spi flash and at91_spi plus at91_pdc initial implementation

Evgeniy Dushistov
1 parent 0c250455
Showing 9 changed files with 625 additions and 29 deletions
Makefile.target
hw/at91.h
hw/at91_pdc.c
hw/at91_spi.c
hw/at91sam9.c
hw/at91sam9263_defs.h
hw/flash.h
hw/spi.h
hw/spi_flash.c
@@ -411,7 +411,7 @@ obj-sparc-y += cs4231.o eccmemctl.o sbi.o sun4c_intctl.o
 endif
 obj-arm-y = integratorcp.o versatilepb.o smc91c111.o arm_pic.o arm_timer.o
-obj-arm-y += pflash_atmel.o at91sam9.o
+obj-arm-y += pflash_atmel.o at91sam9.o spi_flash.o
 obj-arm-y += arm_boot.o pl011.o pl031.o pl050.o pl080.o pl110.o pl181.o pl190.o
 obj-arm-y += versatile_pci.o
 obj-arm-y += realview_gic.o realview.o arm_sysctl.o mpcore.o
@@ -433,7 +433,7 @@ obj-arm-y += syborg.o syborg_fb.o syborg_interrupt.o syborg_keyboard.o
 obj-arm-y += syborg_serial.o syborg_timer.o syborg_pointer.o syborg_rtc.o
 obj-arm-y += syborg_virtio.o
 obj-arm-y += at91_aic.o at91_dbgu.o at91_pio.o at91_pit.o at91_pmc.o at91_rtt.o
-obj-arm-y += at91_rstc.o at91_intor.o at91_tc.o at91_emac.o at91pes.o
+obj-arm-y += at91_rstc.o at91_intor.o at91_tc.o at91_emac.o at91_spi.o at91_pdc.o at91pes.o
 obj-arm-y += gpio_rotary.o gpio_keypad.o hd44780.o
 ifeq ($(TARGET_BASE_ARCH), arm)
@@ -29,4 +29,19 @@
    Controller. */
 extern int at91_master_clock_frequency;
+typedef uint32_t (*spi_txrx_callback_fun_t)(void *opaque, uint32_t cmd, int len);
+
+typedef struct PDCState PDCState;
+typedef int (*pdc_start_transfer_t)(void *opaque,
+                                     target_phys_addr_t tx,
+                                     unsigned int tx_len,
+                                     target_phys_addr_t rx,
+                                     unsigned int rx_len,
+                                     int last_transfer);
+
+PDCState *at91_pdc_init(void *opaque, pdc_start_transfer_t start_transfer);
+extern void at91_pdc_reset(PDCState *s);
+extern void at91_pdc_write(void *opaque, target_phys_addr_t offset, uint32_t val);
+extern uint32_t at91_pdc_read(void *opaque, target_phys_addr_t offset);
+
 #endif /* !AT91_H */
+/*
+ * AT91 Peripheral DMA Controller (PDC) User Interface
+ * Written by Evgeniy Dushistov
+ * This code is licenced under the GPL. 
+ */
+#include <stdint.h>
+#include "sysbus.h"
+#include "at91.h"
+
+
+#define PDC_RPR  0x100          //Receive Pointer Register         Read/Write     0
+#define PDC_RCR  0x104          //Receive Counter Register        PDC_RCR Read/Write     0
+#define PDC_TPR  0x108          //Transmit Pointer Register       PDC_TPR Read/Write     0
+#define PDC_TCR  0x10C          //Transmit Counter Register       PDC_TCR Read/Write     0
+#define PDC_RNPR 0x110          //Receive Next Pointer Register  PDC_RNPR Read/Write     0
+#define PDC_RNCR 0x114          //Receive Next Counter Register  PDC_RNCR Read/Write     0
+#define PDC_TNPR 0x118          //Transmit Next Pointer Register PDC_TNPR Read/Write     0
+#define PDC_TNCR 0x11C          //Transmit Next Counter Register PDC_TNCR Read/Write     0
+#define PDC_PTCR 0x120          //Transfer Control Register      PDC_PTCR   Write        0
+#define PDC_PTSR 0x124          //Transfer Status Register       PDC_PTSR   Read         0
+
+#define PDC_PTCR_RXTEN  (1 << 0)
+#define PDC_PTCR_RXTDIS (1 << 1)
+#define PDC_PTCR_TXTEN  (1 << 8)
+#define PDC_PTCR_TXTDIS (1 << 9)
+
+#define AT91_PDC_DEBUG
+#ifdef AT91_PDC_DEBUG
+#define DPRINTF(fmt, ...)                           \
+    do {                                            \
+        printf("AT91PDC: " fmt , ## __VA_ARGS__);    \
+    } while (0)
+#else
+#define DPRINTF(fmt, ...) do { } while (0)
+#endif
+
+struct PDCState {
+    uint32_t ptsr;
+    uint32_t rpr;
+    uint32_t tpr;
+    uint16_t rcr;
+    uint16_t tcr;
+    uint32_t rnpr;
+    uint32_t tnpr;
+    uint16_t rncr;
+    uint16_t tncr;
+    void *opaque;
+    pdc_start_transfer_t start_transfer;
+};
+
+PDCState *at91_pdc_init(void *opaque, pdc_start_transfer_t start_transfer)
+{
+    PDCState *s;
+
+    s = qemu_mallocz(sizeof(PDCState));
+    s->opaque = opaque;
+    s->start_transfer = start_transfer;
+    return s;
+}
+
+void at91_pdc_write(void *opaque, target_phys_addr_t offset, uint32_t val)
+{
+    PDCState *s = opaque;
+    int last_transfer = 1;
+
+    switch (offset) {
+    case PDC_PTCR:
+        DPRINTF("%s, %s was (%s, %s)\n",
+                val & PDC_PTCR_RXTEN ? "enable recieve" : "<>", 
+                val & PDC_PTCR_TXTEN ? "enable transfer" : "<>",
+                s->ptsr & PDC_PTCR_RXTEN ? "enable recieve" : "<>", 
+                s->ptsr & PDC_PTCR_TXTEN ? "enable transfer" : "<>");
+
+        if (val & PDC_PTCR_RXTEN) {
+            s->ptsr |= PDC_PTCR_RXTEN;
+        }
+
+        if (val & PDC_PTCR_RXTDIS) {
+            s->ptsr &= ~PDC_PTCR_RXTEN;
+        }
+
+        if (s->ptsr & PDC_PTCR_RXTEN) {
+          last_transfer = s->rncr == 0;
+        }
+
+        if (val & PDC_PTCR_TXTEN) {
+            s->ptsr |= PDC_PTCR_TXTEN;         
+        }
+
+        if (val & PDC_PTCR_TXTDIS) {
+            s->ptsr &= ~PDC_PTCR_TXTEN;
+        }
+
+        if (s->ptsr & PDC_PTCR_TXTEN) {
+            last_transfer |= s->tncr == 0;
+        }
+               
+        if ((s->ptsr & PDC_PTCR_RXTEN) || (s->ptsr & PDC_PTCR_TXTEN)) {
+            int ret = s->start_transfer(s->opaque, s->tpr,
+                                        (s->ptsr & PDC_PTCR_TXTEN) ? s->tcr : 0,
+                                        s->rpr, (s->ptsr & PDC_PTCR_RXTEN) ? s->rcr : 0,
+                                        last_transfer);
+
+            if (ret == 0) {
+                if (s->ptsr & PDC_PTCR_RXTEN) {
+                    s->rcr = 0;
+                }
+                if (s->ptsr & PDC_PTCR_TXTEN) {
+                    s->tcr = 0;
+                }
+
+            } else
+                break;
+
+
+            if (last_transfer == 0) {
+                if (s->ptsr & PDC_PTCR_RXTEN) {
+                    s->rpr = s->rnpr;
+                    s->rcr = s->rncr;
+                    s->rncr = 0;
+                }
+                if (s->ptsr & PDC_PTCR_TXTEN) {
+                    s->tpr = s->tnpr;
+                    s->tcr = s->tncr;
+                    s->tncr = 0;
+                }
+                s->start_transfer(s->opaque, s->tpr,
+                                  (s->ptsr & PDC_PTCR_TXTEN) ? s->tcr : 0,
+                                  s->rpr, (s->ptsr & PDC_PTCR_RXTEN) ? s->rcr : 0, 1);
+
+                if (s->ptsr & PDC_PTCR_RXTEN) {
+                    s->rcr = 0;
+                }
+                if (s->ptsr & PDC_PTCR_TXTEN) {
+                    s->tcr = 0;
+                }
+            }
+        }
+
+        break;
+    case PDC_RPR:
+        s->rpr = val;
+        break;
+    case PDC_TPR:
+        s->tpr = val;
+        break;
+    case PDC_RCR:
+        s->rcr = val;
+        break;
+    case PDC_TCR:
+        s->tcr = val;
+        break;
+    case PDC_RNPR:
+        s->rnpr = val;
+        break;
+    case PDC_RNCR:
+        s->rncr = val;
+        break;
+    case PDC_TNPR:
+        s->tnpr = val;
+        break;
+    case PDC_TNCR:
+        s->tncr = val;
+        break;
+    default:
+        DPRINTF("ignore write of %X to %X\n", val, offset);
+        /*ignore*/break;
+    }
+}
+
+uint32_t at91_pdc_read(void *opaque, target_phys_addr_t offset)
+{
+//PDCState *s = opaque;
+        DPRINTF("ignore read from %X\n", offset);
+        return 0;
+}
+
+void at91_pdc_reset(PDCState *s)
+{
+    s->ptsr = 0;
+    s->rpr = 0;
+    s->tpr = 0;
+    s->rcr = 0;
+    s->tcr = 0;
+
+    s->tnpr = 0;
+    s->rnpr = 0;
+    s->tncr = 0;
+    s->rncr = 0;
+}
+/*
+ * AT91 Serial Peripheral Interface
+ * Written by Evgeniy Dushistov
+ * This code is licenced under the GPL.
+ */
+#include "sysbus.h"
+#include "spi.h"
+#include "at91.h"
+
+#define SPI_SIZE 0x4000
+#define SPI_CR  0x0
+#define SPI_MR  0x4
+#define SPI_RDR 0x8
+#define SPI_TDR 0xC
+#define SPI_SR  0x10
+#define SPI_IER 0x14
+#define SPI_IDR 0x18
+#define SPI_IMR 0x1C
+#define SPI_CSR0 0x30
+#define SPI_CSR1 0x34
+#define SPI_CSR2 0x38
+#define SPI_CSR3 0x3C
+
+#define SPI_CR_SPIEN  1
+#define SPI_CR_SPIDIS 2
+#define SPI_SR_ENDRX  (1 << 4)
+#define SPI_SR_ENDTX  (1 << 5)
+#define SPI_SR_RXBUFF (1 << 6)
+#define SPI_SR_TXBUFE (1 << 7)
+#define SPI_SR_SPIENS (1 << 16)
+
+typedef struct SPIState {
+    SysBusDevice busdev;
+    qemu_irq irq;
+    uint32_t mr;
+    uint32_t rdr;
+    uint32_t tdr;
+    uint32_t sr;
+    uint32_t imr;
+    uint32_t csr[4];
+    SPIControl *spi_control;
+    PDCState *pdc_state;
+} SPIState;
+
+#define AT91_SPI_DEBUG
+#ifdef AT91_SPI_DEBUG
+#define DPRINTF(fmt, ...)                           \
+    do {                                            \
+        printf("AT91SPI: " fmt , ## __VA_ARGS__);    \
+    } while (0)
+#else
+#define DPRINTF(fmt, ...) do { } while (0)
+#endif
+
+static uint32_t txrx_callback_empty_fun(void *opaque, uint32_t cmd, int len)
+{
+    return 0;
+}
+
+static void set_chipselect_empty(void *opaque, int on)
+{
+}
+
+static const SPIControl txrx_callback_empty = {
+    .txrx_callback = txrx_callback_empty_fun,
+    .set_chipselect = set_chipselect_empty,
+    .opaque = NULL,
+};
+
+extern CPUState *g_env;
+
+static uint32_t at91_spi_mem_read(void *opaque, target_phys_addr_t offset)
+{
+    SPIState *s = opaque;
+
+    offset &= SPI_SIZE - 1;
+    DPRINTF("spi read off %X, %X\n", offset, g_env->regs[15]);
+
+    switch (offset) {
+    case SPI_MR:
+        return s->mr;
+    case SPI_SR:
+        DPRINTF("s->sr %X\n", s->sr);
+        return s->sr;
+    case SPI_RDR:
+        return s->rdr;
+    case SPI_CSR0 ... SPI_CSR3:
+        return s->csr[(offset - SPI_CSR0) / sizeof(s->csr[0])];
+    case 0x100 ... 0x124:
+        return at91_pdc_read(s->pdc_state, offset);
+    case SPI_CR:/*write only*/
+    default:
+        DPRINTF("unsupported offset %X\n", offset);
+        return 0;
+    }
+}
+
+static void at91_spi_mem_write(void *opaque, target_phys_addr_t offset,
+                               uint32_t value)
+{
+    SPIState *s = opaque;
+
+    offset &= SPI_SIZE - 1;
+    DPRINTF("spi write off %X, val %X, %X\n", offset, value, g_env->regs[15]);
+    switch (offset ){
+    case SPI_CR:
+        if (value & SPI_CR_SPIEN)
+            s->sr |= SPI_SR_SPIENS;
+        if (value & SPI_CR_SPIDIS)
+            s->sr &= ~SPI_SR_SPIENS;
+        break;
+    case SPI_MR:
+        s->mr = value;
+        break;
+    case SPI_CSR0 ... SPI_CSR3:
+        DPRINTF("bits per transfer %d\n", 8 + ((value & 0xF0) >> 4));
+        s->csr[(offset - SPI_CSR0) / sizeof(s->csr[0])] = value;
+        break;
+    case 0x100 ... 0x124:
+        at91_pdc_write(s->pdc_state, offset, value);
+        break;
+    default:
+        DPRINTF("unsupported offset %X, val %X\n", offset, value);
+        break;
+    }
+}
+
+static CPUReadMemoryFunc *at91_spi_readfn[] = {
+    at91_spi_mem_read,
+    at91_spi_mem_read,
+    at91_spi_mem_read,
+};
+
+static CPUWriteMemoryFunc *at91_spi_writefn[] = {
+    at91_spi_mem_write,
+    at91_spi_mem_write,
+    at91_spi_mem_write,
+};
+
+static int pdc_start_transfer(void *opaque,
+                               target_phys_addr_t tx,
+                               unsigned int tx_len,
+                               target_phys_addr_t rx,
+                               unsigned int rx_len,
+                               int last_transfer)
+{
+    SPIState *s = opaque;
+    unsigned int i;
+    unsigned int tlen = rx_len > tx_len ? rx_len : tx_len;
+    int flags = ((tx_len > 0) ? 1 : 0) | ((rx_len > 0) ? 2 : 0);
+
+    DPRINTF("pdc: start transfer, last trans %d\n", last_transfer);
+#if 1
+    if (flags == 2) {
+        DPRINTF("ignore only read request\n");
+        return -1;
+    }
+#endif
+    /* suppose that transfer 8 bit,
+       TODO: fix this, extract right value from csr
+    */
+    s->spi_control->set_chipselect(s->spi_control->opaque, 1);
+    for (i = 0; i < tlen; ++i) {
+        DPRINTF("pdc: transfering\n");
+        uint8_t tmp = 0;
+        if (tx_len > 0) {
+            cpu_physical_memory_read(tx, &tmp, 1);
+            ++tx;
+            --tx_len;
+        }
+        tmp = s->spi_control->txrx_callback(s->spi_control->opaque, tmp, 8);
+        s->rdr = tmp;
+        if (rx_len > 0) {
+            cpu_physical_memory_write(rx, &tmp, 1);
+            ++rx;
+            --rx_len;
+        }
+    }
+    if (flags & 1) {//tx
+        s->sr |= SPI_SR_ENDTX | SPI_SR_TXBUFE;
+    }
+    if (flags & 2) {//rx
+        s->sr |= SPI_SR_RXBUFF | SPI_SR_ENDRX;
+    }
+    if (last_transfer)
+        s->spi_control->set_chipselect(s->spi_control->opaque, 0);
+    return 0;
+}
+
+static void at91_spi_reset(void *opaque)
+{
+    SPIState *s = opaque;
+
+    s->mr = 0;
+    s->rdr = 0;
+    s->sr = 0xf0;
+    s->imr = 0;
+    memset(s->csr, 0, sizeof(s->csr));
+    at91_pdc_reset(s->pdc_state);
+}
+
+static void at91_spi_init(SysBusDevice *dev)
+{
+    SPIState *s = FROM_SYSBUS(typeof(*s), dev);
+    int spi_regs;
+
+    s->pdc_state = at91_pdc_init(s, pdc_start_transfer);
+    sysbus_init_irq(dev, &s->irq);
+    spi_regs = cpu_register_io_memory(at91_spi_readfn, at91_spi_writefn, s);
+    sysbus_init_mmio(dev, SPI_SIZE, spi_regs);
+    qemu_register_reset(at91_spi_reset, s);
+}
+
+static SysBusDeviceInfo spi_info = {
+    .init = at91_spi_init,
+    .qdev.name = "at91,spi",
+    .qdev.size = sizeof(SPIState),
+    .qdev.props = (Property[]) {
+        {
+            .name   = "spi_control",
+            .info   = &qdev_prop_ptr,
+            .offset = offsetof(SPIState, spi_control),
+            .defval = (void *)&txrx_callback_empty,
+        },
+       {/* end of list */}
+    }
+};
+
+
+static void at91_spi_register(void)
+{
+    sysbus_register_withprop(&spi_info);
+}
+
+device_init(at91_spi_register)
@@ -13,11 +13,13 @@
 #include "devices.h"
 #include "net.h"
 #include "sysemu.h"
+#include "spi.h"
 #include "flash.h"
 #include "boards.h"
 #include "qemu-char.h"
 #include "qemu-timer.h"
 #include "sysbus.h"
+#include "at91.h"
 #include "at91sam9263_defs.h"
@@ -62,7 +64,7 @@ struct at91sam9_state {
     uint32_t sdramc0_regs[(AT91_SMC0_BASE - AT91_SDRAMC0_BASE) / sizeof(uint32_t)];
     uint32_t smc0_regs[(AT91_ECC1_BASE - AT91_SMC0_BASE) / sizeof(uint32_t)];
     uint32_t usart0_regs[0x1000 / sizeof(uint32_t)];
-    struct dbgu_state dbgu;
+//    struct dbgu_state dbgu;
     pflash_t *norflash;
     ram_addr_t internal_sram;
     QEMUTimer *dbgu_tr_timer;
@@ -70,6 +72,8 @@ struct at91sam9_state {
     int timer_active;
     CPUState *env;
     qemu_irq *qirq;
+    ram_addr_t bootrom;
+    int rom_size;
 };
 static uint32_t at91_bus_matrix_read(void *opaque, target_phys_addr_t offset)
@@ -125,7 +129,7 @@ static void at91_ccfg_write(void *opaque, target_phys_addr_t offset,
 static uint32_t at91_sdramc0_read(void *opaque, target_phys_addr_t offset)
 {
     struct at91sam9_state *sam9 = (struct at91sam9_state *)opaque;
- 
+
     TRACE("sdramc0 read offset %X\n", offset);
     return sam9->sdramc0_regs[offset / sizeof(sam9->sdramc0_regs[0])];
 }
@@ -134,7 +138,7 @@ static void at91_sdramc0_write(void *opaque, target_phys_addr_t offset,
                                uint32_t value)
 {
     struct at91sam9_state *sam9 = (struct at91sam9_state *)opaque;
- 
+
     TRACE("sdramc0 write offset %X, value %X\n", offset, value);
     sam9->sdramc0_regs[offset / sizeof(sam9->sdramc0_regs[0])] = value;
 }
@@ -223,6 +227,7 @@ static CPUWriteMemoryFunc *at91_periph_writefn[] = {
     at91_periph_write
 };
+CPUState *g_env;
 static void at91sam9_init(ram_addr_t ram_size,
                           const char *boot_device,
@@ -241,9 +246,23 @@ static void at91sam9_init(ram_addr_t ram_size,
     DeviceState *dev;
     DeviceState *pit;
     DeviceState *pmc;
+    DeviceState *spi;
     int i;
+    int bms;
+    SPIControl *cs0_spi_handler;
+
+    cs0_spi_handler = qemu_mallocz(sizeof(SPIControl));
+    DEBUG("begin, ram_size %llu, boot dev %s\n", (unsigned long long)ram_size,
+          boot_device ? boot_device : "<empty>");
+
+    if (option_rom[0] && boot_device[0] == 'n') {
+        printf("Emulate ROM code\n");
+        bms = 1;
+    } else {
+        printf("Emulate start from EBI0_NCS0\n");
+        bms = 0;
+    }
-    DEBUG("begin, ram_size %llu\n", (unsigned long long)ram_size);
 #ifdef TRACE_ON
     trace_file = fopen("/tmp/trace.log", "w");
 #endif
@@ -267,6 +286,12 @@ static void at91sam9_init(ram_addr_t ram_size,
     /* Internal SRAM */
     sam9->internal_sram = qemu_ram_alloc(80 * 1024);
     cpu_register_physical_memory(0x00300000, 80 * 1024, sam9->internal_sram | IO_MEM_RAM);
+    sam9->bootrom = qemu_ram_alloc(0x100000);
+    cpu_register_physical_memory(0x00400000, 0x100000, sam9->bootrom | IO_MEM_RAM);
+    if (option_rom[0]) {
+        sam9->rom_size = load_image_targphys(option_rom[0], 0x00400000, 0x100000);
+        printf("load bootrom, size %d\n", sam9->rom_size);
+    }
     /*Internal Peripherals */
     iomemtype = cpu_register_io_memory(at91_periph_readfn, at91_periph_writefn, sam9);
@@ -291,7 +316,7 @@ static void at91sam9_init(ram_addr_t ram_size,
     qdev_prop_set_uint32(pmc, "mo_freq", 16000000);
     pit = sysbus_create_simple("at91,pit", AT91_PITC_BASE, pic1[3]);
     sysbus_create_varargs("at91,tc", AT91_TC012_BASE, pic[19], pic[19], pic[19], NULL);
-
+    spi = sysbus_create_simple("at91,spi", AT91_SPI0_BASE, pic[14]);
     at91_init_bus_matrix(sam9);
     memset(&sam9->ccfg_regs, 0, sizeof(sam9->ccfg_regs));
     sysbus_create_simple("at91,pio", AT91_PIOA_BASE, pic[2]);
@@ -318,33 +343,46 @@ static void at91sam9_init(ram_addr_t ram_size,
     */
     dinfo = drive_get(IF_PFLASH, 0, 0);
     if (dinfo) {
-        ram_addr_t nor_flash_mem = qemu_ram_alloc(NOR_FLASH_SIZE);
-        if (!nor_flash_mem) {
-            fprintf(stderr, "allocation failed\n");
-            exit(EXIT_FAILURE);
+        if (bms) {
+            if (spi_flash_register(dinfo->bdrv, 2 * 1024 * 1024, cs0_spi_handler) < 0) {
+                fprintf(stderr, "init of spi flash failed\n");
+                exit(EXIT_FAILURE);
+            }
+            qdev_prop_set_ptr(spi, "spi_control", cs0_spi_handler);
+            //rom
+            cpu_register_physical_memory(0x0, 100 * 1024,
+                                         sam9->bootrom | IO_MEM_ROMD);
+        } else {
+            //nor flash
+            ram_addr_t nor_flash_mem = qemu_ram_alloc(NOR_FLASH_SIZE);
+            if (!nor_flash_mem) {
+                fprintf(stderr, "allocation failed\n");
+                exit(EXIT_FAILURE);
+            }
+
+            sam9->norflash = pflash_cfi_atmel_register(AT91SAM9263EK_NORFLASH_OFF,
+                                                       nor_flash_mem,
+                                                       dinfo->bdrv,
+                                                       4 * 1024 * 2, 8,
+                                                       32 * 1024 * 2,
+                                                       (135 - 8),
+                                                       2, 0x001F, 0x01D6, 0, 0);
+
+            if (!sam9->norflash) {
+                fprintf(stderr, "qemu: error registering flash memory.\n");
+                exit(EXIT_FAILURE);
+            }
+
+            DEBUG("register flash at 0x0\n");
+            //register only part of flash, to prevent conflict with internal sram
+            cpu_register_physical_memory(0x0, 100 * 1024,
+                                         nor_flash_mem | IO_MEM_ROMD);
         }
-
-        sam9->norflash = pflash_cfi_atmel_register(AT91SAM9263EK_NORFLASH_OFF,
-                                                   nor_flash_mem,
-                                                   dinfo->bdrv,
-                                                   4 * 1024 * 2, 8,
-                                                   32 * 1024 * 2,
-                                                   (135 - 8),
-                                                   2, 0x001F, 0x01D6, 0, 0);
-
-        if (!sam9->norflash) {
-            fprintf(stderr, "qemu: error registering flash memory.\n");
-            exit(EXIT_FAILURE);
-        }
-
-        DEBUG("register flash at 0x0\n");
-        //register only part of flash, to prevent conflict with internal sram
-        cpu_register_physical_memory(0x0, 100 * 1024 /*NOR_FLASH_SIZE*/,
-                                     nor_flash_mem | IO_MEM_ROMD);
     } else {
         fprintf(stderr, "qemu: can not start without flash.\n");
         exit(EXIT_FAILURE);
     }
+    g_env = env;
     env->regs[15] = 0x0;
 }
@@ -6,6 +6,7 @@
 #define AT91_TC012_BASE      0xFFF7C000
 #define AT91_USART0_BASE     0xFFF8C000
 #define AT91_EMAC_BASE       0xFFFBC000
+#define AT91_SPI0_BASE       0xFFFA4000
 #define AT91_SDRAMC0_BASE    0xFFFFE200
 #define AT91_SMC0_BASE       0xFFFFE400
 #define AT91_ECC1_BASE       0xFFFFE600
@@ -26,6 +26,10 @@ pflash_t *pflash_cfi_atmel_register(target_phys_addr_t base, ram_addr_t off,
 				    uint16_t id0, uint16_t id1,
 				    uint16_t id2, uint16_t id3);
+struct SPIControl;
+/* spi_flash.c */
+extern int spi_flash_register(BlockDriverState *bs, unsigned int len,
+                              struct SPIControl *spi_control);
 /* nand.c */
 typedef struct NANDFlashState NANDFlashState;
+#ifndef _HW_SPI_H_
+#define _HW_SPI_H_
+
+/* minimal interface to separate device connected via SPI and SPI controller */
+typedef struct SPIControl {
+    void *opaque;
+    uint32_t (*txrx_callback)(void *opaque, uint32_t val, int len);
+    void (*set_chipselect)(void *opaque, int on);
+} SPIControl;
+
+#endif//!_HW_SPI_H_
+#include "hw.h"
+#include "block.h"
+#include "spi.h"
+#include "flash.h"
+
+typedef struct SPIFlash {
+    uint32_t cmd;
+    unsigned cmd_len;
+    uint32_t addr;
+    void *storage;
+    unsigned int len;
+    BlockDriverState *bs;
+} SPIFlash;
+
+#define AT91_SPI_FLASH_DEBUG
+#ifdef AT91_SPI_FLASH_DEBUG
+#define DPRINTF(fmt, ...)                           \
+    do {                                            \
+        printf("AT91SPI_FLASH: " fmt , ## __VA_ARGS__);    \
+    } while (0)
+#else
+#define DPRINTF(fmt, ...) do { } while (0)
+#endif
+
+static void spi_flash_reset_state(SPIFlash *s)
+{
+    s->cmd = 0;
+    s->cmd_len = 0;
+    s->addr = 0;
+}
+
+static void spi_flash_set_chipselect(void *opaque, int on)
+{
+    SPIFlash *s = opaque;
+
+    DPRINTF("set NS %d\n", on);
+    if (on == 0)
+        spi_flash_reset_state(s);
+}
+
+static uint32_t spi_flash_txrx(void *opaque, uint32_t val, int len)
+{
+    SPIFlash *s = opaque;
+
+    DPRINTF("txrx: val %X\n", val);
+    switch (s->cmd) {
+    case 0:
+        s->cmd = val;
+        ++s->cmd_len;
+        return 0;
+    case 0xE8:
+        ++s->cmd_len;
+        if (s->cmd_len >= 2 && s->cmd_len <= 4) {
+            s->addr |= (val & 0xFF) << ((4 - s->cmd_len) * 8);
+        } else if (s->cmd_len >= 5 && s->cmd_len < (5 + 4)) {
+            /*ignore bytes*/
+        } else {
+            uint8_t *bytes = s->storage;
+            /*TODO: handle different page sizes*/
+            uint32_t addr = (s->addr >> 10) * 528 + (s->addr & 0x3ff);
+            DPRINTF("we read %X\n", bytes[addr + s->cmd_len - 9]);
+
+            return bytes[addr + s->cmd_len - 9];
+        }
+
+        return 0;
+    case 0xD7:
+        spi_flash_reset_state(s);
+        DPRINTF("return id\n");
+        return (1 << 2) | (1 << 3) | (1 << 5) | (1 << 7);
+    default:
+        DPRINTF("Unknown cmd\n");
+        return 0;
+    }
+}
+
+int spi_flash_register(BlockDriverState *bs, unsigned int len,
+                       SPIControl *spi_control)
+{
+    SPIFlash *spi_flash;
+    int ret = 0;
+
+    spi_flash =  qemu_mallocz(sizeof(SPIFlash));
+    spi_control->opaque = spi_flash;
+    spi_control->txrx_callback = spi_flash_txrx;
+    spi_control->set_chipselect = spi_flash_set_chipselect;
+
+    spi_flash_reset_state(spi_flash);
+    spi_flash->storage = qemu_malloc(len);
+    spi_flash->len = len;
+    spi_flash->bs = bs;
+    if (spi_flash->bs) {
+        ret = bdrv_read(spi_flash->bs, 0, spi_flash->storage, len >> 9);
+        if (ret < 0) {
+            qemu_free(spi_flash->storage);
+            qemu_free(spi_flash);
+            goto out;
+        }
+    }
+out:
+    return ret;
+}