m25p80.c 21.2 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
/*
 * ST M25P80 emulator. Emulate all SPI flash devices based on the m25p80 command
 * set. Known devices table current as of Jun/2012 and taken from linux.
 * See drivers/mtd/devices/m25p80.c.
 *
 * Copyright (C) 2011 Edgar E. Iglesias <edgar.iglesias@gmail.com>
 * Copyright (C) 2012 Peter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>
 * Copyright (C) 2012 PetaLogix
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 2 or
 * (at your option) a later version of the License.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along
 * with this program; if not, see <http://www.gnu.org/licenses/>.
 */

24
#include "hw/hw.h"
25
#include "sysemu/block-backend.h"
26
#include "sysemu/blockdev.h"
27
#include "hw/ssi.h"
28

29 30
#ifndef M25P80_ERR_DEBUG
#define M25P80_ERR_DEBUG 0
31 32
#endif

33 34 35 36 37 38 39
#define DB_PRINT_L(level, ...) do { \
    if (M25P80_ERR_DEBUG > (level)) { \
        fprintf(stderr,  ": %s: ", __func__); \
        fprintf(stderr, ## __VA_ARGS__); \
    } \
} while (0);

40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76
/* Fields for FlashPartInfo->flags */

/* erase capabilities */
#define ER_4K 1
#define ER_32K 2
/* set to allow the page program command to write 0s back to 1. Useful for
 * modelling EEPROM with SPI flash command set
 */
#define WR_1 0x100

typedef struct FlashPartInfo {
    const char *part_name;
    /* jedec code. (jedec >> 16) & 0xff is the 1st byte, >> 8 the 2nd etc */
    uint32_t jedec;
    /* extended jedec code */
    uint16_t ext_jedec;
    /* there is confusion between manufacturers as to what a sector is. In this
     * device model, a "sector" is the size that is erased by the ERASE_SECTOR
     * command (opcode 0xd8).
     */
    uint32_t sector_size;
    uint32_t n_sectors;
    uint32_t page_size;
    uint8_t flags;
} FlashPartInfo;

/* adapted from linux */

#define INFO(_part_name, _jedec, _ext_jedec, _sector_size, _n_sectors, _flags)\
    .part_name = (_part_name),\
    .jedec = (_jedec),\
    .ext_jedec = (_ext_jedec),\
    .sector_size = (_sector_size),\
    .n_sectors = (_n_sectors),\
    .page_size = 256,\
    .flags = (_flags),\

P
Peter Crosthwaite 已提交
77 78 79 80
#define JEDEC_NUMONYX 0x20
#define JEDEC_WINBOND 0xEF
#define JEDEC_SPANSION 0x01

81 82 83 84 85 86 87 88 89 90 91 92 93 94
static const FlashPartInfo known_devices[] = {
    /* Atmel -- some are (confusingly) marketed as "DataFlash" */
    { INFO("at25fs010",   0x1f6601,      0,  32 << 10,   4, ER_4K) },
    { INFO("at25fs040",   0x1f6604,      0,  64 << 10,   8, ER_4K) },

    { INFO("at25df041a",  0x1f4401,      0,  64 << 10,   8, ER_4K) },
    { INFO("at25df321a",  0x1f4701,      0,  64 << 10,  64, ER_4K) },
    { INFO("at25df641",   0x1f4800,      0,  64 << 10, 128, ER_4K) },

    { INFO("at26f004",    0x1f0400,      0,  64 << 10,   8, ER_4K) },
    { INFO("at26df081a",  0x1f4501,      0,  64 << 10,  16, ER_4K) },
    { INFO("at26df161a",  0x1f4601,      0,  64 << 10,  32, ER_4K) },
    { INFO("at26df321",   0x1f4700,      0,  64 << 10,  64, ER_4K) },

95 96
    { INFO("at45db081d",  0x1f2500,      0,  64 << 10,  16, ER_4K) },

97 98 99 100 101
    /* EON -- en25xxx */
    { INFO("en25f32",     0x1c3116,      0,  64 << 10,  64, ER_4K) },
    { INFO("en25p32",     0x1c2016,      0,  64 << 10,  64, 0) },
    { INFO("en25q32b",    0x1c3016,      0,  64 << 10,  64, 0) },
    { INFO("en25p64",     0x1c2017,      0,  64 << 10, 128, 0) },
102 103 104 105 106
    { INFO("en25q64",     0x1c3017,      0,  64 << 10, 128, ER_4K) },

    /* GigaDevice */
    { INFO("gd25q32",     0xc84016,      0,  64 << 10,  64, ER_4K) },
    { INFO("gd25q64",     0xc84017,      0,  64 << 10, 128, ER_4K) },
107 108 109 110 111

    /* Intel/Numonyx -- xxxs33b */
    { INFO("160s33b",     0x898911,      0,  64 << 10,  32, 0) },
    { INFO("320s33b",     0x898912,      0,  64 << 10,  64, 0) },
    { INFO("640s33b",     0x898913,      0,  64 << 10, 128, 0) },
112
    { INFO("n25q064",     0x20ba17,      0,  64 << 10, 128, 0) },
113 114

    /* Macronix */
115
    { INFO("mx25l2005a",  0xc22012,      0,  64 << 10,   4, ER_4K) },
116 117 118 119 120 121 122 123 124 125
    { INFO("mx25l4005a",  0xc22013,      0,  64 << 10,   8, ER_4K) },
    { INFO("mx25l8005",   0xc22014,      0,  64 << 10,  16, 0) },
    { INFO("mx25l1606e",  0xc22015,      0,  64 << 10,  32, ER_4K) },
    { INFO("mx25l3205d",  0xc22016,      0,  64 << 10,  64, 0) },
    { INFO("mx25l6405d",  0xc22017,      0,  64 << 10, 128, 0) },
    { INFO("mx25l12805d", 0xc22018,      0,  64 << 10, 256, 0) },
    { INFO("mx25l12855e", 0xc22618,      0,  64 << 10, 256, 0) },
    { INFO("mx25l25635e", 0xc22019,      0,  64 << 10, 512, 0) },
    { INFO("mx25l25655e", 0xc22619,      0,  64 << 10, 512, 0) },

126
    /* Micron */
E
Ed Maste 已提交
127 128 129 130 131 132 133 134
    { INFO("n25q032a11",  0x20bb16,      0,  64 << 10,  64, ER_4K) },
    { INFO("n25q032a13",  0x20ba16,      0,  64 << 10,  64, ER_4K) },
    { INFO("n25q064a11",  0x20bb17,      0,  64 << 10, 128, ER_4K) },
    { INFO("n25q064a13",  0x20ba17,      0,  64 << 10, 128, ER_4K) },
    { INFO("n25q128a11",  0x20bb18,      0,  64 << 10, 256, ER_4K) },
    { INFO("n25q128a13",  0x20ba18,      0,  64 << 10, 256, ER_4K) },
    { INFO("n25q256a11",  0x20bb19,      0,  64 << 10, 512, ER_4K) },
    { INFO("n25q256a13",  0x20ba19,      0,  64 << 10, 512, ER_4K) },
135

136 137 138 139
    /* Spansion -- single (large) sector size only, at least
     * for the chips listed here (without boot sectors).
     */
    { INFO("s25sl032p",   0x010215, 0x4d00,  64 << 10,  64, ER_4K) },
140
    { INFO("s25sl064p",   0x010216, 0x4d00,  64 << 10, 128, ER_4K) },
141 142 143 144 145 146 147 148
    { INFO("s25fl256s0",  0x010219, 0x4d00, 256 << 10, 128, 0) },
    { INFO("s25fl256s1",  0x010219, 0x4d01,  64 << 10, 512, 0) },
    { INFO("s25fl512s",   0x010220, 0x4d00, 256 << 10, 256, 0) },
    { INFO("s70fl01gs",   0x010221, 0x4d00, 256 << 10, 256, 0) },
    { INFO("s25sl12800",  0x012018, 0x0300, 256 << 10,  64, 0) },
    { INFO("s25sl12801",  0x012018, 0x0301,  64 << 10, 256, 0) },
    { INFO("s25fl129p0",  0x012018, 0x4d00, 256 << 10,  64, 0) },
    { INFO("s25fl129p1",  0x012018, 0x4d01,  64 << 10, 256, 0) },
149 150 151 152 153
    { INFO("s25sl004a",   0x010212,      0,  64 << 10,   8, 0) },
    { INFO("s25sl008a",   0x010213,      0,  64 << 10,  16, 0) },
    { INFO("s25sl016a",   0x010214,      0,  64 << 10,  32, 0) },
    { INFO("s25sl032a",   0x010215,      0,  64 << 10,  64, 0) },
    { INFO("s25sl064a",   0x010216,      0,  64 << 10, 128, 0) },
154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176
    { INFO("s25fl016k",   0xef4015,      0,  64 << 10,  32, ER_4K | ER_32K) },
    { INFO("s25fl064k",   0xef4017,      0,  64 << 10, 128, ER_4K | ER_32K) },

    /* SST -- large erase sizes are "overlays", "sectors" are 4<< 10 */
    { INFO("sst25vf040b", 0xbf258d,      0,  64 << 10,   8, ER_4K) },
    { INFO("sst25vf080b", 0xbf258e,      0,  64 << 10,  16, ER_4K) },
    { INFO("sst25vf016b", 0xbf2541,      0,  64 << 10,  32, ER_4K) },
    { INFO("sst25vf032b", 0xbf254a,      0,  64 << 10,  64, ER_4K) },
    { INFO("sst25wf512",  0xbf2501,      0,  64 << 10,   1, ER_4K) },
    { INFO("sst25wf010",  0xbf2502,      0,  64 << 10,   2, ER_4K) },
    { INFO("sst25wf020",  0xbf2503,      0,  64 << 10,   4, ER_4K) },
    { INFO("sst25wf040",  0xbf2504,      0,  64 << 10,   8, ER_4K) },

    /* ST Microelectronics -- newer production may have feature updates */
    { INFO("m25p05",      0x202010,      0,  32 << 10,   2, 0) },
    { INFO("m25p10",      0x202011,      0,  32 << 10,   4, 0) },
    { INFO("m25p20",      0x202012,      0,  64 << 10,   4, 0) },
    { INFO("m25p40",      0x202013,      0,  64 << 10,   8, 0) },
    { INFO("m25p80",      0x202014,      0,  64 << 10,  16, 0) },
    { INFO("m25p16",      0x202015,      0,  64 << 10,  32, 0) },
    { INFO("m25p32",      0x202016,      0,  64 << 10,  64, 0) },
    { INFO("m25p64",      0x202017,      0,  64 << 10, 128, 0) },
    { INFO("m25p128",     0x202018,      0, 256 << 10,  64, 0) },
177
    { INFO("n25q032",     0x20ba16,      0,  64 << 10,  64, 0) },
178 179 180 181 182

    { INFO("m45pe10",     0x204011,      0,  64 << 10,   2, 0) },
    { INFO("m45pe80",     0x204014,      0,  64 << 10,  16, 0) },
    { INFO("m45pe16",     0x204015,      0,  64 << 10,  32, 0) },

183
    { INFO("m25pe20",     0x208012,      0,  64 << 10,   4, 0) },
184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199
    { INFO("m25pe80",     0x208014,      0,  64 << 10,  16, 0) },
    { INFO("m25pe16",     0x208015,      0,  64 << 10,  32, ER_4K) },

    { INFO("m25px32",     0x207116,      0,  64 << 10,  64, ER_4K) },
    { INFO("m25px32-s0",  0x207316,      0,  64 << 10,  64, ER_4K) },
    { INFO("m25px32-s1",  0x206316,      0,  64 << 10,  64, ER_4K) },
    { INFO("m25px64",     0x207117,      0,  64 << 10, 128, 0) },

    /* Winbond -- w25x "blocks" are 64k, "sectors" are 4KiB */
    { INFO("w25x10",      0xef3011,      0,  64 << 10,   2, ER_4K) },
    { INFO("w25x20",      0xef3012,      0,  64 << 10,   4, ER_4K) },
    { INFO("w25x40",      0xef3013,      0,  64 << 10,   8, ER_4K) },
    { INFO("w25x80",      0xef3014,      0,  64 << 10,  16, ER_4K) },
    { INFO("w25x16",      0xef3015,      0,  64 << 10,  32, ER_4K) },
    { INFO("w25x32",      0xef3016,      0,  64 << 10,  64, ER_4K) },
    { INFO("w25q32",      0xef4016,      0,  64 << 10,  64, ER_4K) },
200
    { INFO("w25q32dw",    0xef6016,      0,  64 << 10,  64, ER_4K) },
201 202
    { INFO("w25x64",      0xef3017,      0,  64 << 10, 128, ER_4K) },
    { INFO("w25q64",      0xef4017,      0,  64 << 10, 128, ER_4K) },
203 204 205
    { INFO("w25q80",      0xef5014,      0,  64 << 10,  16, ER_4K) },
    { INFO("w25q80bl",    0xef4014,      0,  64 << 10,  16, ER_4K) },
    { INFO("w25q256",     0xef4019,      0,  64 << 10, 512, ER_4K) },
206 207 208 209 210 211 212

    /* Numonyx -- n25q128 */
    { INFO("n25q128",      0x20ba18,      0,  64 << 10, 256, 0) },
};

typedef enum {
    NOP = 0,
213
    WRSR = 0x1,
214 215 216
    WRDI = 0x4,
    RDSR = 0x5,
    WREN = 0x6,
P
Peter Crosthwaite 已提交
217 218 219 220
    JEDEC_READ = 0x9f,
    BULK_ERASE = 0xc7,

    READ = 0x3,
221
    FAST_READ = 0xb,
P
Peter Crosthwaite 已提交
222 223 224 225 226 227 228 229 230
    DOR = 0x3b,
    QOR = 0x6b,
    DIOR = 0xbb,
    QIOR = 0xeb,

    PP = 0x2,
    DPP = 0xa2,
    QPP = 0x32,

231 232 233 234 235 236 237 238 239 240 241 242 243 244
    ERASE_4K = 0x20,
    ERASE_32K = 0x52,
    ERASE_SECTOR = 0xd8,
} FlashCMD;

typedef enum {
    STATE_IDLE,
    STATE_PAGE_PROGRAM,
    STATE_READ,
    STATE_COLLECTING_DATA,
    STATE_READING_DATA,
} CMDState;

typedef struct Flash {
245 246
    SSISlave parent_obj;

247 248
    uint32_t r;

249
    BlockBackend *blk;
250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269

    uint8_t *storage;
    uint32_t size;
    int page_size;

    uint8_t state;
    uint8_t data[16];
    uint32_t len;
    uint32_t pos;
    uint8_t needed_bytes;
    uint8_t cmd_in_progress;
    uint64_t cur_addr;
    bool write_enable;

    int64_t dirty_page;

    const FlashPartInfo *pi;

} Flash;

270 271 272 273 274 275 276 277 278 279 280 281 282
typedef struct M25P80Class {
    SSISlaveClass parent_class;
    FlashPartInfo *pi;
} M25P80Class;

#define TYPE_M25P80 "m25p80-generic"
#define M25P80(obj) \
     OBJECT_CHECK(Flash, (obj), TYPE_M25P80)
#define M25P80_CLASS(klass) \
     OBJECT_CLASS_CHECK(M25P80Class, (klass), TYPE_M25P80)
#define M25P80_GET_CLASS(obj) \
     OBJECT_GET_CLASS(M25P80Class, (obj), TYPE_M25P80)

283
static void blk_sync_complete(void *opaque, int ret)
284 285 286 287 288 289 290 291
{
    /* do nothing. Masters do not directly interact with the backing store,
     * only the working copy so no mutexing required.
     */
}

static void flash_sync_page(Flash *s, int page)
{
292
    int blk_sector, nb_sectors;
293 294
    QEMUIOVector iov;

295
    if (!s->blk || blk_is_read_only(s->blk)) {
296
        return;
297
    }
298

299
    blk_sector = (page * s->pi->page_size) / BDRV_SECTOR_SIZE;
300 301
    nb_sectors = DIV_ROUND_UP(s->pi->page_size, BDRV_SECTOR_SIZE);
    qemu_iovec_init(&iov, 1);
302
    qemu_iovec_add(&iov, s->storage + blk_sector * BDRV_SECTOR_SIZE,
303
                   nb_sectors * BDRV_SECTOR_SIZE);
304 305
    blk_aio_writev(s->blk, blk_sector, &iov, nb_sectors, blk_sync_complete,
                   NULL);
306 307 308 309 310 311 312
}

static inline void flash_sync_area(Flash *s, int64_t off, int64_t len)
{
    int64_t start, end, nb_sectors;
    QEMUIOVector iov;

313
    if (!s->blk || blk_is_read_only(s->blk)) {
314 315 316 317 318 319 320 321 322 323
        return;
    }

    assert(!(len % BDRV_SECTOR_SIZE));
    start = off / BDRV_SECTOR_SIZE;
    end = (off + len) / BDRV_SECTOR_SIZE;
    nb_sectors = end - start;
    qemu_iovec_init(&iov, 1);
    qemu_iovec_add(&iov, s->storage + (start * BDRV_SECTOR_SIZE),
                                        nb_sectors * BDRV_SECTOR_SIZE);
324
    blk_aio_writev(s->blk, start, &iov, nb_sectors, blk_sync_complete, NULL);
325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350
}

static void flash_erase(Flash *s, int offset, FlashCMD cmd)
{
    uint32_t len;
    uint8_t capa_to_assert = 0;

    switch (cmd) {
    case ERASE_4K:
        len = 4 << 10;
        capa_to_assert = ER_4K;
        break;
    case ERASE_32K:
        len = 32 << 10;
        capa_to_assert = ER_32K;
        break;
    case ERASE_SECTOR:
        len = s->pi->sector_size;
        break;
    case BULK_ERASE:
        len = s->size;
        break;
    default:
        abort();
    }

351
    DB_PRINT_L(0, "offset = %#x, len = %d\n", offset, len);
352
    if ((s->pi->flags & capa_to_assert) != capa_to_assert) {
353 354
        qemu_log_mask(LOG_GUEST_ERROR, "M25P80: %d erase size not supported by"
                      " device\n", len);
355 356 357
    }

    if (!s->write_enable) {
358
        qemu_log_mask(LOG_GUEST_ERROR, "M25P80: erase with write protect!\n");
359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379
        return;
    }
    memset(s->storage + offset, 0xff, len);
    flash_sync_area(s, offset, len);
}

static inline void flash_sync_dirty(Flash *s, int64_t newpage)
{
    if (s->dirty_page >= 0 && s->dirty_page != newpage) {
        flash_sync_page(s, s->dirty_page);
        s->dirty_page = newpage;
    }
}

static inline
void flash_write8(Flash *s, uint64_t addr, uint8_t data)
{
    int64_t page = addr / s->pi->page_size;
    uint8_t prev = s->storage[s->cur_addr];

    if (!s->write_enable) {
380
        qemu_log_mask(LOG_GUEST_ERROR, "M25P80: write with write protect!\n");
381 382 383
    }

    if ((prev ^ data) & data) {
384 385
        DB_PRINT_L(1, "programming zero to one! addr=%" PRIx64 "  %" PRIx8
                   " -> %" PRIx8 "\n", addr, prev, data);
386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403
    }

    if (s->pi->flags & WR_1) {
        s->storage[s->cur_addr] = data;
    } else {
        s->storage[s->cur_addr] &= data;
    }

    flash_sync_dirty(s, page);
    s->dirty_page = page;
}

static void complete_collecting_data(Flash *s)
{
    s->cur_addr = s->data[0] << 16;
    s->cur_addr |= s->data[1] << 8;
    s->cur_addr |= s->data[2];

404 405
    s->state = STATE_IDLE;

406
    switch (s->cmd_in_progress) {
P
Peter Crosthwaite 已提交
407 408
    case DPP:
    case QPP:
409 410 411 412 413
    case PP:
        s->state = STATE_PAGE_PROGRAM;
        break;
    case READ:
    case FAST_READ:
P
Peter Crosthwaite 已提交
414 415 416 417
    case DOR:
    case QOR:
    case DIOR:
    case QIOR:
418 419 420 421 422 423 424
        s->state = STATE_READ;
        break;
    case ERASE_4K:
    case ERASE_32K:
    case ERASE_SECTOR:
        flash_erase(s, s->cur_addr, s->cmd_in_progress);
        break;
425 426 427 428 429
    case WRSR:
        if (s->write_enable) {
            s->write_enable = false;
        }
        break;
430 431 432 433 434 435 436 437
    default:
        break;
    }
}

static void decode_new_cmd(Flash *s, uint32_t value)
{
    s->cmd_in_progress = value;
438
    DB_PRINT_L(0, "decoded new command:%x\n", value);
439 440 441 442 443 444 445

    switch (value) {

    case ERASE_4K:
    case ERASE_32K:
    case ERASE_SECTOR:
    case READ:
P
Peter Crosthwaite 已提交
446 447
    case DPP:
    case QPP:
448 449 450 451 452 453 454 455
    case PP:
        s->needed_bytes = 3;
        s->pos = 0;
        s->len = 0;
        s->state = STATE_COLLECTING_DATA;
        break;

    case FAST_READ:
P
Peter Crosthwaite 已提交
456 457
    case DOR:
    case QOR:
458 459 460 461 462 463
        s->needed_bytes = 4;
        s->pos = 0;
        s->len = 0;
        s->state = STATE_COLLECTING_DATA;
        break;

P
Peter Crosthwaite 已提交
464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493
    case DIOR:
        switch ((s->pi->jedec >> 16) & 0xFF) {
        case JEDEC_WINBOND:
        case JEDEC_SPANSION:
            s->needed_bytes = 4;
            break;
        case JEDEC_NUMONYX:
        default:
            s->needed_bytes = 5;
        }
        s->pos = 0;
        s->len = 0;
        s->state = STATE_COLLECTING_DATA;
        break;

    case QIOR:
        switch ((s->pi->jedec >> 16) & 0xFF) {
        case JEDEC_WINBOND:
        case JEDEC_SPANSION:
            s->needed_bytes = 6;
            break;
        case JEDEC_NUMONYX:
        default:
            s->needed_bytes = 8;
        }
        s->pos = 0;
        s->len = 0;
        s->state = STATE_COLLECTING_DATA;
        break;

494 495 496 497 498 499 500 501 502
    case WRSR:
        if (s->write_enable) {
            s->needed_bytes = 1;
            s->pos = 0;
            s->len = 0;
            s->state = STATE_COLLECTING_DATA;
        }
        break;

503 504 505 506 507 508 509 510 511 512 513 514 515 516 517
    case WRDI:
        s->write_enable = false;
        break;
    case WREN:
        s->write_enable = true;
        break;

    case RDSR:
        s->data[0] = (!!s->write_enable) << 1;
        s->pos = 0;
        s->len = 1;
        s->state = STATE_READING_DATA;
        break;

    case JEDEC_READ:
518
        DB_PRINT_L(0, "populated jedec code\n");
519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534
        s->data[0] = (s->pi->jedec >> 16) & 0xff;
        s->data[1] = (s->pi->jedec >> 8) & 0xff;
        s->data[2] = s->pi->jedec & 0xff;
        if (s->pi->ext_jedec) {
            s->data[3] = (s->pi->ext_jedec >> 8) & 0xff;
            s->data[4] = s->pi->ext_jedec & 0xff;
            s->len = 5;
        } else {
            s->len = 3;
        }
        s->pos = 0;
        s->state = STATE_READING_DATA;
        break;

    case BULK_ERASE:
        if (s->write_enable) {
535
            DB_PRINT_L(0, "chip erase\n");
536 537
            flash_erase(s, 0, BULK_ERASE);
        } else {
538 539
            qemu_log_mask(LOG_GUEST_ERROR, "M25P80: chip erase with write "
                          "protect!\n");
540 541 542 543 544
        }
        break;
    case NOP:
        break;
    default:
545
        qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Unknown cmd %x\n", value);
546 547 548 549 550 551
        break;
    }
}

static int m25p80_cs(SSISlave *ss, bool select)
{
552
    Flash *s = M25P80(ss);
553 554 555 556 557 558 559 560

    if (select) {
        s->len = 0;
        s->pos = 0;
        s->state = STATE_IDLE;
        flash_sync_dirty(s, -1);
    }

561
    DB_PRINT_L(0, "%sselect\n", select ? "de" : "");
562 563 564 565 566 567

    return 0;
}

static uint32_t m25p80_transfer8(SSISlave *ss, uint32_t tx)
{
568
    Flash *s = M25P80(ss);
569 570 571 572 573
    uint32_t r = 0;

    switch (s->state) {

    case STATE_PAGE_PROGRAM:
574 575
        DB_PRINT_L(1, "page program cur_addr=%#" PRIx64 " data=%" PRIx8 "\n",
                   s->cur_addr, (uint8_t)tx);
576 577 578 579 580 581
        flash_write8(s, s->cur_addr, (uint8_t)tx);
        s->cur_addr++;
        break;

    case STATE_READ:
        r = s->storage[s->cur_addr];
582 583
        DB_PRINT_L(1, "READ 0x%" PRIx64 "=%" PRIx8 "\n", s->cur_addr,
                   (uint8_t)r);
584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616
        s->cur_addr = (s->cur_addr + 1) % s->size;
        break;

    case STATE_COLLECTING_DATA:
        s->data[s->len] = (uint8_t)tx;
        s->len++;

        if (s->len == s->needed_bytes) {
            complete_collecting_data(s);
        }
        break;

    case STATE_READING_DATA:
        r = s->data[s->pos];
        s->pos++;
        if (s->pos == s->len) {
            s->pos = 0;
            s->state = STATE_IDLE;
        }
        break;

    default:
    case STATE_IDLE:
        decode_new_cmd(s, (uint8_t)tx);
        break;
    }

    return r;
}

static int m25p80_init(SSISlave *ss)
{
    DriveInfo *dinfo;
617
    Flash *s = M25P80(ss);
618
    M25P80Class *mc = M25P80_GET_CLASS(s);
619

620
    s->pi = mc->pi;
621 622 623

    s->size = s->pi->sector_size * s->pi->n_sectors;
    s->dirty_page = -1;
624
    s->storage = blk_blockalign(s->blk, s->size);
625

626
    /* FIXME use a qdev drive property instead of drive_get_next() */
627 628
    dinfo = drive_get_next(IF_MTD);

629
    if (dinfo) {
630
        DB_PRINT_L(0, "Binding to IF_MTD drive\n");
631
        s->blk = blk_by_legacy_dinfo(dinfo);
632

633
        /* FIXME: Move to late init */
634 635
        if (blk_read(s->blk, 0, s->storage,
                     DIV_ROUND_UP(s->size, BDRV_SECTOR_SIZE))) {
636 637 638 639
            fprintf(stderr, "Failed to initialize SPI flash!\n");
            return 1;
        }
    } else {
640
        DB_PRINT_L(0, "No BDRV - binding to RAM\n");
641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673
        memset(s->storage, 0xFF, s->size);
    }

    return 0;
}

static void m25p80_pre_save(void *opaque)
{
    flash_sync_dirty((Flash *)opaque, -1);
}

static const VMStateDescription vmstate_m25p80 = {
    .name = "xilinx_spi",
    .version_id = 1,
    .minimum_version_id = 1,
    .pre_save = m25p80_pre_save,
    .fields = (VMStateField[]) {
        VMSTATE_UINT8(state, Flash),
        VMSTATE_UINT8_ARRAY(data, Flash, 16),
        VMSTATE_UINT32(len, Flash),
        VMSTATE_UINT32(pos, Flash),
        VMSTATE_UINT8(needed_bytes, Flash),
        VMSTATE_UINT8(cmd_in_progress, Flash),
        VMSTATE_UINT64(cur_addr, Flash),
        VMSTATE_BOOL(write_enable, Flash),
        VMSTATE_END_OF_LIST()
    }
};

static void m25p80_class_init(ObjectClass *klass, void *data)
{
    DeviceClass *dc = DEVICE_CLASS(klass);
    SSISlaveClass *k = SSI_SLAVE_CLASS(klass);
674
    M25P80Class *mc = M25P80_CLASS(klass);
675 676 677 678 679 680

    k->init = m25p80_init;
    k->transfer = m25p80_transfer8;
    k->set_cs = m25p80_cs;
    k->cs_polarity = SSI_CS_LOW;
    dc->vmsd = &vmstate_m25p80;
681
    mc->pi = data;
682 683 684
}

static const TypeInfo m25p80_info = {
685
    .name           = TYPE_M25P80,
686 687
    .parent         = TYPE_SSI_SLAVE,
    .instance_size  = sizeof(Flash),
688 689
    .class_size     = sizeof(M25P80Class),
    .abstract       = true,
690 691 692 693
};

static void m25p80_register_types(void)
{
694 695
    int i;

696
    type_register_static(&m25p80_info);
697 698 699 700 701 702 703 704 705
    for (i = 0; i < ARRAY_SIZE(known_devices); ++i) {
        TypeInfo ti = {
            .name       = known_devices[i].part_name,
            .parent     = TYPE_M25P80,
            .class_init = m25p80_class_init,
            .class_data = (void *)&known_devices[i],
        };
        type_register(&ti);
    }
706 707 708
}

type_init(m25p80_register_types)