 598 break; 599 case 2: 600 switch (pfl->cmd) { 601 case 0xe8: /* Block write */ 602 if (!pfl->ro) { 603 pflash_data_write(pfl, offset, value, width, be); 604 } else { 605 pfl->status |= 0x10; /* Programming error */ 606 } 607 608 pfl->status |= 0x80; 609 610 if (!pfl->counter) { 611 hwaddr mask = pfl->writeblock_size - 1; 612 mask = ~mask; 613 614 DPRINTF("%s: block write finished\n", __func__); 615 pfl->wcycle++; 616 if (!pfl->ro) { 617 /* Flush the entire write buffer onto backing storage. */ 618 pflash_update(pfl, offset & mask, pfl->writeblock_size); 619 } else { 620 pfl->status |= 0x10; /* Programming error */ 621 } 622 } 623 624 pfl->counter--; 625 break; 626 default: 627 goto error_flash; 628 } 629 break; 630 case 3: /* Confirm mode */ 631 switch (pfl->cmd) { 632 case 0xe8: /* Block write */ 633 if (cmd == 0xd0) { 634 pfl->wcycle = 0; 635 pfl->status |= 0x80; 636 } else { 637 DPRINTF("%s: unknown command for \"write block\"\n", __func__); 638 PFLASH_BUG("Write block confirm"); 639 goto reset_flash; 640 } 641 break; 642 default: 643 goto error_flash; 644 } 645 break; 646 default: 647 /* Should never happen */ 648 DPRINTF("%s: invalid write state\n", __func__); 649 goto reset_flash; 650 } 651 return; 652 653 error_flash: 654 qemu_log_mask(LOG_UNIMP, "%s: Unimplemented flash cmd sequence " 655 "(offset " TARGET_FMT_plx ", wcycle 0x%x cmd 0x%x value 0x%x)" 656 "\n", __func__, offset, pfl->wcycle, pfl->cmd, value); 657 658 reset_flash: 659 memory_region_rom_device_set_romd(&pfl->mem, true); 660 661 pfl->wcycle = 0; 662 pfl->cmd = 0; 663 } 664 665 666 static MemTxResult pflash_mem_read_with_attrs(void *opaque, hwaddr addr, uint64_t *value, 667 unsigned len, MemTxAttrs attrs) 668 { 669 pflash_t *pfl = opaque; 670 bool be = !!(pfl->features & (1 << PFLASH_BE)); 671 672 if ((pfl->features & (1 << PFLASH_SECURE)) && !attrs.secure) { 673 *value = pflash_data_read(opaque, addr, len, be); 674 } else { 675 *value = pflash_read(opaque, addr, len, be); 676 } 677 return MEMTX_OK; 678 } 679 680 static MemTxResult pflash_mem_write_with_attrs(void *opaque, hwaddr addr, uint64_t value, 681 unsigned len, MemTxAttrs attrs) 682 { 683 pflash_t *pfl = opaque; 684 bool be = !!(pfl->features & (1 << PFLASH_BE)); 685 686 if ((pfl->features & (1 << PFLASH_SECURE)) && !attrs.secure) { 687 return MEMTX_ERROR; 688 } else { 689 pflash_write(opaque, addr, value, len, be); 690 return MEMTX_OK; 691 } 692 } 693 694 static const MemoryRegionOps pflash_cfi01_ops = { 695 .read_with_attrs = pflash_mem_read_with_attrs, 696 .write_with_attrs = pflash_mem_write_with_attrs, 697 .endianness = DEVICE_NATIVE_ENDIAN, 698 }; 699 700 static void pflash_cfi01_realize(DeviceState *dev, Error **errp) 701 { 702 pflash_t *pfl = CFI_PFLASH01(dev); 703 uint64_t total_len; 704 int ret; 705 uint64_t blocks_per_device, sector_len_per_device, device_len; 706 int num_devices; 707 Error *local_err = NULL; 708 709 if (pfl->sector_len == 0) { 710 error_setg(errp, "attribute \"sector-length\" not specified or zero."); 711 return; 712 } 713 if (pfl->nb_blocs == 0) { 714 error_setg(errp, "attribute \"num-blocks\" not specified or zero."); 715 return; 716 } 717 if (pfl->name == NULL) { 718 error_setg(errp, "attribute \"name\" not specified."); 719 return; 720 } 721 722 total_len = pfl->sector_len * pfl->nb_blocs; 723 724 /* These are only used to expose the parameters of each device 725 * in the cfi_table[]. 726 */ 727 num_devices = pfl->device_width ? (pfl->bank_width / pfl->device_width) : 1; 728 if (pfl->old_multiple_chip_handling) { 729 blocks_per_device = pfl->nb_blocs / num_devices; 730 sector_len_per_device = pfl->sector_len; 731 } else { 732 blocks_per_device = pfl->nb_blocs; 733 sector_len_per_device = pfl->sector_len / num_devices; 734 } 735 device_len = sector_len_per_device * blocks_per_device; 736 737 /* XXX: to be fixed */ 738 #if 0 739 if (total_len != (8 * 1024 * 1024) && total_len != (16 * 1024 * 1024) && 740 total_len != (32 * 1024 * 1024) && total_len != (64 * 1024 * 1024)) 741 return NULL; 742 #endif 743 744 memory_region_init_rom_device( 745 &pfl->mem, OBJECT(dev), 746 &pflash_cfi01_ops, 747 pfl, 748 pfl->name, total_len, &local_err); 749 if (local_err) { 750 error_propagate(errp, local_err); 751 return; 752 } 753 754 pfl->storage = memory_region_get_ram_ptr(&pfl->mem); 755 sysbus_init_mmio(SYS_BUS_DEVICE(dev), &pfl->mem); 756 757 if (pfl->blk) { 758 uint64_t perm; 759 pfl->ro = blk_is_read_only(pfl->blk); 760 perm = BLK_PERM_CONSISTENT_READ | (pfl->ro ? 0 : BLK_PERM_WRITE); 761 ret = blk_set_perm(pfl->blk, perm, BLK_PERM_ALL, errp); 762 if (ret < 0) { 763 return; 764 } 765 } else { 766 pfl->ro = 0; 767 } 768 769 if (pfl->blk) { 770 /* read the initial flash content */ 771 ret = blk_pread(pfl->blk, 0, pfl->storage, total_len); 772 773 if (ret < 0) { 774 vmstate_unregister_ram(&pfl->mem, DEVICE(pfl)); 775 error_setg(errp, "failed to read the initial flash content"); 776 return; 777 } 778 } 779 780 /* Default to devices being used at their maximum device width. This was 781 * assumed before the device_width support was added. 782 */ 783 if (!pfl->max_device_width) { 784 pfl->max_device_width = pfl->device_width; 785 } 786 787 pfl->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, pflash_timer, pfl); 788 pfl->wcycle = 0; 789 pfl->cmd = 0; 790 pfl->status = 0; 791 /* Hardcoded CFI table */ 792 /* Standard "QRY" string */ 793 pfl->cfi_table[0x10] = 'Q'; 794 pfl->cfi_table[0x11] = 'R'; 795 pfl->cfi_table[0x12] = 'Y'; 796 /* Command set (Intel) */ 797 pfl->cfi_table[0x13] = 0x01; 798 pfl->cfi_table[0x14] = 0x00; 799 /* Primary extended table address (none) */ 800 pfl->cfi_table[0x15] = 0x31; 801 pfl->cfi_table[0x16] = 0x00; 802 /* Alternate command set (none) */ 803 pfl->cfi_table[0x17] = 0x00; 804 pfl->cfi_table[0x18] = 0x00; 805 /* Alternate extended table (none) */ 806 pfl->cfi_table[0x19] = 0x00; 807 pfl->cfi_table[0x1A] = 0x00; 808 /* Vcc min */ 809 pfl->cfi_table[0x1B] = 0x45; 810 /* Vcc max */ 811 pfl->cfi_table[0x1C] = 0x55; 812 /* Vpp min (no Vpp pin) */ 813 pfl->cfi_table[0x1D] = 0x00; 814 /* Vpp max (no Vpp pin) */ 815 pfl->cfi_table[0x1E] = 0x00; 816 /* Reserved */ 817 pfl->cfi_table[0x1F] = 0x07; 818 /* Timeout for min size buffer write */ 819 pfl->cfi_table[0x20] = 0x07; 820 /* Typical timeout for block erase */ 821 pfl->cfi_table[0x21] = 0x0a; 822 /* Typical timeout for full chip erase (4096 ms) */ 823 pfl->cfi_table[0x22] = 0x00; 824 /* Reserved */ 825 pfl->cfi_table[0x23] = 0x04; 826 /* Max timeout for buffer write */ 827 pfl->cfi_table[0x24] = 0x04; 828 /* Max timeout for block erase */ 829 pfl->cfi_table[0x25] = 0x04; 830 /* Max timeout for chip erase */ 831 pfl->cfi_table[0x26] = 0x00; 832 /* Device size */ 833 pfl->cfi_table[0x27] = ctz32(device_len); /* + 1; */ 834 /* Flash device interface (8 & 16 bits) */ 835 pfl->cfi_table[0x28] = 0x02; 836 pfl->cfi_table[0x29] = 0x00; 837 /* Max number of bytes in multi-bytes write */ 838 if (pfl->bank_width == 1) { 839 pfl->cfi_table[0x2A] = 0x08; 840 } else { 841 pfl->cfi_table[0x2A] = 0x0B; 842 } 843 pfl->writeblock_size = 1 << pfl->cfi_table[0x2A]; 844 if (!pfl->old_multiple_chip_handling && num_devices > 1) { 845 pfl->writeblock_size *= num_devices; 846 } 847 848 pfl->cfi_table[0x2B] = 0x00; 849 /* Number of erase block regions (uniform) */ 850 pfl->cfi_table[0x2C] = 0x01; 851 /* Erase block region 1 */ 852 pfl->cfi_table[0x2D] = blocks_per_device - 1; 853 pfl->cfi_table[0x2E] = (blocks_per_device - 1) >> 8; 854 pfl->cfi_table[0x2F] = sector_len_per_device >> 8; 855 pfl->cfi_table[0x30] = sector_len_per_device >> 16; 856 857 /* Extended */ 858 pfl->cfi_table[0x31] = 'P'; 859 pfl->cfi_table[0x32] = 'R'; 860 pfl->cfi_table[0x33] = 'I'; 861 862 pfl->cfi_table[0x34] = '1'; 863 pfl->cfi_table[0x35] = '0'; 864 865 pfl->cfi_table[0x36] = 0x00; 866 pfl->cfi_table[0x37] = 0x00; 867 pfl->cfi_table[0x38] = 0x00; 868 pfl->cfi_table[0x39] = 0x00; 869 870 pfl->cfi_table[0x3a] = 0x00; 871 872 pfl->cfi_table[0x3b] = 0x00; 873 pfl->cfi_table[0x3c] = 0x00; 874 875 pfl->cfi_table[0x3f] = 0x01; /* Number of protection fields */ 876 } 877 878 static Property pflash_cfi01_properties[] = { 879 DEFINE_PROP_DRIVE("drive", struct pflash_t, blk), 880 /* num-blocks is the number of blocks actually visible to the guest, 881 * ie the total size of the device divided by the sector length. 882 * If we're emulating flash devices wired in parallel the actual 883 * number of blocks per indvidual device will differ. 884 */ 885 DEFINE_PROP_UINT32("num-blocks", struct pflash_t, nb_blocs, 0), 886 DEFINE_PROP_UINT64("sector-length", struct pflash_t, sector_len, 0), 887 /* width here is the overall width of this QEMU device in bytes. 888 * The QEMU device may be emulating a number of flash devices 889 * wired up in parallel; the width of each individual flash 890 * device should be specified via device-width. If the individual 891 * devices have a maximum width which is greater than the width 892 * they are being used for, this maximum width should be set via 893 * max-device-width (which otherwise defaults to device-width). 894 * So for instance a 32-bit wide QEMU flash device made from four 895 * 16-bit flash devices used in 8-bit wide mode would be configured 896 * with width = 4, device-width = 1, max-device-width = 2. 897 * 898 * If device-width is not specified we default to backwards 899 * compatible behaviour which is a bad emulation of two 900 * 16 bit devices making up a 32 bit wide QEMU device. This 901 * is deprecated for new uses of this device. 902 */ 903 DEFINE_PROP_UINT8("width", struct pflash_t, bank_width, 0), 904 DEFINE_PROP_UINT8("device-width", struct pflash_t, device_width, 0), 905 DEFINE_PROP_UINT8("max-device-width", struct pflash_t, max_device_width, 0), 906 DEFINE_PROP_BIT("big-endian", struct pflash_t, features, PFLASH_BE, 0), 907 DEFINE_PROP_BIT("secure", struct pflash_t, features, PFLASH_SECURE, 0), 908 DEFINE_PROP_UINT16("id0", struct pflash_t, ident0, 0), 909 DEFINE_PROP_UINT16("id1", struct pflash_t, ident1, 0), 910 DEFINE_PROP_UINT16("id2", struct pflash_t, ident2, 0), 911 DEFINE_PROP_UINT16("id3", struct pflash_t, ident3, 0), 912 DEFINE_PROP_STRING("name", struct pflash_t, name), 913 DEFINE_PROP_BOOL("old-multiple-chip-handling", struct pflash_t, 914 old_multiple_chip_handling, false), 915 DEFINE_PROP_END_OF_LIST(), 916 }; 917 918 static void pflash_cfi01_class_init(ObjectClass *klass, void *data) 919 { 920 DeviceClass *dc = DEVICE_CLASS(klass); 921 922 dc->realize = pflash_cfi01_realize; 923 dc->props = pflash_cfi01_properties; 924 dc->vmsd = &vmstate_pflash; 925 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 926 } 927 928 929 static const TypeInfo pflash_cfi01_info = { 930 .name = TYPE_CFI_PFLASH01, 931 .parent = TYPE_SYS_BUS_DEVICE, 932 .instance_size = sizeof(struct pflash_t), 933 .class_init = pflash_cfi01_class_init, 934 }; 935 936 static void pflash_cfi01_register_types(void) 937 { 938 type_register_static(&pflash_cfi01_info); 939 } 940 941 type_init(pflash_cfi01_register_types) 942 943 pflash_t *pflash_cfi01_register(hwaddr base, 944 DeviceState *qdev, const char *name, 945 hwaddr size, 946 BlockBackend *blk, 947 uint32_t sector_len, int nb_blocs, 948 int bank_width, uint16_t id0, uint16_t id1, 949 uint16_t id2, uint16_t id3, int be) 950 { 951 DeviceState *dev = qdev_create(NULL, TYPE_CFI_PFLASH01); 952 953 if (blk) { 954 qdev_prop_set_drive(dev, "drive", blk, &error_abort); 955 } 956 qdev_prop_set_uint32(dev, "num-blocks", nb_blocs); 957 qdev_prop_set_uint64(dev, "sector-length", sector_len); 958 qdev_prop_set_uint8(dev, "width", bank_width); 959 qdev_prop_set_bit(dev, "big-endian", !!be); 960 qdev_prop_set_uint16(dev, "id0", id0); 961 qdev_prop_set_uint16(dev, "id1", id1); 962 qdev_prop_set_uint16(dev, "id2", id2); 963 qdev_prop_set_uint16(dev, "id3", id3); 964 qdev_prop_set_string(dev, "name", name); 965 qdev_init_nofail(dev); 966 967 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base); 968 return CFI_PFLASH01(dev); 969 } 970 971 MemoryRegion *pflash_cfi01_get_memory(pflash_t *fl) 972 { 973 return &fl->mem; 974 } 975 976 static void postload_update_cb(void *opaque, int running, RunState state) 977 { 978 pflash_t *pfl = opaque; 979 980 /* This is called after bdrv_invalidate_cache_all. */ 981 qemu_del_vm_change_state_handler(pfl->vmstate); 982 pfl->vmstate = NULL; 983 984 DPRINTF("%s: updating bdrv for %s\n", __func__, pfl->name); 985 pflash_update(pfl, 0, pfl->sector_len * pfl->nb_blocs); 986 } 987 988 static int pflash_post_load(void *opaque, int version_id) 989 { 990 pflash_t *pfl = opaque; 991 992 if (!pfl->ro) { 993 pfl->vmstate = qemu_add_vm_change_state_handler(postload_update_cb, 994 pfl); 995 } 996 return 0; 997 } 998