qemu/hw/block/pflash_cfi02.c
<<
>>
Prefs
   1/*
   2 *  CFI parallel flash with AMD command set emulation
   3 *
   4 *  Copyright (c) 2005 Jocelyn Mayer
   5 *
   6 * This library is free software; you can redistribute it and/or
   7 * modify it under the terms of the GNU Lesser General Public
   8 * License as published by the Free Software Foundation; either
   9 * version 2 of the License, or (at your option) any later version.
  10 *
  11 * This library is distributed in the hope that it will be useful,
  12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14 * Lesser General Public License for more details.
  15 *
  16 * You should have received a copy of the GNU Lesser General Public
  17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20/*
  21 * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
  22 * Supported commands/modes are:
  23 * - flash read
  24 * - flash write
  25 * - flash ID read
  26 * - sector erase
  27 * - chip erase
  28 * - unlock bypass command
  29 * - CFI queries
  30 *
  31 * It does not support flash interleaving.
  32 * It does not implement boot blocs with reduced size
  33 * It does not implement software data protection as found in many real chips
  34 * It does not implement erase suspend/resume commands
  35 * It does not implement multiple sectors erase
  36 */
  37
  38#include "qemu/osdep.h"
  39#include "hw/hw.h"
  40#include "hw/block/flash.h"
  41#include "qapi/error.h"
  42#include "qemu/timer.h"
  43#include "sysemu/block-backend.h"
  44#include "exec/address-spaces.h"
  45#include "qemu/host-utils.h"
  46#include "hw/sysbus.h"
  47
  48//#define PFLASH_DEBUG
  49#ifdef PFLASH_DEBUG
  50#define DPRINTF(fmt, ...)                                  \
  51do {                                                       \
  52    fprintf(stderr, "PFLASH: " fmt , ## __VA_ARGS__);       \
  53} while (0)
  54#else
  55#define DPRINTF(fmt, ...) do { } while (0)
  56#endif
  57
  58#define PFLASH_LAZY_ROMD_THRESHOLD 42
  59
  60#define CFI_PFLASH02(obj) OBJECT_CHECK(pflash_t, (obj), TYPE_CFI_PFLASH02)
  61
  62struct pflash_t {
  63    /*< private >*/
  64    SysBusDevice parent_obj;
  65    /*< public >*/
  66
  67    BlockBackend *blk;
  68    uint32_t sector_len;
  69    uint32_t nb_blocs;
  70    uint32_t chip_len;
  71    uint8_t mappings;
  72    uint8_t width;
  73    uint8_t be;
  74    int wcycle; /* if 0, the flash is read normally */
  75    int bypass;
  76    int ro;
  77    uint8_t cmd;
  78    uint8_t status;
  79    /* FIXME: implement array device properties */
  80    uint16_t ident0;
  81    uint16_t ident1;
  82    uint16_t ident2;
  83    uint16_t ident3;
  84    uint16_t unlock_addr0;
  85    uint16_t unlock_addr1;
  86    uint8_t cfi_len;
  87    uint8_t cfi_table[0x52];
  88    QEMUTimer *timer;
  89    /* The device replicates the flash memory across its memory space.  Emulate
  90     * that by having a container (.mem) filled with an array of aliases
  91     * (.mem_mappings) pointing to the flash memory (.orig_mem).
  92     */
  93    MemoryRegion mem;
  94    MemoryRegion *mem_mappings;    /* array; one per mapping */
  95    MemoryRegion orig_mem;
  96    int rom_mode;
  97    int read_counter; /* used for lazy switch-back to rom mode */
  98    char *name;
  99    void *storage;
 100};
 101
 102/*
 103 * Set up replicated mappings of the same region.
 104 */
 105static void pflash_setup_mappings(pflash_t *pfl)
 106{
 107    unsigned i;
 108    hwaddr size = memory_region_size(&pfl->orig_mem);
 109
 110    memory_region_init(&pfl->mem, OBJECT(pfl), "pflash", pfl->mappings * size);
 111    pfl->mem_mappings = g_new(MemoryRegion, pfl->mappings);
 112    for (i = 0; i < pfl->mappings; ++i) {
 113        memory_region_init_alias(&pfl->mem_mappings[i], OBJECT(pfl),
 114                                 "pflash-alias", &pfl->orig_mem, 0, size);
 115        memory_region_add_subregion(&pfl->mem, i * size, &pfl->mem_mappings[i]);
 116    }
 117}
 118
 119static void pflash_register_memory(pflash_t *pfl, int rom_mode)
 120{
 121    memory_region_rom_device_set_romd(&pfl->orig_mem, rom_mode);
 122    pfl->rom_mode = rom_mode;
 123}
 124
 125static void pflash_timer (void *opaque)
 126{
 127    pflash_t *pfl = opaque;
 128
 129    DPRINTF("%s: command %02x done\n", __func__, pfl->cmd);
 130    /* Reset flash */
 131    pfl->status ^= 0x80;
 132    if (pfl->bypass) {
 133        pfl->wcycle = 2;
 134    } else {
 135        pflash_register_memory(pfl, 1);
 136        pfl->wcycle = 0;
 137    }
 138    pfl->cmd = 0;
 139}
 140
 141static uint32_t pflash_read (pflash_t *pfl, hwaddr offset,
 142                             int width, int be)
 143{
 144    hwaddr boff;
 145    uint32_t ret;
 146    uint8_t *p;
 147
 148    DPRINTF("%s: offset " TARGET_FMT_plx "\n", __func__, offset);
 149    ret = -1;
 150    /* Lazy reset to ROMD mode after a certain amount of read accesses */
 151    if (!pfl->rom_mode && pfl->wcycle == 0 &&
 152        ++pfl->read_counter > PFLASH_LAZY_ROMD_THRESHOLD) {
 153        pflash_register_memory(pfl, 1);
 154    }
 155    offset &= pfl->chip_len - 1;
 156    boff = offset & 0xFF;
 157    if (pfl->width == 2)
 158        boff = boff >> 1;
 159    else if (pfl->width == 4)
 160        boff = boff >> 2;
 161    switch (pfl->cmd) {
 162    default:
 163        /* This should never happen : reset state & treat it as a read*/
 164        DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);
 165        pfl->wcycle = 0;
 166        pfl->cmd = 0;
 167        /* fall through to the read code */
 168    case 0x80:
 169        /* We accept reads during second unlock sequence... */
 170    case 0x00:
 171    flash_read:
 172        /* Flash area read */
 173        p = pfl->storage;
 174        switch (width) {
 175        case 1:
 176            ret = p[offset];
 177//            DPRINTF("%s: data offset %08x %02x\n", __func__, offset, ret);
 178            break;
 179        case 2:
 180            if (be) {
 181                ret = p[offset] << 8;
 182                ret |= p[offset + 1];
 183            } else {
 184                ret = p[offset];
 185                ret |= p[offset + 1] << 8;
 186            }
 187//            DPRINTF("%s: data offset %08x %04x\n", __func__, offset, ret);
 188            break;
 189        case 4:
 190            if (be) {
 191                ret = p[offset] << 24;
 192                ret |= p[offset + 1] << 16;
 193                ret |= p[offset + 2] << 8;
 194                ret |= p[offset + 3];
 195            } else {
 196                ret = p[offset];
 197                ret |= p[offset + 1] << 8;
 198                ret |= p[offset + 2] << 16;
 199                ret |= p[offset + 3] << 24;
 200            }
 201//            DPRINTF("%s: data offset %08x %08x\n", __func__, offset, ret);
 202            break;
 203        }
 204        break;
 205    case 0x90:
 206        /* flash ID read */
 207        switch (boff) {
 208        case 0x00:
 209        case 0x01:
 210            ret = boff & 0x01 ? pfl->ident1 : pfl->ident0;
 211            break;
 212        case 0x02:
 213            ret = 0x00; /* Pretend all sectors are unprotected */
 214            break;
 215        case 0x0E:
 216        case 0x0F:
 217            ret = boff & 0x01 ? pfl->ident3 : pfl->ident2;
 218            if (ret == (uint8_t)-1) {
 219                goto flash_read;
 220            }
 221            break;
 222        default:
 223            goto flash_read;
 224        }
 225        DPRINTF("%s: ID " TARGET_FMT_plx " %x\n", __func__, boff, ret);
 226        break;
 227    case 0xA0:
 228    case 0x10:
 229    case 0x30:
 230        /* Status register read */
 231        ret = pfl->status;
 232        DPRINTF("%s: status %x\n", __func__, ret);
 233        /* Toggle bit 6 */
 234        pfl->status ^= 0x40;
 235        break;
 236    case 0x98:
 237        /* CFI query mode */
 238        if (boff > pfl->cfi_len)
 239            ret = 0;
 240        else
 241            ret = pfl->cfi_table[boff];
 242        break;
 243    }
 244
 245    return ret;
 246}
 247
 248/* update flash content on disk */
 249static void pflash_update(pflash_t *pfl, int offset,
 250                          int size)
 251{
 252    int offset_end;
 253    if (pfl->blk) {
 254        offset_end = offset + size;
 255        /* widen to sector boundaries */
 256        offset = QEMU_ALIGN_DOWN(offset, BDRV_SECTOR_SIZE);
 257        offset_end = QEMU_ALIGN_UP(offset_end, BDRV_SECTOR_SIZE);
 258        blk_pwrite(pfl->blk, offset, pfl->storage + offset,
 259                   offset_end - offset, 0);
 260    }
 261}
 262
 263static void pflash_write (pflash_t *pfl, hwaddr offset,
 264                          uint32_t value, int width, int be)
 265{
 266    hwaddr boff;
 267    uint8_t *p;
 268    uint8_t cmd;
 269
 270    cmd = value;
 271    if (pfl->cmd != 0xA0 && cmd == 0xF0) {
 272#if 0
 273        DPRINTF("%s: flash reset asked (%02x %02x)\n",
 274                __func__, pfl->cmd, cmd);
 275#endif
 276        goto reset_flash;
 277    }
 278    DPRINTF("%s: offset " TARGET_FMT_plx " %08x %d %d\n", __func__,
 279            offset, value, width, pfl->wcycle);
 280    offset &= pfl->chip_len - 1;
 281
 282    DPRINTF("%s: offset " TARGET_FMT_plx " %08x %d\n", __func__,
 283            offset, value, width);
 284    boff = offset & (pfl->sector_len - 1);
 285    if (pfl->width == 2)
 286        boff = boff >> 1;
 287    else if (pfl->width == 4)
 288        boff = boff >> 2;
 289    switch (pfl->wcycle) {
 290    case 0:
 291        /* Set the device in I/O access mode if required */
 292        if (pfl->rom_mode)
 293            pflash_register_memory(pfl, 0);
 294        pfl->read_counter = 0;
 295        /* We're in read mode */
 296    check_unlock0:
 297        if (boff == 0x55 && cmd == 0x98) {
 298        enter_CFI_mode:
 299            /* Enter CFI query mode */
 300            pfl->wcycle = 7;
 301            pfl->cmd = 0x98;
 302            return;
 303        }
 304        if (boff != pfl->unlock_addr0 || cmd != 0xAA) {
 305            DPRINTF("%s: unlock0 failed " TARGET_FMT_plx " %02x %04x\n",
 306                    __func__, boff, cmd, pfl->unlock_addr0);
 307            goto reset_flash;
 308        }
 309        DPRINTF("%s: unlock sequence started\n", __func__);
 310        break;
 311    case 1:
 312        /* We started an unlock sequence */
 313    check_unlock1:
 314        if (boff != pfl->unlock_addr1 || cmd != 0x55) {
 315            DPRINTF("%s: unlock1 failed " TARGET_FMT_plx " %02x\n", __func__,
 316                    boff, cmd);
 317            goto reset_flash;
 318        }
 319        DPRINTF("%s: unlock sequence done\n", __func__);
 320        break;
 321    case 2:
 322        /* We finished an unlock sequence */
 323        if (!pfl->bypass && boff != pfl->unlock_addr0) {
 324            DPRINTF("%s: command failed " TARGET_FMT_plx " %02x\n", __func__,
 325                    boff, cmd);
 326            goto reset_flash;
 327        }
 328        switch (cmd) {
 329        case 0x20:
 330            pfl->bypass = 1;
 331            goto do_bypass;
 332        case 0x80:
 333        case 0x90:
 334        case 0xA0:
 335            pfl->cmd = cmd;
 336            DPRINTF("%s: starting command %02x\n", __func__, cmd);
 337            break;
 338        default:
 339            DPRINTF("%s: unknown command %02x\n", __func__, cmd);
 340            goto reset_flash;
 341        }
 342        break;
 343    case 3:
 344        switch (pfl->cmd) {
 345        case 0x80:
 346            /* We need another unlock sequence */
 347            goto check_unlock0;
 348        case 0xA0:
 349            DPRINTF("%s: write data offset " TARGET_FMT_plx " %08x %d\n",
 350                    __func__, offset, value, width);
 351            p = pfl->storage;
 352            if (!pfl->ro) {
 353                switch (width) {
 354                case 1:
 355                    p[offset] &= value;
 356                    pflash_update(pfl, offset, 1);
 357                    break;
 358                case 2:
 359                    if (be) {
 360                        p[offset] &= value >> 8;
 361                        p[offset + 1] &= value;
 362                    } else {
 363                        p[offset] &= value;
 364                        p[offset + 1] &= value >> 8;
 365                    }
 366                    pflash_update(pfl, offset, 2);
 367                    break;
 368                case 4:
 369                    if (be) {
 370                        p[offset] &= value >> 24;
 371                        p[offset + 1] &= value >> 16;
 372                        p[offset + 2] &= value >> 8;
 373                        p[offset + 3] &= value;
 374                    } else {
 375                        p[offset] &= value;
 376                        p[offset + 1] &= value >> 8;
 377                        p[offset + 2] &= value >> 16;
 378                        p[offset + 3] &= value >> 24;
 379                    }
 380                    pflash_update(pfl, offset, 4);
 381                    break;
 382                }
 383            }
 384            pfl->status = 0x00 | ~(value & 0x80);
 385            /* Let's pretend write is immediate */
 386            if (pfl->bypass)
 387                goto do_bypass;
 388            goto reset_flash;
 389        case 0x90:
 390            if (pfl->bypass && cmd == 0x00) {
 391                /* Unlock bypass reset */
 392                goto reset_flash;
 393            }
 394            /* We can enter CFI query mode from autoselect mode */
 395            if (boff == 0x55 && cmd == 0x98)
 396                goto enter_CFI_mode;
 397            /* No break here */
 398        default:
 399            DPRINTF("%s: invalid write for command %02x\n",
 400                    __func__, pfl->cmd);
 401            goto reset_flash;
 402        }
 403    case 4:
 404        switch (pfl->cmd) {
 405        case 0xA0:
 406            /* Ignore writes while flash data write is occurring */
 407            /* As we suppose write is immediate, this should never happen */
 408            return;
 409        case 0x80:
 410            goto check_unlock1;
 411        default:
 412            /* Should never happen */
 413            DPRINTF("%s: invalid command state %02x (wc 4)\n",
 414                    __func__, pfl->cmd);
 415            goto reset_flash;
 416        }
 417        break;
 418    case 5:
 419        switch (cmd) {
 420        case 0x10:
 421            if (boff != pfl->unlock_addr0) {
 422                DPRINTF("%s: chip erase: invalid address " TARGET_FMT_plx "\n",
 423                        __func__, offset);
 424                goto reset_flash;
 425            }
 426            /* Chip erase */
 427            DPRINTF("%s: start chip erase\n", __func__);
 428            if (!pfl->ro) {
 429                memset(pfl->storage, 0xFF, pfl->chip_len);
 430                pflash_update(pfl, 0, pfl->chip_len);
 431            }
 432            pfl->status = 0x00;
 433            /* Let's wait 5 seconds before chip erase is done */
 434            timer_mod(pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
 435                      (NANOSECONDS_PER_SECOND * 5));
 436            break;
 437        case 0x30:
 438            /* Sector erase */
 439            p = pfl->storage;
 440            offset &= ~(pfl->sector_len - 1);
 441            DPRINTF("%s: start sector erase at " TARGET_FMT_plx "\n", __func__,
 442                    offset);
 443            if (!pfl->ro) {
 444                memset(p + offset, 0xFF, pfl->sector_len);
 445                pflash_update(pfl, offset, pfl->sector_len);
 446            }
 447            pfl->status = 0x00;
 448            /* Let's wait 1/2 second before sector erase is done */
 449            timer_mod(pfl->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
 450                      (NANOSECONDS_PER_SECOND / 2));
 451            break;
 452        default:
 453            DPRINTF("%s: invalid command %02x (wc 5)\n", __func__, cmd);
 454            goto reset_flash;
 455        }
 456        pfl->cmd = cmd;
 457        break;
 458    case 6:
 459        switch (pfl->cmd) {
 460        case 0x10:
 461            /* Ignore writes during chip erase */
 462            return;
 463        case 0x30:
 464            /* Ignore writes during sector erase */
 465            return;
 466        default:
 467            /* Should never happen */
 468            DPRINTF("%s: invalid command state %02x (wc 6)\n",
 469                    __func__, pfl->cmd);
 470            goto reset_flash;
 471        }
 472        break;
 473    case 7: /* Special value for CFI queries */
 474        DPRINTF("%s: invalid write in CFI query mode\n", __func__);
 475        goto reset_flash;
 476    default:
 477        /* Should never happen */
 478        DPRINTF("%s: invalid write state (wc 7)\n",  __func__);
 479        goto reset_flash;
 480    }
 481    pfl->wcycle++;
 482
 483    return;
 484
 485    /* Reset flash */
 486 reset_flash:
 487    pfl->bypass = 0;
 488    pfl->wcycle = 0;
 489    pfl->cmd = 0;
 490    return;
 491
 492 do_bypass:
 493    pfl->wcycle = 2;
 494    pfl->cmd = 0;
 495}
 496
 497
 498static uint32_t pflash_readb_be(void *opaque, hwaddr addr)
 499{
 500    return pflash_read(opaque, addr, 1, 1);
 501}
 502
 503static uint32_t pflash_readb_le(void *opaque, hwaddr addr)
 504{
 505    return pflash_read(opaque, addr, 1, 0);
 506}
 507
 508static uint32_t pflash_readw_be(void *opaque, hwaddr addr)
 509{
 510    pflash_t *pfl = opaque;
 511
 512    return pflash_read(pfl, addr, 2, 1);
 513}
 514
 515static uint32_t pflash_readw_le(void *opaque, hwaddr addr)
 516{
 517    pflash_t *pfl = opaque;
 518
 519    return pflash_read(pfl, addr, 2, 0);
 520}
 521
 522static uint32_t pflash_readl_be(void *opaque, hwaddr addr)
 523{
 524    pflash_t *pfl = opaque;
 525
 526    return pflash_read(pfl, addr, 4, 1);
 527}
 528
 529static uint32_t pflash_readl_le(void *opaque, hwaddr addr)
 530{
 531    pflash_t *pfl = opaque;
 532
 533    return pflash_read(pfl, addr, 4, 0);
 534}
 535
 536static void pflash_writeb_be(void *opaque, hwaddr addr,
 537                             uint32_t value)
 538{
 539    pflash_write(opaque, addr, value, 1, 1);
 540}
 541
 542static void pflash_writeb_le(void *opaque, hwaddr addr,
 543                             uint32_t value)
 544{
 545    pflash_write(opaque, addr, value, 1, 0);
 546}
 547
 548static void pflash_writew_be(void *opaque, hwaddr addr,
 549                             uint32_t value)
 550{
 551    pflash_t *pfl = opaque;
 552
 553    pflash_write(pfl, addr, value, 2, 1);
 554}
 555
 556static void pflash_writew_le(void *opaque, hwaddr addr,
 557                             uint32_t value)
 558{
 559    pflash_t *pfl = opaque;
 560
 561    pflash_write(pfl, addr, value, 2, 0);
 562}
 563
 564static void pflash_writel_be(void *opaque, hwaddr addr,
 565                             uint32_t value)
 566{
 567    pflash_t *pfl = opaque;
 568
 569    pflash_write(pfl, addr, value, 4, 1);
 570}
 571
 572static void pflash_writel_le(void *opaque, hwaddr addr,
 573                             uint32_t value)
 574{
 575    pflash_t *pfl = opaque;
 576
 577    pflash_write(pfl, addr, value, 4, 0);
 578}
 579
 580static const MemoryRegionOps pflash_cfi02_ops_be = {
 581    .old_mmio = {
 582        .read = { pflash_readb_be, pflash_readw_be, pflash_readl_be, },
 583        .write = { pflash_writeb_be, pflash_writew_be, pflash_writel_be, },
 584    },
 585    .endianness = DEVICE_NATIVE_ENDIAN,
 586};
 587
 588static const MemoryRegionOps pflash_cfi02_ops_le = {
 589    .old_mmio = {
 590        .read = { pflash_readb_le, pflash_readw_le, pflash_readl_le, },
 591        .write = { pflash_writeb_le, pflash_writew_le, pflash_writel_le, },
 592    },
 593    .endianness = DEVICE_NATIVE_ENDIAN,
 594};
 595
 596static void pflash_cfi02_realize(DeviceState *dev, Error **errp)
 597{
 598    pflash_t *pfl = CFI_PFLASH02(dev);
 599    uint32_t chip_len;
 600    int ret;
 601    Error *local_err = NULL;
 602
 603    if (pfl->sector_len == 0) {
 604        error_setg(errp, "attribute \"sector-length\" not specified or zero.");
 605        return;
 606    }
 607    if (pfl->nb_blocs == 0) {
 608        error_setg(errp, "attribute \"num-blocks\" not specified or zero.");
 609        return;
 610    }
 611    if (pfl->name == NULL) {
 612        error_setg(errp, "attribute \"name\" not specified.");
 613        return;
 614    }
 615
 616    chip_len = pfl->sector_len * pfl->nb_blocs;
 617    /* XXX: to be fixed */
 618#if 0
 619    if (total_len != (8 * 1024 * 1024) && total_len != (16 * 1024 * 1024) &&
 620        total_len != (32 * 1024 * 1024) && total_len != (64 * 1024 * 1024))
 621        return NULL;
 622#endif
 623
 624    memory_region_init_rom_device(&pfl->orig_mem, OBJECT(pfl), pfl->be ?
 625                                  &pflash_cfi02_ops_be : &pflash_cfi02_ops_le,
 626                                  pfl, pfl->name, chip_len, &local_err);
 627    if (local_err) {
 628        error_propagate(errp, local_err);
 629        return;
 630    }
 631
 632    pfl->storage = memory_region_get_ram_ptr(&pfl->orig_mem);
 633    pfl->chip_len = chip_len;
 634
 635    if (pfl->blk) {
 636        uint64_t perm;
 637        pfl->ro = blk_is_read_only(pfl->blk);
 638        perm = BLK_PERM_CONSISTENT_READ | (pfl->ro ? 0 : BLK_PERM_WRITE);
 639        ret = blk_set_perm(pfl->blk, perm, BLK_PERM_ALL, errp);
 640        if (ret < 0) {
 641            return;
 642        }
 643    } else {
 644        pfl->ro = 0;
 645    }
 646
 647    if (pfl->blk) {
 648        /* read the initial flash content */
 649        ret = blk_pread(pfl->blk, 0, pfl->storage, chip_len);
 650        if (ret < 0) {
 651            vmstate_unregister_ram(&pfl->orig_mem, DEVICE(pfl));
 652            error_setg(errp, "failed to read the initial flash content");
 653            return;
 654        }
 655    }
 656
 657    pflash_setup_mappings(pfl);
 658    pfl->rom_mode = 1;
 659    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &pfl->mem);
 660
 661    pfl->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, pflash_timer, pfl);
 662    pfl->wcycle = 0;
 663    pfl->cmd = 0;
 664    pfl->status = 0;
 665    /* Hardcoded CFI table (mostly from SG29 Spansion flash) */
 666    pfl->cfi_len = 0x52;
 667    /* Standard "QRY" string */
 668    pfl->cfi_table[0x10] = 'Q';
 669    pfl->cfi_table[0x11] = 'R';
 670    pfl->cfi_table[0x12] = 'Y';
 671    /* Command set (AMD/Fujitsu) */
 672    pfl->cfi_table[0x13] = 0x02;
 673    pfl->cfi_table[0x14] = 0x00;
 674    /* Primary extended table address */
 675    pfl->cfi_table[0x15] = 0x31;
 676    pfl->cfi_table[0x16] = 0x00;
 677    /* Alternate command set (none) */
 678    pfl->cfi_table[0x17] = 0x00;
 679    pfl->cfi_table[0x18] = 0x00;
 680    /* Alternate extended table (none) */
 681    pfl->cfi_table[0x19] = 0x00;
 682    pfl->cfi_table[0x1A] = 0x00;
 683    /* Vcc min */
 684    pfl->cfi_table[0x1B] = 0x27;
 685    /* Vcc max */
 686    pfl->cfi_table[0x1C] = 0x36;
 687    /* Vpp min (no Vpp pin) */
 688    pfl->cfi_table[0x1D] = 0x00;
 689    /* Vpp max (no Vpp pin) */
 690    pfl->cfi_table[0x1E] = 0x00;
 691    /* Reserved */
 692    pfl->cfi_table[0x1F] = 0x07;
 693    /* Timeout for min size buffer write (NA) */
 694    pfl->cfi_table[0x20] = 0x00;
 695    /* Typical timeout for block erase (512 ms) */
 696    pfl->cfi_table[0x21] = 0x09;
 697    /* Typical timeout for full chip erase (4096 ms) */
 698    pfl->cfi_table[0x22] = 0x0C;
 699    /* Reserved */
 700    pfl->cfi_table[0x23] = 0x01;
 701    /* Max timeout for buffer write (NA) */
 702    pfl->cfi_table[0x24] = 0x00;
 703    /* Max timeout for block erase */
 704    pfl->cfi_table[0x25] = 0x0A;
 705    /* Max timeout for chip erase */
 706    pfl->cfi_table[0x26] = 0x0D;
 707    /* Device size */
 708    pfl->cfi_table[0x27] = ctz32(chip_len);
 709    /* Flash device interface (8 & 16 bits) */
 710    pfl->cfi_table[0x28] = 0x02;
 711    pfl->cfi_table[0x29] = 0x00;
 712    /* Max number of bytes in multi-bytes write */
 713    /* XXX: disable buffered write as it's not supported */
 714    //    pfl->cfi_table[0x2A] = 0x05;
 715    pfl->cfi_table[0x2A] = 0x00;
 716    pfl->cfi_table[0x2B] = 0x00;
 717    /* Number of erase block regions (uniform) */
 718    pfl->cfi_table[0x2C] = 0x01;
 719    /* Erase block region 1 */
 720    pfl->cfi_table[0x2D] = pfl->nb_blocs - 1;
 721    pfl->cfi_table[0x2E] = (pfl->nb_blocs - 1) >> 8;
 722    pfl->cfi_table[0x2F] = pfl->sector_len >> 8;
 723    pfl->cfi_table[0x30] = pfl->sector_len >> 16;
 724
 725    /* Extended */
 726    pfl->cfi_table[0x31] = 'P';
 727    pfl->cfi_table[0x32] = 'R';
 728    pfl->cfi_table[0x33] = 'I';
 729
 730    pfl->cfi_table[0x34] = '1';
 731    pfl->cfi_table[0x35] = '0';
 732
 733    pfl->cfi_table[0x36] = 0x00;
 734    pfl->cfi_table[0x37] = 0x00;
 735    pfl->cfi_table[0x38] = 0x00;
 736    pfl->cfi_table[0x39] = 0x00;
 737
 738    pfl->cfi_table[0x3a] = 0x00;
 739
 740    pfl->cfi_table[0x3b] = 0x00;
 741    pfl->cfi_table[0x3c] = 0x00;
 742}
 743
 744static Property pflash_cfi02_properties[] = {
 745    DEFINE_PROP_DRIVE("drive", struct pflash_t, blk),
 746    DEFINE_PROP_UINT32("num-blocks", struct pflash_t, nb_blocs, 0),
 747    DEFINE_PROP_UINT32("sector-length", struct pflash_t, sector_len, 0),
 748    DEFINE_PROP_UINT8("width", struct pflash_t, width, 0),
 749    DEFINE_PROP_UINT8("mappings", struct pflash_t, mappings, 0),
 750    DEFINE_PROP_UINT8("big-endian", struct pflash_t, be, 0),
 751    DEFINE_PROP_UINT16("id0", struct pflash_t, ident0, 0),
 752    DEFINE_PROP_UINT16("id1", struct pflash_t, ident1, 0),
 753    DEFINE_PROP_UINT16("id2", struct pflash_t, ident2, 0),
 754    DEFINE_PROP_UINT16("id3", struct pflash_t, ident3, 0),
 755    DEFINE_PROP_UINT16("unlock-addr0", struct pflash_t, unlock_addr0, 0),
 756    DEFINE_PROP_UINT16("unlock-addr1", struct pflash_t, unlock_addr1, 0),
 757    DEFINE_PROP_STRING("name", struct pflash_t, name),
 758    DEFINE_PROP_END_OF_LIST(),
 759};
 760
 761static void pflash_cfi02_class_init(ObjectClass *klass, void *data)
 762{
 763    DeviceClass *dc = DEVICE_CLASS(klass);
 764
 765    dc->realize = pflash_cfi02_realize;
 766    dc->props = pflash_cfi02_properties;
 767    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 768}
 769
 770static const TypeInfo pflash_cfi02_info = {
 771    .name           = TYPE_CFI_PFLASH02,
 772    .parent         = TYPE_SYS_BUS_DEVICE,
 773    .instance_size  = sizeof(struct pflash_t),
 774    .class_init     = pflash_cfi02_class_init,
 775};
 776
 777static void pflash_cfi02_register_types(void)
 778{
 779    type_register_static(&pflash_cfi02_info);
 780}
 781
 782type_init(pflash_cfi02_register_types)
 783
 784pflash_t *pflash_cfi02_register(hwaddr base,
 785                                DeviceState *qdev, const char *name,
 786                                hwaddr size,
 787                                BlockBackend *blk, uint32_t sector_len,
 788                                int nb_blocs, int nb_mappings, int width,
 789                                uint16_t id0, uint16_t id1,
 790                                uint16_t id2, uint16_t id3,
 791                                uint16_t unlock_addr0, uint16_t unlock_addr1,
 792                                int be)
 793{
 794    DeviceState *dev = qdev_create(NULL, TYPE_CFI_PFLASH02);
 795
 796    if (blk) {
 797        qdev_prop_set_drive(dev, "drive", blk, &error_abort);
 798    }
 799    qdev_prop_set_uint32(dev, "num-blocks", nb_blocs);
 800    qdev_prop_set_uint32(dev, "sector-length", sector_len);
 801    qdev_prop_set_uint8(dev, "width", width);
 802    qdev_prop_set_uint8(dev, "mappings", nb_mappings);
 803    qdev_prop_set_uint8(dev, "big-endian", !!be);
 804    qdev_prop_set_uint16(dev, "id0", id0);
 805    qdev_prop_set_uint16(dev, "id1", id1);
 806    qdev_prop_set_uint16(dev, "id2", id2);
 807    qdev_prop_set_uint16(dev, "id3", id3);
 808    qdev_prop_set_uint16(dev, "unlock-addr0", unlock_addr0);
 809    qdev_prop_set_uint16(dev, "unlock-addr1", unlock_addr1);
 810    qdev_prop_set_string(dev, "name", name);
 811    qdev_init_nofail(dev);
 812
 813    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
 814    return CFI_PFLASH02(dev);
 815}
 816