1 /* 2 * CFI parallel flash with AMD command set emulation 3 * 4 * Copyright (c) 2005 Jocelyn Mayer 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 */ 19 20 /* 21 * For now, this code can emulate flashes of 1, 2 or 4 bytes width. 22 * Supported commands/modes are: 23 * - flash read 24 * - flash write 25 * - flash ID read 26 * - sector erase 27 * - chip erase 28 * - unlock bypass command 29 * - CFI queries 30 * 31 * It does not support flash interleaving. 32 * It does not implement software data protection as found in many real chips 33 */ 34 35 #include "qemu/osdep.h" 36 #include "hw/hw.h" 37 #include "hw/block/block.h" 38 #include "hw/block/flash.h" 39 #include "qapi/error.h" 40 #include "qemu/bitmap.h" 41 #include "qemu/timer.h" 42 #include "sysemu/block-backend.h" 43 #include "qemu/host-utils.h" 44 #include "qemu/module.h" 45 #include "hw/sysbus.h" 46 #include "trace.h" 47 48 #define PFLASH_DEBUG false 49 #define DPRINTF(fmt, ...) \ 50 do { \ 51 if (PFLASH_DEBUG) { \ 52 fprintf(stderr, "PFLASH: " fmt, ## __VA_ARGS__); \ 53 } \ 54 } while (0) 55 56 #define PFLASH_LAZY_ROMD_THRESHOLD 42 57 58 /* 59 * The size of the cfi_table indirectly depends on this and the start of the 60 * PRI table directly depends on it. 4 is the maximum size (and also what 61 * seems common) without changing the PRT table address. 62 */ 63 #define PFLASH_MAX_ERASE_REGIONS 4 64 65 /* Special write cycles for CFI queries. */ 66 enum { 67 WCYCLE_CFI = 7, 68 WCYCLE_AUTOSELECT_CFI = 8, 69 }; 70 71 struct PFlashCFI02 { 72 /*< private >*/ 73 SysBusDevice parent_obj; 74 /*< public >*/ 75 76 BlockBackend *blk; 77 uint32_t uniform_nb_blocs; 78 uint32_t uniform_sector_len; 79 uint32_t total_sectors; 80 uint32_t nb_blocs[PFLASH_MAX_ERASE_REGIONS]; 81 uint32_t sector_len[PFLASH_MAX_ERASE_REGIONS]; 82 uint32_t chip_len; 83 uint8_t mappings; 84 uint8_t width; 85 uint8_t be; 86 int wcycle; /* if 0, the flash is read normally */ 87 int bypass; 88 int ro; 89 uint8_t cmd; 90 uint8_t status; 91 /* FIXME: implement array device properties */ 92 uint16_t ident0; 93 uint16_t ident1; 94 uint16_t ident2; 95 uint16_t ident3; 96 uint16_t unlock_addr0; 97 uint16_t unlock_addr1; 98 uint8_t cfi_table[0x4d]; 99 QEMUTimer timer; 100 /* The device replicates the flash memory across its memory space. Emulate 101 * that by having a container (.mem) filled with an array of aliases 102 * (.mem_mappings) pointing to the flash memory (.orig_mem). 103 */ 104 MemoryRegion mem; 105 MemoryRegion *mem_mappings; /* array; one per mapping */ 106 MemoryRegion orig_mem; 107 int rom_mode; 108 int read_counter; /* used for lazy switch-back to rom mode */ 109 int sectors_to_erase; 110 uint64_t erase_time_remaining; 111 unsigned long *sector_erase_map; 112 char *name; 113 void *storage; 114 }; 115 116 /* 117 * Toggle status bit DQ7. 118 */ 119 static inline void toggle_dq7(PFlashCFI02 *pfl) 120 { 121 pfl->status ^= 0x80; 122 } 123 124 /* 125 * Set status bit DQ7 to bit 7 of value. 126 */ 127 static inline void set_dq7(PFlashCFI02 *pfl, uint8_t value) 128 { 129 pfl->status &= 0x7F; 130 pfl->status |= value & 0x80; 131 } 132 133 /* 134 * Toggle status bit DQ6. 135 */ 136 static inline void toggle_dq6(PFlashCFI02 *pfl) 137 { 138 pfl->status ^= 0x40; 139 } 140 141 /* 142 * Turn on DQ3. 143 */ 144 static inline void assert_dq3(PFlashCFI02 *pfl) 145 { 146 pfl->status |= 0x08; 147 } 148 149 /* 150 * Turn off DQ3. 151 */ 152 static inline void reset_dq3(PFlashCFI02 *pfl) 153 { 154 pfl->status &= ~0x08; 155 } 156 157 /* 158 * Toggle status bit DQ2. 159 */ 160 static inline void toggle_dq2(PFlashCFI02 *pfl) 161 { 162 pfl->status ^= 0x04; 163 } 164 165 /* 166 * Set up replicated mappings of the same region. 167 */ 168 static void pflash_setup_mappings(PFlashCFI02 *pfl) 169 { 170 unsigned i; 171 hwaddr size = memory_region_size(&pfl->orig_mem); 172 173 memory_region_init(&pfl->mem, OBJECT(pfl), "pflash", pfl->mappings * size); 174 pfl->mem_mappings = g_new(MemoryRegion, pfl->mappings); 175 for (i = 0; i < pfl->mappings; ++i) { 176 memory_region_init_alias(&pfl->mem_mappings[i], OBJECT(pfl), 177 "pflash-alias", &pfl->orig_mem, 0, size); 178 memory_region_add_subregion(&pfl->mem, i * size, &pfl->mem_mappings[i]); 179 } 180 } 181 182 static void pflash_register_memory(PFlashCFI02 *pfl, int rom_mode) 183 { 184 memory_region_rom_device_set_romd(&pfl->orig_mem, rom_mode); 185 pfl->rom_mode = rom_mode; 186 } 187 188 static size_t pflash_regions_count(PFlashCFI02 *pfl) 189 { 190 return pfl->cfi_table[0x2c]; 191 } 192 193 /* 194 * Returns the time it takes to erase the number of sectors scheduled for 195 * erasure based on CFI address 0x21 which is "Typical timeout per individual 196 * block erase 2^N ms." 197 */ 198 static uint64_t pflash_erase_time(PFlashCFI02 *pfl) 199 { 200 /* 201 * If there are no sectors to erase (which can happen if all of the sectors 202 * to be erased are protected), then erase takes 100 us. Protected sectors 203 * aren't supported so this should never happen. 204 */ 205 return ((1ULL << pfl->cfi_table[0x21]) * pfl->sectors_to_erase) * SCALE_US; 206 } 207 208 /* 209 * Returns true if the device is currently in erase suspend mode. 210 */ 211 static inline bool pflash_erase_suspend_mode(PFlashCFI02 *pfl) 212 { 213 return pfl->erase_time_remaining > 0; 214 } 215 216 static void pflash_timer(void *opaque) 217 { 218 PFlashCFI02 *pfl = opaque; 219 220 trace_pflash_timer_expired(pfl->cmd); 221 if (pfl->cmd == 0x30) { 222 /* 223 * Sector erase. If DQ3 is 0 when the timer expires, then the 50 224 * us erase timeout has expired so we need to start the timer for the 225 * sector erase algorithm. Otherwise, the erase completed and we should 226 * go back to read array mode. 227 */ 228 if ((pfl->status & 0x08) == 0) { 229 assert_dq3(pfl); 230 uint64_t timeout = pflash_erase_time(pfl); 231 timer_mod(&pfl->timer, 232 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + timeout); 233 DPRINTF("%s: erase timeout fired; erasing %d sectors\n", 234 __func__, pfl->sectors_to_erase); 235 return; 236 } 237 DPRINTF("%s: sector erase complete\n", __func__); 238 bitmap_zero(pfl->sector_erase_map, pfl->total_sectors); 239 pfl->sectors_to_erase = 0; 240 reset_dq3(pfl); 241 } 242 243 /* Reset flash */ 244 toggle_dq7(pfl); 245 if (pfl->bypass) { 246 pfl->wcycle = 2; 247 } else { 248 pflash_register_memory(pfl, 1); 249 pfl->wcycle = 0; 250 } 251 pfl->cmd = 0; 252 } 253 254 /* 255 * Read data from flash. 256 */ 257 static uint64_t pflash_data_read(PFlashCFI02 *pfl, hwaddr offset, 258 unsigned int width) 259 { 260 uint8_t *p = (uint8_t *)pfl->storage + offset; 261 uint64_t ret = pfl->be ? ldn_be_p(p, width) : ldn_le_p(p, width); 262 trace_pflash_data_read(offset, width << 1, ret); 263 return ret; 264 } 265 266 typedef struct { 267 uint32_t len; 268 uint32_t num; 269 } SectorInfo; 270 271 /* 272 * offset should be a byte offset of the QEMU device and _not_ a device 273 * offset. 274 */ 275 static SectorInfo pflash_sector_info(PFlashCFI02 *pfl, hwaddr offset) 276 { 277 assert(offset < pfl->chip_len); 278 hwaddr addr = 0; 279 uint32_t sector_num = 0; 280 for (int i = 0; i < pflash_regions_count(pfl); ++i) { 281 uint64_t region_size = (uint64_t)pfl->nb_blocs[i] * pfl->sector_len[i]; 282 if (addr <= offset && offset < addr + region_size) { 283 return (SectorInfo) { 284 .len = pfl->sector_len[i], 285 .num = sector_num + (offset - addr) / pfl->sector_len[i], 286 }; 287 } 288 sector_num += pfl->nb_blocs[i]; 289 addr += region_size; 290 } 291 abort(); 292 } 293 294 /* 295 * Returns true if the offset refers to a flash sector that is currently being 296 * erased. 297 */ 298 static bool pflash_sector_is_erasing(PFlashCFI02 *pfl, hwaddr offset) 299 { 300 long sector_num = pflash_sector_info(pfl, offset).num; 301 return test_bit(sector_num, pfl->sector_erase_map); 302 } 303 304 static uint64_t pflash_read(void *opaque, hwaddr offset, unsigned int width) 305 { 306 PFlashCFI02 *pfl = opaque; 307 hwaddr boff; 308 uint64_t ret; 309 310 ret = -1; 311 /* Lazy reset to ROMD mode after a certain amount of read accesses */ 312 if (!pfl->rom_mode && pfl->wcycle == 0 && 313 ++pfl->read_counter > PFLASH_LAZY_ROMD_THRESHOLD) { 314 pflash_register_memory(pfl, 1); 315 } 316 offset &= pfl->chip_len - 1; 317 boff = offset & 0xFF; 318 if (pfl->width == 2) { 319 boff = boff >> 1; 320 } 321 switch (pfl->cmd) { 322 default: 323 /* This should never happen : reset state & treat it as a read*/ 324 DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd); 325 pfl->wcycle = 0; 326 pfl->cmd = 0; 327 /* fall through to the read code */ 328 case 0x80: /* Erase (unlock) */ 329 /* We accept reads during second unlock sequence... */ 330 case 0x00: 331 if (pflash_erase_suspend_mode(pfl) && 332 pflash_sector_is_erasing(pfl, offset)) { 333 /* Toggle bit 2, but not 6. */ 334 toggle_dq2(pfl); 335 /* Status register read */ 336 ret = pfl->status; 337 DPRINTF("%s: status %" PRIx64 "\n", __func__, ret); 338 break; 339 } 340 /* Flash area read */ 341 ret = pflash_data_read(pfl, offset, width); 342 break; 343 case 0x90: /* flash ID read */ 344 switch (boff) { 345 case 0x00: 346 case 0x01: 347 ret = boff & 0x01 ? pfl->ident1 : pfl->ident0; 348 break; 349 case 0x02: 350 ret = 0x00; /* Pretend all sectors are unprotected */ 351 break; 352 case 0x0E: 353 case 0x0F: 354 ret = boff & 0x01 ? pfl->ident3 : pfl->ident2; 355 if (ret != (uint8_t)-1) { 356 break; 357 } 358 /* Fall through to data read. */ 359 default: 360 ret = pflash_data_read(pfl, offset, width); 361 } 362 DPRINTF("%s: ID " TARGET_FMT_plx " %" PRIx64 "\n", __func__, boff, ret); 363 break; 364 case 0x10: /* Chip Erase */ 365 case 0x30: /* Sector Erase */ 366 /* Toggle bit 2 during erase, but not program. */ 367 toggle_dq2(pfl); 368 case 0xA0: /* Program */ 369 /* Toggle bit 6 */ 370 toggle_dq6(pfl); 371 /* Status register read */ 372 ret = pfl->status; 373 DPRINTF("%s: status %" PRIx64 "\n", __func__, ret); 374 break; 375 case 0x98: 376 /* CFI query mode */ 377 if (boff < sizeof(pfl->cfi_table)) { 378 ret = pfl->cfi_table[boff]; 379 } else { 380 ret = 0; 381 } 382 break; 383 } 384 trace_pflash_io_read(offset, width, width << 1, ret, pfl->cmd, pfl->wcycle); 385 386 return ret; 387 } 388 389 /* update flash content on disk */ 390 static void pflash_update(PFlashCFI02 *pfl, int offset, int size) 391 { 392 int offset_end; 393 if (pfl->blk) { 394 offset_end = offset + size; 395 /* widen to sector boundaries */ 396 offset = QEMU_ALIGN_DOWN(offset, BDRV_SECTOR_SIZE); 397 offset_end = QEMU_ALIGN_UP(offset_end, BDRV_SECTOR_SIZE); 398 blk_pwrite(pfl->blk, offset, pfl->storage + offset, 399 offset_end - offset, 0); 400 } 401 } 402 403 static void pflash_sector_erase(PFlashCFI02 *pfl, hwaddr offset) 404 { 405 SectorInfo sector_info = pflash_sector_info(pfl, offset); 406 uint64_t sector_len = sector_info.len; 407 offset &= ~(sector_len - 1); 408 DPRINTF("%s: start sector erase at %0*" PRIx64 "-%0*" PRIx64 "\n", 409 __func__, pfl->width * 2, offset, 410 pfl->width * 2, offset + sector_len - 1); 411 if (!pfl->ro) { 412 uint8_t *p = pfl->storage; 413 memset(p + offset, 0xff, sector_len); 414 pflash_update(pfl, offset, sector_len); 415 } 416 set_dq7(pfl, 0x00); 417 ++pfl->sectors_to_erase; 418 set_bit(sector_info.num, pfl->sector_erase_map); 419 /* Set (or reset) the 50 us timer for additional erase commands. */ 420 timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 50000); 421 } 422 423 static void pflash_write(void *opaque, hwaddr offset, uint64_t value, 424 unsigned int width) 425 { 426 PFlashCFI02 *pfl = opaque; 427 hwaddr boff; 428 uint8_t *p; 429 uint8_t cmd; 430 431 trace_pflash_io_write(offset, width, width << 1, value, pfl->wcycle); 432 cmd = value; 433 if (pfl->cmd != 0xA0) { 434 /* Reset does nothing during chip erase and sector erase. */ 435 if (cmd == 0xF0 && pfl->cmd != 0x10 && pfl->cmd != 0x30) { 436 if (pfl->wcycle == WCYCLE_AUTOSELECT_CFI) { 437 /* Return to autoselect mode. */ 438 pfl->wcycle = 3; 439 pfl->cmd = 0x90; 440 return; 441 } 442 goto reset_flash; 443 } 444 } 445 offset &= pfl->chip_len - 1; 446 447 boff = offset; 448 if (pfl->width == 2) { 449 boff = boff >> 1; 450 } 451 /* Only the least-significant 11 bits are used in most cases. */ 452 boff &= 0x7FF; 453 switch (pfl->wcycle) { 454 case 0: 455 /* Set the device in I/O access mode if required */ 456 if (pfl->rom_mode) 457 pflash_register_memory(pfl, 0); 458 pfl->read_counter = 0; 459 /* We're in read mode */ 460 check_unlock0: 461 if (boff == 0x55 && cmd == 0x98) { 462 /* Enter CFI query mode */ 463 pfl->wcycle = WCYCLE_CFI; 464 pfl->cmd = 0x98; 465 return; 466 } 467 /* Handle erase resume in erase suspend mode, otherwise reset. */ 468 if (cmd == 0x30) { /* Erase Resume */ 469 if (pflash_erase_suspend_mode(pfl)) { 470 /* Resume the erase. */ 471 timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 472 pfl->erase_time_remaining); 473 pfl->erase_time_remaining = 0; 474 pfl->wcycle = 6; 475 pfl->cmd = 0x30; 476 set_dq7(pfl, 0x00); 477 assert_dq3(pfl); 478 return; 479 } 480 goto reset_flash; 481 } 482 /* Ignore erase suspend. */ 483 if (cmd == 0xB0) { /* Erase Suspend */ 484 return; 485 } 486 if (boff != pfl->unlock_addr0 || cmd != 0xAA) { 487 DPRINTF("%s: unlock0 failed " TARGET_FMT_plx " %02x %04x\n", 488 __func__, boff, cmd, pfl->unlock_addr0); 489 goto reset_flash; 490 } 491 DPRINTF("%s: unlock sequence started\n", __func__); 492 break; 493 case 1: 494 /* We started an unlock sequence */ 495 check_unlock1: 496 if (boff != pfl->unlock_addr1 || cmd != 0x55) { 497 DPRINTF("%s: unlock1 failed " TARGET_FMT_plx " %02x\n", __func__, 498 boff, cmd); 499 goto reset_flash; 500 } 501 DPRINTF("%s: unlock sequence done\n", __func__); 502 break; 503 case 2: 504 /* We finished an unlock sequence */ 505 if (!pfl->bypass && boff != pfl->unlock_addr0) { 506 DPRINTF("%s: command failed " TARGET_FMT_plx " %02x\n", __func__, 507 boff, cmd); 508 goto reset_flash; 509 } 510 switch (cmd) { 511 case 0x20: 512 pfl->bypass = 1; 513 goto do_bypass; 514 case 0x80: /* Erase */ 515 case 0x90: /* Autoselect */ 516 case 0xA0: /* Program */ 517 pfl->cmd = cmd; 518 DPRINTF("%s: starting command %02x\n", __func__, cmd); 519 break; 520 default: 521 DPRINTF("%s: unknown command %02x\n", __func__, cmd); 522 goto reset_flash; 523 } 524 break; 525 case 3: 526 switch (pfl->cmd) { 527 case 0x80: /* Erase */ 528 /* We need another unlock sequence */ 529 goto check_unlock0; 530 case 0xA0: /* Program */ 531 if (pflash_erase_suspend_mode(pfl) && 532 pflash_sector_is_erasing(pfl, offset)) { 533 /* Ignore writes to erasing sectors. */ 534 if (pfl->bypass) { 535 goto do_bypass; 536 } 537 goto reset_flash; 538 } 539 trace_pflash_data_write(offset, width << 1, value, 0); 540 if (!pfl->ro) { 541 p = (uint8_t *)pfl->storage + offset; 542 if (pfl->be) { 543 uint64_t current = ldn_be_p(p, width); 544 stn_be_p(p, width, current & value); 545 } else { 546 uint64_t current = ldn_le_p(p, width); 547 stn_le_p(p, width, current & value); 548 } 549 pflash_update(pfl, offset, width); 550 } 551 /* 552 * While programming, status bit DQ7 should hold the opposite 553 * value from how it was programmed. 554 */ 555 set_dq7(pfl, ~value); 556 /* Let's pretend write is immediate */ 557 if (pfl->bypass) 558 goto do_bypass; 559 goto reset_flash; 560 case 0x90: /* Autoselect */ 561 if (pfl->bypass && cmd == 0x00) { 562 /* Unlock bypass reset */ 563 goto reset_flash; 564 } 565 /* 566 * We can enter CFI query mode from autoselect mode, but we must 567 * return to autoselect mode after a reset. 568 */ 569 if (boff == 0x55 && cmd == 0x98) { 570 /* Enter autoselect CFI query mode */ 571 pfl->wcycle = WCYCLE_AUTOSELECT_CFI; 572 pfl->cmd = 0x98; 573 return; 574 } 575 /* No break here */ 576 default: 577 DPRINTF("%s: invalid write for command %02x\n", 578 __func__, pfl->cmd); 579 goto reset_flash; 580 } 581 case 4: 582 switch (pfl->cmd) { 583 case 0xA0: /* Program */ 584 /* Ignore writes while flash data write is occurring */ 585 /* As we suppose write is immediate, this should never happen */ 586 return; 587 case 0x80: /* Erase */ 588 goto check_unlock1; 589 default: 590 /* Should never happen */ 591 DPRINTF("%s: invalid command state %02x (wc 4)\n", 592 __func__, pfl->cmd); 593 goto reset_flash; 594 } 595 break; 596 case 5: 597 if (pflash_erase_suspend_mode(pfl)) { 598 /* Erasing is not supported in erase suspend mode. */ 599 goto reset_flash; 600 } 601 switch (cmd) { 602 case 0x10: /* Chip Erase */ 603 if (boff != pfl->unlock_addr0) { 604 DPRINTF("%s: chip erase: invalid address " TARGET_FMT_plx "\n", 605 __func__, offset); 606 goto reset_flash; 607 } 608 /* Chip erase */ 609 DPRINTF("%s: start chip erase\n", __func__); 610 if (!pfl->ro) { 611 memset(pfl->storage, 0xff, pfl->chip_len); 612 pflash_update(pfl, 0, pfl->chip_len); 613 } 614 set_dq7(pfl, 0x00); 615 /* Wait the time specified at CFI address 0x22. */ 616 timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 617 (1ULL << pfl->cfi_table[0x22]) * SCALE_MS); 618 break; 619 case 0x30: /* Sector erase */ 620 pflash_sector_erase(pfl, offset); 621 break; 622 default: 623 DPRINTF("%s: invalid command %02x (wc 5)\n", __func__, cmd); 624 goto reset_flash; 625 } 626 pfl->cmd = cmd; 627 break; 628 case 6: 629 switch (pfl->cmd) { 630 case 0x10: /* Chip Erase */ 631 /* Ignore writes during chip erase */ 632 return; 633 case 0x30: /* Sector erase */ 634 if (cmd == 0xB0) { 635 /* 636 * If erase suspend happens during the erase timeout (so DQ3 is 637 * 0), then the device suspends erasing immediately. Set the 638 * remaining time to be the total time to erase. Otherwise, 639 * there is a maximum amount of time it can take to enter 640 * suspend mode. Let's ignore that and suspend immediately and 641 * set the remaining time to the actual time remaining on the 642 * timer. 643 */ 644 if ((pfl->status & 0x08) == 0) { 645 pfl->erase_time_remaining = pflash_erase_time(pfl); 646 } else { 647 int64_t delta = timer_expire_time_ns(&pfl->timer) - 648 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 649 /* Make sure we have a positive time remaining. */ 650 pfl->erase_time_remaining = delta <= 0 ? 1 : delta; 651 } 652 reset_dq3(pfl); 653 timer_del(&pfl->timer); 654 pfl->wcycle = 0; 655 pfl->cmd = 0; 656 return; 657 } 658 /* 659 * If DQ3 is 0, additional sector erase commands can be 660 * written and anything else (other than an erase suspend) resets 661 * the device. 662 */ 663 if ((pfl->status & 0x08) == 0) { 664 if (cmd == 0x30) { 665 pflash_sector_erase(pfl, offset); 666 } else { 667 goto reset_flash; 668 } 669 } 670 /* Ignore writes during the actual erase. */ 671 return; 672 default: 673 /* Should never happen */ 674 DPRINTF("%s: invalid command state %02x (wc 6)\n", 675 __func__, pfl->cmd); 676 goto reset_flash; 677 } 678 break; 679 /* Special values for CFI queries */ 680 case WCYCLE_CFI: 681 case WCYCLE_AUTOSELECT_CFI: 682 DPRINTF("%s: invalid write in CFI query mode\n", __func__); 683 goto reset_flash; 684 default: 685 /* Should never happen */ 686 DPRINTF("%s: invalid write state (wc 7)\n", __func__); 687 goto reset_flash; 688 } 689 pfl->wcycle++; 690 691 return; 692 693 /* Reset flash */ 694 reset_flash: 695 trace_pflash_reset(); 696 pfl->bypass = 0; 697 pfl->wcycle = 0; 698 pfl->cmd = 0; 699 return; 700 701 do_bypass: 702 pfl->wcycle = 2; 703 pfl->cmd = 0; 704 } 705 706 static const MemoryRegionOps pflash_cfi02_ops = { 707 .read = pflash_read, 708 .write = pflash_write, 709 .impl.max_access_size = 2, 710 .valid.min_access_size = 1, 711 .valid.max_access_size = 4, 712 .endianness = DEVICE_NATIVE_ENDIAN, 713 }; 714 715 static void pflash_cfi02_realize(DeviceState *dev, Error **errp) 716 { 717 PFlashCFI02 *pfl = PFLASH_CFI02(dev); 718 int ret; 719 Error *local_err = NULL; 720 721 if (pfl->uniform_sector_len == 0 && pfl->sector_len[0] == 0) { 722 error_setg(errp, "attribute \"sector-length\" not specified or zero."); 723 return; 724 } 725 if (pfl->uniform_nb_blocs == 0 && pfl->nb_blocs[0] == 0) { 726 error_setg(errp, "attribute \"num-blocks\" not specified or zero."); 727 return; 728 } 729 if (pfl->name == NULL) { 730 error_setg(errp, "attribute \"name\" not specified."); 731 return; 732 } 733 734 int nb_regions; 735 pfl->chip_len = 0; 736 pfl->total_sectors = 0; 737 for (nb_regions = 0; nb_regions < PFLASH_MAX_ERASE_REGIONS; ++nb_regions) { 738 if (pfl->nb_blocs[nb_regions] == 0) { 739 break; 740 } 741 pfl->total_sectors += pfl->nb_blocs[nb_regions]; 742 uint64_t sector_len_per_device = pfl->sector_len[nb_regions]; 743 744 /* 745 * The size of each flash sector must be a power of 2 and it must be 746 * aligned at the same power of 2. 747 */ 748 if (sector_len_per_device & 0xff || 749 sector_len_per_device >= (1 << 24) || 750 !is_power_of_2(sector_len_per_device)) 751 { 752 error_setg(errp, "unsupported configuration: " 753 "sector length[%d] per device = %" PRIx64 ".", 754 nb_regions, sector_len_per_device); 755 return; 756 } 757 if (pfl->chip_len & (sector_len_per_device - 1)) { 758 error_setg(errp, "unsupported configuration: " 759 "flash region %d not correctly aligned.", 760 nb_regions); 761 return; 762 } 763 764 pfl->chip_len += (uint64_t)pfl->sector_len[nb_regions] * 765 pfl->nb_blocs[nb_regions]; 766 } 767 768 uint64_t uniform_len = (uint64_t)pfl->uniform_nb_blocs * 769 pfl->uniform_sector_len; 770 if (nb_regions == 0) { 771 nb_regions = 1; 772 pfl->nb_blocs[0] = pfl->uniform_nb_blocs; 773 pfl->sector_len[0] = pfl->uniform_sector_len; 774 pfl->chip_len = uniform_len; 775 pfl->total_sectors = pfl->uniform_nb_blocs; 776 } else if (uniform_len != 0 && uniform_len != pfl->chip_len) { 777 error_setg(errp, "\"num-blocks\"*\"sector-length\" " 778 "different from \"num-blocks0\"*\'sector-length0\" + ... + " 779 "\"num-blocks3\"*\"sector-length3\""); 780 return; 781 } 782 783 memory_region_init_rom_device(&pfl->orig_mem, OBJECT(pfl), 784 &pflash_cfi02_ops, pfl, pfl->name, 785 pfl->chip_len, &local_err); 786 if (local_err) { 787 error_propagate(errp, local_err); 788 return; 789 } 790 791 pfl->storage = memory_region_get_ram_ptr(&pfl->orig_mem); 792 793 if (pfl->blk) { 794 uint64_t perm; 795 pfl->ro = blk_is_read_only(pfl->blk); 796 perm = BLK_PERM_CONSISTENT_READ | (pfl->ro ? 0 : BLK_PERM_WRITE); 797 ret = blk_set_perm(pfl->blk, perm, BLK_PERM_ALL, errp); 798 if (ret < 0) { 799 return; 800 } 801 } else { 802 pfl->ro = 0; 803 } 804 805 if (pfl->blk) { 806 if (!blk_check_size_and_read_all(pfl->blk, pfl->storage, 807 pfl->chip_len, errp)) { 808 vmstate_unregister_ram(&pfl->orig_mem, DEVICE(pfl)); 809 return; 810 } 811 } 812 813 /* Only 11 bits are used in the comparison. */ 814 pfl->unlock_addr0 &= 0x7FF; 815 pfl->unlock_addr1 &= 0x7FF; 816 817 /* Allocate memory for a bitmap for sectors being erased. */ 818 pfl->sector_erase_map = bitmap_new(pfl->total_sectors); 819 820 pflash_setup_mappings(pfl); 821 pfl->rom_mode = 1; 822 sysbus_init_mmio(SYS_BUS_DEVICE(dev), &pfl->mem); 823 824 timer_init_ns(&pfl->timer, QEMU_CLOCK_VIRTUAL, pflash_timer, pfl); 825 pfl->wcycle = 0; 826 pfl->cmd = 0; 827 pfl->status = 0; 828 829 /* Hardcoded CFI table (mostly from SG29 Spansion flash) */ 830 const uint16_t pri_ofs = 0x40; 831 /* Standard "QRY" string */ 832 pfl->cfi_table[0x10] = 'Q'; 833 pfl->cfi_table[0x11] = 'R'; 834 pfl->cfi_table[0x12] = 'Y'; 835 /* Command set (AMD/Fujitsu) */ 836 pfl->cfi_table[0x13] = 0x02; 837 pfl->cfi_table[0x14] = 0x00; 838 /* Primary extended table address */ 839 pfl->cfi_table[0x15] = pri_ofs; 840 pfl->cfi_table[0x16] = pri_ofs >> 8; 841 /* Alternate command set (none) */ 842 pfl->cfi_table[0x17] = 0x00; 843 pfl->cfi_table[0x18] = 0x00; 844 /* Alternate extended table (none) */ 845 pfl->cfi_table[0x19] = 0x00; 846 pfl->cfi_table[0x1A] = 0x00; 847 /* Vcc min */ 848 pfl->cfi_table[0x1B] = 0x27; 849 /* Vcc max */ 850 pfl->cfi_table[0x1C] = 0x36; 851 /* Vpp min (no Vpp pin) */ 852 pfl->cfi_table[0x1D] = 0x00; 853 /* Vpp max (no Vpp pin) */ 854 pfl->cfi_table[0x1E] = 0x00; 855 /* Timeout per single byte/word write (128 ms) */ 856 pfl->cfi_table[0x1F] = 0x07; 857 /* Timeout for min size buffer write (NA) */ 858 pfl->cfi_table[0x20] = 0x00; 859 /* Typical timeout for block erase (512 ms) */ 860 pfl->cfi_table[0x21] = 0x09; 861 /* Typical timeout for full chip erase (4096 ms) */ 862 pfl->cfi_table[0x22] = 0x0C; 863 /* Reserved */ 864 pfl->cfi_table[0x23] = 0x01; 865 /* Max timeout for buffer write (NA) */ 866 pfl->cfi_table[0x24] = 0x00; 867 /* Max timeout for block erase */ 868 pfl->cfi_table[0x25] = 0x0A; 869 /* Max timeout for chip erase */ 870 pfl->cfi_table[0x26] = 0x0D; 871 /* Device size */ 872 pfl->cfi_table[0x27] = ctz32(pfl->chip_len); 873 /* Flash device interface (8 & 16 bits) */ 874 pfl->cfi_table[0x28] = 0x02; 875 pfl->cfi_table[0x29] = 0x00; 876 /* Max number of bytes in multi-bytes write */ 877 /* XXX: disable buffered write as it's not supported */ 878 // pfl->cfi_table[0x2A] = 0x05; 879 pfl->cfi_table[0x2A] = 0x00; 880 pfl->cfi_table[0x2B] = 0x00; 881 /* Number of erase block regions */ 882 pfl->cfi_table[0x2c] = nb_regions; 883 /* Erase block regions */ 884 for (int i = 0; i < nb_regions; ++i) { 885 uint32_t sector_len_per_device = pfl->sector_len[i]; 886 pfl->cfi_table[0x2d + 4 * i] = pfl->nb_blocs[i] - 1; 887 pfl->cfi_table[0x2e + 4 * i] = (pfl->nb_blocs[i] - 1) >> 8; 888 pfl->cfi_table[0x2f + 4 * i] = sector_len_per_device >> 8; 889 pfl->cfi_table[0x30 + 4 * i] = sector_len_per_device >> 16; 890 } 891 assert(0x2c + 4 * nb_regions < pri_ofs); 892 893 /* Extended */ 894 pfl->cfi_table[0x00 + pri_ofs] = 'P'; 895 pfl->cfi_table[0x01 + pri_ofs] = 'R'; 896 pfl->cfi_table[0x02 + pri_ofs] = 'I'; 897 898 /* Extended version 1.0 */ 899 pfl->cfi_table[0x03 + pri_ofs] = '1'; 900 pfl->cfi_table[0x04 + pri_ofs] = '0'; 901 902 /* Address sensitive unlock required. */ 903 pfl->cfi_table[0x05 + pri_ofs] = 0x00; 904 /* Erase suspend to read/write. */ 905 pfl->cfi_table[0x06 + pri_ofs] = 0x02; 906 /* Sector protect not supported. */ 907 pfl->cfi_table[0x07 + pri_ofs] = 0x00; 908 /* Temporary sector unprotect not supported. */ 909 pfl->cfi_table[0x08 + pri_ofs] = 0x00; 910 911 /* Sector protect/unprotect scheme. */ 912 pfl->cfi_table[0x09 + pri_ofs] = 0x00; 913 914 /* Simultaneous operation not supported. */ 915 pfl->cfi_table[0x0a + pri_ofs] = 0x00; 916 /* Burst mode not supported. */ 917 pfl->cfi_table[0x0b + pri_ofs] = 0x00; 918 /* Page mode not supported. */ 919 pfl->cfi_table[0x0c + pri_ofs] = 0x00; 920 assert(0x0c + pri_ofs < ARRAY_SIZE(pfl->cfi_table)); 921 } 922 923 static Property pflash_cfi02_properties[] = { 924 DEFINE_PROP_DRIVE("drive", PFlashCFI02, blk), 925 DEFINE_PROP_UINT32("num-blocks", PFlashCFI02, uniform_nb_blocs, 0), 926 DEFINE_PROP_UINT32("sector-length", PFlashCFI02, uniform_sector_len, 0), 927 DEFINE_PROP_UINT32("num-blocks0", PFlashCFI02, nb_blocs[0], 0), 928 DEFINE_PROP_UINT32("sector-length0", PFlashCFI02, sector_len[0], 0), 929 DEFINE_PROP_UINT32("num-blocks1", PFlashCFI02, nb_blocs[1], 0), 930 DEFINE_PROP_UINT32("sector-length1", PFlashCFI02, sector_len[1], 0), 931 DEFINE_PROP_UINT32("num-blocks2", PFlashCFI02, nb_blocs[2], 0), 932 DEFINE_PROP_UINT32("sector-length2", PFlashCFI02, sector_len[2], 0), 933 DEFINE_PROP_UINT32("num-blocks3", PFlashCFI02, nb_blocs[3], 0), 934 DEFINE_PROP_UINT32("sector-length3", PFlashCFI02, sector_len[3], 0), 935 DEFINE_PROP_UINT8("width", PFlashCFI02, width, 0), 936 DEFINE_PROP_UINT8("mappings", PFlashCFI02, mappings, 0), 937 DEFINE_PROP_UINT8("big-endian", PFlashCFI02, be, 0), 938 DEFINE_PROP_UINT16("id0", PFlashCFI02, ident0, 0), 939 DEFINE_PROP_UINT16("id1", PFlashCFI02, ident1, 0), 940 DEFINE_PROP_UINT16("id2", PFlashCFI02, ident2, 0), 941 DEFINE_PROP_UINT16("id3", PFlashCFI02, ident3, 0), 942 DEFINE_PROP_UINT16("unlock-addr0", PFlashCFI02, unlock_addr0, 0), 943 DEFINE_PROP_UINT16("unlock-addr1", PFlashCFI02, unlock_addr1, 0), 944 DEFINE_PROP_STRING("name", PFlashCFI02, name), 945 DEFINE_PROP_END_OF_LIST(), 946 }; 947 948 static void pflash_cfi02_unrealize(DeviceState *dev, Error **errp) 949 { 950 PFlashCFI02 *pfl = PFLASH_CFI02(dev); 951 timer_del(&pfl->timer); 952 g_free(pfl->sector_erase_map); 953 } 954 955 static void pflash_cfi02_class_init(ObjectClass *klass, void *data) 956 { 957 DeviceClass *dc = DEVICE_CLASS(klass); 958 959 dc->realize = pflash_cfi02_realize; 960 dc->unrealize = pflash_cfi02_unrealize; 961 dc->props = pflash_cfi02_properties; 962 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 963 } 964 965 static const TypeInfo pflash_cfi02_info = { 966 .name = TYPE_PFLASH_CFI02, 967 .parent = TYPE_SYS_BUS_DEVICE, 968 .instance_size = sizeof(PFlashCFI02), 969 .class_init = pflash_cfi02_class_init, 970 }; 971 972 static void pflash_cfi02_register_types(void) 973 { 974 type_register_static(&pflash_cfi02_info); 975 } 976 977 type_init(pflash_cfi02_register_types) 978 979 PFlashCFI02 *pflash_cfi02_register(hwaddr base, 980 const char *name, 981 hwaddr size, 982 BlockBackend *blk, 983 uint32_t sector_len, 984 int nb_mappings, int width, 985 uint16_t id0, uint16_t id1, 986 uint16_t id2, uint16_t id3, 987 uint16_t unlock_addr0, 988 uint16_t unlock_addr1, 989 int be) 990 { 991 DeviceState *dev = qdev_create(NULL, TYPE_PFLASH_CFI02); 992 993 if (blk) { 994 qdev_prop_set_drive(dev, "drive", blk, &error_abort); 995 } 996 assert(size % sector_len == 0); 997 qdev_prop_set_uint32(dev, "num-blocks", size / sector_len); 998 qdev_prop_set_uint32(dev, "sector-length", sector_len); 999 qdev_prop_set_uint8(dev, "width", width); 1000 qdev_prop_set_uint8(dev, "mappings", nb_mappings); 1001 qdev_prop_set_uint8(dev, "big-endian", !!be); 1002 qdev_prop_set_uint16(dev, "id0", id0); 1003 qdev_prop_set_uint16(dev, "id1", id1); 1004 qdev_prop_set_uint16(dev, "id2", id2); 1005 qdev_prop_set_uint16(dev, "id3", id3); 1006 qdev_prop_set_uint16(dev, "unlock-addr0", unlock_addr0); 1007 qdev_prop_set_uint16(dev, "unlock-addr1", unlock_addr1); 1008 qdev_prop_set_string(dev, "name", name); 1009 qdev_init_nofail(dev); 1010 1011 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base); 1012 return PFLASH_CFI02(dev); 1013 } 1014