Disable preadv/pwritev support
[qemu-kvm/fedora.git] / hw / pflash_cfi01.c
blobbfa2bdd97be288153e24f415acfc0db1230dd3f4
1 /*
2 * CFI parallel flash with Intel command set emulation
4 * Copyright (c) 2006 Thorsten Zitterell
5 * Copyright (c) 2005 Jocelyn Mayer
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
22 * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
23 * Supported commands/modes are:
24 * - flash read
25 * - flash write
26 * - flash ID read
27 * - sector erase
28 * - CFI queries
30 * It does not support timings
31 * It does not support flash interleaving
32 * It does not implement software data protection as found in many real chips
33 * It does not implement erase suspend/resume commands
34 * It does not implement multiple sectors erase
36 * It does not implement much more ...
39 #include "hw.h"
40 #include "flash.h"
41 #include "block.h"
42 #include "qemu-timer.h"
44 #define PFLASH_BUG(fmt, ...) \
45 do { \
46 printf("PFLASH: Possible BUG - " fmt, ## __VA_ARGS__); \
47 exit(1); \
48 } while(0)
50 /* #define PFLASH_DEBUG */
51 #ifdef PFLASH_DEBUG
52 #define DPRINTF(fmt, ...) \
53 do { \
54 printf("PFLASH: " fmt , ## __VA_ARGS__); \
55 } while (0)
56 #else
57 #define DPRINTF(fmt, ...) do { } while (0)
58 #endif
60 struct pflash_t {
61 BlockDriverState *bs;
62 target_phys_addr_t base;
63 target_phys_addr_t sector_len;
64 target_phys_addr_t total_len;
65 int width;
66 int wcycle; /* if 0, the flash is read normally */
67 int bypass;
68 int ro;
69 uint8_t cmd;
70 uint8_t status;
71 uint16_t ident[4];
72 uint8_t cfi_len;
73 uint8_t cfi_table[0x52];
74 target_phys_addr_t counter;
75 QEMUTimer *timer;
76 ram_addr_t off;
77 int fl_mem;
78 void *storage;
81 static void pflash_timer (void *opaque)
83 pflash_t *pfl = opaque;
85 DPRINTF("%s: command %02x done\n", __func__, pfl->cmd);
86 /* Reset flash */
87 pfl->status ^= 0x80;
88 if (pfl->bypass) {
89 pfl->wcycle = 2;
90 } else {
91 cpu_register_physical_memory(pfl->base, pfl->total_len,
92 pfl->off | IO_MEM_ROMD | pfl->fl_mem);
93 pfl->wcycle = 0;
95 pfl->cmd = 0;
98 static uint32_t pflash_read (pflash_t *pfl, target_phys_addr_t offset,
99 int width)
101 target_phys_addr_t boff;
102 uint32_t ret;
103 uint8_t *p;
105 ret = -1;
106 boff = offset & 0xFF; /* why this here ?? */
108 if (pfl->width == 2)
109 boff = boff >> 1;
110 else if (pfl->width == 4)
111 boff = boff >> 2;
113 DPRINTF("%s: reading offset " TARGET_FMT_lx " under cmd %02x width %d\n",
114 __func__, offset, pfl->cmd, width);
116 switch (pfl->cmd) {
117 case 0x00:
118 /* Flash area read */
119 p = pfl->storage;
120 switch (width) {
121 case 1:
122 ret = p[offset];
123 DPRINTF("%s: data offset " TARGET_FMT_lx " %02x\n",
124 __func__, offset, ret);
125 break;
126 case 2:
127 #if defined(TARGET_WORDS_BIGENDIAN)
128 ret = p[offset] << 8;
129 ret |= p[offset + 1];
130 #else
131 ret = p[offset];
132 ret |= p[offset + 1] << 8;
133 #endif
134 DPRINTF("%s: data offset " TARGET_FMT_lx " %04x\n",
135 __func__, offset, ret);
136 break;
137 case 4:
138 #if defined(TARGET_WORDS_BIGENDIAN)
139 ret = p[offset] << 24;
140 ret |= p[offset + 1] << 16;
141 ret |= p[offset + 2] << 8;
142 ret |= p[offset + 3];
143 #else
144 ret = p[offset];
145 ret |= p[offset + 1] << 8;
146 ret |= p[offset + 1] << 8;
147 ret |= p[offset + 2] << 16;
148 ret |= p[offset + 3] << 24;
149 #endif
150 DPRINTF("%s: data offset " TARGET_FMT_lx " %08x\n",
151 __func__, offset, ret);
152 break;
153 default:
154 DPRINTF("BUG in %s\n", __func__);
157 break;
158 case 0x20: /* Block erase */
159 case 0x50: /* Clear status register */
160 case 0x60: /* Block /un)lock */
161 case 0x70: /* Status Register */
162 case 0xe8: /* Write block */
163 /* Status register read */
164 ret = pfl->status;
165 DPRINTF("%s: status %x\n", __func__, ret);
166 break;
167 case 0x98: /* Query mode */
168 if (boff > pfl->cfi_len)
169 ret = 0;
170 else
171 ret = pfl->cfi_table[boff];
172 break;
173 default:
174 /* This should never happen : reset state & treat it as a read */
175 DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);
176 pfl->wcycle = 0;
177 pfl->cmd = 0;
179 return ret;
182 /* update flash content on disk */
183 static void pflash_update(pflash_t *pfl, int offset,
184 int size)
186 int offset_end;
187 if (pfl->bs) {
188 offset_end = offset + size;
189 /* round to sectors */
190 offset = offset >> 9;
191 offset_end = (offset_end + 511) >> 9;
192 bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),
193 offset_end - offset);
197 static void inline pflash_data_write(pflash_t *pfl, target_phys_addr_t offset,
198 uint32_t value, int width)
200 uint8_t *p = pfl->storage;
202 DPRINTF("%s: block write offset " TARGET_FMT_lx
203 " value %x counter " TARGET_FMT_lx "\n",
204 __func__, offset, value, pfl->counter);
205 switch (width) {
206 case 1:
207 p[offset] = value;
208 pflash_update(pfl, offset, 1);
209 break;
210 case 2:
211 #if defined(TARGET_WORDS_BIGENDIAN)
212 p[offset] = value >> 8;
213 p[offset + 1] = value;
214 #else
215 p[offset] = value;
216 p[offset + 1] = value >> 8;
217 #endif
218 pflash_update(pfl, offset, 2);
219 break;
220 case 4:
221 #if defined(TARGET_WORDS_BIGENDIAN)
222 p[offset] = value >> 24;
223 p[offset + 1] = value >> 16;
224 p[offset + 2] = value >> 8;
225 p[offset + 3] = value;
226 #else
227 p[offset] = value;
228 p[offset + 1] = value >> 8;
229 p[offset + 2] = value >> 16;
230 p[offset + 3] = value >> 24;
231 #endif
232 pflash_update(pfl, offset, 4);
233 break;
238 static void pflash_write(pflash_t *pfl, target_phys_addr_t offset,
239 uint32_t value, int width)
241 target_phys_addr_t boff;
242 uint8_t *p;
243 uint8_t cmd;
245 cmd = value;
247 DPRINTF("%s: writing offset " TARGET_FMT_lx " value %08x width %d wcycle 0x%x\n",
248 __func__, offset, value, width, pfl->wcycle);
250 /* Set the device in I/O access mode */
251 cpu_register_physical_memory(pfl->base, pfl->total_len, pfl->fl_mem);
252 boff = offset & (pfl->sector_len - 1);
254 if (pfl->width == 2)
255 boff = boff >> 1;
256 else if (pfl->width == 4)
257 boff = boff >> 2;
259 switch (pfl->wcycle) {
260 case 0:
261 /* read mode */
262 switch (cmd) {
263 case 0x00: /* ??? */
264 goto reset_flash;
265 case 0x10: /* Single Byte Program */
266 case 0x40: /* Single Byte Program */
267 DPRINTF(stderr, "%s: Single Byte Program\n", __func__);
268 break;
269 case 0x20: /* Block erase */
270 p = pfl->storage;
271 offset &= ~(pfl->sector_len - 1);
273 DPRINTF("%s: block erase at " TARGET_FMT_lx " bytes "
274 TARGET_FMT_lx "\n",
275 __func__, offset, pfl->sector_len);
277 memset(p + offset, 0xff, pfl->sector_len);
278 pflash_update(pfl, offset, pfl->sector_len);
279 pfl->status |= 0x80; /* Ready! */
280 break;
281 case 0x50: /* Clear status bits */
282 DPRINTF("%s: Clear status bits\n", __func__);
283 pfl->status = 0x0;
284 goto reset_flash;
285 case 0x60: /* Block (un)lock */
286 DPRINTF("%s: Block unlock\n", __func__);
287 break;
288 case 0x70: /* Status Register */
289 DPRINTF("%s: Read status register\n", __func__);
290 pfl->cmd = cmd;
291 return;
292 case 0x98: /* CFI query */
293 DPRINTF("%s: CFI query\n", __func__);
294 break;
295 case 0xe8: /* Write to buffer */
296 DPRINTF("%s: Write to buffer\n", __func__);
297 pfl->status |= 0x80; /* Ready! */
298 break;
299 case 0xff: /* Read array mode */
300 DPRINTF("%s: Read array mode\n", __func__);
301 goto reset_flash;
302 default:
303 goto error_flash;
305 pfl->wcycle++;
306 pfl->cmd = cmd;
307 return;
308 case 1:
309 switch (pfl->cmd) {
310 case 0x10: /* Single Byte Program */
311 case 0x40: /* Single Byte Program */
312 DPRINTF("%s: Single Byte Program\n", __func__);
313 pflash_data_write(pfl, offset, value, width);
314 pfl->status |= 0x80; /* Ready! */
315 pfl->wcycle = 0;
316 break;
317 case 0x20: /* Block erase */
318 case 0x28:
319 if (cmd == 0xd0) { /* confirm */
320 pfl->wcycle = 0;
321 pfl->status |= 0x80;
322 } else if (cmd == 0xff) { /* read array mode */
323 goto reset_flash;
324 } else
325 goto error_flash;
327 break;
328 case 0xe8:
329 DPRINTF("%s: block write of %x bytes\n", __func__, value);
330 pfl->counter = value;
331 pfl->wcycle++;
332 break;
333 case 0x60:
334 if (cmd == 0xd0) {
335 pfl->wcycle = 0;
336 pfl->status |= 0x80;
337 } else if (cmd == 0x01) {
338 pfl->wcycle = 0;
339 pfl->status |= 0x80;
340 } else if (cmd == 0xff) {
341 goto reset_flash;
342 } else {
343 DPRINTF("%s: Unknown (un)locking command\n", __func__);
344 goto reset_flash;
346 break;
347 case 0x98:
348 if (cmd == 0xff) {
349 goto reset_flash;
350 } else {
351 DPRINTF("%s: leaving query mode\n", __func__);
353 break;
354 default:
355 goto error_flash;
357 return;
358 case 2:
359 switch (pfl->cmd) {
360 case 0xe8: /* Block write */
361 pflash_data_write(pfl, offset, value, width);
363 pfl->status |= 0x80;
365 if (!pfl->counter) {
366 DPRINTF("%s: block write finished\n", __func__);
367 pfl->wcycle++;
370 pfl->counter--;
371 break;
372 default:
373 goto error_flash;
375 return;
376 case 3: /* Confirm mode */
377 switch (pfl->cmd) {
378 case 0xe8: /* Block write */
379 if (cmd == 0xd0) {
380 pfl->wcycle = 0;
381 pfl->status |= 0x80;
382 } else {
383 DPRINTF("%s: unknown command for \"write block\"\n", __func__);
384 PFLASH_BUG("Write block confirm");
385 goto reset_flash;
387 break;
388 default:
389 goto error_flash;
391 return;
392 default:
393 /* Should never happen */
394 DPRINTF("%s: invalid write state\n", __func__);
395 goto reset_flash;
397 return;
399 error_flash:
400 printf("%s: Unimplemented flash cmd sequence "
401 "(offset " TARGET_FMT_plx ", wcycle 0x%x cmd 0x%x value 0x%x)\n",
402 __func__, offset, pfl->wcycle, pfl->cmd, value);
404 reset_flash:
405 cpu_register_physical_memory(pfl->base, pfl->total_len,
406 pfl->off | IO_MEM_ROMD | pfl->fl_mem);
408 pfl->bypass = 0;
409 pfl->wcycle = 0;
410 pfl->cmd = 0;
411 return;
415 static uint32_t pflash_readb (void *opaque, target_phys_addr_t addr)
417 return pflash_read(opaque, addr, 1);
420 static uint32_t pflash_readw (void *opaque, target_phys_addr_t addr)
422 pflash_t *pfl = opaque;
424 return pflash_read(pfl, addr, 2);
427 static uint32_t pflash_readl (void *opaque, target_phys_addr_t addr)
429 pflash_t *pfl = opaque;
431 return pflash_read(pfl, addr, 4);
434 static void pflash_writeb (void *opaque, target_phys_addr_t addr,
435 uint32_t value)
437 pflash_write(opaque, addr, value, 1);
440 static void pflash_writew (void *opaque, target_phys_addr_t addr,
441 uint32_t value)
443 pflash_t *pfl = opaque;
445 pflash_write(pfl, addr, value, 2);
448 static void pflash_writel (void *opaque, target_phys_addr_t addr,
449 uint32_t value)
451 pflash_t *pfl = opaque;
453 pflash_write(pfl, addr, value, 4);
456 static CPUWriteMemoryFunc *pflash_write_ops[] = {
457 &pflash_writeb,
458 &pflash_writew,
459 &pflash_writel,
462 static CPUReadMemoryFunc *pflash_read_ops[] = {
463 &pflash_readb,
464 &pflash_readw,
465 &pflash_readl,
468 /* Count trailing zeroes of a 32 bits quantity */
469 static int ctz32 (uint32_t n)
471 int ret;
473 ret = 0;
474 if (!(n & 0xFFFF)) {
475 ret += 16;
476 n = n >> 16;
478 if (!(n & 0xFF)) {
479 ret += 8;
480 n = n >> 8;
482 if (!(n & 0xF)) {
483 ret += 4;
484 n = n >> 4;
486 if (!(n & 0x3)) {
487 ret += 2;
488 n = n >> 2;
490 if (!(n & 0x1)) {
491 ret++;
492 n = n >> 1;
494 #if 0 /* This is not necessary as n is never 0 */
495 if (!n)
496 ret++;
497 #endif
499 return ret;
502 pflash_t *pflash_cfi01_register(target_phys_addr_t base, ram_addr_t off,
503 BlockDriverState *bs, uint32_t sector_len,
504 int nb_blocs, int width,
505 uint16_t id0, uint16_t id1,
506 uint16_t id2, uint16_t id3)
508 pflash_t *pfl;
509 target_phys_addr_t total_len;
511 total_len = sector_len * nb_blocs;
513 /* XXX: to be fixed */
514 #if 0
515 if (total_len != (8 * 1024 * 1024) && total_len != (16 * 1024 * 1024) &&
516 total_len != (32 * 1024 * 1024) && total_len != (64 * 1024 * 1024))
517 return NULL;
518 #endif
520 pfl = qemu_mallocz(sizeof(pflash_t));
522 /* FIXME: Allocate ram ourselves. */
523 pfl->storage = qemu_get_ram_ptr(off);
524 pfl->fl_mem = cpu_register_io_memory(
525 pflash_read_ops, pflash_write_ops, pfl);
526 pfl->off = off;
527 cpu_register_physical_memory(base, total_len,
528 off | pfl->fl_mem | IO_MEM_ROMD);
530 pfl->bs = bs;
531 if (pfl->bs) {
532 /* read the initial flash content */
533 bdrv_read(pfl->bs, 0, pfl->storage, total_len >> 9);
535 #if 0 /* XXX: there should be a bit to set up read-only,
536 * the same way the hardware does (with WP pin).
538 pfl->ro = 1;
539 #else
540 pfl->ro = 0;
541 #endif
542 pfl->timer = qemu_new_timer(vm_clock, pflash_timer, pfl);
543 pfl->base = base;
544 pfl->sector_len = sector_len;
545 pfl->total_len = total_len;
546 pfl->width = width;
547 pfl->wcycle = 0;
548 pfl->cmd = 0;
549 pfl->status = 0;
550 pfl->ident[0] = id0;
551 pfl->ident[1] = id1;
552 pfl->ident[2] = id2;
553 pfl->ident[3] = id3;
554 /* Hardcoded CFI table */
555 pfl->cfi_len = 0x52;
556 /* Standard "QRY" string */
557 pfl->cfi_table[0x10] = 'Q';
558 pfl->cfi_table[0x11] = 'R';
559 pfl->cfi_table[0x12] = 'Y';
560 /* Command set (Intel) */
561 pfl->cfi_table[0x13] = 0x01;
562 pfl->cfi_table[0x14] = 0x00;
563 /* Primary extended table address (none) */
564 pfl->cfi_table[0x15] = 0x31;
565 pfl->cfi_table[0x16] = 0x00;
566 /* Alternate command set (none) */
567 pfl->cfi_table[0x17] = 0x00;
568 pfl->cfi_table[0x18] = 0x00;
569 /* Alternate extended table (none) */
570 pfl->cfi_table[0x19] = 0x00;
571 pfl->cfi_table[0x1A] = 0x00;
572 /* Vcc min */
573 pfl->cfi_table[0x1B] = 0x45;
574 /* Vcc max */
575 pfl->cfi_table[0x1C] = 0x55;
576 /* Vpp min (no Vpp pin) */
577 pfl->cfi_table[0x1D] = 0x00;
578 /* Vpp max (no Vpp pin) */
579 pfl->cfi_table[0x1E] = 0x00;
580 /* Reserved */
581 pfl->cfi_table[0x1F] = 0x07;
582 /* Timeout for min size buffer write */
583 pfl->cfi_table[0x20] = 0x07;
584 /* Typical timeout for block erase */
585 pfl->cfi_table[0x21] = 0x0a;
586 /* Typical timeout for full chip erase (4096 ms) */
587 pfl->cfi_table[0x22] = 0x00;
588 /* Reserved */
589 pfl->cfi_table[0x23] = 0x04;
590 /* Max timeout for buffer write */
591 pfl->cfi_table[0x24] = 0x04;
592 /* Max timeout for block erase */
593 pfl->cfi_table[0x25] = 0x04;
594 /* Max timeout for chip erase */
595 pfl->cfi_table[0x26] = 0x00;
596 /* Device size */
597 pfl->cfi_table[0x27] = ctz32(total_len); // + 1;
598 /* Flash device interface (8 & 16 bits) */
599 pfl->cfi_table[0x28] = 0x02;
600 pfl->cfi_table[0x29] = 0x00;
601 /* Max number of bytes in multi-bytes write */
602 pfl->cfi_table[0x2A] = 0x0B;
603 pfl->cfi_table[0x2B] = 0x00;
604 /* Number of erase block regions (uniform) */
605 pfl->cfi_table[0x2C] = 0x01;
606 /* Erase block region 1 */
607 pfl->cfi_table[0x2D] = nb_blocs - 1;
608 pfl->cfi_table[0x2E] = (nb_blocs - 1) >> 8;
609 pfl->cfi_table[0x2F] = sector_len >> 8;
610 pfl->cfi_table[0x30] = sector_len >> 16;
612 /* Extended */
613 pfl->cfi_table[0x31] = 'P';
614 pfl->cfi_table[0x32] = 'R';
615 pfl->cfi_table[0x33] = 'I';
617 pfl->cfi_table[0x34] = '1';
618 pfl->cfi_table[0x35] = '1';
620 pfl->cfi_table[0x36] = 0x00;
621 pfl->cfi_table[0x37] = 0x00;
622 pfl->cfi_table[0x38] = 0x00;
623 pfl->cfi_table[0x39] = 0x00;
625 pfl->cfi_table[0x3a] = 0x00;
627 pfl->cfi_table[0x3b] = 0x00;
628 pfl->cfi_table[0x3c] = 0x00;
630 return pfl;