xref: /openbmc/qemu/hw/block/pflash_cfi02.c (revision 4c4465ff)
1 /*
2  *  CFI parallel flash with AMD command set emulation
3  *
4  *  Copyright (c) 2005 Jocelyn Mayer
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  */
19 
20 /*
21  * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
22  * Supported commands/modes are:
23  * - flash read
24  * - flash write
25  * - flash ID read
26  * - sector erase
27  * - chip erase
28  * - unlock bypass command
29  * - CFI queries
30  *
31  * It does not support flash interleaving.
32  * It does not implement software data protection as found in many real chips
33  */
34 
35 #include "qemu/osdep.h"
36 #include "hw/block/block.h"
37 #include "hw/block/flash.h"
38 #include "hw/qdev-properties.h"
39 #include "hw/qdev-properties-system.h"
40 #include "qapi/error.h"
41 #include "qemu/error-report.h"
42 #include "qemu/bitmap.h"
43 #include "qemu/timer.h"
44 #include "sysemu/block-backend.h"
45 #include "qemu/host-utils.h"
46 #include "qemu/module.h"
47 #include "hw/sysbus.h"
48 #include "migration/vmstate.h"
49 #include "trace.h"
50 
51 #define PFLASH_DEBUG false
52 #define DPRINTF(fmt, ...)                                  \
53 do {                                                       \
54     if (PFLASH_DEBUG) {                                    \
55         fprintf(stderr, "PFLASH: " fmt, ## __VA_ARGS__);   \
56     }                                                      \
57 } while (0)
58 
59 #define PFLASH_LAZY_ROMD_THRESHOLD 42
60 
61 /*
62  * The size of the cfi_table indirectly depends on this and the start of the
63  * PRI table directly depends on it. 4 is the maximum size (and also what
64  * seems common) without changing the PRT table address.
65  */
66 #define PFLASH_MAX_ERASE_REGIONS 4
67 
68 /* Special write cycles for CFI queries. */
69 enum {
70     WCYCLE_CFI              = 7,
71     WCYCLE_AUTOSELECT_CFI   = 8,
72 };
73 
74 struct PFlashCFI02 {
75     /*< private >*/
76     SysBusDevice parent_obj;
77     /*< public >*/
78 
79     BlockBackend *blk;
80     uint32_t uniform_nb_blocs;
81     uint32_t uniform_sector_len;
82     uint32_t total_sectors;
83     uint32_t nb_blocs[PFLASH_MAX_ERASE_REGIONS];
84     uint32_t sector_len[PFLASH_MAX_ERASE_REGIONS];
85     uint32_t chip_len;
86     uint8_t mappings;
87     uint8_t width;
88     uint8_t be;
89     int wcycle; /* if 0, the flash is read normally */
90     int bypass;
91     int ro;
92     uint8_t cmd;
93     uint8_t status;
94     /* FIXME: implement array device properties */
95     uint16_t ident0;
96     uint16_t ident1;
97     uint16_t ident2;
98     uint16_t ident3;
99     uint16_t unlock_addr0;
100     uint16_t unlock_addr1;
101     uint8_t cfi_table[0x4d];
102     QEMUTimer timer;
103     /* The device replicates the flash memory across its memory space.  Emulate
104      * that by having a container (.mem) filled with an array of aliases
105      * (.mem_mappings) pointing to the flash memory (.orig_mem).
106      */
107     MemoryRegion mem;
108     MemoryRegion *mem_mappings;    /* array; one per mapping */
109     MemoryRegion orig_mem;
110     int rom_mode;
111     int read_counter; /* used for lazy switch-back to rom mode */
112     int sectors_to_erase;
113     uint64_t erase_time_remaining;
114     unsigned long *sector_erase_map;
115     char *name;
116     void *storage;
117 };
118 
119 /*
120  * Toggle status bit DQ7.
121  */
122 static inline void toggle_dq7(PFlashCFI02 *pfl)
123 {
124     pfl->status ^= 0x80;
125 }
126 
127 /*
128  * Set status bit DQ7 to bit 7 of value.
129  */
130 static inline void set_dq7(PFlashCFI02 *pfl, uint8_t value)
131 {
132     pfl->status &= 0x7F;
133     pfl->status |= value & 0x80;
134 }
135 
136 /*
137  * Toggle status bit DQ6.
138  */
139 static inline void toggle_dq6(PFlashCFI02 *pfl)
140 {
141     pfl->status ^= 0x40;
142 }
143 
144 /*
145  * Turn on DQ3.
146  */
147 static inline void assert_dq3(PFlashCFI02 *pfl)
148 {
149     pfl->status |= 0x08;
150 }
151 
152 /*
153  * Turn off DQ3.
154  */
155 static inline void reset_dq3(PFlashCFI02 *pfl)
156 {
157     pfl->status &= ~0x08;
158 }
159 
160 /*
161  * Toggle status bit DQ2.
162  */
163 static inline void toggle_dq2(PFlashCFI02 *pfl)
164 {
165     pfl->status ^= 0x04;
166 }
167 
168 /*
169  * Set up replicated mappings of the same region.
170  */
171 static void pflash_setup_mappings(PFlashCFI02 *pfl)
172 {
173     unsigned i;
174     hwaddr size = memory_region_size(&pfl->orig_mem);
175 
176     memory_region_init(&pfl->mem, OBJECT(pfl), "pflash", pfl->mappings * size);
177     pfl->mem_mappings = g_new(MemoryRegion, pfl->mappings);
178     for (i = 0; i < pfl->mappings; ++i) {
179         memory_region_init_alias(&pfl->mem_mappings[i], OBJECT(pfl),
180                                  "pflash-alias", &pfl->orig_mem, 0, size);
181         memory_region_add_subregion(&pfl->mem, i * size, &pfl->mem_mappings[i]);
182     }
183 }
184 
185 static void pflash_register_memory(PFlashCFI02 *pfl, int rom_mode)
186 {
187     memory_region_rom_device_set_romd(&pfl->orig_mem, rom_mode);
188     pfl->rom_mode = rom_mode;
189 }
190 
191 static size_t pflash_regions_count(PFlashCFI02 *pfl)
192 {
193     return pfl->cfi_table[0x2c];
194 }
195 
196 /*
197  * Returns the time it takes to erase the number of sectors scheduled for
198  * erasure based on CFI address 0x21 which is "Typical timeout per individual
199  * block erase 2^N ms."
200  */
201 static uint64_t pflash_erase_time(PFlashCFI02 *pfl)
202 {
203     /*
204      * If there are no sectors to erase (which can happen if all of the sectors
205      * to be erased are protected), then erase takes 100 us. Protected sectors
206      * aren't supported so this should never happen.
207      */
208     return ((1ULL << pfl->cfi_table[0x21]) * pfl->sectors_to_erase) * SCALE_US;
209 }
210 
211 /*
212  * Returns true if the device is currently in erase suspend mode.
213  */
214 static inline bool pflash_erase_suspend_mode(PFlashCFI02 *pfl)
215 {
216     return pfl->erase_time_remaining > 0;
217 }
218 
219 static void pflash_timer(void *opaque)
220 {
221     PFlashCFI02 *pfl = opaque;
222 
223     trace_pflash_timer_expired(pfl->cmd);
224     if (pfl->cmd == 0x30) {
225         /*
226          * Sector erase. If DQ3 is 0 when the timer expires, then the 50
227          * us erase timeout has expired so we need to start the timer for the
228          * sector erase algorithm. Otherwise, the erase completed and we should
229          * go back to read array mode.
230          */
231         if ((pfl->status & 0x08) == 0) {
232             assert_dq3(pfl);
233             uint64_t timeout = pflash_erase_time(pfl);
234             timer_mod(&pfl->timer,
235                       qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + timeout);
236             DPRINTF("%s: erase timeout fired; erasing %d sectors\n",
237                     __func__, pfl->sectors_to_erase);
238             return;
239         }
240         DPRINTF("%s: sector erase complete\n", __func__);
241         bitmap_zero(pfl->sector_erase_map, pfl->total_sectors);
242         pfl->sectors_to_erase = 0;
243         reset_dq3(pfl);
244     }
245 
246     /* Reset flash */
247     toggle_dq7(pfl);
248     if (pfl->bypass) {
249         pfl->wcycle = 2;
250     } else {
251         pflash_register_memory(pfl, 1);
252         pfl->wcycle = 0;
253     }
254     pfl->cmd = 0;
255 }
256 
257 /*
258  * Read data from flash.
259  */
260 static uint64_t pflash_data_read(PFlashCFI02 *pfl, hwaddr offset,
261                                  unsigned int width)
262 {
263     uint8_t *p = (uint8_t *)pfl->storage + offset;
264     uint64_t ret = pfl->be ? ldn_be_p(p, width) : ldn_le_p(p, width);
265     trace_pflash_data_read(offset, width, ret);
266     return ret;
267 }
268 
269 typedef struct {
270     uint32_t len;
271     uint32_t num;
272 } SectorInfo;
273 
274 /*
275  * offset should be a byte offset of the QEMU device and _not_ a device
276  * offset.
277  */
278 static SectorInfo pflash_sector_info(PFlashCFI02 *pfl, hwaddr offset)
279 {
280     assert(offset < pfl->chip_len);
281     hwaddr addr = 0;
282     uint32_t sector_num = 0;
283     for (int i = 0; i < pflash_regions_count(pfl); ++i) {
284         uint64_t region_size = (uint64_t)pfl->nb_blocs[i] * pfl->sector_len[i];
285         if (addr <= offset && offset < addr + region_size) {
286             return (SectorInfo) {
287                 .len = pfl->sector_len[i],
288                 .num = sector_num + (offset - addr) / pfl->sector_len[i],
289             };
290         }
291         sector_num += pfl->nb_blocs[i];
292         addr += region_size;
293     }
294     abort();
295 }
296 
297 /*
298  * Returns true if the offset refers to a flash sector that is currently being
299  * erased.
300  */
301 static bool pflash_sector_is_erasing(PFlashCFI02 *pfl, hwaddr offset)
302 {
303     long sector_num = pflash_sector_info(pfl, offset).num;
304     return test_bit(sector_num, pfl->sector_erase_map);
305 }
306 
307 static uint64_t pflash_read(void *opaque, hwaddr offset, unsigned int width)
308 {
309     PFlashCFI02 *pfl = opaque;
310     hwaddr boff;
311     uint64_t ret;
312 
313     /* Lazy reset to ROMD mode after a certain amount of read accesses */
314     if (!pfl->rom_mode && pfl->wcycle == 0 &&
315         ++pfl->read_counter > PFLASH_LAZY_ROMD_THRESHOLD) {
316         pflash_register_memory(pfl, 1);
317     }
318     offset &= pfl->chip_len - 1;
319     boff = offset & 0xFF;
320     if (pfl->width == 2) {
321         boff = boff >> 1;
322     } else if (pfl->width == 4) {
323         boff = boff >> 2;
324     }
325     switch (pfl->cmd) {
326     default:
327         /* This should never happen : reset state & treat it as a read*/
328         DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);
329         pfl->wcycle = 0;
330         pfl->cmd = 0;
331         /* fall through to the read code */
332     case 0x80: /* Erase (unlock) */
333         /* We accept reads during second unlock sequence... */
334     case 0x00:
335         if (pflash_erase_suspend_mode(pfl) &&
336             pflash_sector_is_erasing(pfl, offset)) {
337             /* Toggle bit 2, but not 6. */
338             toggle_dq2(pfl);
339             /* Status register read */
340             ret = pfl->status;
341             DPRINTF("%s: status %" PRIx64 "\n", __func__, ret);
342             break;
343         }
344         /* Flash area read */
345         ret = pflash_data_read(pfl, offset, width);
346         break;
347     case 0x90: /* flash ID read */
348         switch (boff) {
349         case 0x00:
350         case 0x01:
351             ret = boff & 0x01 ? pfl->ident1 : pfl->ident0;
352             break;
353         case 0x02:
354             ret = 0x00; /* Pretend all sectors are unprotected */
355             break;
356         case 0x0E:
357         case 0x0F:
358             ret = boff & 0x01 ? pfl->ident3 : pfl->ident2;
359             if (ret != (uint8_t)-1) {
360                 break;
361             }
362             /* Fall through to data read. */
363         default:
364             ret = pflash_data_read(pfl, offset, width);
365         }
366         DPRINTF("%s: ID " TARGET_FMT_plx " %" PRIx64 "\n", __func__, boff, ret);
367         break;
368     case 0x10: /* Chip Erase */
369     case 0x30: /* Sector Erase */
370         /* Toggle bit 2 during erase, but not program. */
371         toggle_dq2(pfl);
372         /* fall through */
373     case 0xA0: /* Program */
374         /* Toggle bit 6 */
375         toggle_dq6(pfl);
376         /* Status register read */
377         ret = pfl->status;
378         DPRINTF("%s: status %" PRIx64 "\n", __func__, ret);
379         break;
380     case 0x98:
381         /* CFI query mode */
382         if (boff < sizeof(pfl->cfi_table)) {
383             ret = pfl->cfi_table[boff];
384         } else {
385             ret = 0;
386         }
387         break;
388     }
389     trace_pflash_io_read(offset, width, ret, pfl->cmd, pfl->wcycle);
390 
391     return ret;
392 }
393 
394 /* update flash content on disk */
395 static void pflash_update(PFlashCFI02 *pfl, int offset, int size)
396 {
397     int offset_end;
398     int ret;
399     if (pfl->blk) {
400         offset_end = offset + size;
401         /* widen to sector boundaries */
402         offset = QEMU_ALIGN_DOWN(offset, BDRV_SECTOR_SIZE);
403         offset_end = QEMU_ALIGN_UP(offset_end, BDRV_SECTOR_SIZE);
404         ret = blk_pwrite(pfl->blk, offset, pfl->storage + offset,
405                    offset_end - offset, 0);
406         if (ret < 0) {
407             /* TODO set error bit in status */
408             error_report("Could not update PFLASH: %s", strerror(-ret));
409         }
410     }
411 }
412 
413 static void pflash_sector_erase(PFlashCFI02 *pfl, hwaddr offset)
414 {
415     SectorInfo sector_info = pflash_sector_info(pfl, offset);
416     uint64_t sector_len = sector_info.len;
417     offset &= ~(sector_len - 1);
418     DPRINTF("%s: start sector erase at %0*" PRIx64 "-%0*" PRIx64 "\n",
419             __func__, pfl->width * 2, offset,
420             pfl->width * 2, offset + sector_len - 1);
421     if (!pfl->ro) {
422         uint8_t *p = pfl->storage;
423         memset(p + offset, 0xff, sector_len);
424         pflash_update(pfl, offset, sector_len);
425     }
426     set_dq7(pfl, 0x00);
427     ++pfl->sectors_to_erase;
428     set_bit(sector_info.num, pfl->sector_erase_map);
429     /* Set (or reset) the 50 us timer for additional erase commands.  */
430     timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 50000);
431 }
432 
433 static void pflash_write(void *opaque, hwaddr offset, uint64_t value,
434                          unsigned int width)
435 {
436     PFlashCFI02 *pfl = opaque;
437     hwaddr boff;
438     uint8_t *p;
439     uint8_t cmd;
440 
441     trace_pflash_io_write(offset, width, value, pfl->wcycle);
442     cmd = value;
443     if (pfl->cmd != 0xA0) {
444         /* Reset does nothing during chip erase and sector erase. */
445         if (cmd == 0xF0 && pfl->cmd != 0x10 && pfl->cmd != 0x30) {
446             if (pfl->wcycle == WCYCLE_AUTOSELECT_CFI) {
447                 /* Return to autoselect mode. */
448                 pfl->wcycle = 3;
449                 pfl->cmd = 0x90;
450                 return;
451             }
452             goto reset_flash;
453         }
454     }
455     offset &= pfl->chip_len - 1;
456 
457     boff = offset;
458     if (pfl->width == 2) {
459         boff = boff >> 1;
460     } else if (pfl->width == 4) {
461         boff = boff >> 2;
462     }
463     /* Only the least-significant 11 bits are used in most cases. */
464     boff &= 0x7FF;
465     switch (pfl->wcycle) {
466     case 0:
467         /* Set the device in I/O access mode if required */
468         if (pfl->rom_mode)
469             pflash_register_memory(pfl, 0);
470         pfl->read_counter = 0;
471         /* We're in read mode */
472     check_unlock0:
473         if (boff == 0x55 && cmd == 0x98) {
474             /* Enter CFI query mode */
475             pfl->wcycle = WCYCLE_CFI;
476             pfl->cmd = 0x98;
477             return;
478         }
479         /* Handle erase resume in erase suspend mode, otherwise reset. */
480         if (cmd == 0x30) { /* Erase Resume */
481             if (pflash_erase_suspend_mode(pfl)) {
482                 /* Resume the erase. */
483                 timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
484                           pfl->erase_time_remaining);
485                 pfl->erase_time_remaining = 0;
486                 pfl->wcycle = 6;
487                 pfl->cmd = 0x30;
488                 set_dq7(pfl, 0x00);
489                 assert_dq3(pfl);
490                 return;
491             }
492             goto reset_flash;
493         }
494         /* Ignore erase suspend. */
495         if (cmd == 0xB0) { /* Erase Suspend */
496             return;
497         }
498         if (boff != pfl->unlock_addr0 || cmd != 0xAA) {
499             DPRINTF("%s: unlock0 failed " TARGET_FMT_plx " %02x %04x\n",
500                     __func__, boff, cmd, pfl->unlock_addr0);
501             goto reset_flash;
502         }
503         DPRINTF("%s: unlock sequence started\n", __func__);
504         break;
505     case 1:
506         /* We started an unlock sequence */
507     check_unlock1:
508         if (boff != pfl->unlock_addr1 || cmd != 0x55) {
509             DPRINTF("%s: unlock1 failed " TARGET_FMT_plx " %02x\n", __func__,
510                     boff, cmd);
511             goto reset_flash;
512         }
513         DPRINTF("%s: unlock sequence done\n", __func__);
514         break;
515     case 2:
516         /* We finished an unlock sequence */
517         if (!pfl->bypass && boff != pfl->unlock_addr0) {
518             DPRINTF("%s: command failed " TARGET_FMT_plx " %02x\n", __func__,
519                     boff, cmd);
520             goto reset_flash;
521         }
522         switch (cmd) {
523         case 0x20:
524             pfl->bypass = 1;
525             goto do_bypass;
526         case 0x80: /* Erase */
527         case 0x90: /* Autoselect */
528         case 0xA0: /* Program */
529             pfl->cmd = cmd;
530             DPRINTF("%s: starting command %02x\n", __func__, cmd);
531             break;
532         default:
533             DPRINTF("%s: unknown command %02x\n", __func__, cmd);
534             goto reset_flash;
535         }
536         break;
537     case 3:
538         switch (pfl->cmd) {
539         case 0x80: /* Erase */
540             /* We need another unlock sequence */
541             goto check_unlock0;
542         case 0xA0: /* Program */
543             if (pflash_erase_suspend_mode(pfl) &&
544                 pflash_sector_is_erasing(pfl, offset)) {
545                 /* Ignore writes to erasing sectors. */
546                 if (pfl->bypass) {
547                     goto do_bypass;
548                 }
549                 goto reset_flash;
550             }
551             trace_pflash_data_write(offset, width, value, 0);
552             if (!pfl->ro) {
553                 p = (uint8_t *)pfl->storage + offset;
554                 if (pfl->be) {
555                     uint64_t current = ldn_be_p(p, width);
556                     stn_be_p(p, width, current & value);
557                 } else {
558                     uint64_t current = ldn_le_p(p, width);
559                     stn_le_p(p, width, current & value);
560                 }
561                 pflash_update(pfl, offset, width);
562             }
563             /*
564              * While programming, status bit DQ7 should hold the opposite
565              * value from how it was programmed.
566              */
567             set_dq7(pfl, ~value);
568             /* Let's pretend write is immediate */
569             if (pfl->bypass)
570                 goto do_bypass;
571             goto reset_flash;
572         case 0x90: /* Autoselect */
573             if (pfl->bypass && cmd == 0x00) {
574                 /* Unlock bypass reset */
575                 goto reset_flash;
576             }
577             /*
578              * We can enter CFI query mode from autoselect mode, but we must
579              * return to autoselect mode after a reset.
580              */
581             if (boff == 0x55 && cmd == 0x98) {
582                 /* Enter autoselect CFI query mode */
583                 pfl->wcycle = WCYCLE_AUTOSELECT_CFI;
584                 pfl->cmd = 0x98;
585                 return;
586             }
587             /* fall through */
588         default:
589             DPRINTF("%s: invalid write for command %02x\n",
590                     __func__, pfl->cmd);
591             goto reset_flash;
592         }
593     case 4:
594         switch (pfl->cmd) {
595         case 0xA0: /* Program */
596             /* Ignore writes while flash data write is occurring */
597             /* As we suppose write is immediate, this should never happen */
598             return;
599         case 0x80: /* Erase */
600             goto check_unlock1;
601         default:
602             /* Should never happen */
603             DPRINTF("%s: invalid command state %02x (wc 4)\n",
604                     __func__, pfl->cmd);
605             goto reset_flash;
606         }
607         break;
608     case 5:
609         if (pflash_erase_suspend_mode(pfl)) {
610             /* Erasing is not supported in erase suspend mode. */
611             goto reset_flash;
612         }
613         switch (cmd) {
614         case 0x10: /* Chip Erase */
615             if (boff != pfl->unlock_addr0) {
616                 DPRINTF("%s: chip erase: invalid address " TARGET_FMT_plx "\n",
617                         __func__, offset);
618                 goto reset_flash;
619             }
620             /* Chip erase */
621             DPRINTF("%s: start chip erase\n", __func__);
622             if (!pfl->ro) {
623                 memset(pfl->storage, 0xff, pfl->chip_len);
624                 pflash_update(pfl, 0, pfl->chip_len);
625             }
626             set_dq7(pfl, 0x00);
627             /* Wait the time specified at CFI address 0x22. */
628             timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
629                       (1ULL << pfl->cfi_table[0x22]) * SCALE_MS);
630             break;
631         case 0x30: /* Sector erase */
632             pflash_sector_erase(pfl, offset);
633             break;
634         default:
635             DPRINTF("%s: invalid command %02x (wc 5)\n", __func__, cmd);
636             goto reset_flash;
637         }
638         pfl->cmd = cmd;
639         break;
640     case 6:
641         switch (pfl->cmd) {
642         case 0x10: /* Chip Erase */
643             /* Ignore writes during chip erase */
644             return;
645         case 0x30: /* Sector erase */
646             if (cmd == 0xB0) {
647                 /*
648                  * If erase suspend happens during the erase timeout (so DQ3 is
649                  * 0), then the device suspends erasing immediately. Set the
650                  * remaining time to be the total time to erase. Otherwise,
651                  * there is a maximum amount of time it can take to enter
652                  * suspend mode. Let's ignore that and suspend immediately and
653                  * set the remaining time to the actual time remaining on the
654                  * timer.
655                  */
656                 if ((pfl->status & 0x08) == 0) {
657                     pfl->erase_time_remaining = pflash_erase_time(pfl);
658                 } else {
659                     int64_t delta = timer_expire_time_ns(&pfl->timer) -
660                         qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
661                     /* Make sure we have a positive time remaining. */
662                     pfl->erase_time_remaining = delta <= 0 ? 1 : delta;
663                 }
664                 reset_dq3(pfl);
665                 timer_del(&pfl->timer);
666                 pfl->wcycle = 0;
667                 pfl->cmd = 0;
668                 return;
669             }
670             /*
671              * If DQ3 is 0, additional sector erase commands can be
672              * written and anything else (other than an erase suspend) resets
673              * the device.
674              */
675             if ((pfl->status & 0x08) == 0) {
676                 if (cmd == 0x30) {
677                     pflash_sector_erase(pfl, offset);
678                 } else {
679                     goto reset_flash;
680                 }
681             }
682             /* Ignore writes during the actual erase. */
683             return;
684         default:
685             /* Should never happen */
686             DPRINTF("%s: invalid command state %02x (wc 6)\n",
687                     __func__, pfl->cmd);
688             goto reset_flash;
689         }
690         break;
691     /* Special values for CFI queries */
692     case WCYCLE_CFI:
693     case WCYCLE_AUTOSELECT_CFI:
694         DPRINTF("%s: invalid write in CFI query mode\n", __func__);
695         goto reset_flash;
696     default:
697         /* Should never happen */
698         DPRINTF("%s: invalid write state (wc 7)\n",  __func__);
699         goto reset_flash;
700     }
701     pfl->wcycle++;
702 
703     return;
704 
705     /* Reset flash */
706  reset_flash:
707     trace_pflash_reset();
708     pfl->bypass = 0;
709     pfl->wcycle = 0;
710     pfl->cmd = 0;
711     return;
712 
713  do_bypass:
714     pfl->wcycle = 2;
715     pfl->cmd = 0;
716 }
717 
718 static const MemoryRegionOps pflash_cfi02_ops = {
719     .read = pflash_read,
720     .write = pflash_write,
721     .valid.min_access_size = 1,
722     .valid.max_access_size = 4,
723     .endianness = DEVICE_NATIVE_ENDIAN,
724 };
725 
726 static void pflash_cfi02_realize(DeviceState *dev, Error **errp)
727 {
728     ERRP_GUARD();
729     PFlashCFI02 *pfl = PFLASH_CFI02(dev);
730     int ret;
731 
732     if (pfl->uniform_sector_len == 0 && pfl->sector_len[0] == 0) {
733         error_setg(errp, "attribute \"sector-length\" not specified or zero.");
734         return;
735     }
736     if (pfl->uniform_nb_blocs == 0 && pfl->nb_blocs[0] == 0) {
737         error_setg(errp, "attribute \"num-blocks\" not specified or zero.");
738         return;
739     }
740     if (pfl->name == NULL) {
741         error_setg(errp, "attribute \"name\" not specified.");
742         return;
743     }
744 
745     int nb_regions;
746     pfl->chip_len = 0;
747     pfl->total_sectors = 0;
748     for (nb_regions = 0; nb_regions < PFLASH_MAX_ERASE_REGIONS; ++nb_regions) {
749         if (pfl->nb_blocs[nb_regions] == 0) {
750             break;
751         }
752         pfl->total_sectors += pfl->nb_blocs[nb_regions];
753         uint64_t sector_len_per_device = pfl->sector_len[nb_regions];
754 
755         /*
756          * The size of each flash sector must be a power of 2 and it must be
757          * aligned at the same power of 2.
758          */
759         if (sector_len_per_device & 0xff ||
760             sector_len_per_device >= (1 << 24) ||
761             !is_power_of_2(sector_len_per_device))
762         {
763             error_setg(errp, "unsupported configuration: "
764                        "sector length[%d] per device = %" PRIx64 ".",
765                        nb_regions, sector_len_per_device);
766             return;
767         }
768         if (pfl->chip_len & (sector_len_per_device - 1)) {
769             error_setg(errp, "unsupported configuration: "
770                        "flash region %d not correctly aligned.",
771                        nb_regions);
772             return;
773         }
774 
775         pfl->chip_len += (uint64_t)pfl->sector_len[nb_regions] *
776                           pfl->nb_blocs[nb_regions];
777     }
778 
779     uint64_t uniform_len = (uint64_t)pfl->uniform_nb_blocs *
780                            pfl->uniform_sector_len;
781     if (nb_regions == 0) {
782         nb_regions = 1;
783         pfl->nb_blocs[0] = pfl->uniform_nb_blocs;
784         pfl->sector_len[0] = pfl->uniform_sector_len;
785         pfl->chip_len = uniform_len;
786         pfl->total_sectors = pfl->uniform_nb_blocs;
787     } else if (uniform_len != 0 && uniform_len != pfl->chip_len) {
788         error_setg(errp, "\"num-blocks\"*\"sector-length\" "
789                    "different from \"num-blocks0\"*\'sector-length0\" + ... + "
790                    "\"num-blocks3\"*\"sector-length3\"");
791         return;
792     }
793 
794     memory_region_init_rom_device(&pfl->orig_mem, OBJECT(pfl),
795                                   &pflash_cfi02_ops, pfl, pfl->name,
796                                   pfl->chip_len, errp);
797     if (*errp) {
798         return;
799     }
800 
801     pfl->storage = memory_region_get_ram_ptr(&pfl->orig_mem);
802 
803     if (pfl->blk) {
804         uint64_t perm;
805         pfl->ro = blk_is_read_only(pfl->blk);
806         perm = BLK_PERM_CONSISTENT_READ | (pfl->ro ? 0 : BLK_PERM_WRITE);
807         ret = blk_set_perm(pfl->blk, perm, BLK_PERM_ALL, errp);
808         if (ret < 0) {
809             return;
810         }
811     } else {
812         pfl->ro = 0;
813     }
814 
815     if (pfl->blk) {
816         if (!blk_check_size_and_read_all(pfl->blk, pfl->storage,
817                                          pfl->chip_len, errp)) {
818             vmstate_unregister_ram(&pfl->orig_mem, DEVICE(pfl));
819             return;
820         }
821     }
822 
823     /* Only 11 bits are used in the comparison. */
824     pfl->unlock_addr0 &= 0x7FF;
825     pfl->unlock_addr1 &= 0x7FF;
826 
827     /* Allocate memory for a bitmap for sectors being erased. */
828     pfl->sector_erase_map = bitmap_new(pfl->total_sectors);
829 
830     pflash_setup_mappings(pfl);
831     pfl->rom_mode = 1;
832     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &pfl->mem);
833 
834     timer_init_ns(&pfl->timer, QEMU_CLOCK_VIRTUAL, pflash_timer, pfl);
835     pfl->wcycle = 0;
836     pfl->cmd = 0;
837     pfl->status = 0;
838 
839     /* Hardcoded CFI table (mostly from SG29 Spansion flash) */
840     const uint16_t pri_ofs = 0x40;
841     /* Standard "QRY" string */
842     pfl->cfi_table[0x10] = 'Q';
843     pfl->cfi_table[0x11] = 'R';
844     pfl->cfi_table[0x12] = 'Y';
845     /* Command set (AMD/Fujitsu) */
846     pfl->cfi_table[0x13] = 0x02;
847     pfl->cfi_table[0x14] = 0x00;
848     /* Primary extended table address */
849     pfl->cfi_table[0x15] = pri_ofs;
850     pfl->cfi_table[0x16] = pri_ofs >> 8;
851     /* Alternate command set (none) */
852     pfl->cfi_table[0x17] = 0x00;
853     pfl->cfi_table[0x18] = 0x00;
854     /* Alternate extended table (none) */
855     pfl->cfi_table[0x19] = 0x00;
856     pfl->cfi_table[0x1A] = 0x00;
857     /* Vcc min */
858     pfl->cfi_table[0x1B] = 0x27;
859     /* Vcc max */
860     pfl->cfi_table[0x1C] = 0x36;
861     /* Vpp min (no Vpp pin) */
862     pfl->cfi_table[0x1D] = 0x00;
863     /* Vpp max (no Vpp pin) */
864     pfl->cfi_table[0x1E] = 0x00;
865     /* Timeout per single byte/word write (128 ms) */
866     pfl->cfi_table[0x1F] = 0x07;
867     /* Timeout for min size buffer write (NA) */
868     pfl->cfi_table[0x20] = 0x00;
869     /* Typical timeout for block erase (512 ms) */
870     pfl->cfi_table[0x21] = 0x09;
871     /* Typical timeout for full chip erase (4096 ms) */
872     pfl->cfi_table[0x22] = 0x0C;
873     /* Reserved */
874     pfl->cfi_table[0x23] = 0x01;
875     /* Max timeout for buffer write (NA) */
876     pfl->cfi_table[0x24] = 0x00;
877     /* Max timeout for block erase */
878     pfl->cfi_table[0x25] = 0x0A;
879     /* Max timeout for chip erase */
880     pfl->cfi_table[0x26] = 0x0D;
881     /* Device size */
882     pfl->cfi_table[0x27] = ctz32(pfl->chip_len);
883     /* Flash device interface (8 & 16 bits) */
884     pfl->cfi_table[0x28] = 0x02;
885     pfl->cfi_table[0x29] = 0x00;
886     /* Max number of bytes in multi-bytes write */
887     /* XXX: disable buffered write as it's not supported */
888     //    pfl->cfi_table[0x2A] = 0x05;
889     pfl->cfi_table[0x2A] = 0x00;
890     pfl->cfi_table[0x2B] = 0x00;
891     /* Number of erase block regions */
892     pfl->cfi_table[0x2c] = nb_regions;
893     /* Erase block regions */
894     for (int i = 0; i < nb_regions; ++i) {
895         uint32_t sector_len_per_device = pfl->sector_len[i];
896         pfl->cfi_table[0x2d + 4 * i] = pfl->nb_blocs[i] - 1;
897         pfl->cfi_table[0x2e + 4 * i] = (pfl->nb_blocs[i] - 1) >> 8;
898         pfl->cfi_table[0x2f + 4 * i] = sector_len_per_device >> 8;
899         pfl->cfi_table[0x30 + 4 * i] = sector_len_per_device >> 16;
900     }
901     assert(0x2c + 4 * nb_regions < pri_ofs);
902 
903     /* Extended */
904     pfl->cfi_table[0x00 + pri_ofs] = 'P';
905     pfl->cfi_table[0x01 + pri_ofs] = 'R';
906     pfl->cfi_table[0x02 + pri_ofs] = 'I';
907 
908     /* Extended version 1.0 */
909     pfl->cfi_table[0x03 + pri_ofs] = '1';
910     pfl->cfi_table[0x04 + pri_ofs] = '0';
911 
912     /* Address sensitive unlock required. */
913     pfl->cfi_table[0x05 + pri_ofs] = 0x00;
914     /* Erase suspend to read/write. */
915     pfl->cfi_table[0x06 + pri_ofs] = 0x02;
916     /* Sector protect not supported. */
917     pfl->cfi_table[0x07 + pri_ofs] = 0x00;
918     /* Temporary sector unprotect not supported. */
919     pfl->cfi_table[0x08 + pri_ofs] = 0x00;
920 
921     /* Sector protect/unprotect scheme. */
922     pfl->cfi_table[0x09 + pri_ofs] = 0x00;
923 
924     /* Simultaneous operation not supported. */
925     pfl->cfi_table[0x0a + pri_ofs] = 0x00;
926     /* Burst mode not supported. */
927     pfl->cfi_table[0x0b + pri_ofs] = 0x00;
928     /* Page mode not supported. */
929     pfl->cfi_table[0x0c + pri_ofs] = 0x00;
930     assert(0x0c + pri_ofs < ARRAY_SIZE(pfl->cfi_table));
931 }
932 
933 static Property pflash_cfi02_properties[] = {
934     DEFINE_PROP_DRIVE("drive", PFlashCFI02, blk),
935     DEFINE_PROP_UINT32("num-blocks", PFlashCFI02, uniform_nb_blocs, 0),
936     DEFINE_PROP_UINT32("sector-length", PFlashCFI02, uniform_sector_len, 0),
937     DEFINE_PROP_UINT32("num-blocks0", PFlashCFI02, nb_blocs[0], 0),
938     DEFINE_PROP_UINT32("sector-length0", PFlashCFI02, sector_len[0], 0),
939     DEFINE_PROP_UINT32("num-blocks1", PFlashCFI02, nb_blocs[1], 0),
940     DEFINE_PROP_UINT32("sector-length1", PFlashCFI02, sector_len[1], 0),
941     DEFINE_PROP_UINT32("num-blocks2", PFlashCFI02, nb_blocs[2], 0),
942     DEFINE_PROP_UINT32("sector-length2", PFlashCFI02, sector_len[2], 0),
943     DEFINE_PROP_UINT32("num-blocks3", PFlashCFI02, nb_blocs[3], 0),
944     DEFINE_PROP_UINT32("sector-length3", PFlashCFI02, sector_len[3], 0),
945     DEFINE_PROP_UINT8("width", PFlashCFI02, width, 0),
946     DEFINE_PROP_UINT8("mappings", PFlashCFI02, mappings, 0),
947     DEFINE_PROP_UINT8("big-endian", PFlashCFI02, be, 0),
948     DEFINE_PROP_UINT16("id0", PFlashCFI02, ident0, 0),
949     DEFINE_PROP_UINT16("id1", PFlashCFI02, ident1, 0),
950     DEFINE_PROP_UINT16("id2", PFlashCFI02, ident2, 0),
951     DEFINE_PROP_UINT16("id3", PFlashCFI02, ident3, 0),
952     DEFINE_PROP_UINT16("unlock-addr0", PFlashCFI02, unlock_addr0, 0),
953     DEFINE_PROP_UINT16("unlock-addr1", PFlashCFI02, unlock_addr1, 0),
954     DEFINE_PROP_STRING("name", PFlashCFI02, name),
955     DEFINE_PROP_END_OF_LIST(),
956 };
957 
958 static void pflash_cfi02_unrealize(DeviceState *dev)
959 {
960     PFlashCFI02 *pfl = PFLASH_CFI02(dev);
961     timer_del(&pfl->timer);
962     g_free(pfl->sector_erase_map);
963 }
964 
965 static void pflash_cfi02_class_init(ObjectClass *klass, void *data)
966 {
967     DeviceClass *dc = DEVICE_CLASS(klass);
968 
969     dc->realize = pflash_cfi02_realize;
970     dc->unrealize = pflash_cfi02_unrealize;
971     device_class_set_props(dc, pflash_cfi02_properties);
972     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
973 }
974 
975 static const TypeInfo pflash_cfi02_info = {
976     .name           = TYPE_PFLASH_CFI02,
977     .parent         = TYPE_SYS_BUS_DEVICE,
978     .instance_size  = sizeof(PFlashCFI02),
979     .class_init     = pflash_cfi02_class_init,
980 };
981 
982 static void pflash_cfi02_register_types(void)
983 {
984     type_register_static(&pflash_cfi02_info);
985 }
986 
987 type_init(pflash_cfi02_register_types)
988 
989 PFlashCFI02 *pflash_cfi02_register(hwaddr base,
990                                    const char *name,
991                                    hwaddr size,
992                                    BlockBackend *blk,
993                                    uint32_t sector_len,
994                                    int nb_mappings, int width,
995                                    uint16_t id0, uint16_t id1,
996                                    uint16_t id2, uint16_t id3,
997                                    uint16_t unlock_addr0,
998                                    uint16_t unlock_addr1,
999                                    int be)
1000 {
1001     DeviceState *dev = qdev_new(TYPE_PFLASH_CFI02);
1002 
1003     if (blk) {
1004         qdev_prop_set_drive(dev, "drive", blk);
1005     }
1006     assert(QEMU_IS_ALIGNED(size, sector_len));
1007     qdev_prop_set_uint32(dev, "num-blocks", size / sector_len);
1008     qdev_prop_set_uint32(dev, "sector-length", sector_len);
1009     qdev_prop_set_uint8(dev, "width", width);
1010     qdev_prop_set_uint8(dev, "mappings", nb_mappings);
1011     qdev_prop_set_uint8(dev, "big-endian", !!be);
1012     qdev_prop_set_uint16(dev, "id0", id0);
1013     qdev_prop_set_uint16(dev, "id1", id1);
1014     qdev_prop_set_uint16(dev, "id2", id2);
1015     qdev_prop_set_uint16(dev, "id3", id3);
1016     qdev_prop_set_uint16(dev, "unlock-addr0", unlock_addr0);
1017     qdev_prop_set_uint16(dev, "unlock-addr1", unlock_addr1);
1018     qdev_prop_set_string(dev, "name", name);
1019     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
1020 
1021     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
1022     return PFLASH_CFI02(dev);
1023 }
1024