fix stack buffer overflows in eepro100.c tx
[qemu/cris-port.git] / hw / eeprom93xx.c
blob66dfc43d50048d6c77dcff57491b74ee7ff2217c
1 /*
2 * QEMU EEPROM 93xx emulation
4 * Copyright (c) 2006-2007 Stefan Weil
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 /* Emulation for serial EEPROMs:
21 * NMC93C06 256-Bit (16 x 16)
22 * NMC93C46 1024-Bit (64 x 16)
23 * NMC93C56 2028 Bit (128 x 16)
24 * NMC93C66 4096 Bit (256 x 16)
25 * Compatible devices include FM93C46 and others.
27 * Other drivers use these interface functions:
28 * eeprom93xx_new - add a new EEPROM (with 16, 64 or 256 words)
29 * eeprom93xx_free - destroy EEPROM
30 * eeprom93xx_read - read data from the EEPROM
31 * eeprom93xx_write - write data to the EEPROM
32 * eeprom93xx_data - get EEPROM data array for external manipulation
34 * Todo list:
35 * - No emulation of EEPROM timings.
38 #include "hw.h"
39 #include "eeprom93xx.h"
41 /* Debug EEPROM emulation. */
42 //~ #define DEBUG_EEPROM
44 #ifdef DEBUG_EEPROM
45 #define logout(fmt, ...) fprintf(stderr, "EEPROM\t%-24s" fmt, __func__, ## __VA_ARGS__)
46 #else
47 #define logout(fmt, ...) ((void)0)
48 #endif
50 #define EEPROM_INSTANCE 0
51 #define OLD_EEPROM_VERSION 20061112
52 #define EEPROM_VERSION (OLD_EEPROM_VERSION + 1)
54 #if 0
55 typedef enum {
56 eeprom_read = 0x80, /* read register xx */
57 eeprom_write = 0x40, /* write register xx */
58 eeprom_erase = 0xc0, /* erase register xx */
59 eeprom_ewen = 0x30, /* erase / write enable */
60 eeprom_ewds = 0x00, /* erase / write disable */
61 eeprom_eral = 0x20, /* erase all registers */
62 eeprom_wral = 0x10, /* write all registers */
63 eeprom_amask = 0x0f,
64 eeprom_imask = 0xf0
65 } eeprom_instruction_t;
66 #endif
68 #ifdef DEBUG_EEPROM
69 static const char *opstring[] = {
70 "extended", "write", "read", "erase"
72 #endif
74 struct _eeprom_t {
75 uint8_t tick;
76 uint8_t address;
77 uint8_t command;
78 uint8_t writeable;
80 uint8_t eecs;
81 uint8_t eesk;
82 uint8_t eedo;
84 uint8_t addrbits;
85 uint16_t size;
86 uint16_t data;
87 uint16_t contents[0];
90 /* Code for saving and restoring of EEPROM state. */
92 static void eeprom_save(QEMUFile *f, void *opaque)
94 /* Save EEPROM data. */
95 unsigned address;
96 eeprom_t *eeprom = (eeprom_t *)opaque;
98 qemu_put_byte(f, eeprom->tick);
99 qemu_put_byte(f, eeprom->address);
100 qemu_put_byte(f, eeprom->command);
101 qemu_put_byte(f, eeprom->writeable);
103 qemu_put_byte(f, eeprom->eecs);
104 qemu_put_byte(f, eeprom->eesk);
105 qemu_put_byte(f, eeprom->eedo);
107 qemu_put_byte(f, eeprom->addrbits);
108 qemu_put_be16(f, eeprom->size);
109 qemu_put_be16(f, eeprom->data);
110 for (address = 0; address < eeprom->size; address++) {
111 qemu_put_be16(f, eeprom->contents[address]);
115 static int eeprom_load(QEMUFile *f, void *opaque, int version_id)
117 /* Load EEPROM data from saved data if version and EEPROM size
118 of data and current EEPROM are identical. */
119 eeprom_t *eeprom = (eeprom_t *)opaque;
120 int result = -EINVAL;
121 if (version_id >= OLD_EEPROM_VERSION) {
122 unsigned address;
123 int size = eeprom->size;
125 eeprom->tick = qemu_get_byte(f);
126 eeprom->address = qemu_get_byte(f);
127 eeprom->command = qemu_get_byte(f);
128 eeprom->writeable = qemu_get_byte(f);
130 eeprom->eecs = qemu_get_byte(f);
131 eeprom->eesk = qemu_get_byte(f);
132 eeprom->eedo = qemu_get_byte(f);
134 eeprom->addrbits = qemu_get_byte(f);
135 if (version_id == OLD_EEPROM_VERSION) {
136 eeprom->size = qemu_get_byte(f);
137 qemu_get_byte(f);
138 } else {
139 eeprom->size = qemu_get_be16(f);
142 if (eeprom->size == size) {
143 eeprom->data = qemu_get_be16(f);
144 for (address = 0; address < eeprom->size; address++) {
145 eeprom->contents[address] = qemu_get_be16(f);
147 result = 0;
150 return result;
153 void eeprom93xx_write(eeprom_t *eeprom, int eecs, int eesk, int eedi)
155 uint8_t tick = eeprom->tick;
156 uint8_t eedo = eeprom->eedo;
157 uint16_t address = eeprom->address;
158 uint8_t command = eeprom->command;
160 logout("CS=%u SK=%u DI=%u DO=%u, tick = %u\n",
161 eecs, eesk, eedi, eedo, tick);
163 if (! eeprom->eecs && eecs) {
164 /* Start chip select cycle. */
165 logout("Cycle start, waiting for 1st start bit (0)\n");
166 tick = 0;
167 command = 0x0;
168 address = 0x0;
169 } else if (eeprom->eecs && ! eecs) {
170 /* End chip select cycle. This triggers write / erase. */
171 if (eeprom->writeable) {
172 uint8_t subcommand = address >> (eeprom->addrbits - 2);
173 if (command == 0 && subcommand == 2) {
174 /* Erase all. */
175 for (address = 0; address < eeprom->size; address++) {
176 eeprom->contents[address] = 0xffff;
178 } else if (command == 3) {
179 /* Erase word. */
180 eeprom->contents[address] = 0xffff;
181 } else if (tick >= 2 + 2 + eeprom->addrbits + 16) {
182 if (command == 1) {
183 /* Write word. */
184 eeprom->contents[address] &= eeprom->data;
185 } else if (command == 0 && subcommand == 1) {
186 /* Write all. */
187 for (address = 0; address < eeprom->size; address++) {
188 eeprom->contents[address] &= eeprom->data;
193 /* Output DO is tristate, read results in 1. */
194 eedo = 1;
195 } else if (eecs && ! eeprom->eesk && eesk) {
196 /* Raising edge of clock shifts data in. */
197 if (tick == 0) {
198 /* Wait for 1st start bit. */
199 if (eedi == 0) {
200 logout("Got correct 1st start bit, waiting for 2nd start bit (1)\n");
201 tick++;
202 } else {
203 logout("wrong 1st start bit (is 1, should be 0)\n");
204 tick = 2;
205 //~ assert(!"wrong start bit");
207 } else if (tick == 1) {
208 /* Wait for 2nd start bit. */
209 if (eedi != 0) {
210 logout("Got correct 2nd start bit, getting command + address\n");
211 tick++;
212 } else {
213 logout("1st start bit is longer than needed\n");
215 } else if (tick < 2 + 2) {
216 /* Got 2 start bits, transfer 2 opcode bits. */
217 tick++;
218 command <<= 1;
219 if (eedi) {
220 command += 1;
222 } else if (tick < 2 + 2 + eeprom->addrbits) {
223 /* Got 2 start bits and 2 opcode bits, transfer all address bits. */
224 tick++;
225 address = ((address << 1) | eedi);
226 if (tick == 2 + 2 + eeprom->addrbits) {
227 logout("%s command, address = 0x%02x (value 0x%04x)\n",
228 opstring[command], address, eeprom->contents[address]);
229 if (command == 2) {
230 eedo = 0;
232 address = address % eeprom->size;
233 if (command == 0) {
234 /* Command code in upper 2 bits of address. */
235 switch (address >> (eeprom->addrbits - 2)) {
236 case 0:
237 logout("write disable command\n");
238 eeprom->writeable = 0;
239 break;
240 case 1:
241 logout("write all command\n");
242 break;
243 case 2:
244 logout("erase all command\n");
245 break;
246 case 3:
247 logout("write enable command\n");
248 eeprom->writeable = 1;
249 break;
251 } else {
252 /* Read, write or erase word. */
253 eeprom->data = eeprom->contents[address];
256 } else if (tick < 2 + 2 + eeprom->addrbits + 16) {
257 /* Transfer 16 data bits. */
258 tick++;
259 if (command == 2) {
260 /* Read word. */
261 eedo = ((eeprom->data & 0x8000) != 0);
263 eeprom->data <<= 1;
264 eeprom->data += eedi;
265 } else {
266 logout("additional unneeded tick, not processed\n");
269 /* Save status of EEPROM. */
270 eeprom->tick = tick;
271 eeprom->eecs = eecs;
272 eeprom->eesk = eesk;
273 eeprom->eedo = eedo;
274 eeprom->address = address;
275 eeprom->command = command;
278 uint16_t eeprom93xx_read(eeprom_t *eeprom)
280 /* Return status of pin DO (0 or 1). */
281 logout("CS=%u DO=%u\n", eeprom->eecs, eeprom->eedo);
282 return (eeprom->eedo);
285 #if 0
286 void eeprom93xx_reset(eeprom_t *eeprom)
288 /* prepare eeprom */
289 logout("eeprom = 0x%p\n", eeprom);
290 eeprom->tick = 0;
291 eeprom->command = 0;
293 #endif
295 eeprom_t *eeprom93xx_new(uint16_t nwords)
297 /* Add a new EEPROM (with 16, 64 or 256 words). */
298 eeprom_t *eeprom;
299 uint8_t addrbits;
301 switch (nwords) {
302 case 16:
303 case 64:
304 addrbits = 6;
305 break;
306 case 128:
307 case 256:
308 addrbits = 8;
309 break;
310 default:
311 assert(!"Unsupported EEPROM size, fallback to 64 words!");
312 nwords = 64;
313 addrbits = 6;
316 eeprom = (eeprom_t *)qemu_mallocz(sizeof(*eeprom) + nwords * 2);
317 eeprom->size = nwords;
318 eeprom->addrbits = addrbits;
319 /* Output DO is tristate, read results in 1. */
320 eeprom->eedo = 1;
321 logout("eeprom = 0x%p, nwords = %u\n", eeprom, nwords);
322 register_savevm("eeprom", EEPROM_INSTANCE, EEPROM_VERSION,
323 eeprom_save, eeprom_load, eeprom);
324 return eeprom;
327 void eeprom93xx_free(eeprom_t *eeprom)
329 /* Destroy EEPROM. */
330 logout("eeprom = 0x%p\n", eeprom);
331 unregister_savevm("eeprom", eeprom);
332 qemu_free(eeprom);
335 uint16_t *eeprom93xx_data(eeprom_t *eeprom)
337 /* Get EEPROM data array. */
338 return &eeprom->contents[0];
341 /* eof */