1/*
2 * CFI parallel flash with AMD command set emulation
3 *
4 * Copyright (c) 2005 Jocelyn Mayer
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20/*
21 * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
22 * Supported commands/modes are:
23 * - flash read
24 * - flash write
25 * - flash ID read
26 * - sector erase
27 * - chip erase
28 * - unlock bypass command
29 * - CFI queries
30 *
31 * It does not support flash interleaving.
32 * It does not implement software data protection as found in many real chips
33 */
34
35#include "qemu/osdep.h"
36#include "hw/block/block.h"
37#include "hw/block/flash.h"
38#include "hw/qdev-properties.h"
39#include "qapi/error.h"
40#include "qemu/bitmap.h"
41#include "qemu/timer.h"
42#include "sysemu/block-backend.h"
43#include "qemu/host-utils.h"
44#include "qemu/module.h"
45#include "hw/sysbus.h"
46#include "migration/vmstate.h"
47#include "trace.h"
48
49#define PFLASH_DEBUG false
50#define DPRINTF(fmt, ...) \
51do { \
52 if (PFLASH_DEBUG) { \
53 fprintf(stderr, "PFLASH: " fmt, ## __VA_ARGS__); \
54 } \
55} while (0)
56
57#define PFLASH_LAZY_ROMD_THRESHOLD 42
58
59/*
60 * The size of the cfi_table indirectly depends on this and the start of the
61 * PRI table directly depends on it. 4 is the maximum size (and also what
62 * seems common) without changing the PRT table address.
63 */
64#define PFLASH_MAX_ERASE_REGIONS 4
65
66/* Special write cycles for CFI queries. */
67enum {
68 WCYCLE_CFI = 7,
69 WCYCLE_AUTOSELECT_CFI = 8,
70};
71
72struct PFlashCFI02 {
73 /*< private >*/
74 SysBusDevice parent_obj;
75 /*< public >*/
76
77 BlockBackend *blk;
78 uint32_t uniform_nb_blocs;
79 uint32_t uniform_sector_len;
80 uint32_t total_sectors;
81 uint32_t nb_blocs[PFLASH_MAX_ERASE_REGIONS];
82 uint32_t sector_len[PFLASH_MAX_ERASE_REGIONS];
83 uint32_t chip_len;
84 uint8_t mappings;
85 uint8_t width;
86 uint8_t be;
87 int wcycle; /* if 0, the flash is read normally */
88 int bypass;
89 int ro;
90 uint8_t cmd;
91 uint8_t status;
92 /* FIXME: implement array device properties */
93 uint16_t ident0;
94 uint16_t ident1;
95 uint16_t ident2;
96 uint16_t ident3;
97 uint16_t unlock_addr0;
98 uint16_t unlock_addr1;
99 uint8_t cfi_table[0x4d];
100 QEMUTimer timer;
101 /* The device replicates the flash memory across its memory space. Emulate
102 * that by having a container (.mem) filled with an array of aliases
103 * (.mem_mappings) pointing to the flash memory (.orig_mem).
104 */
105 MemoryRegion mem;
106 MemoryRegion *mem_mappings; /* array; one per mapping */
107 MemoryRegion orig_mem;
108 int rom_mode;
109 int read_counter; /* used for lazy switch-back to rom mode */
110 int sectors_to_erase;
111 uint64_t erase_time_remaining;
112 unsigned long *sector_erase_map;
113 char *name;
114 void *storage;
115};
116
117/*
118 * Toggle status bit DQ7.
119 */
120static inline void toggle_dq7(PFlashCFI02 *pfl)
121{
122 pfl->status ^= 0x80;
123}
124
125/*
126 * Set status bit DQ7 to bit 7 of value.
127 */
128static inline void set_dq7(PFlashCFI02 *pfl, uint8_t value)
129{
130 pfl->status &= 0x7F;
131 pfl->status |= value & 0x80;
132}
133
134/*
135 * Toggle status bit DQ6.
136 */
137static inline void toggle_dq6(PFlashCFI02 *pfl)
138{
139 pfl->status ^= 0x40;
140}
141
142/*
143 * Turn on DQ3.
144 */
145static inline void assert_dq3(PFlashCFI02 *pfl)
146{
147 pfl->status |= 0x08;
148}
149
150/*
151 * Turn off DQ3.
152 */
153static inline void reset_dq3(PFlashCFI02 *pfl)
154{
155 pfl->status &= ~0x08;
156}
157
158/*
159 * Toggle status bit DQ2.
160 */
161static inline void toggle_dq2(PFlashCFI02 *pfl)
162{
163 pfl->status ^= 0x04;
164}
165
166/*
167 * Set up replicated mappings of the same region.
168 */
169static void pflash_setup_mappings(PFlashCFI02 *pfl)
170{
171 unsigned i;
172 hwaddr size = memory_region_size(&pfl->orig_mem);
173
174 memory_region_init(&pfl->mem, OBJECT(pfl), "pflash", pfl->mappings * size);
175 pfl->mem_mappings = g_new(MemoryRegion, pfl->mappings);
176 for (i = 0; i < pfl->mappings; ++i) {
177 memory_region_init_alias(&pfl->mem_mappings[i], OBJECT(pfl),
178 "pflash-alias", &pfl->orig_mem, 0, size);
179 memory_region_add_subregion(&pfl->mem, i * size, &pfl->mem_mappings[i]);
180 }
181}
182
183static void pflash_register_memory(PFlashCFI02 *pfl, int rom_mode)
184{
185 memory_region_rom_device_set_romd(&pfl->orig_mem, rom_mode);
186 pfl->rom_mode = rom_mode;
187}
188
189static size_t pflash_regions_count(PFlashCFI02 *pfl)
190{
191 return pfl->cfi_table[0x2c];
192}
193
194/*
195 * Returns the time it takes to erase the number of sectors scheduled for
196 * erasure based on CFI address 0x21 which is "Typical timeout per individual
197 * block erase 2^N ms."
198 */
199static uint64_t pflash_erase_time(PFlashCFI02 *pfl)
200{
201 /*
202 * If there are no sectors to erase (which can happen if all of the sectors
203 * to be erased are protected), then erase takes 100 us. Protected sectors
204 * aren't supported so this should never happen.
205 */
206 return ((1ULL << pfl->cfi_table[0x21]) * pfl->sectors_to_erase) * SCALE_US;
207}
208
209/*
210 * Returns true if the device is currently in erase suspend mode.
211 */
212static inline bool pflash_erase_suspend_mode(PFlashCFI02 *pfl)
213{
214 return pfl->erase_time_remaining > 0;
215}
216
217static void pflash_timer(void *opaque)
218{
219 PFlashCFI02 *pfl = opaque;
220
221 trace_pflash_timer_expired(pfl->cmd);
222 if (pfl->cmd == 0x30) {
223 /*
224 * Sector erase. If DQ3 is 0 when the timer expires, then the 50
225 * us erase timeout has expired so we need to start the timer for the
226 * sector erase algorithm. Otherwise, the erase completed and we should
227 * go back to read array mode.
228 */
229 if ((pfl->status & 0x08) == 0) {
230 assert_dq3(pfl);
231 uint64_t timeout = pflash_erase_time(pfl);
232 timer_mod(&pfl->timer,
233 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + timeout);
234 DPRINTF("%s: erase timeout fired; erasing %d sectors\n",
235 __func__, pfl->sectors_to_erase);
236 return;
237 }
238 DPRINTF("%s: sector erase complete\n", __func__);
239 bitmap_zero(pfl->sector_erase_map, pfl->total_sectors);
240 pfl->sectors_to_erase = 0;
241 reset_dq3(pfl);
242 }
243
244 /* Reset flash */
245 toggle_dq7(pfl);
246 if (pfl->bypass) {
247 pfl->wcycle = 2;
248 } else {
249 pflash_register_memory(pfl, 1);
250 pfl->wcycle = 0;
251 }
252 pfl->cmd = 0;
253}
254
255/*
256 * Read data from flash.
257 */
258static uint64_t pflash_data_read(PFlashCFI02 *pfl, hwaddr offset,
259 unsigned int width)
260{
261 uint8_t *p = (uint8_t *)pfl->storage + offset;
262 uint64_t ret = pfl->be ? ldn_be_p(p, width) : ldn_le_p(p, width);
263 trace_pflash_data_read(offset, width << 1, ret);
264 return ret;
265}
266
267typedef struct {
268 uint32_t len;
269 uint32_t num;
270} SectorInfo;
271
272/*
273 * offset should be a byte offset of the QEMU device and _not_ a device
274 * offset.
275 */
276static SectorInfo pflash_sector_info(PFlashCFI02 *pfl, hwaddr offset)
277{
278 assert(offset < pfl->chip_len);
279 hwaddr addr = 0;
280 uint32_t sector_num = 0;
281 for (int i = 0; i < pflash_regions_count(pfl); ++i) {
282 uint64_t region_size = (uint64_t)pfl->nb_blocs[i] * pfl->sector_len[i];
283 if (addr <= offset && offset < addr + region_size) {
284 return (SectorInfo) {
285 .len = pfl->sector_len[i],
286 .num = sector_num + (offset - addr) / pfl->sector_len[i],
287 };
288 }
289 sector_num += pfl->nb_blocs[i];
290 addr += region_size;
291 }
292 abort();
293}
294
295/*
296 * Returns true if the offset refers to a flash sector that is currently being
297 * erased.
298 */
299static bool pflash_sector_is_erasing(PFlashCFI02 *pfl, hwaddr offset)
300{
301 long sector_num = pflash_sector_info(pfl, offset).num;
302 return test_bit(sector_num, pfl->sector_erase_map);
303}
304
305static uint64_t pflash_read(void *opaque, hwaddr offset, unsigned int width)
306{
307 PFlashCFI02 *pfl = opaque;
308 hwaddr boff;
309 uint64_t ret;
310
311 ret = -1;
312 /* Lazy reset to ROMD mode after a certain amount of read accesses */
313 if (!pfl->rom_mode && pfl->wcycle == 0 &&
314 ++pfl->read_counter > PFLASH_LAZY_ROMD_THRESHOLD) {
315 pflash_register_memory(pfl, 1);
316 }
317 offset &= pfl->chip_len - 1;
318 boff = offset & 0xFF;
319 if (pfl->width == 2) {
320 boff = boff >> 1;
321 } else if (pfl->width == 4) {
322 boff = boff >> 2;
323 }
324 switch (pfl->cmd) {
325 default:
326 /* This should never happen : reset state & treat it as a read*/
327 DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);
328 pfl->wcycle = 0;
329 pfl->cmd = 0;
330 /* fall through to the read code */
331 case 0x80: /* Erase (unlock) */
332 /* We accept reads during second unlock sequence... */
333 case 0x00:
334 if (pflash_erase_suspend_mode(pfl) &&
335 pflash_sector_is_erasing(pfl, offset)) {
336 /* Toggle bit 2, but not 6. */
337 toggle_dq2(pfl);
338 /* Status register read */
339 ret = pfl->status;
340 DPRINTF("%s: status %" PRIx64 "\n", __func__, ret);
341 break;
342 }
343 /* Flash area read */
344 ret = pflash_data_read(pfl, offset, width);
345 break;
346 case 0x90: /* flash ID read */
347 switch (boff) {
348 case 0x00:
349 case 0x01:
350 ret = boff & 0x01 ? pfl->ident1 : pfl->ident0;
351 break;
352 case 0x02:
353 ret = 0x00; /* Pretend all sectors are unprotected */
354 break;
355 case 0x0E:
356 case 0x0F:
357 ret = boff & 0x01 ? pfl->ident3 : pfl->ident2;
358 if (ret != (uint8_t)-1) {
359 break;
360 }
361 /* Fall through to data read. */
362 default:
363 ret = pflash_data_read(pfl, offset, width);
364 }
365 DPRINTF("%s: ID " TARGET_FMT_plx " %" PRIx64 "\n", __func__, boff, ret);
366 break;
367 case 0x10: /* Chip Erase */
368 case 0x30: /* Sector Erase */
369 /* Toggle bit 2 during erase, but not program. */
370 toggle_dq2(pfl);
371 /* fall through */
372 case 0xA0: /* Program */
373 /* Toggle bit 6 */
374 toggle_dq6(pfl);
375 /* Status register read */
376 ret = pfl->status;
377 DPRINTF("%s: status %" PRIx64 "\n", __func__, ret);
378 break;
379 case 0x98:
380 /* CFI query mode */
381 if (boff < sizeof(pfl->cfi_table)) {
382 ret = pfl->cfi_table[boff];
383 } else {
384 ret = 0;
385 }
386 break;
387 }
388 trace_pflash_io_read(offset, width, width << 1, ret, pfl->cmd, pfl->wcycle);
389
390 return ret;
391}
392
393/* update flash content on disk */
394static void pflash_update(PFlashCFI02 *pfl, int offset, int size)
395{
396 int offset_end;
397 if (pfl->blk) {
398 offset_end = offset + size;
399 /* widen to sector boundaries */
400 offset = QEMU_ALIGN_DOWN(offset, BDRV_SECTOR_SIZE);
401 offset_end = QEMU_ALIGN_UP(offset_end, BDRV_SECTOR_SIZE);
402 blk_pwrite(pfl->blk, offset, pfl->storage + offset,
403 offset_end - offset, 0);
404 }
405}
406
407static void pflash_sector_erase(PFlashCFI02 *pfl, hwaddr offset)
408{
409 SectorInfo sector_info = pflash_sector_info(pfl, offset);
410 uint64_t sector_len = sector_info.len;
411 offset &= ~(sector_len - 1);
412 DPRINTF("%s: start sector erase at %0*" PRIx64 "-%0*" PRIx64 "\n",
413 __func__, pfl->width * 2, offset,
414 pfl->width * 2, offset + sector_len - 1);
415 if (!pfl->ro) {
416 uint8_t *p = pfl->storage;
417 memset(p + offset, 0xff, sector_len);
418 pflash_update(pfl, offset, sector_len);
419 }
420 set_dq7(pfl, 0x00);
421 ++pfl->sectors_to_erase;
422 set_bit(sector_info.num, pfl->sector_erase_map);
423 /* Set (or reset) the 50 us timer for additional erase commands. */
424 timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 50000);
425}
426
427static void pflash_write(void *opaque, hwaddr offset, uint64_t value,
428 unsigned int width)
429{
430 PFlashCFI02 *pfl = opaque;
431 hwaddr boff;
432 uint8_t *p;
433 uint8_t cmd;
434
435 trace_pflash_io_write(offset, width, width << 1, value, pfl->wcycle);
436 cmd = value;
437 if (pfl->cmd != 0xA0) {
438 /* Reset does nothing during chip erase and sector erase. */
439 if (cmd == 0xF0 && pfl->cmd != 0x10 && pfl->cmd != 0x30) {
440 if (pfl->wcycle == WCYCLE_AUTOSELECT_CFI) {
441 /* Return to autoselect mode. */
442 pfl->wcycle = 3;
443 pfl->cmd = 0x90;
444 return;
445 }
446 goto reset_flash;
447 }
448 }
449 offset &= pfl->chip_len - 1;
450
451 boff = offset;
452 if (pfl->width == 2) {
453 boff = boff >> 1;
454 } else if (pfl->width == 4) {
455 boff = boff >> 2;
456 }
457 /* Only the least-significant 11 bits are used in most cases. */
458 boff &= 0x7FF;
459 switch (pfl->wcycle) {
460 case 0:
461 /* Set the device in I/O access mode if required */
462 if (pfl->rom_mode)
463 pflash_register_memory(pfl, 0);
464 pfl->read_counter = 0;
465 /* We're in read mode */
466 check_unlock0:
467 if (boff == 0x55 && cmd == 0x98) {
468 /* Enter CFI query mode */
469 pfl->wcycle = WCYCLE_CFI;
470 pfl->cmd = 0x98;
471 return;
472 }
473 /* Handle erase resume in erase suspend mode, otherwise reset. */
474 if (cmd == 0x30) { /* Erase Resume */
475 if (pflash_erase_suspend_mode(pfl)) {
476 /* Resume the erase. */
477 timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
478 pfl->erase_time_remaining);
479 pfl->erase_time_remaining = 0;
480 pfl->wcycle = 6;
481 pfl->cmd = 0x30;
482 set_dq7(pfl, 0x00);
483 assert_dq3(pfl);
484 return;
485 }
486 goto reset_flash;
487 }
488 /* Ignore erase suspend. */
489 if (cmd == 0xB0) { /* Erase Suspend */
490 return;
491 }
492 if (boff != pfl->unlock_addr0 || cmd != 0xAA) {
493 DPRINTF("%s: unlock0 failed " TARGET_FMT_plx " %02x %04x\n",
494 __func__, boff, cmd, pfl->unlock_addr0);
495 goto reset_flash;
496 }
497 DPRINTF("%s: unlock sequence started\n", __func__);
498 break;
499 case 1:
500 /* We started an unlock sequence */
501 check_unlock1:
502 if (boff != pfl->unlock_addr1 || cmd != 0x55) {
503 DPRINTF("%s: unlock1 failed " TARGET_FMT_plx " %02x\n", __func__,
504 boff, cmd);
505 goto reset_flash;
506 }
507 DPRINTF("%s: unlock sequence done\n", __func__);
508 break;
509 case 2:
510 /* We finished an unlock sequence */
511 if (!pfl->bypass && boff != pfl->unlock_addr0) {
512 DPRINTF("%s: command failed " TARGET_FMT_plx " %02x\n", __func__,
513 boff, cmd);
514 goto reset_flash;
515 }
516 switch (cmd) {
517 case 0x20:
518 pfl->bypass = 1;
519 goto do_bypass;
520 case 0x80: /* Erase */
521 case 0x90: /* Autoselect */
522 case 0xA0: /* Program */
523 pfl->cmd = cmd;
524 DPRINTF("%s: starting command %02x\n", __func__, cmd);
525 break;
526 default:
527 DPRINTF("%s: unknown command %02x\n", __func__, cmd);
528 goto reset_flash;
529 }
530 break;
531 case 3:
532 switch (pfl->cmd) {
533 case 0x80: /* Erase */
534 /* We need another unlock sequence */
535 goto check_unlock0;
536 case 0xA0: /* Program */
537 if (pflash_erase_suspend_mode(pfl) &&
538 pflash_sector_is_erasing(pfl, offset)) {
539 /* Ignore writes to erasing sectors. */
540 if (pfl->bypass) {
541 goto do_bypass;
542 }
543 goto reset_flash;
544 }
545 trace_pflash_data_write(offset, width << 1, value, 0);
546 if (!pfl->ro) {
547 p = (uint8_t *)pfl->storage + offset;
548 if (pfl->be) {
549 uint64_t current = ldn_be_p(p, width);
550 stn_be_p(p, width, current & value);
551 } else {
552 uint64_t current = ldn_le_p(p, width);
553 stn_le_p(p, width, current & value);
554 }
555 pflash_update(pfl, offset, width);
556 }
557 /*
558 * While programming, status bit DQ7 should hold the opposite
559 * value from how it was programmed.
560 */
561 set_dq7(pfl, ~value);
562 /* Let's pretend write is immediate */
563 if (pfl->bypass)
564 goto do_bypass;
565 goto reset_flash;
566 case 0x90: /* Autoselect */
567 if (pfl->bypass && cmd == 0x00) {
568 /* Unlock bypass reset */
569 goto reset_flash;
570 }
571 /*
572 * We can enter CFI query mode from autoselect mode, but we must
573 * return to autoselect mode after a reset.
574 */
575 if (boff == 0x55 && cmd == 0x98) {
576 /* Enter autoselect CFI query mode */
577 pfl->wcycle = WCYCLE_AUTOSELECT_CFI;
578 pfl->cmd = 0x98;
579 return;
580 }
581 /* fall through */
582 default:
583 DPRINTF("%s: invalid write for command %02x\n",
584 __func__, pfl->cmd);
585 goto reset_flash;
586 }
587 case 4:
588 switch (pfl->cmd) {
589 case 0xA0: /* Program */
590 /* Ignore writes while flash data write is occurring */
591 /* As we suppose write is immediate, this should never happen */
592 return;
593 case 0x80: /* Erase */
594 goto check_unlock1;
595 default:
596 /* Should never happen */
597 DPRINTF("%s: invalid command state %02x (wc 4)\n",
598 __func__, pfl->cmd);
599 goto reset_flash;
600 }
601 break;
602 case 5:
603 if (pflash_erase_suspend_mode(pfl)) {
604 /* Erasing is not supported in erase suspend mode. */
605 goto reset_flash;
606 }
607 switch (cmd) {
608 case 0x10: /* Chip Erase */
609 if (boff != pfl->unlock_addr0) {
610 DPRINTF("%s: chip erase: invalid address " TARGET_FMT_plx "\n",
611 __func__, offset);
612 goto reset_flash;
613 }
614 /* Chip erase */
615 DPRINTF("%s: start chip erase\n", __func__);
616 if (!pfl->ro) {
617 memset(pfl->storage, 0xff, pfl->chip_len);
618 pflash_update(pfl, 0, pfl->chip_len);
619 }
620 set_dq7(pfl, 0x00);
621 /* Wait the time specified at CFI address 0x22. */
622 timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
623 (1ULL << pfl->cfi_table[0x22]) * SCALE_MS);
624 break;
625 case 0x30: /* Sector erase */
626 pflash_sector_erase(pfl, offset);
627 break;
628 default:
629 DPRINTF("%s: invalid command %02x (wc 5)\n", __func__, cmd);
630 goto reset_flash;
631 }
632 pfl->cmd = cmd;
633 break;
634 case 6:
635 switch (pfl->cmd) {
636 case 0x10: /* Chip Erase */
637 /* Ignore writes during chip erase */
638 return;
639 case 0x30: /* Sector erase */
640 if (cmd == 0xB0) {
641 /*
642 * If erase suspend happens during the erase timeout (so DQ3 is
643 * 0), then the device suspends erasing immediately. Set the
644 * remaining time to be the total time to erase. Otherwise,
645 * there is a maximum amount of time it can take to enter
646 * suspend mode. Let's ignore that and suspend immediately and
647 * set the remaining time to the actual time remaining on the
648 * timer.
649 */
650 if ((pfl->status & 0x08) == 0) {
651 pfl->erase_time_remaining = pflash_erase_time(pfl);
652 } else {
653 int64_t delta = timer_expire_time_ns(&pfl->timer) -
654 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
655 /* Make sure we have a positive time remaining. */
656 pfl->erase_time_remaining = delta <= 0 ? 1 : delta;
657 }
658 reset_dq3(pfl);
659 timer_del(&pfl->timer);
660 pfl->wcycle = 0;
661 pfl->cmd = 0;
662 return;
663 }
664 /*
665 * If DQ3 is 0, additional sector erase commands can be
666 * written and anything else (other than an erase suspend) resets
667 * the device.
668 */
669 if ((pfl->status & 0x08) == 0) {
670 if (cmd == 0x30) {
671 pflash_sector_erase(pfl, offset);
672 } else {
673 goto reset_flash;
674 }
675 }
676 /* Ignore writes during the actual erase. */
677 return;
678 default:
679 /* Should never happen */
680 DPRINTF("%s: invalid command state %02x (wc 6)\n",
681 __func__, pfl->cmd);
682 goto reset_flash;
683 }
684 break;
685 /* Special values for CFI queries */
686 case WCYCLE_CFI:
687 case WCYCLE_AUTOSELECT_CFI:
688 DPRINTF("%s: invalid write in CFI query mode\n", __func__);
689 goto reset_flash;
690 default:
691 /* Should never happen */
692 DPRINTF("%s: invalid write state (wc 7)\n", __func__);
693 goto reset_flash;
694 }
695 pfl->wcycle++;
696
697 return;
698
699 /* Reset flash */
700 reset_flash:
701 trace_pflash_reset();
702 pfl->bypass = 0;
703 pfl->wcycle = 0;
704 pfl->cmd = 0;
705 return;
706
707 do_bypass:
708 pfl->wcycle = 2;
709 pfl->cmd = 0;
710}
711
712static const MemoryRegionOps pflash_cfi02_ops = {
713 .read = pflash_read,
714 .write = pflash_write,
715 .valid.min_access_size = 1,
716 .valid.max_access_size = 4,
717 .endianness = DEVICE_NATIVE_ENDIAN,
718};
719
720static void pflash_cfi02_realize(DeviceState *dev, Error **errp)
721{
722 PFlashCFI02 *pfl = PFLASH_CFI02(dev);
723 int ret;
724 Error *local_err = NULL;
725
726 if (pfl->uniform_sector_len == 0 && pfl->sector_len[0] == 0) {
727 error_setg(errp, "attribute \"sector-length\" not specified or zero.");
728 return;
729 }
730 if (pfl->uniform_nb_blocs == 0 && pfl->nb_blocs[0] == 0) {
731 error_setg(errp, "attribute \"num-blocks\" not specified or zero.");
732 return;
733 }
734 if (pfl->name == NULL) {
735 error_setg(errp, "attribute \"name\" not specified.");
736 return;
737 }
738
739 int nb_regions;
740 pfl->chip_len = 0;
741 pfl->total_sectors = 0;
742 for (nb_regions = 0; nb_regions < PFLASH_MAX_ERASE_REGIONS; ++nb_regions) {
743 if (pfl->nb_blocs[nb_regions] == 0) {
744 break;
745 }
746 pfl->total_sectors += pfl->nb_blocs[nb_regions];
747 uint64_t sector_len_per_device = pfl->sector_len[nb_regions];
748
749 /*
750 * The size of each flash sector must be a power of 2 and it must be
751 * aligned at the same power of 2.
752 */
753 if (sector_len_per_device & 0xff ||
754 sector_len_per_device >= (1 << 24) ||
755 !is_power_of_2(sector_len_per_device))
756 {
757 error_setg(errp, "unsupported configuration: "
758 "sector length[%d] per device = %" PRIx64 ".",
759 nb_regions, sector_len_per_device);
760 return;
761 }
762 if (pfl->chip_len & (sector_len_per_device - 1)) {
763 error_setg(errp, "unsupported configuration: "
764 "flash region %d not correctly aligned.",
765 nb_regions);
766 return;
767 }
768
769 pfl->chip_len += (uint64_t)pfl->sector_len[nb_regions] *
770 pfl->nb_blocs[nb_regions];
771 }
772
773 uint64_t uniform_len = (uint64_t)pfl->uniform_nb_blocs *
774 pfl->uniform_sector_len;
775 if (nb_regions == 0) {
776 nb_regions = 1;
777 pfl->nb_blocs[0] = pfl->uniform_nb_blocs;
778 pfl->sector_len[0] = pfl->uniform_sector_len;
779 pfl->chip_len = uniform_len;
780 pfl->total_sectors = pfl->uniform_nb_blocs;
781 } else if (uniform_len != 0 && uniform_len != pfl->chip_len) {
782 error_setg(errp, "\"num-blocks\"*\"sector-length\" "
783 "different from \"num-blocks0\"*\'sector-length0\" + ... + "
784 "\"num-blocks3\"*\"sector-length3\"");
785 return;
786 }
787
788 memory_region_init_rom_device(&pfl->orig_mem, OBJECT(pfl),
789 &pflash_cfi02_ops, pfl, pfl->name,
790 pfl->chip_len, &local_err);
791 if (local_err) {
792 error_propagate(errp, local_err);
793 return;
794 }
795
796 pfl->storage = memory_region_get_ram_ptr(&pfl->orig_mem);
797
798 if (pfl->blk) {
799 uint64_t perm;
800 pfl->ro = blk_is_read_only(pfl->blk);
801 perm = BLK_PERM_CONSISTENT_READ | (pfl->ro ? 0 : BLK_PERM_WRITE);
802 ret = blk_set_perm(pfl->blk, perm, BLK_PERM_ALL, errp);
803 if (ret < 0) {
804 return;
805 }
806 } else {
807 pfl->ro = 0;
808 }
809
810 if (pfl->blk) {
811 if (!blk_check_size_and_read_all(pfl->blk, pfl->storage,
812 pfl->chip_len, errp)) {
813 vmstate_unregister_ram(&pfl->orig_mem, DEVICE(pfl));
814 return;
815 }
816 }
817
818 /* Only 11 bits are used in the comparison. */
819 pfl->unlock_addr0 &= 0x7FF;
820 pfl->unlock_addr1 &= 0x7FF;
821
822 /* Allocate memory for a bitmap for sectors being erased. */
823 pfl->sector_erase_map = bitmap_new(pfl->total_sectors);
824
825 pflash_setup_mappings(pfl);
826 pfl->rom_mode = 1;
827 sysbus_init_mmio(SYS_BUS_DEVICE(dev), &pfl->mem);
828
829 timer_init_ns(&pfl->timer, QEMU_CLOCK_VIRTUAL, pflash_timer, pfl);
830 pfl->wcycle = 0;
831 pfl->cmd = 0;
832 pfl->status = 0;
833
834 /* Hardcoded CFI table (mostly from SG29 Spansion flash) */
835 const uint16_t pri_ofs = 0x40;
836 /* Standard "QRY" string */
837 pfl->cfi_table[0x10] = 'Q';
838 pfl->cfi_table[0x11] = 'R';
839 pfl->cfi_table[0x12] = 'Y';
840 /* Command set (AMD/Fujitsu) */
841 pfl->cfi_table[0x13] = 0x02;
842 pfl->cfi_table[0x14] = 0x00;
843 /* Primary extended table address */
844 pfl->cfi_table[0x15] = pri_ofs;
845 pfl->cfi_table[0x16] = pri_ofs >> 8;
846 /* Alternate command set (none) */
847 pfl->cfi_table[0x17] = 0x00;
848 pfl->cfi_table[0x18] = 0x00;
849 /* Alternate extended table (none) */
850 pfl->cfi_table[0x19] = 0x00;
851 pfl->cfi_table[0x1A] = 0x00;
852 /* Vcc min */
853 pfl->cfi_table[0x1B] = 0x27;
854 /* Vcc max */
855 pfl->cfi_table[0x1C] = 0x36;
856 /* Vpp min (no Vpp pin) */
857 pfl->cfi_table[0x1D] = 0x00;
858 /* Vpp max (no Vpp pin) */
859 pfl->cfi_table[0x1E] = 0x00;
860 /* Timeout per single byte/word write (128 ms) */
861 pfl->cfi_table[0x1F] = 0x07;
862 /* Timeout for min size buffer write (NA) */
863 pfl->cfi_table[0x20] = 0x00;
864 /* Typical timeout for block erase (512 ms) */
865 pfl->cfi_table[0x21] = 0x09;
866 /* Typical timeout for full chip erase (4096 ms) */
867 pfl->cfi_table[0x22] = 0x0C;
868 /* Reserved */
869 pfl->cfi_table[0x23] = 0x01;
870 /* Max timeout for buffer write (NA) */
871 pfl->cfi_table[0x24] = 0x00;
872 /* Max timeout for block erase */
873 pfl->cfi_table[0x25] = 0x0A;
874 /* Max timeout for chip erase */
875 pfl->cfi_table[0x26] = 0x0D;
876 /* Device size */
877 pfl->cfi_table[0x27] = ctz32(pfl->chip_len);
878 /* Flash device interface (8 & 16 bits) */
879 pfl->cfi_table[0x28] = 0x02;
880 pfl->cfi_table[0x29] = 0x00;
881 /* Max number of bytes in multi-bytes write */
882 /* XXX: disable buffered write as it's not supported */
883 // pfl->cfi_table[0x2A] = 0x05;
884 pfl->cfi_table[0x2A] = 0x00;
885 pfl->cfi_table[0x2B] = 0x00;
886 /* Number of erase block regions */
887 pfl->cfi_table[0x2c] = nb_regions;
888 /* Erase block regions */
889 for (int i = 0; i < nb_regions; ++i) {
890 uint32_t sector_len_per_device = pfl->sector_len[i];
891 pfl->cfi_table[0x2d + 4 * i] = pfl->nb_blocs[i] - 1;
892 pfl->cfi_table[0x2e + 4 * i] = (pfl->nb_blocs[i] - 1) >> 8;
893 pfl->cfi_table[0x2f + 4 * i] = sector_len_per_device >> 8;
894 pfl->cfi_table[0x30 + 4 * i] = sector_len_per_device >> 16;
895 }
896 assert(0x2c + 4 * nb_regions < pri_ofs);
897
898 /* Extended */
899 pfl->cfi_table[0x00 + pri_ofs] = 'P';
900 pfl->cfi_table[0x01 + pri_ofs] = 'R';
901 pfl->cfi_table[0x02 + pri_ofs] = 'I';
902
903 /* Extended version 1.0 */
904 pfl->cfi_table[0x03 + pri_ofs] = '1';
905 pfl->cfi_table[0x04 + pri_ofs] = '0';
906
907 /* Address sensitive unlock required. */
908 pfl->cfi_table[0x05 + pri_ofs] = 0x00;
909 /* Erase suspend to read/write. */
910 pfl->cfi_table[0x06 + pri_ofs] = 0x02;
911 /* Sector protect not supported. */
912 pfl->cfi_table[0x07 + pri_ofs] = 0x00;
913 /* Temporary sector unprotect not supported. */
914 pfl->cfi_table[0x08 + pri_ofs] = 0x00;
915
916 /* Sector protect/unprotect scheme. */
917 pfl->cfi_table[0x09 + pri_ofs] = 0x00;
918
919 /* Simultaneous operation not supported. */
920 pfl->cfi_table[0x0a + pri_ofs] = 0x00;
921 /* Burst mode not supported. */
922 pfl->cfi_table[0x0b + pri_ofs] = 0x00;
923 /* Page mode not supported. */
924 pfl->cfi_table[0x0c + pri_ofs] = 0x00;
925 assert(0x0c + pri_ofs < ARRAY_SIZE(pfl->cfi_table));
926}
927
928static Property pflash_cfi02_properties[] = {
929 DEFINE_PROP_DRIVE("drive", PFlashCFI02, blk),
930 DEFINE_PROP_UINT32("num-blocks", PFlashCFI02, uniform_nb_blocs, 0),
931 DEFINE_PROP_UINT32("sector-length", PFlashCFI02, uniform_sector_len, 0),
932 DEFINE_PROP_UINT32("num-blocks0", PFlashCFI02, nb_blocs[0], 0),
933 DEFINE_PROP_UINT32("sector-length0", PFlashCFI02, sector_len[0], 0),
934 DEFINE_PROP_UINT32("num-blocks1", PFlashCFI02, nb_blocs[1], 0),
935 DEFINE_PROP_UINT32("sector-length1", PFlashCFI02, sector_len[1], 0),
936 DEFINE_PROP_UINT32("num-blocks2", PFlashCFI02, nb_blocs[2], 0),
937 DEFINE_PROP_UINT32("sector-length2", PFlashCFI02, sector_len[2], 0),
938 DEFINE_PROP_UINT32("num-blocks3", PFlashCFI02, nb_blocs[3], 0),
939 DEFINE_PROP_UINT32("sector-length3", PFlashCFI02, sector_len[3], 0),
940 DEFINE_PROP_UINT8("width", PFlashCFI02, width, 0),
941 DEFINE_PROP_UINT8("mappings", PFlashCFI02, mappings, 0),
942 DEFINE_PROP_UINT8("big-endian", PFlashCFI02, be, 0),
943 DEFINE_PROP_UINT16("id0", PFlashCFI02, ident0, 0),
944 DEFINE_PROP_UINT16("id1", PFlashCFI02, ident1, 0),
945 DEFINE_PROP_UINT16("id2", PFlashCFI02, ident2, 0),
946 DEFINE_PROP_UINT16("id3", PFlashCFI02, ident3, 0),
947 DEFINE_PROP_UINT16("unlock-addr0", PFlashCFI02, unlock_addr0, 0),
948 DEFINE_PROP_UINT16("unlock-addr1", PFlashCFI02, unlock_addr1, 0),
949 DEFINE_PROP_STRING("name", PFlashCFI02, name),
950 DEFINE_PROP_END_OF_LIST(),
951};
952
953static void pflash_cfi02_unrealize(DeviceState *dev, Error **errp)
954{
955 PFlashCFI02 *pfl = PFLASH_CFI02(dev);
956 timer_del(&pfl->timer);
957 g_free(pfl->sector_erase_map);
958}
959
960static void pflash_cfi02_class_init(ObjectClass *klass, void *data)
961{
962 DeviceClass *dc = DEVICE_CLASS(klass);
963
964 dc->realize = pflash_cfi02_realize;
965 dc->unrealize = pflash_cfi02_unrealize;
966 dc->props = pflash_cfi02_properties;
967 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
968}
969
970static const TypeInfo pflash_cfi02_info = {
971 .name = TYPE_PFLASH_CFI02,
972 .parent = TYPE_SYS_BUS_DEVICE,
973 .instance_size = sizeof(PFlashCFI02),
974 .class_init = pflash_cfi02_class_init,
975};
976
977static void pflash_cfi02_register_types(void)
978{
979 type_register_static(&pflash_cfi02_info);
980}
981
982type_init(pflash_cfi02_register_types)
983
984PFlashCFI02 *pflash_cfi02_register(hwaddr base,
985 const char *name,
986 hwaddr size,
987 BlockBackend *blk,
988 uint32_t sector_len,
989 int nb_mappings, int width,
990 uint16_t id0, uint16_t id1,
991 uint16_t id2, uint16_t id3,
992 uint16_t unlock_addr0,
993 uint16_t unlock_addr1,
994 int be)
995{
996 DeviceState *dev = qdev_create(NULL, TYPE_PFLASH_CFI02);
997
998 if (blk) {
999 qdev_prop_set_drive(dev, "drive", blk, &error_abort);
1000 }
1001 assert(size % sector_len == 0);
1002 qdev_prop_set_uint32(dev, "num-blocks", size / sector_len);
1003 qdev_prop_set_uint32(dev, "sector-length", sector_len);
1004 qdev_prop_set_uint8(dev, "width", width);
1005 qdev_prop_set_uint8(dev, "mappings", nb_mappings);
1006 qdev_prop_set_uint8(dev, "big-endian", !!be);
1007 qdev_prop_set_uint16(dev, "id0", id0);
1008 qdev_prop_set_uint16(dev, "id1", id1);
1009 qdev_prop_set_uint16(dev, "id2", id2);
1010 qdev_prop_set_uint16(dev, "id3", id3);
1011 qdev_prop_set_uint16(dev, "unlock-addr0", unlock_addr0);
1012 qdev_prop_set_uint16(dev, "unlock-addr1", unlock_addr1);
1013 qdev_prop_set_string(dev, "name", name);
1014 qdev_init_nofail(dev);
1015
1016 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
1017 return PFLASH_CFI02(dev);
1018}
1019