Fix typo that leads to out of bounds array access on big endian systems
[qemu/mini2440.git] / hw / eeprom93xx.c
blobae15a7f6362df615d9ed4e4d7dd184aa8f9a0f37
1 /*
2 * QEMU EEPROM 93xx emulation
4 * Copyright (c) 2006-2007 Stefan Weil
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
21 /* Emulation for serial EEPROMs:
22 * NMC93C06 256-Bit (16 x 16)
23 * NMC93C46 1024-Bit (64 x 16)
24 * NMC93C56 2028 Bit (128 x 16)
25 * NMC93C66 4096 Bit (256 x 16)
26 * Compatible devices include FM93C46 and others.
28 * Other drivers use these interface functions:
29 * eeprom93xx_new - add a new EEPROM (with 16, 64 or 256 words)
30 * eeprom93xx_free - destroy EEPROM
31 * eeprom93xx_read - read data from the EEPROM
32 * eeprom93xx_write - write data to the EEPROM
33 * eeprom93xx_data - get EEPROM data array for external manipulation
35 * Todo list:
36 * - No emulation of EEPROM timings.
39 #include <assert.h>
40 #include "hw.h"
41 #include "eeprom93xx.h"
43 /* Debug EEPROM emulation. */
44 //~ #define DEBUG_EEPROM
46 #ifdef DEBUG_EEPROM
47 #define logout(fmt, args...) fprintf(stderr, "EEPROM\t%-24s" fmt, __func__, ##args)
48 #else
49 #define logout(fmt, args...) ((void)0)
50 #endif
52 #define EEPROM_INSTANCE 0
53 #define OLD_EEPROM_VERSION 20061112
54 #define EEPROM_VERSION (OLD_EEPROM_VERSION + 1)
56 #if 0
57 typedef enum {
58 eeprom_read = 0x80, /* read register xx */
59 eeprom_write = 0x40, /* write register xx */
60 eeprom_erase = 0xc0, /* erase register xx */
61 eeprom_ewen = 0x30, /* erase / write enable */
62 eeprom_ewds = 0x00, /* erase / write disable */
63 eeprom_eral = 0x20, /* erase all registers */
64 eeprom_wral = 0x10, /* write all registers */
65 eeprom_amask = 0x0f,
66 eeprom_imask = 0xf0
67 } eeprom_instruction_t;
68 #endif
70 #ifdef DEBUG_EEPROM
71 static const char *opstring[] = {
72 "extended", "write", "read", "erase"
74 #endif
76 struct _eeprom_t {
77 uint8_t tick;
78 uint8_t address;
79 uint8_t command;
80 uint8_t writeable;
82 uint8_t eecs;
83 uint8_t eesk;
84 uint8_t eedo;
86 uint8_t addrbits;
87 uint16_t size;
88 uint16_t data;
89 uint16_t contents[0];
92 /* Code for saving and restoring of EEPROM state. */
94 static void eeprom_save(QEMUFile *f, void *opaque)
96 /* Save EEPROM data. */
97 unsigned address;
98 eeprom_t *eeprom = (eeprom_t *)opaque;
100 qemu_put_byte(f, eeprom->tick);
101 qemu_put_byte(f, eeprom->address);
102 qemu_put_byte(f, eeprom->command);
103 qemu_put_byte(f, eeprom->writeable);
105 qemu_put_byte(f, eeprom->eecs);
106 qemu_put_byte(f, eeprom->eesk);
107 qemu_put_byte(f, eeprom->eedo);
109 qemu_put_byte(f, eeprom->addrbits);
110 qemu_put_be16(f, eeprom->size);
111 qemu_put_be16(f, eeprom->data);
112 for (address = 0; address < eeprom->size; address++) {
113 qemu_put_be16(f, eeprom->contents[address]);
117 static int eeprom_load(QEMUFile *f, void *opaque, int version_id)
119 /* Load EEPROM data from saved data if version and EEPROM size
120 of data and current EEPROM are identical. */
121 eeprom_t *eeprom = (eeprom_t *)opaque;
122 int result = -EINVAL;
123 if (version_id >= OLD_EEPROM_VERSION) {
124 unsigned address;
125 int size = eeprom->size;
127 eeprom->tick = qemu_get_byte(f);
128 eeprom->address = qemu_get_byte(f);
129 eeprom->command = qemu_get_byte(f);
130 eeprom->writeable = qemu_get_byte(f);
132 eeprom->eecs = qemu_get_byte(f);
133 eeprom->eesk = qemu_get_byte(f);
134 eeprom->eedo = qemu_get_byte(f);
136 eeprom->addrbits = qemu_get_byte(f);
137 if (version_id == OLD_EEPROM_VERSION) {
138 eeprom->size = qemu_get_byte(f);
139 qemu_get_byte(f);
140 } else {
141 eeprom->size = qemu_get_be16(f);
144 if (eeprom->size == size) {
145 eeprom->data = qemu_get_be16(f);
146 for (address = 0; address < eeprom->size; address++) {
147 eeprom->contents[address] = qemu_get_be16(f);
149 result = 0;
152 return result;
155 void eeprom93xx_write(eeprom_t *eeprom, int eecs, int eesk, int eedi)
157 uint8_t tick = eeprom->tick;
158 uint8_t eedo = eeprom->eedo;
159 uint16_t address = eeprom->address;
160 uint8_t command = eeprom->command;
162 logout("CS=%u SK=%u DI=%u DO=%u, tick = %u\n",
163 eecs, eesk, eedi, eedo, tick);
165 if (! eeprom->eecs && eecs) {
166 /* Start chip select cycle. */
167 logout("Cycle start, waiting for 1st start bit (0)\n");
168 tick = 0;
169 command = 0x0;
170 address = 0x0;
171 } else if (eeprom->eecs && ! eecs) {
172 /* End chip select cycle. This triggers write / erase. */
173 if (eeprom->writeable) {
174 uint8_t subcommand = address >> (eeprom->addrbits - 2);
175 if (command == 0 && subcommand == 2) {
176 /* Erase all. */
177 for (address = 0; address < eeprom->size; address++) {
178 eeprom->contents[address] = 0xffff;
180 } else if (command == 3) {
181 /* Erase word. */
182 eeprom->contents[address] = 0xffff;
183 } else if (tick >= 2 + 2 + eeprom->addrbits + 16) {
184 if (command == 1) {
185 /* Write word. */
186 eeprom->contents[address] &= eeprom->data;
187 } else if (command == 0 && subcommand == 1) {
188 /* Write all. */
189 for (address = 0; address < eeprom->size; address++) {
190 eeprom->contents[address] &= eeprom->data;
195 /* Output DO is tristate, read results in 1. */
196 eedo = 1;
197 } else if (eecs && ! eeprom->eesk && eesk) {
198 /* Raising edge of clock shifts data in. */
199 if (tick == 0) {
200 /* Wait for 1st start bit. */
201 if (eedi == 0) {
202 logout("Got correct 1st start bit, waiting for 2nd start bit (1)\n");
203 tick++;
204 } else {
205 logout("wrong 1st start bit (is 1, should be 0)\n");
206 tick = 2;
207 //~ assert(!"wrong start bit");
209 } else if (tick == 1) {
210 /* Wait for 2nd start bit. */
211 if (eedi != 0) {
212 logout("Got correct 2nd start bit, getting command + address\n");
213 tick++;
214 } else {
215 logout("1st start bit is longer than needed\n");
217 } else if (tick < 2 + 2) {
218 /* Got 2 start bits, transfer 2 opcode bits. */
219 tick++;
220 command <<= 1;
221 if (eedi) {
222 command += 1;
224 } else if (tick < 2 + 2 + eeprom->addrbits) {
225 /* Got 2 start bits and 2 opcode bits, transfer all address bits. */
226 tick++;
227 address = ((address << 1) | eedi);
228 if (tick == 2 + 2 + eeprom->addrbits) {
229 logout("%s command, address = 0x%02x (value 0x%04x)\n",
230 opstring[command], address, eeprom->contents[address]);
231 if (command == 2) {
232 eedo = 0;
234 address = address % eeprom->size;
235 if (command == 0) {
236 /* Command code in upper 2 bits of address. */
237 switch (address >> (eeprom->addrbits - 2)) {
238 case 0:
239 logout("write disable command\n");
240 eeprom->writeable = 0;
241 break;
242 case 1:
243 logout("write all command\n");
244 break;
245 case 2:
246 logout("erase all command\n");
247 break;
248 case 3:
249 logout("write enable command\n");
250 eeprom->writeable = 1;
251 break;
253 } else {
254 /* Read, write or erase word. */
255 eeprom->data = eeprom->contents[address];
258 } else if (tick < 2 + 2 + eeprom->addrbits + 16) {
259 /* Transfer 16 data bits. */
260 tick++;
261 if (command == 2) {
262 /* Read word. */
263 eedo = ((eeprom->data & 0x8000) != 0);
265 eeprom->data <<= 1;
266 eeprom->data += eedi;
267 } else {
268 logout("additional unneeded tick, not processed\n");
271 /* Save status of EEPROM. */
272 eeprom->tick = tick;
273 eeprom->eecs = eecs;
274 eeprom->eesk = eesk;
275 eeprom->eedo = eedo;
276 eeprom->address = address;
277 eeprom->command = command;
280 uint16_t eeprom93xx_read(eeprom_t *eeprom)
282 /* Return status of pin DO (0 or 1). */
283 logout("CS=%u DO=%u\n", eeprom->eecs, eeprom->eedo);
284 return (eeprom->eedo);
287 #if 0
288 void eeprom93xx_reset(eeprom_t *eeprom)
290 /* prepare eeprom */
291 logout("eeprom = 0x%p\n", eeprom);
292 eeprom->tick = 0;
293 eeprom->command = 0;
295 #endif
297 eeprom_t *eeprom93xx_new(uint16_t nwords)
299 /* Add a new EEPROM (with 16, 64 or 256 words). */
300 eeprom_t *eeprom;
301 uint8_t addrbits;
303 switch (nwords) {
304 case 16:
305 case 64:
306 addrbits = 6;
307 break;
308 case 128:
309 case 256:
310 addrbits = 8;
311 break;
312 default:
313 assert(!"Unsupported EEPROM size, fallback to 64 words!");
314 nwords = 64;
315 addrbits = 6;
318 eeprom = (eeprom_t *)qemu_mallocz(sizeof(*eeprom) + nwords * 2);
319 eeprom->size = nwords;
320 eeprom->addrbits = addrbits;
321 /* Output DO is tristate, read results in 1. */
322 eeprom->eedo = 1;
323 logout("eeprom = 0x%p, nwords = %u\n", eeprom, nwords);
324 register_savevm("eeprom", EEPROM_INSTANCE, EEPROM_VERSION,
325 eeprom_save, eeprom_load, eeprom);
326 return eeprom;
329 void eeprom93xx_free(eeprom_t *eeprom)
331 /* Destroy EEPROM. */
332 logout("eeprom = 0x%p\n", eeprom);
333 qemu_free(eeprom);
336 uint16_t *eeprom93xx_data(eeprom_t *eeprom)
338 /* Get EEPROM data array. */
339 return &eeprom->contents[0];
342 /* eof */