Merge branch 'upstream-merge'
[qemu-kvm/markmc.git] / hw / pflash_cfi01.c
blobdfdced97b01236d98d9b6851e87bd03581fc347c
1 /*
2 * CFI parallel flash with Intel command set emulation
4 * Copyright (c) 2006 Thorsten Zitterell
5 * Copyright (c) 2005 Jocelyn Mayer
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
22 * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
23 * Supported commands/modes are:
24 * - flash read
25 * - flash write
26 * - flash ID read
27 * - sector erase
28 * - CFI queries
30 * It does not support timings
31 * It does not support flash interleaving
32 * It does not implement software data protection as found in many real chips
33 * It does not implement erase suspend/resume commands
34 * It does not implement multiple sectors erase
36 * It does not implement much more ...
39 #include "hw.h"
40 #include "flash.h"
41 #include "block.h"
42 #include "qemu-timer.h"
44 #define PFLASH_BUG(fmt, ...) \
45 do { \
46 printf("PFLASH: Possible BUG - " fmt, ## __VA_ARGS__); \
47 exit(1); \
48 } while(0)
50 /* #define PFLASH_DEBUG */
51 #ifdef PFLASH_DEBUG
52 #define DPRINTF(fmt, ...) \
53 do { \
54 printf("PFLASH: " fmt , ## __VA_ARGS__); \
55 } while (0)
56 #else
57 #define DPRINTF(fmt, ...) do { } while (0)
58 #endif
60 struct pflash_t {
61 BlockDriverState *bs;
62 target_phys_addr_t base;
63 target_phys_addr_t sector_len;
64 target_phys_addr_t total_len;
65 int width;
66 int wcycle; /* if 0, the flash is read normally */
67 int bypass;
68 int ro;
69 uint8_t cmd;
70 uint8_t status;
71 uint16_t ident[4];
72 uint8_t cfi_len;
73 uint8_t cfi_table[0x52];
74 target_phys_addr_t counter;
75 QEMUTimer *timer;
76 ram_addr_t off;
77 int fl_mem;
78 void *storage;
81 static void pflash_timer (void *opaque)
83 pflash_t *pfl = opaque;
85 DPRINTF("%s: command %02x done\n", __func__, pfl->cmd);
86 /* Reset flash */
87 pfl->status ^= 0x80;
88 if (pfl->bypass) {
89 pfl->wcycle = 2;
90 } else {
91 cpu_register_physical_memory(pfl->base, pfl->total_len,
92 pfl->off | IO_MEM_ROMD | pfl->fl_mem);
93 pfl->wcycle = 0;
95 pfl->cmd = 0;
98 static uint32_t pflash_read (pflash_t *pfl, target_phys_addr_t offset,
99 int width)
101 target_phys_addr_t boff;
102 uint32_t ret;
103 uint8_t *p;
105 ret = -1;
106 boff = offset & 0xFF; /* why this here ?? */
108 if (pfl->width == 2)
109 boff = boff >> 1;
110 else if (pfl->width == 4)
111 boff = boff >> 2;
113 #if 0
114 DPRINTF("%s: reading offset " TARGET_FMT_plx " under cmd %02x width %d\n",
115 __func__, offset, pfl->cmd, width);
116 #endif
117 switch (pfl->cmd) {
118 case 0x00:
119 /* Flash area read */
120 p = pfl->storage;
121 switch (width) {
122 case 1:
123 ret = p[offset];
124 DPRINTF("%s: data offset " TARGET_FMT_plx " %02x\n",
125 __func__, offset, ret);
126 break;
127 case 2:
128 #if defined(TARGET_WORDS_BIGENDIAN)
129 ret = p[offset] << 8;
130 ret |= p[offset + 1];
131 #else
132 ret = p[offset];
133 ret |= p[offset + 1] << 8;
134 #endif
135 DPRINTF("%s: data offset " TARGET_FMT_plx " %04x\n",
136 __func__, offset, ret);
137 break;
138 case 4:
139 #if defined(TARGET_WORDS_BIGENDIAN)
140 ret = p[offset] << 24;
141 ret |= p[offset + 1] << 16;
142 ret |= p[offset + 2] << 8;
143 ret |= p[offset + 3];
144 #else
145 ret = p[offset];
146 ret |= p[offset + 1] << 8;
147 ret |= p[offset + 1] << 8;
148 ret |= p[offset + 2] << 16;
149 ret |= p[offset + 3] << 24;
150 #endif
151 DPRINTF("%s: data offset " TARGET_FMT_plx " %08x\n",
152 __func__, offset, ret);
153 break;
154 default:
155 DPRINTF("BUG in %s\n", __func__);
158 break;
159 case 0x20: /* Block erase */
160 case 0x50: /* Clear status register */
161 case 0x60: /* Block /un)lock */
162 case 0x70: /* Status Register */
163 case 0xe8: /* Write block */
164 /* Status register read */
165 ret = pfl->status;
166 DPRINTF("%s: status %x\n", __func__, ret);
167 break;
168 case 0x98: /* Query mode */
169 if (boff > pfl->cfi_len)
170 ret = 0;
171 else
172 ret = pfl->cfi_table[boff];
173 break;
174 default:
175 /* This should never happen : reset state & treat it as a read */
176 DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);
177 pfl->wcycle = 0;
178 pfl->cmd = 0;
180 return ret;
183 /* update flash content on disk */
184 static void pflash_update(pflash_t *pfl, int offset,
185 int size)
187 int offset_end;
188 if (pfl->bs) {
189 offset_end = offset + size;
190 /* round to sectors */
191 offset = offset >> 9;
192 offset_end = (offset_end + 511) >> 9;
193 bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),
194 offset_end - offset);
198 static inline void pflash_data_write(pflash_t *pfl, target_phys_addr_t offset,
199 uint32_t value, int width)
201 uint8_t *p = pfl->storage;
203 DPRINTF("%s: block write offset " TARGET_FMT_plx
204 " value %x counter " TARGET_FMT_plx "\n",
205 __func__, offset, value, pfl->counter);
206 switch (width) {
207 case 1:
208 p[offset] = value;
209 pflash_update(pfl, offset, 1);
210 break;
211 case 2:
212 #if defined(TARGET_WORDS_BIGENDIAN)
213 p[offset] = value >> 8;
214 p[offset + 1] = value;
215 #else
216 p[offset] = value;
217 p[offset + 1] = value >> 8;
218 #endif
219 pflash_update(pfl, offset, 2);
220 break;
221 case 4:
222 #if defined(TARGET_WORDS_BIGENDIAN)
223 p[offset] = value >> 24;
224 p[offset + 1] = value >> 16;
225 p[offset + 2] = value >> 8;
226 p[offset + 3] = value;
227 #else
228 p[offset] = value;
229 p[offset + 1] = value >> 8;
230 p[offset + 2] = value >> 16;
231 p[offset + 3] = value >> 24;
232 #endif
233 pflash_update(pfl, offset, 4);
234 break;
239 static void pflash_write(pflash_t *pfl, target_phys_addr_t offset,
240 uint32_t value, int width)
242 target_phys_addr_t boff;
243 uint8_t *p;
244 uint8_t cmd;
246 cmd = value;
248 DPRINTF("%s: writing offset " TARGET_FMT_plx " value %08x width %d wcycle 0x%x\n",
249 __func__, offset, value, width, pfl->wcycle);
251 /* Set the device in I/O access mode */
252 cpu_register_physical_memory(pfl->base, pfl->total_len, pfl->fl_mem);
253 boff = offset & (pfl->sector_len - 1);
255 if (pfl->width == 2)
256 boff = boff >> 1;
257 else if (pfl->width == 4)
258 boff = boff >> 2;
260 switch (pfl->wcycle) {
261 case 0:
262 /* read mode */
263 switch (cmd) {
264 case 0x00: /* ??? */
265 goto reset_flash;
266 case 0x10: /* Single Byte Program */
267 case 0x40: /* Single Byte Program */
268 DPRINTF("%s: Single Byte Program\n", __func__);
269 break;
270 case 0x20: /* Block erase */
271 p = pfl->storage;
272 offset &= ~(pfl->sector_len - 1);
274 DPRINTF("%s: block erase at " TARGET_FMT_plx " bytes "
275 TARGET_FMT_plx "\n",
276 __func__, offset, pfl->sector_len);
278 memset(p + offset, 0xff, pfl->sector_len);
279 pflash_update(pfl, offset, pfl->sector_len);
280 pfl->status |= 0x80; /* Ready! */
281 break;
282 case 0x50: /* Clear status bits */
283 DPRINTF("%s: Clear status bits\n", __func__);
284 pfl->status = 0x0;
285 goto reset_flash;
286 case 0x60: /* Block (un)lock */
287 DPRINTF("%s: Block unlock\n", __func__);
288 break;
289 case 0x70: /* Status Register */
290 DPRINTF("%s: Read status register\n", __func__);
291 pfl->cmd = cmd;
292 return;
293 case 0x98: /* CFI query */
294 DPRINTF("%s: CFI query\n", __func__);
295 break;
296 case 0xe8: /* Write to buffer */
297 DPRINTF("%s: Write to buffer\n", __func__);
298 pfl->status |= 0x80; /* Ready! */
299 break;
300 case 0xff: /* Read array mode */
301 DPRINTF("%s: Read array mode\n", __func__);
302 goto reset_flash;
303 default:
304 goto error_flash;
306 pfl->wcycle++;
307 pfl->cmd = cmd;
308 return;
309 case 1:
310 switch (pfl->cmd) {
311 case 0x10: /* Single Byte Program */
312 case 0x40: /* Single Byte Program */
313 DPRINTF("%s: Single Byte Program\n", __func__);
314 pflash_data_write(pfl, offset, value, width);
315 pfl->status |= 0x80; /* Ready! */
316 pfl->wcycle = 0;
317 break;
318 case 0x20: /* Block erase */
319 case 0x28:
320 if (cmd == 0xd0) { /* confirm */
321 pfl->wcycle = 0;
322 pfl->status |= 0x80;
323 } else if (cmd == 0xff) { /* read array mode */
324 goto reset_flash;
325 } else
326 goto error_flash;
328 break;
329 case 0xe8:
330 DPRINTF("%s: block write of %x bytes\n", __func__, value);
331 pfl->counter = value;
332 pfl->wcycle++;
333 break;
334 case 0x60:
335 if (cmd == 0xd0) {
336 pfl->wcycle = 0;
337 pfl->status |= 0x80;
338 } else if (cmd == 0x01) {
339 pfl->wcycle = 0;
340 pfl->status |= 0x80;
341 } else if (cmd == 0xff) {
342 goto reset_flash;
343 } else {
344 DPRINTF("%s: Unknown (un)locking command\n", __func__);
345 goto reset_flash;
347 break;
348 case 0x98:
349 if (cmd == 0xff) {
350 goto reset_flash;
351 } else {
352 DPRINTF("%s: leaving query mode\n", __func__);
354 break;
355 default:
356 goto error_flash;
358 return;
359 case 2:
360 switch (pfl->cmd) {
361 case 0xe8: /* Block write */
362 pflash_data_write(pfl, offset, value, width);
364 pfl->status |= 0x80;
366 if (!pfl->counter) {
367 DPRINTF("%s: block write finished\n", __func__);
368 pfl->wcycle++;
371 pfl->counter--;
372 break;
373 default:
374 goto error_flash;
376 return;
377 case 3: /* Confirm mode */
378 switch (pfl->cmd) {
379 case 0xe8: /* Block write */
380 if (cmd == 0xd0) {
381 pfl->wcycle = 0;
382 pfl->status |= 0x80;
383 } else {
384 DPRINTF("%s: unknown command for \"write block\"\n", __func__);
385 PFLASH_BUG("Write block confirm");
386 goto reset_flash;
388 break;
389 default:
390 goto error_flash;
392 return;
393 default:
394 /* Should never happen */
395 DPRINTF("%s: invalid write state\n", __func__);
396 goto reset_flash;
398 return;
400 error_flash:
401 printf("%s: Unimplemented flash cmd sequence "
402 "(offset " TARGET_FMT_plx ", wcycle 0x%x cmd 0x%x value 0x%x)\n",
403 __func__, offset, pfl->wcycle, pfl->cmd, value);
405 reset_flash:
406 cpu_register_physical_memory(pfl->base, pfl->total_len,
407 pfl->off | IO_MEM_ROMD | pfl->fl_mem);
409 pfl->bypass = 0;
410 pfl->wcycle = 0;
411 pfl->cmd = 0;
412 return;
416 static uint32_t pflash_readb (void *opaque, target_phys_addr_t addr)
418 return pflash_read(opaque, addr, 1);
421 static uint32_t pflash_readw (void *opaque, target_phys_addr_t addr)
423 pflash_t *pfl = opaque;
425 return pflash_read(pfl, addr, 2);
428 static uint32_t pflash_readl (void *opaque, target_phys_addr_t addr)
430 pflash_t *pfl = opaque;
432 return pflash_read(pfl, addr, 4);
435 static void pflash_writeb (void *opaque, target_phys_addr_t addr,
436 uint32_t value)
438 pflash_write(opaque, addr, value, 1);
441 static void pflash_writew (void *opaque, target_phys_addr_t addr,
442 uint32_t value)
444 pflash_t *pfl = opaque;
446 pflash_write(pfl, addr, value, 2);
449 static void pflash_writel (void *opaque, target_phys_addr_t addr,
450 uint32_t value)
452 pflash_t *pfl = opaque;
454 pflash_write(pfl, addr, value, 4);
457 static CPUWriteMemoryFunc * const pflash_write_ops[] = {
458 &pflash_writeb,
459 &pflash_writew,
460 &pflash_writel,
463 static CPUReadMemoryFunc * const pflash_read_ops[] = {
464 &pflash_readb,
465 &pflash_readw,
466 &pflash_readl,
469 /* Count trailing zeroes of a 32 bits quantity */
470 static int ctz32 (uint32_t n)
472 int ret;
474 ret = 0;
475 if (!(n & 0xFFFF)) {
476 ret += 16;
477 n = n >> 16;
479 if (!(n & 0xFF)) {
480 ret += 8;
481 n = n >> 8;
483 if (!(n & 0xF)) {
484 ret += 4;
485 n = n >> 4;
487 if (!(n & 0x3)) {
488 ret += 2;
489 n = n >> 2;
491 if (!(n & 0x1)) {
492 ret++;
493 n = n >> 1;
495 #if 0 /* This is not necessary as n is never 0 */
496 if (!n)
497 ret++;
498 #endif
500 return ret;
503 pflash_t *pflash_cfi01_register(target_phys_addr_t base, ram_addr_t off,
504 BlockDriverState *bs, uint32_t sector_len,
505 int nb_blocs, int width,
506 uint16_t id0, uint16_t id1,
507 uint16_t id2, uint16_t id3)
509 pflash_t *pfl;
510 target_phys_addr_t total_len;
511 int ret;
513 total_len = sector_len * nb_blocs;
515 /* XXX: to be fixed */
516 #if 0
517 if (total_len != (8 * 1024 * 1024) && total_len != (16 * 1024 * 1024) &&
518 total_len != (32 * 1024 * 1024) && total_len != (64 * 1024 * 1024))
519 return NULL;
520 #endif
522 pfl = qemu_mallocz(sizeof(pflash_t));
524 /* FIXME: Allocate ram ourselves. */
525 pfl->storage = qemu_get_ram_ptr(off);
526 pfl->fl_mem = cpu_register_io_memory(
527 pflash_read_ops, pflash_write_ops, pfl);
528 pfl->off = off;
529 cpu_register_physical_memory(base, total_len,
530 off | pfl->fl_mem | IO_MEM_ROMD);
532 pfl->bs = bs;
533 if (pfl->bs) {
534 /* read the initial flash content */
535 ret = bdrv_read(pfl->bs, 0, pfl->storage, total_len >> 9);
536 if (ret < 0) {
537 cpu_unregister_io_memory(pfl->fl_mem);
538 qemu_free(pfl);
539 return NULL;
542 #if 0 /* XXX: there should be a bit to set up read-only,
543 * the same way the hardware does (with WP pin).
545 pfl->ro = 1;
546 #else
547 pfl->ro = 0;
548 #endif
549 pfl->timer = qemu_new_timer(vm_clock, pflash_timer, pfl);
550 pfl->base = base;
551 pfl->sector_len = sector_len;
552 pfl->total_len = total_len;
553 pfl->width = width;
554 pfl->wcycle = 0;
555 pfl->cmd = 0;
556 pfl->status = 0;
557 pfl->ident[0] = id0;
558 pfl->ident[1] = id1;
559 pfl->ident[2] = id2;
560 pfl->ident[3] = id3;
561 /* Hardcoded CFI table */
562 pfl->cfi_len = 0x52;
563 /* Standard "QRY" string */
564 pfl->cfi_table[0x10] = 'Q';
565 pfl->cfi_table[0x11] = 'R';
566 pfl->cfi_table[0x12] = 'Y';
567 /* Command set (Intel) */
568 pfl->cfi_table[0x13] = 0x01;
569 pfl->cfi_table[0x14] = 0x00;
570 /* Primary extended table address (none) */
571 pfl->cfi_table[0x15] = 0x31;
572 pfl->cfi_table[0x16] = 0x00;
573 /* Alternate command set (none) */
574 pfl->cfi_table[0x17] = 0x00;
575 pfl->cfi_table[0x18] = 0x00;
576 /* Alternate extended table (none) */
577 pfl->cfi_table[0x19] = 0x00;
578 pfl->cfi_table[0x1A] = 0x00;
579 /* Vcc min */
580 pfl->cfi_table[0x1B] = 0x45;
581 /* Vcc max */
582 pfl->cfi_table[0x1C] = 0x55;
583 /* Vpp min (no Vpp pin) */
584 pfl->cfi_table[0x1D] = 0x00;
585 /* Vpp max (no Vpp pin) */
586 pfl->cfi_table[0x1E] = 0x00;
587 /* Reserved */
588 pfl->cfi_table[0x1F] = 0x07;
589 /* Timeout for min size buffer write */
590 pfl->cfi_table[0x20] = 0x07;
591 /* Typical timeout for block erase */
592 pfl->cfi_table[0x21] = 0x0a;
593 /* Typical timeout for full chip erase (4096 ms) */
594 pfl->cfi_table[0x22] = 0x00;
595 /* Reserved */
596 pfl->cfi_table[0x23] = 0x04;
597 /* Max timeout for buffer write */
598 pfl->cfi_table[0x24] = 0x04;
599 /* Max timeout for block erase */
600 pfl->cfi_table[0x25] = 0x04;
601 /* Max timeout for chip erase */
602 pfl->cfi_table[0x26] = 0x00;
603 /* Device size */
604 pfl->cfi_table[0x27] = ctz32(total_len); // + 1;
605 /* Flash device interface (8 & 16 bits) */
606 pfl->cfi_table[0x28] = 0x02;
607 pfl->cfi_table[0x29] = 0x00;
608 /* Max number of bytes in multi-bytes write */
609 pfl->cfi_table[0x2A] = 0x0B;
610 pfl->cfi_table[0x2B] = 0x00;
611 /* Number of erase block regions (uniform) */
612 pfl->cfi_table[0x2C] = 0x01;
613 /* Erase block region 1 */
614 pfl->cfi_table[0x2D] = nb_blocs - 1;
615 pfl->cfi_table[0x2E] = (nb_blocs - 1) >> 8;
616 pfl->cfi_table[0x2F] = sector_len >> 8;
617 pfl->cfi_table[0x30] = sector_len >> 16;
619 /* Extended */
620 pfl->cfi_table[0x31] = 'P';
621 pfl->cfi_table[0x32] = 'R';
622 pfl->cfi_table[0x33] = 'I';
624 pfl->cfi_table[0x34] = '1';
625 pfl->cfi_table[0x35] = '1';
627 pfl->cfi_table[0x36] = 0x00;
628 pfl->cfi_table[0x37] = 0x00;
629 pfl->cfi_table[0x38] = 0x00;
630 pfl->cfi_table[0x39] = 0x00;
632 pfl->cfi_table[0x3a] = 0x00;
634 pfl->cfi_table[0x3b] = 0x00;
635 pfl->cfi_table[0x3c] = 0x00;
637 return pfl;