1 /* 2 * CFI parallel flash with AMD command set emulation 3 * 4 * Copyright (c) 2005 Jocelyn Mayer 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2.1 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 */ 19 20 /* 21 * For now, this code can emulate flashes of 1, 2 or 4 bytes width. 22 * Supported commands/modes are: 23 * - flash read 24 * - flash write 25 * - flash ID read 26 * - sector erase 27 * - chip erase 28 * - unlock bypass command 29 * - CFI queries 30 * 31 * It does not support flash interleaving. 32 * It does not implement software data protection as found in many real chips 33 */ 34 35 #include "qemu/osdep.h" 36 #include "hw/block/block.h" 37 #include "hw/block/flash.h" 38 #include "hw/qdev-properties.h" 39 #include "hw/qdev-properties-system.h" 40 #include "qapi/error.h" 41 #include "qemu/error-report.h" 42 #include "qemu/bitmap.h" 43 #include "qemu/timer.h" 44 #include "sysemu/block-backend.h" 45 #include "qemu/host-utils.h" 46 #include "qemu/module.h" 47 #include "hw/sysbus.h" 48 #include "migration/vmstate.h" 49 #include "trace.h" 50 51 #define PFLASH_DEBUG false 52 #define DPRINTF(fmt, ...) \ 53 do { \ 54 if (PFLASH_DEBUG) { \ 55 fprintf(stderr, "PFLASH: " fmt, ## __VA_ARGS__); \ 56 } \ 57 } while (0) 58 59 #define PFLASH_LAZY_ROMD_THRESHOLD 42 60 61 /* 62 * The size of the cfi_table indirectly depends on this and the start of the 63 * PRI table directly depends on it. 4 is the maximum size (and also what 64 * seems common) without changing the PRT table address. 65 */ 66 #define PFLASH_MAX_ERASE_REGIONS 4 67 68 /* Special write cycles for CFI queries. */ 69 enum { 70 WCYCLE_CFI = 7, 71 WCYCLE_AUTOSELECT_CFI = 8, 72 }; 73 74 struct PFlashCFI02 { 75 /*< private >*/ 76 SysBusDevice parent_obj; 77 /*< public >*/ 78 79 BlockBackend *blk; 80 uint32_t uniform_nb_blocs; 81 uint32_t uniform_sector_len; 82 uint32_t total_sectors; 83 uint32_t nb_blocs[PFLASH_MAX_ERASE_REGIONS]; 84 uint32_t sector_len[PFLASH_MAX_ERASE_REGIONS]; 85 uint32_t chip_len; 86 uint8_t mappings; 87 uint8_t width; 88 uint8_t be; 89 int wcycle; /* if 0, the flash is read normally */ 90 int bypass; 91 int ro; 92 uint8_t cmd; 93 uint8_t status; 94 /* FIXME: implement array device properties */ 95 uint16_t ident0; 96 uint16_t ident1; 97 uint16_t ident2; 98 uint16_t ident3; 99 uint16_t unlock_addr0; 100 uint16_t unlock_addr1; 101 uint8_t cfi_table[0x4d]; 102 QEMUTimer timer; 103 /* 104 * The device replicates the flash memory across its memory space. Emulate 105 * that by having a container (.mem) filled with an array of aliases 106 * (.mem_mappings) pointing to the flash memory (.orig_mem). 107 */ 108 MemoryRegion mem; 109 MemoryRegion *mem_mappings; /* array; one per mapping */ 110 MemoryRegion orig_mem; 111 bool rom_mode; 112 int read_counter; /* used for lazy switch-back to rom mode */ 113 int sectors_to_erase; 114 uint64_t erase_time_remaining; 115 unsigned long *sector_erase_map; 116 char *name; 117 void *storage; 118 }; 119 120 /* 121 * Toggle status bit DQ7. 122 */ 123 static inline void toggle_dq7(PFlashCFI02 *pfl) 124 { 125 pfl->status ^= 0x80; 126 } 127 128 /* 129 * Set status bit DQ7 to bit 7 of value. 130 */ 131 static inline void set_dq7(PFlashCFI02 *pfl, uint8_t value) 132 { 133 pfl->status &= 0x7F; 134 pfl->status |= value & 0x80; 135 } 136 137 /* 138 * Toggle status bit DQ6. 139 */ 140 static inline void toggle_dq6(PFlashCFI02 *pfl) 141 { 142 pfl->status ^= 0x40; 143 } 144 145 /* 146 * Turn on DQ3. 147 */ 148 static inline void assert_dq3(PFlashCFI02 *pfl) 149 { 150 pfl->status |= 0x08; 151 } 152 153 /* 154 * Turn off DQ3. 155 */ 156 static inline void reset_dq3(PFlashCFI02 *pfl) 157 { 158 pfl->status &= ~0x08; 159 } 160 161 /* 162 * Toggle status bit DQ2. 163 */ 164 static inline void toggle_dq2(PFlashCFI02 *pfl) 165 { 166 pfl->status ^= 0x04; 167 } 168 169 /* 170 * Set up replicated mappings of the same region. 171 */ 172 static void pflash_setup_mappings(PFlashCFI02 *pfl) 173 { 174 unsigned i; 175 hwaddr size = memory_region_size(&pfl->orig_mem); 176 177 memory_region_init(&pfl->mem, OBJECT(pfl), "pflash", pfl->mappings * size); 178 pfl->mem_mappings = g_new(MemoryRegion, pfl->mappings); 179 for (i = 0; i < pfl->mappings; ++i) { 180 memory_region_init_alias(&pfl->mem_mappings[i], OBJECT(pfl), 181 "pflash-alias", &pfl->orig_mem, 0, size); 182 memory_region_add_subregion(&pfl->mem, i * size, &pfl->mem_mappings[i]); 183 } 184 pfl->rom_mode = true; 185 } 186 187 static void pflash_reset_state_machine(PFlashCFI02 *pfl) 188 { 189 trace_pflash_reset(); 190 pfl->cmd = 0x00; 191 pfl->wcycle = 0; 192 } 193 194 static void pflash_mode_read_array(PFlashCFI02 *pfl) 195 { 196 trace_pflash_mode_read_array(); 197 pflash_reset_state_machine(pfl); 198 pfl->rom_mode = true; 199 memory_region_rom_device_set_romd(&pfl->orig_mem, true); 200 } 201 202 static size_t pflash_regions_count(PFlashCFI02 *pfl) 203 { 204 return pfl->cfi_table[0x2c]; 205 } 206 207 /* 208 * Returns the time it takes to erase the number of sectors scheduled for 209 * erasure based on CFI address 0x21 which is "Typical timeout per individual 210 * block erase 2^N ms." 211 */ 212 static uint64_t pflash_erase_time(PFlashCFI02 *pfl) 213 { 214 /* 215 * If there are no sectors to erase (which can happen if all of the sectors 216 * to be erased are protected), then erase takes 100 us. Protected sectors 217 * aren't supported so this should never happen. 218 */ 219 return ((1ULL << pfl->cfi_table[0x21]) * pfl->sectors_to_erase) * SCALE_US; 220 } 221 222 /* 223 * Returns true if the device is currently in erase suspend mode. 224 */ 225 static inline bool pflash_erase_suspend_mode(PFlashCFI02 *pfl) 226 { 227 return pfl->erase_time_remaining > 0; 228 } 229 230 static void pflash_timer(void *opaque) 231 { 232 PFlashCFI02 *pfl = opaque; 233 234 trace_pflash_timer_expired(pfl->cmd); 235 if (pfl->cmd == 0x30) { 236 /* 237 * Sector erase. If DQ3 is 0 when the timer expires, then the 50 238 * us erase timeout has expired so we need to start the timer for the 239 * sector erase algorithm. Otherwise, the erase completed and we should 240 * go back to read array mode. 241 */ 242 if ((pfl->status & 0x08) == 0) { 243 assert_dq3(pfl); 244 uint64_t timeout = pflash_erase_time(pfl); 245 timer_mod(&pfl->timer, 246 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + timeout); 247 DPRINTF("%s: erase timeout fired; erasing %d sectors\n", 248 __func__, pfl->sectors_to_erase); 249 return; 250 } 251 DPRINTF("%s: sector erase complete\n", __func__); 252 bitmap_zero(pfl->sector_erase_map, pfl->total_sectors); 253 pfl->sectors_to_erase = 0; 254 reset_dq3(pfl); 255 } 256 257 /* Reset flash */ 258 toggle_dq7(pfl); 259 if (pfl->bypass) { 260 pfl->wcycle = 2; 261 pfl->cmd = 0; 262 } else { 263 pflash_mode_read_array(pfl); 264 } 265 } 266 267 /* 268 * Read data from flash. 269 */ 270 static uint64_t pflash_data_read(PFlashCFI02 *pfl, hwaddr offset, 271 unsigned int width) 272 { 273 uint8_t *p = (uint8_t *)pfl->storage + offset; 274 uint64_t ret = pfl->be ? ldn_be_p(p, width) : ldn_le_p(p, width); 275 trace_pflash_data_read(offset, width, ret); 276 return ret; 277 } 278 279 typedef struct { 280 uint32_t len; 281 uint32_t num; 282 } SectorInfo; 283 284 /* 285 * offset should be a byte offset of the QEMU device and _not_ a device 286 * offset. 287 */ 288 static SectorInfo pflash_sector_info(PFlashCFI02 *pfl, hwaddr offset) 289 { 290 assert(offset < pfl->chip_len); 291 hwaddr addr = 0; 292 uint32_t sector_num = 0; 293 for (int i = 0; i < pflash_regions_count(pfl); ++i) { 294 uint64_t region_size = (uint64_t)pfl->nb_blocs[i] * pfl->sector_len[i]; 295 if (addr <= offset && offset < addr + region_size) { 296 return (SectorInfo) { 297 .len = pfl->sector_len[i], 298 .num = sector_num + (offset - addr) / pfl->sector_len[i], 299 }; 300 } 301 sector_num += pfl->nb_blocs[i]; 302 addr += region_size; 303 } 304 abort(); 305 } 306 307 /* 308 * Returns true if the offset refers to a flash sector that is currently being 309 * erased. 310 */ 311 static bool pflash_sector_is_erasing(PFlashCFI02 *pfl, hwaddr offset) 312 { 313 long sector_num = pflash_sector_info(pfl, offset).num; 314 return test_bit(sector_num, pfl->sector_erase_map); 315 } 316 317 static uint64_t pflash_read(void *opaque, hwaddr offset, unsigned int width) 318 { 319 PFlashCFI02 *pfl = opaque; 320 hwaddr boff; 321 uint64_t ret; 322 323 /* Lazy reset to ROMD mode after a certain amount of read accesses */ 324 if (!pfl->rom_mode && pfl->wcycle == 0 && 325 ++pfl->read_counter > PFLASH_LAZY_ROMD_THRESHOLD) { 326 pflash_mode_read_array(pfl); 327 } 328 offset &= pfl->chip_len - 1; 329 boff = offset & 0xFF; 330 if (pfl->width == 2) { 331 boff = boff >> 1; 332 } else if (pfl->width == 4) { 333 boff = boff >> 2; 334 } 335 switch (pfl->cmd) { 336 default: 337 /* This should never happen : reset state & treat it as a read*/ 338 DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd); 339 pflash_reset_state_machine(pfl); 340 /* fall through to the read code */ 341 case 0x80: /* Erase (unlock) */ 342 /* We accept reads during second unlock sequence... */ 343 case 0x00: 344 if (pflash_erase_suspend_mode(pfl) && 345 pflash_sector_is_erasing(pfl, offset)) { 346 /* Toggle bit 2, but not 6. */ 347 toggle_dq2(pfl); 348 /* Status register read */ 349 ret = pfl->status; 350 DPRINTF("%s: status %" PRIx64 "\n", __func__, ret); 351 break; 352 } 353 /* Flash area read */ 354 ret = pflash_data_read(pfl, offset, width); 355 break; 356 case 0x90: /* flash ID read */ 357 switch (boff) { 358 case 0x00: 359 case 0x01: 360 ret = boff & 0x01 ? pfl->ident1 : pfl->ident0; 361 break; 362 case 0x02: 363 ret = 0x00; /* Pretend all sectors are unprotected */ 364 break; 365 case 0x0E: 366 case 0x0F: 367 ret = boff & 0x01 ? pfl->ident3 : pfl->ident2; 368 if (ret != (uint8_t)-1) { 369 break; 370 } 371 /* Fall through to data read. */ 372 default: 373 ret = pflash_data_read(pfl, offset, width); 374 } 375 DPRINTF("%s: ID " TARGET_FMT_plx " %" PRIx64 "\n", __func__, boff, ret); 376 break; 377 case 0x10: /* Chip Erase */ 378 case 0x30: /* Sector Erase */ 379 /* Toggle bit 2 during erase, but not program. */ 380 toggle_dq2(pfl); 381 /* fall through */ 382 case 0xA0: /* Program */ 383 /* Toggle bit 6 */ 384 toggle_dq6(pfl); 385 /* Status register read */ 386 ret = pfl->status; 387 DPRINTF("%s: status %" PRIx64 "\n", __func__, ret); 388 break; 389 case 0x98: 390 /* CFI query mode */ 391 if (boff < sizeof(pfl->cfi_table)) { 392 ret = pfl->cfi_table[boff]; 393 } else { 394 ret = 0; 395 } 396 break; 397 } 398 trace_pflash_io_read(offset, width, ret, pfl->cmd, pfl->wcycle); 399 400 return ret; 401 } 402 403 /* update flash content on disk */ 404 static void pflash_update(PFlashCFI02 *pfl, int offset, int size) 405 { 406 int offset_end; 407 int ret; 408 if (pfl->blk) { 409 offset_end = offset + size; 410 /* widen to sector boundaries */ 411 offset = QEMU_ALIGN_DOWN(offset, BDRV_SECTOR_SIZE); 412 offset_end = QEMU_ALIGN_UP(offset_end, BDRV_SECTOR_SIZE); 413 ret = blk_pwrite(pfl->blk, offset, pfl->storage + offset, 414 offset_end - offset, 0); 415 if (ret < 0) { 416 /* TODO set error bit in status */ 417 error_report("Could not update PFLASH: %s", strerror(-ret)); 418 } 419 } 420 } 421 422 static void pflash_sector_erase(PFlashCFI02 *pfl, hwaddr offset) 423 { 424 SectorInfo sector_info = pflash_sector_info(pfl, offset); 425 uint64_t sector_len = sector_info.len; 426 offset &= ~(sector_len - 1); 427 DPRINTF("%s: start sector erase at %0*" PRIx64 "-%0*" PRIx64 "\n", 428 __func__, pfl->width * 2, offset, 429 pfl->width * 2, offset + sector_len - 1); 430 if (!pfl->ro) { 431 uint8_t *p = pfl->storage; 432 memset(p + offset, 0xff, sector_len); 433 pflash_update(pfl, offset, sector_len); 434 } 435 set_dq7(pfl, 0x00); 436 ++pfl->sectors_to_erase; 437 set_bit(sector_info.num, pfl->sector_erase_map); 438 /* Set (or reset) the 50 us timer for additional erase commands. */ 439 timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 50000); 440 } 441 442 static void pflash_write(void *opaque, hwaddr offset, uint64_t value, 443 unsigned int width) 444 { 445 PFlashCFI02 *pfl = opaque; 446 hwaddr boff; 447 uint8_t *p; 448 uint8_t cmd; 449 450 trace_pflash_io_write(offset, width, value, pfl->wcycle); 451 cmd = value; 452 if (pfl->cmd != 0xA0) { 453 /* Reset does nothing during chip erase and sector erase. */ 454 if (cmd == 0xF0 && pfl->cmd != 0x10 && pfl->cmd != 0x30) { 455 if (pfl->wcycle == WCYCLE_AUTOSELECT_CFI) { 456 /* Return to autoselect mode. */ 457 pfl->wcycle = 3; 458 pfl->cmd = 0x90; 459 return; 460 } 461 goto reset_flash; 462 } 463 } 464 offset &= pfl->chip_len - 1; 465 466 boff = offset; 467 if (pfl->width == 2) { 468 boff = boff >> 1; 469 } else if (pfl->width == 4) { 470 boff = boff >> 2; 471 } 472 /* Only the least-significant 11 bits are used in most cases. */ 473 boff &= 0x7FF; 474 switch (pfl->wcycle) { 475 case 0: 476 /* Set the device in I/O access mode if required */ 477 if (pfl->rom_mode) { 478 pfl->rom_mode = false; 479 memory_region_rom_device_set_romd(&pfl->orig_mem, false); 480 } 481 pfl->read_counter = 0; 482 /* We're in read mode */ 483 check_unlock0: 484 if (boff == 0x55 && cmd == 0x98) { 485 /* Enter CFI query mode */ 486 pfl->wcycle = WCYCLE_CFI; 487 pfl->cmd = 0x98; 488 return; 489 } 490 /* Handle erase resume in erase suspend mode, otherwise reset. */ 491 if (cmd == 0x30) { /* Erase Resume */ 492 if (pflash_erase_suspend_mode(pfl)) { 493 /* Resume the erase. */ 494 timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 495 pfl->erase_time_remaining); 496 pfl->erase_time_remaining = 0; 497 pfl->wcycle = 6; 498 pfl->cmd = 0x30; 499 set_dq7(pfl, 0x00); 500 assert_dq3(pfl); 501 return; 502 } 503 goto reset_flash; 504 } 505 /* Ignore erase suspend. */ 506 if (cmd == 0xB0) { /* Erase Suspend */ 507 return; 508 } 509 if (boff != pfl->unlock_addr0 || cmd != 0xAA) { 510 DPRINTF("%s: unlock0 failed " TARGET_FMT_plx " %02x %04x\n", 511 __func__, boff, cmd, pfl->unlock_addr0); 512 goto reset_flash; 513 } 514 DPRINTF("%s: unlock sequence started\n", __func__); 515 break; 516 case 1: 517 /* We started an unlock sequence */ 518 check_unlock1: 519 if (boff != pfl->unlock_addr1 || cmd != 0x55) { 520 DPRINTF("%s: unlock1 failed " TARGET_FMT_plx " %02x\n", __func__, 521 boff, cmd); 522 goto reset_flash; 523 } 524 DPRINTF("%s: unlock sequence done\n", __func__); 525 break; 526 case 2: 527 /* We finished an unlock sequence */ 528 if (!pfl->bypass && boff != pfl->unlock_addr0) { 529 DPRINTF("%s: command failed " TARGET_FMT_plx " %02x\n", __func__, 530 boff, cmd); 531 goto reset_flash; 532 } 533 switch (cmd) { 534 case 0x20: 535 pfl->bypass = 1; 536 goto do_bypass; 537 case 0x80: /* Erase */ 538 case 0x90: /* Autoselect */ 539 case 0xA0: /* Program */ 540 pfl->cmd = cmd; 541 DPRINTF("%s: starting command %02x\n", __func__, cmd); 542 break; 543 default: 544 DPRINTF("%s: unknown command %02x\n", __func__, cmd); 545 goto reset_flash; 546 } 547 break; 548 case 3: 549 switch (pfl->cmd) { 550 case 0x80: /* Erase */ 551 /* We need another unlock sequence */ 552 goto check_unlock0; 553 case 0xA0: /* Program */ 554 if (pflash_erase_suspend_mode(pfl) && 555 pflash_sector_is_erasing(pfl, offset)) { 556 /* Ignore writes to erasing sectors. */ 557 if (pfl->bypass) { 558 goto do_bypass; 559 } 560 goto reset_flash; 561 } 562 trace_pflash_data_write(offset, width, value, 0); 563 if (!pfl->ro) { 564 p = (uint8_t *)pfl->storage + offset; 565 if (pfl->be) { 566 uint64_t current = ldn_be_p(p, width); 567 stn_be_p(p, width, current & value); 568 } else { 569 uint64_t current = ldn_le_p(p, width); 570 stn_le_p(p, width, current & value); 571 } 572 pflash_update(pfl, offset, width); 573 } 574 /* 575 * While programming, status bit DQ7 should hold the opposite 576 * value from how it was programmed. 577 */ 578 set_dq7(pfl, ~value); 579 /* Let's pretend write is immediate */ 580 if (pfl->bypass) 581 goto do_bypass; 582 goto reset_flash; 583 case 0x90: /* Autoselect */ 584 if (pfl->bypass && cmd == 0x00) { 585 /* Unlock bypass reset */ 586 goto reset_flash; 587 } 588 /* 589 * We can enter CFI query mode from autoselect mode, but we must 590 * return to autoselect mode after a reset. 591 */ 592 if (boff == 0x55 && cmd == 0x98) { 593 /* Enter autoselect CFI query mode */ 594 pfl->wcycle = WCYCLE_AUTOSELECT_CFI; 595 pfl->cmd = 0x98; 596 return; 597 } 598 /* fall through */ 599 default: 600 DPRINTF("%s: invalid write for command %02x\n", 601 __func__, pfl->cmd); 602 goto reset_flash; 603 } 604 case 4: 605 switch (pfl->cmd) { 606 case 0xA0: /* Program */ 607 /* Ignore writes while flash data write is occurring */ 608 /* As we suppose write is immediate, this should never happen */ 609 return; 610 case 0x80: /* Erase */ 611 goto check_unlock1; 612 default: 613 /* Should never happen */ 614 DPRINTF("%s: invalid command state %02x (wc 4)\n", 615 __func__, pfl->cmd); 616 goto reset_flash; 617 } 618 break; 619 case 5: 620 if (pflash_erase_suspend_mode(pfl)) { 621 /* Erasing is not supported in erase suspend mode. */ 622 goto reset_flash; 623 } 624 switch (cmd) { 625 case 0x10: /* Chip Erase */ 626 if (boff != pfl->unlock_addr0) { 627 DPRINTF("%s: chip erase: invalid address " TARGET_FMT_plx "\n", 628 __func__, offset); 629 goto reset_flash; 630 } 631 /* Chip erase */ 632 DPRINTF("%s: start chip erase\n", __func__); 633 if (!pfl->ro) { 634 memset(pfl->storage, 0xff, pfl->chip_len); 635 pflash_update(pfl, 0, pfl->chip_len); 636 } 637 set_dq7(pfl, 0x00); 638 /* Wait the time specified at CFI address 0x22. */ 639 timer_mod(&pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 640 (1ULL << pfl->cfi_table[0x22]) * SCALE_MS); 641 break; 642 case 0x30: /* Sector erase */ 643 pflash_sector_erase(pfl, offset); 644 break; 645 default: 646 DPRINTF("%s: invalid command %02x (wc 5)\n", __func__, cmd); 647 goto reset_flash; 648 } 649 pfl->cmd = cmd; 650 break; 651 case 6: 652 switch (pfl->cmd) { 653 case 0x10: /* Chip Erase */ 654 /* Ignore writes during chip erase */ 655 return; 656 case 0x30: /* Sector erase */ 657 if (cmd == 0xB0) { 658 /* 659 * If erase suspend happens during the erase timeout (so DQ3 is 660 * 0), then the device suspends erasing immediately. Set the 661 * remaining time to be the total time to erase. Otherwise, 662 * there is a maximum amount of time it can take to enter 663 * suspend mode. Let's ignore that and suspend immediately and 664 * set the remaining time to the actual time remaining on the 665 * timer. 666 */ 667 if ((pfl->status & 0x08) == 0) { 668 pfl->erase_time_remaining = pflash_erase_time(pfl); 669 } else { 670 int64_t delta = timer_expire_time_ns(&pfl->timer) - 671 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 672 /* Make sure we have a positive time remaining. */ 673 pfl->erase_time_remaining = delta <= 0 ? 1 : delta; 674 } 675 reset_dq3(pfl); 676 timer_del(&pfl->timer); 677 pflash_reset_state_machine(pfl); 678 return; 679 } 680 /* 681 * If DQ3 is 0, additional sector erase commands can be 682 * written and anything else (other than an erase suspend) resets 683 * the device. 684 */ 685 if ((pfl->status & 0x08) == 0) { 686 if (cmd == 0x30) { 687 pflash_sector_erase(pfl, offset); 688 } else { 689 goto reset_flash; 690 } 691 } 692 /* Ignore writes during the actual erase. */ 693 return; 694 default: 695 /* Should never happen */ 696 DPRINTF("%s: invalid command state %02x (wc 6)\n", 697 __func__, pfl->cmd); 698 goto reset_flash; 699 } 700 break; 701 /* Special values for CFI queries */ 702 case WCYCLE_CFI: 703 case WCYCLE_AUTOSELECT_CFI: 704 DPRINTF("%s: invalid write in CFI query mode\n", __func__); 705 goto reset_flash; 706 default: 707 /* Should never happen */ 708 DPRINTF("%s: invalid write state (wc 7)\n", __func__); 709 goto reset_flash; 710 } 711 pfl->wcycle++; 712 713 return; 714 715 /* Reset flash */ 716 reset_flash: 717 pfl->bypass = 0; 718 pflash_reset_state_machine(pfl); 719 return; 720 721 do_bypass: 722 pfl->wcycle = 2; 723 pfl->cmd = 0; 724 } 725 726 static const MemoryRegionOps pflash_cfi02_ops = { 727 .read = pflash_read, 728 .write = pflash_write, 729 .valid.min_access_size = 1, 730 .valid.max_access_size = 4, 731 .endianness = DEVICE_NATIVE_ENDIAN, 732 }; 733 734 static void pflash_cfi02_fill_cfi_table(PFlashCFI02 *pfl, int nb_regions) 735 { 736 /* Hardcoded CFI table (mostly from SG29 Spansion flash) */ 737 const uint16_t pri_ofs = 0x40; 738 /* Standard "QRY" string */ 739 pfl->cfi_table[0x10] = 'Q'; 740 pfl->cfi_table[0x11] = 'R'; 741 pfl->cfi_table[0x12] = 'Y'; 742 /* Command set (AMD/Fujitsu) */ 743 pfl->cfi_table[0x13] = 0x02; 744 pfl->cfi_table[0x14] = 0x00; 745 /* Primary extended table address */ 746 pfl->cfi_table[0x15] = pri_ofs; 747 pfl->cfi_table[0x16] = pri_ofs >> 8; 748 /* Alternate command set (none) */ 749 pfl->cfi_table[0x17] = 0x00; 750 pfl->cfi_table[0x18] = 0x00; 751 /* Alternate extended table (none) */ 752 pfl->cfi_table[0x19] = 0x00; 753 pfl->cfi_table[0x1A] = 0x00; 754 /* Vcc min */ 755 pfl->cfi_table[0x1B] = 0x27; 756 /* Vcc max */ 757 pfl->cfi_table[0x1C] = 0x36; 758 /* Vpp min (no Vpp pin) */ 759 pfl->cfi_table[0x1D] = 0x00; 760 /* Vpp max (no Vpp pin) */ 761 pfl->cfi_table[0x1E] = 0x00; 762 /* Timeout per single byte/word write (128 ms) */ 763 pfl->cfi_table[0x1F] = 0x07; 764 /* Timeout for min size buffer write (NA) */ 765 pfl->cfi_table[0x20] = 0x00; 766 /* Typical timeout for block erase (512 ms) */ 767 pfl->cfi_table[0x21] = 0x09; 768 /* Typical timeout for full chip erase (4096 ms) */ 769 pfl->cfi_table[0x22] = 0x0C; 770 /* Reserved */ 771 pfl->cfi_table[0x23] = 0x01; 772 /* Max timeout for buffer write (NA) */ 773 pfl->cfi_table[0x24] = 0x00; 774 /* Max timeout for block erase */ 775 pfl->cfi_table[0x25] = 0x0A; 776 /* Max timeout for chip erase */ 777 pfl->cfi_table[0x26] = 0x0D; 778 /* Device size */ 779 pfl->cfi_table[0x27] = ctz32(pfl->chip_len); 780 /* Flash device interface (8 & 16 bits) */ 781 pfl->cfi_table[0x28] = 0x02; 782 pfl->cfi_table[0x29] = 0x00; 783 /* Max number of bytes in multi-bytes write */ 784 /* 785 * XXX: disable buffered write as it's not supported 786 * pfl->cfi_table[0x2A] = 0x05; 787 */ 788 pfl->cfi_table[0x2A] = 0x00; 789 pfl->cfi_table[0x2B] = 0x00; 790 /* Number of erase block regions */ 791 pfl->cfi_table[0x2c] = nb_regions; 792 /* Erase block regions */ 793 for (int i = 0; i < nb_regions; ++i) { 794 uint32_t sector_len_per_device = pfl->sector_len[i]; 795 pfl->cfi_table[0x2d + 4 * i] = pfl->nb_blocs[i] - 1; 796 pfl->cfi_table[0x2e + 4 * i] = (pfl->nb_blocs[i] - 1) >> 8; 797 pfl->cfi_table[0x2f + 4 * i] = sector_len_per_device >> 8; 798 pfl->cfi_table[0x30 + 4 * i] = sector_len_per_device >> 16; 799 } 800 assert(0x2c + 4 * nb_regions < pri_ofs); 801 802 /* Extended */ 803 pfl->cfi_table[0x00 + pri_ofs] = 'P'; 804 pfl->cfi_table[0x01 + pri_ofs] = 'R'; 805 pfl->cfi_table[0x02 + pri_ofs] = 'I'; 806 807 /* Extended version 1.0 */ 808 pfl->cfi_table[0x03 + pri_ofs] = '1'; 809 pfl->cfi_table[0x04 + pri_ofs] = '0'; 810 811 /* Address sensitive unlock required. */ 812 pfl->cfi_table[0x05 + pri_ofs] = 0x00; 813 /* Erase suspend to read/write. */ 814 pfl->cfi_table[0x06 + pri_ofs] = 0x02; 815 /* Sector protect not supported. */ 816 pfl->cfi_table[0x07 + pri_ofs] = 0x00; 817 /* Temporary sector unprotect not supported. */ 818 pfl->cfi_table[0x08 + pri_ofs] = 0x00; 819 820 /* Sector protect/unprotect scheme. */ 821 pfl->cfi_table[0x09 + pri_ofs] = 0x00; 822 823 /* Simultaneous operation not supported. */ 824 pfl->cfi_table[0x0a + pri_ofs] = 0x00; 825 /* Burst mode not supported. */ 826 pfl->cfi_table[0x0b + pri_ofs] = 0x00; 827 /* Page mode not supported. */ 828 pfl->cfi_table[0x0c + pri_ofs] = 0x00; 829 assert(0x0c + pri_ofs < ARRAY_SIZE(pfl->cfi_table)); 830 } 831 832 static void pflash_cfi02_realize(DeviceState *dev, Error **errp) 833 { 834 ERRP_GUARD(); 835 PFlashCFI02 *pfl = PFLASH_CFI02(dev); 836 int ret; 837 838 if (pfl->uniform_sector_len == 0 && pfl->sector_len[0] == 0) { 839 error_setg(errp, "attribute \"sector-length\" not specified or zero."); 840 return; 841 } 842 if (pfl->uniform_nb_blocs == 0 && pfl->nb_blocs[0] == 0) { 843 error_setg(errp, "attribute \"num-blocks\" not specified or zero."); 844 return; 845 } 846 if (pfl->name == NULL) { 847 error_setg(errp, "attribute \"name\" not specified."); 848 return; 849 } 850 851 int nb_regions; 852 pfl->chip_len = 0; 853 pfl->total_sectors = 0; 854 for (nb_regions = 0; nb_regions < PFLASH_MAX_ERASE_REGIONS; ++nb_regions) { 855 if (pfl->nb_blocs[nb_regions] == 0) { 856 break; 857 } 858 pfl->total_sectors += pfl->nb_blocs[nb_regions]; 859 uint64_t sector_len_per_device = pfl->sector_len[nb_regions]; 860 861 /* 862 * The size of each flash sector must be a power of 2 and it must be 863 * aligned at the same power of 2. 864 */ 865 if (sector_len_per_device & 0xff || 866 sector_len_per_device >= (1 << 24) || 867 !is_power_of_2(sector_len_per_device)) 868 { 869 error_setg(errp, "unsupported configuration: " 870 "sector length[%d] per device = %" PRIx64 ".", 871 nb_regions, sector_len_per_device); 872 return; 873 } 874 if (pfl->chip_len & (sector_len_per_device - 1)) { 875 error_setg(errp, "unsupported configuration: " 876 "flash region %d not correctly aligned.", 877 nb_regions); 878 return; 879 } 880 881 pfl->chip_len += (uint64_t)pfl->sector_len[nb_regions] * 882 pfl->nb_blocs[nb_regions]; 883 } 884 885 uint64_t uniform_len = (uint64_t)pfl->uniform_nb_blocs * 886 pfl->uniform_sector_len; 887 if (nb_regions == 0) { 888 nb_regions = 1; 889 pfl->nb_blocs[0] = pfl->uniform_nb_blocs; 890 pfl->sector_len[0] = pfl->uniform_sector_len; 891 pfl->chip_len = uniform_len; 892 pfl->total_sectors = pfl->uniform_nb_blocs; 893 } else if (uniform_len != 0 && uniform_len != pfl->chip_len) { 894 error_setg(errp, "\"num-blocks\"*\"sector-length\" " 895 "different from \"num-blocks0\"*\'sector-length0\" + ... + " 896 "\"num-blocks3\"*\"sector-length3\""); 897 return; 898 } 899 900 memory_region_init_rom_device(&pfl->orig_mem, OBJECT(pfl), 901 &pflash_cfi02_ops, pfl, pfl->name, 902 pfl->chip_len, errp); 903 if (*errp) { 904 return; 905 } 906 907 pfl->storage = memory_region_get_ram_ptr(&pfl->orig_mem); 908 909 if (pfl->blk) { 910 uint64_t perm; 911 pfl->ro = !blk_supports_write_perm(pfl->blk); 912 perm = BLK_PERM_CONSISTENT_READ | (pfl->ro ? 0 : BLK_PERM_WRITE); 913 ret = blk_set_perm(pfl->blk, perm, BLK_PERM_ALL, errp); 914 if (ret < 0) { 915 return; 916 } 917 } else { 918 pfl->ro = 0; 919 } 920 921 if (pfl->blk) { 922 if (!blk_check_size_and_read_all(pfl->blk, pfl->storage, 923 pfl->chip_len, errp)) { 924 vmstate_unregister_ram(&pfl->orig_mem, DEVICE(pfl)); 925 return; 926 } 927 } 928 929 /* Only 11 bits are used in the comparison. */ 930 pfl->unlock_addr0 &= 0x7FF; 931 pfl->unlock_addr1 &= 0x7FF; 932 933 /* Allocate memory for a bitmap for sectors being erased. */ 934 pfl->sector_erase_map = bitmap_new(pfl->total_sectors); 935 936 pflash_setup_mappings(pfl); 937 sysbus_init_mmio(SYS_BUS_DEVICE(dev), &pfl->mem); 938 939 timer_init_ns(&pfl->timer, QEMU_CLOCK_VIRTUAL, pflash_timer, pfl); 940 pfl->status = 0; 941 942 pflash_cfi02_fill_cfi_table(pfl, nb_regions); 943 } 944 945 static void pflash_cfi02_reset(DeviceState *dev) 946 { 947 PFlashCFI02 *pfl = PFLASH_CFI02(dev); 948 949 pflash_reset_state_machine(pfl); 950 } 951 952 static Property pflash_cfi02_properties[] = { 953 DEFINE_PROP_DRIVE("drive", PFlashCFI02, blk), 954 DEFINE_PROP_UINT32("num-blocks", PFlashCFI02, uniform_nb_blocs, 0), 955 DEFINE_PROP_UINT32("sector-length", PFlashCFI02, uniform_sector_len, 0), 956 DEFINE_PROP_UINT32("num-blocks0", PFlashCFI02, nb_blocs[0], 0), 957 DEFINE_PROP_UINT32("sector-length0", PFlashCFI02, sector_len[0], 0), 958 DEFINE_PROP_UINT32("num-blocks1", PFlashCFI02, nb_blocs[1], 0), 959 DEFINE_PROP_UINT32("sector-length1", PFlashCFI02, sector_len[1], 0), 960 DEFINE_PROP_UINT32("num-blocks2", PFlashCFI02, nb_blocs[2], 0), 961 DEFINE_PROP_UINT32("sector-length2", PFlashCFI02, sector_len[2], 0), 962 DEFINE_PROP_UINT32("num-blocks3", PFlashCFI02, nb_blocs[3], 0), 963 DEFINE_PROP_UINT32("sector-length3", PFlashCFI02, sector_len[3], 0), 964 DEFINE_PROP_UINT8("width", PFlashCFI02, width, 0), 965 DEFINE_PROP_UINT8("mappings", PFlashCFI02, mappings, 0), 966 DEFINE_PROP_UINT8("big-endian", PFlashCFI02, be, 0), 967 DEFINE_PROP_UINT16("id0", PFlashCFI02, ident0, 0), 968 DEFINE_PROP_UINT16("id1", PFlashCFI02, ident1, 0), 969 DEFINE_PROP_UINT16("id2", PFlashCFI02, ident2, 0), 970 DEFINE_PROP_UINT16("id3", PFlashCFI02, ident3, 0), 971 DEFINE_PROP_UINT16("unlock-addr0", PFlashCFI02, unlock_addr0, 0), 972 DEFINE_PROP_UINT16("unlock-addr1", PFlashCFI02, unlock_addr1, 0), 973 DEFINE_PROP_STRING("name", PFlashCFI02, name), 974 DEFINE_PROP_END_OF_LIST(), 975 }; 976 977 static void pflash_cfi02_unrealize(DeviceState *dev) 978 { 979 PFlashCFI02 *pfl = PFLASH_CFI02(dev); 980 timer_del(&pfl->timer); 981 g_free(pfl->sector_erase_map); 982 } 983 984 static void pflash_cfi02_class_init(ObjectClass *klass, void *data) 985 { 986 DeviceClass *dc = DEVICE_CLASS(klass); 987 988 dc->realize = pflash_cfi02_realize; 989 dc->reset = pflash_cfi02_reset; 990 dc->unrealize = pflash_cfi02_unrealize; 991 device_class_set_props(dc, pflash_cfi02_properties); 992 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 993 } 994 995 static const TypeInfo pflash_cfi02_info = { 996 .name = TYPE_PFLASH_CFI02, 997 .parent = TYPE_SYS_BUS_DEVICE, 998 .instance_size = sizeof(PFlashCFI02), 999 .class_init = pflash_cfi02_class_init, 1000 }; 1001 1002 static void pflash_cfi02_register_types(void) 1003 { 1004 type_register_static(&pflash_cfi02_info); 1005 } 1006 1007 type_init(pflash_cfi02_register_types) 1008 1009 PFlashCFI02 *pflash_cfi02_register(hwaddr base, 1010 const char *name, 1011 hwaddr size, 1012 BlockBackend *blk, 1013 uint32_t sector_len, 1014 int nb_mappings, int width, 1015 uint16_t id0, uint16_t id1, 1016 uint16_t id2, uint16_t id3, 1017 uint16_t unlock_addr0, 1018 uint16_t unlock_addr1, 1019 int be) 1020 { 1021 DeviceState *dev = qdev_new(TYPE_PFLASH_CFI02); 1022 1023 if (blk) { 1024 qdev_prop_set_drive(dev, "drive", blk); 1025 } 1026 assert(QEMU_IS_ALIGNED(size, sector_len)); 1027 qdev_prop_set_uint32(dev, "num-blocks", size / sector_len); 1028 qdev_prop_set_uint32(dev, "sector-length", sector_len); 1029 qdev_prop_set_uint8(dev, "width", width); 1030 qdev_prop_set_uint8(dev, "mappings", nb_mappings); 1031 qdev_prop_set_uint8(dev, "big-endian", !!be); 1032 qdev_prop_set_uint16(dev, "id0", id0); 1033 qdev_prop_set_uint16(dev, "id1", id1); 1034 qdev_prop_set_uint16(dev, "id2", id2); 1035 qdev_prop_set_uint16(dev, "id3", id3); 1036 qdev_prop_set_uint16(dev, "unlock-addr0", unlock_addr0); 1037 qdev_prop_set_uint16(dev, "unlock-addr1", unlock_addr1); 1038 qdev_prop_set_string(dev, "name", name); 1039 sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal); 1040 1041 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base); 1042 return PFLASH_CFI02(dev); 1043 } 1044