1 | /* |
2 | * Nordic Semiconductor nRF51 non-volatile memory |
3 | * |
4 | * It provides an interface to erase regions in flash memory. |
5 | * Furthermore it provides the user and factory information registers. |
6 | * |
7 | * Reference Manual: http://infocenter.nordicsemi.com/pdf/nRF51_RM_v3.0.pdf |
8 | * |
9 | * See nRF51 reference manual and product sheet sections: |
10 | * + Non-Volatile Memory Controller (NVMC) |
11 | * + Factory Information Configuration Registers (FICR) |
12 | * + User Information Configuration Registers (UICR) |
13 | * |
14 | * Copyright 2018 Steffen Görtz <contrib@steffen-goertz.de> |
15 | * |
16 | * This code is licensed under the GPL version 2 or later. See |
17 | * the COPYING file in the top-level directory. |
18 | */ |
19 | |
20 | #include "qemu/osdep.h" |
21 | #include "qapi/error.h" |
22 | #include "qemu/log.h" |
23 | #include "qemu/module.h" |
24 | #include "exec/address-spaces.h" |
25 | #include "hw/arm/nrf51.h" |
26 | #include "hw/nvram/nrf51_nvm.h" |
27 | #include "hw/qdev-properties.h" |
28 | #include "migration/vmstate.h" |
29 | |
30 | /* |
31 | * FICR Registers Assignments |
32 | * CODEPAGESIZE 0x010 |
33 | * CODESIZE 0x014 |
34 | * CLENR0 0x028 |
35 | * PPFC 0x02C |
36 | * NUMRAMBLOCK 0x034 |
37 | * SIZERAMBLOCKS 0x038 |
38 | * SIZERAMBLOCK[0] 0x038 |
39 | * SIZERAMBLOCK[1] 0x03C |
40 | * SIZERAMBLOCK[2] 0x040 |
41 | * SIZERAMBLOCK[3] 0x044 |
42 | * CONFIGID 0x05C |
43 | * DEVICEID[0] 0x060 |
44 | * DEVICEID[1] 0x064 |
45 | * ER[0] 0x080 |
46 | * ER[1] 0x084 |
47 | * ER[2] 0x088 |
48 | * ER[3] 0x08C |
49 | * IR[0] 0x090 |
50 | * IR[1] 0x094 |
51 | * IR[2] 0x098 |
52 | * IR[3] 0x09C |
53 | * DEVICEADDRTYPE 0x0A0 |
54 | * DEVICEADDR[0] 0x0A4 |
55 | * DEVICEADDR[1] 0x0A8 |
56 | * OVERRIDEEN 0x0AC |
57 | * NRF_1MBIT[0] 0x0B0 |
58 | * NRF_1MBIT[1] 0x0B4 |
59 | * NRF_1MBIT[2] 0x0B8 |
60 | * NRF_1MBIT[3] 0x0BC |
61 | * NRF_1MBIT[4] 0x0C0 |
62 | * BLE_1MBIT[0] 0x0EC |
63 | * BLE_1MBIT[1] 0x0F0 |
64 | * BLE_1MBIT[2] 0x0F4 |
65 | * BLE_1MBIT[3] 0x0F8 |
66 | * BLE_1MBIT[4] 0x0FC |
67 | */ |
68 | static const uint32_t ficr_content[64] = { |
69 | 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000400, |
70 | 0x00000100, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000002, 0x00002000, |
71 | 0x00002000, 0x00002000, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, |
72 | 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, |
73 | 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000003, |
74 | 0x12345678, 0x9ABCDEF1, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, |
75 | 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, |
76 | 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, |
77 | 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, |
78 | 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, |
79 | 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, |
80 | 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, |
81 | 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF |
82 | }; |
83 | |
84 | static uint64_t ficr_read(void *opaque, hwaddr offset, unsigned int size) |
85 | { |
86 | assert(offset < sizeof(ficr_content)); |
87 | return ficr_content[offset / 4]; |
88 | } |
89 | |
90 | static void ficr_write(void *opaque, hwaddr offset, uint64_t value, |
91 | unsigned int size) |
92 | { |
93 | /* Intentionally do nothing */ |
94 | } |
95 | |
96 | static const MemoryRegionOps ficr_ops = { |
97 | .read = ficr_read, |
98 | .write = ficr_write, |
99 | .impl.min_access_size = 4, |
100 | .impl.max_access_size = 4, |
101 | .endianness = DEVICE_LITTLE_ENDIAN |
102 | }; |
103 | |
104 | /* |
105 | * UICR Registers Assignments |
106 | * CLENR0 0x000 |
107 | * RBPCONF 0x004 |
108 | * XTALFREQ 0x008 |
109 | * FWID 0x010 |
110 | * BOOTLOADERADDR 0x014 |
111 | * NRFFW[0] 0x014 |
112 | * NRFFW[1] 0x018 |
113 | * NRFFW[2] 0x01C |
114 | * NRFFW[3] 0x020 |
115 | * NRFFW[4] 0x024 |
116 | * NRFFW[5] 0x028 |
117 | * NRFFW[6] 0x02C |
118 | * NRFFW[7] 0x030 |
119 | * NRFFW[8] 0x034 |
120 | * NRFFW[9] 0x038 |
121 | * NRFFW[10] 0x03C |
122 | * NRFFW[11] 0x040 |
123 | * NRFFW[12] 0x044 |
124 | * NRFFW[13] 0x048 |
125 | * NRFFW[14] 0x04C |
126 | * NRFHW[0] 0x050 |
127 | * NRFHW[1] 0x054 |
128 | * NRFHW[2] 0x058 |
129 | * NRFHW[3] 0x05C |
130 | * NRFHW[4] 0x060 |
131 | * NRFHW[5] 0x064 |
132 | * NRFHW[6] 0x068 |
133 | * NRFHW[7] 0x06C |
134 | * NRFHW[8] 0x070 |
135 | * NRFHW[9] 0x074 |
136 | * NRFHW[10] 0x078 |
137 | * NRFHW[11] 0x07C |
138 | * CUSTOMER[0] 0x080 |
139 | * CUSTOMER[1] 0x084 |
140 | * CUSTOMER[2] 0x088 |
141 | * CUSTOMER[3] 0x08C |
142 | * CUSTOMER[4] 0x090 |
143 | * CUSTOMER[5] 0x094 |
144 | * CUSTOMER[6] 0x098 |
145 | * CUSTOMER[7] 0x09C |
146 | * CUSTOMER[8] 0x0A0 |
147 | * CUSTOMER[9] 0x0A4 |
148 | * CUSTOMER[10] 0x0A8 |
149 | * CUSTOMER[11] 0x0AC |
150 | * CUSTOMER[12] 0x0B0 |
151 | * CUSTOMER[13] 0x0B4 |
152 | * CUSTOMER[14] 0x0B8 |
153 | * CUSTOMER[15] 0x0BC |
154 | * CUSTOMER[16] 0x0C0 |
155 | * CUSTOMER[17] 0x0C4 |
156 | * CUSTOMER[18] 0x0C8 |
157 | * CUSTOMER[19] 0x0CC |
158 | * CUSTOMER[20] 0x0D0 |
159 | * CUSTOMER[21] 0x0D4 |
160 | * CUSTOMER[22] 0x0D8 |
161 | * CUSTOMER[23] 0x0DC |
162 | * CUSTOMER[24] 0x0E0 |
163 | * CUSTOMER[25] 0x0E4 |
164 | * CUSTOMER[26] 0x0E8 |
165 | * CUSTOMER[27] 0x0EC |
166 | * CUSTOMER[28] 0x0F0 |
167 | * CUSTOMER[29] 0x0F4 |
168 | * CUSTOMER[30] 0x0F8 |
169 | * CUSTOMER[31] 0x0FC |
170 | */ |
171 | |
172 | static uint64_t uicr_read(void *opaque, hwaddr offset, unsigned int size) |
173 | { |
174 | NRF51NVMState *s = NRF51_NVM(opaque); |
175 | |
176 | assert(offset < sizeof(s->uicr_content)); |
177 | return s->uicr_content[offset / 4]; |
178 | } |
179 | |
180 | static void uicr_write(void *opaque, hwaddr offset, uint64_t value, |
181 | unsigned int size) |
182 | { |
183 | NRF51NVMState *s = NRF51_NVM(opaque); |
184 | |
185 | assert(offset < sizeof(s->uicr_content)); |
186 | s->uicr_content[offset / 4] = value; |
187 | } |
188 | |
189 | static const MemoryRegionOps uicr_ops = { |
190 | .read = uicr_read, |
191 | .write = uicr_write, |
192 | .impl.min_access_size = 4, |
193 | .impl.max_access_size = 4, |
194 | .endianness = DEVICE_LITTLE_ENDIAN |
195 | }; |
196 | |
197 | |
198 | static uint64_t io_read(void *opaque, hwaddr offset, unsigned int size) |
199 | { |
200 | NRF51NVMState *s = NRF51_NVM(opaque); |
201 | uint64_t r = 0; |
202 | |
203 | switch (offset) { |
204 | case NRF51_NVMC_READY: |
205 | r = NRF51_NVMC_READY_READY; |
206 | break; |
207 | case NRF51_NVMC_CONFIG: |
208 | r = s->config; |
209 | break; |
210 | default: |
211 | qemu_log_mask(LOG_GUEST_ERROR, |
212 | "%s: bad read offset 0x%" HWADDR_PRIx "\n" , __func__, offset); |
213 | break; |
214 | } |
215 | |
216 | return r; |
217 | } |
218 | |
219 | static void io_write(void *opaque, hwaddr offset, uint64_t value, |
220 | unsigned int size) |
221 | { |
222 | NRF51NVMState *s = NRF51_NVM(opaque); |
223 | |
224 | switch (offset) { |
225 | case NRF51_NVMC_CONFIG: |
226 | s->config = value & NRF51_NVMC_CONFIG_MASK; |
227 | break; |
228 | case NRF51_NVMC_ERASEPCR0: |
229 | case NRF51_NVMC_ERASEPCR1: |
230 | if (s->config & NRF51_NVMC_CONFIG_EEN) { |
231 | /* Mask in-page sub address */ |
232 | value &= ~(NRF51_PAGE_SIZE - 1); |
233 | if (value <= (s->flash_size - NRF51_PAGE_SIZE)) { |
234 | memset(s->storage + value, 0xFF, NRF51_PAGE_SIZE); |
235 | memory_region_flush_rom_device(&s->flash, value, |
236 | NRF51_PAGE_SIZE); |
237 | } |
238 | } else { |
239 | qemu_log_mask(LOG_GUEST_ERROR, |
240 | "%s: Flash erase at 0x%" HWADDR_PRIx" while flash not erasable.\n" , |
241 | __func__, offset); |
242 | } |
243 | break; |
244 | case NRF51_NVMC_ERASEALL: |
245 | if (value == NRF51_NVMC_ERASE) { |
246 | if (s->config & NRF51_NVMC_CONFIG_EEN) { |
247 | memset(s->storage, 0xFF, s->flash_size); |
248 | memory_region_flush_rom_device(&s->flash, 0, s->flash_size); |
249 | memset(s->uicr_content, 0xFF, sizeof(s->uicr_content)); |
250 | } else { |
251 | qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash not erasable.\n" , |
252 | __func__); |
253 | } |
254 | } |
255 | break; |
256 | case NRF51_NVMC_ERASEUICR: |
257 | if (value == NRF51_NVMC_ERASE) { |
258 | memset(s->uicr_content, 0xFF, sizeof(s->uicr_content)); |
259 | } |
260 | break; |
261 | |
262 | default: |
263 | qemu_log_mask(LOG_GUEST_ERROR, |
264 | "%s: bad write offset 0x%" HWADDR_PRIx "\n" , __func__, offset); |
265 | } |
266 | } |
267 | |
268 | static const MemoryRegionOps io_ops = { |
269 | .read = io_read, |
270 | .write = io_write, |
271 | .impl.min_access_size = 4, |
272 | .impl.max_access_size = 4, |
273 | .endianness = DEVICE_LITTLE_ENDIAN, |
274 | }; |
275 | |
276 | |
277 | static void flash_write(void *opaque, hwaddr offset, uint64_t value, |
278 | unsigned int size) |
279 | { |
280 | NRF51NVMState *s = NRF51_NVM(opaque); |
281 | |
282 | if (s->config & NRF51_NVMC_CONFIG_WEN) { |
283 | uint32_t oldval; |
284 | |
285 | assert(offset + size <= s->flash_size); |
286 | |
287 | /* NOR Flash only allows bits to be flipped from 1's to 0's on write */ |
288 | oldval = ldl_le_p(s->storage + offset); |
289 | oldval &= value; |
290 | stl_le_p(s->storage + offset, oldval); |
291 | |
292 | memory_region_flush_rom_device(&s->flash, offset, size); |
293 | } else { |
294 | qemu_log_mask(LOG_GUEST_ERROR, |
295 | "%s: Flash write 0x%" HWADDR_PRIx" while flash not writable.\n" , |
296 | __func__, offset); |
297 | } |
298 | } |
299 | |
300 | |
301 | |
302 | static const MemoryRegionOps flash_ops = { |
303 | .write = flash_write, |
304 | .valid.min_access_size = 4, |
305 | .valid.max_access_size = 4, |
306 | .endianness = DEVICE_LITTLE_ENDIAN, |
307 | }; |
308 | |
309 | static void nrf51_nvm_init(Object *obj) |
310 | { |
311 | NRF51NVMState *s = NRF51_NVM(obj); |
312 | SysBusDevice *sbd = SYS_BUS_DEVICE(obj); |
313 | |
314 | memory_region_init_io(&s->mmio, obj, &io_ops, s, "nrf51_soc.nvmc" , |
315 | NRF51_NVMC_SIZE); |
316 | sysbus_init_mmio(sbd, &s->mmio); |
317 | |
318 | memory_region_init_io(&s->ficr, obj, &ficr_ops, s, "nrf51_soc.ficr" , |
319 | sizeof(ficr_content)); |
320 | sysbus_init_mmio(sbd, &s->ficr); |
321 | |
322 | memory_region_init_io(&s->uicr, obj, &uicr_ops, s, "nrf51_soc.uicr" , |
323 | sizeof(s->uicr_content)); |
324 | sysbus_init_mmio(sbd, &s->uicr); |
325 | } |
326 | |
327 | static void nrf51_nvm_realize(DeviceState *dev, Error **errp) |
328 | { |
329 | NRF51NVMState *s = NRF51_NVM(dev); |
330 | Error *err = NULL; |
331 | |
332 | memory_region_init_rom_device(&s->flash, OBJECT(dev), &flash_ops, s, |
333 | "nrf51_soc.flash" , s->flash_size, &err); |
334 | if (err) { |
335 | error_propagate(errp, err); |
336 | return; |
337 | } |
338 | |
339 | s->storage = memory_region_get_ram_ptr(&s->flash); |
340 | sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->flash); |
341 | } |
342 | |
343 | static void nrf51_nvm_reset(DeviceState *dev) |
344 | { |
345 | NRF51NVMState *s = NRF51_NVM(dev); |
346 | |
347 | s->config = 0x00; |
348 | memset(s->uicr_content, 0xFF, sizeof(s->uicr_content)); |
349 | } |
350 | |
351 | static Property nrf51_nvm_properties[] = { |
352 | DEFINE_PROP_UINT32("flash-size" , NRF51NVMState, flash_size, 0x40000), |
353 | DEFINE_PROP_END_OF_LIST(), |
354 | }; |
355 | |
356 | static const VMStateDescription vmstate_nvm = { |
357 | .name = "nrf51_soc.nvm" , |
358 | .version_id = 1, |
359 | .minimum_version_id = 1, |
360 | .fields = (VMStateField[]) { |
361 | VMSTATE_UINT32_ARRAY(uicr_content, NRF51NVMState, |
362 | NRF51_UICR_FIXTURE_SIZE), |
363 | VMSTATE_UINT32(config, NRF51NVMState), |
364 | VMSTATE_END_OF_LIST() |
365 | } |
366 | }; |
367 | |
368 | static void nrf51_nvm_class_init(ObjectClass *klass, void *data) |
369 | { |
370 | DeviceClass *dc = DEVICE_CLASS(klass); |
371 | |
372 | dc->props = nrf51_nvm_properties; |
373 | dc->vmsd = &vmstate_nvm; |
374 | dc->realize = nrf51_nvm_realize; |
375 | dc->reset = nrf51_nvm_reset; |
376 | } |
377 | |
378 | static const TypeInfo nrf51_nvm_info = { |
379 | .name = TYPE_NRF51_NVM, |
380 | .parent = TYPE_SYS_BUS_DEVICE, |
381 | .instance_size = sizeof(NRF51NVMState), |
382 | .instance_init = nrf51_nvm_init, |
383 | .class_init = nrf51_nvm_class_init |
384 | }; |
385 | |
386 | static void nrf51_nvm_register_types(void) |
387 | { |
388 | type_register_static(&nrf51_nvm_info); |
389 | } |
390 | |
391 | type_init(nrf51_nvm_register_types) |
392 | |