hw/block/pflash_cfi02.c

   1 /*
   2  *  CFI parallel flash with AMD command set emulation
   3  *
   4  *  Copyright (c) 2005 Jocelyn Mayer
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*
  21  * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
  22  * Supported commands/modes are:
  23  * - flash read
  24  * - flash write
  25  * - flash ID read
  26  * - sector erase
  27  * - chip erase
  28  * - unlock bypass command
  29  * - CFI queries
  30  *
  31  * It does not support flash interleaving.
  32  * It does not implement software data protection as found in many real chips
  33  * It does not implement erase suspend/resume commands
  34  * It does not implement multiple sectors erase
  35  */
  36
  37 #include "qemu/osdep.h"
  38 #include "hw/hw.h"
  39 #include "hw/block/block.h"
  40 #include "hw/block/flash.h"
  41 #include "qapi/error.h"
  42 #include "qemu/timer.h"
  43 #include "sysemu/block-backend.h"
  44 #include "qemu/host-utils.h"
  45 #include "qemu/module.h"
  46 #include "hw/sysbus.h"
  47 #include "trace.h"
  48
  49 #define PFLASH_DEBUG false
  50 #define DPRINTF(fmt, ...)                                  \
  51 do {                                                       \
  52     if (PFLASH_DEBUG) {                                    \
  53         fprintf(stderr, "PFLASH: " fmt, ## __VA_ARGS__);   \
  54     }                                                      \
  55 } while (0)
  56
  57 #define PFLASH_LAZY_ROMD_THRESHOLD 42
  58
  59 /*
  60  * The size of the cfi_table indirectly depends on this and the start of the
  61  * PRI table directly depends on it. 4 is the maximum size (and also what
  62  * seems common) without changing the PRT table address.
  63  */
  64 #define PFLASH_MAX_ERASE_REGIONS 4
  65
  66 /* Special write cycles for CFI queries. */
  67 enum {
  68     WCYCLE_CFI              = 7,
  69     WCYCLE_AUTOSELECT_CFI   = 8,
  70 };
  71
  72 struct PFlashCFI02 {
  73     /*< private >*/
  74     SysBusDevice parent_obj;
  75     /*< public >*/
  76
  77     BlockBackend *blk;
  78     uint32_t uniform_nb_blocs;
  79     uint32_t uniform_sector_len;
  80     uint32_t nb_blocs[PFLASH_MAX_ERASE_REGIONS];
  81     uint32_t sector_len[PFLASH_MAX_ERASE_REGIONS];
  82     uint32_t chip_len;
  83     uint8_t mappings;
  84     uint8_t width;
  85     uint8_t be;
  86     int wcycle; /* if 0, the flash is read normally */
  87     int bypass;
  88     int ro;
  89     uint8_t cmd;
  90     uint8_t status;
  91     /* FIXME: implement array device properties */
  92     uint16_t ident0;
  93     uint16_t ident1;
  94     uint16_t ident2;
  95     uint16_t ident3;
  96     uint16_t unlock_addr0;
  97     uint16_t unlock_addr1;
  98     uint8_t cfi_table[0x4d];
  99     QEMUTimer timer;
 100     /* The device replicates the flash memory across its memory space.  Emulate
 101      * that by having a container (.mem) filled with an array of aliases
 102      * (.mem_mappings) pointing to the flash memory (.orig_mem).
 103      */
 104     MemoryRegion mem;
 105     MemoryRegion *mem_mappings;    /* array; one per mapping */
 106     MemoryRegion orig_mem;
 107     int rom_mode;
 108     int read_counter; /* used for lazy switch-back to rom mode */
 109     char *name;
 110     void *storage;
 111 };
 112
 113 /*
 114  * Toggle status bit DQ7.
 115  */
 116 static inline void toggle_dq7(PFlashCFI02 *pfl)
 117 {
 118     pfl->status ^= 0x80;
 119 }
 120
 121 /*
 122  * Set status bit DQ7 to bit 7 of value.
 123  */
 124 static inline void set_dq7(PFlashCFI02 *pfl, uint8_t value)
 125 {
 126     pfl->status &= 0x7F;
 127     pfl->status |= value & 0x80;
 128 }
 129
 130 /*
 131  * Toggle status bit DQ6.
 132  */
 133 static inline void toggle_dq6(PFlashCFI02 *pfl)
 134 {
 135     pfl->status ^= 0x40;
 136 }
 137
 138 /*
 139  * Set up replicated mappings of the same region.
 140  */
 141 static void pflash_setup_mappings(PFlashCFI02 *pfl)
 142 {
 143     unsigned i;
 144     hwaddr size = memory_region_size(&pfl->orig_mem);
 145
 146     memory_region_init(&pfl->mem, OBJECT(pfl), "pflash", pfl->mappings * size);
 147     pfl->mem_mappings = g_new(MemoryRegion, pfl->mappings);
 148     for (i = 0; i < pfl->mappings; ++i) {
 149         memory_region_init_alias(&pfl->mem_mappings[i], OBJECT(pfl),
 150                                  "pflash-alias", &pfl->orig_mem, 0, size);
 151         memory_region_add_subregion(&pfl->mem, i * size, &pfl->mem_mappings[i]);
 152     }
 153 }
 154
 155 static void pflash_register_memory(PFlashCFI02 *pfl, int rom_mode)
 156 {
 157     memory_region_rom_device_set_romd(&pfl->orig_mem, rom_mode);
 158     pfl->rom_mode = rom_mode;
 159 }
 160
 161 static size_t pflash_regions_count(PFlashCFI02 *pfl)
 162 {
 163     return pfl->cfi_table[0x2c];
 164 }
 165
 166 static void pflash_timer (void *opaque)
 167 {
 168     PFlashCFI02 *pfl = opaque;
 169
 170     trace_pflash_timer_expired(pfl->cmd);
 171     /* Reset flash */
 172     toggle_dq7(pfl);
 173     if (pfl->bypass) {
 174         pfl->wcycle = 2;
 175     } else {
 176         pflash_register_memory(pfl, 1);
 177         pfl->wcycle = 0;
 178     }
 179     pfl->cmd = 0;
 180 }
 181
 182 /*
 183  * Read data from flash.
 184  */
 185 static uint64_t pflash_data_read(PFlashCFI02 *pfl, hwaddr offset,
 186                                  unsigned int width)
 187 {
 188     uint8_t *p = (uint8_t *)pfl->storage + offset;
 189     uint64_t ret = pfl->be ? ldn_be_p(p, width) : ldn_le_p(p, width);
 190     trace_pflash_data_read(offset, width << 1, ret);
 191     return ret;
 192 }
 193
 194 /*
 195  * offset should be a byte offset of the QEMU device and _not_ a device
 196  * offset.
 197  */
 198 static uint32_t pflash_sector_len(PFlashCFI02 *pfl, hwaddr offset)
 199 {
 200     assert(offset < pfl->chip_len);
 201     hwaddr addr = 0;
 202     for (int i = 0; i < pflash_regions_count(pfl); ++i) {
 203         uint64_t region_size = (uint64_t)pfl->nb_blocs[i] * pfl->sector_len[i];
 204         if (addr <= offset && offset < addr + region_size) {
 205             return pfl->sector_len[i];
 206         }
 207         addr += region_size;
 208     }
 209     abort();
 210 }
 211
 212 static uint64_t pflash_read(void *opaque, hwaddr offset, unsigned int width)
 213 {
 214     PFlashCFI02 *pfl = opaque;
 215     hwaddr boff;
 216     uint64_t ret;
 217
 218     ret = -1;
 219     /* Lazy reset to ROMD mode after a certain amount of read accesses */
 220     if (!pfl->rom_mode && pfl->wcycle == 0 &&
 221         ++pfl->read_counter > PFLASH_LAZY_ROMD_THRESHOLD) {
 222         pflash_register_memory(pfl, 1);
 223     }
 224     offset &= pfl->chip_len - 1;
 225     boff = offset & 0xFF;
 226     if (pfl->width == 2) {
 227         boff = boff >> 1;
 228     } else if (pfl->width == 4) {
 229         boff = boff >> 2;
 230     }
 231     switch (pfl->cmd) {
 232     default:
 233         /* This should never happen : reset state & treat it as a read*/
 234         DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);
 235         pfl->wcycle = 0;
 236         pfl->cmd = 0;
 237         /* fall through to the read code */
 238     case 0x80:
 239         /* We accept reads during second unlock sequence... */
 240     case 0x00:
 241         /* Flash area read */
 242         ret = pflash_data_read(pfl, offset, width);
 243         break;
 244     case 0x90:
 245         /* flash ID read */
 246         switch (boff) {
 247         case 0x00:
 248         case 0x01:
 249             ret = boff & 0x01 ? pfl->ident1 : pfl->ident0;
 250             break;
 251         case 0x02:
 252             ret = 0x00; /* Pretend all sectors are unprotected */
 253             break;
 254         case 0x0E:
 255         case 0x0F:
 256             ret = boff & 0x01 ? pfl->ident3 : pfl->ident2;
 257             if (ret != (uint8_t)-1) {
 258                 break;
 259             }
 260             /* Fall through to data read. */
 261         default:
 262             ret = pflash_data_read(pfl, offset, width);
 263         }
 264         DPRINTF("%s: ID " TARGET_FMT_plx " %" PRIx64 "\n", __func__, boff, ret);
 265         break;
 266     case 0xA0:
 267     case 0x10:
 268     case 0x30:
 269         /* Status register read */
 270         ret = pfl->status;
 271         DPRINTF("%s: status %" PRIx64 "\n", __func__, ret);
 272         toggle_dq6(pfl);
 273         break;
 274     case 0x98:
 275         /* CFI query mode */
 276         if (boff < sizeof(pfl->cfi_table)) {
 277             ret = pfl->cfi_table[boff];
 278         } else {
 279             ret = 0;
 280         }
 281         break;
 282     }
 283     trace_pflash_io_read(offset, width, width << 1, ret, pfl->cmd, pfl->wcycle);
 284
 285     return ret;
 286 }
 287
 288 /* update flash content on disk */
 289 static void pflash_update(PFlashCFI02 *pfl, int offset, int size)
 290 {
 291     int offset_end;
 292     if (pfl->blk) {
 293         offset_end = offset + size;
 294         /* widen to sector boundaries */
 295         offset = QEMU_ALIGN_DOWN(offset, BDRV_SECTOR_SIZE);
 296         offset_end = QEMU_ALIGN_UP(offset_end, BDRV_SECTOR_SIZE);
 297         blk_pwrite(pfl->blk, offset, pfl->storage + offset,
 298                    offset_end - offset, 0);
 299     }
 300 }
 301
 302 static void pflash_write(void *opaque, hwaddr offset, uint64_t value,
 303                          unsigned int width)
 304 {
 305     PFlashCFI02 *pfl = opaque;
 306     hwaddr boff;
 307     uint8_t *p;
 308     uint8_t cmd;
 309     uint32_t sector_len;
 310
 311     trace_pflash_io_write(offset, width, width << 1, value, pfl->wcycle);
 312     cmd = value;
 313     if (pfl->cmd != 0xA0) {
 314         if (cmd == 0xF0) {
 315             if (pfl->wcycle == WCYCLE_AUTOSELECT_CFI) {
 316                 /* Return to autoselect mode. */
 317                 pfl->wcycle = 3;
 318                 pfl->cmd = 0x90;
 319                 return;
 320             }
 321             goto reset_flash;
 322         }
 323     }
 324     offset &= pfl->chip_len - 1;
 325
 326     boff = offset;
 327     if (pfl->width == 2) {
 328         boff = boff >> 1;
 329     } else if (pfl->width == 4) {
 330         boff = boff >> 2;
 331     }
 332     /* Only the least-significant 11 bits are used in most cases. */
 333     boff &= 0x7FF;
 334     switch (pfl->wcycle) {
 335     case 0:
 336         /* Set the device in I/O access mode if required */
 337         if (pfl->rom_mode)
 338             pflash_register_memory(pfl, 0);
 339         pfl->read_counter = 0;
 340         /* We're in read mode */
 341     check_unlock0:
 342         if (boff == 0x55 && cmd == 0x98) {
 343             /* Enter CFI query mode */
 344             pfl->wcycle = WCYCLE_CFI;
 345             pfl->cmd = 0x98;
 346             return;
 347         }
 348         if (boff != pfl->unlock_addr0 || cmd != 0xAA) {
 349             DPRINTF("%s: unlock0 failed " TARGET_FMT_plx " %02x %04x\n",
 350                     __func__, boff, cmd, pfl->unlock_addr0);
 351             goto reset_flash;
 352         }
 353         DPRINTF("%s: unlock sequence started\n", __func__);
 354         break;
 355     case 1:
 356         /* We started an unlock sequence */
 357     check_unlock1:
 358         if (boff != pfl->unlock_addr1 || cmd != 0x55) {
 359             DPRINTF("%s: unlock1 failed " TARGET_FMT_plx " %02x\n", __func__,
 360                     boff, cmd);
 361             goto reset_flash;
 362         }
 363         DPRINTF("%s: unlock sequence done\n", __func__);
 364         break;
 365     case 2:
 366         /* We finished an unlock sequence */
 367         if (!pfl->bypass && boff != pfl->unlock_addr0) {
 368             DPRINTF("%s: command failed " TARGET_FMT_plx " %02x\n", __func__,
 369                     boff, cmd);
 370             goto reset_flash;
 371         }
 372         switch (cmd) {
 373         case 0x20:
 374             pfl->bypass = 1;
 375             goto do_bypass;
 376         case 0x80:
 377         case 0x90:
 378         case 0xA0:
 379             pfl->cmd = cmd;
 380             DPRINTF("%s: starting command %02x\n", __func__, cmd);
 381             break;
 382         default:
 383             DPRINTF("%s: unknown command %02x\n", __func__, cmd);
 384             goto reset_flash;
 385         }
 386         break;
 387     case 3:
 388         switch (pfl->cmd) {
 389         case 0x80:
 390             /* We need another unlock sequence */
 391             goto check_unlock0;
 392         case 0xA0:
 393             trace_pflash_data_write(offset, width << 1, value, 0);
 394             if (!pfl->ro) {
 395                 p = (uint8_t *)pfl->storage + offset;
 396                 if (pfl->be) {
 397                     uint64_t current = ldn_be_p(p, width);
 398                     stn_be_p(p, width, current & value);
 399                 } else {
 400                     uint64_t current = ldn_le_p(p, width);
 401                     stn_le_p(p, width, current & value);
 402                 }
 403                 pflash_update(pfl, offset, width);
 404             }
 405             /*
 406              * While programming, status bit DQ7 should hold the opposite
 407              * value from how it was programmed.
 408              */
 409             set_dq7(pfl, ~value);
 410             /* Let's pretend write is immediate */
 411             if (pfl->bypass)
 412                 goto do_bypass;
 413             goto reset_flash;
 414         case 0x90:
 415             if (pfl->bypass && cmd == 0x00) {
 416                 /* Unlock bypass reset */
 417                 goto reset_flash;
 418             }
 419             /*
 420              * We can enter CFI query mode from autoselect mode, but we must
 421              * return to autoselect mode after a reset.
 422              */
 423             if (boff == 0x55 && cmd == 0x98) {
 424                 /* Enter autoselect CFI query mode */
 425                 pfl->wcycle = WCYCLE_AUTOSELECT_CFI;
 426                 pfl->cmd = 0x98;
 427                 return;
 428             }
 429             /* No break here */
 430         default:
 431             DPRINTF("%s: invalid write for command %02x\n",
 432                     __func__, pfl->cmd);
 433             goto reset_flash;
 434         }
 435     case 4:
 436         switch (pfl->cmd) {
 437         case 0xA0:
 438             /* Ignore writes while flash data write is occurring */
 439             /* As we suppose write is immediate, this should never happen */
 440             return;
 441         case 0x80:
 442             goto check_unlock1;
 443         default:
 444             /* Should never happen */
 445             DPRINTF("%s: invalid command state %02x (wc 4)\n",
 446                     __func__, pfl->cmd);
 447             goto reset_flash;
 448         }
 449         break;
 450     case 5:
 451         switch (cmd) {
 452         case 0x10:
 453             if (boff != pfl->unlock_addr0) {
 454                 DPRINTF("%s: chip erase: invalid address " TARGET_FMT_plx "\n",
 455                         __func__, offset);
 456                 goto reset_flash;
 457             }
 458             /* Chip erase */
 459             DPRINTF("%s: start chip erase\n", __func__);
 460             if (!pfl->ro) {
 461                 memset(pfl->storage, 0xff, pfl->chip_len);
 462                 pflash_update(pfl, 0, pfl->chip_len);
 463             }
 464             set_dq7(pfl, 0x00);
 465             /* Let's wait 5 seconds before chip erase is done */
 466             timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
 467                       (NANOSECONDS_PER_SECOND * 5));
 468             break;
 469         case 0x30:
 470             /* Sector erase */
 471             p = pfl->storage;
 472             sector_len = pflash_sector_len(pfl, offset);
 473             offset &= ~(sector_len - 1);
 474             DPRINTF("%s: start sector erase at %0*" PRIx64 "-%0*" PRIx64 "\n",
 475                     __func__, pfl->width * 2, offset,
 476                     pfl->width * 2, offset + sector_len - 1);
 477             if (!pfl->ro) {
 478                 memset(p + offset, 0xff, sector_len);
 479                 pflash_update(pfl, offset, sector_len);
 480             }
 481             set_dq7(pfl, 0x00);
 482             /* Let's wait 1/2 second before sector erase is done */
 483             timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
 484                       (NANOSECONDS_PER_SECOND / 2));
 485             break;
 486         default:
 487             DPRINTF("%s: invalid command %02x (wc 5)\n", __func__, cmd);
 488             goto reset_flash;
 489         }
 490         pfl->cmd = cmd;
 491         break;
 492     case 6:
 493         switch (pfl->cmd) {
 494         case 0x10:
 495             /* Ignore writes during chip erase */
 496             return;
 497         case 0x30:
 498             /* Ignore writes during sector erase */
 499             return;
 500         default:
 501             /* Should never happen */
 502             DPRINTF("%s: invalid command state %02x (wc 6)\n",
 503                     __func__, pfl->cmd);
 504             goto reset_flash;
 505         }
 506         break;
 507     /* Special values for CFI queries */
 508     case WCYCLE_CFI:
 509     case WCYCLE_AUTOSELECT_CFI:
 510         DPRINTF("%s: invalid write in CFI query mode\n", __func__);
 511         goto reset_flash;
 512     default:
 513         /* Should never happen */
 514         DPRINTF("%s: invalid write state (wc 7)\n",  __func__);
 515         goto reset_flash;
 516     }
 517     pfl->wcycle++;
 518
 519     return;
 520
 521     /* Reset flash */
 522  reset_flash:
 523     trace_pflash_reset();
 524     pfl->bypass = 0;
 525     pfl->wcycle = 0;
 526     pfl->cmd = 0;
 527     return;
 528
 529  do_bypass:
 530     pfl->wcycle = 2;
 531     pfl->cmd = 0;
 532 }
 533
 534 static const MemoryRegionOps pflash_cfi02_ops = {
 535     .read = pflash_read,
 536     .write = pflash_write,
 537     .valid.min_access_size = 1,
 538     .valid.max_access_size = 4,
 539     .endianness = DEVICE_NATIVE_ENDIAN,
 540 };
 541
 542 static void pflash_cfi02_realize(DeviceState *dev, Error **errp)
 543 {
 544     PFlashCFI02 *pfl = PFLASH_CFI02(dev);
 545     int ret;
 546     Error *local_err = NULL;
 547
 548     if (pfl->uniform_sector_len == 0 && pfl->sector_len[0] == 0) {
 549         error_setg(errp, "attribute \"sector-length\" not specified or zero.");
 550         return;
 551     }
 552     if (pfl->uniform_nb_blocs == 0 && pfl->nb_blocs[0] == 0) {
 553         error_setg(errp, "attribute \"num-blocks\" not specified or zero.");
 554         return;
 555     }
 556     if (pfl->name == NULL) {
 557         error_setg(errp, "attribute \"name\" not specified.");
 558         return;
 559     }
 560
 561     int nb_regions;
 562     pfl->chip_len = 0;
 563     for (nb_regions = 0; nb_regions < PFLASH_MAX_ERASE_REGIONS; ++nb_regions) {
 564         if (pfl->nb_blocs[nb_regions] == 0) {
 565             break;
 566         }
 567         uint64_t sector_len_per_device = pfl->sector_len[nb_regions];
 568
 569         /*
 570          * The size of each flash sector must be a power of 2 and it must be
 571          * aligned at the same power of 2.
 572          */
 573         if (sector_len_per_device & 0xff ||
 574             sector_len_per_device >= (1 << 24) ||
 575             !is_power_of_2(sector_len_per_device))
 576         {
 577             error_setg(errp, "unsupported configuration: "
 578                        "sector length[%d] per device = %" PRIx64 ".",
 579                        nb_regions, sector_len_per_device);
 580             return;
 581         }
 582         if (pfl->chip_len & (sector_len_per_device - 1)) {
 583             error_setg(errp, "unsupported configuration: "
 584                        "flash region %d not correctly aligned.",
 585                        nb_regions);
 586             return;
 587         }
 588
 589         pfl->chip_len += (uint64_t)pfl->sector_len[nb_regions] *
 590                           pfl->nb_blocs[nb_regions];
 591     }
 592
 593     uint64_t uniform_len = (uint64_t)pfl->uniform_nb_blocs *
 594                            pfl->uniform_sector_len;
 595     if (nb_regions == 0) {
 596         nb_regions = 1;
 597         pfl->nb_blocs[0] = pfl->uniform_nb_blocs;
 598         pfl->sector_len[0] = pfl->uniform_sector_len;
 599         pfl->chip_len = uniform_len;
 600     } else if (uniform_len != 0 && uniform_len != pfl->chip_len) {
 601         error_setg(errp, "\"num-blocks\"*\"sector-length\" "
 602                    "different from \"num-blocks0\"*\'sector-length0\" + ... + "
 603                    "\"num-blocks3\"*\"sector-length3\"");
 604         return;
 605     }
 606
 607     memory_region_init_rom_device(&pfl->orig_mem, OBJECT(pfl),
 608                                   &pflash_cfi02_ops, pfl, pfl->name,
 609                                   pfl->chip_len, &local_err);
 610     if (local_err) {
 611         error_propagate(errp, local_err);
 612         return;
 613     }
 614
 615     pfl->storage = memory_region_get_ram_ptr(&pfl->orig_mem);
 616
 617     if (pfl->blk) {
 618         uint64_t perm;
 619         pfl->ro = blk_is_read_only(pfl->blk);
 620         perm = BLK_PERM_CONSISTENT_READ | (pfl->ro ? 0 : BLK_PERM_WRITE);
 621         ret = blk_set_perm(pfl->blk, perm, BLK_PERM_ALL, errp);
 622         if (ret < 0) {
 623             return;
 624         }
 625     } else {
 626         pfl->ro = 0;
 627     }
 628
 629     if (pfl->blk) {
 630         if (!blk_check_size_and_read_all(pfl->blk, pfl->storage,
 631                                          pfl->chip_len, errp)) {
 632             vmstate_unregister_ram(&pfl->orig_mem, DEVICE(pfl));
 633             return;
 634         }
 635     }
 636
 637     /* Only 11 bits are used in the comparison. */
 638     pfl->unlock_addr0 &= 0x7FF;
 639     pfl->unlock_addr1 &= 0x7FF;
 640
 641     pflash_setup_mappings(pfl);
 642     pfl->rom_mode = 1;
 643     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &pfl->mem);
 644
 645     timer_init_ns(&pfl->timer, QEMU_CLOCK_VIRTUAL, pflash_timer, pfl);
 646     pfl->wcycle = 0;
 647     pfl->cmd = 0;
 648     pfl->status = 0;
 649
 650     /* Hardcoded CFI table (mostly from SG29 Spansion flash) */
 651     const uint16_t pri_ofs = 0x40;
 652     /* Standard "QRY" string */
 653     pfl->cfi_table[0x10] = 'Q';
 654     pfl->cfi_table[0x11] = 'R';
 655     pfl->cfi_table[0x12] = 'Y';
 656     /* Command set (AMD/Fujitsu) */
 657     pfl->cfi_table[0x13] = 0x02;
 658     pfl->cfi_table[0x14] = 0x00;
 659     /* Primary extended table address */
 660     pfl->cfi_table[0x15] = pri_ofs;
 661     pfl->cfi_table[0x16] = pri_ofs >> 8;
 662     /* Alternate command set (none) */
 663     pfl->cfi_table[0x17] = 0x00;
 664     pfl->cfi_table[0x18] = 0x00;
 665     /* Alternate extended table (none) */
 666     pfl->cfi_table[0x19] = 0x00;
 667     pfl->cfi_table[0x1A] = 0x00;
 668     /* Vcc min */
 669     pfl->cfi_table[0x1B] = 0x27;
 670     /* Vcc max */
 671     pfl->cfi_table[0x1C] = 0x36;
 672     /* Vpp min (no Vpp pin) */
 673     pfl->cfi_table[0x1D] = 0x00;
 674     /* Vpp max (no Vpp pin) */
 675     pfl->cfi_table[0x1E] = 0x00;
 676     /* Timeout per single byte/word write (128 ms) */
 677     pfl->cfi_table[0x1F] = 0x07;
 678     /* Timeout for min size buffer write (NA) */
 679     pfl->cfi_table[0x20] = 0x00;
 680     /* Typical timeout for block erase (512 ms) */
 681     pfl->cfi_table[0x21] = 0x09;
 682     /* Typical timeout for full chip erase (4096 ms) */
 683     pfl->cfi_table[0x22] = 0x0C;
 684     /* Reserved */
 685     pfl->cfi_table[0x23] = 0x01;
 686     /* Max timeout for buffer write (NA) */
 687     pfl->cfi_table[0x24] = 0x00;
 688     /* Max timeout for block erase */
 689     pfl->cfi_table[0x25] = 0x0A;
 690     /* Max timeout for chip erase */
 691     pfl->cfi_table[0x26] = 0x0D;
 692     /* Device size */
 693     pfl->cfi_table[0x27] = ctz32(pfl->chip_len);
 694     /* Flash device interface (8 & 16 bits) */
 695     pfl->cfi_table[0x28] = 0x02;
 696     pfl->cfi_table[0x29] = 0x00;
 697     /* Max number of bytes in multi-bytes write */
 698     /* XXX: disable buffered write as it's not supported */
 699     //    pfl->cfi_table[0x2A] = 0x05;
 700     pfl->cfi_table[0x2A] = 0x00;
 701     pfl->cfi_table[0x2B] = 0x00;
 702     /* Number of erase block regions */
 703     pfl->cfi_table[0x2c] = nb_regions;
 704     /* Erase block regions */
 705     for (int i = 0; i < nb_regions; ++i) {
 706         uint32_t sector_len_per_device = pfl->sector_len[i];
 707         pfl->cfi_table[0x2d + 4 * i] = pfl->nb_blocs[i] - 1;
 708         pfl->cfi_table[0x2e + 4 * i] = (pfl->nb_blocs[i] - 1) >> 8;
 709         pfl->cfi_table[0x2f + 4 * i] = sector_len_per_device >> 8;
 710         pfl->cfi_table[0x30 + 4 * i] = sector_len_per_device >> 16;
 711     }
 712     assert(0x2c + 4 * nb_regions < pri_ofs);
 713
 714     /* Extended */
 715     pfl->cfi_table[0x00 + pri_ofs] = 'P';
 716     pfl->cfi_table[0x01 + pri_ofs] = 'R';
 717     pfl->cfi_table[0x02 + pri_ofs] = 'I';
 718
 719     /* Extended version 1.0 */
 720     pfl->cfi_table[0x03 + pri_ofs] = '1';
 721     pfl->cfi_table[0x04 + pri_ofs] = '0';
 722
 723     /* Address sensitive unlock required. */
 724     pfl->cfi_table[0x05 + pri_ofs] = 0x00;
 725     /* Erase suspend not supported. */
 726     pfl->cfi_table[0x06 + pri_ofs] = 0x00;
 727     /* Sector protect not supported. */
 728     pfl->cfi_table[0x07 + pri_ofs] = 0x00;
 729     /* Temporary sector unprotect not supported. */
 730     pfl->cfi_table[0x08 + pri_ofs] = 0x00;
 731
 732     /* Sector protect/unprotect scheme. */
 733     pfl->cfi_table[0x09 + pri_ofs] = 0x00;
 734
 735     /* Simultaneous operation not supported. */
 736     pfl->cfi_table[0x0a + pri_ofs] = 0x00;
 737     /* Burst mode not supported. */
 738     pfl->cfi_table[0x0b + pri_ofs] = 0x00;
 739     /* Page mode not supported. */
 740     pfl->cfi_table[0x0c + pri_ofs] = 0x00;
 741     assert(0x0c + pri_ofs < ARRAY_SIZE(pfl->cfi_table));
 742 }
 743
 744 static Property pflash_cfi02_properties[] = {
 745     DEFINE_PROP_DRIVE("drive", PFlashCFI02, blk),
 746     DEFINE_PROP_UINT32("num-blocks", PFlashCFI02, uniform_nb_blocs, 0),
 747     DEFINE_PROP_UINT32("sector-length", PFlashCFI02, uniform_sector_len, 0),
 748     DEFINE_PROP_UINT32("num-blocks0", PFlashCFI02, nb_blocs[0], 0),
 749     DEFINE_PROP_UINT32("sector-length0", PFlashCFI02, sector_len[0], 0),
 750     DEFINE_PROP_UINT32("num-blocks1", PFlashCFI02, nb_blocs[1], 0),
 751     DEFINE_PROP_UINT32("sector-length1", PFlashCFI02, sector_len[1], 0),
 752     DEFINE_PROP_UINT32("num-blocks2", PFlashCFI02, nb_blocs[2], 0),
 753     DEFINE_PROP_UINT32("sector-length2", PFlashCFI02, sector_len[2], 0),
 754     DEFINE_PROP_UINT32("num-blocks3", PFlashCFI02, nb_blocs[3], 0),
 755     DEFINE_PROP_UINT32("sector-length3", PFlashCFI02, sector_len[3], 0),
 756     DEFINE_PROP_UINT8("width", PFlashCFI02, width, 0),
 757     DEFINE_PROP_UINT8("mappings", PFlashCFI02, mappings, 0),
 758     DEFINE_PROP_UINT8("big-endian", PFlashCFI02, be, 0),
 759     DEFINE_PROP_UINT16("id0", PFlashCFI02, ident0, 0),
 760     DEFINE_PROP_UINT16("id1", PFlashCFI02, ident1, 0),
 761     DEFINE_PROP_UINT16("id2", PFlashCFI02, ident2, 0),
 762     DEFINE_PROP_UINT16("id3", PFlashCFI02, ident3, 0),
 763     DEFINE_PROP_UINT16("unlock-addr0", PFlashCFI02, unlock_addr0, 0),
 764     DEFINE_PROP_UINT16("unlock-addr1", PFlashCFI02, unlock_addr1, 0),
 765     DEFINE_PROP_STRING("name", PFlashCFI02, name),
 766     DEFINE_PROP_END_OF_LIST(),
 767 };
 768
 769 static void pflash_cfi02_unrealize(DeviceState *dev, Error **errp)
 770 {
 771     PFlashCFI02 *pfl = PFLASH_CFI02(dev);
 772     timer_del(&pfl->timer);
 773 }
 774
 775 static void pflash_cfi02_class_init(ObjectClass *klass, void *data)
 776 {
 777     DeviceClass *dc = DEVICE_CLASS(klass);
 778
 779     dc->realize = pflash_cfi02_realize;
 780     dc->unrealize = pflash_cfi02_unrealize;
 781     dc->props = pflash_cfi02_properties;
 782     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 783 }
 784
 785 static const TypeInfo pflash_cfi02_info = {
 786     .name           = TYPE_PFLASH_CFI02,
 787     .parent         = TYPE_SYS_BUS_DEVICE,
 788     .instance_size  = sizeof(PFlashCFI02),
 789     .class_init     = pflash_cfi02_class_init,
 790 };
 791
 792 static void pflash_cfi02_register_types(void)
 793 {
 794     type_register_static(&pflash_cfi02_info);
 795 }
 796
 797 type_init(pflash_cfi02_register_types)
 798
 799 PFlashCFI02 *pflash_cfi02_register(hwaddr base,
 800                                    const char *name,
 801                                    hwaddr size,
 802                                    BlockBackend *blk,
 803                                    uint32_t sector_len,
 804                                    int nb_mappings, int width,
 805                                    uint16_t id0, uint16_t id1,
 806                                    uint16_t id2, uint16_t id3,
 807                                    uint16_t unlock_addr0,
 808                                    uint16_t unlock_addr1,
 809                                    int be)
 810 {
 811     DeviceState *dev = qdev_create(NULL, TYPE_PFLASH_CFI02);
 812
 813     if (blk) {
 814         qdev_prop_set_drive(dev, "drive", blk, &error_abort);
 815     }
 816     assert(size % sector_len == 0);
 817     qdev_prop_set_uint32(dev, "num-blocks", size / sector_len);
 818     qdev_prop_set_uint32(dev, "sector-length", sector_len);
 819     qdev_prop_set_uint8(dev, "width", width);
 820     qdev_prop_set_uint8(dev, "mappings", nb_mappings);
 821     qdev_prop_set_uint8(dev, "big-endian", !!be);
 822     qdev_prop_set_uint16(dev, "id0", id0);
 823     qdev_prop_set_uint16(dev, "id1", id1);
 824     qdev_prop_set_uint16(dev, "id2", id2);
 825     qdev_prop_set_uint16(dev, "id3", id3);
 826     qdev_prop_set_uint16(dev, "unlock-addr0", unlock_addr0);
 827     qdev_prop_set_uint16(dev, "unlock-addr1", unlock_addr1);
 828     qdev_prop_set_string(dev, "name", name);
 829     qdev_init_nofail(dev);
 830
 831     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
 832     return PFLASH_CFI02(dev);
 833 }