1 /* 2 * CFI parallel flash with AMD command set emulation 3 * 4 * Copyright (c) 2005 Jocelyn Mayer 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 */ 19 20 /* 21 * For now, this code can emulate flashes of 1, 2 or 4 bytes width. 22 * Supported commands/modes are: 23 * - flash read 24 * - flash write 25 * - flash ID read 26 * - sector erase 27 * - chip erase 28 * - unlock bypass command 29 * - CFI queries 30 * 31 * It does not support flash interleaving. 32 * It does not implement software data protection as found in many real chips 33 */ 34 35 #include "qemu/osdep.h" 36 #include "hw/block/block.h" 37 #include "hw/block/flash.h" 38 #include "hw/qdev-properties.h" 39 #include "qapi/error.h" 40 #include "qemu/bitmap.h" 41 #include "qemu/timer.h" 42 #include "sysemu/block-backend.h" 43 #include "qemu/host-utils.h" 44 #include "qemu/module.h" 45 #include "hw/sysbus.h" 46 #include "migration/vmstate.h" 47 #include "trace.h" 48 49 #define PFLASH_DEBUG false 50 #define DPRINTF(fmt, ...) \ 51 do { \ 52 if (PFLASH_DEBUG) { \ 53 fprintf(stderr, "PFLASH: " fmt, ## __VA_ARGS__); \ 54 } \ 55 } while (0) 56 57 #define PFLASH_LAZY_ROMD_THRESHOLD 42 58 59 /* 60 * The size of the cfi_table indirectly depends on this and the start of the 61 * PRI table directly depends on it. 4 is the maximum size (and also what 62 * seems common) without changing the PRT table address. 63 */ 64 #define PFLASH_MAX_ERASE_REGIONS 4 65 66 /* Special write cycles for CFI queries. */ 67 enum { 68 WCYCLE_CFI = 7, 69 WCYCLE_AUTOSELECT_CFI = 8, 70 }; 71 72 struct PFlashCFI02 { 73 /*< private >*/ 74 SysBusDevice parent_obj; 75 /*< public >*/ 76 77 BlockBackend *blk; 78 uint32_t uniform_nb_blocs; 79 uint32_t uniform_sector_len; 80 uint32_t total_sectors; 81 uint32_t nb_blocs[PFLASH_MAX_ERASE_REGIONS]; 82 uint32_t sector_len[PFLASH_MAX_ERASE_REGIONS]; 83 uint32_t chip_len; 84 uint8_t mappings; 85 uint8_t width; 86 uint8_t be; 87 int wcycle; /* if 0, the flash is read normally */ 88 int bypass; 89 int ro; 90 uint8_t cmd; 91 uint8_t status; 92 /* FIXME: implement array device properties */ 93 uint16_t ident0; 94 uint16_t ident1; 95 uint16_t ident2; 96 uint16_t ident3; 97 uint16_t unlock_addr0; 98 uint16_t unlock_addr1; 99 uint8_t cfi_table[0x4d]; 100 QEMUTimer timer; 101 /* The device replicates the flash memory across its memory space. Emulate 102 * that by having a container (.mem) filled with an array of aliases 103 * (.mem_mappings) pointing to the flash memory (.orig_mem). 104 */ 105 MemoryRegion mem; 106 MemoryRegion *mem_mappings; /* array; one per mapping */ 107 MemoryRegion orig_mem; 108 int rom_mode; 109 int read_counter; /* used for lazy switch-back to rom mode */ 110 int sectors_to_erase; 111 uint64_t erase_time_remaining; 112 unsigned long *sector_erase_map; 113 char *name; 114 void *storage; 115 }; 116 117 /* 118 * Toggle status bit DQ7. 119 */ 120 static inline void toggle_dq7(PFlashCFI02 *pfl) 121 { 122 pfl->status ^= 0x80; 123 } 124 125 /* 126 * Set status bit DQ7 to bit 7 of value. 127 */ 128 static inline void set_dq7(PFlashCFI02 *pfl, uint8_t value) 129 { 130 pfl->status &= 0x7F; 131 pfl->status |= value & 0x80; 132 } 133 134 /* 135 * Toggle status bit DQ6. 136 */ 137 static inline void toggle_dq6(PFlashCFI02 *pfl) 138 { 139 pfl->status ^= 0x40; 140 } 141 142 /* 143 * Turn on DQ3. 144 */ 145 static inline void assert_dq3(PFlashCFI02 *pfl) 146 { 147 pfl->status |= 0x08; 148 } 149 150 /* 151 * Turn off DQ3. 152 */ 153 static inline void reset_dq3(PFlashCFI02 *pfl) 154 { 155 pfl->status &= ~0x08; 156 } 157 158 /* 159 * Toggle status bit DQ2. 160 */ 161 static inline void toggle_dq2(PFlashCFI02 *pfl) 162 { 163 pfl->status ^= 0x04; 164 } 165 166 /* 167 * Set up replicated mappings of the same region. 168 */ 169 static void pflash_setup_mappings(PFlashCFI02 *pfl) 170 { 171 unsigned i; 172 hwaddr size = memory_region_size(&pfl->orig_mem); 173 174 memory_region_init(&pfl->mem, OBJECT(pfl), "pflash", pfl->mappings * size); 175 pfl->mem_mappings = g_new(MemoryRegion, pfl->mappings); 176 for (i = 0; i < pfl->mappings; ++i) { 177 memory_region_init_alias(&pfl->mem_mappings[i], OBJECT(pfl), 178 "pflash-alias", &pfl->orig_mem, 0, size); 179 memory_region_add_subregion(&pfl->mem, i * size, &pfl->mem_mappings[i]); 180 } 181 } 182 183 static void pflash_register_memory(PFlashCFI02 *pfl, int rom_mode) 184 { 185 memory_region_rom_device_set_romd(&pfl->orig_mem, rom_mode); 186 pfl->rom_mode = rom_mode; 187 } 188 189 static size_t pflash_regions_count(PFlashCFI02 *pfl) 190 { 191 return pfl->cfi_table[0x2c]; 192 } 193 194 /* 195 * Returns the time it takes to erase the number of sectors scheduled for 196 * erasure based on CFI address 0x21 which is "Typical timeout per individual 197 * block erase 2^N ms." 198 */ 199 static uint64_t pflash_erase_time(PFlashCFI02 *pfl) 200 { 201 /* 202 * If there are no sectors to erase (which can happen if all of the sectors 203 * to be erased are protected), then erase takes 100 us. Protected sectors 204 * aren't supported so this should never happen. 205 */ 206 return ((1ULL << pfl->cfi_table[0x21]) * pfl->sectors_to_erase) * SCALE_US; 207 } 208 209 /* 210 * Returns true if the device is currently in erase suspend mode. 211 */ 212 static inline bool pflash_erase_suspend_mode(PFlashCFI02 *pfl) 213 { 214 return pfl->erase_time_remaining > 0; 215 } 216 217 static void pflash_timer(void *opaque) 218 { 219 PFlashCFI02 *pfl = opaque; 220 221 trace_pflash_timer_expired(pfl->cmd); 222 if (pfl->cmd == 0x30) { 223 /* 224 * Sector erase. If DQ3 is 0 when the timer expires, then the 50 225 * us erase timeout has expired so we need to start the timer for the 226 * sector erase algorithm. Otherwise, the erase completed and we should 227 * go back to read array mode. 228 */ 229 if ((pfl->status & 0x08) == 0) { 230 assert_dq3(pfl); 231 uint64_t timeout = pflash_erase_time(pfl); 232 timer_mod(&pfl->timer, 233 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + timeout); 234 DPRINTF("%s: erase timeout fired; erasing %d sectors\n", 235 __func__, pfl->sectors_to_erase); 236 return; 237 } 238 DPRINTF("%s: sector erase complete\n", __func__); 239 bitmap_zero(pfl->sector_erase_map, pfl->total_sectors); 240 pfl->sectors_to_erase = 0; 241 reset_dq3(pfl); 242 } 243 244 /* Reset flash */ 245 toggle_dq7(pfl); 246 if (pfl->bypass) { 247 pfl->wcycle = 2; 248 } else { 249 pflash_register_memory(pfl, 1); 250 pfl->wcycle = 0; 251 } 252 pfl->cmd = 0; 253 } 254 255 /* 256 * Read data from flash. 257 */ 258 static uint64_t pflash_data_read(PFlashCFI02 *pfl, hwaddr offset, 259 unsigned int width) 260 { 261 uint8_t *p = (uint8_t *)pfl->storage + offset; 262 uint64_t ret = pfl->be ? ldn_be_p(p, width) : ldn_le_p(p, width); 263 trace_pflash_data_read(offset, width, ret); 264 return ret; 265 } 266 267 typedef struct { 268 uint32_t len; 269 uint32_t num; 270 } SectorInfo; 271 272 /* 273 * offset should be a byte offset of the QEMU device and _not_ a device 274 * offset. 275 */ 276 static SectorInfo pflash_sector_info(PFlashCFI02 *pfl, hwaddr offset) 277 { 278 assert(offset < pfl->chip_len); 279 hwaddr addr = 0; 280 uint32_t sector_num = 0; 281 for (int i = 0; i < pflash_regions_count(pfl); ++i) { 282 uint64_t region_size = (uint64_t)pfl->nb_blocs[i] * pfl->sector_len[i]; 283 if (addr <= offset && offset < addr + region_size) { 284 return (SectorInfo) { 285 .len = pfl->sector_len[i], 286 .num = sector_num + (offset - addr) / pfl->sector_len[i], 287 }; 288 } 289 sector_num += pfl->nb_blocs[i]; 290 addr += region_size; 291 } 292 abort(); 293 } 294 295 /* 296 * Returns true if the offset refers to a flash sector that is currently being 297 * erased. 298 */ 299 static bool pflash_sector_is_erasing(PFlashCFI02 *pfl, hwaddr offset) 300 { 301 long sector_num = pflash_sector_info(pfl, offset).num; 302 return test_bit(sector_num, pfl->sector_erase_map); 303 } 304 305 static uint64_t pflash_read(void *opaque, hwaddr offset, unsigned int width) 306 { 307 PFlashCFI02 *pfl = opaque; 308 hwaddr boff; 309 uint64_t ret; 310 311 ret = -1; 312 /* Lazy reset to ROMD mode after a certain amount of read accesses */ 313 if (!pfl->rom_mode && pfl->wcycle == 0 && 314 ++pfl->read_counter > PFLASH_LAZY_ROMD_THRESHOLD) { 315 pflash_register_memory(pfl, 1); 316 } 317 offset &= pfl->chip_len - 1; 318 boff = offset & 0xFF; 319 if (pfl->width == 2) { 320 boff = boff >> 1; 321 } else if (pfl->width == 4) { 322 boff = boff >> 2; 323 } 324 switch (pfl->cmd) { 325 default: 326 /* This should never happen : reset state & treat it as a read*/ 327 DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd); 328 pfl->wcycle = 0; 329 pfl->cmd = 0; 330 /* fall through to the read code */ 331 case 0x80: /* Erase (unlock) */ 332 /* We accept reads during second unlock sequence... */ 333 case 0x00: 334 if (pflash_erase_suspend_mode(pfl) && 335 pflash_sector_is_erasing(pfl, offset)) { 336 /* Toggle bit 2, but not 6. */ 337 toggle_dq2(pfl); 338 /* Status register read */ 339 ret = pfl->status; 340 DPRINTF("%s: status %" PRIx64 "\n", __func__, ret); 341 break; 342 } 343 /* Flash area read */ 344 ret = pflash_data_read(pfl, offset, width); 345 break; 346 case 0x90: /* flash ID read */ 347 switch (boff) { 348 case 0x00: 349 case 0x01: 350 ret = boff & 0x01 ? pfl->ident1 : pfl->ident0; 351 break; 352 case 0x02: 353 ret = 0x00; /* Pretend all sectors are unprotected */ 354 break; 355 case 0x0E: 356 case 0x0F: 357 ret = boff & 0x01 ? pfl->ident3 : pfl->ident2; 358 if (ret != (uint8_t)-1) { 359 break; 360 } 361 /* Fall through to data read. */ 362 default: 363 ret = pflash_data_read(pfl, offset, width); 364 } 365 DPRINTF("%s: ID " TARGET_FMT_plx " %" PRIx64 "\n", __func__, boff, ret); 366 break; 367 case 0x10: /* Chip Erase */ 368 case 0x30: /* Sector Erase */ 369 /* Toggle bit 2 during erase, but not program. */ 370 toggle_dq2(pfl); 371 /* fall through */ 372 case 0xA0: /* Program */ 373 /* Toggle bit 6 */ 374 toggle_dq6(pfl); 375 /* Status register read */ 376 ret = pfl->status; 377 DPRINTF("%s: status %" PRIx64 "\n", __func__, ret); 378 break; 379 case 0x98: 380 /* CFI query mode */ 381 if (boff < sizeof(pfl->cfi_table)) { 382 ret = pfl->cfi_table[boff]; 383 } else { 384 ret = 0; 385 } 386 break; 387 } 388 trace_pflash_io_read(offset, width, ret, pfl->cmd, pfl->wcycle); 389 390 return ret; 391 } 392 393 /* update flash content on disk */ 394 static void pflash_update(PFlashCFI02 *pfl, int offset, int size) 395 { 396 int offset_end; 397 if (pfl->blk) { 398 offset_end = offset + size; 399 /* widen to sector boundaries */ 400 offset = QEMU_ALIGN_DOWN(offset, BDRV_SECTOR_SIZE); 401 offset_end = QEMU_ALIGN_UP(offset_end, BDRV_SECTOR_SIZE); 402 blk_pwrite(pfl->blk, offset, pfl->storage + offset, 403 offset_end - offset, 0); 404 } 405 } 406 407 static void pflash_sector_erase(PFlashCFI02 *pfl, hwaddr offset) 408 { 409 SectorInfo sector_info = pflash_sector_info(pfl, offset); 410 uint64_t sector_len = sector_info.len; 411 offset &= ~(sector_len - 1); 412 DPRINTF("%s: start sector erase at %0*" PRIx64 "-%0*" PRIx64 "\n", 413 __func__, pfl->width * 2, offset, 414 pfl->width * 2, offset + sector_len - 1); 415 if (!pfl->ro) { 416 uint8_t *p = pfl->storage; 417 memset(p + offset, 0xff, sector_len); 418 pflash_update(pfl, offset, sector_len); 419 } 420 set_dq7(pfl, 0x00); 421 ++pfl->sectors_to_erase; 422 set_bit(sector_info.num, pfl->sector_erase_map); 423 /* Set (or reset) the 50 us timer for additional erase commands. */ 424 timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 50000); 425 } 426 427 static void pflash_write(void *opaque, hwaddr offset, uint64_t value, 428 unsigned int width) 429 { 430 PFlashCFI02 *pfl = opaque; 431 hwaddr boff; 432 uint8_t *p; 433 uint8_t cmd; 434 435 trace_pflash_io_write(offset, width, value, pfl->wcycle); 436 cmd = value; 437 if (pfl->cmd != 0xA0) { 438 /* Reset does nothing during chip erase and sector erase. */ 439 if (cmd == 0xF0 && pfl->cmd != 0x10 && pfl->cmd != 0x30) { 440 if (pfl->wcycle == WCYCLE_AUTOSELECT_CFI) { 441 /* Return to autoselect mode. */ 442 pfl->wcycle = 3; 443 pfl->cmd = 0x90; 444 return; 445 } 446 goto reset_flash; 447 } 448 } 449 offset &= pfl->chip_len - 1; 450 451 boff = offset; 452 if (pfl->width == 2) { 453 boff = boff >> 1; 454 } else if (pfl->width == 4) { 455 boff = boff >> 2; 456 } 457 /* Only the least-significant 11 bits are used in most cases. */ 458 boff &= 0x7FF; 459 switch (pfl->wcycle) { 460 case 0: 461 /* Set the device in I/O access mode if required */ 462 if (pfl->rom_mode) 463 pflash_register_memory(pfl, 0); 464 pfl->read_counter = 0; 465 /* We're in read mode */ 466 check_unlock0: 467 if (boff == 0x55 && cmd == 0x98) { 468 /* Enter CFI query mode */ 469 pfl->wcycle = WCYCLE_CFI; 470 pfl->cmd = 0x98; 471 return; 472 } 473 /* Handle erase resume in erase suspend mode, otherwise reset. */ 474 if (cmd == 0x30) { /* Erase Resume */ 475 if (pflash_erase_suspend_mode(pfl)) { 476 /* Resume the erase. */ 477 timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 478 pfl->erase_time_remaining); 479 pfl->erase_time_remaining = 0; 480 pfl->wcycle = 6; 481 pfl->cmd = 0x30; 482 set_dq7(pfl, 0x00); 483 assert_dq3(pfl); 484 return; 485 } 486 goto reset_flash; 487 } 488 /* Ignore erase suspend. */ 489 if (cmd == 0xB0) { /* Erase Suspend */ 490 return; 491 } 492 if (boff != pfl->unlock_addr0 || cmd != 0xAA) { 493 DPRINTF("%s: unlock0 failed " TARGET_FMT_plx " %02x %04x\n", 494 __func__, boff, cmd, pfl->unlock_addr0); 495 goto reset_flash; 496 } 497 DPRINTF("%s: unlock sequence started\n", __func__); 498 break; 499 case 1: 500 /* We started an unlock sequence */ 501 check_unlock1: 502 if (boff != pfl->unlock_addr1 || cmd != 0x55) { 503 DPRINTF("%s: unlock1 failed " TARGET_FMT_plx " %02x\n", __func__, 504 boff, cmd); 505 goto reset_flash; 506 } 507 DPRINTF("%s: unlock sequence done\n", __func__); 508 break; 509 case 2: 510 /* We finished an unlock sequence */ 511 if (!pfl->bypass && boff != pfl->unlock_addr0) { 512 DPRINTF("%s: command failed " TARGET_FMT_plx " %02x\n", __func__, 513 boff, cmd); 514 goto reset_flash; 515 } 516 switch (cmd) { 517 case 0x20: 518 pfl->bypass = 1; 519 goto do_bypass; 520 case 0x80: /* Erase */ 521 case 0x90: /* Autoselect */ 522 case 0xA0: /* Program */ 523 pfl->cmd = cmd; 524 DPRINTF("%s: starting command %02x\n", __func__, cmd); 525 break; 526 default: 527 DPRINTF("%s: unknown command %02x\n", __func__, cmd); 528 goto reset_flash; 529 } 530 break; 531 case 3: 532 switch (pfl->cmd) { 533 case 0x80: /* Erase */ 534 /* We need another unlock sequence */ 535 goto check_unlock0; 536 case 0xA0: /* Program */ 537 if (pflash_erase_suspend_mode(pfl) && 538 pflash_sector_is_erasing(pfl, offset)) { 539 /* Ignore writes to erasing sectors. */ 540 if (pfl->bypass) { 541 goto do_bypass; 542 } 543 goto reset_flash; 544 } 545 trace_pflash_data_write(offset, width, value, 0); 546 if (!pfl->ro) { 547 p = (uint8_t *)pfl->storage + offset; 548 if (pfl->be) { 549 uint64_t current = ldn_be_p(p, width); 550 stn_be_p(p, width, current & value); 551 } else { 552 uint64_t current = ldn_le_p(p, width); 553 stn_le_p(p, width, current & value); 554 } 555 pflash_update(pfl, offset, width); 556 } 557 /* 558 * While programming, status bit DQ7 should hold the opposite 559 * value from how it was programmed. 560 */ 561 set_dq7(pfl, ~value); 562 /* Let's pretend write is immediate */ 563 if (pfl->bypass) 564 goto do_bypass; 565 goto reset_flash; 566 case 0x90: /* Autoselect */ 567 if (pfl->bypass && cmd == 0x00) { 568 /* Unlock bypass reset */ 569 goto reset_flash; 570 } 571 /* 572 * We can enter CFI query mode from autoselect mode, but we must 573 * return to autoselect mode after a reset. 574 */ 575 if (boff == 0x55 && cmd == 0x98) { 576 /* Enter autoselect CFI query mode */ 577 pfl->wcycle = WCYCLE_AUTOSELECT_CFI; 578 pfl->cmd = 0x98; 579 return; 580 } 581 /* fall through */ 582 default: 583 DPRINTF("%s: invalid write for command %02x\n", 584 __func__, pfl->cmd); 585 goto reset_flash; 586 } 587 case 4: 588 switch (pfl->cmd) { 589 case 0xA0: /* Program */ 590 /* Ignore writes while flash data write is occurring */ 591 /* As we suppose write is immediate, this should never happen */ 592 return; 593 case 0x80: /* Erase */ 594 goto check_unlock1; 595 default: 596 /* Should never happen */ 597 DPRINTF("%s: invalid command state %02x (wc 4)\n", 598 __func__, pfl->cmd); 599 goto reset_flash; 600 } 601 break; 602 case 5: 603 if (pflash_erase_suspend_mode(pfl)) { 604 /* Erasing is not supported in erase suspend mode. */ 605 goto reset_flash; 606 } 607 switch (cmd) { 608 case 0x10: /* Chip Erase */ 609 if (boff != pfl->unlock_addr0) { 610 DPRINTF("%s: chip erase: invalid address " TARGET_FMT_plx "\n", 611 __func__, offset); 612 goto reset_flash; 613 } 614 /* Chip erase */ 615 DPRINTF("%s: start chip erase\n", __func__); 616 if (!pfl->ro) { 617 memset(pfl->storage, 0xff, pfl->chip_len); 618 pflash_update(pfl, 0, pfl->chip_len); 619 } 620 set_dq7(pfl, 0x00); 621 /* Wait the time specified at CFI address 0x22. */ 622 timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 623 (1ULL << pfl->cfi_table[0x22]) * SCALE_MS); 624 break; 625 case 0x30: /* Sector erase */ 626 pflash_sector_erase(pfl, offset); 627 break; 628 default: 629 DPRINTF("%s: invalid command %02x (wc 5)\n", __func__, cmd); 630 goto reset_flash; 631 } 632 pfl->cmd = cmd; 633 break; 634 case 6: 635 switch (pfl->cmd) { 636 case 0x10: /* Chip Erase */ 637 /* Ignore writes during chip erase */ 638 return; 639 case 0x30: /* Sector erase */ 640 if (cmd == 0xB0) { 641 /* 642 * If erase suspend happens during the erase timeout (so DQ3 is 643 * 0), then the device suspends erasing immediately. Set the 644 * remaining time to be the total time to erase. Otherwise, 645 * there is a maximum amount of time it can take to enter 646 * suspend mode. Let's ignore that and suspend immediately and 647 * set the remaining time to the actual time remaining on the 648 * timer. 649 */ 650 if ((pfl->status & 0x08) == 0) { 651 pfl->erase_time_remaining = pflash_erase_time(pfl); 652 } else { 653 int64_t delta = timer_expire_time_ns(&pfl->timer) - 654 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 655 /* Make sure we have a positive time remaining. */ 656 pfl->erase_time_remaining = delta <= 0 ? 1 : delta; 657 } 658 reset_dq3(pfl); 659 timer_del(&pfl->timer); 660 pfl->wcycle = 0; 661 pfl->cmd = 0; 662 return; 663 } 664 /* 665 * If DQ3 is 0, additional sector erase commands can be 666 * written and anything else (other than an erase suspend) resets 667 * the device. 668 */ 669 if ((pfl->status & 0x08) == 0) { 670 if (cmd == 0x30) { 671 pflash_sector_erase(pfl, offset); 672 } else { 673 goto reset_flash; 674 } 675 } 676 /* Ignore writes during the actual erase. */ 677 return; 678 default: 679 /* Should never happen */ 680 DPRINTF("%s: invalid command state %02x (wc 6)\n", 681 __func__, pfl->cmd); 682 goto reset_flash; 683 } 684 break; 685 /* Special values for CFI queries */ 686 case WCYCLE_CFI: 687 case WCYCLE_AUTOSELECT_CFI: 688 DPRINTF("%s: invalid write in CFI query mode\n", __func__); 689 goto reset_flash; 690 default: 691 /* Should never happen */ 692 DPRINTF("%s: invalid write state (wc 7)\n", __func__); 693 goto reset_flash; 694 } 695 pfl->wcycle++; 696 697 return; 698 699 /* Reset flash */ 700 reset_flash: 701 trace_pflash_reset(); 702 pfl->bypass = 0; 703 pfl->wcycle = 0; 704 pfl->cmd = 0; 705 return; 706 707 do_bypass: 708 pfl->wcycle = 2; 709 pfl->cmd = 0; 710 } 711 712 static const MemoryRegionOps pflash_cfi02_ops = { 713 .read = pflash_read, 714 .write = pflash_write, 715 .valid.min_access_size = 1, 716 .valid.max_access_size = 4, 717 .endianness = DEVICE_NATIVE_ENDIAN, 718 }; 719 720 static void pflash_cfi02_realize(DeviceState *dev, Error **errp) 721 { 722 PFlashCFI02 *pfl = PFLASH_CFI02(dev); 723 int ret; 724 Error *local_err = NULL; 725 726 if (pfl->uniform_sector_len == 0 && pfl->sector_len[0] == 0) { 727 error_setg(errp, "attribute \"sector-length\" not specified or zero."); 728 return; 729 } 730 if (pfl->uniform_nb_blocs == 0 && pfl->nb_blocs[0] == 0) { 731 error_setg(errp, "attribute \"num-blocks\" not specified or zero."); 732 return; 733 } 734 if (pfl->name == NULL) { 735 error_setg(errp, "attribute \"name\" not specified."); 736 return; 737 } 738 739 int nb_regions; 740 pfl->chip_len = 0; 741 pfl->total_sectors = 0; 742 for (nb_regions = 0; nb_regions < PFLASH_MAX_ERASE_REGIONS; ++nb_regions) { 743 if (pfl->nb_blocs[nb_regions] == 0) { 744 break; 745 } 746 pfl->total_sectors += pfl->nb_blocs[nb_regions]; 747 uint64_t sector_len_per_device = pfl->sector_len[nb_regions]; 748 749 /* 750 * The size of each flash sector must be a power of 2 and it must be 751 * aligned at the same power of 2. 752 */ 753 if (sector_len_per_device & 0xff || 754 sector_len_per_device >= (1 << 24) || 755 !is_power_of_2(sector_len_per_device)) 756 { 757 error_setg(errp, "unsupported configuration: " 758 "sector length[%d] per device = %" PRIx64 ".", 759 nb_regions, sector_len_per_device); 760 return; 761 } 762 if (pfl->chip_len & (sector_len_per_device - 1)) { 763 error_setg(errp, "unsupported configuration: " 764 "flash region %d not correctly aligned.", 765 nb_regions); 766 return; 767 } 768 769 pfl->chip_len += (uint64_t)pfl->sector_len[nb_regions] * 770 pfl->nb_blocs[nb_regions]; 771 } 772 773 uint64_t uniform_len = (uint64_t)pfl->uniform_nb_blocs * 774 pfl->uniform_sector_len; 775 if (nb_regions == 0) { 776 nb_regions = 1; 777 pfl->nb_blocs[0] = pfl->uniform_nb_blocs; 778 pfl->sector_len[0] = pfl->uniform_sector_len; 779 pfl->chip_len = uniform_len; 780 pfl->total_sectors = pfl->uniform_nb_blocs; 781 } else if (uniform_len != 0 && uniform_len != pfl->chip_len) { 782 error_setg(errp, "\"num-blocks\"*\"sector-length\" " 783 "different from \"num-blocks0\"*\'sector-length0\" + ... + " 784 "\"num-blocks3\"*\"sector-length3\""); 785 return; 786 } 787 788 memory_region_init_rom_device(&pfl->orig_mem, OBJECT(pfl), 789 &pflash_cfi02_ops, pfl, pfl->name, 790 pfl->chip_len, &local_err); 791 if (local_err) { 792 error_propagate(errp, local_err); 793 return; 794 } 795 796 pfl->storage = memory_region_get_ram_ptr(&pfl->orig_mem); 797 798 if (pfl->blk) { 799 uint64_t perm; 800 pfl->ro = blk_is_read_only(pfl->blk); 801 perm = BLK_PERM_CONSISTENT_READ | (pfl->ro ? 0 : BLK_PERM_WRITE); 802 ret = blk_set_perm(pfl->blk, perm, BLK_PERM_ALL, errp); 803 if (ret < 0) { 804 return; 805 } 806 } else { 807 pfl->ro = 0; 808 } 809 810 if (pfl->blk) { 811 if (!blk_check_size_and_read_all(pfl->blk, pfl->storage, 812 pfl->chip_len, errp)) { 813 vmstate_unregister_ram(&pfl->orig_mem, DEVICE(pfl)); 814 return; 815 } 816 } 817 818 /* Only 11 bits are used in the comparison. */ 819 pfl->unlock_addr0 &= 0x7FF; 820 pfl->unlock_addr1 &= 0x7FF; 821 822 /* Allocate memory for a bitmap for sectors being erased. */ 823 pfl->sector_erase_map = bitmap_new(pfl->total_sectors); 824 825 pflash_setup_mappings(pfl); 826 pfl->rom_mode = 1; 827 sysbus_init_mmio(SYS_BUS_DEVICE(dev), &pfl->mem); 828 829 timer_init_ns(&pfl->timer, QEMU_CLOCK_VIRTUAL, pflash_timer, pfl); 830 pfl->wcycle = 0; 831 pfl->cmd = 0; 832 pfl->status = 0; 833 834 /* Hardcoded CFI table (mostly from SG29 Spansion flash) */ 835 const uint16_t pri_ofs = 0x40; 836 /* Standard "QRY" string */ 837 pfl->cfi_table[0x10] = 'Q'; 838 pfl->cfi_table[0x11] = 'R'; 839 pfl->cfi_table[0x12] = 'Y'; 840 /* Command set (AMD/Fujitsu) */ 841 pfl->cfi_table[0x13] = 0x02; 842 pfl->cfi_table[0x14] = 0x00; 843 /* Primary extended table address */ 844 pfl->cfi_table[0x15] = pri_ofs; 845 pfl->cfi_table[0x16] = pri_ofs >> 8; 846 /* Alternate command set (none) */ 847 pfl->cfi_table[0x17] = 0x00; 848 pfl->cfi_table[0x18] = 0x00; 849 /* Alternate extended table (none) */ 850 pfl->cfi_table[0x19] = 0x00; 851 pfl->cfi_table[0x1A] = 0x00; 852 /* Vcc min */ 853 pfl->cfi_table[0x1B] = 0x27; 854 /* Vcc max */ 855 pfl->cfi_table[0x1C] = 0x36; 856 /* Vpp min (no Vpp pin) */ 857 pfl->cfi_table[0x1D] = 0x00; 858 /* Vpp max (no Vpp pin) */ 859 pfl->cfi_table[0x1E] = 0x00; 860 /* Timeout per single byte/word write (128 ms) */ 861 pfl->cfi_table[0x1F] = 0x07; 862 /* Timeout for min size buffer write (NA) */ 863 pfl->cfi_table[0x20] = 0x00; 864 /* Typical timeout for block erase (512 ms) */ 865 pfl->cfi_table[0x21] = 0x09; 866 /* Typical timeout for full chip erase (4096 ms) */ 867 pfl->cfi_table[0x22] = 0x0C; 868 /* Reserved */ 869 pfl->cfi_table[0x23] = 0x01; 870 /* Max timeout for buffer write (NA) */ 871 pfl->cfi_table[0x24] = 0x00; 872 /* Max timeout for block erase */ 873 pfl->cfi_table[0x25] = 0x0A; 874 /* Max timeout for chip erase */ 875 pfl->cfi_table[0x26] = 0x0D; 876 /* Device size */ 877 pfl->cfi_table[0x27] = ctz32(pfl->chip_len); 878 /* Flash device interface (8 & 16 bits) */ 879 pfl->cfi_table[0x28] = 0x02; 880 pfl->cfi_table[0x29] = 0x00; 881 /* Max number of bytes in multi-bytes write */ 882 /* XXX: disable buffered write as it's not supported */ 883 // pfl->cfi_table[0x2A] = 0x05; 884 pfl->cfi_table[0x2A] = 0x00; 885 pfl->cfi_table[0x2B] = 0x00; 886 /* Number of erase block regions */ 887 pfl->cfi_table[0x2c] = nb_regions; 888 /* Erase block regions */ 889 for (int i = 0; i < nb_regions; ++i) { 890 uint32_t sector_len_per_device = pfl->sector_len[i]; 891 pfl->cfi_table[0x2d + 4 * i] = pfl->nb_blocs[i] - 1; 892 pfl->cfi_table[0x2e + 4 * i] = (pfl->nb_blocs[i] - 1) >> 8; 893 pfl->cfi_table[0x2f + 4 * i] = sector_len_per_device >> 8; 894 pfl->cfi_table[0x30 + 4 * i] = sector_len_per_device >> 16; 895 } 896 assert(0x2c + 4 * nb_regions < pri_ofs); 897 898 /* Extended */ 899 pfl->cfi_table[0x00 + pri_ofs] = 'P'; 900 pfl->cfi_table[0x01 + pri_ofs] = 'R'; 901 pfl->cfi_table[0x02 + pri_ofs] = 'I'; 902 903 /* Extended version 1.0 */ 904 pfl->cfi_table[0x03 + pri_ofs] = '1'; 905 pfl->cfi_table[0x04 + pri_ofs] = '0'; 906 907 /* Address sensitive unlock required. */ 908 pfl->cfi_table[0x05 + pri_ofs] = 0x00; 909 /* Erase suspend to read/write. */ 910 pfl->cfi_table[0x06 + pri_ofs] = 0x02; 911 /* Sector protect not supported. */ 912 pfl->cfi_table[0x07 + pri_ofs] = 0x00; 913 /* Temporary sector unprotect not supported. */ 914 pfl->cfi_table[0x08 + pri_ofs] = 0x00; 915 916 /* Sector protect/unprotect scheme. */ 917 pfl->cfi_table[0x09 + pri_ofs] = 0x00; 918 919 /* Simultaneous operation not supported. */ 920 pfl->cfi_table[0x0a + pri_ofs] = 0x00; 921 /* Burst mode not supported. */ 922 pfl->cfi_table[0x0b + pri_ofs] = 0x00; 923 /* Page mode not supported. */ 924 pfl->cfi_table[0x0c + pri_ofs] = 0x00; 925 assert(0x0c + pri_ofs < ARRAY_SIZE(pfl->cfi_table)); 926 } 927 928 static Property pflash_cfi02_properties[] = { 929 DEFINE_PROP_DRIVE("drive", PFlashCFI02, blk), 930 DEFINE_PROP_UINT32("num-blocks", PFlashCFI02, uniform_nb_blocs, 0), 931 DEFINE_PROP_UINT32("sector-length", PFlashCFI02, uniform_sector_len, 0), 932 DEFINE_PROP_UINT32("num-blocks0", PFlashCFI02, nb_blocs[0], 0), 933 DEFINE_PROP_UINT32("sector-length0", PFlashCFI02, sector_len[0], 0), 934 DEFINE_PROP_UINT32("num-blocks1", PFlashCFI02, nb_blocs[1], 0), 935 DEFINE_PROP_UINT32("sector-length1", PFlashCFI02, sector_len[1], 0), 936 DEFINE_PROP_UINT32("num-blocks2", PFlashCFI02, nb_blocs[2], 0), 937 DEFINE_PROP_UINT32("sector-length2", PFlashCFI02, sector_len[2], 0), 938 DEFINE_PROP_UINT32("num-blocks3", PFlashCFI02, nb_blocs[3], 0), 939 DEFINE_PROP_UINT32("sector-length3", PFlashCFI02, sector_len[3], 0), 940 DEFINE_PROP_UINT8("width", PFlashCFI02, width, 0), 941 DEFINE_PROP_UINT8("mappings", PFlashCFI02, mappings, 0), 942 DEFINE_PROP_UINT8("big-endian", PFlashCFI02, be, 0), 943 DEFINE_PROP_UINT16("id0", PFlashCFI02, ident0, 0), 944 DEFINE_PROP_UINT16("id1", PFlashCFI02, ident1, 0), 945 DEFINE_PROP_UINT16("id2", PFlashCFI02, ident2, 0), 946 DEFINE_PROP_UINT16("id3", PFlashCFI02, ident3, 0), 947 DEFINE_PROP_UINT16("unlock-addr0", PFlashCFI02, unlock_addr0, 0), 948 DEFINE_PROP_UINT16("unlock-addr1", PFlashCFI02, unlock_addr1, 0), 949 DEFINE_PROP_STRING("name", PFlashCFI02, name), 950 DEFINE_PROP_END_OF_LIST(), 951 }; 952 953 static void pflash_cfi02_unrealize(DeviceState *dev, Error **errp) 954 { 955 PFlashCFI02 *pfl = PFLASH_CFI02(dev); 956 timer_del(&pfl->timer); 957 g_free(pfl->sector_erase_map); 958 } 959 960 static void pflash_cfi02_class_init(ObjectClass *klass, void *data) 961 { 962 DeviceClass *dc = DEVICE_CLASS(klass); 963 964 dc->realize = pflash_cfi02_realize; 965 dc->unrealize = pflash_cfi02_unrealize; 966 dc->props = pflash_cfi02_properties; 967 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 968 } 969 970 static const TypeInfo pflash_cfi02_info = { 971 .name = TYPE_PFLASH_CFI02, 972 .parent = TYPE_SYS_BUS_DEVICE, 973 .instance_size = sizeof(PFlashCFI02), 974 .class_init = pflash_cfi02_class_init, 975 }; 976 977 static void pflash_cfi02_register_types(void) 978 { 979 type_register_static(&pflash_cfi02_info); 980 } 981 982 type_init(pflash_cfi02_register_types) 983 984 PFlashCFI02 *pflash_cfi02_register(hwaddr base, 985 const char *name, 986 hwaddr size, 987 BlockBackend *blk, 988 uint32_t sector_len, 989 int nb_mappings, int width, 990 uint16_t id0, uint16_t id1, 991 uint16_t id2, uint16_t id3, 992 uint16_t unlock_addr0, 993 uint16_t unlock_addr1, 994 int be) 995 { 996 DeviceState *dev = qdev_create(NULL, TYPE_PFLASH_CFI02); 997 998 if (blk) { 999 qdev_prop_set_drive(dev, "drive", blk, &error_abort); 1000 } 1001 assert(size % sector_len == 0); 1002 qdev_prop_set_uint32(dev, "num-blocks", size / sector_len); 1003 qdev_prop_set_uint32(dev, "sector-length", sector_len); 1004 qdev_prop_set_uint8(dev, "width", width); 1005 qdev_prop_set_uint8(dev, "mappings", nb_mappings); 1006 qdev_prop_set_uint8(dev, "big-endian", !!be); 1007 qdev_prop_set_uint16(dev, "id0", id0); 1008 qdev_prop_set_uint16(dev, "id1", id1); 1009 qdev_prop_set_uint16(dev, "id2", id2); 1010 qdev_prop_set_uint16(dev, "id3", id3); 1011 qdev_prop_set_uint16(dev, "unlock-addr0", unlock_addr0); 1012 qdev_prop_set_uint16(dev, "unlock-addr1", unlock_addr1); 1013 qdev_prop_set_string(dev, "name", name); 1014 qdev_init_nofail(dev); 1015 1016 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base); 1017 return PFLASH_CFI02(dev); 1018 } 1019