hw/pflash_cfi02.c

   1 /*
   2  *  CFI parallel flash with AMD command set emulation
   3  *
   4  *  Copyright (c) 2005 Jocelyn Mayer
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20
  21 /*
  22  * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
  23  * Supported commands/modes are:
  24  * - flash read
  25  * - flash write
  26  * - flash ID read
  27  * - sector erase
  28  * - chip erase
  29  * - unlock bypass command
  30  * - CFI queries
  31  *
  32  * It does not support flash interleaving.
  33  * It does not implement boot blocs with reduced size
  34  * It does not implement software data protection as found in many real chips
  35  * It does not implement erase suspend/resume commands
  36  * It does not implement multiple sectors erase
  37  */
  38
  39 #include "vl.h"
  40
  41 //#define PFLASH_DEBUG
  42 #ifdef PFLASH_DEBUG
  43 #define DPRINTF(fmt, args...)                      \
  44 do {                                               \
  45         printf("PFLASH: " fmt , ##args);           \
  46 } while (0)
  47 #else
  48 #define DPRINTF(fmt, args...) do { } while (0)
  49 #endif
  50
  51 struct pflash_t {
  52     BlockDriverState *bs;
  53     target_phys_addr_t base;
  54     uint32_t sector_len;
  55     uint32_t total_len;
  56     int width;
  57     int wcycle; /* if 0, the flash is read normally */
  58     int bypass;
  59     int ro;
  60     uint8_t cmd;
  61     uint8_t status;
  62     uint16_t ident[4];
  63     uint8_t cfi_len;
  64     uint8_t cfi_table[0x52];
  65     QEMUTimer *timer;
  66     ram_addr_t off;
  67     int fl_mem;
  68     void *storage;
  69 };
  70
  71 static void pflash_timer (void *opaque)
  72 {
  73     pflash_t *pfl = opaque;
  74
  75     DPRINTF("%s: command %02x done\n", __func__, pfl->cmd);
  76     /* Reset flash */
  77     pfl->status ^= 0x80;
  78     if (pfl->bypass) {
  79         pfl->wcycle = 2;
  80     } else {
  81         cpu_register_physical_memory(pfl->base, pfl->total_len,
  82                                      pfl->off | IO_MEM_ROMD | pfl->fl_mem);
  83         pfl->wcycle = 0;
  84     }
  85     pfl->cmd = 0;
  86 }
  87
  88 static uint32_t pflash_read (pflash_t *pfl, uint32_t offset, int width)
  89 {
  90     uint32_t boff;
  91     uint32_t ret;
  92     uint8_t *p;
  93
  94     DPRINTF("%s: offset " TARGET_FMT_lx "\n", __func__, offset);
  95     ret = -1;
  96     offset -= pfl->base;
  97     boff = offset & 0xFF;
  98     if (pfl->width == 2)
  99         boff = boff >> 1;
 100     else if (pfl->width == 4)
 101         boff = boff >> 2;
 102     switch (pfl->cmd) {
 103     default:
 104         /* This should never happen : reset state & treat it as a read*/
 105         DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);
 106         pfl->wcycle = 0;
 107         pfl->cmd = 0;
 108     case 0x80:
 109         /* We accept reads during second unlock sequence... */
 110     case 0x00:
 111     flash_read:
 112         /* Flash area read */
 113         p = pfl->storage;
 114         switch (width) {
 115         case 1:
 116             ret = p[offset];
 117 //            DPRINTF("%s: data offset %08x %02x\n", __func__, offset, ret);
 118             break;
 119         case 2:
 120 #if defined(TARGET_WORDS_BIGENDIAN)
 121             ret = p[offset] << 8;
 122             ret |= p[offset + 1];
 123 #else
 124             ret = p[offset];
 125             ret |= p[offset + 1] << 8;
 126 #endif
 127 //            DPRINTF("%s: data offset %08x %04x\n", __func__, offset, ret);
 128             break;
 129         case 4:
 130 #if defined(TARGET_WORDS_BIGENDIAN)
 131             ret = p[offset] << 24;
 132             ret |= p[offset + 1] << 16;
 133             ret |= p[offset + 2] << 8;
 134             ret |= p[offset + 3];
 135 #else
 136             ret = p[offset];
 137             ret |= p[offset + 1] << 8;
 138             ret |= p[offset + 2] << 16;
 139             ret |= p[offset + 3] << 24;
 140 #endif
 141 //            DPRINTF("%s: data offset %08x %08x\n", __func__, offset, ret);
 142             break;
 143         }
 144         break;
 145     case 0x90:
 146         /* flash ID read */
 147         switch (boff) {
 148         case 0x00:
 149         case 0x01:
 150             ret = pfl->ident[boff & 0x01];
 151             break;
 152         case 0x02:
 153             ret = 0x00; /* Pretend all sectors are unprotected */
 154             break;
 155         case 0x0E:
 156         case 0x0F:
 157             if (pfl->ident[2 + (boff & 0x01)] == (uint8_t)-1)
 158                 goto flash_read;
 159             ret = pfl->ident[2 + (boff & 0x01)];
 160             break;
 161         default:
 162             goto flash_read;
 163         }
 164         DPRINTF("%s: ID " TARGET_FMT_ld " %x\n", __func__, boff, ret);
 165         break;
 166     case 0xA0:
 167     case 0x10:
 168     case 0x30:
 169         /* Status register read */
 170         ret = pfl->status;
 171         DPRINTF("%s: status %x\n", __func__, ret);
 172         /* Toggle bit 6 */
 173         pfl->status ^= 0x40;
 174         break;
 175     case 0x98:
 176         /* CFI query mode */
 177         if (boff > pfl->cfi_len)
 178             ret = 0;
 179         else
 180             ret = pfl->cfi_table[boff];
 181         break;
 182     }
 183
 184     return ret;
 185 }
 186
 187 /* update flash content on disk */
 188 static void pflash_update(pflash_t *pfl, int offset,
 189                           int size)
 190 {
 191     int offset_end;
 192     if (pfl->bs) {
 193         offset_end = offset + size;
 194         /* round to sectors */
 195         offset = offset >> 9;
 196         offset_end = (offset_end + 511) >> 9;
 197         bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),
 198                    offset_end - offset);
 199     }
 200 }
 201
 202 static void pflash_write (pflash_t *pfl, uint32_t offset, uint32_t value,
 203                           int width)
 204 {
 205     uint32_t boff;
 206     uint8_t *p;
 207     uint8_t cmd;
 208
 209     /* WARNING: when the memory area is in ROMD mode, the offset is a
 210        ram offset, not a physical address */
 211     cmd = value;
 212     if (pfl->cmd != 0xA0 && cmd == 0xF0) {
 213 #if 0
 214         DPRINTF("%s: flash reset asked (%02x %02x)\n",
 215                 __func__, pfl->cmd, cmd);
 216 #endif
 217         goto reset_flash;
 218     }
 219     DPRINTF("%s: offset " TARGET_FMT_lx " %08x %d %d\n", __func__,
 220             offset, value, width, pfl->wcycle);
 221     if (pfl->wcycle == 0)
 222         offset -= (uint32_t)(long)pfl->storage;
 223     else
 224         offset -= pfl->base;
 225
 226     DPRINTF("%s: offset " TARGET_FMT_lx " %08x %d\n", __func__,
 227             offset, value, width);
 228     /* Set the device in I/O access mode */
 229     cpu_register_physical_memory(pfl->base, pfl->total_len, pfl->fl_mem);
 230     boff = offset & (pfl->sector_len - 1);
 231     if (pfl->width == 2)
 232         boff = boff >> 1;
 233     else if (pfl->width == 4)
 234         boff = boff >> 2;
 235     switch (pfl->wcycle) {
 236     case 0:
 237         /* We're in read mode */
 238     check_unlock0:
 239         if (boff == 0x55 && cmd == 0x98) {
 240         enter_CFI_mode:
 241             /* Enter CFI query mode */
 242             pfl->wcycle = 7;
 243             pfl->cmd = 0x98;
 244             return;
 245         }
 246         if (boff != 0x555 || cmd != 0xAA) {
 247             DPRINTF("%s: unlock0 failed " TARGET_FMT_lx " %02x %04x\n",
 248                     __func__, boff, cmd, 0x555);
 249             goto reset_flash;
 250         }
 251         DPRINTF("%s: unlock sequence started\n", __func__);
 252         break;
 253     case 1:
 254         /* We started an unlock sequence */
 255     check_unlock1:
 256         if (boff != 0x2AA || cmd != 0x55) {
 257             DPRINTF("%s: unlock1 failed " TARGET_FMT_lx " %02x\n", __func__,
 258                     boff, cmd);
 259             goto reset_flash;
 260         }
 261         DPRINTF("%s: unlock sequence done\n", __func__);
 262         break;
 263     case 2:
 264         /* We finished an unlock sequence */
 265         if (!pfl->bypass && boff != 0x555) {
 266             DPRINTF("%s: command failed " TARGET_FMT_lx " %02x\n", __func__,
 267                     boff, cmd);
 268             goto reset_flash;
 269         }
 270         switch (cmd) {
 271         case 0x20:
 272             pfl->bypass = 1;
 273             goto do_bypass;
 274         case 0x80:
 275         case 0x90:
 276         case 0xA0:
 277             pfl->cmd = cmd;
 278             DPRINTF("%s: starting command %02x\n", __func__, cmd);
 279             break;
 280         default:
 281             DPRINTF("%s: unknown command %02x\n", __func__, cmd);
 282             goto reset_flash;
 283         }
 284         break;
 285     case 3:
 286         switch (pfl->cmd) {
 287         case 0x80:
 288             /* We need another unlock sequence */
 289             goto check_unlock0;
 290         case 0xA0:
 291             DPRINTF("%s: write data offset " TARGET_FMT_lx " %08x %d\n",
 292                     __func__, offset, value, width);
 293             p = pfl->storage;
 294             switch (width) {
 295             case 1:
 296                 p[offset] &= value;
 297                 pflash_update(pfl, offset, 1);
 298                 break;
 299             case 2:
 300 #if defined(TARGET_WORDS_BIGENDIAN)
 301                 p[offset] &= value >> 8;
 302                 p[offset + 1] &= value;
 303 #else
 304                 p[offset] &= value;
 305                 p[offset + 1] &= value >> 8;
 306 #endif
 307                 pflash_update(pfl, offset, 2);
 308                 break;
 309             case 4:
 310 #if defined(TARGET_WORDS_BIGENDIAN)
 311                 p[offset] &= value >> 24;
 312                 p[offset + 1] &= value >> 16;
 313                 p[offset + 2] &= value >> 8;
 314                 p[offset + 3] &= value;
 315 #else
 316                 p[offset] &= value;
 317                 p[offset + 1] &= value >> 8;
 318                 p[offset + 2] &= value >> 16;
 319                 p[offset + 3] &= value >> 24;
 320 #endif
 321                 pflash_update(pfl, offset, 4);
 322                 break;
 323             }
 324             pfl->status = 0x00 | ~(value & 0x80);
 325             /* Let's pretend write is immediate */
 326             if (pfl->bypass)
 327                 goto do_bypass;
 328             goto reset_flash;
 329         case 0x90:
 330             if (pfl->bypass && cmd == 0x00) {
 331                 /* Unlock bypass reset */
 332                 goto reset_flash;
 333             }
 334             /* We can enter CFI query mode from autoselect mode */
 335             if (boff == 0x55 && cmd == 0x98)
 336                 goto enter_CFI_mode;
 337             /* No break here */
 338         default:
 339             DPRINTF("%s: invalid write for command %02x\n",
 340                     __func__, pfl->cmd);
 341             goto reset_flash;
 342         }
 343     case 4:
 344         switch (pfl->cmd) {
 345         case 0xA0:
 346             /* Ignore writes while flash data write is occuring */
 347             /* As we suppose write is immediate, this should never happen */
 348             return;
 349         case 0x80:
 350             goto check_unlock1;
 351         default:
 352             /* Should never happen */
 353             DPRINTF("%s: invalid command state %02x (wc 4)\n",
 354                     __func__, pfl->cmd);
 355             goto reset_flash;
 356         }
 357         break;
 358     case 5:
 359         switch (cmd) {
 360         case 0x10:
 361             if (boff != 0x555) {
 362                 DPRINTF("%s: chip erase: invalid address " TARGET_FMT_lx "\n",
 363                         __func__, offset);
 364                 goto reset_flash;
 365             }
 366             /* Chip erase */
 367             DPRINTF("%s: start chip erase\n", __func__);
 368             memset(pfl->storage, 0xFF, pfl->total_len);
 369             pfl->status = 0x00;
 370             pflash_update(pfl, 0, pfl->total_len);
 371             /* Let's wait 5 seconds before chip erase is done */
 372             qemu_mod_timer(pfl->timer,
 373                            qemu_get_clock(vm_clock) + (ticks_per_sec * 5));
 374             break;
 375         case 0x30:
 376             /* Sector erase */
 377             p = pfl->storage;
 378             offset &= ~(pfl->sector_len - 1);
 379             DPRINTF("%s: start sector erase at " TARGET_FMT_lx "\n", __func__,
 380                     offset);
 381             memset(p + offset, 0xFF, pfl->sector_len);
 382             pflash_update(pfl, offset, pfl->sector_len);
 383             pfl->status = 0x00;
 384             /* Let's wait 1/2 second before sector erase is done */
 385             qemu_mod_timer(pfl->timer,
 386                            qemu_get_clock(vm_clock) + (ticks_per_sec / 2));
 387             break;
 388         default:
 389             DPRINTF("%s: invalid command %02x (wc 5)\n", __func__, cmd);
 390             goto reset_flash;
 391         }
 392         pfl->cmd = cmd;
 393         break;
 394     case 6:
 395         switch (pfl->cmd) {
 396         case 0x10:
 397             /* Ignore writes during chip erase */
 398             return;
 399         case 0x30:
 400             /* Ignore writes during sector erase */
 401             return;
 402         default:
 403             /* Should never happen */
 404             DPRINTF("%s: invalid command state %02x (wc 6)\n",
 405                     __func__, pfl->cmd);
 406             goto reset_flash;
 407         }
 408         break;
 409     case 7: /* Special value for CFI queries */
 410         DPRINTF("%s: invalid write in CFI query mode\n", __func__);
 411         goto reset_flash;
 412     default:
 413         /* Should never happen */
 414         DPRINTF("%s: invalid write state (wc 7)\n",  __func__);
 415         goto reset_flash;
 416     }
 417     pfl->wcycle++;
 418
 419     return;
 420
 421     /* Reset flash */
 422  reset_flash:
 423     cpu_register_physical_memory(pfl->base, pfl->total_len,
 424                                  pfl->off | IO_MEM_ROMD | pfl->fl_mem);
 425     pfl->bypass = 0;
 426     pfl->wcycle = 0;
 427     pfl->cmd = 0;
 428     return;
 429
 430  do_bypass:
 431     pfl->wcycle = 2;
 432     pfl->cmd = 0;
 433     return;
 434 }
 435
 436
 437 static uint32_t pflash_readb (void *opaque, target_phys_addr_t addr)
 438 {
 439     return pflash_read(opaque, addr, 1);
 440 }
 441
 442 static uint32_t pflash_readw (void *opaque, target_phys_addr_t addr)
 443 {
 444     pflash_t *pfl = opaque;
 445
 446     return pflash_read(pfl, addr, 2);
 447 }
 448
 449 static uint32_t pflash_readl (void *opaque, target_phys_addr_t addr)
 450 {
 451     pflash_t *pfl = opaque;
 452
 453     return pflash_read(pfl, addr, 4);
 454 }
 455
 456 static void pflash_writeb (void *opaque, target_phys_addr_t addr,
 457                            uint32_t value)
 458 {
 459     pflash_write(opaque, addr, value, 1);
 460 }
 461
 462 static void pflash_writew (void *opaque, target_phys_addr_t addr,
 463                            uint32_t value)
 464 {
 465     pflash_t *pfl = opaque;
 466
 467     pflash_write(pfl, addr, value, 2);
 468 }
 469
 470 static void pflash_writel (void *opaque, target_phys_addr_t addr,
 471                            uint32_t value)
 472 {
 473     pflash_t *pfl = opaque;
 474
 475     pflash_write(pfl, addr, value, 4);
 476 }
 477
 478 static CPUWriteMemoryFunc *pflash_write_ops[] = {
 479     &pflash_writeb,
 480     &pflash_writew,
 481     &pflash_writel,
 482 };
 483
 484 static CPUReadMemoryFunc *pflash_read_ops[] = {
 485     &pflash_readb,
 486     &pflash_readw,
 487     &pflash_readl,
 488 };
 489
 490 /* Count trailing zeroes of a 32 bits quantity */
 491 static int ctz32 (uint32_t n)
 492 {
 493     int ret;
 494
 495     ret = 0;
 496     if (!(n & 0xFFFF)) {
 497         ret += 16;
 498         n = n >> 16;
 499     }
 500     if (!(n & 0xFF)) {
 501         ret += 8;
 502         n = n >> 8;
 503     }
 504     if (!(n & 0xF)) {
 505         ret += 4;
 506         n = n >> 4;
 507     }
 508     if (!(n & 0x3)) {
 509         ret += 2;
 510         n = n >> 2;
 511     }
 512     if (!(n & 0x1)) {
 513         ret++;
 514         n = n >> 1;
 515     }
 516 #if 0 /* This is not necessary as n is never 0 */
 517     if (!n)
 518         ret++;
 519 #endif
 520
 521     return ret;
 522 }
 523
 524 pflash_t *pflash_register (target_phys_addr_t base, ram_addr_t off,
 525                            BlockDriverState *bs,
 526                            uint32_t sector_len, int nb_blocs, int width,
 527                            uint16_t id0, uint16_t id1,
 528                            uint16_t id2, uint16_t id3)
 529 {
 530     pflash_t *pfl;
 531     int32_t total_len;
 532
 533     total_len = sector_len * nb_blocs;
 534     /* XXX: to be fixed */
 535 #if 0
 536     if (total_len != (8 * 1024 * 1024) && total_len != (16 * 1024 * 1024) &&
 537         total_len != (32 * 1024 * 1024) && total_len != (64 * 1024 * 1024))
 538         return NULL;
 539 #endif
 540     pfl = qemu_mallocz(sizeof(pflash_t));
 541     if (pfl == NULL)
 542         return NULL;
 543     pfl->storage = phys_ram_base + off;
 544     pfl->fl_mem = cpu_register_io_memory(0, pflash_read_ops, pflash_write_ops,
 545                                          pfl);
 546     pfl->off = off;
 547     cpu_register_physical_memory(base, total_len,
 548                                  off | pfl->fl_mem | IO_MEM_ROMD);
 549     pfl->bs = bs;
 550     if (pfl->bs) {
 551         /* read the initial flash content */
 552         bdrv_read(pfl->bs, 0, pfl->storage, total_len >> 9);
 553     }
 554 #if 0 /* XXX: there should be a bit to set up read-only,
 555        *      the same way the hardware does (with WP pin).
 556        */
 557     pfl->ro = 1;
 558 #else
 559     pfl->ro = 0;
 560 #endif
 561     pfl->timer = qemu_new_timer(vm_clock, pflash_timer, pfl);
 562     pfl->base = base;
 563     pfl->sector_len = sector_len;
 564     pfl->total_len = total_len;
 565     pfl->width = width;
 566     pfl->wcycle = 0;
 567     pfl->cmd = 0;
 568     pfl->status = 0;
 569     pfl->ident[0] = id0;
 570     pfl->ident[1] = id1;
 571     pfl->ident[2] = id2;
 572     pfl->ident[3] = id3;
 573     /* Hardcoded CFI table (mostly from SG29 Spansion flash) */
 574     pfl->cfi_len = 0x52;
 575     /* Standard "QRY" string */
 576     pfl->cfi_table[0x10] = 'Q';
 577     pfl->cfi_table[0x11] = 'R';
 578     pfl->cfi_table[0x12] = 'Y';
 579     /* Command set (AMD/Fujitsu) */
 580     pfl->cfi_table[0x13] = 0x02;
 581     pfl->cfi_table[0x14] = 0x00;
 582     /* Primary extended table address (none) */
 583     pfl->cfi_table[0x15] = 0x00;
 584     pfl->cfi_table[0x16] = 0x00;
 585     /* Alternate command set (none) */
 586     pfl->cfi_table[0x17] = 0x00;
 587     pfl->cfi_table[0x18] = 0x00;
 588     /* Alternate extended table (none) */
 589     pfl->cfi_table[0x19] = 0x00;
 590     pfl->cfi_table[0x1A] = 0x00;
 591     /* Vcc min */
 592     pfl->cfi_table[0x1B] = 0x27;
 593     /* Vcc max */
 594     pfl->cfi_table[0x1C] = 0x36;
 595     /* Vpp min (no Vpp pin) */
 596     pfl->cfi_table[0x1D] = 0x00;
 597     /* Vpp max (no Vpp pin) */
 598     pfl->cfi_table[0x1E] = 0x00;
 599     /* Reserved */
 600     pfl->cfi_table[0x1F] = 0x07;
 601     /* Timeout for min size buffer write (16 µs) */
 602     pfl->cfi_table[0x20] = 0x04;
 603     /* Typical timeout for block erase (512 ms) */
 604     pfl->cfi_table[0x21] = 0x09;
 605     /* Typical timeout for full chip erase (4096 ms) */
 606     pfl->cfi_table[0x22] = 0x0C;
 607     /* Reserved */
 608     pfl->cfi_table[0x23] = 0x01;
 609     /* Max timeout for buffer write */
 610     pfl->cfi_table[0x24] = 0x04;
 611     /* Max timeout for block erase */
 612     pfl->cfi_table[0x25] = 0x0A;
 613     /* Max timeout for chip erase */
 614     pfl->cfi_table[0x26] = 0x0D;
 615     /* Device size */
 616     pfl->cfi_table[0x27] = ctz32(total_len) + 1;
 617     /* Flash device interface (8 & 16 bits) */
 618     pfl->cfi_table[0x28] = 0x02;
 619     pfl->cfi_table[0x29] = 0x00;
 620     /* Max number of bytes in multi-bytes write */
 621     /* XXX: disable buffered write as it's not supported */
 622     //    pfl->cfi_table[0x2A] = 0x05;
 623     pfl->cfi_table[0x2A] = 0x00;
 624     pfl->cfi_table[0x2B] = 0x00;
 625     /* Number of erase block regions (uniform) */
 626     pfl->cfi_table[0x2C] = 0x01;
 627     /* Erase block region 1 */
 628     pfl->cfi_table[0x2D] = nb_blocs - 1;
 629     pfl->cfi_table[0x2E] = (nb_blocs - 1) >> 8;
 630     pfl->cfi_table[0x2F] = sector_len >> 8;
 631     pfl->cfi_table[0x30] = sector_len >> 16;
 632
 633     return pfl;
 634 }